Computer Use 0.12.0 gives the agent its own pointer on macOS. It also adds the shared-computer attach mode for Codewhale Computers and a safety floor for app scripting, irreversible clicks and consent.

• The agent never drives your cursor (macOS). Every click, hover, drag and scroll is sent to the bound app's window as a window-routed event, in both background and activate:true modes. The old route that moved the real cursor and put it back is gone: the helper refuses any request to drive your cursor (real_pointer_refused), and a helper without the window route refuses instead of falling back. activate:true still brings the app forward and gives it keyboard focus, but no longer shares your pointer. Binding receipts report shared_pointer: false and pointer_route: "window-record". In a live check on the maintainer Mac, a raw click reached the target window while 133 samples of the real cursor never came within 421 px of any agent target.
• Held drags are delivered on release. pointer down/move/up build the drag on the agent's pointer and send it to the window on up, so nothing is ever held on a real mouse button. The agent can't observe the screen mid-drag.
• Shared-computer attach mode. CODEWHALE_CU_BROWSER_ATTACH connects to a Codewhale Computer's shared Chromium instead of launching a private browser; CODEWHALE_CU_LEASE_FILE makes input tools refuse computer_busy_human_driving while a person holds the control lease; codewhale-cu-turn-hold keeps a Sprite Task alive for the turn.
• Safety floor. app_script refuses shell, Objective-C bridge and keystroke escapes and puts every scripted app through per-app consent. Clicks on pay/buy/send/transfer/delete controls need an explicit confirmation for that exact call. Consent decisions can't be batched in run_actions or replayed from a trajectory, and trajectories redact typed text and clipboard writes.

Upgrading: behaviour changes for anything that relied on activate:true moving the real cursor. Raw pointer input still needs activate:true, because the window route briefly makes the app key. Windows and Linux raw input is unchanged and still shares the desktop.

Downloads: Mac users should choose the notarized universal DMG; the ZIP is also available for installation and updates. Windows users can extract windows-x64-preview.zip and launch Codewhale Computer Use.cmd from the extracted folder; the included Node runtime needs no separate installation. Linux remains available from source and Docker. The source plugin ZIP is for plugin hosts, not a desktop installer.

The Mac app and DMG are Developer ID signed, Apple notarized (app 57e98ea7-750d-4260-a9f1-dd2aa3ab29a6, disk image 589fd26e-e2e1-4ee6-9080-c0aa5ea7d5a6), stapled, and Gatekeeper verified; all 50 packaged runtime files are byte-identical to the release commit. release.json, SHA256SUMS.txt, and release-provenance.json describe the shipped assets. Windows is unsigned and is not a production installer.

Remaining limits: continuous physical keyboard coexistence, fresh-machine permission flows, native sharing-picker integration, and physical Windows mixed-DPI qualification remain open. This release does not claim full Codex computer-use parity. Codewhale Engine ships separately and embeds its own plugin revision.

Source: release commit, three-platform CI, marketplace mirror.