第 6 组：源码链接、构建和文档约束闭环完成

web/test-browser-wasm-smoke-opfs-policy-sections.js

@@ -0,0 +1,49 @@
+export async function runBrowserOpfsPolicySections(context) {
+  const {
+    browserHasOpfs,
+    createDefaultBrowserSimulator,
+    createSmokeSimulator,
+    expectErrorContaining,
+    runSection,
+  } = context;
+  if (!browserHasOpfs()) {
+    return;
+  }
+  await runSection("browser opfs policy", async () => {
+    const defaultOpfsSimulator = await createDefaultBrowserSimulator();
+    try {
+      if (!defaultOpfsSimulator.fs.opfs) {
+        throw new Error("default browser simulator did not create an OPFS workspace");
+      }
+      if (defaultOpfsSimulator.fs.opfs.workspacePath !== "cnc-simulator") {
+        throw new Error("default browser simulator used an unexpected OPFS workspace path");
+      }
+    } finally {
+      defaultOpfsSimulator.dispose();
+    }
+    await expectErrorContaining(
+      () => createSmokeSimulator(false),
+      "OPFS cannot be disabled",
+      "browser simulator allowed OPFS to be disabled",
+    );
+    for (const unsafeWorkspacePath of ["../bad-workspace", "/bad-workspace", "bad//workspace"]) {
+      await expectErrorContaining(
+        () => createSmokeSimulator({ workspacePath: unsafeWorkspacePath }),
+        "inside the CNC workspace",
+        `browser simulator accepted unsafe OPFS workspace ${unsafeWorkspacePath}`,
+      );
+    }
+    for (const unsafeMountPoint of ["cnc", "/cnc/../escape", "/cnc//escape"]) {
+      await expectErrorContaining(
+        () => createSmokeSimulator({ mountPoint: unsafeMountPoint, workspacePath: "cnc-simulator-smoke" }),
+        "Emscripten filesystem",
+        `browser simulator accepted unsafe OPFS mount ${unsafeMountPoint}`,
+      );
+    }
+    await expectErrorContaining(
+      () => createSmokeSimulator({ mountPoint: "", workspacePath: "cnc-simulator-smoke" }),
+      "non-empty absolute path",
+      "browser simulator accepted empty OPFS mount",
+    );
+  });
+}