Cua open-sources Computer History — encrypted local cross-session memory for computer-use agents

TL;DR

Cua announces the first open-source Computer History for computer-use agents, in early preview on Cua Driver across macOS, Windows, and Linux. It’s an encrypted, local record of what an agent did through Cua Driver so that new sessions — or a different compatible agent — can query prior app/capability usage and success outcomes without replaying full trajectories. Off by default, records only fixed metadata (session lifecycle, action events, target app identity, outcomes) and explicitly excludes screenshots, typed text, keystrokes, clipboard, window titles, URLs, raw arguments, accessibility trees, and paths. Positioned as a user-owned, transparent substrate for persistent computer-use memory: encrypted before disk via CBOR Sequence + COSE_Encrypt0 + CloudEvents with the key in the OS credential store, no history in telemetry.

Key claims

Computer History survives resets, new sessions, and swaps between compatible agents — an agent can query which apps and Cua capabilities were used previously and whether actions succeeded [tweet 2/9].
On a macOS test prompt (“Move the white pawn from e2 to e4”), enabling history let the agent reuse the successful route from a prior run, completing the task with 33.3% fewer actions and zero failed routes vs three failed route attempts with history off [tweet 3/9].
On a Windows Paint continuation test after context reset, history provided app attribution, prior action sequence, and confirmed outcomes — without storing the drawing, screenshots, typed text, raw arguments, titles, or paths [tweet 4/9].
On a Linux LibreOffice Writer text-entry test, history retained six Cua action events plus app and capabilities used, and did not retain text, screenshots, paths, titles, or URLs [tweet 5/9].
Recorded fields: session lifecycle, Cua actions, target app identity, outcomes, writer health. Excluded: screenshots, typed text, keystrokes, clipboard contents, window titles, URLs, raw arguments, raw results, accessibility trees, and paths [tweet 6/9].
Storage stack: CBOR Sequence + COSE_Encrypt0 + CloudEvents, encrypted before reaching disk, key in the OS protected credential store, no history event or content enters product telemetry [tweet 7/9].
Off by default; enabled via cua-driver history enable on the nightly channel; user can pause, resume, disable while keeping the encrypted store, or delete the history and its key [tweet 8/9].

Method

Computer History is a driver-level, cross-agent memory layer that sits outside the LLM’s chat history: chat history disappears when the conversation ends, but Computer History persists as an encrypted local store the agent (or another compatible agent) can query at the start of a new session. The recorded schema is deliberately narrow — action events tagged with app identity, capability used, and outcome (success/failure) — rather than a replay-quality trace. This is the design bet: enough signal to recognize “this route worked before” without any content-privacy-sensitive data (screenshots, keystrokes, clipboard, window titles, URLs, paths, accessibility trees, raw call arguments/results). Encryption uses CBOR Sequence framing, COSE_Encrypt0 for the payload cipher, and CloudEvents for event envelopes; the encryption key lives in the operating system’s protected credential store (Keychain on macOS, DPAPI/Credential Manager on Windows, Secret Service on Linux). No history event ever reaches Cua’s telemetry pipeline. Full setup and RFC are in the driver repo: github.com/trycua/cua/blob/main/libs/cua-driver/docs/computer-history-preview.md and .../computer-history-agent-integration-rfc.md.

Results

Three per-OS demos, each self-reported and single-trajectory:

macOS chess-move test: history-off runs tried three routes that all failed; history-on run reused the previously successful route, completed the task, and used 33.3% fewer actions with no failed routes [tweet 3/9].
Windows Paint continuation: after context reset, history-on run resumed the prior task using recorded action sequence + outcomes, with the storage explicitly not retaining drawing, screenshots, typed text, or arguments [tweet 4/9].
Linux LibreOffice Writer: six Cua action events retained (app + capabilities used), zero content (text/screenshots/paths/titles/URLs) retained [tweet 5/9].

No aggregate benchmark numbers, no comparison against OSWorld or MyPCBench, no head-to-head against agents with alternative memory substrates. The tweet is a preview/announcement, not an evaluation.

Why it’s interesting

This is the first filed concrete deployment substrate for the “agent-memory-as-lifecycle” pattern that Agentic Context Management: Solving Agent Memory and Cost by Treating Them as Lifecycle and Architecture Problems names (ACM) and that Memory in the Age of AI Agents classifies as external-symbolic + experiential + evolution-heavy on the Forms × Functions × Dynamics survey axes — the same slot Training-Free Group Relative Policy Optimization‘s experience library occupies, but scoped to computer-use rather than search/math and materialized at the driver layer rather than the model layer. That placement matters: it makes cross-agent memory a shared substrate any compatible agent can query, which is exactly the “capability lives in the toolset, not the agent” framing Navigator n2: Frontier Computer Use at a Fraction of the Cost and the Waddle/skill-library papers have been converging on. The chess-move result — 33.3% fewer actions on repeat — is the driver-level analog of the “learned experiences reduce required interaction depth” finding on this concept page, but achieved without any model update or LLM-in-the-loop synthesis. Where this differs from every other filed agent-memory system is the user-owned + encrypted-at-rest + telemetry-excluded stance; the OS-credential-store key plus deliberate exclusion of screenshots/keystrokes/clipboard/paths is a first-of-its-kind privacy floor for persistent computer-use memory that a lot of agent products will likely need to match if this pattern generalizes.