fix(cua-driver): repair desktop discovery, typing and click delivery

.github/scripts/cua-driver-mcp-compat/expected-tools.json

@@ -1,15 +1,16 @@
 {
-  "serverName": "cua-driver",
+  "serverName": "opensky-driver",
   "outputSchemaCountByPlatform": {
-    "darwin": 32,
-    "linux": 36,
-    "win32": 32
+    "darwin": 34,
+    "linux": 38,
+    "win32": 34
   },
   "baseTools": [
     "bring_to_front",
     "browser_click",
     "browser_dialog",
     "browser_download",
+    "browser_key",
     "browser_navigate",
     "browser_pointer",
     "browser_prepare",
@@ -20,6 +21,7 @@
     "click",
     "clipboard_read",
     "clipboard_write",
+    "close_window",
     "double_click",
     "drag",
     "end_session",

.github/scripts/tests/test_cua_driver_release_wiring.py

@@ -1,4 +1,9 @@
-"""Regression tests for cua-driver-rs release and PyPI wiring."""
+"""Release/PyPI wiring and explicitly named retained upstream download checks.
+
+OpenSky's public installers build source through install-local. Download version,
+channel, migration and UAC checks below target the retained upstream installer,
+not the source wrapper; they do not certify the OpenSky installation workflow.
+"""
 
 import json
 from pathlib import Path
@@ -325,7 +330,7 @@ def test_driver_installer_version_advances_only_after_publication(self) -> None:
         self.assertIn("-F force=false", workflow)
         self.assertIn("[skip ci]", workflow)
 
-    def test_release_installers_preserve_legacy_telemetry_state_before_cleanup(self) -> None:
+    def test_retained_upstream_release_installers_preserve_legacy_telemetry_state_before_cleanup(self) -> None:
         installer = self.read("libs/cua-driver/scripts/_install-rust.sh")
         cleanup = installer.index('rm -rf "$LEGACY_HOME_DIR"')
         self.assertLess(
@@ -337,7 +342,7 @@ def test_release_installers_preserve_legacy_telemetry_state_before_cleanup(self)
             cleanup,
         )
 
-        powershell = self.read("libs/cua-driver/scripts/install.ps1")
+        powershell = self.read("libs/cua-driver/scripts/_upstream-install.ps1")
         cleanup = powershell.index("Remove-Item -LiteralPath $LegacyHomeDir -Recurse -Force")
         self.assertLess(
             powershell.index(
@@ -350,19 +355,19 @@ def test_release_installers_preserve_legacy_telemetry_state_before_cleanup(self)
             cleanup,
         )
 
-    def test_release_installers_bound_cursor_theme_compatibility(self) -> None:
+    def test_retained_upstream_release_installers_bound_cursor_theme_compatibility(self) -> None:
         shell = self.read("libs/cua-driver/scripts/_install-rust.sh")
         self.assertIn('CURSOR_THEME_REQUIRED_FROM="0.12.7"', shell)
         self.assertIn('"$VERSION" "$CURSOR_THEME_REQUIRED_FROM"', shell)
 
-        powershell = self.read("libs/cua-driver/scripts/install.ps1")
+        powershell = self.read("libs/cua-driver/scripts/_upstream-install.ps1")
         self.assertIn('$CursorThemeRequiredFrom = [version]"0.12.7"', powershell)
         self.assertIn("[version]$version -ge $CursorThemeRequiredFrom", powershell)
 
-    def test_windows_installer_elevates_autostart_binary_without_command_string(
+    def test_retained_upstream_windows_installer_elevates_autostart_binary_without_command_string(
         self,
     ) -> None:
-        powershell = self.read("libs/cua-driver/scripts/install.ps1")
+        powershell = self.read("libs/cua-driver/scripts/_upstream-install.ps1")
         block = powershell.split(
             "function Register-CuaDriverAutostart {", maxsplit=1
         )[1].split(
@@ -384,40 +389,34 @@ def test_local_installer_does_not_clean_release_or_legacy_homes(self) -> None:
         installer = self.read("libs/cua-driver/scripts/_install-local-rust.sh")
 
         self.assertIn(
-            'HOME_DIR="${CUA_DRIVER_LOCAL_HOME:-$HOME/.cua-driver-local}"',
+            'HOME_DIR="${CUA_DRIVER_LOCAL_HOME:-$HOME/.opensky-driver}"',
             installer,
         )
         self.assertNotIn("LEGACY_HOME_DIR", installer)
         self.assertNotIn(".cua-driver-rs", installer)
         self.assertNotIn('rm -rf "$HOME/.cua-driver"', installer)
 
-    def test_local_install_hints_name_the_local_permission_identity(self) -> None:
+    def test_local_install_hints_name_the_opensky_permission_identity(self) -> None:
         installer = self.read("libs/cua-driver/scripts/_install-local-rust.sh")
         shared_hints = self.read("libs/cua-driver/scripts/post-install-hints.txt")
 
-        self.assertIn('permission prompts say \\"Cua Driver Local\\"', installer)
-        self.assertNotIn('permission prompts say \\"Cua Driver\\"', installer)
-        self.assertIn("launches the installed", shared_hints)
-        self.assertNotIn("launches CuaDriver", shared_hints)
+        self.assertIn('permission prompts say \\"OpenSky Driver\\"', installer)
+        self.assertIn("grant to OpenSky Driver", shared_hints)
+        self.assertIn("{{BINARY}} permissions grant", shared_hints)
 
-    def test_post_install_hints_include_muse_stdio_mcp_config(self) -> None:
+    def test_post_install_hints_link_the_opensky_sdk_and_source(self) -> None:
         shared_hints = self.read("libs/cua-driver/scripts/post-install-hints.txt")
 
-        self.assertIn("Muse Code (macOS / Linux", shared_hints)
-        self.assertIn("$XDG_CONFIG_HOME/muse/settings.json", shared_hints)
-        self.assertIn('"mcp_servers": {', shared_hints)
-        self.assertIn('"transport": "stdio"', shared_hints)
-        self.assertIn('"command": "{{BINARY}}"', shared_hints)
-        self.assertIn('"args": ["mcp"]', shared_hints)
-        self.assertIn("MCP servers load at startup", shared_hints)
+        self.assertIn("https://github.com/tanishqkancharla/opensky", shared_hints)
+        self.assertIn("https://github.com/tanishqkancharla/cua", shared_hints)
+        self.assertIn("{{BINARY}} skills install", shared_hints)
 
-    def test_post_install_hints_use_canonical_capability_manifest_flags(self) -> None:
+    def test_post_install_hints_show_product_identity_and_sdk_diagnostics(self) -> None:
         shared_hints = self.read("libs/cua-driver/scripts/post-install-hints.txt")
 
-        self.assertIn("--capability-manifest", shared_hints)
-        self.assertIn("--approve-capability-manifest", shared_hints)
-        self.assertNotIn("--session-policy", shared_hints)
-        self.assertNotIn("--approve-session-policy", shared_hints)
+        self.assertIn("{{BINARY}} --version", shared_hints)
+        self.assertIn("{{BINARY}} --opensky-driver-identity", shared_hints)
+        self.assertIn("opensky doctor", shared_hints)
 
     def test_agent_sdk_examples_use_implicit_sessions_and_per_call_targets(self) -> None:
         example_dir = REPO_ROOT / "libs/cua-driver/examples/agent-sdks"
@@ -453,17 +452,17 @@ def test_local_macos_signing_uses_an_unambiguous_identity_hash(self) -> None:
         )
         self.assertNotIn("printf '%s' \"$CUA_LOCAL_SIGN_CN\"; return", signing)
 
-    def test_release_installers_persist_channel_before_binary_swap(self) -> None:
+    def test_retained_upstream_release_installers_persist_channel_before_binary_swap(self) -> None:
         shell = self.read("libs/cua-driver/scripts/_install-rust.sh")
         hint = shell.index('> "$HOME_DIR/.telemetry_install_channel"')
         self.assertLess(hint, shell.index('ditto "$SRC_APP" "$APP_DEST"'))
         self.assertLess(hint, shell.index('mv -Tf "$TMP_LINK" "$CURRENT_LINK"'))
 
-        powershell = self.read("libs/cua-driver/scripts/install.ps1")
+        powershell = self.read("libs/cua-driver/scripts/_upstream-install.ps1")
         hint = powershell.index("Set-Content -LiteralPath $telemetryHintPath")
         self.assertLess(hint, powershell.index("Ensure-Junction $CurrentDir    $versionedDir"))
 
-    def test_release_installers_gate_channel_hint_on_effective_consent(self) -> None:
+    def test_retained_upstream_release_installers_gate_channel_hint_on_effective_consent(self) -> None:
         shell = self.read("libs/cua-driver/scripts/_install-rust.sh")
         self.assertIn(
             "for telemetry_env_name in CUA_DRIVER_RS_TELEMETRY_ENABLED CUA_TELEMETRY_ENABLED",
@@ -473,7 +472,7 @@ def test_release_installers_gate_channel_hint_on_effective_consent(self) -> None
         self.assertIn('"telemetry_enabled"', shell)
         self.assertIn('[[ "$TELEMETRY_HINT_ENABLED" == "1" ]]', shell)
 
-        powershell = self.read("libs/cua-driver/scripts/install.ps1")
+        powershell = self.read("libs/cua-driver/scripts/_upstream-install.ps1")
         self.assertIn(
             "@('CUA_DRIVER_RS_TELEMETRY_ENABLED', 'CUA_TELEMETRY_ENABLED')",
             powershell,
@@ -707,10 +706,10 @@ def test_driver_release_blocks_on_packaged_mcp_client_discovery(self) -> None:
         self.assertEqual(
             len(expected["baseTools"]), len(set(expected["baseTools"]))
         )
-        self.assertEqual(len(expected["baseTools"]), 56)
+        self.assertEqual(len(expected["baseTools"]), 58)
         self.assertEqual(
             expected["outputSchemaCountByPlatform"],
-            {"darwin": 32, "linux": 36, "win32": 32},
+            {"darwin": 34, "linux": 38, "win32": 34},
         )
         self.assertEqual(
             expected["platformTools"],

.github/scripts/tests/test_release_channel_installers.py

@@ -96,10 +96,10 @@ def test_lume_api_filter_is_exact_draft_aware_and_channel_scoped():
     assert '"draft"[[:space:]]*:[[:space:]]*false' in body
 
 
-def test_installers_make_channel_persistent_but_keep_exact_pins_one_shot():
+def test_lume_and_retained_upstream_driver_persist_channel_with_one_shot_pins():
     lume = LUME_INSTALLER.read_text()
     driver = (ROOT / "libs/cua-driver/scripts/_install-rust.sh").read_text()
-    windows = (ROOT / "libs/cua-driver/scripts/install.ps1").read_text(encoding="utf-8-sig")
+    windows = (ROOT / "libs/cua-driver/scripts/_upstream-install.ps1").read_text(encoding="utf-8-sig")
 
     assert 'RELEASE_CHANNEL_PATH="$LUME_HOME/release-channel"' in lume
     assert 'if [ "$LUME_CHANNEL_EXPLICIT" = true ]' in lume
@@ -128,8 +128,8 @@ def test_driver_download_uses_the_resolved_tag_not_the_stable_prefix():
     assert "releases/download/${TAG_PREFIX}" not in body
 
 
-def test_windows_driver_has_disjoint_exact_pin_grammars():
-    source = (ROOT / "libs/cua-driver/scripts/install.ps1").read_text(encoding="utf-8-sig")
+def test_retained_upstream_windows_driver_has_disjoint_exact_pin_grammars():
+    source = (ROOT / "libs/cua-driver/scripts/_upstream-install.ps1").read_text(encoding="utf-8-sig")
     assert '$NightlyTagPrefix = "nightly-cua-driver-rs-v"' in source
     stable = re.search(
         r"\^\(\?:cua-driver-rs-v\|v\)\?\(\[0-9\]\+.*?\$", source

.github/scripts/tests/test_update_cua_driver_installer_version.py

@@ -19,14 +19,16 @@ def copy_installers(tmp_path: Path) -> tuple[Path, Path, Path]:
     shell = tmp_path / "_install-rust.sh"
     powershell = tmp_path / "install.ps1"
     shell.write_bytes((source / shell.name).read_bytes())
-    powershell.write_bytes((source / powershell.name).read_bytes())
     state = tmp_path / "published-version"
     state.write_bytes(
         (
             REPO_ROOT
             / ".github/release-state/cua-driver-rs-published-version"
         ).read_bytes()
     )
+    # Input document for the retained historical release stamper. OpenSky's
+    # source installer is not a versioned binary-download installer.
+    powershell.write_text(f'$Script:CuaDriverRsBakedVersion = "{state.read_text().strip()}" # published-installer-version\n')
     return shell, powershell, state
 
 

.github/scripts/tests/test_validate_release_versions.py

@@ -30,7 +30,15 @@ def copy_release_sources(destination: Path) -> None:
 
 
 def test_current_release_versions_agree():
-    validate(REPO_ROOT, "all")
+    validate(REPO_ROOT, "all", driver_installation="source")
+
+
+def test_source_build_still_rejects_package_version_drift(tmp_path: Path):
+    copy_release_sources(tmp_path)
+    package = tmp_path / "libs/cua-driver/python/pyproject.toml"
+    package.write_text(re.sub(r'^version = "[^"]+"', 'version = "9.9.9"', package.read_text(), count=1, flags=re.MULTILINE))
+    with pytest.raises(VersionError, match="python/pyproject.toml=9.9.9"):
+        validate(tmp_path, "driver", driver_installation="source")
 
 
 def test_version_drift_fails_with_the_source_name(tmp_path: Path):
@@ -59,7 +67,9 @@ def set_driver_installer_versions(
         )
     )
     powershell = root / "libs/cua-driver/scripts/install.ps1"
-    powershell_source = powershell.read_text()
+    # Historical release-mode input. The current OpenSky public installer is a
+    # source-build wrapper and intentionally has no baked download version.
+    powershell_source = '$Script:CuaDriverRsBakedVersion = "0.0.0" # published-installer-version\n'
     powershell.write_text(
         re.sub(
             r'^\$Script:CuaDriverRsBakedVersion\s*=\s*"[^"]+"',

.github/scripts/validate_release_versions.py

@@ -135,20 +135,26 @@ def lume_versions(root: Path) -> tuple[str, dict[str, str]]:
     }
 
 
-def validate(root: Path, product: str) -> None:
+def validate(root: Path, product: str, *, driver_installation: str = "release") -> None:
+    if driver_installation not in {"source", "release"}:
+        raise VersionError(f"unknown driver installation mode: {driver_installation}")
     manifest = json.loads((root / ".release-please-manifest.json").read_text())
     if product in {"all", "driver"}:
         expected, values = driver_versions(root)
         values[".release-please-manifest.json"] = str(manifest["libs/cua-driver"])
         require_equal("Cua Driver", expected, values)
-        installers = driver_installer_versions(root)
-        installer_version = next(iter(installers.values()))
-        require_equal("Cua Driver baked installers", installer_version, installers)
-        if stable_version_tuple(installer_version) > stable_version_tuple(expected):
-            raise VersionError(
-                f"Cua Driver baked installers advertise {installer_version}, "
-                f"ahead of source release {expected}"
-            )
+        # OpenSky installs this checkout's build. It has no published download
+        # version to compare. Preserve the explicit release mode for historical
+        # release tooling; every source/package version check above still runs.
+        if driver_installation == "release":
+            installers = driver_installer_versions(root)
+            installer_version = next(iter(installers.values()))
+            require_equal("Cua Driver baked installers", installer_version, installers)
+            if stable_version_tuple(installer_version) > stable_version_tuple(expected):
+                raise VersionError(
+                    f"Cua Driver baked installers advertise {installer_version}, "
+                    f"ahead of source release {expected}"
+                )
     if product in {"all", "lume"}:
         expected, values = lume_versions(root)
         values[".release-please-manifest.json"] = str(manifest["libs/lume"])
@@ -159,13 +165,15 @@ def main(argv: Sequence[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--repo-root", type=Path, default=Path.cwd())
     parser.add_argument("--product", choices=("all", "driver", "lume"), default="all")
+    parser.add_argument("--driver-installation", choices=("source", "release"), default="release",
+                        help="source checks build/package versions; release also checks baked download installer versions")
     args = parser.parse_args(argv)
     try:
-        validate(args.repo_root.resolve(), args.product)
+        validate(args.repo_root.resolve(), args.product, driver_installation=args.driver_installation)
     except (KeyError, OSError, VersionError, ValueError) as error:
         print(f"release version error: {error}", file=sys.stderr)
         return 1
-    print(f"release versions agree for {args.product}")
+    print(f"release versions agree for {args.product} (driver installation: {args.driver_installation})")
     return 0
 
 

.github/workflows/ci-cua-driver-contract-clients.yml

@@ -179,7 +179,7 @@ jobs:
   verify:
     name: Generated contract and SDK bindings
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: dtolnay/rust-toolchain@stable
@@ -214,9 +214,36 @@ jobs:
         working-directory: libs/cua-driver/rust
         run: cargo run --locked -p cua-driver-contract --bin cua-contract-gen -- all --check
 
-      - name: Verify generated UniFFI bindings
+      - name: Generate UniFFI bindings for review
+        id: generate-uniffi
         working-directory: libs/cua-driver
-        run: node scripts/generate-uniffi-bindings.mjs --check
+        run: |
+          node scripts/generate-uniffi-bindings.mjs
+          git rev-parse HEAD > uniffi-source-commit.txt
+
+      - name: Verify generated UniFFI bindings are committed
+        working-directory: libs/cua-driver
+        run: |
+          git diff --exit-code -- python/src/cua_driver/_native.py python/src/cua_driver/_native_contract.py \
+            python/.cua-driver-uniffi-generated-files typescript/src/native typescript/.cua-driver-uniffi-generated-files
+          test -z "$(git ls-files --others --exclude-standard -- python/src/cua_driver/_native.py python/src/cua_driver/_native_contract.py \
+            python/.cua-driver-uniffi-generated-files typescript/src/native typescript/.cua-driver-uniffi-generated-files)"
+
+      - name: Retain generated UniFFI bindings
+        if: ${{ !cancelled() && steps.generate-uniffi.outcome == 'success' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: opensky-uniffi-bindings-${{ github.event.pull_request.head.sha || github.sha }}
+          include-hidden-files: true
+          retention-days: 7
+          if-no-files-found: error
+          path: |
+            libs/cua-driver/uniffi-source-commit.txt
+            libs/cua-driver/python/.cua-driver-uniffi-generated-files
+            libs/cua-driver/python/src/cua_driver/_native.py
+            libs/cua-driver/python/src/cua_driver/_native_contract.py
+            libs/cua-driver/typescript/.cua-driver-uniffi-generated-files
+            libs/cua-driver/typescript/src/native
 
       - name: Verify generated public C ABI header
         working-directory: libs/cua-driver/rust
@@ -275,6 +302,10 @@ jobs:
             grep -Eq "[[:space:]]${symbol}$" /tmp/cua-driver-abi-symbols.txt
           done
 
+      - name: Build real driver for Python SDK lifecycle coverage
+        working-directory: libs/cua-driver/rust
+        run: cargo build --locked -p cua-driver
+
       - name: Test Python UniFFI loader
         working-directory: libs/cua-driver/python
         run: |

.github/workflows/ci-release-metadata.yml

@@ -82,7 +82,7 @@ jobs:
           python3 .github/scripts/release_attribution.py "${ARGS[@]}"
 
       - name: Validate checked-in release versions
-        run: python3 .github/scripts/validate_release_versions.py --product all
+        run: python3 .github/scripts/validate_release_versions.py --product all --driver-installation source
 
       - name: Preflight trusted Release Please attribution
         if: >-