feat: cursorless UI automation — no-cursor click/type on macOS and Windows#43

Open

richard-devbot wants to merge 28 commits intoCursorTouch:mainfrom

richard-devbot:richardson/cursorless-automation

Commits on Apr 19, 2026

Add security hardening design doc and roadmap

authored and
Richardson Gunde
committed
Replace os.system() with subprocess.run() for safe process spawning

authored and
Richardson Gunde
committed
Add bandit, gitleaks, pip-audit, coverage to CI pipeline

authored and
Richardson Gunde
committed
Add AI_PRINCIPLES.md and operator_use/guardrails/ module

authored and
Richardson Gunde
committed
Add security and e2e test suite scaffolds

authored and
Richardson Gunde
committed
Update uv.lock for new dev dependencies (bandit, pip-audit, pytest-cov)

authored and
Richardson Gunde
committed
Fix Qodo review findings: browser classification, path containment, CI cache

authored and
Richardson Gunde
committed
Fix CI failures: bandit, gitleaks org license, pip-audit CVEs

authored and
Richardson Gunde
committed
Fix path traversal in resolve() — use is_relative_to() not startswith() [#14]

authored and
Richardson Gunde
committed
Sanitize download filename and URL scheme [#15]

authored and
Richardson Gunde
committed
Fix XPath injection — escape all dangerous chars in JS string context [#16]

authored and
Richardson Gunde
committed
Update test_utils to match secure resolve() behavior [#14]

authored and
Richardson Gunde
committed
Block sensitive JS API access in browser script action [#18]

authored and
Richardson Gunde
committed
Fix download to use sanitized filename and enforce 100MB size limit [#15]

authored and
Richardson Gunde
committed
Add XPath syntax validation before escaping [#16]

authored and
Richardson Gunde
committed
Add symlink, unicode, null byte traversal vectors to security tests [#14]

authored and
Richardson Gunde
committed
Remove unused tempfile import [#14]

authored and
Richardson Gunde
committed
docs: cursorless UI automation design doc and implementation plan

Richardson Gunde
authored and
Richardson Gunde
committed
feat(macos): cursorless click via InvokePattern with coordinate fallback

authored and
Richardson Gunde
committed
fix(macos): add debug logging and False-invoke fallback to cursorless click

authored and
Richardson Gunde
committed
feat(macos): cursorless type via ValuePattern.SetValue with coordinate fallback

authored and
Richardson Gunde
committed
feat(windows): cursorless click via InvokePattern with coordinate fallback

authored and
Richardson Gunde
committed
feat(windows): cursorless type via ValuePattern.SetValue with coordinate fallback

authored and
Richardson Gunde
committed
fix: bump aiohttp/cryptography for CVEs, suppress bandit B310 [ci]

authored and
Richardson Gunde
committed
fix: update test_utils to expect PermissionError for absolute paths [ci]

authored and
Richardson Gunde
committed
fix: remove duplicate pytest import in test_utils (ruff F811)

Richardson Gunde
authored and
Richardson Gunde
committed
fix: update test imports for refactored tools paths [ci]

Richardson Gunde
authored and
Richardson Gunde
committed
fix: fix remaining test_agent.py and e2e imports for refactored tools [ci]

Richardson Gunde
authored and
Richardson Gunde
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: cursorless UI automation — no-cursor click/type on macOS and Windows#43

feat: cursorless UI automation — no-cursor click/type on macOS and Windows#43
richard-devbot wants to merge 28 commits intoCursorTouch:mainfrom
richard-devbot:richardson/cursorless-automation

Commits on Apr 19, 2026

Add security hardening design doc and roadmap

Replace os.system() with subprocess.run() for safe process spawning

Add bandit, gitleaks, pip-audit, coverage to CI pipeline

Add AI_PRINCIPLES.md and operator_use/guardrails/ module

Add security and e2e test suite scaffolds

Update uv.lock for new dev dependencies (bandit, pip-audit, pytest-cov)

Fix Qodo review findings: browser classification, path containment, CI cache

Fix CI failures: bandit, gitleaks org license, pip-audit CVEs

Fix path traversal in resolve() — use is_relative_to() not startswith() [#14]

Sanitize download filename and URL scheme [#15]

Fix XPath injection — escape all dangerous chars in JS string context [#16]

Update test_utils to match secure resolve() behavior [#14]

Block sensitive JS API access in browser script action [#18]

Fix download to use sanitized filename and enforce 100MB size limit [#15]

Add XPath syntax validation before escaping [#16]

Add symlink, unicode, null byte traversal vectors to security tests [#14]

Remove unused tempfile import [#14]

docs: cursorless UI automation design doc and implementation plan

feat(macos): cursorless click via InvokePattern with coordinate fallback

fix(macos): add debug logging and False-invoke fallback to cursorless click

feat(macos): cursorless type via ValuePattern.SetValue with coordinate fallback

feat(windows): cursorless click via InvokePattern with coordinate fallback

feat(windows): cursorless type via ValuePattern.SetValue with coordinate fallback

fix: bump aiohttp/cryptography for CVEs, suppress bandit B310 [ci]

fix: update test_utils to expect PermissionError for absolute paths [ci]

fix: remove duplicate pytest import in test_utils (ruff F811)

fix: update test imports for refactored tools paths [ci]

fix: fix remaining test_agent.py and e2e imports for refactored tools [ci]