rea-agents 3.2.1 → 4.0.0

package/dist/native/AppleSwiftVtables.js

@@ -0,0 +1,86 @@
+/** Decode non-generic, non-resilient Swift class vtable descriptors without instantiating metadata. */
+export const decodeSwiftClassVtables = (input) => {
+    const { readers: read, result } = input;
+    const failures = [];
+    let examined = 0;
+    for (const field of input.entries) {
+        if (!read.admit()) {
+            failures.push("max_records_reached");
+            break;
+        }
+        examined++;
+        try {
+            const descriptor = read.relative(field);
+            const flags = read.u32(descriptor);
+            if ((flags & 31) !== 16)
+                continue;
+            const specific = flags >>> 16;
+            if ((flags & 0x80) !== 0 || (specific & 0x2000) !== 0)
+                throw new TypeError("Generic class or resilient superclass metadata is unsupported");
+            if ((specific & 0x8000) === 0)
+                continue;
+            const initialization = specific & 3;
+            if (initialization === 3)
+                throw new TypeError("Unknown metadata initialization kind");
+            const header = descriptor +
+                44n +
+                BigInt(initialization === 1 ? 12 : initialization === 2 ? 4 : 0);
+            const tableOffset = read.u32(header);
+            const count = read.u32(header + 4n);
+            const positiveWords = read.u32(descriptor + 28n);
+            if (count > 20000 || tableOffset + count > positiveWords)
+                throw new RangeError("Swift vtable count or offset exceeds declared metadata bounds");
+            const owner = read.string(read.relative(descriptor + 8n));
+            for (let index = 0; index < count; index++) {
+                if (!read.admit()) {
+                    failures.push("max_records_reached");
+                    break;
+                }
+                const entry = header + 8n + BigInt(index * 8);
+                const methodFlags = read.u32(entry);
+                // Async slots reference async descriptors; coroutine and future kinds need separate decoders.
+                const synchronous = (methodFlags & 0x40) === 0 && (methodFlags & 15) <= 3;
+                const implementation = read.relative(entry + 4n);
+                const resolved = synchronous && read.executable(implementation);
+                result.swift_dispatch_slots.push({
+                    owner,
+                    table_kind: "class_vtable",
+                    slot_index: tableOffset + index,
+                    requirement: null,
+                    implementation: null,
+                    implementation_address: resolved
+                        ? `0x${implementation.toString(16)}`
+                        : null,
+                    thunk_address: null,
+                    location: read.location(entry),
+                    decode: resolved
+                        ? { status: "decoded", reason: null }
+                        : {
+                            status: "partial",
+                            reason: "Async, coroutine, external or unmapped vtable implementation is unresolved",
+                        },
+                    evidence: read.evidence(entry, "Swift class vtable method descriptor; slot index is a metadata word offset, not a source method ordinal"),
+                });
+            }
+            if ((specific & 0x4000) !== 0)
+                failures.push(`${owner}: inherited override descriptors are unsupported`);
+        }
+        catch (cause) {
+            failures.push(`0x${field.toString(16)}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+    }
+    const slots = result.swift_dispatch_slots.filter((slot) => slot.table_kind === "class_vtable");
+    result.coverage.push({
+        facet: "swift_class_vtable_descriptors",
+        examined,
+        decoded: slots.filter((slot) => slot.decode.status === "decoded").length,
+        status: failures.length > 0 ||
+            slots.some((slot) => slot.decode.status !== "decoded")
+            ? "partial"
+            : "complete",
+        reason: failures.join("; ") ||
+            (slots.some((slot) => slot.decode.status !== "decoded")
+                ? "vtable_implementations_unresolved"
+                : null),
+    });
+};

package/dist/native/CommandRunner.js

@@ -133,7 +133,7 @@ const captureProcess = (executable, arguments_, tool, options) => new Promise((r
             finish(err(new NativeCommandFailure(tool, reason, code)));
             return;
         }
-        if (code !== 0 && options.acceptNonZero !== true) {
+        if (signal !== null || (code !== 0 && options.acceptNonZero !== true)) {
             finish(err(new NativeCommandFailure(tool, "nonzero-exit", code)));
             return;
         }

package/dist/native/NativeHostCapabilities.js

@@ -0,0 +1,23 @@
+/** Apply native host restrictions to portable provider discovery metadata. */
+export const nativeHostCapabilities = (capabilities, platform = process.platform) => {
+    if (platform === "darwin")
+        return capabilities;
+    return capabilities.map((capability) => {
+        if (capability.provider.id === "native-macos")
+            return {
+                ...capability,
+                available: false,
+                availabilityCode: "unsupported_host",
+                reason: "Native macOS utilities require macOS.",
+            };
+        if (capability.provider.id === "rea-artifact-graph" &&
+            capability.operation === "inspect_asset_catalog")
+            return {
+                ...capability,
+                available: false,
+                availabilityCode: "unsupported_host",
+                reason: "Apple asset catalogs require macOS assetutil.",
+            };
+        return capability;
+    });
+};

package/dist/native/NativeMacOSProvider.js

@@ -1,10 +1,12 @@
+import { inspectAppleDispatchMetadata } from "./AppleDispatchMetadata.js";
+import { observeNativeUi } from "./NativeUiObservation.js";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { stat } from "node:fs/promises";
 import { parse as parseXmlPlist } from "plist";
 import { z } from "zod";
 import { createAnalysisExecution, } from "../application/AnalysisProvider.js";
 import { NATIVE_TOOL_CONTRACTS, } from "../contracts/nativeToolContracts.js";
-import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, ProviderAdapterError, } from "../domain/errors.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, ProviderAdapterError, AnalysisError, } from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { demangleSwiftSchema, inspectPlistSchema, inspectSignatureSchema, listArchitecturesSchema, } from "../domain/nativeInspection.js";
 import { err, ok } from "../domain/result.js";
@@ -28,7 +30,10 @@ export class NativeMacOSProvider {
     constructor(runner = new XcrunCommandRunner(), platform = process.platform) {
         this.runner = runner;
         const available = platform === "darwin";
-        this.#capabilities = Object.freeze(NATIVE_TOOL_CONTRACTS.map((contract) => {
+        this.#capabilities = Object.freeze([
+            ...NATIVE_TOOL_CONTRACTS,
+            { name: "inspect_native_dispatch_metadata" },
+        ].map((contract) => {
             const availability = available
                 ? { available: true, reason: null }
                 : {
@@ -42,10 +47,11 @@ export class NativeMacOSProvider {
                 ...availability,
                 effects: Object.freeze({
                     mutatesArtifact: false,
-                    launchesProcess: true,
-                    mayShowUi: false,
-                    mayAccessNetwork: false,
-                    mayWriteFilesystem: false,
+                    launchesProcess: contract.name !== "inspect_native_dispatch_metadata",
+                    mayShowUi: contract.name === "capture_native_ui_scenario",
+                    mayAccessNetwork: contract.name === "capture_native_ui_scenario",
+                    mayWriteFilesystem: contract.name === "capture_native_ui_scenario" ||
+                        contract.name === "observe_native_ui",
                     changesPermissions: false,
                     requiresRoot: false,
                 }),
@@ -77,8 +83,49 @@ class NativeMacOSClient {
             return err(new AnalysisCancelledError(operation));
         if (operation === "health")
             return ok(createAnalysisExecution(null, IDENTITY));
+        if (operation === "inspect_native_dispatch_metadata") {
+            if (this.target.kind !== "executable" || this.target.format !== "mach-o")
+                return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "Binary Apple metadata requires Mach-O; other providers can report symbol-only metadata"));
+            try {
+                const maxRecords = z
+                    .number()
+                    .int()
+                    .min(1)
+                    .max(20000)
+                    .parse(parameters.max_records ?? 5000);
+                const result = await inspectAppleDispatchMetadata(this.target, maxRecords, options?.signal);
+                return ok(createAnalysisExecution(result, result.provider, {
+                    locations: [{ kind: "artifact-path", path: this.target.path }],
+                    limitations: result.result.coverage.flatMap(({ reason }) => reason === null ? [] : [reason]),
+                }));
+            }
+            catch (cause) {
+                if (cause instanceof AnalysisError)
+                    return err(cause);
+                return err(options?.signal?.aborted
+                    ? new AnalysisCancelledError(operation)
+                    : new ProviderAdapterError(IDENTITY.id, operation, {
+                        cause,
+                        diagnostics: {
+                            target_path: this.target.path,
+                            reason: cause instanceof Error ? cause.message : String(cause),
+                        },
+                    }));
+            }
+        }
         if (!isNativeOperation(operation))
             return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "Operation is not implemented by native macOS tools."));
+        if (operation === "observe_native_ui" ||
+            operation === "capture_native_ui_scenario") {
+            const result = await observeNativeUi(this.target, operation, parameters, {
+                signal: options?.signal,
+            });
+            return result.ok
+                ? ok(createAnalysisExecution(result.value, IDENTITY, {
+                    limitations: result.value.limitations,
+                }))
+                : result;
+        }
         try {
             const observation = await this.#dispatch(operation, parameters, options?.signal);
             return observation.ok
@@ -100,6 +147,9 @@ class NativeMacOSClient {
     }
     #dispatch(operation, parameters, signal) {
         switch (operation) {
+            case "observe_native_ui":
+            case "capture_native_ui_scenario":
+                return Promise.resolve(err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "UI observation uses its explicit authority boundary")));
             case "inspect_macho":
                 return this.#inspectMacho(signal);
             case "inspect_signature":
@@ -159,13 +209,15 @@ class NativeMacOSClient {
         const display = await this.#run("inspect_signature", "codesign", ["-d", "--verbose=4", this.target.path], { signal, acceptNonZero: true });
         if (!display.ok)
             return display;
-        const requirements = await this.#run("inspect_signature", "codesign", ["-d", "-r-", this.target.path], { signal, acceptNonZero: true });
+        const unsigned = /not signed at all|code object is not signed/iu.test(`${display.value.stdout}\n${display.value.stderr}`);
+        if (!unsigned && display.value.exitCode !== 0)
+            return err(translateCommandFailure("inspect_signature", new NativeCommandFailure("codesign", "nonzero-exit", display.value.exitCode)));
+        const requirements = await this.#run("inspect_signature", "codesign", ["-d", "-r-", this.target.path], { signal, acceptNonZero: unsigned });
         if (!requirements.ok)
             return requirements;
-        const entitlements = await this.#run("inspect_signature", "codesign", ["-d", "--entitlements", ":-", this.target.path], { signal, acceptNonZero: true });
+        const entitlements = await this.#run("inspect_signature", "codesign", ["-d", "--entitlements", ":-", this.target.path], { signal, acceptNonZero: unsigned });
         if (!entitlements.ok)
             return entitlements;
-        const unsigned = /not signed at all|code object is not signed/iu.test(`${display.value.stdout}\n${display.value.stderr}`);
         const parsed = parseCodeSignature(`${display.value.stdout}\n${display.value.stderr}`, unsigned);
         const requirementText = /designated\s*=>\s*(.+)$/mu.exec(`${requirements.value.stdout}\n${requirements.value.stderr}`)?.[1] ?? null;
         const entitlementValue = parseEntitlements(`${entitlements.value.stdout}\n${entitlements.value.stderr}`);

package/dist/native/NativeMachoInspection.js

@@ -7,7 +7,7 @@ import { parseOtoolLoadCommands } from "./parsers/otool.js";
 const REQUIRED_COMMANDS = [
     ["file", ["-b"]],
     ["lipo", ["-detailed_info"]],
-    ["otool", ["-l"]],
+    ["otool", ["-h", "-l"]],
     ["nm", ["-gjU"]],
     ["dyld_info", ["-imports"]],
     ["dyld_info", ["-exports"]],
@@ -19,14 +19,22 @@ const VTOOL_UNAVAILABLE_LIMITATION = "vtool is unavailable; build metadata is no
 export const inspectNativeMacho = async (context) => {
     const captures = [];
     for (const [tool, prefix] of REQUIRED_COMMANDS) {
-        const captured = await context.run(tool, [...prefix, context.target.path], context.signal);
+        const captured = await context.run(tool, [
+            ...prefix,
+            ...selectedArchitectureArguments(tool, context.target),
+            context.target.path,
+        ], context.signal);
         if (!captured.ok)
             return err(captured.error);
         captures.push(captured.value);
     }
     const limitations = [];
     const [tool, prefix] = OPTIONAL_VTOOL_COMMAND;
-    const optional = await context.run(tool, [...prefix, context.target.path], context.signal);
+    const optional = await context.run(tool, [
+        ...prefix,
+        ...selectedArchitectureArguments(tool, context.target),
+        context.target.path,
+    ], context.signal);
     if (optional.ok)
         captures.push(optional.value);
     else if (optional.error._tag === "AnalysisCapabilityUnavailableError")
@@ -46,7 +54,8 @@ const normalizeMacho = (captures, toInvocation, additionalLimitations) => {
     const architectures = parseLipoArchitectures(byTool("lipo").stdout);
     const load = parseOtoolLoadCommands(byTool("otool").stdout);
     const imports = parseDyldSymbols(byTool("dyld_info", 0).stdout, "imports");
-    const dyldExports = parseDyldSymbols(byTool("dyld_info", 1).stdout, "exports");
+    const imageBase = load.segments.find((segment) => segment.file_offset === 0 && (segment.file_size ?? 0) > 0)?.vm_address ?? null;
+    const dyldExports = parseDyldSymbols(byTool("dyld_info", 1).stdout, "exports", imageBase);
     const exports = uniqueSymbols([
         ...dyldExports,
         ...parseNmExports(byTool("nm").stdout),
@@ -54,6 +63,11 @@ const normalizeMacho = (captures, toInvocation, additionalLimitations) => {
     const uuid = /UUID:\s*([A-Fa-f0-9-]+)/u.exec(byTool("dwarfdump").stdout)?.[1] ??
         load.uuid;
     const provenance = captures.map(toInvocation);
+    // A thread-state command carries the entrypoint in architecture-specific
+    // register state, so an absent decoded offset means unknown, not absent.
+    const threadEntrypoint = load.entrypoints.length === 0 &&
+        load.commands.some((command) => command.kind === "LC_UNIXTHREAD" || command.kind === "LC_THREAD");
+    const threadEntrypointLimitation = "Thread-state entrypoints (LC_UNIXTHREAD/LC_THREAD) are retained as raw load commands; file offsets are not derived.";
     const limitations = [
         "Imports and exports combine dyld_info and nm; stripped or toolchain-hidden symbols may be absent.",
         ...(captures.some(({ tool }) => tool === "vtool")
@@ -62,6 +76,13 @@ const normalizeMacho = (captures, toInvocation, additionalLimitations) => {
             ]
             : []),
         ...additionalLimitations,
+        ...(threadEntrypoint ? [threadEntrypointLimitation] : []),
+        ...(imageBase === null &&
+            /^\s*offset\s+symbol\s*$/mu.test(byTool("dyld_info", 1).stdout)
+            ? [
+                "Export virtual addresses are unavailable because no file-backed image base was observed.",
+            ]
+            : []),
     ];
     return inspectMachoSchema.parse({
         format: "mach-o",
@@ -70,7 +91,7 @@ const normalizeMacho = (captures, toInvocation, additionalLimitations) => {
         file_type: load.fileType,
         flags: load.flags,
         uuid: uuid ?? null,
-        entrypoints: covered(load.entrypoints, true),
+        entrypoints: covered(load.entrypoints, !threadEntrypoint, threadEntrypoint ? [threadEntrypointLimitation] : []),
         architectures: covered(architectures, true),
         build_metadata: covered(load.builds, true),
         load_commands: covered(load.commands, true),
@@ -120,7 +141,8 @@ const covered = (items, exhaustive, limitations = []) => ({
 const uniqueSymbols = (items) => {
     const unique = new Map();
     for (const item of items)
-        unique.set(item.name, item);
+        if (!unique.has(item.name))
+            unique.set(item.name, item);
     return [...unique.values()].sort((left, right) => left.name.localeCompare(right.name));
 };
 const fileOffsetLocations = (macho) => {
@@ -148,3 +170,14 @@ export const architectureLocations = (architectures) => {
     }
     return locations;
 };
+const selectedArchitectureArguments = (tool, target) => {
+    if (target.kind !== "executable" ||
+        target.availableArchitectures.length < 2 ||
+        tool === "file" ||
+        tool === "lipo")
+        return [];
+    const architecture = target.architecture === "x86" ? "i386" : target.architecture;
+    return tool === "dwarfdump"
+        ? [`--arch=${architecture}`]
+        : ["-arch", architecture];
+};

package/dist/native/NativeUiHelperRuntime.js

@@ -0,0 +1,42 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileOutput } from "../process/ExecFileOutput.js";
+/** Lazily compile one owned helper per observation/scenario and remove its compiler cache. */
+export const createNativeUiHelperRuntime = () => {
+    let root;
+    let executable;
+    const invoke = async (parameters, signal) => {
+        if (executable === undefined) {
+            root = await mkdtemp(join(tmpdir(), "rea-native-ui-"));
+            const output = join(root, "observer");
+            await execFileOutput("/usr/bin/xcrun", [
+                "swiftc",
+                "-module-cache-path",
+                join(root, "modules"),
+                fileURLToPath(new URL("../../bridge/native/ReaNativeUI.swift", import.meta.url)),
+                "-o",
+                output,
+            ], {
+                timeout: 60_000,
+                maxBuffer: 1024 * 1024,
+                ...(signal === undefined ? {} : { signal }),
+            });
+            executable = output;
+        }
+        const output = await execFileOutput(executable, [JSON.stringify(parameters)], {
+            timeout: 30_000,
+            maxBuffer: 16 * 1024 * 1024,
+            ...(signal === undefined ? {} : { signal }),
+        });
+        return JSON.parse(output.stdout);
+    };
+    return {
+        invoke,
+        close: async () => {
+            if (root !== undefined)
+                await rm(root, { recursive: true, force: true });
+        },
+    };
+};

package/dist/native/NativeUiObservation.js

@@ -0,0 +1,174 @@
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { nativeUiObservationInputSchema, nativeUiScenarioInputSchema, nativeUiSnapshotSchema, nativeUiResultSchema, } from "../domain/nativeUiObservation.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisInputError, ProviderAdapterError, } from "../domain/errors.js";
+import { err, ok } from "../domain/result.js";
+import { createNativeUiHelperRuntime } from "./NativeUiHelperRuntime.js";
+const helper = fileURLToPath(new URL("../../bridge/native/ReaNativeUI.swift", import.meta.url));
+const responseSchema = z.discriminatedUnion("ok", [
+    z.strictObject({ ok: z.literal(true), result: nativeUiSnapshotSchema }),
+    z.strictObject({
+        ok: z.literal(false),
+        code: z.string(),
+        message: z.string(),
+    }),
+]);
+/** Capture a selected existing app window and run explicitly selected scenarios. */
+export const observeNativeUi = async (target, operation, parameters, options = {}) => {
+    const runtime = createNativeUiHelperRuntime();
+    try {
+        return await observeWithHelper(target, operation, parameters, {
+            ...options,
+            invoke: options.invoke ?? runtime.invoke,
+        });
+    }
+    finally {
+        await runtime.close();
+    }
+};
+const observeWithHelper = async (target, operation, parameters, options) => {
+    const parsed = (operation === "observe_native_ui"
+        ? nativeUiObservationInputSchema
+        : nativeUiScenarioInputSchema).safeParse(parameters);
+    if (!parsed.success)
+        return err(new AnalysisInputError(operation, { cause: parsed.error }));
+    if (target.kind !== "executable" || target.format !== "mach-o")
+        return err(new AnalysisCapabilityUnavailableError("native-macos", operation, "Native UI observation requires an active Mach-O executable or app target"));
+    const input = parsed.data;
+    if (!input.screenshot && !input.accessibility)
+        return err(new AnalysisInputError(operation, {
+            cause: new Error("Enable screenshot or accessibility capture"),
+        }));
+    const steps = operation === "capture_native_ui_scenario"
+        ? nativeUiScenarioInputSchema.parse(parameters).steps
+        : [];
+    const signal = options.signal === undefined
+        ? AbortSignal.timeout(180_000)
+        : AbortSignal.any([options.signal, AbortSignal.timeout(180_000)]);
+    const invoke = options.invoke;
+    let launchTime;
+    let outputBytes = 0;
+    const take = async (action) => {
+        if (signal.aborted)
+            return err(new AnalysisCancelledError(operation));
+        try {
+            const response = responseSchema.parse(await invoke({
+                pid: input.pid,
+                window_id: input.window_id,
+                executable: target.path,
+                sha256: target.sha256,
+                ...(launchTime === undefined ? {} : { launch_time: launchTime }),
+                screenshot: input.screenshot,
+                accessibility: input.accessibility,
+                max_nodes: input.max_nodes,
+                ...(action === undefined ? {} : { action }),
+            }, signal));
+            if (!response.ok)
+                return err(new AnalysisCapabilityUnavailableError("native-macos", operation, `${response.code}: ${response.message}`));
+            if (response.result.window.pid !== input.pid ||
+                response.result.window.window_id !== input.window_id ||
+                response.result.window.executable !== target.path ||
+                (launchTime !== undefined &&
+                    response.result.window.launch_time !== launchTime))
+                return err(new AnalysisCapabilityUnavailableError("native-macos", operation, "Native helper returned a different target process or window"));
+            launchTime = response.result.window.launch_time;
+            outputBytes += 2 * Buffer.byteLength(JSON.stringify(response.result));
+            if (outputBytes > 64 * 1024 * 1024)
+                return err(new AnalysisCapabilityUnavailableError("native-macos", operation, "Scenario captures exceeded the 64 MiB output budget"));
+            return ok(response.result);
+        }
+        catch (cause) {
+            return err(signal.aborted
+                ? new AnalysisCancelledError(operation)
+                : new ProviderAdapterError("native-macos", operation, {
+                    cause,
+                    diagnostics: {
+                        helper_path: helper,
+                        reason: "Native helper failed, timed out, or returned malformed capture data; install compatible Xcode command-line tools and inspect local OS permissions",
+                    },
+                }));
+        }
+    };
+    const initial = await take();
+    if (!initial.ok)
+        return initial;
+    const results = [];
+    let before = initial.value;
+    for (const [index, step] of steps.entries()) {
+        if (signal.aborted) {
+            results.push({
+                index,
+                kind: step.kind,
+                before,
+                after: null,
+                outcome: "cancelled",
+                reason: "Scenario cancelled before action",
+            });
+            break;
+        }
+        if (step.kind === "wait") {
+            try {
+                await new Promise((resolve, reject) => {
+                    const abort = () => {
+                        clearTimeout(timer);
+                        reject(new Error("cancelled"));
+                    };
+                    const timer = setTimeout(() => {
+                        signal.removeEventListener("abort", abort);
+                        resolve();
+                    }, step.milliseconds);
+                    signal.addEventListener("abort", abort, { once: true });
+                    if (signal.aborted)
+                        abort();
+                });
+            }
+            catch {
+                results.push({
+                    index,
+                    kind: step.kind,
+                    before,
+                    after: null,
+                    outcome: "cancelled",
+                    reason: "Scenario cancelled during wait",
+                });
+                break;
+            }
+        }
+        const after = await take(step.kind === "wait" ? undefined : step);
+        if (!after.ok) {
+            results.push({
+                index,
+                kind: step.kind,
+                before,
+                after: null,
+                outcome: after.error._tag === "AnalysisCancelledError"
+                    ? "cancelled"
+                    : "failed",
+                reason: after.error.message,
+            });
+            break;
+        }
+        results.push({
+            index,
+            kind: step.kind,
+            before,
+            after: after.value,
+            outcome: "completed",
+            reason: null,
+        });
+        before = after.value;
+    }
+    return ok(nativeUiResultSchema.parse({
+        target_sha256: target.sha256,
+        initial: initial.value,
+        steps: results,
+        restore: "leave-as-is",
+        limitations: [
+            "Only the explicitly selected already-running process/window is admitted. REA starts no target process and does not change permissions, foreground applications, or restore application data.",
+            "Click uses AXPress; scroll uses AXIncrement/AXDecrement; key-entry sets the selected element's AXValue. Unsupported elements fail without global event fallback.",
+            "Each completed action is followed immediately by capture; delayed UI changes require explicit wait steps. A failed after-capture can follow a completed action, so failure does not prove absence of application effects.",
+            "Scenarios can change app data, cause app network activity and persist changes. The caller explicitly chooses leave-as-is; automatic restoration is unsupported.",
+            "Window matching uses exact PID and window ID for screenshots and unique accessibility geometry. Accessibility paths can change as the UI changes; stale or ambiguous paths fail. Screenshots are scaled to at most 2048 pixels; scenario output is budgeted at 64 MiB and execution is cancelled after 180 seconds.",
+        ],
+    }));
+};

package/dist/native/parsers/codesign.js

@@ -51,5 +51,8 @@ const splitAlgorithms = (value) => value === undefined
 const parseRuntime = (value) => {
     if (value === undefined)
         return null;
-    return /\bruntime\b/u.test(value);
+    const flags = /(?:^|\s)flags=[^(]*\(([^)]*)\)/u.exec(value)?.[1];
+    if (flags === undefined)
+        return null;
+    return flags.split(",").some((flag) => flag.trim() === "runtime");
 };

package/dist/native/parsers/dyldInfo.js

@@ -1,25 +1,51 @@
-/** Parse bounded imports/exports from dyld_info's line-oriented tables. */
-export const parseDyldSymbols = (output, mode) => output.split(/\r?\n/u).flatMap((rawLine) => {
-    const line = rawLine.trim();
-    if (line.length === 0 ||
-        /^(?:imports|exports|binding|address|segment|ordinal)\b/iu.test(line))
-        return [];
-    const tokens = line.split(/\s+/u);
-    const name = tokens.at(-1);
-    if (name === undefined || !/^(?:_|\$s|objc_|swift_)/u.test(name))
-        return [];
-    const addressToken = tokens.find((token) => /^0x[a-fA-F0-9]+$/u.test(token));
-    return [
-        {
-            name,
-            address: addressToken ?? null,
-            weak: /\bweak\b/iu.test(line) ? true : null,
-            reexport: /\bre-?export\b/iu.test(line)
-                ? true
-                : mode === "exports"
-                    ? false
-                    : null,
-            source: mode === "imports" ? (tokens.at(-2) ?? null) : null,
-        },
-    ];
-});
+/** Decode Apple dyld inventory rows, projecting export offsets to VM addresses. */
+export const parseDyldSymbols = (output, mode, imageBase = null) => {
+    const offsets = /^\s*offset\s+symbol\s*$/mu.test(output);
+    return output.split(/\r?\n/u).flatMap((rawLine) => {
+        const line = rawLine.trim();
+        if (mode === "imports") {
+            const imported = /^(?:0x[\da-f]+\s+)?(\S+)(?:\s+\[([^\]]+)\])?\s+\(from (.+)\)$/iu.exec(line);
+            if (imported?.[1] !== undefined)
+                return [
+                    {
+                        name: imported[1],
+                        address: null,
+                        weak: /\bweak-import\b/u.test(imported[2] ?? "") ? true : null,
+                        reexport: null,
+                        source: imported[3] ?? null,
+                    },
+                ];
+            return [];
+        }
+        const reexport = /^\[re-export\]\s+(\S+)(?:\s+\(from (.+)\))?$/u.exec(line);
+        if (reexport?.[1] !== undefined)
+            return [
+                {
+                    name: reexport[1],
+                    address: null,
+                    weak: null,
+                    reexport: true,
+                    source: reexport[2] ?? null,
+                },
+            ];
+        const exported = /^(0x[\da-f]+)\s+(\S+)(?:\s+\[([^\]]+)\])?$/iu.exec(line);
+        if (exported?.[1] === undefined || exported[2] === undefined)
+            return [];
+        const absolute = /\babsolute\b/u.test(exported[3] ?? "");
+        const address = offsets && !absolute
+            ? imageBase === null
+                ? null
+                : `0x${(BigInt(imageBase) + BigInt(exported[1])).toString(16)}`
+            : canonicalHex(exported[1]);
+        return [
+            {
+                name: exported[2],
+                address,
+                weak: /\bweak-def\b/u.test(exported[3] ?? "") ? true : null,
+                reexport: false,
+                source: null,
+            },
+        ];
+    });
+};
+const canonicalHex = (value) => value === undefined ? null : `0x${BigInt(value).toString(16)}`;