fix(linux): make release gate portable

Author: SuperJJ007

desktop/gateway/src/codex_auth/platform.rs

@@ -7,7 +7,7 @@ pub(super) const fn supported() -> bool {
 pub(super) fn browser_open_bin() -> PathBuf {
     #[cfg(target_os = "linux")]
     {
-        return PathBuf::from("/usr/bin/xdg-open");
+        PathBuf::from("/usr/bin/xdg-open")
     }
     #[cfg(not(target_os = "linux"))]
     {

desktop/src-tauri/src/lib.rs

@@ -463,6 +463,7 @@ pub fn run() {
         .expect("error while building tauri application");
 
     app.run(|app, event| match event {
+        #[cfg(target_os = "macos")]
         tauri::RunEvent::Reopen { .. } => show_main_window(app),
         tauri::RunEvent::ExitRequested { .. } | tauri::RunEvent::Exit => cleanup_for_exit(app),
         _ => {}

desktop/src-tauri/src/runtime/legacy_proxy.rs

@@ -255,10 +255,9 @@ where
 
 #[cfg(test)]
 mod tests {
-    use super::{
-        is_legacy_csswitch_python, parse_lsof_records, parse_ps_record,
-        stop_legacy_csswitch_python_on_port, LegacyProxyCleanup, ListenerProcess,
-    };
+    use super::{is_legacy_csswitch_python, parse_lsof_records, parse_ps_record, ListenerProcess};
+    #[cfg(target_os = "macos")]
+    use super::{stop_legacy_csswitch_python_on_port, LegacyProxyCleanup};
 
     fn process(command_name: &str, uid: u32, command: &str) -> ListenerProcess {
         ListenerProcess {

desktop/src-tauri/src/runtime/platform.rs

@@ -113,7 +113,7 @@ pub(crate) fn configure_runtime_script_command(
 pub(crate) fn installed_science_bin(home: &Path) -> PathBuf {
     #[cfg(target_os = "linux")]
     {
-        return home.join(".local/bin/claude-science");
+        home.join(".local/bin/claude-science")
     }
     #[cfg(not(target_os = "linux"))]
     {
@@ -125,7 +125,7 @@ pub(crate) fn installed_science_bin(home: &Path) -> PathBuf {
 pub(crate) fn browser_open_bin() -> PathBuf {
     #[cfg(target_os = "linux")]
     {
-        return PathBuf::from("/usr/bin/xdg-open");
+        PathBuf::from("/usr/bin/xdg-open")
     }
     #[cfg(not(target_os = "linux"))]
     {
@@ -136,7 +136,7 @@ pub(crate) fn browser_open_bin() -> PathBuf {
 pub(crate) fn lsof_bin() -> PathBuf {
     #[cfg(target_os = "linux")]
     {
-        return PathBuf::from("/usr/bin/lsof");
+        PathBuf::from("/usr/bin/lsof")
     }
     #[cfg(not(target_os = "linux"))]
     {
@@ -147,7 +147,7 @@ pub(crate) fn lsof_bin() -> PathBuf {
 pub(crate) fn ps_bin() -> PathBuf {
     #[cfg(target_os = "linux")]
     {
-        return PathBuf::from("/usr/bin/ps");
+        PathBuf::from("/usr/bin/ps")
     }
     #[cfg(not(target_os = "linux"))]
     {
@@ -162,7 +162,7 @@ pub(crate) fn id_bin() -> PathBuf {
 pub(crate) fn kill_bin() -> PathBuf {
     #[cfg(target_os = "linux")]
     {
-        return PathBuf::from("/usr/bin/kill");
+        PathBuf::from("/usr/bin/kill")
     }
     #[cfg(not(target_os = "linux"))]
     {

desktop/src-tauri/src/runtime/sandbox_session.rs

@@ -3,7 +3,9 @@ use std::process::{Command, Stdio};
 use std::time::Duration;
 
 use serde_json::{json, Value};
-use tauri::{Manager, Runtime};
+#[cfg(not(target_os = "linux"))]
+use tauri::Manager;
+use tauri::Runtime;
 
 use crate::runtime::operation::{
     self, OperationKind, OperationStage, OperationTrace, POLL_INTERVAL_MS,

test/__init__.py

@@ -0,0 +1 @@
+"""CSSwitch offline and loopback test package."""

test/test_real_machine_guard.sh

@@ -15,6 +15,13 @@ trap cleanup EXIT
 
 pass() { echo "PASS: $*"; }
 fail() { echo "FAIL: $*" >&2; FAILS=$((FAILS + 1)); }
+file_mode() {
+  case "$(uname -s)" in
+    Darwin) stat -f '%Lp' "$1" ;;
+    Linux) stat -c '%a' "$1" ;;
+    *) return 1 ;;
+  esac
+}
 
 mkdir -p "$REAL_HOME/.csswitch"
 printf '%s\n' 'real-config-sentinel' >"$REAL_HOME/.csswitch/config.json"
@@ -60,7 +67,7 @@ case "$PROXY_PORT:$SANDBOX_PORT" in
     ;;
 esac
 
-if [ "$(stat -f '%Lp' "$ACCEPTANCE_ROOT/state/runtime-ports.v1")" = 600 ]; then
+if [ "$(file_mode "$ACCEPTANCE_ROOT/state/runtime-ports.v1")" = 600 ]; then
   pass "persisted port state is mode 0600"
 else
   fail "persisted port state is not mode 0600"
@@ -90,8 +97,8 @@ else
   fail "Codex fixture contract mismatch"
 fi
 
-if [ "$(stat -f '%Lp' "$CFG")" = 600 ] && \
-   [ "$(stat -f '%Lp' "$ACCEPTANCE_ROOT/home/.csswitch-acceptance")" = 700 ]; then
+if [ "$(file_mode "$CFG")" = 600 ] && \
+   [ "$(file_mode "$ACCEPTANCE_ROOT/home/.csswitch-acceptance")" = 700 ]; then
   pass "Codex fixture permissions are 0600/0700"
 else
   fail "Codex fixture permissions are too broad"
@@ -159,14 +166,23 @@ else
   pass "preflight rejects runtime use of OAuth callback ports"
 fi
 
-if env PATH=/usr/bin:/bin \
+NO_LSOF_BIN="$TMP_ROOT/no-lsof-bin"
+mkdir -p "$NO_LSOF_BIN"
+for tool in awk cat chmod dirname mkdir python3 rm sort uname; do
+  tool_path="$(command -v "$tool")"
+  ln -s "$tool_path" "$NO_LSOF_BIN/$tool"
+done
+NO_LSOF_OUT="$TMP_ROOT/no-lsof.out"
+if env PATH="$NO_LSOF_BIN" \
    HOME="$REAL_HOME" \
    CSSWITCH_REAL_TEST_ROOT="$TMP_ROOT/no-lsof" \
    SCIENCE_BIN=/usr/bin/true \
-     /bin/bash "$GUARD" preflight >/dev/null 2>&1; then
+     /bin/bash "$GUARD" preflight >"$NO_LSOF_OUT" 2>&1; then
   fail "preflight treated missing lsof as an empty listener set"
-else
+elif grep -q '端口安全检查需要可执行 lsof' "$NO_LSOF_OUT"; then
   pass "preflight fails closed when lsof is unavailable"
+else
+  fail "preflight failed before reaching the missing-lsof guard"
 fi
 
 FAKE_BIN="$TMP_ROOT/fake-bin"