fix(cua): correct Gemini key/drag arg names + safer session cleanup

[masnwilliams]

Summary

Stacks on top of the unified CUA template branch. Addresses three of the outstanding Cursor Bugbot findings on PR #143.

Gemini argument-name mismatches

Both bugs cause the affected actions to be silently/structurally broken — fixed in TS and Python in lockstep with the standalone gemini-computer-use templates.

• key_combination read from args.key_combination → now reads args.keys. Gemini's schema sends the combo in keys (a single +-joined string), so the previous code always saw an empty combo and silently dropped every shortcut.
• drag_and_drop read from start_x / start_y / end_x / end_y → now reads x / y / destination_x / destination_y. Gemini's schema uses the latter; the previous names always resolved to 0, so every drag went (0,0) -> (0,0).

Session cleanup ordering (TS + Python)

session.stop() previously placed the state-reset (_sessionId = null, …) after the try / finally that performs replay-stop + browser-delete. If stopReplay() threw, the finally deleted the browser, the exception then propagated past the cleanup lines, and a follow-up stop() from the caller's error path would attempt to delete the already-destroyed session — masking the original error.

Moved the state-reset into the finally, so a second stop() is a safe no-op regardless of how the first attempt unwound.

Bugbot findings I checked but did not change

These are flagged on the PR but already fixed in the current branch (probably resolved between scans):

• Anthropic system prompt date freezing — already a getSystemPrompt() function that reads new Date() per task.
• Python session.py using browsers.delete — already uses browsers.delete_by_id.
• Python OpenAI provider missing screenshot action — already returns [] for screenshot.
• Python Gemini dropping screenshots — already appends an inline_data Part per response when result["screenshot"] is set.
• PREDEFINED_ACTIONS unused — leftover constant; harmless. Left as-is to keep the diff focused.

Test plan

• go build ./...
• go test ./pkg/create/...
• Deploy CUA template with Gemini provider, ask it to perform a drag, then a keyboard shortcut (e.g. ctrl+a, ctrl+l) — confirm both succeed
• Force a replay-stop failure (e.g. invalid replay state) and confirm session.stop() can be called twice without crashing

---

Note

Medium Risk
Moderate risk: changes input parsing for Gemini actions and alters session teardown ordering, which could affect browser lifecycle and replay cleanup if edge cases were missed.

Overview
Fixes Gemini CUA action argument mismatches in both TS and Python so key_combination reads the keys "+"-joined string and drag_and_drop uses x/y and destination_x/destination_y.

Makes KernelBrowserSession.stop() safer by resetting session/replay state inside the finally block and deleting the browser using a captured sessionId, preventing double-deletes when replay stopping throws.

^{Reviewed by Cursor Bugbot for commit 1c6b554. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies CUA (Cursor UI Agent) template code, not kernel API endpoints or Temporal workflows in packages/api/

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c6b554. Configure here.}

[cursor]

Second stop() call throws instead of being no-op

Medium Severity

The stop() method calls this.info (TS) / self.info (Python) unconditionally at the top, before the if (this._sessionId) guard. The info getter delegates to the sessionId getter, which throws when _sessionId is null. After the newly-added state reset in finally sets _sessionId to null, a follow-up stop() call from the caller's error path will throw "Session not started" instead of being the safe no-op described in the comment and PR description. The if guard that makes it a no-op is never reached.

Additional Locations (1)

• pkg/templates/python/cua/session.py#L113-L114

 

^{Reviewed by Cursor Bugbot for commit 1c6b554. Configure here.}