From 36bd55c5f991aded4f853e08fa2023cbbc966bfd Mon Sep 17 00:00:00 2001
From: AstroHan <lei.yuhan@outlook.com>
Date: Mon, 31 Aug 2026 01:47:22 +0800
Subject: [PATCH 1/3] test: keep Nightly workflow policy hermetic

Remove the host-rsync execution from the cross-platform release contract. Keep the receiver compatibility and append-only guarantees as workflow policy assertions, while the real Nightlies run verifies the external rsync boundary.

Generated-by: Codex
---
 .../desktop-nightly-workflow-policy.test.mjs  | 20 ++-----------------
 1 file changed, 2 insertions(+), 18 deletions(-)

diff --git a/scripts/desktop-nightly-workflow-policy.test.mjs b/scripts/desktop-nightly-workflow-policy.test.mjs
index 4fadd8736f..32e78bd11c 100644
--- a/scripts/desktop-nightly-workflow-policy.test.mjs
+++ b/scripts/desktop-nightly-workflow-policy.test.mjs
@@ -19,9 +19,7 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdir, mkdtemp, readFile, rm, stat } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
 import { test } from 'node:test';
 import { parse } from 'yaml';
 
@@ -125,24 +123,10 @@ test('the first Desktop Nightly creates its destination with rsync 3.1-compatibl
   assert.match(bootstrap.run, /mkdir -p \.nightly-empty\/maka\/desktop/u);
   assert.match(bootstrap.run, /^rsync -rlptDz --protect-args /mu);
   assert.doesNotMatch(bootstrap.run, /--mkpath/u);
+  assert.doesNotMatch(bootstrap.run, /--delete/u);
   assert.match(bootstrap.run, /\.nightly-empty\/maka\/ "\$NIGHTLIES_RSYNC_BASE\/maka\/"/u);
   assert.doesNotMatch(bootstrap.run, /\.nightly-publish/u);
   assert.ok(steps.indexOf(bootstrap) < feedGuardPosition);
-
-  const workspace = await mkdtemp(join(tmpdir(), 'maka-nightly-bootstrap-'));
-  const remoteBase = join(workspace, 'remote');
-  await mkdir(remoteBase);
-  try {
-    const localBootstrap = bootstrap.run.replace('--protect-args ', '');
-    const result = spawnSync('bash', ['-c', localBootstrap], {
-      cwd: workspace,
-      env: { ...process.env, NIGHTLIES_RSYNC_BASE: remoteBase },
-    });
-    assert.equal(result.status, 0, result.stderr.toString());
-    assert.ok((await stat(join(remoteBase, 'maka', 'desktop'))).isDirectory());
-  } finally {
-    await rm(workspace, { recursive: true, force: true });
-  }
 });
 
 test('the protected Desktop publisher appends payloads before advancing the feed', async () => {

From 02c47964e84c347195d21be236973d288ae700bb Mon Sep 17 00:00:00 2001
From: AstroHan <lei.yuhan@outlook.com>
Date: Mon, 31 Aug 2026 02:15:59 +0800
Subject: [PATCH 2/3] test: scope the Windows sandbox process probe

Filter the WMI query at its provider so a busy runner does not spend the probe budget enumerating every process before cancellation evidence can be observed.

Generated-by: Codex
---
 scripts/verify-windows-sandbox-e2e.mjs | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/scripts/verify-windows-sandbox-e2e.mjs b/scripts/verify-windows-sandbox-e2e.mjs
index c4c9a08766..c54f404d9f 100644
--- a/scripts/verify-windows-sandbox-e2e.mjs
+++ b/scripts/verify-windows-sandbox-e2e.mjs
@@ -627,13 +627,12 @@ async function verifyPackagedClientCancellation({
 async function listCancellationProcesses(sandboxExecutable, timeoutMs = 10_000) {
   const script = String.raw`
 $imageName = [IO.Path]::GetFileName($env:MAKA_CANCEL_SANDBOX)
+$escapedImageName = $imageName.Replace("'", "''")
 $matches = @(
-  Get-CimInstance Win32_Process | ForEach-Object {
-    if ($_.Name -eq $imageName) {
-      [PSCustomObject]@{
-        processId = $_.ProcessId
-        commandLine = [string]$_.CommandLine
-      }
+  Get-CimInstance Win32_Process -Filter "Name='$escapedImageName'" | ForEach-Object {
+    [PSCustomObject]@{
+      processId = $_.ProcessId
+      commandLine = [string]$_.CommandLine
     }
   }
 )

From 374e1b7160c36139f9b7b76fd33a000b9a6e5baa Mon Sep 17 00:00:00 2001
From: AstroHan <lei.yuhan@outlook.com>
Date: Mon, 31 Aug 2026 02:25:45 +0800
Subject: [PATCH 3/3] test: remove duplicate Nightly policy coverage

Keep the append-only rsync invariant in the shared publisher assertion instead of pinning the bootstrap step twice.

Generated-by: Codex
---
 scripts/desktop-nightly-workflow-policy.test.mjs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/scripts/desktop-nightly-workflow-policy.test.mjs b/scripts/desktop-nightly-workflow-policy.test.mjs
index 32e78bd11c..5dac5578c0 100644
--- a/scripts/desktop-nightly-workflow-policy.test.mjs
+++ b/scripts/desktop-nightly-workflow-policy.test.mjs
@@ -123,7 +123,6 @@ test('the first Desktop Nightly creates its destination with rsync 3.1-compatibl
   assert.match(bootstrap.run, /mkdir -p \.nightly-empty\/maka\/desktop/u);
   assert.match(bootstrap.run, /^rsync -rlptDz --protect-args /mu);
   assert.doesNotMatch(bootstrap.run, /--mkpath/u);
-  assert.doesNotMatch(bootstrap.run, /--delete/u);
   assert.match(bootstrap.run, /\.nightly-empty\/maka\/ "\$NIGHTLIES_RSYNC_BASE\/maka\/"/u);
   assert.doesNotMatch(bootstrap.run, /\.nightly-publish/u);
   assert.ok(steps.indexOf(bootstrap) < feedGuardPosition);