feat: let Claude and other agents use apps and browser tabs on your Mac#15006

🟡 Medium settings/ComputerAccessSetupDialog.tsx:110

Closing the browser-tabs dialog cancels an active permissionRequest for the environment, aborting another client's Cua permission flow even though this dialog did not start it. cancelRequest checks the shared requesting status in addition to the local requestStarted flag; only cancel when this dialog started the request.

Fixed in 58c9948 as suggested. The cleanup checks only requestStarted, which is set when this dialog presses Start. Another client's request is left alone.

🟠 High orchestration-v2/ProviderSessionManager.ts:1483

The terminal event can be published and the next turn can start before the previous Cua child is terminated. endComputerSession only waits for the control socket's connect event, while the proxy calls end() asynchronously in its server-side callback, so a new Cua request can reach the old session or be killed by the delayed callback. Wait for an acknowledged termination request or proxy termination confirmation before publishing the terminal event.

Fixed in 58c9948. The proxy now ends the session first, then closes the control connection, and endCuaSession waits for close instead of connect (bounded to 2 seconds). The pump publishes the terminal only after that, so the next turn cannot reach the old driver.

🟡 Medium Adapters/OpenCodeAdapterV2.ts:1000

A failed client.mcp.add leaves the server in localMcpServers, so buildRuntimeInstructions still tells the model to use an unavailable computer/browser MCP tool. Track only successfully registered servers when constructing the instructions.

Fixed in 58c9948. localMcpServers now holds only the servers whose mcp.add succeeded, and only those reach buildRuntimeInstructions.

🟡 Medium settings/IntegrationsSettings.tsx:902

Re-enabling either flag does not work after it was disabled in a project/checkout scope: the project-level false override remains effective, so the UI stays off and agents cannot be re-enabled there. enable writes only to the environment via updateEnvironment, bypassing the active scope; update the current scope when enabling so it replaces that override.

Not changing this. The premise is wrong: enableAgentComputerAccess and enableAgentBrowserTabs are not in PROJECT_SCOPED_SERVER_SETTING_KEYS, so no project override can exist to shadow them. The server reads both only from environment settings in ComputerAccess.servers. Enabling writes only to the selected environment on purpose, because that is the only machine whose readiness the dialog checked (see the earlier finding on #14523).

🟡 Medium mcp/CuaMcpProxy.ts:80

A replacement driver that returns a JSON-RPC error for the replayed initialize is treated as successfully initialized, so the proxy sends notifications/initialized and flushes tool calls to an unusable driver. Because the provider already completed its original initialization, it will not retry the handshake; handle the replay error by aborting the replacement session (and failing or reconnecting the queued calls) instead of setting ready and calling flush().

Fixed in 58c9948. When the replayed initialize returns an error, the proxy drops that driver and fails the queued calls with the normal "Computer use stopped" error. The next call starts a new driver. The new CuaMcpProxy.test.ts case fails without the fix.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Decode the proxy's stdio streams as UTF-8 before you split lines.

The stream encoding is not set, so each data chunk is a Buffer. buffer += chunk and input += chunk decode each chunk separately. A chunk boundary can split a multi-byte UTF-8 character. Each half then decodes to U+FFFD.

Cua results are large: they include screenshots and accessibility trees, so they arrive in many chunks. Any non-ASCII text in those results (app names, window titles, labels, user text) can be corrupted before it reaches the provider. The same issue applies to client requests on process.stdin.

To fix this, call setEncoding("utf8") on both streams. Node's StringDecoder then keeps a partial character until the next chunk arrives.

Also applies to: 169-170

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Hide the computer-use banner after Cua activity ends.

When a Cua Driver tool completes but its run continues, isRunUsingComputer still finds that tool in turnItems. The banner continues to say “Using your computer” during unrelated work. Check the matching tool’s active status before showing the banner.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Add a timeout to the permissions status probe.

status calls cuaPermissions on every check. The setup dialog runs these checks repeatedly while it waits for grants. runner.run has no timeout here. Running the binary from CuaDriver.app relaunches it inside the app. If that relaunch stalls, serverCheckComputerAccess never returns, and the setup dialog stays stuck on its loading state. runAction returns yield* status, so every action RPC also stalls.

Add a short timeout. On timeout, return the existing unverified fallback, which orElseSucceed already supplies.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Reset pending in a finally block.

runAction calls setPending(null) only after await run(...) resolves. If run rejects, pending stays set. Then busy stays true, the dialog cannot close (Line 127), and the close button stays hidden (Line 130). runAtomCommand usually returns a Failure result instead of rejecting. A defect path can still reject, and the dialog has no other way to recover.

Based on learnings: "wrap the await in try/catch/finally and reset the state in the finally block".

Source: Learnings