release: v0.4.10

[avifenesh]

Cuts 0.4.10, carrying the windowing and input hardening merged in #96, plus two lint fixes.

Changes

chore(lint): simplify negated session-env predicates

Rust 1.94's clippy flags both WAYLAND_DISPLAY emptiness checks under nonminimal_bool.

• src/diagnostics.rs — preserve_native_x11
• src/server.rs — native_x11_xdotool_pointer_session

Both become is_none_or(|value| value.trim().is_empty()), the idiom already used in src/windowing/target.rs and src/server.rs. Behavior is identical; desktop_env_hydration_preserves_explicit_native_x11 and native_x11_pointer_policy_requires_explicit_x11_without_wayland_display cover the two call sites and both still pass.

Scope note: this lint is not a CI blocker. Verified against 1.98 with the original code restored, nonminimal_bool produces zero hits — the lint only fires on 1.94 and was relaxed upstream since. This is a readability cleanup that happens to be clean on both toolchains, not a fix for a failing check.

fix(cosmic): read toplevel state words without a chunk unwrap

This one is the CI blocker. Rust 1.98's clippy adds chunks_exact_to_as_chunks, which fails the -D warnings build at src/bin/computer-use-linux-cosmic.rs:705. CI pins the toolchain action by SHA but resolves stable, so this broke on the 1.98 bump rather than on any source change — the line dates to May 2026 and is untouched by #96 and by this release.

as_chunks::<4>() yields fixed-size arrays directly, so u32::from_ne_bytes takes them without try_into().unwrap(), removing a panic path. Remainder handling is unchanged — both forms drop a trailing partial word. The COSMIC binary's 7 tests pass.

release: v0.4.10

Rolls the Unreleased block into ## [0.4.10] - 2026-08-22 with compare links updated, and bumps the four version sites CI cross-checks: Cargo.toml, Cargo.lock, package.json, and the advertised MCP server version literal in src/server.rs. Patch bump — the released scope is all fixes.

Verification

Re-run locally on Rust 1.98.0, matching CI, after reproducing the clippy failure exactly:

Gate	Result
cargo fmt --all -- --check	pass
cargo clippy --locked --all-targets -- -D warnings	pass
cargo check --locked --all-targets	pass, lockfile in sync
cargo test --bin computer-use-linux-cosmic	7/7 pass
RUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps --document-private-items	pass
cargo publish --dry-run --locked	pass, packages v0.4.10
scripts/mcp_safety_check.py	pass — 18 tools, version 0.4.10
Cargo/npm version match	0.4.10 = 0.4.10

Two sandbox-only failures, both reproducing identically on a8f2f30 and pre-merge 663930f, neither related to these changes:

• command_runner / ydotool process-group reaping tests — this container does not reap orphaned process groups.
• install_sh_test.sh → non-systemd host requires uinput access — asserts a chmod 000 permission denial, impossible under uid 0.

CI runs non-root with working reaping and has already confirmed both: install.sh regressions and cargo test are green here.

After merge

Tagging v0.4.10 triggers release-binary, publish-crate, publish-npm, and validate-published.

[revuto-review]

This is an auto review done by revuto.

---

Revuto completed the review and found no evidence-backed concerns.

[revuto-review]

This is an auto review done by revuto.

---

Revuto completed the review and found no evidence-backed concerns.