chore(cua-driver): release 0.34.1 - #4895

…ing (#4880)

The libei worker replied as soon as input requests were flushed to the
socket. A flush is not delivery: the caller's focus guard could restore
the user's window while the compositor still had the input queued, and
the input then landed in the wrong app.

After each input command, send ei_connection.sync and reply only when
EIS answers its callback, which it does after processing every earlier
request. If no answer comes within 5 s, fail with "delivery is unknown"
instead of reporting success. WaitReady and failed commands reply
immediately as before.

Ported from T3 Code's Linux patch to Cua Driver 0.34.0
(pingdotgg/t3code#16975, MIT, Copyright (c) 2026 T3 Tools Inc.).

Backported to the 0.34 release line from main (cherry picked from commit 9487b0f).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…er (#4879)

* perf(cua-driver): reuse one session-bus connection for the GNOME helper

Every WinRects call spawned a gdbus subprocess, and owner attestation
alone makes three D-Bus calls before the real one. A live preview pays
that on every frame. Replace the subprocess with one zbus connection on
a dedicated single-thread Tokio runtime, so callers inside or outside
Tokio can block on it without nesting runtimes.

Bodies are typed on the wire, and replies keep the textual shape the
existing parsers read (GetRects now arrives as raw JSON, which also
avoids gdbus quoting). A timeout or transport error drops the
connection and the next call reconnects; a mutation is never replayed.
An error reply, such as no helper on the bus, keeps the connection.

T3 Code measured window capture going from 381 ms to 58 ms with this
transport. Ported from their Linux patch to Cua Driver 0.34.0
(pingdotgg/t3code#16975, MIT, Copyright (c) 2026 T3 Tools Inc.); the
reply-versus-transport split is new here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* test(cua-driver): cover GetRects titles gdbus would have escaped

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix(cua-driver): strict GetRects parsing and run the bus test in Nix

Parse the typed GetRects reply as raw JSON instead of slicing a bracket
span, and reuse that parser for focus. Salvaged from #4809, including
the malformed-snapshot fixtures and the Nix dbus check input.

Co-authored-by: injaneity <[email protected]>

* test(cua-driver): start the private test bus from its own config

dbus-daemon --session needs the system session.conf, which the Nix
build sandbox lacks; the daemon then exits without an address. Write a
minimal session config listening in a temp dir instead.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Backported to the 0.34 release line from main (cherry picked from commit 48cc491).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…s v10) (#4882)

* feat(cua-driver): capture GNOME windows from their own actor (WinRects v10)

On GNOME Wayland, window screenshots were crops of the Shell stage.
GetRects proves a window's geometry, not that nothing covers it, so a
covered window's screenshot showed the app on top.

The WinRects helper gains two additive methods:

- CaptureWindow(id, pid), API 9: snapshot the window's own actor with
  paint_to_content. Covered windows keep their content, nothing is
  activated, and a 1x1 transparent clone keeps Mutter painting a fully
  covered window for 4 s after the last capture. Refused while locked,
  for minimized windows, and above 32 MiB.
- CaptureWindowPreview(id, pid, max), API 10: the same capture,
  downscaled on the GPU, returning the full-size dimensions too.

The driver uses CaptureWindow whenever the attested helper reports
API 9 or newer, and then never falls back to a stage crop. Older
helpers keep the stage crop, so users who have not reinstalled the
helper keep window screenshots. A screenshot-only get_window_state
with a size cap uses CaptureWindowPreview (falling back to the full
capture on older helpers), and GNOME's per-capture Creation Time PNG
chunk is removed so unchanged preview frames compare equal.
list_windows asks a verified GNOME helper first instead of probing
other compositor protocols.

Versioning: the UUID stays winrects@cua. One UUID means one installed
copy per user; two UUIDs would race for org.cua.WinRects. API numbers
9 and 10 match T3 Code's bundled helper exactly, so either copy serves
both drivers. install.sh and both cua-driver installers no longer
downgrade a newer installed helper (install.sh --force still does).
The helper README documents the rules and the version table.

Ported from T3 Code's Linux patch to Cua Driver 0.34.0
(pingdotgg/t3code#16975, MIT, Copyright (c) 2026 T3 Tools Inc.). The
stage-crop fallback for older helpers and the no-downgrade installers
are new here.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs(cua-driver): credit every T3 Code Linux port in THIRD_PARTY_NOTICES

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Backported to the 0.34 release line from main (cherry picked from commit 78212ad).

Conflict: THIRD_PARTY_NOTICES.md keeps the 0.34.0 table; the T3 Code row now lists every ported file, as on main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ews (#4881)

Backport of #4881 to the 0.34 release line, reworked for the 0.34.0 code.

`display_only:true` on get_window_state (with
include_accessibility_tree:false) returns the window's pixels and metadata
but publishes, refreshes and removes no snapshot and registers no action
capture, so a preview polling the window several times a second (T3 Code's
picture-in-picture) no longer stales the agent's element tokens or pixel
frame. It maps onto the existing internal observation-only read on macOS,
Windows and Linux; on macOS it also skips the background_input probe.

The contract matches T3 Code's Linux patch to Cua Driver 0.34.0
(pingdotgg/t3code#16975, MIT, Copyright (c) 2026 T3 Tools Inc.) word for
word: the schema property T3 feature-detects, the refusal
`display_only requires include_accessibility_tree:false`, and the
`display_only` / `frame_note` result fields. The typed contract
(cua-driver-contract) and the UniFFI surface are unchanged.

Differences from main's #4881:
- main keeps the helper in cua_driver_core::window_state_view, which does
  not exist on 0.34; here it is cua_driver_core::display_only with the same
  strings and functions, and each backend adds the property to its own
  schema.
- Not backported: plain screenshot-only reads refreshing the current
  snapshot in place on Windows and Linux (refresh_screenshot_for_session is
  0.35 snapshot-store code). On 0.34.x a plain screenshot-only read behaves
  as in 0.34.0; display_only is the side-effect-free read.
- No tool-description or skill text changes; the property's description
  carries the contract. cli-specs and the generated reference page gain the
  property (macOS regenerated from the native dump).

(cherry picked from commit 4cbd096, with conflicts reworked)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Adds main's live smoke (#4769, extended in #4881) to the 0.34 line so the
patch release runs the same real-window check on windows-latest (WinForms)
and ubuntu-latest (GTK3 on Xvfb). It keeps the harness and fixtures as on
main and is cut down to the 0.34 surface: act by element_token with a fresh
snapshot, and display_only previews (8 reads, then a click with the token
from before the previews must still land; a tree walk with display_only is
refused).

Left out, because they exercise 0.35 changes: the lean default read,
full_output, since diffs, run_actions, combo-box set_value, pid-less
element_tokens, and the plain screenshot-only token check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Bumps every Cua Driver version site listed in release-please-config.json
(VERSION, the workspace Cargo.toml, the Python and TypeScript packages,
SKILL.md and the cua-spacesd lockfiles), the driver Cargo.lock and this
branch's .release-please-manifest.json to 0.34.1, and syncs the generated
reference-doc versions with sync_driver_release_docs.py. The same 39 files
the 0.34.0 release commit changed, plus the CHANGELOG entry.

The CHANGELOG entry credits T3 Code (MIT, Copyright (c) 2026 T3 Tools Inc.)
for the Linux fixes and the display_only contract.

main's manifest stays at 0.34.0; this commit lives only on the
release/cua-driver-0.34.x line.

Co-Authored-By: Claude Opus 5.5 <[email protected]>