Pin and verify sing-box version across Harbor runtimes

test/install-script.test.js

@@ -49,3 +49,10 @@ test('macOS installer removes stale archive files without deleting local state',
   assert.match(installer, /--exclude='\.runtime'/);
   assert.match(installer, /--exclude='\.git'/);
 });
+
+test('macOS installer refreshes a stale pinned sing-box version', () => {
+  const installer = fs.readFileSync(path.join(root, 'scripts', 'install-macos-client.sh'), 'utf8');
+
+  assert.match(installer, /TARGET_SINGBOX_VERSION="\$\{SINGBOX_VERSION:-1\.13\.18\}"/);
+  assert.match(installer, /set_env_value SINGBOX_VERSION "\$TARGET_SINGBOX_VERSION"/);
+});

test/server/deploy-split.test.js

@@ -26,6 +26,9 @@ test('gateway deploy updates control without recreating dataplane', () => {
   assert.match(workflow, /npm_status=\$\?[\s\S]*! -x node_modules\/\.bin\/tsc[\s\S]*tail -n 200 \/root\/\.npm\/_logs\/\*-debug-0\.log[\s\S]*exit 1/);
   assert.match(workflow, /npm test[\s\S]*Image build and push skipped: no Gateway runtime impact\.[\s\S]*exit 0[\s\S]*docker login/);
   assert.match(workflow, /Image build and push skipped: no Gateway runtime impact\.[\s\S]*exit 0[\s\S]*\.\/scripts\/build-runtime-base\.sh/);
+  assert.match(workflow, /sing-box version \$\{\{ env\.SINGBOX_VERSION \}\}[\s\S]*\.\/scripts\/build-runtime-base\.sh/);
+  assert.match(workflow, /--entrypoint sing-box[\s\S]*grep -Fx "sing-box version \$\{\{ env\.SINGBOX_VERSION \}\}"/);
+  assert.match(workflow, /api\/version[\s\S]*singBox/);
   assert.match(workflow, /Deploy skipped: no Gateway runtime impact\.[\s\S]*exit 0[\s\S]*bash scripts\/deploy-gateway\.sh/);
   assert.doesNotMatch(workflow, /grep -Eq/);
 });