Exclude processing-instruction nodes at the shared container-member owner
before dispatching plist tags. Keep strict syntax validation and scalar
content rules, with app-resolution and CLI/MCP evidence regressions.
Adapted from Mangolycheematcha's PR #4965, including its boundary controls.
Added built CLI/MCP coverage and verified container fixtures with plutil.
Fixes#4964
Co-authored-by: Mangolycheematcha <288892596+Mangolycheematcha@users.noreply.github.com>
Validate the canonical programs directory before resolving its executable, preserving containment failures even when the external child is missing. Retain in-bundle directory and bundle aliases.
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
* fix(targets): compare the Info.plist bplist prefix without ASCII folding
The six-byte prefix check used an encoding that maps high-bit bytes onto bplist, so a non-binary property list could be sent to the binary decoder.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(targets): satisfy the strict index check in the plist prefix test
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
