fix(cua-driver-rs)(windows): cua-driver autostart enable self-elevates for RunLevel=Highest

[f-trycua]

Summary

PR #1630 made install.ps1 -AutoStart self-elevate when registering the autostart task at RunLevel=Highest. But the standalone CLI subcommand cua-driver autostart enable was left as-is — it just calls Register-ScheduledTask directly from whatever IL the user's shell is at, which fails with 0x80070005 Access is denied from a typical non-admin PowerShell.

This patch adds the same self-elevation flow to the Rust CLI: first attempt at current IL, on access-denied trigger a UAC prompt via Start-Process -Verb RunAs and re-run cua-driver autostart enable inside the elevated child shell.

UX before/after

Where	Before	After
install.ps1 -AutoStart from Medium IL	UAC prompt → registers at Highest ✅	unchanged ✅
cua-driver autostart enable from Medium IL	"Access is denied" error → user has to manually open admin PowerShell ❌	UAC prompt → registers at Highest ✅
cua-driver autostart enable from High IL (admin shell)	Registers at Highest ✅	unchanged ✅

Implementation

crates/cua-driver/src/autostart.rs::enable:

1. First attempt: register directly. Works for any caller already at High IL.
2. If the stderr matches access-denied signatures (0x80070005, "Access is denied", "permission", "requires elevation"), spawn powershell -Command "Start-Process -Verb RunAs ..." which fires the UAC prompt and re-invokes cua-driver autostart enable inside the elevated child. The elevated child hits branch (1) and registers cleanly.
3. If the UAC prompt is dismissed → exit non-zero in the child → parent surfaces an actionable error.

The PowerShell -Verb RunAs invocation uses CREATE_NO_WINDOW so the elevated child's console doesn't flash up.

Repro / verification

Surfaced during the cuademo fresh-install dogfood: a standard admin user (BUILTIN\Administrators, NOT RID 500, UAC-split-token) ran cua-driver autostart enable from their non-elevated PowerShell and got the 0x80070005 error. With this patch, the same invocation triggers a UAC prompt → accept → task registered at RunLevel=Highest.

• cargo check -p cua-driver clean on the VM (11.26s)
• End-to-end fresh-install on cuademo with v0.2.11 (requires a follow-up release bump)

Related

• feat(cua-driver-rs)(windows): register autostart task at RunLevel=Highest (unblocks UWP automation, #1602) #1630 (RunLevel=Highest)
• fix(cua-driver): install.ps1 OSArchitecture lookup under StrictMode Latest #1631 (OSArchitecture / StrictMode fix)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Enhanced Windows autostart functionality to intelligently handle permission requirements. When elevated privileges are needed for task registration, the system now automatically requests them, providing a seamless experience without manual intervention. Improved error handling delivers clearer diagnostic messages when issues occur.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored		May 21, 2026 4:39pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 914b8697-0406-4aa0-b79b-d2f70ef07b2a

📥 Commits

Reviewing files that changed from the base of the PR and between 2054da3 and 1e70674.

📒 Files selected for processing (1)

• libs/cua-driver-rs/crates/cua-driver/src/autostart.rs

---

📝 Walkthrough

Walkthrough

Windows scheduled-task registration in the autostart enable path now attempts registration directly and returns success immediately if the PowerShell command succeeds. On failure, it detects elevation-related stderr patterns and spawns an elevated PowerShell process to retry registration from a privileged context, or returns an error if the failure is unrelated to elevation.

Changes

Windows Autostart Registration with Self-Elevation

Layer / File(s)

Summary

Scheduled task registration with self-elevation retry libs/cua-driver-rs/crates/cua-driver/src/autostart.rs

Windows autostart::platform::enable now runs the PowerShell task registration command once and immediately returns success if it succeeds. On failure, it parses stderr to detect "access denied" or other elevation-required patterns. If elevation is likely needed, it spawns an elevated PowerShell process using Start-Process ... -Verb RunAs that re-invokes the driver binary with autostart enable to retry registration from a privileged context. Non-elevation failures return a simpler error including exit code and stderr; elevation helper failures indicate a likely UAC prompt dismissal.

Sequence Diagram

sequenceDiagram
  participant Driver as Driver Process
  participant PS as PowerShell (User)
  participant Task as Task Scheduler
  participant UAC as Windows UAC
  participant ElevPS as PowerShell (Elevated)
  
  Driver->>PS: Execute registration command
  PS->>Task: Register scheduled task
  Task-->>PS: error: Access Denied
  PS-->>Driver: Return stderr with access denied
  Driver->>UAC: Request elevation via Start-Process -Verb RunAs
  UAC->>ElevPS: User approves → launch elevated PowerShell
  ElevPS->>Driver: Re-run autostart enable
  Driver->>ElevPS: Execute registration command (elevated)
  ElevPS->>Task: Register scheduled task (elevated)
  Task-->>ElevPS: Success
  ElevPS-->>Driver: exit code 0
  Driver-->>Driver: Return Ok()

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• trycua/cua#1550: Both PRs modify libs/cua-driver-rs/crates/cua-driver/src/autostart.rs for Windows autostart—specifically the enable path/task-registration logic—so the main PR's UAC self-elevation handling is directly related to the retrieved PR's new cua-driver autostart enable implementation.

Poem

🐰 A rabbit hops through Windows UAC gates,
First attempt denied, but patience awaits—
With elevated wings, a PowerShell soars,
Re-running with keys to locked privilege doors! 🔑✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cua-driver-rs-autostart-self-elevation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}