Cua client and local runtimes
The Cua handle (embedded or daemon client, configuration, SDK version) and the local container and VM runtimes.
Every program starts from one Cua handle, embedded in the process or connected to a running cua daemon, with the same API either way. Its accessors return the other objects. The config_* functions read and write the user defaults in $CUA_HOME/config.toml (cua config).
| Topology | Create | Behavior |
|---|---|---|
| Embedded | Cua.embedded(config) (Python cua.embedded(), TypeScript embedded()) | The runtime lives in your process |
| Daemon client | Cua.connect(address, token) (Python cua.connect(), TypeScript connect()) | Calls a running cua daemon, which shares sandboxes, spacesd connections, tunnels and credentials across processes |
connect() without an address reads ~/.cua/daemon.json, then the socket ~/.cua/cua.sock. The connection is lazy: the first call fails with Transport when no daemon runs (cua daemon start).
Cua#
The entry point of the SDK: create one with Cua::embedded or
Cua::connect, then reach sandboxes, Spaces and the rest through its
accessors.
| Method | Description |
|---|---|
auto | The default topology: the cua daemon this machine runs when one accepts connections (so the CLI, MCP clients and apps share sandboxes and Spaces), else the runtime in this process with config. |
connect | Connects to a running cua daemon. |
embedded | Runs the SDK runtime in this process. |
info | SDK (and daemon) identity. |
shutdown_daemon | Asks a connected daemon to stop (daemon mode only). |
spacesd | Connects to cua-spacesd at url (host:port, http(s)://… or a relay URL) without a sandbox. |
approve_share | Lets a waiting share go live (an agent's public share, or the first through a share edge). |
check_share | Opens a share's link once, as its owner, so a link is known to work before it is handed to anyone. |
deny_share | Turns down a waiting share. |
remove_share_edge | Removes the share edge from your cloud now. |
set_share_settings | Saves the share settings (the read-only fields are ignored). |
share | Shares target and returns a link that opens on the owner's other signed-in devices, never a localhost link: a port ("3000"), a port in a Space ("space:dev:3000"), or a file or folder ("./report.html", read-only; relative paths resolve against this process's directory). |
share_settings | The share settings, with today's data and the share edge. |
share_tcp | Shares a raw TCP service in a Space (a game server, for example) at a public address anyone can connect to, and returns it (tcp_connect_with). |
shares | The active shares, newest first. |
stop_all_shares | Stops every share. |
stop_share | Stops a share (its id or its name). |
| Accessor | Returns | Description |
|---|---|---|
agent_setup() | AgentSetup | Agent onboarding: detect AI coding agents, install the cua skills and configure the cua MCP server for the current user. |
auth() | Auth | Sign-in and the shared session (CUA_OIDC_ISSUER, CUA_CREDENTIAL_STORE, CUA_HOME apply). |
local() | Local | Local runtimes (doctor and setup) and local images. |
mode() | CuaMode | Topology. |
sandboxes() | Sandboxes | Sandboxes (local, direct, your own cloud). |
spaces() | Spaces | Spaces: the registry and every Space primitive. |
Cua.auto#
The default topology: the cua daemon this machine runs when one
accepts connections (so the CLI, MCP clients and apps share
sandboxes and Spaces), else the runtime in this process with
config. A discovery file (~/.cua/daemon.json) or socket left by a
daemon that exited is not a running daemon: the files are removed
when their pid is provably dead, and this falls back to embedded.
A daemon that is starting (~/.cua/daemon.starting) is waited for,
up to 30 s. Probes with a local connect only (no RPC), except in a
process inside
an app bundle that ships its own cua: it uses only that build's
daemon, and fails with CuaError.DaemonNotRunning naming the
running one (another app's, or its own before a rebuild or update)
rather than silently use it; <bundle>/Contents/MacOS/cua daemon start replaces it.
@classmethod
def auto(cls, config: CuaConfig) -> Cua| Parameter | Type | Default |
|---|---|---|
config | CuaConfig | required |
Returns Cua · Raises CuaError (DaemonNotRunning)
Cua.connect#
Connects to a running cua daemon. address is a socket path
(unix: prefix optional) or a loopback URL (then token is
required unless the discovery file has it); None uses
~/.cua/daemon.json, then ~/.cua/cua.sock. Connects lazily: the
first call fails with DaemonNotRunning when no daemon runs; use
Cua.info to check, or Cua.auto to fall back to the runtime
in this process.
@classmethod
def connect(cls, address: Optional[str], token: Optional[str]) -> Cua| Parameter | Type | Default |
|---|---|---|
address | Option<String> | required |
token | Option<String> | required |
Returns Cua · Raises CuaError (DaemonNotRunning)
Cua.embedded#
Runs the SDK runtime in this process. Performs no I/O beyond
reading the credential store when account_from_session is set (for
the relay account).
@classmethod
def embedded(cls, config: CuaConfig) -> Cua| Parameter | Type | Default |
|---|---|---|
config | CuaConfig | required |
Example
import cua
c = cua.embedded() # the SDK runs in this process; cua.connect() uses a running `cua daemon`
print(c.mode())Cua.info#
SDK (and daemon) identity. In daemon mode this is the connectivity check.
async def info(self) -> CuaInfoReturns CuaInfo · Async · Raises CuaError
Cua.shutdown_daemon#
Asks a connected daemon to stop (daemon mode only).
async def shutdown_daemon(self) -> NoneAsync · Raises CuaError
Cua.spacesd#
Connects to cua-spacesd at url (host:port, http(s)://… or a
relay URL) without a sandbox.
async def spacesd(self, url: str, token: Optional[str]) -> SpacesdClient| Parameter | Type | Default |
|---|---|---|
url | String | required |
token | Option<String> | required |
Returns SpacesdClient · Async · Raises CuaError
CuaConfig record#
Configuration of an embedded SDK runtime.
| Field | Type | Default | Description |
|---|---|---|---|
state_dir / stateDir | Option<String> | None | State directory for sandbox state files (default ~/.cua/sandboxes). |
env_probe_timeout_ms / envProbeTimeoutMs | Option<u32> | None | spacesd probe timeout (default 15 s). |
spaces_home / spacesHome | Option<String> | None | Spaces registry directory (default $CUA_HOME or ~/.cua). |
teleport_home / teleportHome | Option<String> | None | Teleport reads app sessions under this home directory with no host side effects (tests, CI). Default: the real host. |
account_from_session / accountFromSession | bool | false | Use the signed-in session (Cua.auth(), cua auth login) from the shared credential store, refreshed as needed, for the relay account the runtime lists the account's machines with ("My machines"). |
CuaInfo record#
Identity of the SDK (and daemon, when connected).
Returned by Cua.info.
| Field | Type | Default | Description |
|---|---|---|---|
sdk_version / sdkVersion | String | SDK library version. | |
mode | CuaMode | Topology. | |
daemon_version / daemonVersion | Option<String> | Daemon version (daemon mode). | |
daemon_pid / daemonPid | Option<u32> | Daemon pid (daemon mode). | |
socket_path / socketPath | Option<String> | Daemon socket (daemon mode). | |
loopback_url / loopbackUrl | Option<String> | Daemon loopback URL (daemon mode). | |
features | Vec<String> | Compiled-in modules. |
CuaMode enum#
Where the SDK runtime lives.
CuaMode.EMBEDDED
CuaMode.DAEMON| Variant | Description |
|---|---|
Embedded | In this process. |
Daemon | In a cua daemon. |
cua_sdk_version#
Version of the SDK library.
def cua_sdk_version() -> strReturns String
config_list#
Every setting with its effective value and source.
def config_list() -> List[ConfigEntry]Returns Vec<ConfigEntry> · Raises CuaError
config_get#
One setting's effective value and source.
def config_get(key: str) -> ConfigEntry| Parameter | Type | Default |
|---|---|---|
key | String | required |
Returns ConfigEntry · Raises CuaError
config_set#
Writes a setting to the config file (checked and normalised: default.on
takes local or a provider). Returns its effective value, which
an environment variable may still override.
def config_set(key: str, value: str) -> ConfigEntry| Parameter | Type | Default |
|---|---|---|
key | String | required |
value | String | required |
Returns ConfigEntry · Raises CuaError
config_unset#
Removes a setting from the config file. Returns its effective value afterwards (the environment variable or the built-in default).
def config_unset(key: str) -> ConfigEntry| Parameter | Type | Default |
|---|---|---|
key | String | required |
Returns ConfigEntry · Raises CuaError
config_path#
The config file's path ($CUA_HOME/config.toml).
def config_path() -> strReturns String
ConfigEntry record#
One setting's effective value.
Returned by config_get, config_list, config_set, config_unset.
| Field | Type | Default | Description |
|---|---|---|---|
key | String | default.on, default.kind, default.runtime, runtime.container, runtime.vm, runtime.microvm (and their _path) or telemetry.enabled. | |
value | String | The effective value. | |
source | String | env, config or default. | |
from | String | Where exactly: env CUA_DEFAULT_ON, config /home/me/.cua/config.toml or default. | |
env | String | The environment variable that overrides it. | |
default_value / defaultValue | String | The built-in default. | |
description | String | One line about it. |
locations#
Every location with the kinds and runtimes it offers (for pickers and help text).
def locations() -> List[LocationInfo]Returns Vec<LocationInfo>
LocationInfo record#
The locations on accepts: local, then registered providers.
Returned by locations.
| Field | Type | Default | Description |
|---|---|---|---|
name | String | The location's name. | |
description | String | One line about it. | |
kinds | Vec<String> | The kinds it runs (container, vm). | |
runtimes | HashMap<String, Vec<String>> | Its runtimes, in auto preference order, per kind (container: gvisor, runc). |
check_placement#
Checks a location, kind and runtime against each other without creating
anything: InvalidPlacement (listing the valid values) when the
combination does not exist. Empty strings are auto; an empty on is
the user default.
def check_placement(on: str, kind: str, runtime: str) -> None| Parameter | Type | Default |
|---|---|---|
on | String | required |
kind | String | required |
runtime | String | required |
Raises CuaError (InvalidPlacement)
error_doc_url#
A link to the errors-reference entry of a CuaError variant, by name
(InvalidArgument, case-insensitive). An unknown name links to the
page itself. The bindings' doc_url / docUrl on CuaError use it.
def error_doc_url(variant: str) -> str| Parameter | Type | Default |
|---|---|---|
variant | String | required |
Returns String
Local runtimes#
cua.local() checks and sets up the local runtimes and moves images in and out of the local engines.
Python programs usually use the high-level API instead: cua_sandbox runtimes.
Local#
Local runtimes and images.
Returned by Cua.local.
| Method | Description |
|---|---|
build_image | Builds an image from an images.cua.ai/v1alpha1 Image resource (JSON) on base; pushes to push when set. |
doctor | Inspects local runtimes (read-only: never installs or starts anything). |
pull_image | Pulls an image (container engine for container refs, the image cache for vm: containerDisks). |
push_image | Copies an image (host architecture) to destination; returns the pushed manifest digest. |
setup | Provisions components (qemu, lume; runsc reports its plan). |
storage | Free space where local Spaces are written (Lume's VM storage, the cua home for QEMU, the container engine's data disk) and which catalog images are already pulled. |
runtime_check_path | What path is for kind (container, vm, microvm): there, runnable, which runtime and its version. |
runtime_kinds | Each kind of Space (container, vm, microvm) with its runtime setting (runtime.<kind>), the runtimes installed on this machine for it and what the path in use is. |
Local.build_image#
Builds an image from an images.cua.ai/v1alpha1 Image resource
(JSON) on base; pushes to push when set. Returns
reference@digest or the local output directory.
async def build_image(self, spec_json: str, base: str, push: Optional[str]) -> str| Parameter | Type | Default |
|---|---|---|
spec_json | String | required |
base | String | required |
push | Option<String> | required |
Returns String · Async · Raises CuaError
Local.doctor#
Inspects local runtimes (read-only: never installs or starts anything).
async def doctor(self) -> DoctorReportReturns DoctorReport · Async · Raises CuaError
Example
import asyncio
import cua
async def main():
report = await cua.embedded().local().doctor()
for check in report.checks:
print(check.name, check.status)
asyncio.run(main())Local.pull_image#
Pulls an image (container engine for container refs, the image cache
for vm: containerDisks).
async def pull_image(self, reference: str) -> LocalImage| Parameter | Type | Default |
|---|---|---|
reference | String | required |
Returns LocalImage · Async · Raises CuaError
Local.push_image#
Copies an image (host architecture) to destination; returns the
pushed manifest digest.
async def push_image(self, reference: str, destination: str) -> str| Parameter | Type | Default |
|---|---|---|
reference | String | required |
destination | String | required |
Returns String · Async · Raises CuaError
Local.setup#
Provisions components (qemu, lume; runsc reports its plan).
Empty = everything provisionable. dry_run only reports.
async def setup(self, components: List[str], dry_run: bool) -> List[SetupStep]| Parameter | Type | Default |
|---|---|---|
components | Vec<String> | required |
dry_run | bool | required |
Returns Vec<SetupStep> · Async · Raises CuaError
Local.storage#
Free space where local Spaces are written (Lume's VM storage, the cua home for QEMU, the container engine's data disk) and which catalog images are already pulled. Read-only and bounded; probed in this process (the daemon runs on the same host).
async def storage(self) -> LocalStorageReturns LocalStorage · Async · Raises CuaError
DoctorReport record#
Doctor output.
Returned by Local.doctor.
| Field | Type | Default | Description |
|---|---|---|---|
checks | Vec<RuntimeCheck> | One check per backend. | |
report_json / reportJson | String | The full cua-vmm host report as JSON. |
LocalImage record#
A local image.
Returned by Local.pull_image.
| Field | Type | Default | Description |
|---|---|---|---|
reference | String | Reference. | |
kind | String | container or vm. | |
location | String | Disk path (VM) or engine image reference (container). | |
size_bytes / sizeBytes | u64 | Size in bytes, when known. |
LocalStorage record#
What local Spaces have room for (see Local.storage).
Returned by Local.storage.
| Field | Type | Default | Description |
|---|---|---|---|
host_arch / hostArch | String | This host's architecture (arm64, amd64). | |
reserve_bytes / reserveBytes | u64 | Bytes cua keeps free on a volume: a create that would leave less fails (CUA_DISK_MIN_FREE, default 5 GiB). | |
lume | Option<StorageVolume> | Where Lume writes macOS VMs. | |
qemu | Option<StorageVolume> | Where QEMU writes VM disks and the containerDisk cache. | |
container | Option<StorageVolume> | The container engine's data disk (Colima, Docker Desktop, OrbStack, /var/lib/docker), when its free space can be read. | |
pulled | Vec<String> | Catalog image refs already pulled here at their published digest. | |
linux_runtime_download_bytes / linuxRuntimeDownloadBytes | u64 |
RuntimeCheck record#
One doctor check (one backend).
| Field | Type | Default | Description |
|---|---|---|---|
name | String | Backend (container, qemu, lume, ...). | |
status | RuntimeCheckStatus | Status. | |
version | Option<String> | Version, when detected. | |
detail | String | Explanation, missing pieces and what setup would do. |
SetupStep record#
One setup step.
Returned by Local.setup.
| Field | Type | Default | Description |
|---|---|---|---|
name | String | Component. | |
status | RuntimeCheckStatus | Status after the step. | |
detail | String | What was (or would be) done. |
StorageVolume record#
Space on the volume a local engine writes to.
| Field | Type | Default | Description |
|---|---|---|---|
available_bytes / availableBytes | u64 | Bytes available to this user. | |
total_bytes / totalBytes | u64 | Volume size in bytes. | |
name | String | What a person calls it: Macintosh HD, Colima, Docker Desktop. |
RuntimeCheckStatus enum#
Status of one local runtime component.
RuntimeCheckStatus.OK
RuntimeCheckStatus.INSTALLABLE
RuntimeCheckStatus.ERROR
RuntimeCheckStatus.NOT_APPLICABLE
RuntimeCheckStatus.UNKNOWN| Variant | Description |
|---|---|
Ok | Present and usable. |
Installable | Missing; setup can provision it. |
Error | Missing or broken; needs user action. |
NotApplicable | Not used on this host. |
Unknown | Not reported. |