fix(code-runtime): preserve native startup paths and preview packaging

packages/code-runtime/code-runtime-node/tests/host-failures.spec.ts

@@ -376,6 +376,7 @@ describe('Node runtime host failures', () => {
     const h = await setup()
     h.onBoot(() => {
       for (const stream of [h.stdout, h.stderr]) {
+        stream.write(Buffer.from([0xef, 0xbb, 0xbf]))
         stream.write(Buffer.from([0xe2]))
         stream.write(Buffer.from([0x82, 0xac]))
         stream.end(Buffer.from([0xe2]))
@@ -384,6 +385,7 @@ describe('Node runtime host failures', () => {
     })
     const result = await h.start()
     expect(result.error).toBeUndefined()
+    expect(result.logs.filter(text => text === '\uFEFF')).toHaveLength(2)
     expect(result.logs.filter(text => text === '€')).toHaveLength(2)
     expect(result.logs.filter(text => text === '�')).toHaveLength(2)
   })
@@ -436,6 +438,7 @@ describe('Node runtime host failures', () => {
       expect((await h.start()).error).toBeUndefined()
       const spec = h.spawn.mock.calls[0]?.[0]
       expect(spec?.env?.DSH_CODE_RUNTIME_NODE).toBe('1')
+      expect(Object.hasOwn(spec?.env ?? {}, 'PATH')).toBe(false)
       expect(spec?.argv.at(-1)).toBe('134217728')
       expect(Object.entries(spec?.env ?? {}).filter(([, value]) => value !== undefined)).toEqual([['DSH_CODE_RUNTIME_NODE', '1']])
     } finally {

packages/code-runtime/code-runtime-node/tests/runtime.spec.ts

@@ -1,9 +1,9 @@
 import { mkdtemp, mkdir, readFile, rm, symlink } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { createServer, type Socket } from 'node:net'
-import { join } from 'node:path'
+import { delimiter, join } from 'node:path'
 import { Context } from '@deepseek-ai/cordis'
-import { describe, expect, it, onTestFinished } from 'vitest'
+import { describe, expect, it, onTestFinished, vi } from 'vitest'
 import type { CodeBindingFunction, CodeBindingNamespace, CodeRunRequest } from '@deepseek-ai/dsh-code-runtime'
 import type { Config } from '../src/index.ts'
 import { mountRuntime } from './setup.ts'
@@ -175,6 +175,34 @@ describe('Node program process', () => {
     await expect(readFile(path)).rejects.toMatchObject({ code: 'ENOENT' })
   })
 
+  it.skipIf(process.platform === 'win32')('starts a confining launcher found only through the execution PATH', async () => {
+    const { ctx, runtime, run, root } = await setup({}, 'read-only')
+    const confine = ctx.sandbox.confine.bind(ctx.sandbox)
+    const policy = runtime.resolve({ program: '', bindings: [] }).sandboxPolicy
+    if (policy === undefined || policy.mode === 'danger-full-access') throw new Error('expected confined policy')
+    const wrapped = confine([process.execPath, '--version'], policy)
+    const original = wrapped.argv[0]
+    if (original === undefined) throw new Error('expected sandbox launcher')
+    const executable = await ctx.subprocess.resolveExecutable(original)
+    const alias = 'ptc-private-sandbox-launcher'
+    await symlink(executable, join(root, alias))
+    const previousPath = process.env.PATH
+    const substitute = vi.spyOn(ctx.sandbox, 'confine').mockImplementation((argv, selected) => {
+      const result = confine(argv, selected)
+      return { ...result, argv: [alias, ...result.argv.slice(1)] }
+    })
+    try {
+      process.env.PATH = `${root}${delimiter}${previousPath ?? ''}`
+      const result = await run({ program: 'return { env: Object.keys(process.env) };', bindings: [] })
+      expect(result.error).toBeUndefined()
+      expect(result.value).toEqual({ env: [] })
+    } finally {
+      substitute.mockRestore()
+      if (previousPath === undefined) delete process.env.PATH
+      else process.env.PATH = previousPath
+    }
+  })
+
   it('permits workspace writes and denies a symlink to a sibling outside it', async () => {
     const { run, cwd, root } = await setup({}, 'workspace-write')
     const target = join(cwd, 'allowed.txt')