Hand supports Linux, macOS (Apple silicon; Intel builds are released but not tested) and native Windows (amd64, Windows 10 or 11). Supported means the project fixes problems that people report on those systems, not that every step has run on a real machine; the table below says how each part is verified. Known gaps: hand-desktop builds on all three systems and its headless UI tests run on all three, but its real window has run only on Linux, and the binary refuses to start elsewhere with that reason; a release carries its asset for Linux amd64 and arm64 only, so hand update installs it there and hand doctor calls it unsupported elsewhere; Windows has run in CI, with the real Luvus, and not yet on a real Windows machine; the real Mac run of 2026-10-17 (#895) used a stand-in claude; Windows has no desktop notifications; the macOS LaunchAgent's RunAtLoad at a real login is unverified. omp has run on one Linux host only: neither Windows nor macOS has run a real omp, and a provider limit screen or a blocked approval screen was not captured, so Hand has no omp limit line.
Report a problem with the bug form, and a vulnerability as SECURITY.md says.
CI runs the tests on GitHub's latest Ubuntu (amd64), macOS (Apple silicon) and Windows Server (amd64) runners. Every job installs the tested Luvus and runs the TestLive* tests against it; the other tests use a fake one. A separate workflow, e2e-install.yaml, installs a build of the commit with the real installer on each of the three runners and uses it as a user does, with no harness installed. It gates every release: release.yaml runs it on the tag's own tree, with the tag's own scripts and end-to-end tests, so a manual release works only for a tag that carries them (v0.12.0 and later). An older tag has neither .github/e2e nor .github/scripts, and its behavior is not what the current tests assert, so attach binaries to such a tag by hand. The Linux arm64 and Intel macOS builds are released but not run in CI.
In the table:
- daily: a real Linux machine runs it every day, with the real Luvus and harnesses;
- real: it has run on a real Linux machine, but not every day;
- CI: CI runs it on that OS, with the real system calls;
- CI, fake: CI runs it on that OS, but a fake stands in for the harness, Luvus, the release server, the browser, the notifier or the watcher and board processes;
- CI e2e: the end-to-end workflow runs it on that OS through the installed binary of a release build, as a user would: the real installer, the real Luvus, the Board over HTTP and in Chromium, and the previous release's own
hand update; only the harness is missing or a stand-in; - CI, real harness: CI starts the real
claudeorcodexbinary against a mock model server (End-to-end tests). The terminal screens, the trust screens, Luvus's recognition of the agent, and Hand's keys and prompts are real; the model is not, and no account is involved; - real Mac (#895): it ran on a real Mac (macOS 26.5.1, Apple silicon) in the first dogfood run, the issue linked. Stand-in claude: a script stood in for
claude, so the run covers Hand's own processes and panes but not the real worker path; - not run: the code exists but has never run on that OS;
- no: not supported.
| What | Linux | macOS | Windows |
|---|---|---|---|
| Install script | CI e2e | real Mac (#895), CI e2e | CI e2e, in PowerShell 5.1 and 7 |
Install script fetches hand-iroh next to hand, and keeps the old binaries when its checksum, version or archive fails | CI e2e, CI | CI e2e | CI e2e, in PowerShell 5.1 and 7, for a corrupted sidecar archive |
hand init and the Luvus pin | daily, CI e2e | real Mac (#895), CI e2e | CI e2e |
| Download the tested Luvus | CI, real Luvus | CI, real Luvus | CI, real Luvus |
| Luvus server, panes and events | daily | real Mac (#895), stand-in claude | CI, real Luvus over its named pipe |
| Start claude, and accept its trust screen | daily; CI, real harness | CI, real harness | CI, real harness |
| Start codex or agy | real; codex: CI, real harness | codex: CI, real harness; agy: CI, fake | codex: CI, real harness; agy: CI, fake |
| Accept Codex's trust screens for its own worktree and project | CI, real harness | CI, real harness | CI, real harness |
| Start opencode | CI, fake | CI, fake | CI, fake |
| Start copilot (a worker only), and accept its trust screen | real, auto only; CI, fake | CI, fake | CI, fake |
Start omp as a worker or the supervisor, list its models, and find and resume its supervisor session | real, Linux only | not run | not run |
Find a harness off PATH: in mise's shims folder (MISE_DATA_DIR/shims, $XDG_DATA_HOME/mise/shims, ~/.local/share/mise/shims, on Windows %LOCALAPPDATA%\mise\shims), then for copilot in npm's global bin folder (npm prefix -g) and the folder gh copilot downloads to (~/.local/share/gh/copilot, $XDG_DATA_HOME/gh/copilot, on Windows %LOCALAPPDATA%\GitHub CLI\copilot\copilot.exe) | real mise and both copilot folders, then a worker started and reported; unit tests | unit tests; the mise and gh paths are read from mise's documentation and the gh source, not from a run | unit tests; the mise and gh paths are read from mise's documentation and the gh source, not from a run |
Hand refuses a harness found only as a .cmd or .bat (except the .exe that npm puts inside the package of claude, codex, opencode and copilot, found beside the shim in a layout copied from the npm tarballs, not from a Windows install), and prefers a .exe anywhere on PATH | not needed | not needed | CI |
| A prompt reaches the harness byte for byte when it fits both limits (16 KiB, and on Windows 32,766 characters of quoted command line), and Hand refuses one that does not | CI, real Luvus, fake codex.exe | CI, real Luvus, fake codex.exe | CI, real Luvus, fake codex.exe |
Keys reach an agent whose program has an extension (codex.exe) after a process scan | CI, real Luvus, fake codex.exe | CI, real Luvus, fake codex.exe | CI, real Luvus, fake codex.exe |
| A worker reports through the footer | daily; CI, real harness | CI, real harness | CI, real harness |
| A 15 KB briefing reaches the real harness unchanged | CI, real harness | CI, real harness | CI, real harness |
| A wake reaches the supervisor's harness and is answered | CI, real harness | CI, real harness | CI, real harness: Hand presses Enter for Codex and types the text into Claude Code where Luvus will not prompt |
| Stop a worker | daily; CI, real harness | real Mac (#895), stand-in claude; CI, real harness | CI, real harness |
hand attach | CI, fake | real Mac (#895), stand-in claude | not run |
| Start the watcher on demand, and the board keeps watchers alive | daily | real Mac (#895) | CI, fake |
hand update | daily, CI e2e from v0.13.0 | real Mac from v0.11.0 (#895) and CI e2e from v0.13.0 | CI e2e from v0.13.0, the running executable renamed to hand.exe.old |
Luvus switch on repin: stop the server through UHP and server.pid | CI, fake | CI, fake | CI, fake |
| Luvus switch of a quiet fleet: stop the supervisor and the server, start the pin, resume the supervisor | CI, real Luvus, fake claude | CI, real Luvus, fake claude | CI, real Luvus, fake claude |
hand board --update-every, the timer's hand update | CI, fake | CI, fake | CI, fake |
hand board --iroh runs hand-iroh as its child, shows its state in the Phone page and hand doctor, and the child leaves when the board stops | CI e2e and CI, fake sidecar | CI e2e, fake sidecar | CI e2e, fake sidecar: the board is ended with TerminateProcess and the closed pipe stops the child |
hand update fetches hand-iroh with a new hand | CI e2e, CI, fake release | CI e2e, fake release | CI e2e, fake release |
The real hand-iroh starts, keeps its ID, holds its key with modes 0700 and 0600 and leaves when its input closes | CI, real sidecar | CI, real sidecar | CI, real sidecar |
First run with no harness: hand init, doctor, orient, projects, tasks, attempt track, models | CI e2e | CI e2e | CI e2e |
The Board over HTTP: fleet page, /events beat, document viewer, phone pairing and revoke | CI e2e | CI e2e | CI e2e |
| The Board in Chromium at 1440 and 390 px: five regions, document dialog, project badges, no console error | CI e2e | CI e2e | CI e2e |
| Upgrade from v0.13.0 with backups, the old binary refusing a migrated database, and the documented restore | CI e2e | CI e2e | CI e2e |
| Desktop notifications | daily | real Mac (#895) | no |
hand open starts the board and opens the browser | CI e2e starts the board, fake browser | real Mac (#895) | CI e2e starts the board, fake browser |
| Paths over 260 characters | not needed | not needed | CI for Hand's git; not run for a worker's |
hand-desktop: the MyGo window builds cgo-free, hand-desktop --version prints the same version and commit as hand version, and its ui.NewTester scenes, navigation and screenshots pass headless | CI, headless | CI, headless; the binary refuses to start | CI, headless; the binary refuses to start |
The release carries hand-desktop for Linux amd64 and arm64; hand update checks its .sha256 and its version and commit, places it next to hand, and reports none in this release or unsupported on OS/ARCH, and hand doctor has a desktop row | CI, fake release | CI, fake release: unsupported | CI, fake release: unsupported |
hand-desktop over a running board: the fleet switch, Status, Needs, Conversation (with its composer), Tasks and the four detail screens read /api/v1, and a message, an answer and a Mark read post to it | the window itself has run; the API path has the golden-JSON tests | not run | not run |
hand-desktop --open LINK and the single-instance lock: an alert's Open shows the item in the window | the parser, the hand-off and the click command have tests; the lock has not run between two real windows | not run | not run |
the single-instance lock's socket is private to the user only under XDG_RUNTIME_DIR (mode 0700); without it MyGo puts mygo-<uid>-<hash>.sock in $TMPDIR or /tmp, where another local user could hold the name and make a launch exit without opening a window | read from MyGo v0.7.4 | not run | not run |
| Start the board at login | daily | real Mac (#895) by bootout and bootstrap; not at a real login | not run |
| The watcher starts a killed Luvus server again | CI, real Luvus, fake claude | real Mac (#895), stand-in claude | CI, real Luvus, fake claude |
The two .exe rows prove Hand's side: that the lookup picks a .exe over a .cmd and names the shim it refuses (temporary PATH folders with files of those names), and that real Luvus refuses a key to a fake codex.exe until Hand has asked it for a process scan, and accepts it after. The real claude.exe and codex.exe run in the end-to-end tests. Those do not prove what cmd.exe does with a real npm shim (docs/dogfood/windows.md W4b checks Hand's refusal with a stand-in), or anything that depends on a user profile with a space or a non-ASCII letter (W11 checks a temporary folder with both). The prompt row proves that real Luvus hands a fake codex.exe the exact bytes of prompts of the sampled sizes from 1 byte to 16 KiB, with quotes, backslashes, %VAR%, &, Unicode and CRLF, for a worker and a supervisor, and that hand attempt start passes a representative brief whole; the end-to-end tests show the real claude.exe and codex.exe receiving a 15 KB brief of that kind unchanged, and W4c checks the real Codex on a real machine.
On Linux, the setup without a systemd user session (plain SSH, for example) has run only in CI. Hand configures neither commit signing nor ssh on any OS.
Real-machine checks
To help, run the checks in docs/dogfood/ on a real machine, yourself or with a coding agent: one set of checks, with a throw-away home that never touches your own fleets. The checks live only there, riskiest first, and so do the checks for Linux without a systemd user session and for Linux arm64. Report what fails through the issue form; when a run passes, the row of the table above changes from "CI" to a real-machine result, with a link to the run issue.