From 002c8a2d531b6b265b449c91ea8a9cade08a3cf7 Mon Sep 17 00:00:00 2001
From: cnc <cnc@localhost>
Date: Thu, 4 Jun 2026 05:59:49 +0800
Subject: [PATCH] =?UTF-8?q?=E5=8F=82=E8=80=83=E6=89=80=E6=9C=89=E5=88=86?=
 =?UTF-8?q?=E7=BB=84=EF=BC=8C=E5=AE=8C=E6=88=90=E5=B0=BD=E9=87=8F=E5=A4=9A?=
 =?UTF-8?q?=E7=9A=84=E5=86=85=E5=AE=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

结论：OPFS负向守护补充showDirectoryPicker，禁止浏览器目录选择绕过OPFS持久化路径；未扩展smoke功能行为。
---
 docs/linuxcnc-source-policy.md         | 4 ++--
 test-all-native.sh                     | 4 ++++
 test-linuxcnc-wasm-cmake-safe-probe.sh | 2 +-
 test-native.sh                         | 2 +-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/docs/linuxcnc-source-policy.md b/docs/linuxcnc-source-policy.md
index e58bc15..14d1a53 100644
--- a/docs/linuxcnc-source-policy.md
+++ b/docs/linuxcnc-source-policy.md
@@ -18,8 +18,8 @@ Hard rules:
   add browser filesystem paths that bypass OPFS.
 - Browser app and wasm bridge code must not persist CNC programs, LinuxCNC
   parameter files, or mirrored workspace files through non-OPFS browser storage
-  APIs such as Local Storage, IndexedDB, File Picker writes, WebKit filesystem
-  APIs, or FileReader-backed import paths.
+  APIs such as Local Storage, IndexedDB, File Picker reads/writes, Directory
+  Picker access, WebKit filesystem APIs, or FileReader-backed import paths.
 
 Allowed project code:
 
diff --git a/test-all-native.sh b/test-all-native.sh
index 8aae54f..4a73e3c 100755
--- a/test-all-native.sh
+++ b/test-all-native.sh
@@ -734,7 +734,11 @@ grep -F 'signature must include the blocker wrapper script, analyzer script' doc
 grep -F 'sha256sum test-linuxcnc-wasm-blockers.sh' test-linuxcnc-wasm-blockers.sh >/dev/null
 grep -F 'browser app/wasm code must not add filesystem persistence outside OPFS' test-native.sh >/dev/null
 grep -F 'browser app/wasm code must not add filesystem persistence outside OPFS' test-linuxcnc-wasm-cmake-safe-probe.sh >/dev/null
+grep -F 'showDirectoryPicker' test-native.sh >/dev/null
+grep -F 'showDirectoryPicker' test-linuxcnc-wasm-cmake-safe-probe.sh >/dev/null
 grep -F 'reject browser app/wasm storage APIs that could bypass it' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'Directory' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'Picker access' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'Persistent native, source-link, source-syntax, and wasm-safe CMake probe' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'copies and byte-compares `cnc_sim.js` and `cnc_sim.wasm` under' docs/linuxcnc-source-policy.md >/dev/null
 grep -F '`CNC_SIM_BUILD_JOBS` must be a positive integer and defaults to `8`.' docs/linuxcnc-source-policy.md >/dev/null
diff --git a/test-linuxcnc-wasm-cmake-safe-probe.sh b/test-linuxcnc-wasm-cmake-safe-probe.sh
index 90e969e..a753c3b 100755
--- a/test-linuxcnc-wasm-cmake-safe-probe.sh
+++ b/test-linuxcnc-wasm-cmake-safe-probe.sh
@@ -763,7 +763,7 @@ grep -F -- './test-web-wasm-node-smoke.sh' build-wasm.sh >/dev/null
 grep -F -- './test-web-wasm-browser-smoke.sh' build-wasm.sh >/dev/null
 grep -F 'const opfsOptions = options.opfs ?? (isOpfsAvailable() ? {} : false)' web/src/wasm-core.js >/dev/null
 grep -F 'OPFS cannot be disabled in browser contexts with OPFS support' web/src/wasm-core.js >/dev/null
-if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|webkitRequestFileSystem|FileReader' web/src; then
+if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|showDirectoryPicker|webkitRequestFileSystem|FileReader' web/src; then
     echo "browser app/wasm code must not add filesystem persistence outside OPFS" >&2
     exit 1
 fi
diff --git a/test-native.sh b/test-native.sh
index 8f040a1..b159c34 100755
--- a/test-native.sh
+++ b/test-native.sh
@@ -389,7 +389,7 @@ grep -F '"parameters/rs274ngc.var"' web/test-browser-wasm-smoke-opfs-parameter-s
 grep -F '"parameters/rs274ngc.var.bak"' web/test-browser-wasm-smoke-opfs-parameter-sections.js >/dev/null
 grep -F 'const opfsOptions = options.opfs ?? (isOpfsAvailable() ? {} : false)' web/src/wasm-core.js >/dev/null
 grep -F 'OPFS cannot be disabled in browser contexts with OPFS support' web/src/wasm-core.js >/dev/null
-if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|webkitRequestFileSystem|FileReader' web/src; then
+if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|showDirectoryPicker|webkitRequestFileSystem|FileReader' web/src; then
     echo "browser app/wasm code must not add filesystem persistence outside OPFS" >&2
     exit 1
 fi