feat(desktop): add opt-in Cua Driver computer use#10899

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Guard host.uniffiDestroy() so cleanup always releases the standalone factory slot.

If the synchronous native call throws, releasing rejects before occupied = false. No outer finalizer resets occupied, so later createHost calls return CuaDriverError with "The previous Cua Driver is still stopping.". Wrap the call and always clear occupied.

✅ Addressed in commit 201eb13

Fixed in 201eb1307. The factory slot is released in finally after the native calls settle, while a destruction failure still propagates as CuaDriverError. The regression test fails on the previous code and now verifies error reporting, one cleanup across repeated stop calls, and successful replacement-host creation/start. All 15 CuaDriver tests, targeted lint, and the server typecheck pass.

@f-trycua, thanks for the detailed verification. The finally release covers the stale factory-slot path while preserving the CuaDriverError result. The regression coverage also validates repeated cleanup and replacement-host startup.

You are interacting with an AI system.

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Run the required Markdown formatter.

Run vp check --fix before committing these documentation changes. Confirm that the command leaves docs/user/project-settings.md clean.

Source: Coding guidelines

🟡 Medium chat/ChatComposer.tsx:2305

Available applications do not appear when the installedApps query or cuaHost permission check resolves. composerMenuItems caches the initial empty app list because its useMemo dependencies omit installedApps.data and cuaHost.ready; add both dependencies so the @ menu recomputes with the resolved results.

🟡 Medium Layers/OpenCodeAdapter.ts:2888

When a managed driver is present, this unconditionally calls client.mcp.add with CUA_MCP_SERVER_NAME (cua-driver), so OpenCode replaces any user-configured MCP server with that name and silently routes computer-use requests to the managed endpoint. Check for an existing cua-driver server before adding the managed one, or use a collision-free name so the user's configuration takes precedence.

🟡 Medium settings/ProjectDefaultsSettings.tsx:526

await updateSettings({ enableCua: true }) resolves before the server write completes, so a failed enable closes CuaSetupDialog and restarts the driver instead of showing its “Could not save” error. Make updateSettings return the persistScopedSettingsPatch promise (and propagate its rejection) so onEnable can prevent completion when persistence fails.

🟡 Medium lib/cuaHostPermissions.ts:30

A rejected checkSystemPermission query makes readCuaHostPermissions() return null, and cuaHostPermissionsReady(null) treats that result as ready. Thus a transient desktop bridge failure makes the enabled macOS desktop appear permission-ready, offering app mentions and suppressing the missing-permission warning without establishing either grant. Return a non-ready CuaHostPermissions value for query failures, reserving null for non-desktop/non-mac hosts.

🟡 Medium lib/cuaHostPermissions.ts:20

readCuaHostPermissions() returns the cached denial for up to five seconds after the permissions dialog closes, so the settings row continues to report missing permissions even when both grants were just made. Because the focus event during onboarding is ignored while the hook is disabled, no subsequent refresh is scheduled; invalidate or bypass this cache for the post-onboarding refresh.

🟡 Medium components/ComposerContextSheet.tsx:353

Selecting an app context opens this sheet with record undefined, so it displays “Context unavailable” instead of the app name and bundle fields. App references have no draft record and ComposerEditor supplies only draft.context.records; reconstruct the app record from selectedReference (as the send path does) or pass that reference directly to the sheet.

🟠 High lib/composerContextRecords.ts:307

A 161–200 character app-reference label creates an AppContextRecord whose name exceeds the schema's 160-character limit, so the app context is dropped during decoding and the agent receives only the link without its application context. appContextRecordFromReference copies the normalized label unchanged; clamp name to 160 characters or omit the record before adding it.

🟠 High Layers/AntigravityAdapter.ts:810

Starting an Antigravity thread with managed CUA enabled exposes the cuaAcpMcpServer device-control tools to that provider, widening privileged computer access beyond the intended Codex-only restriction. mcp.cuaDriver is populated for every provider session, so this unconditional addition needs to be removed or gated to the Codex provider.

🟡 Medium cua/CuaDriver.ts:485

Disabling a successfully started desktop host leaves its host.waitForExit fiber permanently suspended, so every enable/start/disable cycle leaks a worker fiber until the server scope closes. The cleanup deletes exits.get(requestId) at line 489 without completing it, while the desktop's stopped report resolves only the new stopId; complete the original exit deferred before removing it from the map.

🟠 High state/cua.ts:16

Unmounting useCuaWindowPreview leaks the server-side ThreadPreview, so each viewed thread retains its PubSub and threads map entry for the server lifetime. The stream finalizer calls reconcile, but reconcile only deletes entries when preview.loop exists; idle or completed previews therefore accumulate for every distinct threadId. Update the server cleanup so a preview with no subscribers is deleted regardless of whether its loop is active.

🟠 High cua/cuaScreenshots.ts:104

saveCuaScreenshot allocates a Buffer for the entire untrusted image.base64 value before enforcing MAX_IMAGE_BYTES, so an oversized provider response can exhaust server memory during event ingestion. Reject base64 strings exceeding the encoded size of MAX_IMAGE_BYTES before calling Buffer.from.

🟠 High auth/RpcAuthorization.ts:108

Read-scoped clients can exhaust child-process and CPU resources on CUA-enabled macOS hosts by issuing parallel apps.list requests: concurrent cache misses each start an independent /usr/bin/mdfind process before InstalledApps.list writes its Ref, and each scan can run for up to 10 seconds. Add in-flight request sharing or locking around scan before exposing appsList with AuthOrchestrationReadScope.

🟠 High nativeAppIcons/linux.ts:134

A matching icon can expose arbitrary readable host files through the signed icon URL: existingFile accepts symlinks because stat follows them, and HttpServerResponse.file follows the returned path when serving it. Canonicalize the resolved path or reject symlinks, and validate that the final target is an allowed image before returning it.