AutoCua v0.1.5: Browser vault, faster scans and steadier coders

A vault the web agent can type from, page scans that no longer stall on ad frames, coders that act in the same turn as their notes, and an iPhone link that survives a USB re-plug.

What's new

Vault

• Logins for the web agent: put a site's login in the vault and the agent fills it with the new vault tool. AutoCua types the saved value itself, so the model only ever sees key names like password, and later steps show the typed value as [vault].
• Fills only where it should: a saved site covers its subdomains. The vault types only on https (or http on localhost), checks the page is still on that site right before typing, never types into a frame, and puts a password only into a password field.
• iPhone vault works the same way: it fills the exact key the agent names instead of guessing from the field label, for the app in front by its exact name, and checks the focused field and the app right before typing. It now batches with other input; only a keypad PIN still goes alone.

Browser

• Scans stop stalling on ad frames: a frame inside a same-origin wrapper (common with ad and tag-manager scripts) now answers at once, so reading a page like itv.com takes 20–30 ms instead of 2–3 s. Some frames that were missing from the page tree now show up in the right place.
• Headless runs get past bot walls: headless Chrome now sends the normal Chrome user agent instead of "HeadlessChrome", so sites like itv.com load and sign in. Normal runs are unchanged.
• Extension Test button works with the app open: the popup's Test scan is saved whenever the desktop app is running, during a run or between runs, instead of asking you to run test.command.
• A page can't fake its scan: the page's result is taken only from the top frame Chrome itself labels, so a page lying to one of its frames can no longer swap that frame's content in for the whole page.

Computer use

• Coders act in the same turn as their notes: the coder is steered to make its notes call and its actions together, so a step no longer costs two model calls. macOS, Windows and Linux.
• Notes pause: if a model writes notes twice in a row without acting, the notes tool steps aside for five steps, leaving only the tools that do the work.
• 100 iterations on macOS: the Mac coder (was 50) and minion (was 30) now get 100, as on Windows and Linux, so a minion no longer stops with partial findings a third of the way in.
• Longer replies on GPT-6 Astra, Luna and Sol: coder and minion replies can run to 8,000 tokens (was 2,000), so a whole-file write or a plan is no longer cut off.
• Refusals fall back: when Claude refuses a coder or minion step, the fallback model (if one is set) answers that step instead of the same request being retried three times. An empty reply from Claude now says why it was empty.

iOS

• Survives a USB re-plug: when QuickTime screen mirroring or a cable glitch re-plugs the iPhone, the phone session restarts itself in place, up to 5 times in 10 minutes. Before, every tap failed with "Failed to create WDA session".
• ground_click shows the tapping finger: in the iOS run's tool chain and in the iOS agent's box on the desktops, the same as click.

Telegram

• Comes back on its own: if Telegram is unreachable when the bot starts, it retries after 5, 10, 20 and 40 s, then every minute, instead of staying off for the session. Flood limits (429) are retried too; a bad token still fails loudly once.
• Token stays out of logs: retry lines show the error with the token replaced.
• Windows keeps certificate checks on: an outage at startup no longer leaves the bot running with TLS verification off.

App

• Rebuilt in React + TSX: the page, the intro and its parts are React components now and work as before. pip installs still need no Node: the built UI ships in the package.
• New logo, right-sized Dock icon: the macOS Dock icon now sits at the same size as other apps.

Upgrading

• Vault file format: AutoCua_data/vault/credentials.json now has one section per device: {"ios": {...}, "web": {...}}. The old flat file is no longer read, so move your existing iPhone entries under "ios".
• Restart Chrome once: vault typing in extension mode needs this release's extension, which Chrome loads when it starts. An older one refuses it.
• Agent folders renamed: agent/main_driver is now agent/computer_use on macOS, Windows and Linux, and agent/iphone_use on iOS. This only matters if you import or edit them.

Docs

• New computer use demo video and banner in the README.
• Bug reports and feature requests now have their own forms on GitHub.

Get started

pip install -U autocua

Merged PRs: #22, #25 to #35

Full changelog: 0ded162...v0.1.5