chore(cua): upgrade bundled driver to v0.14.1

docs/architecture/plugin-external-runtime-lifecycle/plan.md

@@ -3,7 +3,7 @@
 ## Status
 
 Lifecycle and model-facing CUA compatibility implementation are complete with automated validation.
-The v0.13.1 native cross-platform release gates remain pending.
+The v0.14.1 native cross-platform release gates remain pending.
 
 ## 1. Freeze the contracts
 
@@ -127,6 +127,21 @@ The v0.13.1 native cross-platform release gates remain pending.
 - Leave normal `start_session.cursor_theme` unset and avoid adding a parameter-policy shim to the
   adapter.
 
+## 12. Upgrade the closed CUA contract to 0.14.1
+
+- Pin `cua-driver-rs-v0.14.1`, its release commit, assets, and SHA-256 values without expanding the
+  supported target matrix.
+- Keep the embedded daemon/proxy protocol contract and 49-tool catalog closed unless native
+  generation proves an intentional upstream change.
+- Preserve raw browser-chrome capture coverage and project only the exact reviewed recovery shape
+  into model-visible content using fixed, bounded identifiers.
+- Document that the signal is a window-scope limitation rather than evidence that a browser prompt
+  exists, and require verified ineffectiveness before desktop escalation.
+- Accept the bundled v2 action-only cursor theme contract while treating separately installed v2
+  themes and retired v1 rejection as native release gates.
+- Keep the optional GNOME Wayland helper outside DeepChat packaging and validate both fresh and
+  manually installed helper states separately.
+
 ## Compatibility and rollback
 
 - Omitted manifest fields default to eager, all existing MCP surfaces, and legacy environment

docs/architecture/plugin-external-runtime-lifecycle/spec.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Lifecycle and model-facing CUA 0.13.1 compatibility implementation are complete with automated
+Lifecycle and model-facing CUA 0.14.1 compatibility implementation are complete with automated
 validation. Native Windows/Linux behavior, release-signed macOS behavior, and preinstalled custom
 cursor themes remain release-gated.
 
@@ -37,7 +37,7 @@ plugin-owned external processes.
    state.
 3. Start CUA only when one of its tools is invoked, while keeping its tool catalog visible before
    process startup.
-4. Upgrade the bundled driver to pinned upstream release `cua-driver-rs-v0.13.1` and adapt to its
+4. Upgrade the bundled driver to pinned upstream release `cua-driver-rs-v0.14.1` and adapt to its
    embedded daemon/proxy contract.
 5. Fail closed on stale crash evidence, runtime integrity failures, incomplete packaged catalogs,
    and unsupported launch contracts.
@@ -227,7 +227,7 @@ Runtime manifests may select a closed host adapter. CUA uses `cua-embedded-v1`;
 continue to use the direct stdio path. Adapter-specific state does not leak into the generic MCP
 configuration persisted in SQLite.
 
-## CUA 0.13.1 adapter
+## CUA 0.14.1 adapter
 
 The CUA adapter starts two related processes:
 
@@ -240,7 +240,7 @@ The CUA adapter starts two related processes:
 The daemon stdin remains open for parent-liveness. Startup completes only after a newline-delimited
 metadata response validates:
 
-- driver version `0.13.1`;
+- driver version `0.14.1`;
 - contract version `0.2.0`;
 - tools-list schema version `1`;
 - capability version `1`;
@@ -264,7 +264,15 @@ For any CUA result carrying `structuredContent.refusal.code`, DeepChat appends a
 single-line code projection to model-visible `content` while preserving the raw structured value.
 The human-readable refusal message is already present in MCP text content and is not duplicated.
 
-CUA 0.13.1 declares `element_token` as an optional unconstrained string but rejects an empty string
+For Chromium-family `get_window_state` results, CUA 0.14.1 may also declare that browser-owned
+chrome is not observable in window scope. DeepChat projects this recovery contract only when every
+known field matches the reviewed upstream shape. The projection contains fixed identifiers rather
+than runtime-provided prose, does not claim that a prompt is present, and recommends desktop
+escalation only after a window action was verified ineffective. Unknown or partial coverage
+contracts remain available in raw `structuredContent` but are not promoted into model-visible
+instructions.
+
+CUA 0.14.1 declares `element_token` as an optional unconstrained string but rejects an empty string
 at runtime and gives any present token precedence over a valid index. Immediately before dispatch,
 the closed CUA adapter therefore removes only an empty or whitespace-only `element_token` from these
 seven tools:
@@ -288,7 +296,7 @@ the projected `refusal.code` is `stale_element_token`, `generation_mismatch`, or
 with the new token. It must not reuse a stale token or silently fall back to an older snapshot's
 index.
 
-### CUA 0.13.1 tool-contract changes
+### CUA 0.14.1 tool-contract changes
 
 The static catalog, closed policy, skill, and tests track these reviewed changes together:
 
@@ -299,9 +307,16 @@ The static catalog, closed policy, skill, and tests track these reviewed changes
 - `browser_type` accepts `replace`; an empty replacement clears the editable field;
 - normal `start_session` calls omit optional `cursor_theme`, while an explicit user theme request
   uses the reviewed `set_agent_cursor_theme` action;
-- `kill_app` is denied because the 0.13.1 public `launch_app` and `kill_app` schemas omit
+- `kill_app` is denied because the 0.14.1 public `launch_app` and `kill_app` schemas omit
   `session`, preventing standard-mode ownership proof. DeepChat does not rely on the proxy's
   current acceptance of undeclared fields.
+- cursor themes use source schema `cua.cursor-theme/2`, profile `cua-driver-actions-v2`, semantics
+  version 2, and compiled artifact magic `CUATHEM3`; retired v1 themes are rejected rather than
+  silently dropping modifier context;
+- delivery and target context move from custom-theme modifier assets into host-rendered session
+  badges, while DeepChat continues to treat cursor appearance as optional user-requested state;
+- Chromium window snapshots may expose the bounded browser-chrome capture-coverage recovery
+  contract described above.
 
 The `kill_app` mitigation is version-specific. A direct native smoke test must use a disposable
 fixture process rather than the DeepChat product path, because the closed policy blocks the call
@@ -398,14 +413,19 @@ security task and do not block CUA remediation.
 | Linux x64 | Bundle executable | Checksum/file-set gate and executable mode |
 | Linux arm64 | DeepChat still builds/releases; CUA remains unbundled until validated | Unsupported CUA target |
 
-The upstream UIA worker is not part of the 0.13.1 release contract. DeepChat continues to package
+The upstream UIA worker is not part of the 0.14.1 release contract. DeepChat continues to package
 only `cua-driver.exe` on Windows and removes the obsolete worker opt-in environment variable.
 
 The macOS `cua-cursor-theme` executable is an authoring utility, not part of the embedded runtime.
 Staging removes it and immediately requires `Contents/MacOS` to contain only the regular
 `deepchat-cua-driver` file before signing and integrity descriptor generation. The bundled
-`cua.default` theme is binary-tested; loading a separately preinstalled custom theme remains a
-native release gate even though the upstream loader supports it.
+`cua.default` v2 theme is binary-tested. Loading a separately preinstalled v2 custom theme and
+confirming the explicit failure of a retired v1 theme remain native release gates.
+
+The upstream GNOME Wayland helper is also outside DeepChat's package and lifecycle contract.
+DeepChat does not install or upgrade it. Users with an older manually installed helper may need to
+update it before v0.14.1 cursor context or overlay behavior can be accepted; fresh and pre-existing
+helper states remain part of the Linux Wayland native gate.
 
 `--no-permissions-gate` skips only the upstream macOS TCC first-launch UI. It does not disable
 DeepChat's per-tool approval or the driver's `--permission-mode standard` authorization. DeepChat
@@ -425,8 +445,8 @@ Automated gates:
 - exact CUA tool catalog/policy parity tests;
 - explicit local `kill_app === deny` coverage;
 - seven-tool empty-token normalization and zero-coordinate preservation tests;
-- raw MCP `structuredContent`, compact CUA token/refusal projections, and stale-token guidance
-  tests;
+- raw MCP `structuredContent`, compact CUA token/refusal/capture-coverage projections, and
+  stale-token guidance tests;
 - explicit CUA screenshot visual-grounding and no-vision fallback tests;
 - macOS signing and entitlement contract tests.
 
@@ -499,3 +519,24 @@ CUA 0.13.1 upgrade verification completed on 2026-07-29:
 The direct-driver ownership smoke, Windows/Linux native catalogs and runtime behavior,
 release-signed/notarized macOS behavior, and preinstalled custom-theme loading remain native
 release gates.
+
+CUA 0.14.1 upgrade verification completed on 2026-07-30:
+
+- all five pinned supported-target release assets matched their upstream SHA-256 values; static
+  protocol, catalog, signing, entitlement, and native-library audits found no host-contract drift;
+- `pnpm run plugin:bundle -- --name cua --platform darwin --arch arm64`,
+  `pnpm run plugin:validate -- --name cua --platform darwin --arch arm64`, and
+  `pnpm run plugin:verify -- --name cua --platform darwin --arch arm64 --plugin-root
+  build/bundled-plugins` passed with a development-signed artifact;
+- the generated macOS arm64 catalog reports driver 0.14.1 and 49 tools, the packaged runtime
+  excludes `cua-cursor-theme`, and strict code-signature verification passed;
+- 178 focused CUA, plugin, MCP, package, integrity, and renderer tests passed;
+- `pnpm run test:main`: 467 files and 5591 tests passed; 20 files and 279 tests were
+  conditionally skipped;
+- `pnpm run test:renderer`: 207 files and 1653 tests passed;
+- `pnpm run format`, `pnpm run i18n`, `pnpm run lint`, `pnpm run typecheck`, and
+  `pnpm run build` passed.
+
+Windows/Linux native catalogs and behavior, macOS x64 and release-signed/notarized behavior,
+direct-driver ownership, separately installed v2 themes, explicit retired-v1 rejection, and GNOME
+Wayland helper states remain native release gates.

docs/architecture/plugin-external-runtime-lifecycle/tasks.md

@@ -54,6 +54,18 @@
 - [ ] Run native driver ownership smoke with a disposable process on each supported platform.
 - [ ] Validate preinstalled custom cursor themes after sidecar removal.
 
+## CUA 0.14.1 contract upgrade
+
+- [x] Pin the 0.14.1 release commit, assets, checksums, and driver handshake version.
+- [x] Preserve the existing embedded protocol metadata and supported target matrix.
+- [x] Project only the exact, bounded browser-chrome capture-coverage recovery contract.
+- [x] Document session-badge ownership and the v2 action-only custom-theme migration boundary.
+- [x] Keep the optional GNOME Wayland helper outside DeepChat packaging and lifecycle ownership.
+- [ ] Regenerate the native catalog and verify the expected tool count on each supported platform.
+  - macOS arm64 generated 49 tools and passed bundle/verification locally on 2026-07-30.
+  - macOS x64, Windows, and Linux generation remain native-CI gates.
+- [ ] Validate bundled and preinstalled cursor-theme behavior on native targets.
+
 ## Model-facing CUA compatibility
 
 - [x] Normalize empty `element_token` for the seven affected CUA action tools without removing
@@ -62,6 +74,8 @@
       the model.
 - [x] Project bounded CUA `refusal.code` values into model-visible content while retaining the raw
       structured refusal.
+- [x] Project the exact browser-chrome capture-coverage contract without accepting arbitrary
+      runtime-provided recovery instructions.
 - [x] Pass stale-token errors through unchanged and document fresh-snapshot retry behavior in the
       packaged CUA skill.
 - [x] Analyze CUA screenshots only for explicit `include_screenshot: true` calls and append bounded
@@ -112,7 +126,8 @@
 - [ ] Linux x64 X11: reproduce the #2039 activation path with no desktop/session loss.
 - [ ] Linux x64 X11: record warm-daemon idle CPU, handle/file-descriptor count, and residual
       windows with and without a compositor.
-- [ ] Linux x64 Wayland: validate discovery, input, capture, restart, and known limitations.
+- [ ] Linux x64 Wayland: validate discovery, input, capture, restart, current and older manually
+      installed helper states, and known limitations.
 - [x] Confirm statically that DeepChat Linux application releases remain independent from optional
       CUA artifacts.
 
@@ -154,6 +169,19 @@ CUA 0.13.1 upgrade validation completed on 2026-07-29:
 - `pnpm run test:renderer`: 207 files and 1653 tests passed;
 - formatting, i18n, lint, Node/Web type checks, and CUA manifest validation passed.
 
+CUA 0.14.1 upgrade validation completed on 2026-07-30:
+
+- all five pinned supported-target release assets matched their upstream SHA-256 values; static
+  protocol, catalog, signing, entitlement, and native-library audits found no host-contract drift;
+- macOS arm64 plugin bundle, validation, and verification passed with a development-signed
+  artifact; the generated catalog reported 49 tools for driver 0.14.1, the package excluded
+  `cua-cursor-theme`, and strict code-signature verification passed;
+- 178 focused CUA, plugin, MCP, package, integrity, and renderer tests passed;
+- `pnpm run test:main`: 467 files and 5591 tests passed; 20 files and 279 tests were skipped;
+- `pnpm run test:renderer`: 207 files and 1653 tests passed;
+- formatting, i18n, lint, Node/Web type checks, the production build, and CUA manifest validation
+  passed.
+
 Windows/Linux native catalogs and behavior, the version-gated direct-driver ownership smoke,
 release-signed/notarized macOS behavior, and preinstalled custom themes remain unchecked above.
 

docs/features/cua-cross-platform-computer-use/spec.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Implemented for driver 0.13.1 with the supervised embedded lifecycle and model-facing argument and
+Implemented for driver 0.14.1 with the supervised embedded lifecycle and model-facing argument and
 result compatibility adapter. Native Windows/Linux behavior, release-signed macOS behavior, and
 preinstalled custom cursor themes remain release-gated.
 
@@ -31,7 +31,7 @@ plugin build matrices.
 
 Upstream `trycua/cua` now publishes the Rust CUA driver as cross-platform release artifacts. The
 previously shipped driver was `cua-driver-rs-v0.7.1`. Issue #2039 demonstrated that retaining its
-eager Linux/X11 startup is unsafe. The current integration pins `cua-driver-rs-v0.13.1` and adds a
+eager Linux/X11 startup is unsafe. The current integration pins `cua-driver-rs-v0.14.1` and adds a
 DeepChat-owned embedded lifecycle adapter, static tool discovery, crash quarantine, controlled
 environment inheritance, and pre-spawn integrity checks.
 
@@ -110,9 +110,9 @@ DeepChat must continue to own the integration boundary:
 
 The replacement runtime is pinned to:
 
-- Tag: `cua-driver-rs-v0.13.1`.
-- Commit: `d8c1efac808333bbecfcb2a9ff6705b5b1e6195a`.
-- Version: `0.13.1`.
+- Tag: `cua-driver-rs-v0.14.1`.
+- Commit: `41ae29b44b49b68c6e01c934fffbbe74d22e26fb`.
+- Version: `0.14.1`.
 
 The build step must stage release artifacts instead of relying on local Swift-only source builds.
 Every staged asset must be validated before packaging:
@@ -153,7 +153,7 @@ still consuming verified upstream release artifacts.
 ## Tool Surface
 
 The plugin policy, skill docs, and packaged static catalog must exactly match the pinned upstream
-0.13.1 tool surface. The catalog keeps CUA tools discoverable without eagerly starting the native
+0.14.1 tool surface. The catalog keeps CUA tools discoverable without eagerly starting the native
 runtime.
 
 Removed or renamed assumptions:
@@ -190,6 +190,8 @@ The maintained model-facing adapter contract is:
   beside the existing accessibility tree;
 - project a bounded `structuredContent.refusal.code` into model-visible content without duplicating
   the human-readable refusal message;
+- project the exact reviewed browser-chrome capture-coverage recovery contract using fixed,
+  bounded identifiers, without treating the coverage limit as proof that a prompt is present;
 - re-snapshot and retry once with a new token when the projected code is `stale_element_token`,
   `generation_mismatch`, or `invalid_element_token`;
 - never retry a failed token against an older snapshot's `element_index`;
@@ -198,7 +200,7 @@ The maintained model-facing adapter contract is:
 - treat screen text and derived visual grounding as untrusted observations rather than
   instructions.
 
-The 0.13.1 model-facing contract also requires:
+The 0.14.1 model-facing contract also requires:
 
 - `browser_type({ replace: true, text: "" })` clears an editable field; append-only examples must
   not hide the `replace` behavior;
@@ -208,6 +210,8 @@ The 0.13.1 model-facing contract also requires:
   used only for an explicit user request;
 - `get_agent_cursor_state` is consumed as a single-session state object with `enabled`, `motion`,
   `position`, `session`, `theme`, and `visual_state`, not the removed `cursors` array.
+- cursor themes use the v2 action-only profile; delivery and target context belong to session
+  badges, and retired v1 theme artifacts are not accepted as compatible.
 
 ## Permission and Safety Requirements
 
@@ -216,7 +220,7 @@ Tool policies must be exact and conservative:
 - Read-only discovery and status tools may be allowed automatically.
 - User-visible input, app launch, usable app-termination paths, window focus, recording, replay,
   config mutation, and dependency installation must require user approval.
-- `kill_app` is explicitly denied for 0.13.1. Its public schema omits `session`, so standard mode
+- `kill_app` is explicitly denied for 0.14.1. Its public schema omits `session`, so standard mode
   cannot prove ownership even though the shared ownership implementation works when a session is
   supplied. DeepChat must use cooperative close paths and must not inject an undocumented field.
 - Any newly detected upstream tool without a policy must be treated as a review failure in tests.
@@ -241,6 +245,8 @@ The packaged app must keep CUA usable after Electron packaging:
 - Linux runtime files must retain executable permissions after package extraction.
 - macOS helper bundles must exclude the upstream authoring-only `cua-cursor-theme` sidecar and pass
   bundle path, executable, and signing validation.
+- DeepChat does not package or upgrade the optional GNOME Wayland helper; fresh and pre-existing
+  manually installed helper states are separate native release gates.
 - `plugin:verify` must be able to verify CUA artifacts per supported platform and arch.
 - CI and release workflows must bundle and verify CUA for supported Windows, macOS, and Linux
   build targets.
@@ -273,7 +279,7 @@ The packaged app must keep CUA usable after Electron packaging:
 - Optional MCP capabilities not implemented by the CUA driver, such as prompts and resources, are
   treated as absent capabilities and must not produce error-level log spam.
 - Skill docs describe DeepChat usage and platform caveats, not upstream manual installer workflows.
-- Tool policies and the static catalog exactly cover the pinned upstream 0.13.1 tools.
+- Tool policies and the static catalog exactly cover the pinned upstream 0.14.1 tools.
 - Packaging docs and tests no longer describe CUA as macOS-only.
 - Build, lint, i18n, and focused test suites pass after implementation.
 

plugins/cua/plugin.json

@@ -31,7 +31,7 @@
     "integrityDescriptor": "runtime/${target.platform}/${arch}/integrity.json",
     "adapterContract": {
       "hostBundleId": "com.wefonk.deepchat",
-      "driverVersion": "0.13.1",
+      "driverVersion": "0.14.1",
       "contractVersion": "0.2.0",
       "toolsListSchemaVersion": "1",
       "capabilityVersion": "1",
@@ -47,7 +47,7 @@
       "mode": "user-confirmed",
       "provider": "trycua",
       "strategy": "bundled-plugin-helper",
-      "minVersion": "0.13.1",
+      "minVersion": "0.14.1",
       "guideUrl": "https://cua.ai/docs/cua-driver/guide/getting-started/installation"
     }
   },