fix(cua): include release records and prepare local registry helpers

.gitignore

@@ -47,3 +47,6 @@ worktrees/
 .agents/worktrees/
 .typert-*/
 native/system/test/bin/
+
+# Generated company-signed CUA release record.
+/packages/experimental/cua-macos/cua-helper.json

packages/boot/plugin-manager/tests/manager.spec.ts

@@ -1773,7 +1773,8 @@ it('lists absent Official entries offline without resolving their packages or co
   onTestFinished(() => { resolve.mockRestore(); registry.mockRestore() })
   const bundles = await manager.listBundles()
   for (const entry of OFFICIAL_ON_DEMAND_CATALOG) {
-    expect(bundles.filter(bundle => bundle.name === entry.packageName)).toEqual([{
+    expect(bundles.filter(bundle => bundle.name === entry.packageName)).toHaveLength(1)
+    expect(bundles.filter(bundle => bundle.name === entry.packageName)).toMatchObject([{
       name: entry.packageName, official: true, availability: 'missing', enabled: false, installed: false, optional: false,
       removable: false, updatable: false, rows: [], overrides: [], meta: entry.meta,
       ...entry.listedByDefault === undefined ? {} : { listedByDefault: entry.listedByDefault },

scripts/check-workspace-constraints.ts

@@ -191,7 +191,7 @@ const packageFileExtras: Readonly<Record<string, readonly string[]>> = {
   '@deepseek-ai/dsh-experimental-subagent-oar': ['LICENSE-OAR'],
   // CUA publishes its client API and attributed native source for local macOS builds.
   '@deepseek-ai/dsh-cua': ['lib/remote-types.js', 'lib/api.js', 'lib/bridge.js', 'lib/native-client.js', 'lib/protocol.js'],
-  '@deepseek-ai/dsh-experimental-cua-macos': ['native/bin', 'native/Package.swift', 'native/Info.plist', 'native/DSHComputerUse.icns', 'native/build_app.py', 'native/Sources', 'native/tests/swift', 'native/tests/test_swift.py', 'native/LICENSE.cua-driver', 'native/LICENSE.computer-use-icon', 'native/upstream.json', 'native/README.md', 'native/README.zh.md', 'native/protocol.schema.json'],
+  '@deepseek-ai/dsh-experimental-cua-macos': ['native/bin', 'cua-helper.json', 'native/Package.swift', 'native/Info.plist', 'native/DSHComputerUse.icns', 'native/build_app.py', 'native/Sources', 'native/tests/swift', 'native/tests/test_swift.py', 'native/LICENSE.cua-driver', 'native/LICENSE.computer-use-icon', 'native/upstream.json', 'native/README.md', 'native/README.zh.md', 'native/protocol.schema.json'],
   '@deepseek-ai/dsh-webhook-github': ['examples/github-review/cordis.yml', 'examples/github-review/github-ready-review-rule.mjs'],
   // Owned Worker bundles import this public bootstrap before their business entry.
   '@deepseek-ai/dsh-app-boot': ['lib/worker/profile-resolution-bootstrap.js'],

scripts/cua-helper/payload.spec.ts

@@ -49,7 +49,7 @@ it.skipIf(process.platform === 'win32')('verifies staged and repacked provider b
   expect(verifyCuaHelperPayload(f.payload, identity)).toEqual(f.manifest)
   const packageRoot = join(f.root, 'package')
   stageCuaHelperPayload(f.payload, packageRoot, identity)
-  expect(() => stageCuaHelperPayload(f.payload, packageRoot, identity)).toThrow('empty native/bin')
+  expect(() => { stageCuaHelperPayload(f.payload, packageRoot, identity) }).toThrow('empty native/bin')
   const tarball = join(f.root, 'provider.tgz')
   await create({ file: tarball, cwd: f.root, gzip: true, portable: true }, ['package'])
   await verifyCuaHelperTarball(tarball, identity)
@@ -70,7 +70,7 @@ it.skipIf(process.platform === 'win32').each(['version', 'commit', 'architecture
   if (damage === 'permissions') chmodSync(join(before.application, 'Contents/MacOS/dsh-cua-native'), 0o644)
   if (damage === 'symlink') symlinkSync(join(f.root, 'outside'), join(before.application, 'outside'))
   writeFileSync(join(f.payload, CUA_MANIFEST), JSON.stringify(f.manifest))
-  expect(() => stageCuaHelperPayload(f.payload, join(f.root, 'consumer'), identity)).toThrow()
+  expect(() => { stageCuaHelperPayload(f.payload, join(f.root, 'consumer'), identity) }).toThrow()
 })
 
 it('keeps company signing outside pull-request release rehearsals', () => {

scripts/dev-bundle-registry.ts

@@ -123,6 +123,9 @@ async function main(): Promise<void> {
     // 2. Current official artifacts, so the run never serves an earlier build.
     await runStep(root, ['run', 'build:official'], abort.signal, 'build:official')
     verifyBuiltBundles({ entries, packages })
+    if (selection.members.some(member => member.name === '@deepseek-ai/dsh-experimental-cua-macos')) {
+      await runStep(root, ['--dir', 'packages/experimental/cua-macos', 'run', 'build:native'], abort.signal, 'CUA native build')
+    }
 
     // 3. One immutable, run-owned directory; a later run never overwrites these bytes.
     const buildId = runId()