Cua client and local runtimes

The Cua handle (embedded or daemon client, configuration, SDK version) and the local container and VM runtimes.

Every program starts from one Cua handle, embedded in the process or connected to a running cua daemon, with the same API either way. Its accessors return the other objects. The config_* functions read and write the user defaults in $CUA_HOME/config.toml (cua config).

TopologyCreateBehavior
EmbeddedCua.embedded(config) (Python cua.embedded(), TypeScript embedded())The runtime lives in your process
Daemon clientCua.connect(address, token) (Python cua.connect(), TypeScript connect())Calls a running cua daemon, which shares sandboxes, spacesd connections, tunnels and credentials across processes

connect() without an address reads ~/.cua/daemon.json, then the socket ~/.cua/cua.sock. The connection is lazy: the first call fails with Transport when no daemon runs (cua daemon start).

Cua#

The entry point of the SDK: create one with Cua::embedded or Cua::connect, then reach sandboxes, Spaces and the rest through its accessors.

MethodDescription
autoThe default topology: the cua daemon this machine runs when one accepts connections (so the CLI, MCP clients and apps share sandboxes and Spaces), else the runtime in this process with config.
connectConnects to a running cua daemon.
embeddedRuns the SDK runtime in this process.
infoSDK (and daemon) identity.
shutdown_daemonAsks a connected daemon to stop (daemon mode only).
spacesdConnects to cua-spacesd at url (host:port, http(s)://… or a relay URL) without a sandbox.
approve_shareLets a waiting share go live (an agent's public share, or the first through a share edge).
check_shareOpens a share's link once, as its owner, so a link is known to work before it is handed to anyone.
deny_shareTurns down a waiting share.
remove_share_edgeRemoves the share edge from your cloud now.
set_share_settingsSaves the share settings (the read-only fields are ignored).
shareShares target and returns a link that opens on the owner's other signed-in devices, never a localhost link: a port ("3000"), a port in a Space ("space:dev:3000"), or a file or folder ("./report.html", read-only; relative paths resolve against this process's directory).
share_settingsThe share settings, with today's data and the share edge.
share_tcpShares a raw TCP service in a Space (a game server, for example) at a public address anyone can connect to, and returns it (tcp_connect_with).
sharesThe active shares, newest first.
stop_all_sharesStops every share.
stop_shareStops a share (its id or its name).
AccessorReturnsDescription
agent_setup()AgentSetupAgent onboarding: detect AI coding agents, install the cua skills and configure the cua MCP server for the current user.
auth()AuthSign-in and the shared session (CUA_OIDC_ISSUER, CUA_CREDENTIAL_STORE, CUA_HOME apply).
local()LocalLocal runtimes (doctor and setup) and local images.
mode()CuaModeTopology.
sandboxes()SandboxesSandboxes (local, direct, your own cloud).
spaces()SpacesSpaces: the registry and every Space primitive.

Cua.auto#

The default topology: the cua daemon this machine runs when one accepts connections (so the CLI, MCP clients and apps share sandboxes and Spaces), else the runtime in this process with config. A discovery file (~/.cua/daemon.json) or socket left by a daemon that exited is not a running daemon: the files are removed when their pid is provably dead, and this falls back to embedded. A daemon that is starting (~/.cua/daemon.starting) is waited for, up to 30 s. Probes with a local connect only (no RPC), except in a process inside an app bundle that ships its own cua: it uses only that build's daemon, and fails with CuaError.DaemonNotRunning naming the running one (another app's, or its own before a rebuild or update) rather than silently use it; <bundle>/Contents/MacOS/cua daemon start replaces it.

@classmethod
def auto(cls, config: CuaConfig) -> Cua
ParameterTypeDefault
configCuaConfigrequired

Returns Cua · Raises CuaError (DaemonNotRunning)

Cua.connect#

Connects to a running cua daemon. address is a socket path (unix: prefix optional) or a loopback URL (then token is required unless the discovery file has it); None uses ~/.cua/daemon.json, then ~/.cua/cua.sock. Connects lazily: the first call fails with DaemonNotRunning when no daemon runs; use Cua.info to check, or Cua.auto to fall back to the runtime in this process.

@classmethod
def connect(cls, address: Optional[str], token: Optional[str]) -> Cua
ParameterTypeDefault
addressOption<String>required
tokenOption<String>required

Returns Cua · Raises CuaError (DaemonNotRunning)

Cua.embedded#

Runs the SDK runtime in this process. Performs no I/O beyond reading the credential store when account_from_session is set (for the relay account).

@classmethod
def embedded(cls, config: CuaConfig) -> Cua
ParameterTypeDefault
configCuaConfigrequired

Returns Cua · Raises CuaError

Example

import cua
 
c = cua.embedded()  # the SDK runs in this process; cua.connect() uses a running `cua daemon`
print(c.mode())

Cua.info#

SDK (and daemon) identity. In daemon mode this is the connectivity check.

async def info(self) -> CuaInfo

Returns CuaInfo · Async · Raises CuaError

Cua.shutdown_daemon#

Asks a connected daemon to stop (daemon mode only).

async def shutdown_daemon(self) -> None

Async · Raises CuaError

Cua.spacesd#

Connects to cua-spacesd at url (host:port, http(s)://… or a relay URL) without a sandbox.

async def spacesd(self, url: str, token: Optional[str]) -> SpacesdClient
ParameterTypeDefault
urlStringrequired
tokenOption<String>required

Returns SpacesdClient · Async · Raises CuaError

CuaConfig record#

Configuration of an embedded SDK runtime.

FieldTypeDefaultDescription
state_dir / stateDirOption<String>NoneState directory for sandbox state files (default ~/.cua/sandboxes).
env_probe_timeout_ms / envProbeTimeoutMsOption<u32>Nonespacesd probe timeout (default 15 s).
spaces_home / spacesHomeOption<String>NoneSpaces registry directory (default $CUA_HOME or ~/.cua).
teleport_home / teleportHomeOption<String>NoneTeleport reads app sessions under this home directory with no host side effects (tests, CI). Default: the real host.
account_from_session / accountFromSessionboolfalseUse the signed-in session (Cua.auth(), cua auth login) from the shared credential store, refreshed as needed, for the relay account the runtime lists the account's machines with ("My machines").

CuaInfo record#

Identity of the SDK (and daemon, when connected).

Returned by Cua.info.

FieldTypeDefaultDescription
sdk_version / sdkVersionStringSDK library version.
modeCuaModeTopology.
daemon_version / daemonVersionOption<String>Daemon version (daemon mode).
daemon_pid / daemonPidOption<u32>Daemon pid (daemon mode).
socket_path / socketPathOption<String>Daemon socket (daemon mode).
loopback_url / loopbackUrlOption<String>Daemon loopback URL (daemon mode).
featuresVec<String>Compiled-in modules.

CuaMode enum#

Where the SDK runtime lives.

CuaMode.EMBEDDED
CuaMode.DAEMON
VariantDescription
EmbeddedIn this process.
DaemonIn a cua daemon.

cua_sdk_version#

Version of the SDK library.

def cua_sdk_version() -> str

Returns String

config_list#

Every setting with its effective value and source.

def config_list() -> List[ConfigEntry]

Returns Vec<ConfigEntry> · Raises CuaError

config_get#

One setting's effective value and source.

def config_get(key: str) -> ConfigEntry
ParameterTypeDefault
keyStringrequired

Returns ConfigEntry · Raises CuaError

config_set#

Writes a setting to the config file (checked and normalised: default.on takes local or a provider). Returns its effective value, which an environment variable may still override.

def config_set(key: str, value: str) -> ConfigEntry
ParameterTypeDefault
keyStringrequired
valueStringrequired

Returns ConfigEntry · Raises CuaError

config_unset#

Removes a setting from the config file. Returns its effective value afterwards (the environment variable or the built-in default).

def config_unset(key: str) -> ConfigEntry
ParameterTypeDefault
keyStringrequired

Returns ConfigEntry · Raises CuaError

config_path#

The config file's path ($CUA_HOME/config.toml).

def config_path() -> str

Returns String

ConfigEntry record#

One setting's effective value.

Returned by config_get, config_list, config_set, config_unset.

FieldTypeDefaultDescription
keyStringdefault.on, default.kind, default.runtime, runtime.container, runtime.vm, runtime.microvm (and their _path) or telemetry.enabled.
valueStringThe effective value.
sourceStringenv, config or default.
fromStringWhere exactly: env CUA_DEFAULT_ON, config /home/me/.cua/config.toml or default.
envStringThe environment variable that overrides it.
default_value / defaultValueStringThe built-in default.
descriptionStringOne line about it.

locations#

Every location with the kinds and runtimes it offers (for pickers and help text).

def locations() -> List[LocationInfo]

Returns Vec<LocationInfo>

LocationInfo record#

The locations on accepts: local, then registered providers.

Returned by locations.

FieldTypeDefaultDescription
nameStringThe location's name.
descriptionStringOne line about it.
kindsVec<String>The kinds it runs (container, vm).
runtimesHashMap<String, Vec<String>>Its runtimes, in auto preference order, per kind (container: gvisor, runc).

check_placement#

Checks a location, kind and runtime against each other without creating anything: InvalidPlacement (listing the valid values) when the combination does not exist. Empty strings are auto; an empty on is the user default.

def check_placement(on: str, kind: str, runtime: str) -> None
ParameterTypeDefault
onStringrequired
kindStringrequired
runtimeStringrequired

Raises CuaError (InvalidPlacement)

error_doc_url#

A link to the errors-reference entry of a CuaError variant, by name (InvalidArgument, case-insensitive). An unknown name links to the page itself. The bindings' doc_url / docUrl on CuaError use it.

def error_doc_url(variant: str) -> str
ParameterTypeDefault
variantStringrequired

Returns String

Local runtimes#

cua.local() checks and sets up the local runtimes and moves images in and out of the local engines.

Python programs usually use the high-level API instead: cua_sandbox runtimes.

Local#

Local runtimes and images.

Returned by Cua.local.

MethodDescription
build_imageBuilds an image from an images.cua.ai/v1alpha1 Image resource (JSON) on base; pushes to push when set.
doctorInspects local runtimes (read-only: never installs or starts anything).
pull_imagePulls an image (container engine for container refs, the image cache for vm: containerDisks).
push_imageCopies an image (host architecture) to destination; returns the pushed manifest digest.
setupProvisions components (qemu, lume; runsc reports its plan).
storageFree space where local Spaces are written (Lume's VM storage, the cua home for QEMU, the container engine's data disk) and which catalog images are already pulled.
runtime_check_pathWhat path is for kind (container, vm, microvm): there, runnable, which runtime and its version.
runtime_kindsEach kind of Space (container, vm, microvm) with its runtime setting (runtime.<kind>), the runtimes installed on this machine for it and what the path in use is.

Local.build_image#

Builds an image from an images.cua.ai/v1alpha1 Image resource (JSON) on base; pushes to push when set. Returns reference@digest or the local output directory.

async def build_image(self, spec_json: str, base: str, push: Optional[str]) -> str
ParameterTypeDefault
spec_jsonStringrequired
baseStringrequired
pushOption<String>required

Returns String · Async · Raises CuaError

Local.doctor#

Inspects local runtimes (read-only: never installs or starts anything).

async def doctor(self) -> DoctorReport

Returns DoctorReport · Async · Raises CuaError

Example

import asyncio
 
import cua
 
async def main():
    report = await cua.embedded().local().doctor()
    for check in report.checks:
        print(check.name, check.status)
 
asyncio.run(main())

Local.pull_image#

Pulls an image (container engine for container refs, the image cache for vm: containerDisks).

async def pull_image(self, reference: str) -> LocalImage
ParameterTypeDefault
referenceStringrequired

Returns LocalImage · Async · Raises CuaError

Local.push_image#

Copies an image (host architecture) to destination; returns the pushed manifest digest.

async def push_image(self, reference: str, destination: str) -> str
ParameterTypeDefault
referenceStringrequired
destinationStringrequired

Returns String · Async · Raises CuaError

Local.setup#

Provisions components (qemu, lume; runsc reports its plan). Empty = everything provisionable. dry_run only reports.

async def setup(self, components: List[str], dry_run: bool) -> List[SetupStep]
ParameterTypeDefault
componentsVec<String>required
dry_runboolrequired

Returns Vec<SetupStep> · Async · Raises CuaError

Local.storage#

Free space where local Spaces are written (Lume's VM storage, the cua home for QEMU, the container engine's data disk) and which catalog images are already pulled. Read-only and bounded; probed in this process (the daemon runs on the same host).

async def storage(self) -> LocalStorage

Returns LocalStorage · Async · Raises CuaError

DoctorReport record#

Doctor output.

Returned by Local.doctor.

FieldTypeDefaultDescription
checksVec<RuntimeCheck>One check per backend.
report_json / reportJsonStringThe full cua-vmm host report as JSON.

LocalImage record#

A local image.

Returned by Local.pull_image.

FieldTypeDefaultDescription
referenceStringReference.
kindStringcontainer or vm.
locationStringDisk path (VM) or engine image reference (container).
size_bytes / sizeBytesu64Size in bytes, when known.

LocalStorage record#

What local Spaces have room for (see Local.storage).

Returned by Local.storage.

FieldTypeDefaultDescription
host_arch / hostArchStringThis host's architecture (arm64, amd64).
reserve_bytes / reserveBytesu64Bytes cua keeps free on a volume: a create that would leave less fails (CUA_DISK_MIN_FREE, default 5 GiB).
lumeOption<StorageVolume>Where Lume writes macOS VMs.
qemuOption<StorageVolume>Where QEMU writes VM disks and the containerDisk cache.
containerOption<StorageVolume>The container engine's data disk (Colima, Docker Desktop, OrbStack, /var/lib/docker), when its free space can be read.
pulledVec<String>Catalog image refs already pulled here at their published digest.
linux_runtime_download_bytes / linuxRuntimeDownloadBytesu64

RuntimeCheck record#

One doctor check (one backend).

FieldTypeDefaultDescription
nameStringBackend (container, qemu, lume, ...).
statusRuntimeCheckStatusStatus.
versionOption<String>Version, when detected.
detailStringExplanation, missing pieces and what setup would do.

SetupStep record#

One setup step.

Returned by Local.setup.

FieldTypeDefaultDescription
nameStringComponent.
statusRuntimeCheckStatusStatus after the step.
detailStringWhat was (or would be) done.

StorageVolume record#

Space on the volume a local engine writes to.

FieldTypeDefaultDescription
available_bytes / availableBytesu64Bytes available to this user.
total_bytes / totalBytesu64Volume size in bytes.
nameStringWhat a person calls it: Macintosh HD, Colima, Docker Desktop.

RuntimeCheckStatus enum#

Status of one local runtime component.

RuntimeCheckStatus.OK
RuntimeCheckStatus.INSTALLABLE
RuntimeCheckStatus.ERROR
RuntimeCheckStatus.NOT_APPLICABLE
RuntimeCheckStatus.UNKNOWN
VariantDescription
OkPresent and usable.
InstallableMissing; setup can provision it.
ErrorMissing or broken; needs user action.
NotApplicableNot used on this host.
UnknownNot reported.