Harden LinuxCNC wasm and native probe workflows

analyze-linuxcnc-wasm-blockers.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+linuxcnc_root=${LINUXCNC_ROOT:-../linuxcnc}
+manifest=${1:-linuxcnc-rs274-wasm-source-files.txt}
+
+if [[ ! -f "$manifest" ]]; then
+    echo "missing manifest: $manifest" >&2
+    exit 1
+fi
+
+if [[ ! -d "$linuxcnc_root" ]]; then
+    echo "missing LinuxCNC root: $linuxcnc_root" >&2
+    exit 1
+fi
+
+python_blockers=()
+dlopen_blockers=()
+tooldata_blockers=()
+shimmed_tooldata_users=()
+native_backend_blockers=()
+native_fs_blockers=()
+
+while IFS=: read -r group path note; do
+    [[ -z "$group" || "$group" == \#* ]] && continue
+    case "$group" in
+        core)
+            continue
+            ;;
+        blocked)
+            ;;
+        *)
+            echo "unknown manifest group: $group" >&2
+            exit 1
+            ;;
+    esac
+
+    full_path="$linuxcnc_root/$path"
+    if [[ ! -f "$full_path" ]]; then
+        echo "missing manifest source: $path" >&2
+        exit 1
+    fi
+
+    if [[ "$path" == src/emc/tooldata/* ]]; then
+        tooldata_blockers+=("$path")
+    fi
+
+    if [[ "$path" == "src/emc/tooldata/tooldata_mmap.cc" ]]; then
+        native_backend_blockers+=("$path")
+    fi
+
+    if grep -Eq 'Python\.h|boost/python|pythonplugin|PyObject|PyInit_' "$full_path"; then
+        python_blockers+=("$path")
+    fi
+
+    if grep -Eq 'dlopen|dlsym|RTLD_' "$full_path"; then
+        dlopen_blockers+=("$path")
+    fi
+
+    if grep -Eq 'mkstemp|mkstemps|dirent\.h|opendir|readdir|unistd\.h' "$full_path"; then
+        native_fs_blockers+=("$path")
+    fi
+
+    if [[ "$path" != src/emc/tooldata/* ]] && grep -Eq 'tooldata/tooldata.hh|tooldata_' "$full_path"; then
+        shimmed_tooldata_users+=("$path")
+    fi
+done < "$manifest"
+
+print_group() {
+    local title=$1
+    shift
+    echo "[$title]"
+    if [[ $# -eq 0 ]]; then
+        echo "(none)"
+    else
+        printf '%s\n' "$@" | LC_ALL=C sort -u
+    fi
+    echo
+}
+
+print_group "python" "${python_blockers[@]}"
+print_group "dlopen" "${dlopen_blockers[@]}"
+print_group "tooldata" "${tooldata_blockers[@]}"
+print_group "tooldata-users" "${shimmed_tooldata_users[@]}"
+print_group "native-backend" "${native_backend_blockers[@]}"
+print_group "native-fs" "${native_fs_blockers[@]}"