A pointer is a handoff, not consent.
big-arrow-on-the-screen is a new macOS command-line tool that lets a program draw a labelled arrow over other apps. Its public pitch is direct. The arrow can point at a control, let the user's click pass through near the target, leave keyboard focus alone, and remove itself after a timer or when its owner exits.[1]
This is a good answer to a real interface failure. An agent reaches a human-only step, prints "click Allow" into a terminal, and waits while the person looks at another window. A visual pointer closes that gap without turning the agent into a click bot.
Human in the loop is a geometry problem before it is a policy slogan.
The useful boundary is narrow.
The repository draws a full-display NSPanel at the screen-saver window level. The panel is non-activating and starts with mouse events ignored. The target area remains outside the sign and shaft click region, so a click at the arrow tip goes to the app beneath it. The source also sets a duration timer and watches an owner process. Either event can end the cue.[1]
The package separates drawing from target discovery. Coordinates and app windows can use a narrower permission path. Finding a labelled element uses macOS Accessibility access. The grant belongs to the responsible terminal or IDE, not to a magical harmless arrow binary. That distinction belongs in the handoff copy.
A visible cue can still mislead.
The Hacker News discussion found the hard question quickly. What stops an overlay from hiding a decline button or relabelling an approval?[2] The project answers with outlines, target clearance, click-to-dismiss behavior, automatic expiry, and full-sentence signs. Those are useful controls. They do not make the overlay a trusted part of the operating system.
The project also argues that an agent with shell access already has broader power. That comparison explains the existing risk. It does not excuse ambiguous cues. A visual layer should identify its caller, name the exact consequence, leave the native target readable, and expire without cleanup work.
Keep the native action native.
On the web, CSS pointer-events: none makes an element ineligible as the pointer target. The event can reach content underneath it.[3] The macOS implementation uses a different API, but the interaction rule is the same. Decoration should not quietly become the control.
That means the overlay can explain, point, speak, and retire. It should not replace the system button, copy its label into a fake button, or report success because the cue disappeared. The caller must inspect the real result after the human acts.
Write the cutout before drawing the arrow.
Every visual handoff needs five records. Name the caller. Name the native target. State the consequence. Set an expiry. Define the result check. If the action is a payment, deletion, signature, credential grant, or permission change, put the amount, object, recipient, or authority on the cue itself.
The interactive cutout below does not test a desktop overlay. It builds a request template and runs a browser-only preview. Use it to review the wording and expiry contract before connecting any real screen tool.