The live checks in #42 need an unlocked Mac. npm run live-check runs the ones that can be automated, through the same MCP server (dist/mcp.js) and host that agents use:
npm run live-check # the installed app
npm run dev-app # build and open the development app (see build.md)
DESKTOP_TOOLS_STATE=~/.local/state/desktop-tools-dev npm run live-check -- --only 82,88
npm run live-check -- --list # list the checks without running them
npm run live-check -- --json /tmp/live.json
It drives the installed Desktop Tools, or the dev app whose state folder DESKTOP_TOOLS_STATE names. Use npm run dev-app for the dev app, never a copy launched from a build folder. That app must already allow the harness’s caller, the terminal or agent that runs npm run live-check, as it would any agent (see approved agents); otherwise the harness stops before opening anything and says so. Each check prints PASS, FAIL or SKIP with its evidence, and a summary groups them by PR. The exit status is 1 when any check fails, and 2 when nothing could run.
What it touches:
/tmp/desktop-tools-live-* folder: a plain and a rich TextEdit document, a Finder folder of eight files and a subfolder, a PNG, and a web page with a React-style controlled input, a date input, a contenteditable, a table with <th> headers and a grid of inputs. The folder is removed at the end unless --keep-fixtures is passed.desktop_open, and acts only on the new windows. At the end, even after a failure or Control-C, it closes each window it opened and quits only the apps it launched itself. A fixture document that asks to save is answered with Delete or Don’t Save, on that document only.--user-data-dir), with --no-first-run and --no-default-browser-check. They run alongside a Chrome the user already has open, never touch its windows, and quit only the process they started before deleting its profile, so each check starts with web accessibility off. They are skipped when Google Chrome isn’t in /Applications or ~/Applications./usr/bin/perl, which the app asks you about once, and while that prompt is open check that input to a fixture window is refused too. The harness waits up to two minutes for you to answer; choose Don’t Allow, and later runs only check that perl is still refused. If you allowed perl, the check is skipped until you choose Forget for it under Approved Agents. They are skipped on a host that doesn’t approve callers.desktop_system_key (#89) use the real keyboard and pointer, as they always do; nothing else needs the foreground.These stay manual, because they are destructive, change system settings, need a second display, Space or password, or need an app or account the harness can’t create:
unknown.other_space: each needs a second Space.retried: true.clipboard: "replace" into Slack or a browser, Mail and Notes, a 10 MiB TIFF, and clipboard read access set to Ask.claude-code for Claude Code), and a refusal after Revoke. Only the user answers the app’s prompts and menus, so these stay manual.web_accessibility is enabled, with web_accessibility_via manual, once per launch and the web content’s fields are listed, that the app’s window still moves and resizes normally, that All Activity lists Turn on web accessibility once, and that it still runs while input is paused.AXEnabled, with and without the host’s background key-window preparation; (2) does an Accessibility press of Edit > Paste paste into the focused textarea; (3) must the textarea get AXFocused first?