fix(runtime): recover browser connections and exit idle hosts after failures

Cargo.toml

@@ -128,8 +128,8 @@ maka-agent-authority = { path = "plugins/agent/authority" }
 maka-web-api = { path = "plugins/workspace/workspace-web/api" }
 maka-agent-api = { path = "plugins/agent/api" }
 maka-transport = { path = "platform/transport" }
-cua-driver-sdk = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac" }
-cua-driver-contract = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac" }
+cua-driver-sdk = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761" }
+cua-driver-contract = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761" }
 agent-client-protocol = { version = "3.5.0", default-features = false, features = ["unstable_protocol_v2"] }
 apply-patch = { path = "plugins/workspace/workspace-files/patch" }
 cap-fs-ext = "4.0.3"
@@ -257,8 +257,8 @@ opt-level = 3
 opt-level = 3
 
 [patch.crates-io]
-zbus = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac" }
-nom = { git = "https://github.com/maka-agent/cua", rev = "23221967ce6044c1fed303701f43fa54564f0f53" }
+zbus = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761" }
+nom = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761" }
 reqwest = { path = "third-party/reqwest" }
 gix-index = { path = "third-party/gix-index" }
 gix-discover = { path = "third-party/gix-discover" }

justfile

@@ -41,7 +41,7 @@ build *args: setup
 product *args: setup
     npm --workspace @maka-agent/product run build -- "$@"
 
-# Check all maintained source and behavior; setup runs once for the dependency graph.
+# Check the root workspace, product, tooling and terminal; setup runs once.
 [group('Checks')]
 check: setup fmt-check lint typecheck test-js test test-termina licenses
 

platform/capabilities/src/call/resources.rs

@@ -43,6 +43,11 @@ impl Resources {
         let state = self.state.lock().unwrap();
         state.failure.is_none() && self.tasks.is_empty()
     }
+    /// Running owners, independent of cleanup failures already reported by completed owners.
+    /// Retirement callers must fence producers before checking this observation.
+    pub fn has_pending(&self) -> bool {
+        !self.tasks.is_empty()
+    }
     pub fn reserve(self: &Arc<Self>) -> Result<Ticket, ToolError> {
         let state = self.state.lock().unwrap();
         if state.closed {

platform/computer-use/Cargo.toml

@@ -63,14 +63,14 @@ maka-plugin-core.workspace = true
 futures-util.workspace = true
 cua-driver-contract = { workspace = true, optional = true }
 cua-driver-sdk = { workspace = true, optional = true }
-cua-driver-core = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac", optional = true }
+cua-driver-core = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761", optional = true }
 serde.workspace = true
 schemars.workspace = true
 uuid.workspace = true
 libc = { workspace = true, optional = true }
 reqwest.workspace = true
 base64 = { version = "0.23.1", optional = true }
-cursor-overlay = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac", features = ["theme-authoring"], optional = true }
+cursor-overlay = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761", features = ["theme-authoring"], optional = true }
 sha2 = { workspace = true, optional = true }
 tempfile = { workspace = true, optional = true }
 serde_json.workspace = true
@@ -92,12 +92,12 @@ tiny-skia = { version = "0.12.0", features = ["png-format"] }
 cua-skia = { package = "tiny-skia", version = "0.11.4", features = ["png-format"] }
 
 [target.'cfg(windows)'.dependencies]
-platform-windows = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac", optional = true }
+platform-windows = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761", optional = true }
 windows-sys = { version = "0.61.2", features = ["Win32_Foundation", "Win32_System_Threading", "Win32_Storage_FileSystem"], optional = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 image = { version = "0.25.10", default-features = false, features = ["png", "jpeg"], optional = true }
-platform-linux = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac", optional = true }
+platform-linux = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761", optional = true }
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 x11rb = "0.13"
@@ -107,7 +107,7 @@ imagesize.workspace = true
 
 [target.'cfg(target_os = "macos")'.dependencies]
 unicode-segmentation = { workspace = true, optional = true }
-platform-macos = { git = "https://github.com/maka-agent/cua", rev = "9e385e6671acb9b985bc88257e94357db39d21ac", optional = true }
+platform-macos = { git = "https://github.com/maka-agent/cua", rev = "b97a7e7a97b1dabc669b7c362ba39691766df761", optional = true }
 core-foundation = { version = "0.10.1", optional = true }
 objc2 = { version = "0.6.5", optional = true }
 objc2-foundation = { version = "0.3.2", default-features = false, features = ["std", "NSArray", "NSData", "NSString"], optional = true }

platform/computer-use/src/browser/extension.rs

@@ -2580,6 +2580,7 @@ impl Host {
             .ok_or_else(|| failed("extension provider required"))?;
         let browser = BrowserIdentity::of(provider, &extension.identity().generation)?;
         self.known(&browser)?;
+        self.check_extension_binding(&browser.tab(target))?;
         self.check_owned_input(&browser.tab(target))?;
         let Some(lease) = self.tabs.get_mut(&browser.tab(target)) else {
             return Ok(false);
@@ -2833,6 +2834,7 @@ impl Host {
         let browser = BrowserIdentity::of(provider, &extension.identity().generation)?;
         self.known(&browser)?;
         let identity = browser.tab(target);
+        self.check_extension_binding(&identity)?;
         if let Some(lease) = self.tabs.get(&identity) {
             if lease.handoff_transfer.is_some() {
                 return Err(ToolError::CleanupUnconfirmed(