Use zip.js's parsed symlink fact for inventory and open refusal. Treat an
unmatched Godot trailer as an unconfirmed candidate while preserving failures
for confirmed malformed packs. Report entropy path-resolution failures at the
selected-input boundary.
Separate Go header discovery from inline string extents in ELF and Mach-O,
and apply the aggregate content allowance after validating real source ranges.
Normalize binary plist UID widths through the existing scalar-copy owner,
budget exact clone growth, preserve source identity, and refuse inexact UIDs.
Validation: 389 distinct tests passed, one Linux /proc test skipped on Darwin;
build, typecheck/lint, docs, single-thread formatting, and discovery (2142 files)
passed. CLI/MCP Go fixtures and public ZIP/Godot/keyed-archive workflows ran.
Real producer prevalence and external provider execution were not established.
Repeated ordinary keyed-archive CLI inventory facts and estimated reply tokens
were equal before/after. Warm median elapsed was 0.5166s / 0.5177s; no speed claim.
Fixes#6751Fixes#6763Fixes#6754Fixes#6767Fixes#6762Fixes#6779
Exclude processing-instruction nodes at the shared container-member owner
before dispatching plist tags. Keep strict syntax validation and scalar
content rules, with app-resolution and CLI/MCP evidence regressions.
Adapted from Mangolycheematcha's PR #4965, including its boundary controls.
Added built CLI/MCP coverage and verified container fixtures with plutil.
Fixes#4964
Co-authored-by: Mangolycheematcha <288892596+Mangolycheematcha@users.noreply.github.com>
Validate the canonical programs directory before resolving its executable, preserving containment failures even when the external child is missing. Retain in-bundle directory and bundle aliases.
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
* fix(targets): compare the Info.plist bplist prefix without ASCII folding
The six-byte prefix check used an encoding that maps high-bit bytes onto bplist, so a non-binary property list could be sent to the binary decoder.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(targets): satisfy the strict index check in the plist prefix test
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
morluto