feat(cu): add exact cua-driver executor service

[hqhq1025]

Upstream stack notice

This is stack PR C. It depends on #892 and must not merge before it.

The Files tab is cumulative until preceding fork branches are rebased after merge.

Review the exact 21-file executor net diff now in fork-local PR hqhq1025#2.

Current rebase verification: full repository build; @maka/computer-use 103/103; full repository typecheck.

---

Stack position

PR C, stacked on fork PR #1 (codex/cu-runtime-foundation), which is stacked on upstream draft #857.

This fork-local PR preserves the executor-only diff. After the preceding slices merge upstream, it will be retargeted to maka-agent/main.

Summary

Adds the sole native Computer Use executor behind the Runtime contract.

• long-lived, role-separated cua-driver action/capture services;
• bounded startup, request, abort, timeout, shutdown, and consecutive restart budgets;
• exact executable hash and MCP server/config attestation before ready;
• unknown-outcome classification after delivered request loss, with no replay;
• exact PID/window/capture-local coordinate validation;
• page target plus privacy-safe document fingerprint validation;
• native structural AX fingerprint for coordinate actions;
• token-exact semantic refetch, with unique role+label fallback only when the original element had no token;
• target-bound keyboard ownership and verified native/Electron text readback;
• zero foreground/windowless input paths;
• privacy-safe trace projections without raw driver messages;
• fail-closed selector requiring an explicit binary path and pinned SHA.

Reverse-engineering alignment

• direct child ownership and exact executable matching follow the Codex service manager evidence;
• the action and capture roles remain isolated and independently recoverable;
• delivered request failure is outcome_unknown, never automatically retried;
• semantic element ambiguity and token replacement fail closed;
• page execution remains through cua-driver's PID-owned page tool, not direct CDP;
• presentation, provider wire codecs, Desktop lifecycle producers, and release packaging remain outside this slice.

Review hardening

Adversarial review findings fixed before publication:

• successful starts reset the consecutive restart budget;
• initialize identity and set_config tool errors are attested;
• binary SHA is verified before every spawn;
• native structure replacement and same-target Electron document replacement are rejected;
• token mismatch cannot fall back to role+label replacement;
• outcome trace events exclude raw driver error text;
• Desktop resource discovery was removed from this package.

Verification

• @maka/computer-use: 97/97;
• Runtime: 1420 passed, 2 skipped, 0 failed;
• Core: 834/834;
• UI: 125/125;
• Desktop: 2385/2385;
• full repository build passed;
• full repository typecheck passed;
• git diff --check passed.

Non-goals

• binary download, license manifest, signing, and notarization;
• Desktop/CLI wiring and capability UI;
• physical-input and lock-screen event producers;
• cursor/PiP presentation;
• provider qualification and real-model E2E.

[hqhq1025]

@astrohan This Computer Use stack slice is ready for review. Please follow the dependency and merge order stated at the top of the PR; the exact net diff is linked there.

[hqhq1025]

@astrohan P0 blocker found in live concurrent use: the current compatibility driver PID-bound CGEvent path does not move the pointer or steal focus, but it can still interfere with the user physical mouse button state. Do not merge the Computer Use stack as fully background-safe yet. I am preparing a fail-closed follow-up that disables every CGEvent mouse/keyboard path and retains only AX/CDP/screenshot operations until the native event backend can prove isolation.

[hqhq1025]

@astrohan P0 follow-up #905 now contains the fail-closed fix for the live physical-click interference. Coordinate CGEvent click/scroll/drag/key paths are disabled by default; please include #905 before treating the stack as concurrent-user safe.

[Astro-Han]

Requesting changes for one blocker. I rechecked the latest f57fb9d0 fixes and did not keep the earlier claims about background drag or scroll being incompatible with the bundled fork.

P1

1. The production selector cannot enable allowCompatibilityInputDispatch. It is not part of selectComputerUseBackend()'s input and is never passed to createCuaDriverBackend() (select-backend.ts:54-75). As a result, coordinate click, scroll, drag, and press_key return unsupported_action on every normal Desktop call (cua-driver-backend.ts:1800-1803, 1938-1945, 2113-2116, 2169-2172). type is also unreachable because its keyboard target is established only by a successful left_click, which the same fence blocks (cua-driver-backend.ts:1990-2002, 2395-2414). This is the executor's advertised core surface, not an edge case. Either expose only the semantic actions that actually work, or wire a safe production implementation for these actions. Simply setting the flag to true would reopen several P2 issues below.

P2

1. Semantic refetch treats one matching role and label as the same element and ignores the original frame, depth, and value (cua-driver-backend.ts:914-929, 1313-1360). A dynamic UI can replace a unique Continue or Delete control and the action will be sent to the replacement.
2. physicalInputRecentlyActive is optional and the selector does not require a host guard. Semantic click and set-value dispatch proceed when no callback is supplied (cua-driver-backend.ts:309-323; select-backend.ts:54-75).
3. If compatibility dispatch is enabled, type uses the last click-owned keyboard target for the session and turn without checking the current bound window or page (cua-driver-backend.ts:1372-1379, 2395-2414). Observing another window can still send text to the old one.
4. The Electron click script can deliver element.click() and observe a click event but return no_observable_effect when no synchronous DOM mutation follows (cua-driver-page-target.ts:230-267). The backend converts that delivered action to ordinary capture_failed, which makes an unsafe retry look reasonable (cua-driver-backend.ts:1704-1715).
5. A delivered native or Electron text write can also become capture_failed: the type catch rewrites every lifecycle error after set_value or insert_text (cua-driver-backend.ts:2395-2422). It should preserve outcome_unknown after delivery.
6. select_text and perform_secondary_action are called here, but neither tool exists in the pinned bundled source registry (cua-driver-backend.ts:1840-1850). These actions always fail at runtime.
7. One process-wide operationQueue serializes unrelated sessions (cua-driver-backend.ts:305-306, 494-529). A slow capture or timeout for one user stalls every other Computer Use session.
8. Window observations return the raw get_window_state image without the compression and 8 MiB cap used by desktop capture (cua-driver-backend.ts:821-875). A large window frame can exceed provider limits or consume unbounded memory.
9. Backend observations remain in the observations map until a semantic action consumes that exact ID or the session is cleared (cua-driver-backend.ts:294-305, 855-865, 1786-1793). Repeated coordinate observations retain old AX labels and values for the life of the session.
10. The native content fingerprint hashes role, frame, and depth but not label or value (cua-driver-backend.ts:338-350). A control changing from Cancel to Delete in the same structural slot does not invalidate a bound coordinate action.

The latest CI is green, and the focused package tests pass. The P1 is about the production path being permanently fenced off, not test coverage.

[Astro-Han]

Approving after correcting my earlier severity call. The disabled compatibility input surface is a deliberate fail-closed limitation. This PR is not wired into Desktop on its own, and native AX/CDP semantic actions remain available. The missing coordinate path is therefore P2, not a P1 production regression. The later physical-input guard should land before compatibility dispatch is enabled or the stack is described as concurrent-user safe.

P2

1. Coordinate click, scroll, drag, press_key, and the click-established type path are unavailable through the normal selector because allowCompatibilityInputDispatch is not exposed there (select-backend.ts:54-75; cua-driver-backend.ts:1800-1803, 1938-1945, 1990-2002, 2113-2116, 2169-2172, 2395-2414). This is a material product limitation, but it fails closed.
2. Semantic refetch treats one matching role and label as the same element and ignores the original frame, depth, and value (cua-driver-backend.ts:914-929, 1313-1360). A dynamic UI can replace a unique control and receive the pending action.
3. physicalInputRecentlyActive is optional, and the selector does not require a host guard. Semantic click and set-value dispatch proceed when no callback is supplied (cua-driver-backend.ts:309-323; select-backend.ts:54-75).
4. If compatibility dispatch is enabled, type uses the last click-owned keyboard target for the session and turn without checking the current bound window or page (cua-driver-backend.ts:1372-1379, 2395-2414). Observing another window can still send text to the old one.
5. The Electron click script can deliver element.click() and observe a click event but return no_observable_effect when no synchronous DOM mutation follows (cua-driver-page-target.ts:230-267). The backend converts that delivered action to capture_failed, which can invite a retry.
6. A delivered native or Electron text write can also become capture_failed: the type catch rewrites every lifecycle error after set_value or insert_text (cua-driver-backend.ts:2395-2422). It should preserve outcome_unknown after delivery.
7. select_text and perform_secondary_action are called here, but neither tool exists in the pinned bundled source registry (cua-driver-backend.ts:1840-1850). These actions fail at runtime.
8. One process-wide operationQueue serializes unrelated sessions (cua-driver-backend.ts:305-306, 494-529). A slow capture or timeout for one user stalls every other Computer Use session.
9. Window observations return the raw get_window_state image without the compression and 8 MiB cap used by desktop capture (cua-driver-backend.ts:821-875). A large frame can exceed provider limits or consume excessive memory.
10. Observations remain in the observations map until a semantic action consumes that exact ID or the session is cleared (cua-driver-backend.ts:294-305, 855-865, 1786-1793). Repeated coordinate observations retain old AX data for the life of the session.
11. The native content fingerprint hashes role, frame, and depth but not label or value (cua-driver-backend.ts:338-350). A control changing meaning in the same structural slot does not invalidate a bound coordinate action.

No P0 or P1. CI is green, and the focused package tests pass. This approval supersedes my earlier request for changes.

[hqhq1025]

Post-merge follow-up #910 now tracks and fixes the actionable executor findings from the final review. It covers semantic replacement/ambiguity, label/value fingerprints, window screenshot limits, bounded observation retention, keyboard target rebinding, delivered-action outcome_unknown, and unavailable driver registry actions. The global queue and disabled compatibility input surface are intentionally retained; rationale and remaining work are documented in the PR.