@lqc123qwe/car-runtime 1.8.0 → 1.10.0

package/test/s6.spec.ts

@@ -1,169 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { generateKeyPairSync, sign, createHash } from 'node:crypto'
-import { enforceSignature, verifyMinisig, type SignatureBundle } from '../src/load/verifier.ts'
-import { GoalDriver } from '../src/loop/goal.ts'
-import { recoverInterrupted } from '../src/loop/recover.ts'
-import { runTurn } from '../src/loop/stop.ts'
-import { SessionLog } from '../src/session/log.ts'
-
-// ==================== 验签器（ADR-003 双轨 / D-2 enforce 分级） ====================
-
-function makeTrustRoot() {
-  const { publicKey, privateKey } = generateKeyPairSync('ed25519')
-  const pubB64 = publicKey.export({ type: 'spki', format: 'der' }).toString('base64')
-  const signHash = (hash: string) => sign(null, Buffer.from(hash), privateKey).toString('base64')
-  return { pubB64, signHash }
-}
-
-const HASH = createHash('sha256').update('manifest-body').digest('hex')
-
-test('S6: minisig 验证——正确签名放行，篡改硬拒绝（不可配置放行）', () => {
-  const { pubB64, signHash } = makeTrustRoot()
-  const sig: SignatureBundle = { minisig: signHash(HASH) }
-  const good = enforceSignature(HASH, sig, { trustRootPublicKey: pubB64, mode: 'warn' })
-  assert.equal(good.allowed, true)
-  assert.equal(good.warning, undefined)
-  // 篡改哈希后验签失败——即使 warn 模式也硬拒绝
-  const bad = enforceSignature(HASH + 'x', sig, { trustRootPublicKey: pubB64, mode: 'warn' })
-  assert.equal(bad.allowed, false)
-  assert.match(bad.error!, /verification FAILED.*不可配置放行/)
-})
-
-test('S6 D-2: 签名缺失——warn 告警放行（指纹兜底），enforce 硬拒绝', () => {
-  const { pubB64 } = makeTrustRoot()
-  const warn = enforceSignature(HASH, undefined, { trustRootPublicKey: pubB64, mode: 'warn' })
-  assert.equal(warn.allowed, true)
-  assert.match(warn.warning!, /CAR-W-SIG.*enforce 切换见 D-2 终局条件/)
-  const enforce = enforceSignature(HASH, undefined, { trustRootPublicKey: pubB64, mode: 'enforce' })
-  assert.equal(enforce.allowed, false)
-  assert.match(enforce.error!, /signature missing/)
-})
-
-test('S6 ADR-003: Sigstore 不可达 → 回退静态轨（双轨回退语义）', () => {
-  const { pubB64, signHash } = makeTrustRoot()
-  const sig: SignatureBundle = { minisig: signHash(HASH), sigstoreBundle: '<bundled>' }
-  const r = enforceSignature(HASH, sig, {
-    trustRootPublicKey: pubB64, mode: 'enforce',
-    sigstoreAvailable: () => true, // 主轨探针可用但骨架期 bundle 校验不可达 → 回退静态轨
-  })
-  assert.equal(r.allowed, true) // 静态轨兜底成功
-})
-
-test('S6: verifyMinisig 对非法 base64 不崩溃（fail-closed）', () => {
-  const { pubB64 } = makeTrustRoot()
-  const r = verifyMinisig(HASH, 'not-base64!!!', pubB64)
-  assert.equal(r.ok, false)
-  assert.ok(r.error)
-})
-
-// ==================== F13 Goal 层 ====================
-
-test('F13: Goal phase 持久化（goalUpdate 事件）+ 恢复层重放（activation 不恢复=disarmed）', () => {
-  const log = new SessionLog()
-  const goal = new GoalDriver(log)
-  goal.arm()
-  assert.equal(goal.activation, 'armed')
-  goal.setPhase('paused', 'waiting for external event')
-  goal.setPhase('complete', 'done')
-  const events = log.events as any[]
-  assert.equal(events.filter(e => e.kind === 'goalUpdate').length, 2)
-  const replay = GoalDriver.replay(log.events)
-  assert.equal(replay.phase, 'complete')   // phase 从日志重放
-  assert.equal(replay.activation, 'disarmed') // activation 永不持久化（AC-4.5）
-})
-
-test('F13: 新实例默认 disarmed（重启不会把历史任务叫醒，AC-4.5）', () => {
-  const goal = new GoalDriver(new SessionLog())
-  assert.equal(goal.activation, 'disarmed')
-  assert.equal(goal.phase, 'active')
-})
-
-test('F13: 非 completed 收口自动 disarm（D5 §9：撞限/错误都会 disarm）', () => {
-  const goal = new GoalDriver(new SessionLog())
-  goal.arm()
-  goal.autoDisarmOnTurnEnd('max-tokens')
-  assert.equal(goal.activation, 'disarmed')
-  goal.arm()
-  goal.autoDisarmOnTurnEnd('completed')
-  assert.equal(goal.activation, 'armed') // completed 不 disarm
-})
-
-// ==================== F13 aggregate 可配置 + blockOnDeny ====================
-
-test('F13: aggregate.terminate=any——单个 terminate 即 aborted（对照默认 AND）', async () => {
-  const log = new SessionLog()
-  const tools = new Map([
-    ['killer', { declaredSideEffect: 'readonly', terminate: true, run: async () => 'k' } as any],
-    ['probe', { declaredSideEffect: 'readonly', run: async () => 'p' } as any],
-  ])
-  const r = await runTurn({
-    log, turnId: 'T', tools,
-    preset: { aggregate: { terminate: 'any' } },
-    model: async (): Promise<any> => ({ stopReason: 'toolUse', toolCalls: [
-      { id: 'c1', tool: 'probe', args: {} }, { id: 'c2', tool: 'killer', args: {} },
-    ] }),
-  })
-  assert.equal(r.reason, 'aborted') // any：killer 投票即整批终止（对照 M1 默认 AND 需全部）
-})
-
-test('F13: aggregate.concludesTurn=all——单工具收口不再立即 completed（对照默认 OR）', async () => {
-  const log = new SessionLog()
-  let n = 0
-  const tools = new Map([
-    ['probe', { declaredSideEffect: 'readonly', run: async () => 'p' } as any],
-    ['commit', { declaredSideEffect: 'write', concludesTurn: true, run: async () => 'c' } as any],
-  ])
-  const r = await runTurn({
-    log, turnId: 'T', tools, preset: { mode: 'full', aggregate: { concludesTurn: 'all' } },
-    model: async (): Promise<any> => n++ === 0
-      ? { stopReason: 'toolUse', toolCalls: [
-          { id: 'c1', tool: 'probe', args: {} }, { id: 'c2', tool: 'commit', args: {} },
-        ] }
-      : { stopReason: 'stop', text: 'final' },
-  })
-  // all 模式：批次 2 个工具仅 1 个 conclude 投票 → concludesAll 不满足 → 模型继续 → stop 收口
-  // （对照默认 OR：同批次会立即 completed——见 s2/s4 用例）
-  assert.equal(r.reason, 'completed')
-  assert.equal(r.steps, 2)
-})
-
-test('F13: blockOnDeny——授权拒绝即收口 blocked（产出点新增，枚举不增）', async () => {
-  const log = new SessionLog()
-  const tools = new Map([['danger', { declaredSideEffect: 'write', run: async () => 'x' } as any]])
-  const r = await runTurn({
-    log, turnId: 'T', tools,
-    preset: { mode: 'confirm', blockOnDeny: true, authorize: async () => false },
-    model: async (): Promise<any> => ({ stopReason: 'toolUse', toolCalls: [{ id: 'c1', tool: 'danger', args: {} }] }),
-  })
-  assert.equal(r.reason, 'blocked')
-  const end = log.events.find(e => e.kind === 'turnEnd') as any
-  assert.equal(end.meta.reason, 'blocked')
-})
-
-// ==================== 恢复层（interrupted） ====================
-
-test('F13: recoverInterrupted——未配对 toolCall 补合成结果 + 未闭合 turn 补记 interrupted', () => {
-  const log = new SessionLog()
-  log.append('user', 'user', 'T1', 'go')
-  log.append('model', 'toolCall', 'T1', { id: 'c1', tool: 't', args: {} })
-  // 模拟进程消失：c1 无 toolResult、T1 无 turnEnd
-  const report = recoverInterrupted(log)
-  assert.equal(report.pairedCalls, 1)
-  assert.equal(report.turnsClosed, 1)
-  const synthetic = log.events.find(e => e.kind === 'toolResult' && (e.payload as any).id === 'c1') as any
-  assert.equal(synthetic.payload.recovered, true) // 副作用状态未知显式声明
-  const end = log.events.find(e => e.kind === 'turnEnd' && e.turnId === 'T1') as any
-  assert.equal(end.meta.reason, 'interrupted') // 与 aborted 不混用
-})
-
-test('F13: 已配对/已闭合日志幂等（重复恢复零补记）', () => {
-  const log = new SessionLog()
-  log.append('user', 'user', 'T1', 'go')
-  log.append('model', 'toolCall', 'T1', { id: 'c1', tool: 't', args: {} })
-  log.append('plugin', 'toolResult', 'T1', { id: 'c1', result: 'ok' })
-  log.append('runtime', 'turnEnd', 'T1', null, { reason: 'completed' })
-  const report = recoverInterrupted(log)
-  assert.equal(report.pairedCalls, 0)
-  assert.equal(report.turnsClosed, 0)
-})

package/test/s7.spec.ts

@@ -1,136 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { scanSecrets, redactSecrets, shannonEntropy, PATTERN_LIBRARY } from '../src/security/secrets.ts'
-import { buildSeatbeltProfile } from '../src/sandbox/sandbox.ts'
-import { execFileSync } from 'node:child_process'
-
-// ==================== F12 secrets 检测（T-6 + D-3） ====================
-
-test('F12: API Key 前缀族命中（OpenAI/GitHub/AWS）', () => {
-  const t = 'const key = "sk-proj-abcdefghij0123456789abcd" // OPENAI_API_KEY'
-  const { hits } = scanSecrets(t)
-  assert.ok(hits.some(h => h.name === 'OpenAI'), 'OpenAI sk- 命中')
-  const aws = scanSecrets('aws_secret_access_key = "AKIAIOSFODNN7EXAMPLE"').hits
-  assert.ok(aws.some(h => h.name === 'AWS Access Key'), 'AWS AccessKey 命中')
-})
-
-test('F12: L2 熵过滤——低熵假 token 不命中（误报控制）', () => {
-  // sk- 前缀但内容是重复字符（低熵 <3.5）→ 不应命中
-  const t = 'sk-aaaaaaaaaaaaaaaaaaaaaaaa  // 测试占位符，非真实 key'
-  const { hits, candidates } = scanSecrets(t, { returnCandidates: true })
-  assert.equal(hits.length, 0, '低熵候选不进命中')
-  assert.ok(candidates.length >= 0) // 观察面存在
-})
-
-test('F12: L3 上下文打分——裸 sk- 串（无键名/赋值语境）分数不足则降级候选', () => {
-  const t = 'random text sk-Xy3kP9mQ2vB7nR4tW8zC for demo' // 有熵但无键名共现、非赋值语境
-  const { hits, candidates } = scanSecrets(t, { returnCandidates: true })
-  assert.ok(!hits.some(h => h.name === 'OpenAI') || hits.length >= 0) // 依打分而定，但机制须工作
-  assert.ok(hits.length + candidates.length >= 1, 'L1 前缀层必须先捕获候选')
-})
-
-test('F12: 私钥块与连接串结构化模式豁免熵检查', () => {
-  const pem = '-----BEGIN RSA PRIVATE KEY-----\nMIIB\n-----END RSA PRIVATE KEY-----'
-  assert.ok(scanSecrets(pem).hits.some(h => h.category === 'private-key'))
-  const cs = 'mongodb://admin:S3cretPw@cluster0.abc.mongodb.net/db'
-  assert.ok(scanSecrets(cs).hits.some(h => h.category === 'connection-string'))
-})
-
-test('F12: 连接串误报防护——无凭据连接串不命中', () => {
-  const t = 'mongodb://localhost:27017/mydb' // 无用户:密码@ 结构
-  const { hits } = scanSecrets(t)
-  assert.equal(hits.length, 0)
-})
-
-test('F12: redact 全遮蔽（保留首尾 ≤4）+ 原文不可逆', () => {
-  const key = 'sk-proj-abcdefghij0123456789abcd'
-  const t = `const key = "${key}" // OPENAI_API_KEY`
-  const { text, redacted } = redactSecrets(t)
-  assert.equal(redacted, 1)
-  assert.ok(!text.includes(key), '原文 key 不可见于脱敏后文本')
-  assert.ok(text.includes('sk-p****abcd'), '遮蔽格式 = 首 4 + **** + 尾 4')
-})
-
-test('F12: 熵函数基准', () => {
-  assert.ok(shannonEntropy('aaaaaaaa') < 0.1)
-  assert.ok(shannonEntropy('Xy3kP9mQ2vB7') > 3.2)
-})
-
-test('F12: 模式库 6 类齐备且可枚举（治理视图数据源）', () => {
-  const cats = new Set(PATTERN_LIBRARY.map(p => p.category))
-  for (const c of ['api-key', 'private-key', 'connection-string', 'cloud-credential', 'bearer-token']) {
-    assert.ok(cats.has(c as any), `类别 ${c} 存在`)
-  }
-  assert.ok(PATTERN_LIBRARY.length >= 20, '模式 ≥20 条（v1 目标 30 内精选）')
-})
-
-test('F12: D-3 标定——正负 1:9 基准集粗标（FPR ≤5% 门禁可执行）', () => {
-  // 负样本 90 条：常见代码片段（不含真实凭据）
-  const negatives: string[] = []
-  for (let i = 0; i < 90; i++) {
-    negatives.push([
-      `const cfg = { port: ${3000 + i}, debug: true }`,
-      `await fetch('https://api.example.com/v1/items?page=${i}')`,
-      `// TODO: handle error case ${i}`,
-      `const xs = [${i}, ${i + 1}, ${i + 2}].map(x => x * 2)`,
-    ][i % 4])
-  }
-  let fp = 0
-  for (const n of negatives) if (scanSecrets(n).hits.length > 0) fp++
-  const fpr = fp / negatives.length
-  assert.ok(fpr <= 0.05, `FPR=${(fpr * 100).toFixed(1)}% ≤5%（D-3）`)
-  // 正样本 10 条
-  const positives = [
-    'const k = "sk-proj-abcdefghij0123456789abcd" // openai key',
-    'const g = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ123456"',
-    'xoxb-123456789-abcdefgh',
-    'AKIAIOSFODNN7EXAMPLE',
-    '-----BEGIN RSA PRIVATE KEY-----',
-    'postgres://u:pX9k2m@db.internal:5432/app',
-    'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc',
-    'api_key = "a1B2c3D4e5F6g7H8i9J0"',
-    'password: "Sup3rS3cret!"',
-    'client_secret = "cs_live_abcdefghijklmnop"',
-  ]
-  let tp = 0
-  for (const p of positives) if (scanSecrets(p).hits.length > 0) tp++
-  const recall = tp / positives.length
-  assert.ok(recall >= 0.85, `正样本召回 ${(recall * 100).toFixed(0)}% ≥85%（正式 <1.5% 漏报为万级基准集目标）`)
-})
-
-// ==================== Seatbelt profile（darwin 后端，纯生成器测试） ====================
-
-test('Seatbelt: profile fail-closed 结构（deny default + 网络拒绝 + .git 保护）', () => {
-  const p = buildSeatbeltProfile('workspace-write', '/home/dev/proj')
-  assert.ok(p.includes('(deny default)'), 'fail-closed 顶层')
-  assert.ok(p.includes('(deny network*)'), 'deny-by-default 网络')
-  assert.ok(p.includes('(allow file-write* (subpath "/home/dev/proj"))'))
-  assert.ok(p.includes(`(deny file-write* (subpath "/home/dev/proj/.git"))`), '.git 受保护路径')
-  assert.ok(p.includes('(subpath "/usr")'), '系统只读面')
-})
-
-test('Seatbelt: read-only 不含 file-write*；danger-full-access 不生成 profile', () => {
-  const ro = buildSeatbeltProfile('read-only', '/w')
-  assert.ok(!ro.includes('file-write*'), 'read-only 无写授权')
-  assert.throws(() => buildSeatbeltProfile('danger-full-access', '/w'), /danger-full-access/)
-})
-
-test('Seatbelt: workspace 引号转义（注入防护）', () => {
-  const p = buildSeatbeltProfile('workspace-write', '/tmp/x"y')
-  assert.ok(!p.includes('"/tmp/x"y"'), '恶意引号被转义')
-  assert.ok(p.includes('\\"'))
-})
-
-// ==================== win32 spike 准备（S8 结论门输入） ====================
-
-test('win32 spike: 脚本存在且 win32 外环境输出 SKIP（判据清单可达）', () => {
-  const out = execFileSync(process.execPath, ['--experimental-transform-types', 'scripts/win32-koffi-spike.ts'], {
-    encoding: 'utf-8', timeout: 30_000,
-  })
-  if (process.platform !== 'win32') {
-    assert.ok(out.includes('SKIP: spike requires win32'))
-  } else {
-    // M5-S26 起四判据自动断言整合，win32 上以 VERDICT 收口（四判据全 PASS 或逐条列明）
-    assert.ok(out.includes('VERDICT:'), '四判据报告以 VERDICT 收口')
-  }
-})

package/test/s7b-baseline.spec.ts

@@ -1,20 +0,0 @@
-/**
- * S7b · E-5 万级 secrets 基准集常驻回归（M2 退出标准 #4；D-3 判据）
- *
- * 判据（M2 安全设计增补 D-3）：漏报率 <1.5%、FPR ≤5%、precision ≥80%，1:9 正负比。
- * 基准集确定性生成（mulberry32 固定种子），任何 PATTERN_LIBRARY / 三层检测改动
- * 触碰判据即本 spec 红——D-3「CI 标定」承诺的载体。
- */
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { runBaseline } from '../src/security/secrets-baseline.ts'
-
-test('S7b-E5: 10k 基准集（1000 正 + 9000 负）满足 D-3 判据', () => {
-  const r = runBaseline(1000, 9000)
-  assert.equal(r.posTotal, 1000, '正样本数')
-  assert.equal(r.negTotal, 9000, '负样本数')
-  assert.ok(r.missRate < r.criteria.missRateLt, `漏报率 ${(r.missRate * 100).toFixed(2)}% 应 <1.5%`)
-  assert.ok(r.fpr <= r.criteria.fprLe, `FPR ${(r.fpr * 100).toFixed(2)}% 应 ≤5%`)
-  assert.ok(r.precision >= r.criteria.precisionGe, `precision ${(r.precision * 100).toFixed(2)}% 应 ≥80%`)
-  assert.equal(r.pass, true)
-})

package/test/s9.spec.ts

@@ -1,89 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { Context } from '../src/kernel/context.ts'
-import { declareEvent, EventBus } from '../src/kernel/events.ts'
-import { dumpAssembly, dumpEventGraph } from '../src/governance/dump.ts'
-import { exportForensicsBundle, verifyBundle, complianceStatement, FIELD_STANDARD_MAP, AUDIT_FIELDS } from '../src/session/export.ts'
-import { SessionLog } from '../src/session/log.ts'
-
-// ==================== F14 治理视图 ====================
-
-test('F14: 配置树 dump——插件/依赖/服务/副作用计数完整', () => {
-  const ctx = new Context()
-  ctx.plugin({ name: 'db', apply: (c) => { c.provide('conn', { url: 'x' }); c.effect(() => () => {}, 'timer') } })
-  ctx.plugin({ name: 'api', inject: ['conn'], apply: () => {} })
-  const tree = dumpAssembly(ctx)
-  const db = tree.plugins.find(p => p.name === 'db')!
-  assert.equal(db.state, 'ACTIVE')
-  assert.deepEqual(db.provides, ['conn'])
-  assert.equal(db.effects, 1)
-  assert.deepEqual(db.effectLabels, ['timer'])
-  const api = tree.plugins.find(p => p.name === 'api')!
-  assert.deepEqual(api.inject, ['conn'])
-  assert.ok(tree.services.some(s => s.name === 'conn' && s.provider === 'db'))
-  assert.equal(tree.pending.length, 0)
-})
-
-test('F14: 产消图——目录 × handlerChain，priority 执行序', () => {
-  declareEvent('gov/e', 'serial')
-  const bus = new EventBus()
-  bus.on('gov/e', () => {}, { label: 'low', priority: 10 })
-  bus.on('gov/e', () => {}, { label: 'high', priority: -1 })
-  const { events, edges } = dumpEventGraph(bus, new Map([['gov/e', { mode: 'serial' }]]))
-  assert.equal(events[0].mode, 'serial')
-  assert.deepEqual(events[0].consumers.map(c => c.label), ['high', 'low']) // 实际执行序
-  assert.equal(edges.filter(e => e.direction === 'producer').length, 1)
-  assert.equal(edges.filter(e => e.direction === 'consumer').length, 2)
-})
-
-// ==================== F15 合规导出增强 ====================
-
-function sampleLog(): SessionLog {
-  const log = new SessionLog()
-  log.append('user', 'user', 'T1', { text: 'hi' })
-  log.append('model', 'toolCall', 'T1', { id: 'c1', tool: 't' })
-  log.append('model', 'toolResult', 'T1', { id: 'c1', result: 'ok' })
-  log.append('runtime', 'turnEnd', 'T1', null, { reason: 'completed' })
-  return log
-}
-
-test('F15: 取证包——逐文件 SHA-256 + 链锚点 + 审计元数据', () => {
-  const log = sampleLog()
-  const bundle = exportForensicsBundle(log, {
-    sessionId: 'S1', exportedBy: 'alice', exportedAt: '2026-09-04T14:00:00Z',
-    runtimeVersion: '0.1.0', sessionRange: { fromSeq: 0, toSeq: 3 },
-  })
-  assert.equal(bundle.manifest.format, 'car-forensics/1')
-  assert.equal(bundle.manifest.verifyChainAtExport, 'PASS')
-  assert.equal(bundle.manifest.eventCount, 4)
-  assert.ok(bundle.manifest.chainTail)
-  assert.equal(bundle.files.length, 2)
-  assert.ok(bundle.files.some(f => f.name === 'manifest.json'))
-  assert.equal(verifyBundle(bundle).ok, true)
-})
-
-test('F15: 篡改文件 → verifyBundle 拒绝；断链 → 导出中止', () => {
-  const log = sampleLog()
-  const bundle = exportForensicsBundle(log, { sessionId: 'S', exportedBy: 'a', exportedAt: 'x', runtimeVersion: 'v', sessionRange: { fromSeq: 0, toSeq: 3 } })
-  bundle.files[0].content = bundle.files[0].content.replace('"hi"', '"HACKED"')
-  const v = verifyBundle(bundle)
-  assert.equal(v.ok, false)
-  assert.equal(v.brokenFile, bundle.files[0].name)
-  // 断链导出中止
-  const log2 = sampleLog()
-  ;(log2.events as any)[1].payload = { tampered: true }
-  assert.throws(() => exportForensicsBundle(log2, { sessionId: 'S', exportedBy: 'a', exportedAt: 'x', runtimeVersion: 'v', sessionRange: { fromSeq: 0, toSeq: 3 } }), /CAR-E-EXPORT/)
-})
-
-test('T-7: 三标分层——字段映射与核心字段不可裁剪', () => {
-  assert.equal(AUDIT_FIELDS.length, 13)
-  for (const std of ['soc2', 'gdpr', 'mlps'] as const) {
-    const s = complianceStatement(std)
-    assert.ok(s.fields.length >= 6, `${std} 字段集非空`)
-    assert.equal(s.coreMissing.length, 0, `${std} 不可裁剪核心字段必须全含（9 核心字段三标并集设计保证）`)
-    assert.ok(s.statement.length > 40)
-  }
-  // 等保 b) 条四要素：日期时间/用户/事件类型/是否成功 均在 mlps 字段集
-  const mlps = complianceStatement('mlps').fields
-  for (const f of ['ts', 'actor', 'eventType', 'result/status']) assert.ok(mlps.includes(f), `等保 b) 要素 ${f}`)
-})

package/test/sandbox-escape/j17-orchestrate.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-# J-17 escape-wsl2 六步编排器（M3部署设计增补 §2.1.1）——在 WSL 发行版内执行
-#
-# 用法: j17-orchestrate.sh <repo 的 WSL 路径> <landlock-run 二进制的 WSL 路径>
-# 步骤映射：1 WSL 启用（CI 前置步骤）/ 2 发行版导入（CI 前置步骤）/ 3 环境自检 / 4 工作区迁移 / 5 实跑 / 6 证据回传（CI 后置步骤）
-set -euo pipefail
-
-REPO="${1:?usage: j17-orchestrate.sh <repo-wsl-path> <landlock-run-wsl-path>}"
-LR_SRC="${2:?missing landlock-run path}"
-
-# ── 步骤 4：工作区迁移到原生 ext4（强约束：/mnt 9p 语义不完整 → 假阳性/假阴性） ──
-case "$REPO" in /mnt/*) : ;; *)
-  echo "note: repo path $REPO 不在 /mnt——若本机为原生 Linux（J-05 场景）请直接用 run-matrix.sh" >&2 ;;
-esac
-rm -rf ~/car-matrix
-mkdir -p ~/car-matrix/artifacts
-cp -r "$REPO/native" "$REPO/test" ~/car-matrix/
-cp "$LR_SRC" ~/car-matrix/artifacts/landlock-run
-chmod +x ~/car-matrix/artifacts/landlock-run
-
-# ── G-06 第 4 断言点：WSL 发行版 node 版本（发行版默认无 node → informational，不阻塞逃逸门禁） ──
-if command -v node >/dev/null 2>&1; then
-  echo "G06-WSL-NODE: $(node -v)"
-else
-  echo "G06-WSL-NODE: not installed (informational — 逃逸矩阵不依赖 node)"
-fi
-
-# ── 步骤 3+5：环境自检（失败 exit 2 = 环境失败，§2.1.3 维护者 rerun 语义） + 20 条实跑 ──
-cd ~/car-matrix
-bash test/sandbox-escape/run-matrix.sh ~/car-matrix/artifacts/landlock-run ~/car-matrix/audit

package/test/sandbox-escape/run-matrix.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-# CAR E-1 逃逸回归矩阵（20 条 × 5 类）—— J-05 escape-linux / J-17 escape-wsl2 共用面
-#
-# 口径（M3部署设计增补 §2.1）：
-#   - 20 条 POC-4 移植用例常驻化；逐条串行（M2 工作目录并发护栏）；禁止 rerun 掩盖；
-#   - 审计 JSONL 无论成败必须产出（§2.1.1 步骤 6 常驻上传，非失败时才传）；
-#   - 运行位置强约束：必须在原生 ext4 路径（WSL 内 $HOME），禁止 /mnt 挂载路径（9p 语义不完整→假阳性/假阴性）；
-#   - 环境自检失败（内核/Landlock 不可用）= 环境失败（exit 2），不构成用例失败（§2.1.3）；
-#   - 用例失败 exit 1；全绿 exit 0。
-#
-# 用法: run-matrix.sh <landlock-run 绝对路径> [审计 JSONL 输出目录]（默认 ./audit）
-set -u
-
-LR="$1"
-OUTDIR="${2:-./audit}"
-mkdir -p "$OUTDIR"
-JSONL="$OUTDIR/escape-audit.jsonl"
-: > "$JSONL"
-
-PASS=0; FAIL=0; TOTAL=0
-TS() { date +%s%3N 2>/dev/null || python3 -c 'import time;print(int(time.time()*1000))' 2>/dev/null || echo 0; }
-
-# ── 环境自检（§2.1.1 步骤 3）：内核 ≥5.15 + Landlock 可探测；失败=环境失败 ──
-KVER="$(uname -r)"
-KMAJOR="$(echo "$KVER" | cut -d. -f1)"; KMINOR="$(echo "$KVER" | cut -d. -f2)"
-if [ "$KMAJOR" -lt 5 ] || { [ "$KMAJOR" -eq 5 ] && [ "$KMINOR" -lt 15 ]; }; then
-  echo "ENV-FAIL: kernel $KVER < 5.15" >&2; exit 2
-fi
-if ! "$LR" --probe; then
-  echo "ENV-FAIL: landlock probe failed (LSM disabled or kernel <5.13)" >&2; exit 2
-fi
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-cd "$WORK"
-# §2.1.1 步骤 4 强约束：用例必须在原生 ext4 工作区执行（/mnt 9p 语义不完整 → 假阳性/假阴性）
-case "$(pwd)" in /mnt/*|/cygdrive/*)
-  echo "ENV-FAIL: workspace on drvfs mount ($(pwd)) — move to native ext4 path" >&2; exit 2 ;;
-esac
-mkdir -p ws ro-target && echo secret > ro-target/secret.txt && echo local > ws/local.txt
-# shellcheck disable=SC2164
-ABS_RO="$(cd ro-target && pwd)"
-ABS_WS="$(cd ws && pwd)"
-
-# run_case <编号> <类> <模式> <期望exit> <描述> -- <bash -c 脚本>
-run_case() {
-  local id="$1" cls="$2" mode="$3" expect="$4" desc="$5"; shift 5
-  [ "$1" = "--" ] && shift
-  TOTAL=$((TOTAL+1))
-  local out rc=0
-  ( cd "ws" && "$LR" "$mode" -- bash -c "$*" ) >"$WORK/.out" 2>&1 || rc=$?
-  local verdict=FAIL
-  [ "$rc" -eq "$expect" ] && { verdict=PASS; PASS=$((PASS+1)); } || { verdict=FAIL; FAIL=$((FAIL+1)); }
-  printf '{"case":"E-%s","class":"%s","mode":"%s","expect":%s,"actual":%s,"verdict":"%s","desc":"%s","ts":%s}\n' \
-    "$id" "$cls" "$mode" "$expect" "$rc" "$verdict" "$desc" "$(TS)" >> "$JSONL"
-  printf '[%s] E-%-2s (%s) expect=%s actual=%s  %s\n' "$verdict" "$id" "$cls" "$expect" "$rc" "$desc"
-}
-
-# ════ 类 A：工作区外写拒绝（--rw 下，写位仅授予 cwd） ════
-run_case 01 A --rw 1 "写 /tmp 拒绝"          -- 'echo x > /tmp/car-escape-a && rm -f /tmp/car-escape-a'
-run_case 02 A --rw 1 "写 \$HOME 拒绝"        -- 'echo x > "$HOME/car-escape-b" && rm -f "$HOME/car-escape-b"'
-run_case 03 A --rw 1 "写父目录拒绝"           -- 'echo x > ../car-escape-c'
-run_case 04 A --rw 1 "写绝对外部路径拒绝"      -- "echo x > $ABS_RO/overrun"
-
-# ════ 类 B：写位转换拒绝（删除/建目/改名/截断，跨出 cwd 一律 EACCES） ════
-run_case 05 B --rw 1 "unlink 工作区外拒绝"    -- "rm $ABS_RO/secret.txt"
-run_case 06 B --rw 1 "mkdir 工作区外拒绝"     -- 'mkdir /tmp/car-escape-d'
-run_case 07 B --rw 1 "rename 跨出 cwd 拒绝"   -- 'mv local.txt ../car-escape-e'
-run_case 08 B --rw 1 "截断外部文件拒绝"       -- ": > $ABS_RO/secret.txt"
-
-# ════ 类 C：读/执行面放行验证（allowlist 正确放行运行必需面） ════
-run_case 09 C --rw 0 "读 /etc 放行"           -- 'cat /etc/hostname >/dev/null'
-run_case 10 C --rw 0 "读工作区放行"           -- 'cat local.txt >/dev/null'
-run_case 11 C --rw 0 "exec /bin/true 放行"    -- '/bin/true'
-run_case 12 C --ro 0 "只读态读工作区放行"      -- 'cat local.txt >/dev/null'
-
-# ════ 类 D：提权与特殊文件逃逸面 ════
-run_case 13 D --ro 1 "只读态 cwd 写拒绝"      -- 'echo x > newfile'
-run_case 14 D --rw 1 "symlink 逃逸拒绝"       -- 'ln -s /tmp/car-escape-f link && echo x > link'
-run_case 15 D --ro 1 "只读态建目拒绝（MAKE_DIR）" -- 'mkdir subdir'
-run_case 16 D --rw 1 "hardlink 外联拒绝"      -- 'ln local.txt ../car-escape-h'
-
-# ════ 类 E：probe 与契约语义 ════
-run_case 17 E --rw 0 "--rw cwd 写放行（正对照）" -- 'echo ok > w.txt && grep -q ok w.txt'
-run_case 19 E --ro 0 "只读态 exec 放行"        -- '/bin/true'
-run_case 20 E --rw 0 "子进程继承沙箱（嵌套写仍拒）" -- 'bash -c "echo x > /tmp/car-escape-i"; test $? -ne 0'
-
-# E-18 特殊：非法用法不走 bash -c 包装，直接断言二进制契约
-TOTAL=$((TOTAL+1))
-( cd ws && "$LR" --bogus -- true ) >/dev/null 2>&1; rc=$?
-if [ "$rc" -eq 64 ]; then PASS=$((PASS+1)); v=PASS; else FAIL=$((FAIL+1)); v=FAIL; fi
-printf '{"case":"E-18","class":"E","mode":"contract","expect":64,"actual":%s,"verdict":"%s","desc":"非法用法固定 exit 64","ts":%s}\n' "$rc" "$v" "$(TS)" >> "$JSONL"
-printf '[%s] E-18 (E) expect=64 actual=%s  非法用法固定 exit 64\n' "$v" "$rc"
-
-echo "----"
-echo "matrix: $PASS/$TOTAL PASS, $FAIL FAIL  (audit: $JSONL)"
-[ "$FAIL" -eq 0 ] && [ "$PASS" -eq 20 ] || exit 1
-exit 0

package/tsconfig.json

@@ -1,18 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "allowImportingTsExtensions": true,
-    "noEmit": true,
-    "skipLibCheck": true,
-    "strict": true,
-    "types": [
-      "node"
-    ]
-  },
-  "include": [
-    "src/**/*",
-    "scripts/**/*"
-  ]
-}