Add pi extension for CUA browser tools

.github/workflows/ci.yml

@@ -33,6 +33,23 @@ jobs:
           npm install "$RUNNER_TEMP"/onkernel-cua-ai-*.tgz
           node --input-type=module -e "import('@onkernel/cua-ai').then((m) => { if (typeof m.getCuaModel !== 'function') process.exit(1); })"
 
+  pi-extension-unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build --workspace @onkernel/cua-ai
+      - run: npm run build --workspace @onkernel/cua-agent
+      - name: Pi extension tests
+        run: npm test --workspace @onkernel/cua-pi-extension
+      - name: Pi extension typecheck
+        run: npm run typecheck --workspace @onkernel/cua-pi-extension
+
   agent-unit:
     runs-on: ubuntu-latest
     timeout-minutes: 15

.github/workflows/release-cua-pi-extension.yml

@@ -0,0 +1,95 @@
+name: Release CUA Pi Extension
+
+on:
+  push:
+    tags:
+      - "cua-pi-extension/v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: release-cua-pi-extension-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Verify tag is on main
+        run: |
+          git fetch origin main:refs/remotes/origin/main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@^11.5.1
+
+      - run: npm ci
+
+      - name: Verify package version matches tag
+        run: |
+          node --input-type=module <<'EOF'
+          import { readFileSync } from "node:fs";
+
+          const tag = process.env.GITHUB_REF_NAME;
+          const prefix = "cua-pi-extension/v";
+          if (!tag?.startsWith(prefix)) {
+            throw new Error(`Expected tag to start with ${prefix}, got ${tag}`);
+          }
+
+          const tagVersion = tag.slice(prefix.length);
+          const pkg = JSON.parse(readFileSync("packages/pi-extension/package.json", "utf8"));
+          if (pkg.version !== tagVersion) {
+            throw new Error(`Tag version ${tagVersion} does not match ${pkg.name} package.json version ${pkg.version}`);
+          }
+
+          console.log(`${pkg.name}@${pkg.version}`);
+          EOF
+
+      - run: npm run build --workspace @onkernel/cua-ai
+      - run: npm run build --workspace @onkernel/cua-agent
+      - run: npm run build --workspace @onkernel/cua-pi-extension
+      - run: npm run typecheck --workspace @onkernel/cua-pi-extension
+
+      - name: Unit tests
+        run: npm test --workspace @onkernel/cua-pi-extension -- --exclude "**/*.live.test.ts"
+
+      - name: Verify dependency packages are published
+        run: |
+          for package in @onkernel/cua-ai @onkernel/cua-agent @onkernel/sdk; do
+            version=$(node -p "require('./packages/pi-extension/package.json').dependencies['$package']")
+            npm view "$package@$version" version
+          done
+
+      - name: Pack tarballs
+        run: |
+          mkdir -p /tmp/pack
+          npm pack --workspace @onkernel/cua-ai --pack-destination /tmp/pack
+          npm pack --workspace @onkernel/cua-pi-extension --pack-destination /tmp/pack
+
+      - name: Packed manifest smoke test
+        run: |
+          SMOKE_DIR=$(mktemp -d)
+          cd "$SMOKE_DIR"
+          npm init -y > /dev/null
+          npm install --omit=dev /tmp/pack/*.tgz
+          node --input-type=module <<'EOF'
+          import { readFileSync } from "node:fs";
+          const pkg = JSON.parse(readFileSync("node_modules/@onkernel/cua-pi-extension/package.json", "utf8"));
+          if (pkg.pi?.extensions?.[0] !== "./src/index.ts") throw new Error("missing pi extension manifest");
+          console.log("packed manifest OK");
+          EOF
+
+      - name: Publish to npm
+        run: npm publish --workspace @onkernel/cua-pi-extension --access public

README.md

@@ -37,6 +37,7 @@ packages/
 ├── ai/         # @onkernel/cua-ai    - model catalog, tool schemas, provider adapters
 ├── agent/      # @onkernel/cua-agent - Kernel-browser tool execution
 ├── cli/        # @onkernel/cua-cli   - the `cua` binary
+├── pi-extension/ # @onkernel/cua-pi-extension - pi function-tool extension
 └── ptywright/  # @onkernel/ptywright - development-only PTY/TUI test infrastructure
 ```
 
@@ -69,6 +70,7 @@ flowchart LR
 | [`@onkernel/cua-ai`](packages/ai)       | Computer-use model catalog, tool factories/toolsets, compatibility checks, and provider adapters.                         |
 | [`@onkernel/cua-agent`](packages/agent) | Agent and harness APIs that run selected computer-use tools against a Kernel browser.                                    |
 | [`@onkernel/cua-cli`](packages/cli)     | The `cua` binary: argv parsing, sessions, skills, JSONL output, pi-tui front-end.                                         |
+| [`@onkernel/cua-pi-extension`](packages/pi-extension) | Explicit CUA function tools and Anthropic native computer use inside pi. |
 | [`@onkernel/ptywright`](packages/ptywright) | Development-only PTY/TUI test infrastructure.                                                                         |
 
 ---

docs/architecture.md

@@ -26,6 +26,11 @@ both explicitly and may use pi's orchestration primitives directly.
   for each selected model, adds pi coding tools, supplies the system prompt,
   resolves credentials/sessions/skills, and renders text, JSONL, or TUI output.
 - `@onkernel/ptywright` is development-only PTY/TUI test infrastructure.
+- `@onkernel/cua-pi-extension` adapts explicit CUA specs into pi extension
+  tools. Pi owns model selection, sessions, prompting, and RPC; cua-ai compiles
+  declarations and cua-agent executes against the shared browser pool. It also
+  registers CUA's Anthropic provider wrapper so the documented native Anthropic
+  computer tool retains its transport behavior.
 
 The invariant is that `packages/agent/src` contains no provider-name branches.
 Adding provider behavior means adding data and transforms in `cua-ai`, not a

docs/npm-releases.md

@@ -1,11 +1,12 @@
 # npm releases
 
-`@onkernel/cua-ai`, `@onkernel/cua-agent`, and `@onkernel/cua-cli` publish from
-package-specific tags:
+`@onkernel/cua-ai`, `@onkernel/cua-agent`, `@onkernel/cua-cli`, and
+`@onkernel/cua-pi-extension` publish from package-specific tags:
 
 - `cua-ai/v0.1.0` runs `.github/workflows/release-cua-ai.yml`
 - `cua-agent/v0.1.0` runs `.github/workflows/release-cua-agent.yml`
 - `cua-cli/v0.1.0` runs `.github/workflows/release-cua-cli.yml`
+- `cua-pi-extension/v0.10.1` runs `.github/workflows/release-cua-pi-extension.yml`
 
 The tag version must match the target package's `package.json` version, and the
 tagged commit must be contained in `main`.
@@ -19,6 +20,7 @@ Configure each package on npm with a GitHub Actions trusted publisher:
 | `@onkernel/cua-ai` | `kernel` | `cua` | `release-cua-ai.yml` | leave blank |
 | `@onkernel/cua-agent` | `kernel` | `cua` | `release-cua-agent.yml` | leave blank |
 | `@onkernel/cua-cli` | `kernel` | `cua` | `release-cua-cli.yml` | leave blank |
+| `@onkernel/cua-pi-extension` | `kernel` | `cua` | `release-cua-pi-extension.yml` | leave blank |
 
 The same configuration can be created from the npm CLI:
 
@@ -27,6 +29,7 @@ npm install -g npm@^11.17.0
 npm trust github @onkernel/cua-ai --repo kernel/cua --file release-cua-ai.yml --allow-publish
 npm trust github @onkernel/cua-agent --repo kernel/cua --file release-cua-agent.yml --allow-publish
 npm trust github @onkernel/cua-cli --repo kernel/cua --file release-cua-cli.yml --allow-publish
+npm trust github @onkernel/cua-pi-extension --repo kernel/cua --file release-cua-pi-extension.yml --allow-publish
 ```
 
 npm requires packages to exist before a trusted publisher can be configured. If

package.json

@@ -8,7 +8,8 @@
     "packages/ai",
     "packages/agent",
     "packages/ptywright",
-    "packages/cli"
+    "packages/cli",
+    "packages/pi-extension"
   ],
   "scripts": {
     "build": "npm run build --workspace @onkernel/cua-ai && npm run build --workspace @onkernel/cua-agent && tsc -b && npm run build --workspace @onkernel/cua-cli && npm run build:native --workspace @onkernel/ptywright --if-present",

packages/agent/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.10.1 - 2026-08-06
+
+- Update `@onkernel/cua-ai` to 0.10.1 for Anthropic's documented native
+  computer declaration versions.
+
 ## 0.10.0 - 2026-08-04
 
 Breaking: upgrade `@earendil-works/pi-agent-core` and `@earendil-works/pi-ai`

packages/agent/README.md

@@ -132,7 +132,9 @@ Provider-native declarations compose with ordinary function tools:
 ```ts
 const tools = [
   cua.providers.anthropic.tools.computer({
-    version: "20260701",
+    version: "20251124",
+    displayWidth: 1440,
+    displayHeight: 900,
     enableZoom: true,
   }),
   cua.tools.browser.snapshot(),

packages/agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/cua-agent",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Kernel browser computer-use Agent and AgentHarness classes built on pi-agent-core",
   "license": "MIT",
   "type": "module",
@@ -45,7 +45,7 @@
   "dependencies": {
     "@earendil-works/pi-agent-core": "0.83.0",
     "@earendil-works/pi-ai": "0.83.0",
-    "@onkernel/cua-ai": "0.10.0",
+    "@onkernel/cua-ai": "0.10.1",
     "@onkernel/sdk": "0.49.0",
     "sharp": "^0.35.3"
   },

packages/ai/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.10.1 - 2026-08-06
+
+- Add Anthropic's documented `computer_20251124` and `computer_20250124`
+  declaration versions while retaining the existing early-access version.
+
 ## 0.10.0 - 2026-08-04
 
 Breaking: upgrade `@earendil-works/pi-ai` to 0.83.0.

packages/ai/README.md

@@ -136,7 +136,9 @@ function tools.
 ```ts
 const tools = [
   cua.providers.anthropic.tools.computer({
-    version: "20260701",
+    version: "20251124",
+    displayWidth: 1440,
+    displayHeight: 900,
     enableZoom: true,
   }),
   cua.tools.browser.snapshot(),
@@ -149,6 +151,8 @@ Available groups:
 cua.providers.openai.tools.computer();
 
 cua.providers.anthropic.source;
+cua.providers.anthropic.tools.computer({ version: "20250124" });
+cua.providers.anthropic.tools.computer({ version: "20251124", enableZoom: true });
 cua.providers.anthropic.tools.computer({ version: "20260701" });
 cua.providers.anthropic.tools.browser({ version: "20260701" });
 
@@ -173,8 +177,11 @@ Moonshot accepts the ordinary browser toolset, including `browser_wait_for`,
 but rejects `browser_act`'s substantially larger function schema. Catalog
 compilation rejects that specific combination before a provider request.
 
-Provider-native caller-visible names are fixed by protocol. Version/tool/model
-mismatches fail during catalog compilation. If an Anthropic credential cannot
+Provider-native caller-visible names are fixed by protocol. Anthropic computer
+versions `20250124` and `20251124` emit their documented display dimensions and
+beta headers; the early-access `20260701` surface remains available. Version,
+tool, and model mismatches fail during catalog compilation. If an Anthropic
+credential cannot
 access `browser_20260701`, CUA retries with an equivalent `browser` function
 tool and remembers that choice for the credential and process. Every
 `cua.providers.*` tool surface exposes its first-party `source` (or versioned

packages/ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/cua-ai",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Kernel-curated computer-use model access built on pi-ai",
   "license": "MIT",
   "type": "module",