* fix(native): retain Apple dispatch metadata descriptor cleanup ownership
inspect_native_dispatch_metadata opened the target with raw
openRegularFile and closed it in a finally block, so a rejected close
replaced integrity, capacity or cancellation failures and left no owner
to retry. The read now uses the shared owned regular-file operation in a
client resource scope; the physical failure stays the cleanup primary,
client close retries the exact descriptor, and a confirmed release
clears the original error's cleanup uncertainty. Decoding runs after the
descriptor is released.
Fixes#4743
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(verify): give the Apple dispatch verifier an owned file scope
Pass an ArtifactResourceScope to inspectAppleDispatchMetadata and close
it after inspection so a failed descriptor close is retained and retried
rather than reaching an undefined scope.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Carry caller and runtime deadline cancellation through helper cleanup, preserve command-owner reasons and physical failures, and retain collected scenario reports with typed terminal errors.
BREAKING CHANGE: failed or cancelled native UI scenarios now return typed errors with the collected report in partial_observation instead of successful reports containing failed or cancelled steps.
Refs #4227
Join admitted helper work before runtime removal, retain one preparation outcome and root, and bind originating and retry errors to exact runtime release leases with live resources.
Refs #4227
Own journal, capture, result and PID descriptors through confirmed release. Preserve parsed facts and exact cancellation reasons while retaining unresolved children and gating runtime removal on their completion.
Refs #4742
Reuse stable-file hashing and exact cleanup leases for target verification, join admitted call workflows before tracer close, and block replacement work while descriptor cleanup remains unresolved. Preserve physical failures, exact cancellation reasons and completed call facts; remove the duplicate reader and AbortError-name heuristic.
Validate real inert-file cleanup controls and controlled tracers through provider and MCP boundaries. No LLDB execution, real OS close-failure or Windows qualification.
Refs #4740
Bind signature inspection to its named domain result and retain completed facts in typed cancellation. Check cancellation after descriptor and root finalization, preserve exact caller reasons, and keep physical failures primary. Use explicit cancellation checkpoints instead of signal-state guesses.
Validate root and descriptor cleanup, retries, late root handoff, opaque reasons, provider projections, and existing real codesign/CLI controls. No real OS close-failure or Windows qualification.
Refs #4735
Retain roots and descriptors through shared cleanup leases and bind composed errors to their actual pending owners. Successful retries shrink live attribution and reveal the original typed failure.
Validate mixed root and descriptor failures, partial/final release, existing target binding, and real codesign and CLI controls. No real OS close-failure or Windows qualification.
Refs #4734
Use shared owned file operations for plist admission and source probes. Join admitted work during close, retain exact descriptor leases through retries, and preserve physical failures, cancellation reasons and completed converter output.
Validate with controlled cleanup faults and native plist CLI workflows on inert data. Real OS close-failure incidence and Windows behavior remain unverified.
Refs #4723
* fix(native): report unidentified text plists as unknown
Require explicit XML identification in file output instead of treating all
text as XML. Preserve decoded plist values and source-format provenance
when plutil falls back to XML conversion.
Add provider-boundary regressions and real macOS CLI controls for OpenStep,
data-bearing OpenStep, XML, UTF-16 XML and binary property lists.
Fixes#4294
* fix(native): keep XML plists without a declaration labeled xml
`file -b` names XML only when a document declaration is present, so the
narrowed `\bXML\b` check reported a declaration-less XML plist as unknown and
broke the real-plutil `decodes xml plists that plutil cannot express as JSON`
CLI test. When `file` reports only text, read the source head once and label it
XML only when its first non-whitespace character (after a UTF-8 BOM) is `<`;
OpenStep and other text stay unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): distinguish OpenStep data from XML source markup
Recognize XML markup instead of treating every leading angle bracket as XML.
Keep data-only OpenStep sources unknown, honor explicit JSON identification,
and decode BOM-marked UTF-16 prefixes before detecting declarationless XML.
Add source-format regressions and macOS CLI cases for data-only sources.
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(objc): isolate empty Objective-C protocol method selectors
A protocol method_list_t entry whose selector reached an empty string was
appended to objc_protocols and objc_protocol_records unchecked. The final
metadata schema then rejected the whole result, discarding every valid
class, protocol and category.
The protocol method decoder now skips only that entry and reports it as
a protocol failure. The protocol keeps its other method declarations, and
its record is marked partial with protocol_method_selector_empty.
Fixes#4540
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(objc): treat empty local category class names as unresolved
A category whose class reference pointed at a mapped local class with an
empty class_ro_t name took that empty string as class_name. The final
metadata schema then rejected the whole result, discarding every valid
class, protocol and category.
An empty local class name now fails the class reference the same way an
unmapped one does: the category is kept with class_name null,
class_source unresolved and a category_class_unresolved issue, and its
name, methods and protocols survive.
Fixes#4541
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Record cancellation at file checkpoints and before owner handoff. Keep physical hash failures, exact reasons, completed facts and failed-close owners distinct through artifact and provider projections and cleanup retries.
Refs #4598. Validated with 566 passing affected tests and 22 platform skips; final Kuna cleanup reason rerun passed 43 tests. No Android device or real JADX/Kuna execution claimed.
Allow the composed one-shot dispatch workflow to open a covered Mach-O
without selecting a deep provider. The registry still owns selector
precedence; explicit request/environment choices remain binding, while
non-Mach-O and unsupported hosts retain deep symbol fallback. Requested
snapshots keep ordinary binding and profile semantics.
Share runtime composition and target admission with the native byte reader.
Keep target parsing, resource ownership and Evidence on the original session.
Validation: 13 focused files, 192 passed and 2 skipped; npm run check passed.
The six previously blocked native property CLI controls now pass. Ten measured
CLI workflows preserved exact metadata facts; warm raw reply token medians
1344/927, elapsed .475/.547s, CPU .691/.745s, sampled family RSS351.2/359.3MiB
baseline/candidate. Baseline used explicit Ghidra workaround; true cold and
full-agent costs unmeasured. No speed/memory improvement or Windows claim.
Refs #4555
Validate protocol and implementation selectors, ivar names and category
names before publishing records. Share validated local class identity
between class, superclass and category consumers, retaining unresolved
addresses and the decoder's failure reason.
Byte fixtures reproduced the reported validation failures. Final focused
4-file run: 118 passed; npm run check passed. Six existing CLI property
controls remain blocked before decoding by deep-provider auto-selection
ambiguity, as exposed by improved assertion diagnostics (#4555).
No Windows runtime or real malformed-application verification performed.
Refs #4540, #4541, #4533, #4534, #4115, #4555
Refs #4522, #4526, #4555.
Retain producer-owned compiler output and cleanup markers through xcrun
resolution and native failure projection. Keep physical preparation failures
primary and preserve separate command deadline classification for interrupted
preparation. Omitted output facts stay unknown; client close does not resolve
foreign helper cleanup. Include CLI failure output in native regression reports.
Validation: 87 focused tests passed. Broader 140-file run passed 1483 tests,
skipped 109, and exposed three pre-existing deep-provider selection failures
tracked in #4555. Static checks passed. Compiler faults use controlled Node
fixtures; native Swift compiler faults and Windows execution were not verified.
Other command consumers still need preparation-fact propagation.
Refs #4373, #4455, #4457, #4458.
Use canonical artifact ownership in Go, Rust, SQLite and PE readers and their failure consumers. Admit PE read budgets before allocation and ignore zero-extent sections in interval ownership. Close Rust resources through CLI and MCP lifecycles.
* fix(native): report PE input byte budgets as file-size limits
PeResourcesProvider translated every ArtifactReaderFailure with reason
"limit" into a memory resource constraint, so an image above the
caller's max_file_bytes was reported as a memory problem with memory
remediation advice. The bound that was exceeded is the input file's
byte length, which the caller raises with a flag.
Record the constrained bound on the failure the way ElectronFuseReader
already does, declare it at the reader's two input-byte refusals and at
the parser's metadata and entry budgets, and report that bound instead
of assuming memory. Readers that do not declare a boundary are
unchanged.
Fixes#4192
* fix(native): keep caller-selected PE budget refusals actionable
Address review findings on the budget classification:
- withCleanup now forwards the constrained bound, so a file that grows past
its byte limit while its handle also fails to close is still reported as
a file-size refusal rather than a memory one.
- Both caller-selected bounds carry their own remediation, pointing at
max_file_bytes and max_entries instead of the file-size fallback's worker
write-limit advice.
- AnalysisResourceConstraintError can declare that retrying cannot succeed.
The entry budget is deterministic for the same file and limit, so it no
longer inherits admission capacity's retryable behaviour.
The projection falls back to the previous resource-kind rule when a caller
does not declare retryability, so other capacity refusals are unchanged.
* fix(native): preserve budget retryability and name the schema ceiling
Address the remaining review findings on the budget classification:
- Failure redaction and the caller-copy path rebuilt resource constraint
errors without forwarding retryable, so a deterministic capacity refusal
projected as retryable again and automated callers could loop on it.
Both constructors now forward the declared boolean.
- Both remediations recommended raising a bound the caller had already
set to the schema maximum. The maxima are now named constants shared
with the schema, and the remediation names the operation's hard ceiling
when the caller is already at it.
* fix(native): reject empty Swift class vtable owner before slot insertion
Throw an explicit RangeError within the descriptor recovery block when a Swift class vtable descriptor class name is empty. This prevents emitting malformed slots that fail final schema validation, allowing partial coverage and valid sibling descriptors to be preserved. Fixes#4369
* test(native): verify decoding continues for valid Swift vtable siblings after a malformed descriptor
Both resource-interval overlap predicates in PeResourceLayout used strict
endpoint inequalities without an extent or point ownership rule, so a
section with VirtualSize=0 and SizeOfRawData=0 inside a resource interval
was rejected as overlapping virtual sections, and the same empty section
inside a header-backed payload was rejected as ambiguous header mapping.
An empty payload at an RVA that starts a positive-extent section below
SizeOfHeaders silently resolved to the header offset even though that
section owns the point.
Normalize intersection once at the owning mapper: a section without
virtual extent owns no byte and never conflicts; an empty resource owns
exactly its start point, so a positive-extent section starting there
conflicts with header-backed ownership and keeps the existing
ambiguous-mapping failure. Positive-extent overlap rejection is
unchanged.
Fixes#4455Fixes#4373
Co-authored-by: maxazure <maxazure@gmail.com>
Fixes#4011.
Normalize exec-aware worker ownership at the shared pwntools decoder boundary. Preserve parent, process-group and run-token checks, explicit command pins, partial observations, and retryable cleanup.
Validated with real Linux pwntools/GDB/pwndbg CLI/MCP workflows, native-exec cancellation and foreign-token controls.
Recognize known undecoded producer spellings without treating them as successful demangles. Preserve actual producer output and derive symbol types from the domain contract instead of duplicating its validation schema.
Compare retained output with the real demangler through MCP, while preserving CLI malformed-input and line-ending coverage.
Refs: #4215, #4287
Co-authored-by: Vinícius DS Andrade <95101505+viniciusdsandrade@users.noreply.github.com>
Carry the selected slice name and the existing tool owner's dwarfdump spelling separately. Compare observed row labels exactly, preserving explicit ABI versions and uncertainty for missing rows.
Correct the production-boundary fixture and retain wrong-version and mixed-row controls. Real Apple multi-version selection behavior remains unverified.
Refs: #4195, #4288
Co-authored-by: Henglie <ebhenglie@gmail.com>
* fix(cleanup): preserve owner recovery instructions
Keep cleanup remediation through combined errors and direct or managed one-shot analysis while retaining primary diagnostics.
Refs: #4227
* fix(hopper): recover late startup and retained cleanup
Authenticate initial and cleanup handshakes through the same identity owner. Expose startup and cleanup activity, retain health after target retirement, and expire abandoned unauthenticated listeners without timing out authenticated work.
Refs: #4227
* fix(providers): retain composite lifecycle facts across retries
Preserve observed child health with incomplete peer coverage, retry only unresolved clients, and retain all child cleanup recovery actions.
Refs: #4233
* fix(process): honor cancellation through capture cleanup
Check the request signal after cleanup and before final publication, retaining completed observations under typed cancellation.
Refs: #4005
* fix(native): preserve failed LLDB launch ownership and exit proof
Publish failed-launch process identity and observed exit separately from object validity. Retire only the exact owned process and retain uncertainty when exit cannot be established.
Refs: #4232
* fix(native): honor cancellation after trace finalization
Check cancellation after runtime-root cleanup and retain collected trace observations as partial cancellation evidence.
Refs: #4009
* fix(cli): preserve analysis results when provider cleanup fails
Reuse the existing one-shot finalizer across thirteen command families to retain completed Evidence and primary diagnostics on close failure. Cover success, denied cleanup, and combined primary/cleanup failure through the public CLI.
Refs: #3935
* docs(lifecycle): define completion invariants and regression scenarios
Document distinct ownership/readiness/exit facts, late cancellation and atomic publication boundaries, partial child cleanup, and diagnostic retention. Link representative regressions and route contributor guidance through AGENTS.md.
Refs: #4227
* fix(session): retain run identity through pending cleanup
* fix(cli): preserve original cleanup resource diagnostics
* fix(native): retain completed facts through finalization failure
* fix(providers): report retained cleanup paths at their owners
Map a zero-byte payload at a section endpoint only when no section contains that RVA, preserving adjacent-section ownership and raw backing checks. Extend the real CLI and stdio MCP workflow across PE32/PE32+ empty and nonempty resources.
The portable parser and public adapter regressions ran locally; Windows API loader behavior and GNU-produced images were not independently rerun.
Refs #3970
Co-authored-by: Gabriel Dias <gabrieldiasnevess@outlook.com>
Consume signed and unsigned LEB operands through their terminators while validating 64-bit payloads and bounded extension. Preserve independent decoded metadata when a malformed stream fails.
Co-authored-by: Arjun Prabhulal <arjun.prabhulal@gmail.com>
An Objective-C category whose nonzero class reference pointed outside
mapped metadata failed as a whole, discarding its readable name, method
selectors and implementations. The category decoder now resolves the
local class name in its own boundary: on failure the category keeps its
facts with class_name null and class_source unresolved, and a
category_class_unresolved issue records the unreadable reference in the
category coverage.
Fixes#4012
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): record an empty Objective-C protocol name as a protocol failure
A protocol declaration whose name was an empty NUL-terminated string was
accepted as decoded, so whole-result validation of objc_protocols[].name
failed and inspect-native-dispatch-metadata discarded every decoded
class from the same image. The protocol decoder now rejects the empty
name inside its per-protocol boundary, as the class decoder already
does, so the protocol becomes a recorded partial-coverage failure and
independently decoded classes are retained.
Fixes#3873
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): decode adopted protocols before rejecting an empty parent name
Review follow-up. The empty-name check ran before the adopted-protocol
list was traversed, so a protocol declared only through an empty-named
parent's list was dropped. Adopted protocols are independent
declarations; traverse the list first, then reject only the parent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect-macho projected an empty Mach-O segment or section name as the
display label "unknown", so an exhaustive segment inventory for an
ordinary MH_OBJECT reported a segment literally named "unknown" while
the raw LC_SEGMENT_64 field showed "". Object files place every section
in one unnamed segment, so the empty name is a source value. Segment and
section names are now reported exactly as observed.
Fixes#3875
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect-macho listed the LC_ID_DYLIB command of a dylib as a dependency,
so every dylib reported a self-dependency and an inflated exhaustive
count, while trace-dylib-resolution correctly treats that name as the
image identity. The dependency collector now skips LC_ID_DYLIB; the
command, with its install name, remains in the raw load commands.
Fixes#3872
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
`inspect-macho` stored each `otool -l` row in a flat record, so a key
printed more than once kept only its last value. A two-string
LC_LINKER_OPTION lost `-framework` and kept `#2 Foundation`, and a
multi-tool LC_BUILD_VERSION kept only its last tool, while the
collection still claimed exhaustive coverage.
Linker-option strings are now keyed by otool's own `string #n` label
with the exact option text and must match the declared count. Any other
repeated key is labeled `key #n` in print order. Dylib encoding checks
read the parsed rows, so repeated `options` rows are still rejected.
Fixes#4008
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): retain valid Objective-C properties beside a malformed record
readObjcPropertyList decoded a whole property_list_t in one operation.
When a later entry's name pointer was unmapped, the list-level catch
discarded the properties already decoded. An empty property name passed
decoding and then failed schema validation of the whole result, so
inspect-native-dispatch-metadata exited 1 with no metadata.
Each property_t entry is now decoded on its own. A failing entry, or an
empty name, becomes a property_decode_failed issue at the entry address,
and sibling properties are retained. Incomplete-attribute issues also
report their entry address. List-header failures still fail only that
list.
Fixes#3336
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(native): cover property record isolation on every platform
Move the synthetic Objective-C property Mach-O into a shared fixture and
decode it through decodeAppleDispatchMetadata in a portable test, so
Linux and Windows runs also catch a regression that drops valid sibling
properties. The macOS CLI cases keep exercising the built command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
An Objective-C property attribute string whose quoted class name never
closes, such as T@"NSString, was treated as complete. The missing N and
R were then read as the Objective-C defaults, so the property was reported
atomic and read-write, and objc_properties_categories coverage stayed
complete. The documented semantics require null flags for incomplete
attribute metadata.
The attribute splitter now reports whether every quote closed. An
incomplete string leaves atomicity and any unestablished read-only value
null, while explicit N or R tokens remain established and the raw type is
preserved. Each affected property adds a property_attributes_incomplete
issue, which marks the facet partial.
Fixes#3345
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
plutil writes years past 9999 and negative years in a form the pinned
XML decoder cannot parse, and binary plists can hold dates outside the
JavaScript Date range. The decoder returns an Invalid Date. Its
projection's toISOString() call then threw, so inspect_plist failed the
whole plist as "unreadable_output" with a `rea doctor` remediation.
Keyed archive inspection and Interface Builder decoding rejected the
archive in the same way.
projectPlistValue, the shared projection, now reports such a date as
{ "$plist_type": "date", "iso8601": null } and counts it. inspect_plist,
keyed archive inspection and Interface Builder decoding each add a
counted limitation, as they already do for non-finite reals.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect_plist rooted every file target at the file's own directory, so a
program file under App.app/Contents/MacOS defaulted to
Contents/MacOS/Contents/Info.plist and --relative-path resolved from MacOS/
instead of the app root the CLI documents. A selected plist file likewise
looked for <dir>/Contents/Info.plist instead of reading itself.
A program file directly under a bundle's Contents/MacOS now roots at that
bundle, and a plist artifact target is its own default plist. The missing
default message names the default plist rather than Contents/Info.plist.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
inspect_macho passed the CPU-family spelling (`arm64e`) for every dotted lipo
slice name to otool, nm, dwarfdump and vtool. That is right for the
pointer-auth ABI version suffix (`arm64e.v1`), but `arm64e.x1` is a distinct
subtype: on a universal x86_64 + arm64e.x1 executable otool failed with
"does not contain architecture: arm64e" and the whole inspection failed.
Strip only the `.v<N>` ABI version suffix and pass other variant names
exactly. vtool has no spelling for a variant subtype, so skip it for such
slices and report that build metadata comes from otool only.
Fixes#3389
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Emit explicit target-creation facts only when known. Invalid post-launch process handles remain unknown and retain cleanup ownership.
Refs: #3185
Validation uses bridge fakes and provider-boundary tests; no real LLDB target launch was performed.
Carry the concrete configuration and admission reason through the typed provider-selection error to CLI callers.
Fixes#3055.
Reviewed-PR: #3087
Co-authored-by: 1052326311 <65798732+1052326311@users.noreply.github.com>
* perf(native): skip llvm-nm's dyld-info pass when the symbol table names every export
inspect_macho ran `nm -gjU`, whose default dyld-info pass takes seconds on
large apps (Keynote arm64 5.8 s, x86_64 10.2 s) yet under -gU can only add
export-trie names that dyld_info -exports already reports. Run
`nm -gjU --no-dyldinfo` and rerun the default pass only when dyld_info
reports an export the symbol table lacks (e.g. strip -T), so its exact
names still disambiguate dyld_info rows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): fall back to nm's dyld-info pass for unreadable export rows
Account for every dyld_info export line instead of only the rows the
parser returns, so an unfamiliar row format reruns the default nm pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Apply dyld modulo-64 address arithmetic at the shared bind advance, retaining subsequent bindings after a negative ULEB skip.
Validation: all 37 Mach-O fixup tests pass, including continuation and false-failure controls.
Based on #3138.
Co-authored-by: Dragolone <810170966qq@gmail.com>
Use one upstream Swift mangling prefix owner for demangler status and metadata projection/counts. Keep visible legacy class names and nominal-category decoding semantics distinct.
Validation: metadata prefix, negative symbol and partial decode regressions pass; existing Mach-O controls pass.
Based on #3157.
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
* fix(native): derive Mach-O word size and byte order from the selected slice
inspect_macho read endian and word_size from `file -b` for the whole
file. macOS `file` never prints a Mach-O byte order, so endian was null
for every target. For a universal binary, word_size matched "64-bit"
anywhere in the summary instead of describing the selected slice, and it
was null for a thin 32-bit slice.
Both now come from the selected slice's otool header: the magic gives
the word size and the CPU family gives the byte order (x86 and ARM
little, PowerPC big, other families unknown). The file capture is no
longer needed by inspect_macho, so it is no longer run there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(native): select a 32-bit slice beside a 64-bit slice through inspect_macho
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): classify every Swift mangling prefix as invalid when undecodable
demangle_swift reported "invalid" only for $s and _$s inputs that
swift-demangle left unchanged. Undecodable symbols carrying the other
prefixes the Swift demangler accepts (_T0, $S, _$S, @__swiftmacro_, $e,
_$e) were reported as "unchanged", i.e. as non-Swift names. Legacy _T
stays "unchanged" because it is also an ordinary C symbol spelling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(native): expect only toolchain-portable Swift manglings to demangle
The macOS 15 runner's swift-demangle predates Embedded Swift, so valid
$e symbols stay unchanged there. Keep $e and _$e in the undecodable
half only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): parse renamed dyld_info re-exports
dyld_info prints a re-export whose name differs from the source library's
symbol as `[re-export] _foo_renamed (_foo from libfoo)`. The export parser
only accepted `(from libfoo)`, so inspect_macho reported a nonexistent
export named `_foo_renamed (_foo from libfoo)` with no source, and the nm
row for `_foo_renamed` survived the name-based merge as a second export
with reexport null.
Accept the optional source symbol, trying the plain `(from lib)` form
first so a library name containing ` from ` keeps its text. The row now
reports `_foo_renamed` re-exported from libfoo and replaces the nm
duplicate. The export schema has no field for the source symbol name, so
exports coverage records a limitation when a renamed re-export is present.
The golden fixture is a dyld_info capture of a synthetic dylib linked with
-Wl,-alias,_foo,_foo_renamed.
* fix(native): split dyld re-export suffix without nested quantifiers
Replace the (?:(.+?)\s+)??from lazy-optional group with a linear string
scan so malformed lines cannot backtrack and a library path containing
" from " still keeps its whole text via the plain-form-first check.
* test(native): cover nested re-export library names
* fix(native): retain reexports missing from nm inventory
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: morluto <17176810+morluto@users.noreply.github.com>
* fix(native): bound captured output carried by native command failures
The native command runner retains up to 64 MiB of output because
successful analysis needs it complete, and failureCapture copied all of
it into the failure. An inspect_plist whose plutil output exceeded the
budget therefore returned a 67 MB resource_constraint error whose
details.captured_output.stdout repeated the whole retained output.
Keep a 64 KiB UTF-8-safe excerpt per stream in failure diagnostics,
mark them truncated, and keep the observed stdout/stderr byte totals.
Successful captures are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): bound codesign failures and cover excerpt cuts
translateCodeSignExitFailure wrapped an accepted nonzero codesign capture
into a NativeCommandFailure by copying both complete streams, so
inspect_signature failures still bypassed the diagnostic bound. Route it
through the shared failureCapture builder; accepted output stays
complete until the provider decides it is a failure.
Add a focused runner test for an ordinary nonzero exit with stdout and
stderr just above the excerpt size and a two-byte character straddling
the cut, and a provider test for the codesign path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(native): build excerpt test output inside the child process
The output strings embedded in one node -e argument totalled about 133
KB, above Linux's 128 KiB per-argument limit, so spawn failed with E2BIG
on the CI runner. Generate the repeated output in the child instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): refuse inspect_signature on non-Mach-O targets
This provider's signature inspection covers Mach-O code signatures only.
On a xar pkg, codesign's "code object is not signed" verdict cannot see
the archive-level signature layer, so a signed or invalidly-signed package
was reported as signed:false with "Artifact is not signed." Match the
existing inspect_macho/list_architectures gate and report
capability_unavailable instead of an unsigned claim for a layer that was
never evaluated.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* test(native): scope the signature-gate comment to this provider
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(native): align signature capability discovery with Mach-O support
Bind inspect_signature availability to Mach-O targets in capability discovery and align the public tool description.
Source inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request.
---------
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
