Harden computer server launch and auth defaults by 0xjohnnydev · Pull Request #1563 · trycua/cua

0xjohnnydev · 2026-05-18T15:53:54Z

Summary

Fixes the launch command injection path by removing shell execution from the computer-server and cua-auto launch helpers.

Also tightens the exposed computer-server control surface:

require explicit local unauthenticated mode with CUA_ALLOW_UNAUTHENTICATED_LOCAL=1
gate run_command/shell/exec and PTY command creation behind CUA_ENABLE_RUN_COMMAND=1
protect /cmd, /ws, /playwright_exec, /responses, and mounted /mcp
default server binding to 127.0.0.1
lazy-init native handlers so importing/listing commands does not initialize macOS automation code
update critical dependency ranges and lockfiles for litellm, fastmcp, crawl4ai, nltk, and authlib-related alerts

Fixes #1097.

Testing

cd libs/python/computer-server && uv run --frozen --with pytest --with pytest-asyncio pytest tests/test_auth_availability.py tests/test_import_safety.py tests/test_window_launch.py
cd libs/python/cua-auto && uv run --no-project --python 3.12 --with pytest pytest tests/test_window_launch.py
ran the same focused computer-server suite on the remote macOS M4 test host
ran a /responses ComputerAgent smoke test locally and on the remote host

Summary by CodeRabbit

Release Notes

New Features
- Added authentication middleware for control surface endpoints with configurable local development mode via CUA_ALLOW_UNAUTHENTICATED_LOCAL.
- Added CUA_ENABLE_RUN_COMMAND environment variable to control command execution availability.
Bug Fixes
- Changed default server binding from 0.0.0.0 to 127.0.0.1 for enhanced security.
- Enforced authentication on control endpoints by default.
- Fixed command launch handling to treat shell metacharacters as literals instead of interpreting them.
Chores
- Updated dependencies: openai (≥2.24.0), fastmcp (≥3.2.0), litellm (≥1.83.7).

vercel · 2026-05-18T15:53:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		May 18, 2026 4:46pm

github-actions · 2026-05-18T15:54:09Z

📦 Publishable packages changed

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

coderabbitai · 2026-05-18T15:54:34Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d5a3f6fa-e2ea-48ab-aeb3-6648bf84dbd0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR addresses a command injection security vulnerability in process launching by eliminating shell=True usage, introduces authentication middleware for control surface endpoints, refactors command handling with lazy handler initialization, removes import-time permission prompts, and coordinates dependency version updates including fastmcp 3.2.0, litellm 1.83.7, and openai 2.24.0.

Changes

Command Injection Security Fix and Import Safety

Layer / File(s)	Summary
Safe command launching with shlex-based argv parsing `libs/python/computer-server/computer_server/handlers/generic.py`, `libs/python/cua-auto/cua_auto/window.py`	Introduces `build_launch_argv(app, args)` helper to safely parse command strings using `shlex.split()` instead of `shell=True`, eliminating OS command injection risk in both generic and auto handlers.
Tests for safe command launching `libs/python/computer-server/tests/test_window_launch.py`, `libs/python/cua-auto/tests/test_window_launch.py`	Unit tests verify argv tokenization, literal preservation of shell metacharacters, explicit args handling, non-shell subprocess invocation, and rejection of empty commands.
Import safety: lazy loading and permission-trigger removal `libs/python/computer-server/computer_server/__init__.py`, `libs/python/computer-server/computer_server/handlers/factory.py`, `libs/python/computer-server/computer_server/handlers/macos.py`	Moves OS-specific handler imports inside `create_handlers()` method branches, removes macOS accessibility/screen-recording permission prompts from module import, and adds lazy `__getattr__` for Server export.
Import safety verification tests `libs/python/computer-server/tests/test_import_safety.py`	Subprocess-based tests confirm importing package, generic handlers, and main module complete cleanly without permission-prompt side effects.

Authentication and Authorization Infrastructure Overhaul

Layer / File(s)	Summary
Authentication helpers and middleware `libs/python/computer-server/computer_server/main.py`	Adds `_allow_unauthenticated_local()`, `_run_command_enabled()`, `_auth_required_error()` helpers and new `ControlSurfaceAuthMiddleware` to enforce authentication for `/mcp` and control surface paths with JSON error responses.
Lazy handler initialization and command registry refactor `libs/python/computer-server/computer_server/main.py`	Replaces eager handler creation with `_get_handler_tuple()` lazy initialization, introduces `_STATIC_COMMAND_NAMES` and `_DYNAMIC_COMMAND_NAMES` constants, and creates centralized command discovery via `_get_command_handlers()` and signature-source helpers.
Command execution and validation refactoring `libs/python/computer-server/computer_server/main.py`	Refactors `/commands` endpoint with derived command name lists and signature sources, updates `/ws` and `/cmd` to validate commands via `_has_command()`, enforce `run_command` enablement, and route execution through `_get_handler_func()`.
Authentication enforcement across endpoints `libs/python/computer-server/computer_server/main.py`	Updates `AuthenticationManager.auth()` to deny cloud auth when `CONTAINER_NAME` missing unless local mode enabled; consolidates HTTP auth via `_require_auth()`; gates `/pty` and `/playwright_exec` behind auth; updates `/responses` conditional auth and agent-tool wiring.
Authentication and endpoint tests `libs/python/computer-server/tests/test_auth_availability.py`	Extensive test updates covering default 401 rejection for `/cmd`, `/pty`, `/playwright_exec` without auth; local unauthenticated mode; `run_command` feature gating with 403; WebSocket auth rejection; and `/responses` conditional availability.

Dependency Version Updates and Network Binding

Layer / File(s)	Summary
Dependency version constraints `libs/python/agent/pyproject.toml`, `libs/cua-bench/pyproject.toml`, `libs/python/computer-server/pyproject.toml`, `libs/python/cua-cli/pyproject.toml`, `pyproject.toml`	Updates `litellm` to `>=1.83.7,<1.84`; raises `fastmcp` to `>=3.2.0,<4`; updates `openai` to `>=2.24.0,<3`; upgrades `crawl4ai` to `>=0.8.0`; adds `uv` source mapping for `cua-agent` editable install.
Server network binding defaults changed to localhost `libs/python/computer-server/computer_server/cli.py`, `libs/python/computer-server/computer_server/server.py`, `libs/python/computer-server/computer_server/main.py`	Changes default `--host` binding from `0.0.0.0` (all interfaces) to `127.0.0.1` (localhost only) in CLI, Server class, and uvicorn startup.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

trycua/cua#1335: Overlaps in main.py and test_auth_availability.py with similar auth gating logic changes when CONTAINER_NAME is missing.
trycua/cua#1211: Both PRs update litellm dependency constraints in libs/python/agent/pyproject.toml to newer versions.
trycua/cua#1319: Potential overlap in namespace changes and lazy import patterns for cua_agent and cua_core modules.

Suggested labels

release:pypi/computer-server, release:pypi/computer, release:pypi/agent, release:pypi/cli

Suggested reviewers

r33drichards
ddupont808

Poem

🐰 Hop to it! Command injection's fixed with shlex so keen,
Import safety blooms—no side effects seen,
Auth gates the paths where secrets convene,
Localhost listens, handlers sleep clean. ✨

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Several changes appear out of scope: dependency updates to litellm, fastmcp, crawl4ai, and openai versions are not directly required to fix the command injection vulnerability or harden auth defaults.	Clarify whether dependency updates were necessary for the security fix or move them to a separate PR. Document why specific version ranges (e.g., litellm>=1.83.7,<1.84, fastmcp>=3.2.0) are required.
Docstring Coverage	⚠️ Warning	Docstring coverage is 22.78% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the primary changes: hardening security defaults for the computer server's launch mechanism and authentication requirements.
Linked Issues check	✅ Passed	The PR fully addresses the command injection vulnerability in issue `#1097` by removing shell=True, using shlex-based safe parsing in launch helpers, and adding comprehensive authentication/authorization controls.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/computer-server-launch-auth-hardening

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sentry · 2026-05-18T15:55:06Z

Codecov Report

❌ Patch coverage is 78.53107% with 76 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ibs/python/computer-server/computer_server/main.py	60.12%	63 Missing ⚠️
...omputer-server/computer_server/handlers/factory.py	0.00%	5 Missing ⚠️
...on/computer-server/tests/test_auth_availability.py	94.50%	5 Missing ⚠️
...python/computer-server/computer_server/__init__.py	60.00%	2 Missing ⚠️
...python/computer-server/tests/test_import_safety.py	94.11%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

github-actions · 2026-05-18T16:01:21Z

📦 Publishable packages changed

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

coderabbitai

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@libs/cua-bench/pyproject.toml`:
- Line 74: Update the litellm version constraint in pyproject.toml by changing
the dependency entry "litellm>=1.83.7,<1.84" to require at least 1.83.10 (i.e.,
"litellm>=1.83.10,<1.84") so the project uses the patched release that fixes the
sandbox escape vulnerability; locate the dependency string in the file and
replace the version specifier accordingly.

In `@libs/python/agent/pyproject.toml`:
- Line 24: Update the litellm version constraint in pyproject.toml: replace the
dependency string "litellm>=1.83.7,<1.84" with "litellm>=1.83.10,<1.84" to
ensure the package manager will not install vulnerable 1.83.7–1.83.9 releases
(locate the dependency line in libs/python/agent/pyproject.toml that currently
sets litellm>=1.83.7,<1.84).

In `@libs/python/computer-server/computer_server/cli.py`:
- Line 33: The CLI default for the "--host" argument was changed to "127.0.0.1",
which is a breaking change for deployments expecting external access; update the
project artifacts to surface this change by (1) adding a clear migration note in
the release notes and migration guide stating the new default and instructing
users to pass "--host 0.0.0.0" for external access, (2) updating the CLI help
text for the "--host" argument in
libs/python/computer-server/computer_server/cli.py to mention the breaking
change and the explicit flag value needed for remote bindings, and (optional)
(3) consider restoring the previous default to "0.0.0.0" if preserving backward
compatibility is required.

In `@libs/python/computer-server/computer_server/handlers/generic.py`:
- Around line 28-34: The tokenization currently always uses POSIX shlex rules
which breaks Windows paths; update build_launch_argv to call shlex.split with a
platform-aware posix flag (e.g. shlex.split(app, posix=(os.name != "nt"))), add
the required import (os) at top, keep the existing empty-check/ValueError
behavior, and ensure the branch for args is unchanged so Windows quoted paths
are parsed correctly when args is None.

In `@libs/python/computer-server/computer_server/server.py`:
- Line 38: The Server constructor's host default was changed to "127.0.0.1",
which is a breaking change for callers expecting external binding; restore the
previous default by changing the host parameter default back to "0.0.0.0" in the
Server class constructor (the host: str default in Server.__init__) so existing
code that calls Server() or Server(port=...) continues to bind externally; if
the change was intentional, instead add explicit documentation and/or raise a
visible warning in Server.__init__ so callers know they must pass
host="0.0.0.0".

In `@libs/python/cua-auto/cua_auto/window.py`:
- Around line 34-40: The POSIX-only shlex.split call in _build_launch_argv
breaks Windows paths; modify _build_launch_argv to call shlex.split(app,
posix=os.name != "nt") so shlex uses non-POSIX mode on Windows, and add an
import for os if missing; this change will also make callers like launch() that
use _build_launch_argv handle Windows command strings correctly.

In `@libs/python/cua-cli/pyproject.toml`:
- Line 52: Update the litellm version constraint in pyproject.toml: replace the
dependency string "litellm>=1.83.7,<1.84" with "litellm>=1.83.10,<1.84" so the
minimum version upgrades to 1.83.10 and the sandbox escape vulnerability is
addressed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1470a7ef-29a3-4ab0-bdff-85dafb73bcaa

📥 Commits

Reviewing files that changed from the base of the PR and between e00840a and b36e3f3.

⛔ Files ignored due to path filters (4)

libs/cua-bench/uv.lock is excluded by !**/*.lock
libs/python/cua-cli/uv.lock is excluded by !**/*.lock
libs/python/cua-sandbox/uv.lock is excluded by !**/*.lock
uv.lock is excluded by !**/*.lock

📒 Files selected for processing (17)

libs/cua-bench/pyproject.toml
libs/python/agent/pyproject.toml
libs/python/computer-server/computer_server/__init__.py
libs/python/computer-server/computer_server/cli.py
libs/python/computer-server/computer_server/handlers/factory.py
libs/python/computer-server/computer_server/handlers/generic.py
libs/python/computer-server/computer_server/handlers/macos.py
libs/python/computer-server/computer_server/main.py
libs/python/computer-server/computer_server/server.py
libs/python/computer-server/pyproject.toml
libs/python/computer-server/tests/test_auth_availability.py
libs/python/computer-server/tests/test_import_safety.py
libs/python/computer-server/tests/test_window_launch.py
libs/python/cua-auto/cua_auto/window.py
libs/python/cua-auto/tests/test_window_launch.py
libs/python/cua-cli/pyproject.toml
pyproject.toml

github-actions · 2026-05-18T16:26:59Z

📦 Publishable packages changed

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:31:06Z

📦 Publishable packages changed

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:39:51Z

📦 Publishable packages changed

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:57:15Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/computer-server — will auto-release on merge
pypi/cli

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:57:17Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/computer-server — will auto-release on merge
pypi/cli

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:57:19Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/computer-server — will auto-release on merge
pypi/cli

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:57:20Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/computer-server — will auto-release on merge
pypi/cli

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:57:26Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/computer-server — will auto-release on merge
pypi/cli

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

github-actions · 2026-05-18T16:57:48Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/cli — will auto-release on merge
pypi/computer-server — will auto-release on merge

github-actions · 2026-05-18T16:58:00Z

📦 Publishable packages changed

pypi/agent — will auto-release on merge
pypi/auto — will auto-release on merge
pypi/bench — will auto-release on merge
pypi/cli — will auto-release on merge
pypi/computer-server — will auto-release on merge

f-trycua · 2026-05-18T18:01:05Z

let's split in multiple PRs per area of interest

0xjohnnydev · 2026-05-18T18:44:10Z

Closing this combined PR after splitting it into smaller PRs by area of interest:

Fix launch command argument handling #1568 launch command-injection fix
Avoid native side effects during computer-server imports #1569 import safety / native side-effect cleanup
Require auth for computer-server control surfaces #1570 auth and control-surface hardening (stacked on Avoid native side effects during computer-server imports #1569)
Default computer-server binding to localhost #1571 localhost bind default
Raise security-sensitive dependency floors #1572 security dependency floors

Keeping fix/computer-server-launch-auth-hardening available as the source/reference branch for now.

Harden computer server launch and auth defaults

b36e3f3

Fix Python formatting for lint

71048c4

coderabbitai Bot reviewed May 18, 2026

View reviewed changes

Address security review dependency floors

8ced833

Move host bind note to current changelog

d12e782

Clarify server host default

58ab01d

ddupont808 added release:pypi/agent Release pypi/agent on merge release:pypi/computer Release pypi/computer on merge release:pypi/bench Release pypi/bench on merge release:pypi/computer-server Release pypi/computer-server on merge release:pypi/auto Release pypi/cua-auto on merge labels May 18, 2026

ddupont808 added release:pypi/cli Release pypi/cli on merge and removed release:pypi/computer Release pypi/computer on merge labels May 18, 2026

0xjohnnydev closed this May 18, 2026

0xjohnnydev deleted the fix/computer-server-launch-auth-hardening branch May 18, 2026 19:11

Uh oh!

Uh oh!

Conversation

0xjohnnydev commented May 18, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Summary by CodeRabbit

Release Notes

Uh oh!

vercel Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

coderabbitai Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (2 warnings)

Review ran into problems

Uh oh!

sentry Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

github-actions Bot commented May 18, 2026

📦 Publishable packages changed

Uh oh!

f-trycua commented May 18, 2026

Uh oh!

0xjohnnydev commented May 18, 2026

Uh oh!

0xjohnnydev commented May 18, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented May 18, 2026 •

edited

Loading

coderabbitai Bot commented May 18, 2026 •

edited

Loading

sentry Bot commented May 18, 2026 •

edited

Loading