Update native Anthropic browser/computer tools with model gates

[rgarcia]

Invalid model/native-tool combinations now fail during cua-ai and cua-agent construction, and during cua-cli startup before browser provisioning.

---

Note

Medium Risk
Changes agent tool-turn behavior for native Anthropic runs and tightens which model/native-tool pairs are accepted; misconfigured allowlists could block valid combos until updated.

Overview
Hardens Anthropic early-access computer_20260701 / browser_20260701 usage by failing locally when the model family is not on the live-verified allowlist (e.g. Opus 4.7), including in cua-cli before browser provisioning.

Native multi-action turns now stop after the first failed tool call: CuaRuntimeSpec carries the provider skip message, and CuaAgent / CuaAgentHarness return the required error for remaining calls in that assistant turn instead of running against stale browser state.

Also adds an investigation doc, architecture/CLI help updates, opt-in live integration tests for pi-ai serialization, and a small native executor tweak (optional action, explicit invalid-args error).

^{Reviewed by Cursor Bugbot for commit a88c3a3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Harness toolTurnFailed not reset
  • Added a before_agent_start hook in CuaAgentHarness stop-on-first-failure setup to reset toolTurnFailed at each prompt boundary.

Or push these changes by commenting:

@cursor push 2b6d95a823

Preview (2b6d95a823)

diff --git a/packages/agent/src/agent.ts b/packages/agent/src/agent.ts
--- a/packages/agent/src/agent.ts
+++ b/packages/agent/src/agent.ts
@@ -719,6 +719,10 @@
 		this.requestedActiveToolNames = activeToolNames;
 		if (runtime.stopOnFirstToolFailureMessage) {
 			this.installToolFailureGuard(runtime.stopOnFirstToolFailureMessage);
+			this.on("before_agent_start", () => {
+				this.toolTurnFailed = false;
+				return undefined;
+			});
 			this.subscribe((event) => {
 				if (event.type === "message_end" && event.message.role === "assistant") {
 					this.toolTurnFailed = false;

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit a88c3a3. Configure here.}

[cursor]

Harness toolTurnFailed not reset

Medium Severity

CuaAgentHarness now tracks toolTurnFailed from subscribe() for native stop-on-first-failure, but it is only cleared on assistant message_end, not in before_agent_start. Reused harnesses can carry toolTurnFailed === true into the next prompt() after an aborted or incomplete turn, so the guard may block the first tool call of a new user prompt with the skip message even though no earlier action failed in that turn.

 

^{Triggered by learned rule: Harness per-prompt state must be fully reset in before_agent_start}

^{Reviewed by Cursor Bugbot for commit a88c3a3. Configure here.}