chore(cua): upgrade driver to v0.19.2

[yyhhyyyyyy]

Summary

• Upgrade the bundled CUA driver from 0.17.0 to 0.19.2.
• Update pinned release assets and SHA-256 checksums for all supported targets.
• Update the embedded adapter version contract and related tests.
• Generate integrity.json during local CUA runtime builds so the workspace plugin can be used with pnpm run dev.
• Publish the development integrity descriptor only after signing, smoke checks, tool catalog generation, and final runtime validation.
• Write the descriptor through a temporary file and atomic rename to avoid exposing partial JSON.

Compatibility assessment

Compared the real 0.17.0 and 0.19.2 MCP documentation output:

• Tool count remains 54.
• No tools were added or removed.
• No input schemas changed.
• No safety annotations changed.
• Seven tool descriptions changed without altering their contracts.

The embedded integration contract remains unchanged:

• Adapter contract: 0.6.0
• MCP protocol: 2025-06-18
• Tool list schema: 1
• Capability version: 1

Linux arm64 remains intentionally unsupported; this PR does not expand the existing platform matrix.

Development runtime fix

Previously, pnpm plugin:cua:build:* generated the driver and tool catalog but not the integrity descriptor required when DeepChat loads the workspace plugin in development.

The build now:

1. Downloads and verifies the pinned upstream artifact.
2. Stages and normalizes the runtime.
3. Signs the macOS helper when applicable.
4. Runs the driver smoke check.
5. Generates the MCP tool catalog.
6. Performs final runtime validation.
7. Generates the target-scoped integrity descriptor.

The descriptor:

• Uses the signing operation's resolved purpose.
• Covers the final signed runtime and tool catalog.
• Excludes itself from its file hashes.
• Replaces stale descriptors safely.
• Does not alter production package-time descriptor generation.

Validation

• Real macOS arm64 CUA runtime build
• Driver reports cua-driver 0.19.2
• All 5/5 runtime file hashes match the generated descriptor
• Descriptor is not self-referential
• Development signing contract matches the actual ad-hoc signature
• codesign --verify --deep --strict
• Workspace and installed development plugin copies match
• Real pnpm run dev startup without CUA integrity or integrity.json errors
• Real .dcplugin package descriptor verification
• CUA plugin validation
• 38 focused runtime, packaging, and integrity tests
• pnpm run format:check
• pnpm run i18n
• pnpm run lint
• pnpm run typecheck

Summary by CodeRabbit

• Updates

  • Updated the CUA runtime and driver to version 0.19.2 across supported platforms.
  • Added runtime integrity metadata during builds and packaging.
  • Added validation to help ensure packaged runtime integrity information is accurate.

• Bug Fixes

  • Improved replacement of outdated integrity metadata, including on Windows.
  • Improved handling of platform-specific signing and integrity information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1fdca45f-50e0-4b07-9bc5-b52cd4d2bb6c

📥 Commits

Reviewing files that changed from the base of the PR and between 2f7aa32 and c165826.

📒 Files selected for processing (2)

• scripts/package-plugin.mjs
• test/main/scripts/packagePlugin.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• scripts/package-plugin.mjs

---

📝 Walkthrough

Walkthrough

The CUA driver and installer requirements move to version 0.19.2. Packaging now creates runtime integrity descriptors with atomic replacement. Build signing results flow into descriptor generation, and tests cover the updated metadata and descriptor behavior.

Changes

CUA runtime version upgrade

Layer / File(s)	Summary
Upgrade CUA runtime contracts plugins/cua/plugin.json, plugins/cua/vendor/cua-driver/upstream.json, src/main/plugin/cuaToolAdapter.ts, test/main/plugin/*	Updates CUA requirements, upstream release metadata, contract references, fixtures, and expectations to version 0.19.2.
Generate runtime integrity descriptors scripts/package-plugin.mjs, scripts/build-cua-plugin-runtime.mjs	Adds atomic integrity descriptor writing, Windows replacement handling, direct-entry guarding, and signing-result propagation into runtime staging.
Validate upgraded packaging behavior test/main/scripts/*	Updates version assertions and tests descriptor replacement, target metadata, file-hash exclusion, cleanup, and descriptor parsing.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant buildCuaPluginRuntime
  participant packagePlugin
  participant RuntimeDirectory
  buildCuaPluginRuntime->>packagePlugin: provide target and signing purpose
  packagePlugin->>RuntimeDirectory: read staged runtime files
  packagePlugin->>RuntimeDirectory: atomically write integrity.json
  packagePlugin-->>buildCuaPluginRuntime: return descriptor path

Loading

Possibly related PRs

• ThinkInAIXYZ/deepchat#1776: Adds earlier CUA runtime and packaging changes extended by this PR.
• ThinkInAIXYZ/deepchat#2052: Updates the same CUA packaging scripts and integrity descriptor workflow.
• ThinkInAIXYZ/deepchat#2061: Upgrades the bundled CUA driver and related runtime metadata.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading the CUA driver to version 0.19.2.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/cua-driver-rs-0.19.2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/package-plugin.mjs`:
- Around line 683-694: Update the Windows replacement flow around the descriptor
rename to move the existing descriptor to a backup, attempt the replacement, and
restore the backup if that replacement fails; only remove the backup after
success, while retaining cleanup of temporary files. Add a regression test for
the packaging function that makes the second renameSync call fail and verifies
the original integrity.json is restored.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: baaf3337-b72e-4bb6-b5ad-2e8bf16c55ad

📥 Commits

Reviewing files that changed from the base of the PR and between afc90b5 and 2f7aa32.

📒 Files selected for processing (9)

• plugins/cua/plugin.json
• plugins/cua/vendor/cua-driver/upstream.json
• scripts/build-cua-plugin-runtime.mjs
• scripts/package-plugin.mjs
• src/main/plugin/cuaToolAdapter.ts
• test/main/plugin/cuaEmbeddedAdapter.test.ts
• test/main/plugin/pluginService.test.ts
• test/main/scripts/buildCuaPluginRuntime.test.ts
• test/main/scripts/packagePlugin.test.ts