Nameplate

Why it's ranked here

Three implementations ship here, and they are not equal. The Mac side is the deep one: strict concurrency turned on across every target, window levels chosen so menus can still open above the overlay, delayed frame re-syncs because screen data lags a display change, and a fail-safe teardown that acknowledges a waiting caller instead of hanging it. Windows and Linux carry the same identity file and two commands. The build workflow compiles and tests on macOS only, so the other two rest on review alone. Judge it as a strong Mac utility with working ports, not as one even cross-platform app.

What's good

Failure modes got attention. Alert requests are written to disk and announced separately, so a cold launch cannot drop an alert whose notification was missed. Requests older than 120 seconds are discarded, which stops a login replaying stale alerts. The blocking mode returns distinct exit codes for a human click, an app dismissal, and a timeout, so a script can branch on the outcome. Card size is validated before presentation, and an unpresentable card tears itself down rather than leaving a topmost window eating clicks. The hostname read avoids DNS resolution, which would otherwise block launch and trigger a permission prompt.

Tradeoffs

Parity is thin. Blocking acknowledgement, the settings and dismissal commands, and the location field are macOS only. Wayland cannot observe global clicks, so alerts there need an explicit duration, and the compositor must support the layer shell protocol. macOS exposes no public remote-session connect event, so the connect card fires on display wake, screen unlock, and display reconfiguration instead. Those are proxies and can fire with no remote client attached. Linux release tarballs need system GTK4 and X11 libraries already present. Alert duration is clamped between 2 and 120 seconds, so a long-lived banner is not available.

How to use it well

Best fit is someone driving several machines over remote desktop who has lost time typing into the wrong one. Second fit is agent work: a coding agent blocked on approval can raise a topmost card carrying its reason and wait until a human clicks, which suits password prompts and release gates. Pair it with whatever syncs your dotfiles, since identity lives in one small JSON file. It does not do remote control, session recording, or machine inventory, and it sends nothing off the box. Routing that same alert to a phone or a chat channel is a separate tool.

Observed

License

MIT

Languages

Swift on macOS, Rust on Linux, C# on Windows

Install surface

Homebrew cask and formula on macOS and Linux, downloadable ZIP on Windows, DMG on macOS

Interfaces

Menu bar or tray app plus a CLI; splash and alert commands on all three platforms

Platform floors

macOS 15 on Apple silicon; Swift 6.2 with Xcode 26 to build; .NET 8 SDK for Windows; Rust 1.92 with GTK4 and X11 for Linux

Configuration

One JSON fleet file keyed by lowercase short hostname, read by all three platforms, applied live

Blocking mode

Wait returns 0 on click, 3 on app dismissal, 4 on timeout or expiry; default wait limit 600 seconds

Tests

Two Swift test targets declared in the package manifest; the CI job builds and tests on a macOS runner only

Updates

Sparkle for Developer ID builds; Homebrew builds update through Homebrew; dev builds leave it off

Agent integration

A bundled skill document describing the human-approval handoff