Add cua-driver-bin, the Cua computer-use driver, to the fast ring - #306

Reviewed exact head d9127d7124806095ff5c87b7635173035f954d78 against master. The package builds and installs as described, but one medium packaging defect remains.

Medium — pkgbuilds/cua-driver-bin/PKGBUILD:58 exposes the vendor self-updater unchanged. cua-driver update --apply downloads the vendor installer, pipes it into Bash, installs separately under ~/.cua-driver/packages/releases, and links ~/.local/bin/cua-driver, bypassing pacman and this package's 24-hour release gate. That can leave shell invocations on the user-owned release while generated MCP configurations remain pinned to /usr/lib/cua-driver/cua-driver, with both versions sharing ~/.cua-driver. Add a package-manager mode that suppresses the vendor update path and directs upgrades to pacman; a wrapper alone does not cover configurations that record the resolved executable.

On a disposable credential-free Omabot worker, exact hashes of all four changed files matched this head; the three repository self-tests passed; live sync was a no-op at 0.23.2; an older-version fixture advanced to 0.23.2 with both manifest checksums; and the x86_64 package built, installed through pacman, passed pacman -Qkk, and ran --version, --help, cursor-theme list, session-aware doctor, and a standard-permission daemon call. A clean Arch container with only the declared dependencies had no missing ldd dependency in any shipped ELF and did not need the proposed wayland dependency. The repository's native aarch64 builder was blocked before this PKGBUILD by unavailable Omarchy ARM repository databases, but a checksum-validating structural fallback produced an aarch64 package whose four ELF payloads all identify as AArch64. Native ARM execution, a real GUI input flow, and the mutating update --apply path were not run.

Codex GPT-5.6 Sol XHigh supplied the self-update mechanism as the second opinion; process-level independence is not guaranteed because the named T3 reviewer shares the readable workspace. Its initial wayland dependency candidate was rejected and withdrawn after the exact-package container test disproved it.

Nothing was pushed. Waiting on the author to disable the vendor update path; I did not approve, request changes, or merge.

🤖 Generated by GPT-5.6 Sol XHigh in T3 Code. Reviewed by Codex GPT-5.6 Sol XHigh.

Re-reviewed current head 8ac12ec7d6af878680ae6a2653c3c67e76714bd4, focusing on the delta from d9127d7124806095ff5c87b7635173035f954d78. The earlier user-local installation finding is fixed: both embedded vendor installer URLs are replaced, and the known apply/reinstall paths can no longer install outside pacman.

Medium — pkgbuilds/cua-driver-bin/PKGBUILD:61 changes the installer target but leaves vendor update discovery and recommendations active. The exact upstream binary still checks GitHub directly on its long-running entry points, exposes that state through CLI/MCP, and supports stable/nightly channels, while this package ships only stable releases after a 24-hour quarantine. On the worker, selecting the actual current nightly channel immediately instructed the user to run cua-driver update --apply; injecting that live version into upstream's documented fresh-cache shape made check-update --json report an available update and offer the packaged file:// installer, whose stub then exited 1 and pointed to pacman, where no nightly package can exist. The direct stable check has no release-age input, so it likewise advertises a new stable release before that version clears the package's quarantine. Disable or package-integrate discovery as well as mutation so the exposed checks follow pacman availability and do not offer an unsupported nightly channel.

On a fresh disposable credential-free Omabot worker, exact hashes of all five package files matched this head and all three offline repository self-tests passed. The x86_64 package built in the repository's Docker builder, installed through pacman with 21 clean owned files, and preserved the ELF size and build ID while changing exactly 50 bytes: both vendor URLs were absent and both pacman-stub URLs present. The stub exited 1, named pacman, and created no user-local binary or release tree. A checksum-validating structural aarch64 build also passed with both replacements in its AArch64 ELF; native ARM execution was not run. The live unauthenticated sync and full update --apply fetch were blocked by the worker's exhausted GitHub API allowance (403), so the exact stub path and caller source were verified separately. Hosted self-tests pass.

Codex GPT-5.6 Sol XHigh classified the prior finding as fixed narrowly and supplied the remaining discovery/channel mismatch; process-level independence is not guaranteed because the named T3 reviewer shares the readable workspace. Its binary-corruption, architecture-selection, and unpatched-installer-path suspicions were rejected after direct verification.

Nothing was pushed. Waiting on the author to integrate or disable update discovery; I did not approve, request changes, or merge.

🤖 Generated by GPT-5.6 Sol XHigh in T3 Code. Reviewed by Codex GPT-5.6 Sol XHigh.

Reviewed unchanged head 8ac12ec7d6af878680ae6a2653c3c67e76714bd4 together with its follow-up #347. The required release-discovery fixes belong in #347, where commit 9779715f163897e0b1ef0d14ceefaba896fc7c8b fixes Linux argument-size failures on real release pages and isolates tests from future package-version bumps. No additional change to this PR's PKGBUILD or installer stub is needed for those fixes. Merge #347 into add-cua-driver-bin first.

The earlier comment's remaining updater-discovery finding was overstated as medium and merge-blocking. It is a low-severity UX mismatch: vendor checks can recommend releases before pacman offers them, but applying that recommendation safely fails with pacman guidance. On this run's disposable Omabot worker, the actual cua-driver update --apply recommended 0.25.0, reached the packaged stub, exited 1, created no user-local installation, and left all 21 package-owned files intact. The unsafe self-install path remains fixed. This supersedes the earlier request to block on update discovery.

The unchanged 0.23.2 x86_64 package built through the repository builder and installed with pacman; CLI/version, cursor-theme helper, session-aware doctor and a standard-permission daemon call worked. With #347's fixes, all three native repository self-tests passed, and a separate live-sync copy advanced to quarantined 0.24.0 with both checksums and retained passing tests. Native ARM execution and GUI input were not tested. The optional plugin in #346 still needs its own ABI and compositor qualification.

Codex GPT-6 XHigh reviewed the inherited updater workaround and the final #347 changes with no remaining concrete blocker. Process-level independence is not guaranteed because the named T3 reviewer shares the readable filesystem; the reported failure and containment paths were verified on the worker. Upstream trycua/cua#3636 is merged, but keep the packaging workaround until a release containing it reaches the package through the normal update gate.

#347's final-head Arch self-tests pass. Waiting on the maintainer's merge decision, starting with #347. No merge performed.

🤖 Generated by GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.

Fresh Omabot review after #347 merged: no new blocking findings at 623a6216e7ad9b1f0f8044ae4f423854778e2511. This run used a newly cloned repository, clean detached checkouts, a new disposable credential-free Proxmox worker and a new Codex GPT-6 XHigh review thread. The worker's commit/tree identity and package-file hashes matched the reviewed source.

Current master has advanced, so validation covered both the exact PR head and GitHub's integration commit 5ac7104a4a0f0e5218aa5b121d2cc19b2fbde34d against a44e2d2e49d01faa4d351e047bfa5632c2c21b1b:

• All three PR-head self-test suites passed with native pacman vercmp. All four suites on the integration tree passed, including sync-rebuilds.
• Live release sync advanced a separate disposable copy from 0.23.2 to quarantined 0.24.0 with both architecture checksums; its self-test passed afterward. The reviewed package itself remains 0.23.2-1.
• Both repository builders produced the x86_64 package successfully. Fresh installation and integration-artifact reinstallation passed pacman -Qkk: 21 files, zero alterations. CLI/version and cursor-theme helper checks passed, and package removal left no owned executable, payload or license directory.
• A fresh Arch base container installed the package using its declared dependencies; all four shipped ELF payloads resolved their dynamic libraries. No missing libXtst dependency was found.
• Session-aware doctor and a standard-permission daemon call ran. Actual update --apply reached the pacman refusal stub, exited 1, created no user-local installation and preserved package integrity. The existing updater-notice mismatch remains nonblocking.

Codex GPT-6 XHigh reviewed the full package and current-master integration without a concrete defect. Its dependency question was checked against actual ELF dependencies and the clean-container install. The named T3 reviewer shares a readable filesystem, so process-level independence is not guaranteed.

Current CI passes both self-tests and build-isolation. Native ARM execution and GUI input were not tested; this does not qualify the separate #346 Hyprland plugin. No source changes were needed. Ready for the maintainer's merge decision; no merge performed.

🤖 Generated by GPT-6 in T3 Code. Reviewed by Codex GPT-6 XHigh.