fix(build): validate packaged spawn helpers

python/sdk/tests/test_release_version.py

@@ -16,6 +16,18 @@ SCRIPT = ROOT / "scripts" / "build-python-release.py"
 build_python_release = SimpleNamespace(**runpy.run_path(str(SCRIPT)))
 
 
+def helper_header(target: str) -> bytes:
+    header = bytearray(20)
+    if target.startswith("linux-"):
+        header[:6] = b"\x7fELF\x02\x01"
+        machine = 62 if target == "linux-x64" else 183
+        header[18:20] = machine.to_bytes(2, "little")
+    else:
+        header[:4] = b"\xcf\xfa\xed\xfe"
+        header[4:8] = (0x0100000C).to_bytes(4, "little")
+    return bytes(header)
+
+
 def test_repository_version_matches_root_package_json() -> None:
     expected = json.loads((ROOT / "package.json").read_text())["version"]
 
@@ -45,7 +57,7 @@ def test_stage_runtime_copies_executable_and_spawn_helper(tmp_path: Path) -> Non
     executable.write_bytes(b"runtime")
     executable.chmod(0o755)
     spawn_helper = Path(f"{executable}-spawn-helper")
-    spawn_helper.write_bytes(b"helper")
+    spawn_helper.write_bytes(helper_header("macos-arm64"))
     spawn_helper.chmod(0o751)
     destination = tmp_path / "staging"
 
@@ -59,7 +71,7 @@ def test_stage_runtime_copies_executable_and_spawn_helper(tmp_path: Path) -> Non
     runtime_dir = destination / "src" / "deepseek_harness_runtime" / "runtime"
     assert (runtime_dir / executable.name).read_bytes() == b"runtime"
     copied_helper = runtime_dir / spawn_helper.name
-    assert copied_helper.read_bytes() == b"helper"
+    assert copied_helper.read_bytes() == helper_header("macos-arm64")
     assert copied_helper.stat().st_mode & stat.S_IXUSR
 
 
@@ -75,3 +87,42 @@ def test_stage_runtime_rejects_missing_spawn_helper(tmp_path: Path) -> None:
             executable,
             executable.name,
         )
+
+
+@pytest.mark.parametrize("target", ["linux-x64", "linux-arm64", "macos-arm64"])
+def test_spawn_helper_binary_target(target: str) -> None:
+    assert build_python_release.spawn_helper_binary_target(helper_header(target)) == target
+
+
+def test_stage_runtime_rejects_mismatched_spawn_helper(tmp_path: Path) -> None:
+    executable = tmp_path / "dsh-jsonrpc-agent-pkg-linux-x64"
+    executable.write_bytes(b"runtime")
+    executable.chmod(0o755)
+    spawn_helper = Path(f"{executable}-spawn-helper")
+    spawn_helper.write_bytes(helper_header("linux-arm64"))
+    spawn_helper.chmod(0o755)
+
+    with pytest.raises(ValueError, match="expected linux-x64, found linux-arm64"):
+        build_python_release.stage_runtime(
+            tmp_path / "staging",
+            "1.2.3",
+            executable,
+            executable.name,
+        )
+
+
+def test_stage_runtime_rejects_non_binary_spawn_helper(tmp_path: Path) -> None:
+    executable = tmp_path / "dsh-jsonrpc-agent-pkg-macos-arm64"
+    executable.write_bytes(b"runtime")
+    executable.chmod(0o755)
+    spawn_helper = Path(f"{executable}-spawn-helper")
+    spawn_helper.write_bytes(b"helper")
+    spawn_helper.chmod(0o755)
+
+    with pytest.raises(ValueError, match="unsupported format or architecture"):
+        build_python_release.stage_runtime(
+            tmp_path / "staging",
+            "1.2.3",
+            executable,
+            executable.name,
+        )