ChromeOS has an autoclick accessibility feature: a click event (i.e. a mouse-press event followed by a mouse-release) is automatically generated when the mouse cursor remains stationary for a while (default is 1 second; configurable) after moving some distance (20 DIP; non-configurable).

In mus+ash world, this needs to live in a mus-client (ideally a separate autoclick app). One of the requirements of this is that the client needs to be able to generate a click event. Since this means an external client causes click events to be dispatched to other clients, this needs a carefully designed API to make sure it cannot be misused. To mitigate potential vulnerability:
 . The event-generation API needs to be very restrictive. For example, the window-server will generate a mouse-click only at the current cursor location (instead of letting autoclick dictate where the click event is generated).
 . The event-generation API is available only to a small class of clients (e.g. 'trusted', 'accessibility' etc.)

Some notes: https://docs.google.com/document/d/15d2hBjqpAl0ax2rwjftBhj2ib1-CwYTMYT30vW_nLwI/edit#heading=h.8p818irozpxi