What changed

• add the built-in cross-platform local confirmation card and persistent Stop indicator for standard and bounded protected actions
• expose the collector assurance as same_desktop_best_effort, and document that ordinary same-desktop UI is not a secure-desktop or biometric boundary
• preserve session-scoped browser authority and advertise active operation-sensitive enforcement truthfully
• fix the three repeated GNOME Wayland certification failures: libei drag pacing, Electron child-window focus posture, and high-DPI Chrome fixture geometry
• make bounded manifests the preferred documented path for authenticated browser automation
• add a concise 0.12.x to 0.13.0 migration section, including the cursor-theme breaking change
• document the consent flow with the final branded UI image

Why

Standard mode previously failed closed without a host confirmation provider, while the authorization status and browser tool discovery did not consistently describe the exact runtime enforcement. The release also still carried three reproducible GNOME Wayland certification failures.

The native confirmation surface gives standalone interactive CLI/MCP users a visible, request-bound approval and revocation flow. Its assurance is intentionally labeled as best-effort because another process that can operate the same desktop may activate ordinary desktop UI.

Final validation

Validated from source commit 806da8573cb8d46cb52b38dccc21bbc449f1ecf1.

• macOS: branded confirmation, Allow once, persistent Stop indicator, revocation and re-prompt, explicit decline, and a real Codex client completing a remote MCP list_windows call after local approval
• Windows interactive desktop: 127/127 E2E cases passed, with 102 delivered actions, 25 expected refusals, and 0 failures
• Linux GNOME Wayland: standalone multi-tab browser, foreground pixel drag, and background AX Electron child-window cases all passed
• semantic cursor video covers idle, move, observe, click, drag, scroll, type, hotkey, and key states
• cargo test -p overlay-ui: 15/15 passed
• authorization tests: 33/33 passed
• consent tests: 10/10 passed
• public docs formatting, internal-link checks, hygiene scan, and production build passed
• all required GitHub checks passed, including release metadata

Recordings

macOS semantic cursor states

Linux GNOME Wayland Electron child window

Closes #2594