v4.7.0

4.7.0 - 2026-09-29

Highlights: Fix the 4.6.0 CLI startup failure on Macs without the macOS 27 runtime, add GPT-6 Astra, Sol, and Luna plus GPT-6.1 Sol models, keep unattended clipboard reads from triggering macOS privacy prompts, give MCP and JSON clients structured element tables, focused text selection, and visible display bounds, and make compatible-provider Agent streaming reliable.

• Keep CLI builds on Swift Collections 1.6.0 and reject unsupported strong borrowing-runtime imports in release artifacts, preventing the 4.6.0 startup failure on supported Macs without the macOS 27 runtime. Thanks @changexbc and @jandubois! #831.
• Add GPT-6 Astra, Sol, and Luna selection through Tachikoma, preserving the chosen tier and 128K output allowance for native and compatible agent routes, and omitting unsupported temperature controls on reasoning routes.
• Add GPT-6.1 Sol selection through Tachikoma, retaining its 128K output allowance on native and compatible Agent routes and validating its supported reasoning settings.
• Refuse unattended clipboard reads before macOS privacy prompts, including Agent context and current-clipboard paste; share read admission with temporary writes, preserve retry-unsafe writes when readback is unavailable, and add content-free clipboard status plus explicit manual CLI --allow-prompt opt-in.
• Preserve newer user or application clipboard updates during CLI and MCP paste cleanup, including cancellation and partial-write failures; require silent clipboard-read access and complete prior contents before replacement, restore only while the temporary generation is owned, and retain earlier clipboard effects when input is refused.
• Add opt-in include_elements to the see and inspect_ui MCP tools, returning the element table as structured _meta.ui_elements (same fields as see --json) with its snapshot_id, so clients can act on element IDs without parsing the text summary; default responses are unchanged. Thanks @gxcsoccer.
• Expose bounded, privacy-checked focused text selection as UTF-16 ranges in CLI JSON and MCP/Agent observations; consolidate native range decoding and preserve the existing signed receipt shape.
• Include full visible work-area bounds in screen list JSON and its origin in human output, reusing global logical coordinates while preserving the existing display and visible-size fields.
• Apply the saved Dock preference before promoting the Mac app at startup, keeping Menu bar only launches in accessory mode on macOS 27 while preserving unattended Bridge-host behavior. Thanks @tobihagemann! #861.
• Update Chrome DevTools MCP to 1.10.1 with its per-server browser owner, preserving one-socket verification, telemetry isolation, redirect/reconnect refusal, and exact-page element routing; keep unprojected CSS response references unavailable.
• Update Tachikoma to 0.5.1 for cancellable provider streams, correct LM Studio tool-call history, and preserved numeric tool values, retaining Peekaboo's existing tool schemas and compatible dependency pins.
• Update Tachikoma to remove compatible streaming request dumps that could expose prompts/tool schemas and contaminate Agent JSON or quiet output, without changing provider requests or stream delivery.
• Preserve fragmented tool arguments in compatible-provider Agent streams, validate complete call batches before execution, and retain explicit empty no-argument calls along with existing terminal, schema, and background-authority safeguards.
• Restore the SDK Agent text-stream callback with exact text chunks and whitespace, separate from reasoning and tool events, while retaining model-specific terminal buffering and awaited cancellation-aware delivery.
• Preserve native scalar tool arguments in Agent provider schemas and preflight validation so set_value accepts Boolean and numeric values without string coercion; retain existing structured-schema compatibility and native safety checks.
• Skip discarded Agent progress-event rendering in JSON and quiet runs, share event completion/cancellation draining across task, resume, and audio execution, and remove the unused streaming-delegate adapter without changing provider selection, typed results, or safety metadata.
• Add content-free monotonic Agent provider and tool phase timings for performance diagnosis, preserving streaming selection, results, cancellation, and public output formats.
• Keep help, version, shell completions, and Agent dry-run output independent of configuration parsing, avoiding unnecessary startup reads and malformed-config warnings that corrupt JSON previews.
• Honor see --timeout for pixel-only, raw-output, area, and multi-window captures, sharing the remaining budget with the selected host and preventing late successful output after timeout or cancellation.
• Keep screenshot-free verify independent of capture-owner readiness and ambient capture-engine settings while preserving screenshot safety; clarify that --on matches an app's AXIdentifier or exact role and label, not snapshot-local element IDs.
• Avoid a redundant all-app inventory before verify final screenshots so unrelated app warnings cannot omit an exact-target image; preserve process-generation checks across permission waits and exact-window checks around capture.
• Honor classic capture for verify --screenshot on an explicitly selected compatible Bridge host, preserving optional-image failures, exact-target checks, and screenshot-free verification without extra permission probes.
• Resolve live exact-PID verification through targeted application lookup instead of repeatedly collecting every app's metadata; unrelated inventory warnings no longer block the target, while generation, incomplete-target and absence checks remain fail-closed.
• Verify positive element existence from the same exact-identifier evidence used for value matches when unrelated Accessibility reads fail; share witness validation while preserving unknown absence, ambiguity, truncated observations and target-drift checks.
• Explain authenticated producer-bound snapshot requirements when an explicit Bridge host cannot serve see, instead of suggesting the older protocol 1.26 publication capability is sufficient; preserve host trust and refusal behavior.
• Wait for native Accessibility text, value, and selection writes before dependent input; revalidate the exact receiver and edit state at dispatch, preserve accepted prefixes, and report cancelled pre-service Bridge operations without inventing input.
• Share background window-geometry sequencing across move, resize, set-bounds, and maximize: verify dependent position changes before resizing, skip unchanged components, and retain retry-unsafe accounting for accepted or uncertain native writes.
• Preserve Accessibility-value opt-out through background positional click fallback, and retain signed one-unit focus/selection results without upgrading unverified delivery to confirmed change.
• Preserve signed background coordinate-click results when native hit-testing uses AXPress, retaining exact-window receipts, one-action accounting, and unverified retry-unsafe outcomes.
• Preserve generation-pinned native hotkey targets through CLI and MCP results using the shared executor and sequence metadata; keep unverified chords retry-unsafe and never borrow a setup-focus receipt for an unattributed input leaf.
• Honor synthetic hotkey strategies for Cmd+A without AX selection or permission bypass, preserving the built-in focused-selection default and direct event fallback; keep explicit process-menu scope, exact-window guards, and truthful post-action failure delivery.
• Refuse exact-window actionOnly hotkeys before invoking an app-wide menu, preserving receipt-pinned actionFirst fallback, process-scoped menus, and truthful paste retry safety.
• Stop guessing unreadable menu-shortcut modifiers or enabled state in action-first keyboard input; preserve native read failures and shortcut order while reducing menu traversal to direct Accessibility child reads.
• Preserve signed background Cmd+A selection results and uncertain-write failures across process and exact-window Bridge routes using shared chord classification; retain concrete receipt-validation diagnostics without mistaking differing CLI/app build labels for a stale host.
• Withhold post-mutation native value evidence when security metadata is unreadable, preserving retry-unsafe uncertainty without replaying accepted writes; later readable samples can still confirm within the existing deadline.
• Reduce native AX round trips during exact-field observation by batching non-value identity metadata, preserving bounded individual-read compatibility, before/after validation, secure-field admission, deadlines, and retry-unsafe write outcomes.
• Add content-free debug measurements for slow, incomplete and fallback native AX reads without extra queries or changes to observation completeness, timeouts or stability requirements.
• Avoid executable-file probes when selecting background pointer delivery; inspect WebKit imports only for eligible native wheel targets, preserving exact-window safety checks.
• Reuse the server's immutable semantic plan for projected Bridge requests instead of rebuilding it before dispatch, preserving wrapper validation and signed receipt binding.
• Preserve Bridge request deadlines while socket work waits in its execution queue, refusing expired work before connecting without changing cancellation or dispatched-result semantics.
• Refuse conflicting explicit Bridge sockets and caller-local input-policy overrides before constructing local services or sending input; preserve explicit local opt-in, implicit policy-local routing, and concrete snapshot producer affinity.
• Honor live/action capture-engine overrides on explicitly selected capable Bridge hosts using verified inline pixels, preserving implicit caller-local overrides, default routing, and background focus; avoid redundant frontmost app inventories during observation.
• Validate contiguous typing dispatch counts with bounded ranges instead of repeatedly allocating and scanning arrays, preserving receipt acceptance and partial-failure semantics.
• Confirm daemon shutdown when its socket is gone and the process has exited but awaits parent reaping, avoiding false refusal/timeouts in synchronous automation; distinguish accepted shutdown timeouts from explicit refusals while preserving uncertain-state and probe-error safeguards.
• Include received modifiers, event/key-window identity, activation state, and text-selection metadata in Playground keyboard diagnostics so background shortcut tests can distinguish delivery from verified effects without changing input handling.
• Keep application-launch option tests from activating Finder by isolating their activation callbacks from the desktop.

Compatibility

• CLI clipboard get and clipboard save, plus clipboard set --verify readback, now refuse instead of showing the macOS clipboard privacy alert unless the reader already has silent access. Check peekaboo clipboard status, and use --allow-prompt only for an attended permission bootstrap; MCP and automatic Agent or paste reads cannot opt in.

Verification

• Source commit: f3c6b1b32528290a959244d1ac12d54af3d42928
• Release plan SHA-256: 942d1bcf1a668e80e7846ffd474bed04acc0b520dbcb728eb2a92bbea1e6f7c1
• Checksums SHA-256: 48e3cdefaf7c8795e73e713d38a43cc39e839435a0d948e1c44a3666d9b9aa93
• npm version: 4.7.0
• npm tarball: https://registry.npmjs.org/@steipete/peekaboo/-/peekaboo-4.7.0.tgz
• npm integrity: sha512-ggZl4vwf2X0bM295OixrDlXfcfF3vXd67xCnunIjsEJxmvQWlpkvRglz+oYi03CBIlln0DDCAfIXaKb8QI7WZw==
• npm published: 2026-10-03T22:34:03.114Z

Proof

Peekaboo 4.7.0 is built from the frozen source commit recorded in release-plan.json: f3c6b1b32528290a959244d1ac12d54af3d42928.

• Release preparation: chore(release): prepare Peekaboo 4.7.0 on main. Independent Codex P0–P2 review passed with no findings: all root changelog entries survive unchanged with contributor credits, the release notes equal the root 4.7.0 section, the CLI changelog is a consistent curated subset, and the highlights, README, and Compatibility note are supported by the entries. Deterministic prepare-release --dry-run passed version surfaces, both changelogs, documentation/source contracts, and CLI command/help/inventory contracts. SwiftFormat changed no files; documentation lint and the documentation site build passed.
• Included pull requests: #872 (Chrome DevTools MCP 1.10.1) and #873 (GPT-6.1 Sol selection) each landed only after their complete exact-head gates, including Swift CodeQL. #873 merged after the preparation commit, so its entry was moved into the 4.7.0 notes and highlights with a separate independently reviewed commit; the final notes carry 46 root and 23 CLI entries.
• The first publication preflight attempt, on the pre-#873 preparation commit, stopped before any packaging or public action: a test-only stdout capture helper in DialogDiscoveryCommandTests deadlocked on a full in-memory pipe, and a Playground fixture check prompted on a terminal for a read-only deletion. Both were fixed on main (test: keep release preflight tests from blocking on output or prompts), proven under a pseudo-terminal and by the dialog suite, reviewed, and the complete preflight reruns on this source.
• Native publication toolchain: Xcode 27.2 (27B5019j), Swift 6.4, macOS SDK 27.2, Node 26.10.0, pnpm 11.27.1, on macOS 27.0. Task-local toolchain selection; low-priority compilation.
• The publication driver runs the complete native preflight on the frozen source before packaging: formatting, lint, documentation contracts, safe script/artifact contracts, public SwiftPM consumer build, browser connection contracts, background certification, Foundation tests, CLI tests, and CLI command/help/inventory contracts. The standalone CLI is reused only after the driver re-verifies its Foundation signer, entitlements, native-only surface, runtime libraries, architectures, online notarization, and exact source commit.

Older-runtime qualification (#831)

4.6.0's CLI failed to launch on macOS 26 because it strongly imported _swift_initBorrow, which only the macOS 27 Swift runtime exports. The exact 4.7.0 CLI bytes were qualified before publication:

• Strong-import audit against the macOS 26.5 SDK's Swift runtime export lists, following re-exported libraries, for every architecture slice of the universal CLI (SHA-256 3d1a296c43f7e40ff13299180394fc87f2bbc3034431ab6e2bf4d3734d1cb25a) and the extracted arm64 and x86_64 archive binaries: 0 missing strong imports (arm64: 1,738 strong imports across 32 Swift runtime libraries; x86_64: 1,747), and no _swift_initBorrow reference in any slice.
• Positive control: the same audit on the published 4.6.0 arm64 binary reports exactly one missing strong import, _swift_initBorrow, matching the reporter's dyld failure.
• The only non-OS library dependency is libswiftCompatibilitySpan.dylib, shipped in every archive beside the binary and resolved through @loader_path.
• Every extracted archive, arm64 and x86_64 (via Rosetta), runs --version and --help successfully with all Xcode, Command Line Tools, and cryptex toolchain paths denied by a sandbox profile.
• Deployment target remains macOS 15.0; the artifact verifier also rejects any strong _swift_initBorrow import in every slice.

Exact-source hosted validation

• macOS CI: https://github.com/openclaw/Peekaboo/actions/runs/36668016753
• Swift/JavaScript/Actions analysis: https://github.com/openclaw/Peekaboo/actions/runs/36668016877
• Supplemental release validation: https://github.com/openclaw/Peekaboo/actions/runs/36668042302
• macOS 26 extracted-artifact smoke (hosted macOS 26 runner, Xcode 26.x build of the same source): https://github.com/openclaw/Peekaboo/actions/runs/36668045436

Coverage limits: no physical macOS 26 or macOS 15 machine executed the 4.7.0 bytes; the macOS 26 evidence is the SDK export audit plus the hosted smoke of a same-source build, and there is no macOS 15 SDK export audit. Eleven existing non-serious SwiftLint warnings remain (file/function length, parameter count, two long lines). No task-owned isolated desktop was available for live desktop/provider integration proof; synthetic certification and hosted tests are not claimed as live desktop proof.

Publication source: f3c6b1b32528290a959244d1ac12d54af3d42928. Publication requires successful completion of the linked exact-source workflows.