Add native traffic inspection to Harbor Connect and Gateway

test/deploy/runtime-impact.test.js

@@ -95,6 +95,32 @@ test('classifier covers current dataplane reachability without promoting its cli
   });
 });
 
+test('native traffic contracts and collector restart both Gateway processes', () => {
+  for (const file of [
+    'buf.gen.yaml',
+    'proto/sing-box/v1.14.0-rc.5/daemon/started_service.proto',
+    'src/server/gatewayNativeRuntime.ts',
+    'src/server/generated/daemon/started_service_pb.ts',
+    'src/server/services/liveTrafficService.ts',
+    'src/shared/liveTraffic.ts',
+  ]) {
+    assert.deepEqual(classifyRuntimeImpact([file]), {
+      affectedComponents: ['control', 'dataplane'],
+      restartScope: 'both',
+    }, file);
+  }
+  for (const file of [
+    'tools/test-singbox-client-rc.sh',
+    'tools/test-singbox-gateway-native-traffic.sh',
+    'tools/test-singbox-native-traffic.sh',
+  ]) {
+    assert.deepEqual(classifyRuntimeImpact([file]), {
+      affectedComponents: [],
+      restartScope: 'none',
+    }, file);
+  }
+});
+
 test('version bumps do not promote a control-only change to a dataplane restart', () => {
   assert.deepEqual(classifyRuntimeImpact(['src/web/App.tsx', 'src/shared/versions.ts']), {
     affectedComponents: ['control'],
@@ -118,8 +144,12 @@ test('release-critical inputs restart both and unknown paths fail closed', () =>
   assert.throws(() => classifyRuntimeImpact(['scripts/new-runtime.sh']), /Unclassified path/);
 });
 
-test('every tracked repository path has an explicit ownership class', () => {
-  const tracked = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' })
+test('every repository path has an explicit ownership class', () => {
+  const tracked = execFileSync(
+    'git',
+    ['ls-files', '--cached', '--others', '--exclude-standard'],
+    { cwd: root, encoding: 'utf8' },
+  )
     .trim()
     .split('\n');
   assert.doesNotThrow(() => classifyRuntimeImpact(tracked));