v1.4.0 — Vision, Storage & DDC/CI

14 commits · 87 files · +5,158 −1,043 since v1.3.0

Feature release: vision subsystem complete, text-to-speech output, storage monitoring, DDC/CI monitor control, and community AT-SPI/audio fixes from @lz37 (#26).

👁️ Vision Element Detection (#41)

• 4960d0d — Completed vision.find_element with normalized cross-correlation, overlap suppression, coarse-to-fine matching for full-screen performance, and exact-coordinate refinement.
• 4960d0d — Completed vision.find_by_text with shared Tesseract TSV parsing and multi-word bounding boxes.
• 4960d0d — Completed vision.detect_state with color-region, text-presence, and template-presence checks.
• 17e42fa — Audited and hardened vision implementation.
• e99d7a2 — Trimmed vision dependency features.
• c82dc3d — Serialized environment-mutating tests for vision.
• Wired all three actions through protocol parsing, permissions, and MCP, including file-backed headless execution.
• Installer and CI now provision Tesseract plus English trained data.

🔊 Speech / Text-to-Speech

• 0c0ab15 — speech.speak / speech.stop / speech.voices — audible output channel via spd-say (speech-dispatcher) with espeak-ng fallback; engine, voice, rate, pitch, wait params; tracked children cancelled by speech.stop.
• Wired through protocol parse/serialize, daemon dispatch, system.health dependency checks, CLI, MCP, Python client, permissions, and docs.

💾 Storage Monitoring (#95)

• dd699ae — storage.usage / storage.scan — filesystem usage stats and directory scanning over Unix socket.

🖥️ DDC/CI Monitor Control (#60)

• 3daba41 — monitor.ddc_list, monitor.ddc_getvcp, monitor.ddc_setvcp, monitor.ddc_brightness, monitor.ddc_contrast, monitor.ddc_power, monitor.ddc_input — brightness, contrast, input source, and power state over I2C without compositor dependency. Backend-free dispatch pattern.

🛡️ Daemon Hardening

• 1be21ed — Whole-repository hardening audit.

🔧 Fixes

• e78ee9f — Corrected focused window detection (@lz37, #26).
• c09f438 — Repaired AT-SPI child resolution and property parsing (@lz37, #26).
• b8f4152 — Forced C locale for pactl; fixed volume parsing and default resolution (@lz37, #26).
• 0d78ade — Kept WiFi connect wait off async runtime.
• e386b40 — Fixed CI clippy: collapsible_if + range_contains.
• 6f68f47 — Cargo fmt.

v1.3.0 — REPL, Power Profiles & Environment Control

22 commits · 60 files · +6,680 −1,463 since v1.2.0

Feature release: interactive REPL mode, power management, locale/timezone/env control, presence system with push events, and batch security hardening from Vex review.

🖥️ Interactive REPL (#48)

• 6ba7a85 — deskbrid repl with rustyline loop, tab completion over 250+ action types. dry_run and timeout flags. Persistent history across sessions. Uses client::send_raw to dispatch arbitrary daemon actions without enum routing.

🔋 Power & Battery (#56, #57)

• 39712ec — power.profile.list/get/set over net.hadess.PowerProfiles D-Bus. Validates profile names, switches via Properties.Set. Permissions allow-list updated for the 3 actions.
• 34b488e — battery.threshold.get/set via sysfs (charge_control_start_threshold / charge_control_end_threshold). Vendor auto-detect (Lenovo vs Linux). Three convenience profiles: daily, travel, full. Graceful supported:false on unsupported hardware.

🌍 Locale & Timezone (#127)

• b19b14f — locale.get/set — reads resolve from process env + /etc/locale.conf. Reports source per key. Writes target /etc/locale.conf. Path traversal rejected. Non-root fails cleanly with requires_root:true.
• b19b14f — timezone.get/set — reads /etc/localtime against /usr/share/zoneinfo, computes UTC offset + DST. Writes /etc/localtime symlink.
• 38f9c10 — locale.changed / timezone.changed push events via DBus PropertiesChanged signal monitors. Tokio monitors in daemon/locale_monitor.rs subscribe to org.freedesktop.locale1 and org.freedesktop.timedate1. Initial value seeded at startup to avoid spurious events.

📝 Environment Variables (#116)

• 75d6a69 — env.get/set on daemon's process environment. Returns {found, value, kind, byte_len} for one var or {vars, count, non_utf8_count} for all. Validates names (rejects empty, =, NUL).
• 6bb7845 — env.persist/unset/list_persisted — writes to ~/.config/environment.d/deskbrid.conf (systemd user-session standard, no root). Atomic writes (tmp file + rename). Preserves existing keys not in the request. Reads back with systemd-style \"/\\ un-escaping for round-trip correctness.

👤 Presence System (#39, #138)

• 4bffa9b — system.presence.get action: reads idle seconds via backend, returns {state, idle_seconds}. Background monitor polls idle every 5s, emits on state transitions.
• acd60f3 — Full presence spec: presence.returned (idle_duration_secs), presence.locked, presence.unlocked push events. PresenceSnapshot carries last_active (epoch) + locked fields. PresenceConfig action with runtime-editable idle/away thresholds. Logind LockedHint detection. PresenceStore on DaemonState for lock-free snapshot reads.

🕐 Time of Day (#40)

• 256d46f — system.time_of_day action with configurable sunrise/sunset times, business hours detection, uptime, boot time, day of week, hour of day.

👁️ Vision Action Stubs (#41)

• bd33c2c — vision.find_element, vision.find_by_text, vision.detect_state actions with protocol parsing, serialization, and stub execution handlers. Template matching and ML detection stubbed for future implementation.

🔒 Vex Security Hardening

• 0589c29 — Batch 1: atomic locale/tz writes, dashboard auth, TOCTOU fix, PSK redaction, macro secret redaction.
• 7bf9c89 — Batch 2: DBus validation, OS guard, global rate bucket, audit regression tests, sweeper abort handle.
• 55f0f6a — Batch 3: ENV_LOCK serialization, rate limit validation, CSP header.
• 84900da — Batch 4: rule cycle detection, monitor reconnect, SSE per-IP cap, 12 assorted hardening items.
• b02435a — All findings addressed: W8 clipboard redaction, W13 /tmp fallback, W24 nmcli stdin password, W26 env-configurable rule depth, W27 macro bounds, remaining V1 findings.

🧹 Housekeeping

• 490f8af — Quill docs update
• d0adef5 — Removed all 4 code review artifacts
• 3f6dc72 — Cargo fmt formatting

v1.2.0 — Sandboxed Profiles & Auto-Suspend

Tuck · 19 commits · 147 files · +14,089 −1,894

Agent safety release. Named sandboxed profiles with allow/deny/confirm gates. Auto-suspend system with dangerous command blocking, burst detection, and heartbeat canary suspension. Agent registry and distributed lock primitives. Screen region watching with text-change detection.

🛡️ Sandboxed Agent Profiles (#36)

• 90586be — Named [profile.NAME] blocks in permissions.toml with allow/deny/confirm lists, audit levels, and profile-scoped rate buckets.
• 90586be — Session profile binding on session.create and connect. Profile checks narrow (never widen) UID permissions.
• 90586be — Profile confirmation requirements — actions can require explicit approval per profile.
• 90586be — PROFILE_DENIED error responses at four dispatch gates: direct action, implied action, process starts, and confirmation mode.

⚠️ Auto-Suspend Safety System (#38)

• 90586be — src/daemon/auto_suspend.rs — 216-line new module. Three suspension triggers:
  • Dangerous process commands: rm -rf, mkfs.*, fork bombs (:(){:|:&};:), dd if=
  • Suspicious action bursts: >10 windows.focus in 1s, >5 files.delete in 10s
  • Heartbeat timeout canary: agents that miss registered heartbeat intervals get suspended
• 90586be — AgentSuspended / AgentResumed events emitted. Suspension bypass for resume, list, agent get, and confirmations.
• 90586be — Configurable via [auto_suspend] block in permissions.toml (enabled, suspend_on_heartbeat_timeout, suspend_actions).

🤝 Agent Coordination

• fb45875 — Agent registry: session and agent tracking, heartbeat registration, timeout sweeper.
• fb45875 — Distributed lock primitives: acquire/release with token-based ownership. Token mismatch checking prevents one agent releasing another's lock.

👁️ Screen Region Watching

• c6b213a — daemon/region_watch.rs (722 lines): screen region monitoring with text-change detection, debounced via DEFAULT_STABLE_DURATION_MS. Async-correct, zero blocking calls.

🧪 Testing Infrastructure

• 6f13e8d — Mock backend for protocol testing — enables zero-dependency daemon tests without a running desktop.
• 990d9a5 — Isolated daemon persistence tests — no shared on-disk DB between test runs.

🐛 Fixes

• 9fafc41 — Fix blocking std::fs::write in async context (cmd/update/github.rs:68). Caught by Claude (Sonnet 5) pre-release review.
• 723f39e — Fix GitHub Actions workflow cleanup: add missing actions:write permission, run daily.
• ad24de2 — Fix MCP Registry duplicate version rejection (bump required before republish).
• 56556f4 — Fix MCP tools/list returning empty — root cause was two bugs in tool registration.
• e1155fd — Fix code review findings.

📝 Docs & Polish

• 928caaa, bb0de0d, 1912c85, d34bb94 — Hermes MCP integration skill, LobeHub badge, README sections.
• 59ea607, 37157b9 — Quill: docs and wiki updates.
• 5332720 — ROADMAP: mark items #36 and #38 as ✅ Done.

v1.1.0 — Security Hardening

Tuck · 18 commits · 98 files · +3,756 −1,812

Vex v2 audit resolution + structural hardening. All 6 warnings + 1 bonus resolved. Protocol refactored, lock ordering documented, DashMap migration, unreachable elimination, a11y selector baseline framework.

🔒 Vex v2 Security Audit — 7/7 Resolved (CODE_REVIEW_VEX_V2.md)

• c3145d2 — B1: ui.tree.get removed from capabilities unsupported list (AT-SPI working). CDP reasons clarified.
• c3145d2 — W1: secret-tool stderr sanitized — logged server-side, "internal error" returned to clients.
• c3145d2 — W2+W3: Rules engine blocked from HIGH_RISK dispatch without confirmation (RULES_HIGH_RISK_BLOCKED error code). is_high_risk() made pub(crate).
• c3145d2 — W4: Rule dispatch depth counter (AtomicU32, cap 5 via MAX_RULE_DISPATCH_DEPTH) prevents infinite rule→action→event→rule cascades.
• c3145d2 — W5: Migration wrapped in BEGIN EXCLUSIVE/COMMIT transaction — crash mid-migration no longer corrupts schema version.
• c3145d2 — W6: Audit log parse_audit_params now emits tracing::warn! on malformed JSON instead of silent drop.

🏗️ Structural Hardening (#25)

• a6d8b03 — Protocol refactor: mod.rs split 1505→481 lines into domain files.
• bf1dc86 — DaemonState: Mutex<HashMap> → DashMap for lock ordering simplification.
• e8fb71d — docs/CONTRIBUTING.md + lock ordering documentation added.
• 5885efb — All unreachable!() panics eliminated from non-test code.
• d1c1ad5 — MCP rate limiting, session cleanup, backend lock scope reduction.

🐛 Fixes

• 0831edf, 44e2148 — Flaky audit persistence tests fixed with WAL checkpoint pattern.
• 5a30bb2 — Dual DaemonState bug + MCP TCP auth gap + dashboard 0.0.0.0 bind fix.
• 39552a3, 92be69d — ydotool Enter key fix (numeric code 28 pipe workaround).

♿ A11y Selector Framework

• e7ffed5 — Auto-normalization for same-group role remaps across compositors.
• d81955c — Per-compositor selector baselines with LOUD failure detection.

🌐 Site

• 03ed1d3 — v2 landing page redesign.

v1.0.0 — First Stable Release

Tuck + Scout + Vex · 60 commits · 134 files · +18033 −4310

Production-ready release: DB-backed persistence, rules engine, keyring, rate limiting, pressure monitoring, and a hardened security model with Vex audit remediation. Every core subsystem hardened with tests, explicit error handling, and clear boundaries.

🏗️ DB as Source of Truth (#84)

• a0a7e32 — SQLite schema migrations, PRAGMA user_version, synchronous writes via tokio::sync::Mutex + spawn_blocking. 23 new tests.
• 7c0b191 — Scout's v1.0.0 release notes and changelog.

⚙️ Rules Engine v1.0.0 (#83)

• 4cefad6 — Split rules/eval.rs (454→218) into matching/timerange/engine modules. TimeRange timer, VarEquals/VarExists conditions, app_id resolution from window list.

🔑 Keyring/Secrets (#29)

• Secret-tool executor, protocol actions, MCP tools, CLI subcommand, dashboard card, confirmation-gated access. ~500 lines.

🚦 Rate Limiting (#129)

• Per-namespace, per-UID token buckets. 8 namespaces, permissions.toml config, wildcard 120/min, UID isolation. +285 lines.

📊 System Pressure/PSI (#96)

• /proc/pressure/{cpu,memory,io} monitoring, dashboard card, unit tests. ~100 lines.

📋 Provider Manifest (#135)

• 681b8b8 — capabilities.list now exposes high_risk actions, sandbox dirs, transport constraints, and permissions model. Enables orchestrator integration (Monadix, etc.). +37 lines.

🔒 Vex Security Audit — 37/37 Resolved

• 2233902 — C1/C2: Dashboard bound to 127.0.0.1 by default.
• 4c891f8 — C3/W9: Confirmation ownership check + backend-free routing.
• 3c05555 — C4: Prevent macro recording of secrets/clipboard/process actions.
• bcdc197 — W1/W2/W14: Default-deny permissions, expanded HIGH_RISK_ACTIONS (21 actions), release artifact naming fix.
• 7e67061 — W6/W7: Hard-fail on missing checksum, verify in install.sh.
• f44befb — W10/W11: Bound TCP+dashboard reads, constant-time token compare, connection cap.
• 26aef22 — W12: Switch DB Mutex from std::sync to tokio::sync.
• 0738b0d — W3/W4/W5: Path sandbox for files.search/watch, secure screenshot paths.
• a5eddfa — W8/W13: Clipboard history opt-out, HOME /root fallbacks.
• 599498d — W18-W23: Deploy script hardening, mcp-publisher pin, rustls, CI gates.
• f905848 — W15/W16/W17: Fix docs — bare binary URL, version mismatches, CLI names.
• 2398aa8 — W24/W25/W26: WiFi password via stdin, fix allowlist comment, reject nested dbus arrays.
• 6f96f22 — S1/S2: Wire remove_peer, add stale sweep, graceful socket path fallback.
• 33621e6 — S3/S4/S5/S6/S7: Capped read_line, Python tests, unwrap audit, egg-info cleanup.
• f21d58d — Vex review summary updated — 37/37 resolved.

🔨 Refactoring

• ec77126 — Split protocol/types.rs (265→209) into common/envelope modules.
• d97a9dd — Split daemon/helpers.rs (329→186) into paths/process/responses.
• 8725836 — Split mcp/types.rs (696→120) into 5 domain modules.

📝 Documentation

• 7d69b7b — Recover 7 deleted design docs from git history (10K lines) → docs/archive/.
• 0f8bedd — permissions.example.toml with all actions, presets, high-risk ★ markers.
• 8468c1b — Archive Vex review, Scout changelog, permissions example into docs/.
• 6a468b8 — Scout's rate limiting design spec.
• f0071b4 — Scout's v1.0.0 test plan.
• 8e3db22 — Fix v1.0.0 doc version strings, add security/pressure/permissions sections.
• ba45008–c1a3c71 — Fix broken docs links, PatchHive relationship, ecosystem references.

🐛 Fixes

• bd72132 — Stable /tmp path in expand_path test.
• f3ac61d — Remove invalid needs: ci from release workflow.
• 2837a64 — Remove duplicate use super::* in paths.rs tests.
• 503fabe — Drop state before creating state2 in test to ensure WAL checkpoint.
• d7e3e7d — CI: install libpipewire-0.3-dev for --all-features builds.

v0.13.0 — Action Confirmation, Agent Messaging, Unified Search

Tuck · 8 commits · 32 files · +1197 −20

Three major features: destructive-action gating, inter-agent communication, and cross-surface search — all with live dashboard cards, MCP tools, and background TTL sweeping.

🛡️ Action Confirmation Mode (#37)

• b98e37e — Protocol core: 9 new action variants (confirmation.*, agent.*, search.*), parse modules, execute handlers, dispatch gating. Pending confirmations queue in DaemonState with require_confirmation flag on destructive actions.
• 096ce65 — MCP tools: confirm, deny, list (confirmation); send, broadcast, mailbox (agent); search, index (search). 8 new tools wired via block_state and $crate macros.
• 1a091e2 — Dashboard: three new SSE cards — confirmation queue, agent mailbox, search index.
• 216f58c — Background sweeper: spawn_confirmation_sweeper() runs every 30s, purges confirmations older than 5min. Wired at daemon startup.

📬 Agent-to-Agent Messaging (#44)

• b98e37e — In-process HashMap<SessionId, Vec<AgentMessage>> mailbox with TTL-based expiry.
• 0544142 — TTL cleanup: is_expired() prunes on store and get_for(). Messages expire after configurable TTL.
• 096ce65 — MCP: agent.send, agent.broadcast, agent.mailbox tools for inter-session messaging.

🔍 Unified Search (#80)

• b98e37e — SearchIndex struct in DaemonState indexing windows, apps, files, clipboard, and audit log with relevance scoring.
• 0544142 — Async safety: std::fs::read_dir → tokio::fs::read_dir with async iteration. Scope documented as v1 (4 directories).
• 8f8b203 — Protocol fix: MCP tools used wrong prefix unified.* → corrected to search.* (wire format from action_type.rs).

🧹 Fixes

• 0544142 — Claude review: blocking read_dir eliminated, TTL sweepers added for both confirmation queue and agent mailbox.
• 87b84c8 — Leftover cargo fmt from protocol core commit (7 files missed in original add).
• 07e4aa9 — Agent file refresh: AGENTS.md, CLAUDE.md, hermes skill updated for new features.

v0.12.3 — OCI Docker + MCP Registry

Tuck · Dockerfile label + ghcr.io push + OCI package

Switch from MCPB (broken async verification) to OCI. Docker image pushed
to ghcr.io with io.modelcontextprotocol.server.name label for ownership
verification. Release workflow builds and pushes Docker on every tag.

v0.12.3 — OCI Docker + MCP Registry

Tuck · Dockerfile label + ghcr.io push + OCI package

Switch from MCPB (broken async verification) to OCI. Docker image pushed
to ghcr.io with io.modelcontextprotocol.server.name label for ownership
verification. Release workflow builds and pushes Docker on every tag.

v0.12.3 — OCI Docker + MCP Registry

Tuck · Dockerfile label + ghcr.io push + OCI package

Switch from MCPB (broken async verification) to OCI. Docker image pushed
to ghcr.io with io.modelcontextprotocol.server.name label for ownership
verification. Release workflow builds and pushes Docker on every tag.

v0.12.2 — MCP Registry Publishing

Tuck · 1 commit · 3 files · server.json + publish workflow

Publish Deskbrid to the official MCP Registry. Rename release tarballs to include
"mcp" for MCPB allowlist compatibility. Auto-compute SHA-256 in publish workflow.