**2 issues found** across 5 files Confidence score: **3/5** - There is moderate merge risk because both findings are medium severity (5–6/10) with high confidence (8–9/10), indicating a likely policy and maintainability regression rather than a cosmetic issue. - In `packages/core/lib/v3/agent/OpenAICUAClient.ts`, adding a hardcoded `gpt-5` model-name gate can block valid models and create user-facing failures as model catalogs evolve. - In `packages/core/lib/v3/types/public/agent.ts`, extending a hardcoded CUA allowlist repeats the same anti-pattern, increasing the chance of drift and inconsistent model acceptance behavior. - Pay close attention to `packages/core/lib/v3/agent/OpenAICUAClient.ts`, `packages/core/lib/v3/types/public/agent.ts` - hardcoded allowed-model checks may cause avoidable model rejection and future regressions.

Prompt for AI agents (unresolved issues)

```text Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately. P2: Custom agent: **Ensure we never check against hardcoded lists of allowed LLM model names** New code adds another hardcoded allowed model name to CUA allowlist, violating the rule to avoid hardcoded allowed-model checks. P2: Custom agent: **Ensure we never check against hardcoded lists of allowed LLM model names** New code hardcodes a `gpt-5` model-name gate, violating the rule against hardcoded allowed-model checks. ```

Architecture diagram

```mermaid sequenceDiagram participant App as User Application participant Prov as AgentProvider participant Client as OpenAICUAClient participant API as OpenAI API participant Page as Browser Page Note over App,Prov: Initialization App->>Prov: Request agent (model: "gpt-5.4") Prov->>Prov: NEW: Map gpt-5.4 to "openai" provider Prov-->>Client: Create OpenAICUAClient Note over Client,API: Execution Loop App->>Client: execute(instruction) loop Agent Steps Client->>Client: NEW: check usesNewComputerTool (model ~ gpt-5) Client->>API: Send history + tools Note right of Client: NEW: uses "computer" tool for gpt-5
Legacy: uses "computer_use_preview" API-->>Client: Return tool call (ComputerCallItem) alt NEW: Batched Actions (GPT-5.4) loop for action in actions[] Client->>Page: executeAction(action) Page-->>Client: success/fail end else Legacy Single Action Client->>Page: executeAction(action) Page-->>Client: success/fail end Client->>Page: captureScreenshot() Page-->>Client: base64 string alt NEW: GPT-5.4 Response Format Client->>Client: Build "computer_screenshot" output Note over Client: Sets detail: "original" else Legacy Response Format Client->>Client: Build "input_image" output Note over Client: CHANGED: current_url excluded from new tool format end Client->>API: POST tool_outputs (screenshot + call_id) end Client-->>App: Return final result message ```

_{Reply with feedback, questions, or to request a fix. Tag `@cubic-dev-ai` to re-run a review, or [fix all with cubic](https://www.cubic.dev/action/fix/pr/browserbase/stagehand/2022/ai_pr_review_1776811854925_1802b39d-fff0-4a12-acf1-9e53303f8c3f?entrySource=github_ui_to_cubic_ui).}