refactor(plugin): add Python-free Unix OS primitives

.github/workflows/native-unix.yml

@@ -0,0 +1,127 @@
+name: native-unix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  primitives:
+    name: primitives / ${{ matrix.platform }}-${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            platform: linux
+            arch: x64
+            image: quay.io/pypa/manylinux_2_28_x86_64@sha256:0536c364004fa2a3c5041120b6fe35d84fc5bfe31f04c6a6304f13eac4a67b63
+          - runner: ubuntu-24.04-arm
+            platform: linux
+            arch: arm64
+            image: quay.io/pypa/manylinux_2_28_aarch64@sha256:1676a4f178dc6cf8a1d1e3b7e1d71fca891a466ebde72a33880ccda8af3383d8
+          - runner: macos-15-intel
+            platform: darwin
+            arch: x64
+          - runner: macos-15
+            platform: darwin
+            arch: arm64
+    defaults:
+      run:
+        shell: bash
+        working-directory: plugins/codex-security/native
+    env:
+      NATIVE_IMAGE: ${{ matrix.image }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          package_json_file: package.json
+          cache: true
+          cache_dependency_path: sdk/typescript/pnpm-lock.yaml
+      - name: Set up Node.js 22
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "22.13.0"
+      - name: Compile TypeScript tools
+        working-directory: .
+        run: |
+          pnpm --dir sdk/typescript install --frozen-lockfile
+          pnpm --dir sdk/typescript run build:ci
+      - name: Set up Rust
+        run: rustup toolchain install 1.97.1 --profile minimal --component rustfmt --component clippy
+      - name: Check Rust source and fetch locked dependencies
+        run: |
+          cargo fmt --check
+          cargo clippy --locked -- -D warnings
+          cargo fetch --locked
+      - name: Build and verify Linux on glibc 2.28 with Node.js 22
+        if: matrix.platform == 'linux'
+        run: |
+          mkdir -p "$RUNNER_TEMP/native-cargo" "$RUNNER_TEMP/native-no-python"
+          printf '#!/bin/sh\nexit 99\n' > "$RUNNER_TEMP/native-no-python/python"
+          cp "$RUNNER_TEMP/native-no-python/python" "$RUNNER_TEMP/native-no-python/python3"
+          chmod +x "$RUNNER_TEMP/native-no-python/"*
+          docker run --rm \
+            --volume "$PWD:/source" \
+            --volume "$RUNNER_TEMP/native-cargo:/cargo" \
+            --volume "${CARGO_HOME:-$HOME/.cargo}/registry:/cargo/registry:ro" \
+            --volume "$(rustc --print sysroot):/toolchain:ro" \
+            --volume "$(dirname "$(dirname "$(command -v node)")"):/node:ro" \
+            --volume "$RUNNER_TEMP/native-no-python:/no-python:ro" \
+            --env CARGO_HOME=/cargo \
+            --env CARGO_NET_OFFLINE=true \
+            --env PATH=/no-python:/toolchain/bin:/opt/rh/gcc-toolset-14/root/usr/bin:/usr/local/bin:/usr/bin:/bin \
+            --workdir /source "$NATIVE_IMAGE" /bin/bash -euc '
+              /node/bin/node build.mjs
+              /node/bin/node check.mjs
+              PATH= /node/bin/node proof.mjs
+            '
+      - name: Build and verify macOS with Node.js 22
+        if: matrix.platform == 'darwin'
+        run: |
+          node build.mjs
+          node check.mjs
+          native_node="$(command -v node)"
+          PATH= "$native_node" proof.mjs
+      - name: Set up Node.js 20
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "20.0.0"
+      - name: Verify the same Linux artifact with Node.js 20
+        if: matrix.platform == 'linux'
+        run: |
+          docker run --rm \
+            --volume "$PWD:/source:ro" \
+            --volume "$(dirname "$(dirname "$(command -v node)")"):/node:ro" \
+            --workdir /source "$NATIVE_IMAGE" /bin/bash -euc '
+              /node/bin/node check.mjs
+              PATH= /node/bin/node proof.mjs
+            '
+      - name: Verify the same macOS artifact with Node.js 20
+        if: matrix.platform == 'darwin'
+        run: |
+          node check.mjs
+          native_node="$(command -v node)"
+          PATH= "$native_node" proof.mjs
+      - name: Upload verified native artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-${{ matrix.platform }}-${{ matrix.arch }}-${{ github.sha }}
+          path: plugins/codex-security/native/dist/${{ matrix.platform }}-${{ matrix.arch }}/unix.node
+          if-no-files-found: error
+          retention-days: 7

plugins/codex-security/native/.gitignore

@@ -0,0 +1,3 @@
+/target/
+/dist/
+/*.mjs