feat(desktop): host and package Cua Driver 0.37.0 with notices - #667

On desktop, the server can ask for a Cua Driver host after #665, but the Electron shell doesn't host one and packaged builds don't contain the driver. This PR ports the desktop half of Julius Marminge's upstream stack, pingdotgg/t3code#21696 at frozen head 6b627499b and #21697 at 25852df14. The Electron main process now owns the host on the private control pipe, so macOS attributes permissions to GOAT. Release builds stage the pinned 0.37.0 driver, unpack the SDK's native libraries beside app.asar, and ship the driver's license notices. Computer use stays off by default, with no agent attachment and no UI.

Stacked on #665 (base feat/cua-driver-server). The first two commits are the upstream PRs applied as diffs, authored by Julius with the upstream commit list in each message.

GOAT deltas from upstream

• The desktop host starts through EmbeddedCuaDriverHost.withOptions(cuaDriverHostOptions(path, appUserModelId)), with the same allowlisted telemetry and update‑check opt‑outs as the standalone host in feat(server): verified Cua Driver 0.37.0 lifecycle with telemetry off #665. Upstream uses the two‑argument constructor, which passes no environment.
• Renames via goat-rename (GOAT_CUA_DRIVER_PATH, package scope, temp prefixes). The build cache is node_modules/.cache/goat/cua-driver (upstream .cache/t3code).
• Notices. apps/desktop/src/cua/notices/ vendors LICENSE.md (MIT), libs/cua-driver/rust/THIRD_PARTY_NOTICES.md, and libs/cua-driver/scripts/node-runtime-NOTICE.md (MPL‑2.0 Node runtime), byte‑for‑byte from tag cua-driver-rs-v0.37.0 (identical at 0.38.0). third-party-licenses.config.json lists them as the desktop notice "Cua Driver" 0.37.0, MIT AND MPL-2.0. goat-rename already exempts LICENSE* and THIRD_PARTY_NOTICES*, and the files pass vp fmt --check unchanged.
• Conflicts resolved toward GOAT: apps/desktop/package.json, the main.ts imports, and scripts/build-desktop-artifact{,.test}.ts (GOAT's imports and build‑config tests kept beside the new Cua tests). Upstream's new Windows sidecar test also gets GOAT's vp argument.
• The @ubjs/[email protected] ASAR loader patch is unchanged: the 0.37.0 SDK depends on the same version.
• Merged with dev 881757889 via feat(server): verified Cua Driver 0.37.0 lifecycle with telemetry off #665. The chase deleted many build and publisher tests, so the Cua tests and helpers now sit on dev's files. The macOS/Linux build‑config test asserts the exact Cua asarUnpack globs (upstream dropped that assertion), and three ported Effect.gen callbacks became Effect.fn for dev's new goat(prefer-effect-fn) lint rule.
• Docs: a "Computer use host" section in structure/desktop.md, manifest/INDEX rows, server.md now points at it, and the fork‑delta paths are extended.

Verification

Real macOS (arm64) with the official 0.37.0 archives:

• Staging. stageCuaDriverExecutable ran against the real archives for mac universal, linux x64, linux arm64, win x64 and win arm64 from a pre‑verified cache (no downloads). macOS gets one 80.7 MB universal cua-driver (lipo: x86_64 arm64, mode 755). Linux gets the driver, cua-cursor-theme and wayland-helper/ (executables 755). Windows gets cua-driver.exe, cua-driver-uia.exe and cua-cursor-theme.exe. No SDK libraries, perception extension or skills pack are staged. Upstream verified macOS and Windows staging only with fixtures. This was a temporary test file, not committed.

• Desktop SDK path. @trycua/cua-driver/embedded, resolved from apps/desktop, started the host with si.goat.desktop.dev. The live daemon's environment held all three opt‑outs, and the object withOptions returns has uniffiDestroy.

• Notices. generateThirdPartyLicenseManifest for the desktop bundle in strict mode lists the vendored "Cua Driver" entry (11.5 KB, includes the MPL runtime notice), @trycua/cua-driver and its native packages, and every @ubjs/* package with the full MPL‑2.0 text.

• macOS signing order. GOAT's scripts/sign-macos.ts uses @electron/osx-sign 2.7.0, which signs nested files inside‑out by rank with the app bundle last, so Contents/Resources/cua-driver is re‑signed with GOAT's identity before the app. Read from source, not run.

• apps/desktop: vp test run src/cua src/telemetry src/backend src/ipc src/updates/DesktopRemoteUpdates.test.ts → 209/209 before the dev merge, 114/114 after it (dev deleted tests). apps/server: src/cua + receiver → 25/25. TMPDIR=<clean> vp test run scripts/build-desktop-artifact.test.ts scripts/lib/cli-external-packages.test.ts scripts/lib/third-party-licenses.test.ts → 172/173 before the dev merge, 126/126 after it. Before the merge, the one failure, skips the primary native probe for cross-architecture Windows payloads, fails identically on dev at f045007ed on this Mac. Without the clean TMPDIR, 8 more cases fail on both dev and this branch because a stray /private/tmp/node_modules trips the bundle probe guard.

• Red→green: the desktop host tests now assert the exact environment the fake withOptions receives; emptying the shared option list fails them (the same guard proven in feat(server): verified Cua Driver 0.37.0 lifecycle with telemetry off #665).

• Typecheck exits 0 for apps/desktop, scripts, apps/server, packages/contracts and packages/shared. Targeted vp lint and vp fmt --check pass on all 48 touched files (only the pre‑existing server.ts:944 warning). vp i --frozen-lockfile passes, and the lockfile diff touches only @trycua/@ubjs entries.

• goat-ci on head 9049331: full dispatch run 39591512279, 18/18 jobs with goat-ci-result success. The previous head 017c880 was green (39575151272, 18/18). This base branch is not a goat-ci pull_request target, so the dispatch run is the PR check.

Not run / open

• Signed and notarized macOS build, TCC prompts and attribution, a packaged app start, Windows artifacts and installer, packaged Linux capture/input, and the Wayland helper. These are upstream's human qualification gates and lane 3's job.
• Packaging adds about 57-81 MB of driver per platform plus SDK natives even while the feature is off. Upstream suggests landing packaging with the attachment feature. This PR follows the lane plan; merge timing is the maintainer's call.
• Overlaps: feat(web): Boat cloud machines show the Boat logo and state in Fleet #659 also edits third-party-licenses.config.json (this appends one customNotices entry). chase(t3): merge upstream main 4f651cb10 #658 touches apps/desktop/package.json. chore: drop leftover T3 tooling names and unused root folders #661 edits the fork delta and goat‑rename rules.

Review

Independent read-only review by Codex gpt-6.1-sol: PASS. It confirmed no logic was lost in conflict resolution, notices are byte‑identical to the tag, the lockfile changes only @trycua/@ubjs, and packaging matches 0.37.0. Round 1 covered the pre‑merge head 18600b68e. Round 2, on 017c88076, reviewed only the dev merge and returned PASS: the Cua helpers and tests are byte‑identical to before, no dev‑deleted test came back, the Effect.fn conversions change nothing but tracing spans, and the notice and patch lists are exact unions of both sides.

Implementation: anthropic/claude-opus-5-5 via the Codex harness in GOAT (lane 1 of the Cua Driver program). Upstream implementation credit: Julius Marminge (pingdotgg/t3code #16527, #21696, #21697).