agent-desktop 1.0.2: OP on the tree, Mid as your whole computer

Verdict, November 2, 2026. OP if a coding agent you already run should click a native control by a ref from that app's accessibility tree, and leave the real pointer alone. Mid as computer use for the whole machine. The October 30 posts say any coding agent, every desktop, background use, and a cursor per agent. The docs say the CLI is not an agent, a control with no tree is invisible, and in the mode that draws those cursors the clicks take turns. Mid as a reason to move Cursor. The October 24 note is a different product. No letter moves on the AI Coding Agents board. S stays locked. Cursor stays A. OP or Mid has not installed 1.0.2.

Pages, the npm record, and the posts below were read November 2, 2026.

What 1.0.2 shipped

UPDATE GitHub published v1.0.2 at 9:17 PM UTC on October 30, 2026. It points npm and the repo at vercel-labs/agent-desktop after an org transfer, adds the docs at agent-browser.dev/desktop, and makes the macOS permission guide offer the app that launched the CLI. Linux is the October 27 1.0.0 line: CLI, C library, and npm on x86_64 and aarch64, glibc 2.35 or later, through AT-SPI. The oldest changelog entry is 0.1.1 on February 23, 2026. The npm record has that created date, Apache-2.0, and 1.0.2. Sources: v1.0.2 (opens in a new tab), changelog (opens in a new tab), installation (opens in a new tab), npm registry (opens in a new tab), LICENSE (opens in a new tab).

The buff is the ref

BUFF OP for one named control. A snapshot returns JSON and a ref such as @s8f3k2p9:e8 for each element the agent can act on. Click that ref, then snapshot again. The README says there is no pixel matching, and the loop stays in your agent. A bare @e8 is INVALID_ARGS. A changed UI returns STALE_REF or AMBIGUOUS_TARGET. ok: true does not prove the app changed. delivered_unverified means the call was sent. Read again, or wait for the value, before a second click. The worked example says that second click can enter the digit twice. Sources: README (opens in a new tab), observe, act, verify (opens in a new tab).

BUFF Headless is the default, and it fails closed. The call uses the accessibility API. It does not take focus, move the real cursor, or touch the clipboard. The page says that keeps the action safe while a person uses the desktop. A missing path returns ACTION_NOT_SUPPORTED or POLICY_DENIED. It does not move the mouse to compensate. --headed is the permission to take focus. Do not add it after a miss: the retry can act twice. On a dense window, snapshot --skeleton reads three levels and snapshot --root drills one region. A full Electron or IDE tree can cost enough tokens to run out of budget. No percentage is published. Prefer find for a known name, and set-value or check when you can. Those stay headless. Sources: headed mode (opens in a new tab), skeleton (opens in a new tab), observe, act, verify (opens in a new tab).

The overview calls it a tool: no model, no GUI, one JSON envelope, then exit. Web pages are agent-browser's job. A UI with no accessibility tree is invisible. On October 31 Lahfir wrote the same boundary for the model: it interacts with apps, and the guardrails live in the harness. Sources: overview (opens in a new tab), reply (opens in a new tab).

The posts, then the turns

VENDOR CLAIM At 11:48 PM UTC on October 30, Lahfir posted end-to-end tests, the tree, drilling to save tokens, many agents on one app, all three desktops, and npm i -g agent-desktop. A reply in that thread calls it a Labs experiment. At 12:15 AM UTC on October 31, Chris Tate posted "agent-browser, for your whole computer," background use, and agents in parallel, each with its own cursor. At 9:34 PM UTC that day, Lahfir posted that on a Mac, if the agent should not touch personal stuff, run it in a macOS VM so it only sees the guest. Sources: Lahfir (opens in a new tab), Labs experiment (opens in a new tab), Tate (opens in a new tab), VM (opens in a new tab).

NERF Mid on "in parallel." Own cursors exist only after session start --cursor --multi-agent, and a click or type without --agent-id is INVALID_ARGS. The overlay cursor moves, then the action takes a lease, so the drawings travel together while the clicks take turns. The overlay changes nothing, and --headed hides it. Four names never run: key-down, key-up, mouse-down, mouse-up. Of 60 names, 56 work. hover, drag, and the other pointer gestures need --headed on every OS. Sources: sessions (opens in a new tab), headed mode (opens in a new tab), README (opens in a new tab).

Three desktops

OS	What a primary page says	The catch
macOS 13 or later	Accessibility on the launching app. Screenshots also need Screen Recording.	`open-system-surface` is unsupported. The README lists shell surfaces as planned.
Windows 10 1809 or later, or Server 2019 or later	No grant at the terminal's own integrity level.	`type` needs `--headed`. An admin app can be read, and not driven, until the terminal matches it. The binary is unsigned.
Ubuntu 24.04 or later	AT-SPI, in the signed-in graphical session.	A TTY, a bare SSH shell, or a container without the bus sees no apps. Wayland refuses pointer gestures.

Sources, in row order: macOS (opens in a new tab), Windows (opens in a new tab), Linux (opens in a new tab), README (opens in a new tab).

The macOS and Windows pages say that behavior was checked against the adapter and its tests, and was not run for the docs. Linux examples ran on X11. On Windows, Chromium 138 and later needs no flag for a UIA tree, the first read is partial, and a cold launch takes 10 to 25 seconds, which is the docs' figure. 1.0.1 removed the Homebrew tap and the Scoop bucket. On PowerShell, quote every ref. A bare @token is the splatting operator. Sources: macOS (opens in a new tab), Windows (opens in a new tab), Linux (opens in a new tab), installation (opens in a new tab).

Price, and the files it writes

PRICE Apache-2.0 is a no-charge license. There is no plan page, no success rate, and no price per completed task. A fatter snapshot costs the calling agent more tokens. That bill is the agent's, and this article does not measure it. jev-desktop is optional, not the native CLI, and it needs a repo clone plus an API key. Sources: LICENSE (opens in a new tab), skeleton (opens in a new tab), skills (opens in a new tab).

NERF Snapshots, titles, clipboard reads, notifications, screenshots, and command results are the desktop you inspected. Traces redact text, value, name, and password. Screenshots do not. Keep them, and the calling transcript, out of public logs. The JEV helper sends screen descriptions to a model provider. The VM post is one person's setup. The CLI does not create that guest, and it drives the session it is installed in. A click that should stay off your machine is the isolated desktop in the October 24 note: a Cursor cloud VM, or a Mac or Linux worker you flag on. Sources: traces (opens in a new tab), README (opens in a new tab).

The letter stays A

No letter moves. agent-desktop is not a row. It is a shell-out. Cursor stays A on the AI Coding Agents list. S stays locked.

What to do today

Install 1.0.2. Run agent-desktop status, then skills get desktop and skills get platform, before the first click.
Stay headless. On Windows, use set-value. Pass --headed only for a physical gesture you mean to aim.
Skeleton, then drill. After STALE_REF, snapshot again. Do not repeat an unverified click.
Several agents means session start --cursor --multi-agent and an --agent-id. Expect turns.
Keep the state root private and the snapshots out of git.

The weekly patch is on beehiiv: subscribe free (opens in a new tab).

The OP or Mid Team

Sources

Checked November 2, 2026.

What 1.0.2 shipped

The buff is the ref

The posts, then the turns

Three desktops

OS	What a primary page says	The catch
macOS 13 or later	Accessibility on the launching app. Screenshots also need Screen Recording.	`open-system-surface` is unsupported. The README lists shell surfaces as planned.
Windows 10 1809 or later, or Server 2019 or later	No grant at the terminal's own integrity level.	`type` needs `--headed`. An admin app can be read, and not driven, until the terminal matches it. The binary is unsigned.
Ubuntu 24.04 or later	AT-SPI, in the signed-in graphical session.	A TTY, a bare SSH shell, or a container without the bus sees no apps. Wayland refuses pointer gestures.

Price, and the files it writes

What to do today

Install 1.0.2. Run agent-desktop status, then skills get desktop and skills get platform, before the first click.

Stay headless. On Windows, use set-value. Pass --headed only for a physical gesture you mean to aim.

Skeleton, then drill. After STALE_REF, snapshot again. Do not repeat an unverified click.

Several agents means session start --cursor --multi-agent and an --agent-id. Expect turns.

Keep the state root private and the snapshots out of git.

The OP or Mid Team