fix(native): normalize otool line endings and strip plist JSON BOM (#533)

src/native/parsers/otool.ts

@@ -44,8 +44,19 @@ interface ParsedLoadCommands {
   readonly flags: Set<string>;
 }
 
+/**
+ * otool emits LF, but a capture replayed from another host or toolchain can
+ * carry CRLF. The section/command boundaries below match a bare `\n`, so a
+ * stray `\r` would swallow the terminator and silently empty `sections` while
+ * leaking section fields into the command. Normalizing once at the boundary
+ * keeps every parser below working on one line ending.
+ */
+const normalizeLineEndings = (output: string): string =>
+  output.replaceAll("\r\n", "\n");
+
 /** Parse stable fields from `otool -l`, preserving unknown command fields. */
-export const parseOtoolLoadCommands = (output: string) => {
+export const parseOtoolLoadCommands = (raw: string) => {
+  const output = normalizeLineEndings(raw);
   const headerTokens = parseHeaderTokens(output);
   const state = createLoadCommandState(headerTokens);
   for (const block of output.split(/(?=Load command \d+)/u))

src/native/parsers/plist.ts

@@ -4,7 +4,8 @@ const plistObject = z.record(z.string(), z.unknown());
 
 /** Parse plutil JSON output and project stable bundle metadata. */
 export const parsePlistJson = (output: string) => {
-  const value: unknown = JSON.parse(output);
+  // plutil output can carry a UTF-8 BOM, which JSON.parse rejects outright.
+  const value: unknown = JSON.parse(output.replace(/^\uFEFF/u, ""));
   const object = plistObject.safeParse(value);
   const field = (name: string): string | null => {
     if (!object.success) return null;