@taliesinb/mash 0.0.0-stage → 0.1.0

package/src/behaviors/defs/macos.ts

@@ -0,0 +1,426 @@
+/**
+ * Behavior definitions for macOS system tools (most also describe their BSD
+ * or Linux namesakes well enough): preferences and property lists, launchd,
+ * code signing, network configuration, Spotlight, disk images, diagnostics.
+ *
+ * Query forms are modeled precisely; forms that change system state the
+ * policy has no vocabulary for (network settings, services, firewall) are
+ * `unknown` with `complete: false`.
+ */
+
+import type { AValue } from '../../analysis/value.ts'
+import { concat, concrete, hole, known, knownPrefix } from '../../analysis/value.ts'
+import type { Effect } from '../../policy/effects.ts'
+import { define, type Def } from '../dsl.ts'
+import type { Behavior, BehaviorHelpers, Invocation } from '../types.ts'
+
+const args = (inv: Invocation): AValue[] => inv.argv.slice(1)
+const isDash = (v: AValue): boolean => concrete(v) === '-'
+
+const QUERY: Def = { anyFlags: true, operands: 'arg*', stdin: false }
+const opaque = (detail: string): Def => ({ anyFlags: true, operands: 'arg*', opaque: detail, stdin: 'maybe' })
+
+/** Commands that only print system information. */
+function info(names: string[], summary: string): Behavior {
+  return { names, summary, analyze: () => ({ effects: [], readsStdin: false }) }
+}
+
+/** A tool whose first word decides: query words are read-only, others change system state. */
+function queryOrChange(names: string[], summary: string, query: RegExp, change: string): Behavior {
+  return {
+    names,
+    summary,
+    analyze(inv, h) {
+      const a = args(inv)
+      const first = a.find((x) => knownPrefix(x) !== '' && !/^-(n|v|q)$/.test(concrete(x) ?? ''))
+      const w = first === undefined ? '' : concrete(first)
+      if (w === undefined) return { effects: [{ kind: 'unknown', detail: `${inv.name} with unknown arguments` }], readsStdin: false, complete: false }
+      if (first && /^[a-z]/.test(w)) h.role(first, 'subcommand')
+      if (query.test(w)) return { effects: [], readsStdin: false }
+      return { effects: [{ kind: 'unknown', detail: `${inv.name} ${w}: ${change}` }], readsStdin: false, complete: false }
+    },
+  }
+}
+
+const home = (h: BehaviorHelpers, rest: string): AValue => concat(h.home() ?? known('~'), known(rest))
+
+// ---------------------------------------------------------------------------
+// preferences and property lists
+// ---------------------------------------------------------------------------
+
+/** defaults [-currentHost | -host H] VERB [DOMAIN] …; a domain may be a plist path. */
+const defaults: Behavior = {
+  names: ['defaults'],
+  summary: 'user preferences',
+  analyze(inv, h) {
+    const a = [...args(inv)]
+    while (a.length > 0 && /^-(currentHost|host)$/.test(concrete(a[0]) ?? '')) a.splice(0, concrete(a[0]) === '-host' ? 2 : 1)
+    const verb = concrete(a[0] ?? known('')) ?? '?'
+    if (a[0]) h.role(a[0], 'subcommand')
+    const rest = a.slice(1).filter((x) => !/^-(g|globalDomain|app)$/.test(concrete(x) ?? ''))
+    const domain = rest[0]
+    const prefs = home(h, '/Library/Preferences')
+    // a domain given as a path names that plist (without .plist)
+    const target = (): AValue => {
+      if (!domain || !/^[/~.]/.test(knownPrefix(domain))) return prefs
+      const s = concrete(domain)
+      return s !== undefined && !s.endsWith('.plist') ? h.resolve(known(s + '.plist')) : h.resolve(domain)
+    }
+    const isPrefs = (v: AValue): boolean => v === prefs
+    if (/^(read|read-type|find|domains|help)$/.test(verb)) {
+      const t = target()
+      return { effects: [{ kind: 'read', path: t, ...(isPrefs(t) ? { recursive: true } : {}) }], readsStdin: false }
+    }
+    if (verb === 'export') {
+      const t = target()
+      const out = rest[1]
+      const effects: Effect[] = [{ kind: 'read', path: t, ...(isPrefs(t) ? { recursive: true } : {}) }]
+      if (out && !isDash(out)) effects.push({ kind: 'write', path: h.resolve(out) })
+      return { effects, readsStdin: false }
+    }
+    if (/^(write|delete|rename|import)$/.test(verb)) {
+      const t = target()
+      const effects: Effect[] = [{ kind: 'write', path: t, ...(isPrefs(t) ? { recursive: true } : {}) }]
+      if (verb === 'import' && rest[1]) {
+        if (isDash(rest[1])) return { effects, readsStdin: true }
+        effects.push({ kind: 'read', path: h.resolve(rest[1]) })
+      }
+      return { effects, readsStdin: false }
+    }
+    return { effects: [{ kind: 'unknown', detail: `defaults ${verb}` }], readsStdin: false, complete: false }
+  },
+}
+
+/** plutil: -p/-lint/-type read; -convert/-extract/-insert/-replace/-remove rewrite in place unless -o. */
+const PLUTIL_MODES: Record<string, number> = { '-p': 0, '-lint': 0, '-help': 0, '-type': 1, '-convert': 1, '-extract': 2, '-insert': 3, '-replace': 3, '-remove': 1, '-create': 1 }
+const plutil: Behavior = {
+  names: ['plutil'],
+  summary: 'property list utility',
+  analyze(inv, h) {
+    const a = args(inv)
+    let mode = '-lint'
+    let out: AValue | undefined
+    let ext: AValue | undefined
+    const files: AValue[] = []
+    let complete = true
+    for (let i = 0; i < a.length; i++) {
+      const s = concrete(a[i])
+      if (s === undefined) {
+        files.push(a[i])
+        continue
+      }
+      if (s in PLUTIL_MODES) {
+        mode = s
+        // `-insert KEY -TYPE VALUE`, `-extract KEYPATH FMT`, `-convert FMT`
+        i += PLUTIL_MODES[s]
+        continue
+      }
+      if (s === '-o') out = a[++i]
+      else if (s === '-e') ext = a[++i]
+      else if (s === '-s' || s === '-r' || s === '-n' || s === '--' || s === '-x' || s === '-json' || s === '-xml1' || s === '-binary1' || s === '-raw' || s === '-expect') {
+        if (s === '-expect') i++
+      } else if (s.startsWith('-') && s !== '-') complete = false
+      else files.push(a[i])
+    }
+    const effects: Effect[] = []
+    let readsStdin = false
+    for (const f of files) {
+      if (isDash(f)) readsStdin = true
+      else effects.push({ kind: 'read', path: h.resolve(f) })
+    }
+    if (!['-p', '-lint', '-help', '-type'].includes(mode)) {
+      if (out) {
+        if (!isDash(out)) effects.push({ kind: 'write', path: h.resolve(out) })
+      } else if (ext) {
+        for (const f of files) if (!isDash(f)) effects.push({ kind: 'write', path: concat(h.resolve(f), known('.'), ext) })
+      } else for (const f of files) if (!isDash(f)) effects.push({ kind: 'write', path: h.resolve(f) })
+    }
+    return { effects, readsStdin, complete }
+  },
+}
+
+/** PlistBuddy [-x] [-c CMD]... FILE */
+const plistBuddy: Behavior = {
+  names: ['PlistBuddy'],
+  summary: 'edit property lists',
+  analyze(inv, h) {
+    const a = args(inv)
+    const cmds: AValue[] = []
+    let file: AValue | undefined
+    for (let i = 0; i < a.length; i++) {
+      const s = concrete(a[i])
+      if (s === '-c') {
+        if (a[i + 1]) h.role(a[i + 1], 'code')
+        cmds.push(a[++i])
+      } else if (s === '-x' || s === '-h') continue
+      else file = a[i]
+    }
+    if (!file) return { effects: [], readsStdin: false }
+    const path = h.resolve(file)
+    if (cmds.length === 0) return { effects: [{ kind: 'read', path }, { kind: 'write', path, maybe: true }, { kind: 'unknown', detail: 'interactive PlistBuddy commands' }], readsStdin: true, complete: false }
+    const effects: Effect[] = [{ kind: 'read', path }]
+    let complete = true
+    let writes = false
+    for (const c of cmds) {
+      const t = c ? concrete(c) : undefined
+      if (t === undefined) {
+        complete = false
+        writes = true
+        continue
+      }
+      const verb = t.trim().split(/\s+/)[0]?.toLowerCase() ?? ''
+      if (verb === 'print' || verb === 'help' || verb === 'exit') continue
+      if (verb === 'merge' || verb === 'import') complete = false // reads another file
+      writes = true
+    }
+    if (writes) effects.push({ kind: 'write', path, ...(complete ? {} : { maybe: true }) })
+    return { effects, readsStdin: false, complete }
+  },
+}
+
+// ---------------------------------------------------------------------------
+// launchd, Xcode, signing
+// ---------------------------------------------------------------------------
+
+const launchctl = queryOrChange(['launchctl'], 'launchd services',
+  /^(print|print-cache|print-disabled|list|blame|procinfo|hostinfo|examine|dumpstate|dumpjpcategory|managerpid|manageruid|managername|getenv|version|help|error|resolveport|plist)$/, 'starts, stops or configures services')
+
+const xcodeSelect = define({
+  names: ['xcode-select'], summary: 'active developer directory',
+  spec: { short: 'hpvr', shortWithArg: 's', long: { help: false, 'print-path': false, version: false, switch: '=s', reset: '=r', install: false } },
+  stdin: false, stdout: { type: 'path' },
+  when: { 's|r|install': { opaque: 'xcode-select changes the developer directory or installs tools' } },
+})
+
+/** xcrun [--sdk X] [--toolchain X] TOOL ARGS… | --find TOOL | --show-sdk-*. */
+const xcrun: Behavior = {
+  names: ['xcrun'],
+  summary: 'run or locate developer tools',
+  analyze(inv, h) {
+    const a = args(inv)
+    let i = 0
+    for (; i < a.length; i++) {
+      const s = concrete(a[i])
+      if (s === undefined) return { effects: [{ kind: 'unknown', detail: 'xcrun with unknown arguments' }], readsStdin: 'maybe', complete: false }
+      if (s === '--sdk' || s === '-sdk' || s === '--toolchain' || s === '-toolchain') {
+        i++
+        continue
+      }
+      if (/^-(-)?(find|f)$/.test(s) || /^--show-sdk-|^--show-toolchain|^-(-)?(version|help|h|kill-cache|k)$/.test(s)) return { effects: [], readsStdin: false, stdout: { type: 'path' } }
+      if (/^-(-)?(log|verbose|no-cache|l|v|n|r|run)$/.test(s)) continue
+      break
+    }
+    if (i >= a.length) return { effects: [], readsStdin: false }
+    return h.subcommand(a.slice(i))
+  },
+}
+
+/** codesign: -s/--sign rewrites the operands; -v/-d/--verify/--display read them. */
+const codesign = define({
+  names: ['codesign'], summary: 'code signing',
+  spec: { short: 'dvfhRoV', shortWithArg: 'siPr', long: { sign: '=s', verify: false, display: false, deep: false, strict: true, force: false, verbose: true, identifier: '=i', entitlements: true, options: true, timestamp: true, 'preserve-metadata': true, keychain: true, requirements: '=r', remove: false, 'remove-signature': false, xml: false, der: false, 'check-notarization': false, 'generate-entitlement-der': false, 'all-architectures': false, prefix: true, 'test-requirement': true, detached: true, bundle: true, file: false, extract: true } },
+  operands: 'read*', stdin: false, flags: { entitlements: 'write' },
+  when: { 's|remove-signature|remove': { operands: 'write*', flags: { entitlements: 'read', keychain: 'read' } } },
+})
+
+const spctl = queryOrChange(['spctl'], 'Gatekeeper assessments', /^(-a|--assess|--status|-s|--test|-t|--list|--help|-h)$/, 'changes the Gatekeeper policy')
+
+const security: Behavior = {
+  names: ['security'],
+  summary: 'keychains and certificates',
+  analyze(inv, h) {
+    const a = args(inv)
+    const sub = concrete(a.find((x) => !knownPrefix(x).startsWith('-')) ?? known('')) ?? '?'
+    const keychains = home(h, '/Library/Keychains')
+    if (/^(find-|dump-|list-|show-|verify-cert$|error$|help$)/.test(sub) || (sub === 'cms' && a.some((x) => concrete(x) === '-D'))) {
+      const effects: Effect[] = [{ kind: 'read', path: keychains, recursive: true }, { kind: 'read', path: known('/Library/Keychains'), recursive: true, maybe: true }]
+      if (sub === 'cms') for (let i = 0; i < a.length; i++) if (concrete(a[i]) === '-i' && a[i + 1]) effects.push({ kind: 'read', path: h.resolve(a[i + 1]) })
+      return { effects, readsStdin: sub === 'cms' && !a.some((x) => concrete(x) === '-i') }
+    }
+    return { effects: [{ kind: 'write', path: keychains, recursive: true, maybe: true }, { kind: 'unknown', detail: `security ${sub}` }], readsStdin: 'maybe', complete: false }
+  },
+}
+
+// ---------------------------------------------------------------------------
+// network
+// ---------------------------------------------------------------------------
+
+const networkTools: Behavior[] = [
+  queryOrChange(['ipconfig'], 'network interfaces (macOS)', /^(getifaddr|getoption|getpacket|getsummary|getv6packet|ifcount|getiflist|getra|waitall|help)$/, 'changes interface configuration'),
+  {
+    names: ['ifconfig'],
+    summary: 'network interfaces',
+    analyze(inv) {
+      // `ifconfig`, `ifconfig -a`, `ifconfig -l`, `ifconfig en0`: queries; more words configure the interface
+      const ops = args(inv).filter((x) => !/^-[aludLmvrC]+$/.test(concrete(x) ?? ''))
+      if (ops.length <= 1) return { effects: [], readsStdin: false }
+      return { effects: [{ kind: 'unknown', detail: 'ifconfig configures an interface' }], readsStdin: false, complete: false }
+    },
+  },
+  {
+    names: ['arp', 'ndp'],
+    summary: 'address resolution tables',
+    analyze(inv) {
+      const a = args(inv).map((x) => concrete(x))
+      if (a.some((x) => x === undefined || /^-[a-zA-Z]*[dsSf]/.test(x))) return { effects: [{ kind: 'unknown', detail: `${inv.name} changes the table` }], readsStdin: false, complete: false }
+      return { effects: [], readsStdin: false }
+    },
+  },
+  queryOrChange(['route'], 'routing tables', /^(get|monitor|show|-n)$/, 'changes routes'),
+  queryOrChange(['scutil'], 'system configuration', /^(--dns|--proxy|--nwi|--get|-r|-w)$/, 'changes the system configuration'),
+  queryOrChange(['networksetup'], 'network settings', /^-(get|list|print|version|help|isBluetooth|show)/, 'changes network settings'),
+  queryOrChange(['socketfilterfw'], 'application firewall', /^--(get|list)/, 'changes the firewall'),
+  {
+    names: ['dscacheutil'],
+    summary: 'directory service cache',
+    analyze: (inv) => ({ effects: args(inv).some((x) => concrete(x) === '-flushcache') ? [{ kind: 'process', detail: 'flush the DNS cache' }] : [], readsStdin: false }),
+  },
+  define({ names: ['dns-sd', 'mDNS'], summary: 'Bonjour browsing and registration', anyFlags: true, operands: 'arg*', stdin: false, effects: [{ kind: 'network', detail: 'multicast DNS' }] }),
+  define({ names: ['mtr', 'whois'], summary: 'network diagnostics', anyFlags: true, operands: 'url arg*', stdin: false }),
+]
+
+// ---------------------------------------------------------------------------
+// system state and diagnostics
+// ---------------------------------------------------------------------------
+
+const systemTools: Behavior[] = [
+  info(['system_profiler', 'ioreg', 'lsappinfo', 'footprint', 'vmmap', 'heap', 'leaks', 'fs_usage', 'powermetrics', 'nettop', 'csrutil', 'kextstat', 'machine'], 'print system or process information'),
+  define({
+    names: ['sysctl'], summary: 'kernel state',
+    spec: { short: 'abdehiNnoqxAX', shortWithArg: 'f' }, operands: 'arg*', stdin: false,
+    // `name=value` and -w set kernel parameters
+    extra: (r, { operands, p }) => (p.flags.has('w') || operands.some((o) => knownPrefix(o).includes('=') || concrete(o) === undefined) ? { ...r, effects: [...r.effects, { kind: 'unknown', detail: 'sysctl sets kernel parameters' }], complete: false } : r),
+  }),
+  define({
+    names: ['memory_pressure'], summary: 'memory pressure', spec: { short: 'Q', shortWithArg: 'lSps' }, stdin: false,
+    when: { S: { opaque: 'memory_pressure -S simulates memory pressure' } },
+  }),
+  queryOrChange(['pmset'], 'power management', /^-g$/, 'changes power settings'),
+  queryOrChange(['tmutil'], 'Time Machine', /^(listbackups|latestbackup|status|destinationinfo|isexcluded|machinedirectory|listlocalsnapshots|listlocalsnapshotdates|compare|calculatedrift|uniquesize|version|help|verifychecksums)$/, 'changes backups or their settings'),
+  queryOrChange(['diskutil'], 'disks and volumes', /^(list|info|information|activity|listFilesystems|apfs|cs|appleRAID|verifyVolume|verifyDisk|image)$/, 'changes disks or volumes'),
+  queryOrChange(['hdiutil'], 'disk images', /^(info|imageinfo|verify|checksum|isencrypted|plugins|help|pmap)$/, 'mounts or creates disk images'),
+  queryOrChange(['log'], 'unified logging', /^(show|stream|stats|help)$/, 'changes logging configuration or collects archives'),
+  queryOrChange(['lsregister'], 'Launch Services database', /^-(dump|h|help)$/, 'changes the Launch Services database'),
+  {
+    names: ['sample', 'spindump'],
+    summary: 'sample a process',
+    analyze(inv, h) {
+      // writes the report to -file PATH, else into /tmp
+      const a = args(inv)
+      const i = a.findIndex((x) => concrete(x) === '-file' || concrete(x) === '-o')
+      const out: AValue = i >= 0 && a[i + 1] ? h.resolve(a[i + 1]) : concat(known('/tmp/'), hole('filename', 'sample report'))
+      return { effects: [{ kind: 'write', path: out }], readsStdin: false }
+    },
+  },
+]
+
+// ---------------------------------------------------------------------------
+// files, Spotlight, images, screen
+// ---------------------------------------------------------------------------
+
+const mdfind: Behavior = {
+  names: ['mdfind'],
+  summary: 'Spotlight search',
+  analyze(inv, h) {
+    const a = args(inv)
+    const effects: Effect[] = []
+    let complete = true
+    for (let i = 0; i < a.length; i++) {
+      const s = concrete(a[i])
+      if (s === '-onlyin' && a[i + 1]) {
+        h.role(a[i + 1], 'dir')
+        effects.push({ kind: 'read', path: h.resolve(a[++i]), recursive: true })
+      } else if (s === '-name' || s === '-attr' || s === '-s') {
+        if (a[i + 1]) h.role(a[i + 1], 'pattern')
+        i++
+      } else if (s === '-live' || s === '-count' || s === '-0' || s === '-literal' || s === '-interpret' || s === '-reprint') continue
+      else if (s !== undefined && s.startsWith('-')) complete = false
+      else h.role(a[i], 'pattern')
+    }
+    // names (not contents) of matching files anywhere in the index
+    if (!effects.length) effects.push({ kind: 'read', path: known('/'), recursive: true, maybe: true })
+    return { effects, readsStdin: false, complete, stdout: { type: 'path', lines: true } }
+  },
+}
+
+const mdls = define({
+  names: ['mdls'], summary: 'Spotlight metadata',
+  spec: { longSingle: true, long: { name: true, raw: false, nullMarker: true, plist: true, r: false } },
+  operands: 'read*', flags: { plist: 'write' }, stdin: false,
+})
+
+/** sips: queries (-g) read; anything else rewrites the images, or writes --out. */
+const SIPS_QUERY = new Set(['g', 'getProperty', '1', 'oneLine', 'h', 'help', 'H', 'helpProperties', 'v', 'version', 'debug'])
+const sips = define({
+  names: ['sips'], summary: 'image processing (macOS)',
+  spec: {
+    short: '1hHv', shortWithArg: 'gsdrfcpzZioeEmMxj', arity: { s: 2, c: 2, p: 2, z: 2, M: 2 },
+    long: { getProperty: '=g', setProperty: '=s', deleteProperty: '=d', rotate: '=r', flip: '=f', cropToHeightWidth: '=c', padToHeightWidth: '=p', resampleHeightWidth: '=z', resampleHeightWidthMax: '=Z', resampleWidth: true, resampleHeight: true, cropOffset: 2, padColor: true, addIcon: '=i', out: '=o', embedProfile: '=e', embedProfileIfNone: '=E', matchTo: '=m', matchToWithIntent: '=M', extractProfile: '=x', extractTag: 2, js: '=j', oneLine: '=1', help: '=h', helpProperties: '=H', version: '=v', debug: false, optimizeColorForSharing: false, verifyColor: false, deleteColorManagementProperties: false, setColorManagementPropertiesFromFile: true },
+  },
+  operands: 'read*', stdin: false, flags: { e: 'read', E: 'read', m: 'read', x: 'write', extractTag: 'write' },
+  extra: (r, { h, p, operands }) => {
+    if (p.flags.has('j')) return { ...r, effects: [...r.effects, { kind: 'unknown', detail: 'sips runs a JavaScript file' }], complete: false }
+    const modifies = [...p.flags.keys()].some((k) => !SIPS_QUERY.has(k) && !['e', 'E', 'm', 'M', 'x', 'extractTag', 'o'].includes(k)) || ['e', 'E', 'm', 'M'].some((k) => p.flags.has(k))
+    if (!modifies) return r
+    const out = p.flags.get('o')
+    const writes: Effect[] = out && out !== true
+      ? [{ kind: 'write', path: h.resolve(out), ...(operands.length > 1 ? { recursive: true } : {}) }]
+      : operands.map((o): Effect => ({ kind: 'write', path: h.resolve(o) }))
+    if (out && out !== true && operands.length > 1) h.role(out, 'dir')
+    return { ...r, effects: [...r.effects, ...writes] }
+  },
+})
+
+const screencapture = define({
+  names: ['screencapture'], summary: 'screenshots (macOS)',
+  spec: { short: 'cCdimMoPswWxSaUuvkgbBIrpGJ', shortWithArg: 'RtTlDVBGJf' },
+  operands: 'write*', stdin: false,
+  when: { c: { operands: 'arg*' }, 'M|P': { effects: [{ kind: 'process', detail: 'opens the capture in an app' }] } },
+})
+
+const qlmanage = define({
+  names: ['qlmanage'], summary: 'Quick Look', spec: { short: 'pthmrxi', shortWithArg: 'osgc', long: {} },
+  operands: 'read*', stdin: false, flags: { o: 'write:dir' },
+  when: { p: { opaque: 'qlmanage -p opens a preview window' }, r: { effects: [{ kind: 'process', detail: 'resets Quick Look' }] } },
+})
+
+/** Chrome / Chromium: --headless with an output flag renders a page; anything else is the GUI browser. */
+const chrome: Behavior = {
+  names: ['Google Chrome', 'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome', 'Chromium', 'Google Chrome Canary', 'Microsoft Edge', 'Brave Browser'],
+  summary: 'web browser',
+  analyze(inv, h) {
+    const a = args(inv)
+    const opt = (name: string): AValue | true | undefined => {
+      for (const x of a) {
+        const s = concrete(x)
+        if (s === `--${name}`) return true
+        if (s?.startsWith(`--${name}=`)) return known(s.slice(name.length + 3))
+      }
+      return undefined
+    }
+    if (opt('version') || opt('help')) return { effects: [], readsStdin: false }
+    const headless = opt('headless') !== undefined
+    const effects: Effect[] = [{ kind: 'network', detail: inv.name, maybe: true }]
+    const shot = opt('screenshot')
+    const pdf = opt('print-to-pdf')
+    const profile = opt('user-data-dir')
+    effects.push(profile && profile !== true
+      ? { kind: 'write', path: h.resolve(profile), recursive: true }
+      : { kind: 'write', path: home(h, process.platform === 'darwin' ? '/Library/Application Support' : '/.config'), recursive: true, maybe: true })
+    if (shot) effects.push({ kind: 'write', path: shot === true ? concat(inv.cwd, known('/screenshot.png')) : h.resolve(shot) })
+    if (pdf) effects.push({ kind: 'write', path: pdf === true ? concat(inv.cwd, known('/output.pdf')) : h.resolve(pdf) })
+    for (const x of a) {
+      const s = concrete(x)
+      if (s !== undefined && !s.startsWith('-') && !/^[a-z]+:/.test(s)) effects.push({ kind: 'read', path: h.resolve(x) })
+      if (s?.startsWith('file://')) effects.push({ kind: 'read', path: known(decodeURIComponent(s.slice(7))) })
+    }
+    const outputOnly = headless && (shot || pdf || opt('dump-dom'))
+    if (!outputOnly) effects.push({ kind: 'unknown', detail: `${inv.name} runs a browser` })
+    return { effects, readsStdin: false, complete: !!outputOnly && !opt('remote-debugging-port') && !opt('remote-debugging-pipe') }
+  },
+}
+
+export const macosBehaviors: Behavior[] = [
+  defaults, plutil, plistBuddy, launchctl, xcodeSelect, xcrun, codesign, spctl, security,
+  ...networkTools, ...systemTools, mdfind, mdls, sips, screencapture, qlmanage, chrome,
+]