feat: complete WorkBuddy parity and Windows release workflow

scripts/conversation-runtime-regression.ts

@@ -13,11 +13,13 @@ import type { ChatEvent, ChatMessage } from '../src/shared/types'
 import type { ChatInteraction } from '../src/shared/conversation'
 import type { OmpKernel } from '../src/main/omp'
 import { assistantWireHistory } from '../src/main/agent/history'
+import { configureSandbox } from '../src/main/sandbox/configuration'
 
 async function main() {
   const directory = await mkdtemp(join(tmpdir(), 'ycode-conversation-runtime-'))
   const workspace = join(directory, 'workspace')
   await mkdir(workspace)
+  configureSandbox({ stateRoot: join(directory, 'sandbox-state'), resourceDirectory: join(directory, 'missing-sandbox-backend') })
   try {
     const events: ChatEvent[] = []
     const emitted = new EventEmitter()
@@ -56,7 +58,9 @@ async function main() {
     await symlink(outside, join(workspace, 'linked'), process.platform === 'win32' ? 'junction' : 'dir')
     assert.equal((await executeConversationTool('read_file', { path: 'linked/secret.txt' }, context)).ok, false)
     assert.equal((await executeConversationTool('write_file', { path: '../outside/deep/new.txt', content: 'x' }, context)).ok, false)
-    assert.equal((await executeConversationTool('execute_command', { command: 'echo SHOULD_NOT_RUN' }, context)).ok, false)
+    const unavailableCommand = await executeConversationTool('execute_command', { command: 'echo SHOULD_NOT_RUN' }, context)
+    assert.equal(unavailableCommand.ok, false, 'a missing native backend must fail closed')
+    assert.match(unavailableCommand.content, /ENOENT|原生组件/)
     const fullController = new AbortController()
     const childScript = join(directory, 'child.cjs')
     const parentScript = join(directory, 'parent.cjs')
@@ -155,7 +159,8 @@ async function main() {
     const hostKernel = new HostKernel()
     const native = await runOmpTurn({ runId: 'native', kernel: hostKernel as unknown as OmpKernel, workspaceRoot: workspace, userText: 'read', signal: controller.signal, emit })
     assert.equal(native.content, 'Native host complete')
-    assert.equal(hostKernel.definitions.length, 8)
+    assert.equal(hostKernel.definitions.length, 9)
+    assert.ok(hostKernel.definitions.some(tool => tool.name === 'browser'), 'native host registers the browser tool')
     assert.equal(native.tools[0].status, 'ok')
     assert.equal((native.tools[0].result as { path: string }).path, join(workspace, 'a.txt'))
     assert.equal(hostKernel.listenerCount('event'), 0)