#25844 cmux next: the upstream computer use driver refuses cmux, terminals and password managers

The upstream computer use helper (computerUse.driver = upstream, cua-driver in process) forwarded every tool call to the driver unchanged. Nothing stopped an agent from driving the person's cmux, a terminal, a password manager or security UI, which the legacy helper refuses. This adds the same guard to the upstream helper, checked against cua-driver v0.38.0 (the latest release; the repo pin is still v0.34.0).

• Target guard (Packages/macOS/CmuxComputerUseHelper/.../CuaTargetGuard.swift, CuaTargetPolicy.swift): every tool call's targets are resolved to a bundle id before the driver runs: pid, window_id, bundle_id, app_name, nested target objects of every kind, and each step of run_steps/run_actions (steps with no target inherit the batch's). Refused: cmux builds, terminals, password managers (1Password, Bitwarden, Dashlane, LastPass, NordPass, Proton Pass, KeePassXC, Strongbox, MacPass, Enpass, Keeper, RoboForm, Secrets, Keychain Access, Passwords), security UI. Desktop-scoped input without an app target, unknown target shapes, and name selectors in batches are refused (fail closed).
• Tools that dispatch inside the driver are refused: run_script (also removed from the tool list with CUA_DRIVER_DISABLE_RUN_SCRIPT=1) and replay_trajectory.
• The allow-list comes only from the app: the helper reads it from the launch environment the app sets (a DEV build may allow only its own tagged bundle); the acpmux bridge no longer sends one, so an agent cannot start its own bridge with a wider list.
• Local build overrides for trying a newer driver without the shared asset store: CMUX_CUA_SDK_PIN in build-cua-helper-dev.sh, CUA_SDK_TAG/CUA_SDK_COMMIT in build-cua-driver-sdk.sh. The published pin stays the default.

Known limit (same as legacy and the Codex app): a terminal panel inside an allowed app (an IDE) is not blocked; the owning app is checked, not the panel.

Changelog

• Added: the upstream computer use driver refuses to act on cmux, terminals, password managers and security prompts.

Tests

• Packages/macOS/CmuxComputerUseHelper/Tests/CmuxCuaHelperCoreTests/: CuaTargetGuardTests (every target shape, batches and inheritance, dispatch tools), CuaTargetPolicyTests (bundle ids, names, prefixes, allow-list), HelperTargetScopeTests (requests cannot widen the launch allow-list).
• cmux-tui/crates/acpmux/tests/cua_mcp_bridge.rs: the bridge sends no allow-list.

Observed / Not run

• Ran locally (Xcode 26.6): swift test --package-path Packages/macOS/CmuxComputerUseHelper: 37 passed. cargo test -p acpmux --test cua_mcp_bridge: 4 passed (the new case failed before the fix). Built the helper locally against cua-driver v0.34.0 and v0.38.0; v0.38.0 loads with no host change and answers list_apps.
• Three security reviews; the last found no way to widen the allow-list and two P1s (KeePassXC not blocked: fixed; IDE terminal panels: known limit above).
• Not run: real clicks with an ad-hoc local helper (no grants), the pin bump to v0.38.0 (needs the fleet to publish the asset).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}