Vercel Labs' Agent-Desktop 1.0 Ships With a macOS Bug That Types Into the Frontmost App

Vercel Labs' agent-desktop reached version 1.0.0 on Oct. 28 and 1.0.2 on Oct. 30, and by Nov. 2 its repository showed 9,200 stars, 48 open issues and 76 open pull requests. One of those issues, #432, says that on macOS an unscoped press command sends keystrokes to whichever app is frontmost even when the user did not pass --headed.

The tool is a command-line program and C library, licensed Apache-2.0, that gives an AI agent a way to read and operate desktop applications through the operating system's accessibility tree, the structured list of buttons, fields and labels that screen readers use. It does not match pixels. Its documentation says it "cannot see a UI that publishes no accessibility tree."

What the 1.0 release is, and how fast it got there

The releases page lists v0.9.0 on Sept. 12, flagged with breaking changes to "verify stateful ref actions against fresh platform state," and v0.10.0 on Oct. 18, which set the C ABI major version to 5 and added Windows 10 1809 support. Then came v1.0.0 and v1.0.1 on Oct. 28, and v1.0.2 on Oct. 30, whose headline change is a notice telling npm users when the Node launcher slows each call.

An agent takes a snapshot, gets back JSON in which every actionable element carries a ref, acts on a ref, then snapshots again to verify. The docs say that loop lives in the calling agent, not in agent-desktop, and that the tool is not an agent: it has no embedded model.

Platform	Minimum, per the docs	Accessibility API
macOS	macOS 13, Intel or Apple Silicon	AX
Windows	Windows 10 1809, x64 or ARM64	UI Automation
Linux	Ubuntu 24.04, x86_64 or aarch64	AT-SPI

The press issue

The README says ref actions run headless by default and that the global --headed flag enables physical input. Issue #432, opened Nov. 1 by israelvicars against agent-desktop 1.0.2 on macOS 26.6, says press does not follow that rule. Running agent-desktop press x with no --headed and no --app reported CGEventPost with the mechanism physical_synthetic, the reporter wrote, and the character landed in the "Keys" field of the frontmost app.

By contrast, press return --app reported CGEventPostToPid, which targets one process. The reporter asks that unscoped press either fail with POLICY_DENIED, as triple-click does, or use delivery that cannot reach another app. If focus moves between the command and the keystroke, the key goes to whatever took focus. The issue page showed no maintainer reply, label or linked pull request.

The reporter points to a documentation conflict. The press --help text says --headed "allows focus changes and real pointer and keyboard input," while a bundled skill file says press "is always physical keyboard input." The related issue #424 notes that on macOS --headed is the only recovery hint offered for observation failures, and that it takes over the user's keyboard.

The rest of the queue

Most of the 48 open issues were filed on Nov. 1 and Nov. 2 and are platform edge cases. #494 reports that ref actions on Voice Memos always fail with AMBIGUOUS_TARGET. #463 says snapshots of dense Chrome tabs fail with a "RefMap exceeds 1MB" error. #478 says list-apps and list-windows on Windows 10 miss most top-level windows. #462 reports an abort and core dump on Linux when stdout and stderr share a closed pipe.

An independent write-up on DEV Community, posted Nov. 1, lists the limits the docs also admit: "UIA is not a perfect map of the visual tree," and custom-drawn controls, games and some Electron builds may return little. Its author also says the project's claim of 78 to 96 percent token savings from skeleton snapshots depends on how well each app builds its tree.

For anyone wiring the tool into an agent that runs unattended, the practical step is to pass --app on every keyboard command until #432 is answered. Related agent tooling has had its own trust problems: T3 Code's remote access docs tell users to treat pairing links as passwords, and the cost of running coding agents is now measurable, as Lawson's 12-framework test showed.

The repository's Homebrew and Scoop packages were still listed as "being submitted" on Nov. 2.