Harden local and remote CUA computer use

[milind-soni]

Summary

• pin the CUA SDK and packaged/local/remote executables to 0.20.0 with verified release and PyPI checksums, telemetry disabled, health-report validation, and a real capture readiness probe
• replace the unused remote computer server with a private CUA Driver daemon that reattaches after Box resume; actions and captures prefer CUA and retain the existing X11 path as a degraded fallback
• add semantic Chrome snapshot, click, and fill tools over loopback DevTools with fresh-ref enforcement and safe URL output
• prevent Box credential injection for new VMs and execute agent commands in a clean desktop-only environment for existing VMs
• remove the broken stopped-container resume path; idle cleanup recycles only the disposable container while preserving the prepared image and durable workspace
• refresh the checked-in server build output for the complete stacked computer integration

Validation

• pnpm typecheck
• pnpm check:electron
• pnpm test — 465 passed, 8 skipped
• pnpm build
• pnpm build:server
• pnpm build:cua
• node scripts/smoke-cua.mjs — 56 CUA tools discovered and a live PNG frame captured
• generated remote bootstrap validated with bash syntax checks and contract tests

Stack

This draft is based on codex/local-vm-idle-suspend (#156). Merge the stack from its earliest PR upward.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2bec4940-4d90-4ab0-a09f-1d5c0c38f619

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[milind-soni]

Superseded by #158, which carries the full CUA hardening on current main and has now merged.