Agent Desktop

Least privilege is handled thoroughly: CI begins with no permissions and grants narrow job-level access, plain permission checks do not prompt, permission requests use an isolated helper, ref actions are headless by default, and physical input or notification mutations require explicit headed mode. User confirmation is reduced because launching or closing applications, keyboard input, clipboard changes, and most mutations do not require per-action confirmation once invoked. Data flows are documented well, including session paths, JSONL traces, screenshot-bearing HTML exports, output-path behavior, and the loopback-only CDP endpoint with an explicit warning that other local user processes can reach it. Sensitive-data handling is adequate but incomplete: full traces are identified as screenshot-equivalent, while no general redaction, encryption, retention, or secure-erasure policy is shown. Dependency security has strong static controls through locked Cargo operations, commit-pinned Actions, CodeQL, and private vulnerability reporting, though no dependency-vulnerability scan result is supplied. External effects, headed behavior, force-close semantics, notification fingerprints, and actionability checks are explicit. Rollback is thin: recovery generally means re-observing, using idempotent commands, or relying on the target application's undo facilities; recoverable trashing appears only in a test workflow. Repository and package origin, licensing, and the reporting channel are identifiable, but the publisher is unverified and no named maintainer or organization is established.

The README, Cargo metadata, and CI agree closely on the Rust requirement, version, platform scope, FFI contract, permissions, and release artifacts. CI also checks release consistency, multiple platforms, units, binaries, and FFI failure boundaries. Dependency availability is documented through npm, npx, source builds, and release binaries, but functional desktop automation is currently macOS-only, while Linux and Windows remain planned; the supplied evidence also omits Cargo.lock and installer implementation. Failure communication is thorough, with structured JSON, error and exit-code contracts, recovery hints, STALE_REF, AMBIGUOUS_TARGET, ACTION_NOT_SUPPORTED, ACTION_FAILED, and explicit permission states. No deduction was made merely because these paths were not executed in this static review.

The documentation addresses AI-agent loops, simple and dense applications, shared or independent agent sessions, FFI consumers, and mixed accessibility/CDP automation with concrete workflows. Capability boundaries are unusually explicit: macOS support versus planned platforms, semantic versus physical actions, headless versus headed operation, reserved unsupported held-input commands, and the fresh-launch requirement for CDP. Trigger precision is strong because snapshots and refs are namespace-scoped, actions run preflight checks, ambiguous matches fail closed, and notification mutations require a prior fingerprint. Environment fit is reduced because practical desktop operation currently requires macOS 13+ and Accessibility permission; Linux and Windows have crates, CI checks, and FFI artifacts, but their product features remain planned.

The repository presents a clear hierarchy covering architecture, installation, permissions, agent workflows, command groups, JSON contracts, refs, platforms, development, and FAQ material. Installation guidance covers npm, npx, source compilation, runtime prerequisites, and OS permissions. Naming and compatibility are well specified through qualified refs, explicitly pinned legacy refs, reserved command names, and ABI-major verification. Examples span the main operations and recovery paths, with a dedicated FAQ referenced. Limitations are candidly stated, including platform gaps, reserved commands, headed side effects, CDP exposure, session concurrency concerns, and a known FFI coverage gap. Apache-2.0 metadata matches the complete license. Version metadata, release links, and consistency checks exist, but no changelog or defined compatibility lifecycle appears in the supplied files. SECURITY.md assigns reporting scope and a general maintainer response, yet it does not identify maintainers, response targets, governance, or succession.

Versioned structured JSON, error recovery hints, snapshot-qualified refs, progressive traversal, batching, condition waits, and readable traces make outputs highly usable by agents. Accessibility trees, semantic references, native desktop surfaces, and optional CDP provide substantial value beyond screenshot or pixel-driven automation. Cost-benefit is reduced because the stated 78–96% and 97% token savings are not backed by included result data, and practical use carries macOS permission costs, accessibility-quality dependence, and headed-mode side effects.

Many claims map to concrete command contracts, configuration, CI jobs, and test harnesses, including isolated permission behavior, FFI panic containment, version consistency, bounded process output, and the platform matrix. Traceability is not complete because referenced detailed documentation, implementation files, Cargo.lock, and actual test results are absent, while quantitative token-saving claims lack primary data in the supplied material. Cross-source corroboration is strong: README, Cargo.toml, SECURITY.md, workflows, and test scripts reinforce one another on versions, permissions, safety boundaries, and test scope. Facts and projections are usually separated with labels such as Planned and Phase 1 and with an explicit FFI coverage note, but broad statements such as “works with any app” and the savings percentages are not locally qualified by sufficient evidence.