rea-agents 6.2.0 → 6.3.0

package/dist/artifacts/ArtifactProvider.js

@@ -14,10 +14,10 @@ import {} from "../domain/analysisErrorBase.js";
 import { interfaceBuilderLimitsSchema } from "../domain/apple/interfaceBuilderGraph.js";
 import { err, ok } from "../domain/result.js";
 import { ArtifactReaderFailure } from "./ArtifactReader.js";
-import { ARTIFACT_PROVIDER_IDENTITY as IDENTITY, artifactCapabilities, } from "./ArtifactProviderMetadata.js";
+import { artifactCapabilities } from "./ArtifactProviderMetadata.js";
+import { ARTIFACT_GRAPH_PROVIDER } from "../application/InvestigationProviders.js";
 import { createEvidence } from "../domain/evidence.js";
 import { createArtifactInspection } from "../domain/artifactInspection.js";
-import { resolveArtifactIntegrityPolicy } from "./inventory/policy.js";
 /** Read-only inventory and exclusively owned extraction provider. */
 export class ArtifactProvider {
     #capabilities;
@@ -29,7 +29,7 @@ export class ArtifactProvider {
         this.#platform = platform;
     }
     identity() {
-        return IDENTITY;
+        return ARTIFACT_GRAPH_PROVIDER;
     }
     capabilities() {
         return this.#capabilities;
@@ -49,9 +49,9 @@ class ArtifactClient {
     }
     async execute(operation, parameters, options) {
         if (operation === "health")
-            return ok(createAnalysisExecution(null, IDENTITY));
+            return ok(createAnalysisExecution(null, ARTIFACT_GRAPH_PROVIDER));
         if (!isArtifactOperation(operation))
-            return err(new AnalysisCapabilityUnavailableError(IDENTITY.id, operation, "Operation is not implemented by artifact graph provider."));
+            return err(new AnalysisCapabilityUnavailableError(ARTIFACT_GRAPH_PROVIDER.id, operation, "Operation is not implemented by artifact graph provider."));
         try {
             if (operation === "inspect_artifact") {
                 const inspected = await this.inspectArtifact(parameters, options);
@@ -69,7 +69,7 @@ class ArtifactClient {
                     limits,
                     ...(options?.signal === undefined ? {} : { signal: options.signal }),
                 });
-                return ok(createAnalysisExecution(result, IDENTITY, {
+                return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
                     limitations: result.limitations,
                     locations: result.documents.map(({ relative_path: path }) => ({
                         kind: "artifact-path",
@@ -108,7 +108,7 @@ class ArtifactClient {
                 });
                 if (standalone && result.archive_sha256 !== this.target.sha256)
                     throw new ArtifactReaderFailure("integrity", `Active archive digest changed: expected ${this.target.sha256}, observed ${result.archive_sha256}`);
-                return ok(createAnalysisExecution(result, IDENTITY, {
+                return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
                     limitations: result.limitations,
                     locations: [{ kind: "artifact-path", path: result.archive_path }],
                 }));
@@ -126,7 +126,7 @@ class ArtifactClient {
                     outputRoot: parsed.output_root,
                     environment: this.environment,
                 }, options?.signal);
-                return ok(createAnalysisExecution(result, IDENTITY, {
+                return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
                     rawResult: null,
                     limitations: result.limitations,
                     subject: subjectFor(this.target.sourcePath ?? this.target.path, result.manifest),
@@ -138,7 +138,7 @@ class ArtifactClient {
             }
             const parsed = artifactInventoryInputSchema.parse(parameters);
             const result = await this.inventory(parsed, options);
-            return ok(createAnalysisExecution(result, IDENTITY, {
+            return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
                 rawResult: null,
                 limitations: result.limitations,
                 subject: subjectFor(this.target.sourcePath ?? this.target.path, result.manifest),
@@ -172,7 +172,7 @@ class ArtifactClient {
             page: parameters,
             ...(options?.signal === undefined ? {} : { signal: options.signal }),
         });
-        return ok(createAnalysisExecution(result, IDENTITY, {
+        return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
             limitations: result.limitations,
             locations: result.catalogs.map(({ path }) => ({
                 kind: "artifact-path",
@@ -196,7 +196,7 @@ class ArtifactClient {
             parameters,
             ...(options?.signal === undefined ? {} : { signal: options.signal }),
         });
-        return ok(createAnalysisExecution(result, IDENTITY, {
+        return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
             limitations: result.limitations,
             locations: result.images.map(({ path }) => ({
                 kind: "artifact-path",
@@ -221,7 +221,7 @@ class ArtifactClient {
             kind: "artifact-path",
             path,
         }));
-        const inventoryEvidence = createEvidence(subject, IDENTITY, {
+        const inventoryEvidence = createEvidence(subject, ARTIFACT_GRAPH_PROVIDER, {
             operation: "inventory_artifact",
             parameters: inventoryParameters,
             result: inventory,
@@ -236,7 +236,7 @@ class ArtifactClient {
             total: 1,
             message: "inventory substep completed",
         });
-        return ok(createAnalysisExecution(result, IDENTITY, {
+        return ok(createAnalysisExecution(result, ARTIFACT_GRAPH_PROVIDER, {
             rawResult: null,
             limitations: result.limitations,
             subject,
@@ -247,9 +247,7 @@ class ArtifactClient {
         return inventoryArtifact(this.target.sourcePath ?? this.target.path, {
             environment: this.environment,
             ...(options?.signal === undefined ? {} : { signal: options.signal }),
-            integrity: resolveArtifactIntegrityPolicy({
-                mode: parsed.integrity_policy,
-            }),
+            integrity: { mode: parsed.integrity_policy },
         });
     }
 }

package/dist/artifacts/ArtifactProviderMetadata.js

@@ -1,12 +1,9 @@
 import { ARTIFACT_GRAPH_PROVIDER } from "../application/InvestigationProviders.js";
 import { ARTIFACT_ANALYSIS_OPERATIONS } from "../contracts/artifactToolContracts.js";
-/** Identity of artifact inventory and owned extraction observations. */
-export const ARTIFACT_PROVIDER_IDENTITY = Object.freeze(ARTIFACT_GRAPH_PROVIDER);
-const IDENTITY = ARTIFACT_PROVIDER_IDENTITY;
 /** Declare artifact coverage without constructing readers or acquiring resources. */
 export const artifactCapabilities = (platform = process.platform) => Object.freeze(ARTIFACT_ANALYSIS_OPERATIONS.map((operation) => {
     const common = {
-        provider: IDENTITY,
+        provider: ARTIFACT_GRAPH_PROVIDER,
         operation,
         effects: Object.freeze({
             mutatesArtifact: false,

package/dist/artifacts/AsarArtifactReader.js

@@ -1,7 +1,10 @@
-import { constants, createReadStream } from "node:fs";
-import { lstat, open, realpath } from "node:fs/promises";
+import { constants, createReadStream, createWriteStream, } from "node:fs";
+import { lstat, mkdtemp, open, realpath, rm, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 import { isAbsolute, join, relative, sep } from "node:path";
-import { Readable } from "node:stream";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { getRawHeader, listPackage, statFile, uncache } from "@electron/asar";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
 import { closeAsarHandle, readValidatedAsarEntry } from "./AsarEntryStream.js";
@@ -15,24 +18,28 @@ import { closeAsarHandle, readValidatedAsarEntry } from "./AsarEntryStream.js";
 export class AsarArtifactReader {
     path;
     openUnpackedFile;
+    removeSnapshot;
     format = "asar";
     #archiveSize;
     #headerSize;
     #entries = new Map();
-    constructor(path, openUnpackedFile = open) {
+    #snapshot;
+    #snapshotRoot;
+    constructor(path, openUnpackedFile = open, removeSnapshot = (path) => rm(path, { recursive: true, force: true })) {
         this.path = path;
         this.openUnpackedFile = openUnpackedFile;
+        this.removeSnapshot = removeSnapshot;
     }
     async *entries(signal) {
         let paths;
         try {
-            // ASAR caches headers by path even after the archive has been replaced.
+            await this.prepareContainer(undefined, signal);
+            const snapshotPath = this.#snapshotPath();
             this.#resetArchiveState();
             this.#entries.clear();
-            uncache(this.path);
-            paths = listPackage(this.path, { isPack: false }).sort((left, right) => left.localeCompare(right, "en"));
-            this.#headerSize = getRawHeader(this.path).headerSize;
-            const archiveMetadata = await lstat(this.path);
+            paths = listPackage(snapshotPath, { isPack: false }).sort((left, right) => left.localeCompare(right, "en"));
+            this.#headerSize = getRawHeader(snapshotPath).headerSize;
+            const archiveMetadata = await lstat(snapshotPath);
             if (!archiveMetadata.isFile() || archiveMetadata.isSymbolicLink())
                 throw new ArtifactReaderFailure("format", "ASAR container is not a regular file");
             this.#archiveSize = archiveMetadata.size;
@@ -54,7 +61,7 @@ export class AsarArtifactReader {
                 : listed;
             let metadata;
             try {
-                metadata = statFile(this.path, providerPath, false);
+                metadata = statFile(this.#snapshotPath(), providerPath, false);
             }
             catch (cause) {
                 throw asarFailure(this.path, `stat ${path}`, cause);
@@ -138,7 +145,7 @@ export class AsarArtifactReader {
             throw new ArtifactReaderFailure("format", `ASAR entry range is outside its container: ${producedEntry.path}`);
         let handle;
         try {
-            const openedHandle = await open(this.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            const openedHandle = await open(this.#snapshotPath(), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
             handle = openedHandle;
             const observed = await openedHandle.stat();
             abortIfNeeded(signal);
@@ -161,16 +168,73 @@ export class AsarArtifactReader {
             throw asarFailure(this.path, `read ${producedEntry.path}`, cause);
         }
     }
-    /** Open raw container bytes to verify the inventory identity before analysis. */
-    openContainer(signal) {
+    /** Capture once per reader lifetime; bind all interpretation to these exact bytes. */
+    async prepareContainer(expectedSha256, signal) {
         abortIfNeeded(signal);
-        return createReadStream(this.path, signal === undefined ? {} : { signal });
+        if (this.#snapshot === undefined && this.#snapshotRoot !== undefined)
+            await this.close();
+        if (this.#snapshot === undefined) {
+            try {
+                this.#snapshotRoot = await mkdtemp(join(tmpdir(), "rea-asar-snapshot-"));
+                const snapshotPath = join(this.#snapshotRoot, "container.asar");
+                const hash = createHash("sha256");
+                const handle = await open(this.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                const source = handle.createReadStream();
+                const digesting = new Transform({
+                    transform(chunk, _encoding, callback) {
+                        hash.update(chunk);
+                        callback(null, chunk);
+                    },
+                });
+                await pipeline(source, digesting, createWriteStream(snapshotPath, { flags: "wx", mode: 0o600 }), signal === undefined ? {} : { signal });
+                this.#snapshot = { path: snapshotPath, sha256: hash.digest("hex") };
+            }
+            catch (cause) {
+                const primary = signal?.aborted === true
+                    ? new ArtifactReaderFailure("cancelled", "ASAR operation cancelled", { cause })
+                    : asarFailure(this.path, "snapshot", cause);
+                try {
+                    await this.close();
+                }
+                catch (cleanupCause) {
+                    throw ArtifactReaderFailure.withCleanup(primary, ArtifactReaderFailure.cleanupObservation(cleanupCause, this.path));
+                }
+                throw primary;
+            }
+        }
+        if (expectedSha256 !== undefined &&
+            this.#snapshot.sha256 !== expectedSha256)
+            throw new ArtifactReaderFailure("integrity", `ASAR container changed before interpretation: ${this.path}`);
+    }
+    /** Read the same captured container that supplies headers and packed members. */
+    async openContainer(signal) {
+        await this.prepareContainer(undefined, signal);
+        return createReadStream(this.#snapshotPath(), signal === undefined ? {} : { signal });
     }
-    close() {
-        uncache(this.path);
+    async close() {
+        const root = this.#snapshotRoot;
+        if (root !== undefined) {
+            try {
+                await this.removeSnapshot(root);
+            }
+            catch (cause) {
+                throw ArtifactReaderFailure.withCleanup(cause, {
+                    reason: `Could not remove ASAR snapshot: ${root}`,
+                    resources: [root],
+                });
+            }
+            this.#snapshotRoot = undefined;
+        }
+        if (this.#snapshot !== undefined)
+            uncache(this.#snapshot.path);
+        this.#snapshot = undefined;
         this.#resetArchiveState();
         this.#entries.clear();
-        return Promise.resolve();
+    }
+    #snapshotPath() {
+        if (this.#snapshot === undefined)
+            throw new ArtifactReaderFailure("integrity", "ASAR snapshot is not available");
+        return this.#snapshot.path;
     }
     provenance() {
         return [];

package/dist/artifacts/DirectoryArtifactReader.js

@@ -1,7 +1,7 @@
 import { constants } from "node:fs";
 import { lstat, open, opendir, realpath } from "node:fs/promises";
 import { isAbsolute, join, relative, sep } from "node:path";
-import { compareCodePoints } from "../domain/canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
 /** Deterministic, non-symlink-following directory reader. */
 export class DirectoryArtifactReader {
@@ -39,7 +39,7 @@ export class DirectoryArtifactReader {
                 await handle.close().catch(() => undefined);
             }
             await withDirectoryIoContext("inspect directory", directory, () => assertContainedDirectory(root, directory));
-            children.sort(compareCodePoints);
+            children.sort(compareUnicodeCodePoints);
             const directories = [];
             for (const name of children) {
                 abortIfNeeded(signal);

package/dist/artifacts/NativeDmgArtifactReader.js

@@ -1,53 +1,48 @@
 import { mkdtemp, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
-import { parse } from "plist";
-import { z } from "zod";
 import { ArtifactReaderFailure, } from "./ArtifactReader.js";
 import { DirectoryArtifactReader } from "./DirectoryArtifactReader.js";
-import { execFileOutput } from "../process/ExecFileOutput.js";
-const DETACH_TIMEOUT_MS = 120_000;
-/**
- * Waits before rechecking devices whose detach failed. A related device's
- * later detach can eject one, `hdiutil info` can still list an ejected device
- * briefly, and a volume can report busy just after it was read.
- */
+import { execFileOutput, execFileOutputFailure, } from "../process/ExecFileOutput.js";
+import { parseNativeDmgAttachOutput, parseNativeDmgInfo, resolveNativeDmgOwnership, } from "./NativeDmgOwnership.js";
+const HDIUTIL_COMMAND_TIMEOUT_MS = 120_000;
+// APFS ejects and busy reporting can lag a detach attempt.
 const DETACH_SETTLE_DELAYS_MS = [250, 500, 1000];
 const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
-const attachOutputSchema = z.object({
-    "system-entities": z.array(z.object({
-        "dev-entry": z.string().startsWith("/dev/"),
-        "mount-point": z.string().optional(),
-    })),
-});
-const infoOutputSchema = z.object({
-    images: z.array(z.object({
-        "system-entities": z.array(z.object({ "dev-entry": z.string() })),
-    })),
-});
+class NativeDmgCommandFailure extends ArtifactReaderFailure {
+    stdout;
+    processNotStarted;
+    constructor(reason, message, stdout, options) {
+        super(reason, message, options?.cause === undefined ? undefined : { cause: options.cause });
+        this.stdout = stdout;
+        this.processNotStarted = options?.processNotStarted ?? false;
+    }
+}
 const createSystemHost = (environment) => ({
     delay,
     async run(arguments_, signal, options) {
         try {
             const { stdout, stderr } = await execFileOutput("/usr/bin/hdiutil", [...arguments_], {
                 env: environment,
+                stopSignal: "SIGTERM",
                 ...(options === undefined ? {} : { timeout: options.timeoutMs }),
                 ...(signal === undefined ? {} : { signal }),
             });
             return { stdout, stderr, exitCode: 0 };
         }
         catch (cause) {
+            const output = execFileOutputFailure(cause);
             if (cause instanceof Error && cause.name === "AbortError")
-                throw new ArtifactReaderFailure("cancelled", "DMG operation cancelled");
-            const exitCode = processExitCode(cause);
+                throw new NativeDmgCommandFailure("cancelled", "DMG operation cancelled", output?.stdout ?? "", { cause });
+            const exitCode = typeof output?.code === "number" ? output.code : processExitCode(cause);
             if (exitCode !== undefined)
                 return {
-                    stdout: processOutput(cause, "stdout"),
-                    stderr: processOutput(cause, "stderr"),
+                    stdout: output?.stdout ?? processOutput(cause, "stdout"),
+                    stderr: output?.stderr ?? processOutput(cause, "stderr"),
                     exitCode,
                     cause,
                 };
-            throw new ArtifactReaderFailure(commandFailureReason(cause, arguments_[0]), `hdiutil ${arguments_[0] ?? "operation"} failed: ${describeCommandFailure(cause, arguments_)}`, { cause });
+            throw new NativeDmgCommandFailure(commandFailureReason(cause, arguments_[0]), `hdiutil ${arguments_[0] ?? "operation"} failed: ${describeCommandFailure(cause, arguments_)}`, output?.stdout ?? "", { cause, processNotStarted: processNotStarted(cause) });
         }
     },
 });
@@ -59,7 +54,13 @@ export class NativeDmgArtifactReader {
     #provenance = [];
     #directory;
     #devices = [];
+    #inventoryConfirmedDevices = new Set();
     #mountRoot;
+    #baselineDevices = new Set();
+    #attachOutput;
+    #attachOutputReturned = false;
+    #attachMayHaveMounted = false;
+    #ownershipUncertainty;
     constructor(path, host) {
         this.path = path;
         this.host = host;
@@ -88,7 +89,7 @@ export class NativeDmgArtifactReader {
         return structuredClone(this.#provenance);
     }
     async close() {
-        let detachFailure;
+        let detachFailure = await this.#reconcileAttachState();
         let remainingDevices = [];
         for (const device of [...this.#devices].reverse()) {
             const failure = await this.#detach(device);
@@ -97,10 +98,7 @@ export class NativeDmgArtifactReader {
                 detachFailure ??= failure;
             }
         }
-        // Detaching a synthesized APFS container also ejects the image that backs
-        // it, so a device whose own detach failed may be gone by the end of the
-        // pass, and hdiutil can list an ejected device or report busy briefly.
-        // Only a device that stays attached through every recheck is a failure.
+        // APFS container detach may briefly leave its backing image listed.
         for (const delayMs of DETACH_SETTLE_DELAYS_MS) {
             if (remainingDevices.length === 0)
                 break;
@@ -120,13 +118,19 @@ export class NativeDmgArtifactReader {
         if (remainingDevices.length === 0)
             detachFailure = undefined;
         this.#devices = remainingDevices.reverse();
-        if (this.#devices.length === 0 && this.#mountRoot !== undefined)
+        if (this.#devices.length === 0 &&
+            this.#mountRoot !== undefined &&
+            !this.#attachMayHaveMounted)
             await rm(this.#mountRoot, { recursive: true, force: true }).then(() => {
                 this.#mountRoot = undefined;
                 this.#directory = undefined;
             }, (cause) => {
                 detachFailure ??= cause;
             });
+        if (this.#attachMayHaveMounted) {
+            detachFailure ??= new Error(this.#ownershipUncertainty ??
+                "hdiutil attachment ownership remains unknown");
+        }
         if (detachFailure !== undefined)
             throw new ArtifactReaderFailure("unavailable", `DMG detach or mount-root cleanup failed for ${JSON.stringify(this.path)}: ${failureMessage(detachFailure)}`, {
                 cause: detachFailure,
@@ -134,6 +138,11 @@ export class NativeDmgArtifactReader {
                     reason: failureMessage(detachFailure),
                     resources: [
                         ...this.#devices.map((device) => `DMG device ${device}`),
+                        ...(this.#attachMayHaveMounted
+                            ? [
+                                `DMG attachment ownership unknown at mount root ${this.#mountRoot ?? this.path}`,
+                            ]
+                            : []),
                         ...(this.#mountRoot === undefined
                             ? []
                             : [`DMG mount root ${this.#mountRoot}`]),
@@ -145,7 +154,7 @@ export class NativeDmgArtifactReader {
     async #detach(device) {
         try {
             await runChecked(this.host, ["detach", device], undefined, {
-                timeoutMs: DETACH_TIMEOUT_MS,
+                timeoutMs: HDIUTIL_COMMAND_TIMEOUT_MS,
             });
             this.#provenance.push(command(["detach", device], ["mount"]));
             return undefined;
@@ -154,18 +163,28 @@ export class NativeDmgArtifactReader {
             return (await this.#isAttached(device)) ? cause : undefined;
         }
     }
-    /**
-     * Report whether hdiutil still lists a device; unknown state counts as
-     * attached. Like detach, this cleanup query runs after the inventory
-     * snapshot has captured provenance, so it is not recorded there.
-     */
+    async #reconcileAttachState() {
+        if (!this.#attachMayHaveMounted)
+            return undefined;
+        try {
+            await this.#resolveAttachOwnership();
+            return undefined;
+        }
+        catch (cause) {
+            this.#ownershipUncertainty = failureMessage(cause);
+            return cause;
+        }
+    }
+    /** Treat unknown hdiutil state as attached during cleanup. */
     async #isAttached(device) {
         try {
-            const info = await runChecked(this.host, ["info", "-plist"], undefined, {
-                timeoutMs: DETACH_TIMEOUT_MS,
-            });
-            const parsed = infoOutputSchema.parse(parse(info.stdout));
-            return parsed.images.some((image) => image["system-entities"].some((entity) => entity["dev-entry"] === device));
+            const parsed = await this.#readInfo();
+            const isListed = parsed.images.some((image) => image["system-entities"].some((entity) => entity["dev-entry"] === device));
+            if (isListed) {
+                this.#inventoryConfirmedDevices.add(device);
+                return true;
+            }
+            return !this.#inventoryConfirmedDevices.has(device);
         }
         catch {
             return true;
@@ -174,44 +193,62 @@ export class NativeDmgArtifactReader {
     async attach(signal) {
         await runChecked(this.host, ["verify", this.path], signal);
         this.#provenance.push(command(["verify", this.path], ["read"]));
-        this.#mountRoot = await realpath(await mkdtemp(join(tmpdir(), "rea-dmg-")));
+        const baseline = await this.#readInfo();
+        this.#baselineDevices = new Set(baseline.images.flatMap((image) => image["system-entities"].map(({ "dev-entry": device }) => device)));
+        const mountRoot = await realpath(await mkdtemp(join(tmpdir(), "rea-dmg-")));
+        this.#mountRoot = mountRoot;
         try {
+            this.#attachMayHaveMounted = true;
             const attached = await runChecked(this.host, [
                 "attach",
                 "-readonly",
                 "-nobrowse",
                 "-plist",
                 "-mountroot",
-                this.#mountRoot,
+                mountRoot,
                 this.path,
-            ], signal);
-            const parsed = attachOutputSchema.parse(parse(attached.stdout));
-            const devices = [
-                ...new Set(parsed["system-entities"].map((entity) => entity["dev-entry"])),
-            ];
-            // Detaching an observed whole disk also detaches its partitions. Do not
-            // subsequently detach the now-unavailable child devices.
-            this.#devices = devices.filter((device) => !devices.some((parent) => /^\/dev\/disk\d+$/u.test(parent) &&
-                device.startsWith(`${parent}s`) &&
-                /^\d+$/u.test(device.slice(parent.length + 1))));
-            if (this.#devices.length === 0)
+            ], signal, { timeoutMs: HDIUTIL_COMMAND_TIMEOUT_MS });
+            this.#attachOutputReturned = true;
+            let parsed;
+            try {
+                parsed = parseNativeDmgAttachOutput(attached.stdout);
+            }
+            catch (cause) {
+                throw new ArtifactReaderFailure("format", "hdiutil returned a malformed attachment plist", { cause });
+            }
+            if (parsed["system-entities"].length === 0)
                 throw new ArtifactReaderFailure("format", "hdiutil returned no attached devices");
-            for (const entity of parsed["system-entities"])
-                if (entity["mount-point"] !== undefined &&
-                    !entity["mount-point"].startsWith(`${this.#mountRoot}/`))
-                    throw new ArtifactReaderFailure("path", "hdiutil mounted outside the owned root");
+            this.#attachOutput = parsed;
+            const ownership = await this.#resolveAttachOwnership();
+            if (ownership !== "owned")
+                throw new ArtifactReaderFailure(ownership === "unknown" ? "unavailable" : "path", ownership === "unknown"
+                    ? `DMG attachment ownership is uncertain: ${this.#ownershipUncertainty ?? "no unique mount under the owned root"}`
+                    : "hdiutil did not mount a new image beneath the owned root");
             this.#provenance.push(command([
                 "attach",
                 "-readonly",
                 "-nobrowse",
                 "-plist",
                 "-mountroot",
-                this.#mountRoot,
+                mountRoot,
                 this.path,
             ], ["read", "mount"]));
-            this.#directory = new DirectoryArtifactReader(this.#mountRoot);
+            this.#directory = new DirectoryArtifactReader(mountRoot);
         }
         catch (cause) {
+            if (cause instanceof NativeDmgCommandFailure && cause.stdout !== "") {
+                try {
+                    this.#attachOutput = parseNativeDmgAttachOutput(cause.stdout);
+                    this.#attachOutputReturned = true;
+                }
+                catch {
+                    // The original command failure remains primary; fresh info still recovers mounts.
+                }
+            }
+            if (cause instanceof NativeDmgCommandFailure && cause.processNotStarted) {
+                this.#attachMayHaveMounted = false;
+                this.#ownershipUncertainty = undefined;
+            }
             let cleanupFailure;
             try {
                 await this.close();
@@ -224,8 +261,57 @@ export class NativeDmgArtifactReader {
             throw cause;
         }
     }
+    async #readInfo() {
+        const info = await runChecked(this.host, ["info", "-plist"], undefined, {
+            timeoutMs: HDIUTIL_COMMAND_TIMEOUT_MS,
+        });
+        return parseNativeDmgInfo(info.stdout);
+    }
+    async #resolveAttachOwnership() {
+        const mountRoot = this.#mountRoot;
+        if (mountRoot === undefined)
+            throw new Error("DMG mount root is unavailable for ownership discovery");
+        const ownership = resolveNativeDmgOwnership({
+            info: await this.#readInfo(),
+            ...(this.#attachOutput === undefined
+                ? {}
+                : { attachOutput: this.#attachOutput }),
+            attachOutputReturned: this.#attachOutputReturned,
+            mountRoot,
+            baselineDevices: this.#baselineDevices,
+        });
+        if (ownership.status === "owned") {
+            this.#devices = [...ownership.devices];
+            if (ownership.source === "info")
+                for (const device of ownership.devices)
+                    this.#inventoryConfirmedDevices.add(device);
+            this.#attachMayHaveMounted = false;
+            this.#ownershipUncertainty = undefined;
+            return "owned";
+        }
+        if (ownership.status === "unknown") {
+            this.#ownershipUncertainty = ownership.reason;
+            return "unknown";
+        }
+        this.#attachMayHaveMounted = false;
+        this.#ownershipUncertainty = undefined;
+        this.#devices = [];
+        return "none";
+    }
 }
 const failureMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
+const processNotStarted = (cause) => {
+    if (!(cause instanceof Error))
+        return false;
+    const syscall = Reflect.get(cause, "syscall");
+    const code = Reflect.get(cause, "code");
+    const errno = Reflect.get(cause, "errno");
+    return (typeof syscall === "string" &&
+        syscall.startsWith("spawn ") &&
+        (typeof code === "string" ||
+            typeof code === "number" ||
+            typeof errno === "number"));
+};
 const runChecked = async (host, arguments_, signal, options) => {
     let result;
     try {
@@ -235,10 +321,9 @@ const runChecked = async (host, arguments_, signal, options) => {
         if (cause instanceof ArtifactReaderFailure)
             throw cause;
         if (cause instanceof Error && cause.name === "AbortError")
-            throw new ArtifactReaderFailure("cancelled", "DMG operation cancelled", {
-                cause,
-            });
-        throw new ArtifactReaderFailure(commandFailureReason(cause, arguments_[0]), `hdiutil ${arguments_[0] ?? "operation"} failed: ${describeCommandFailure(cause, arguments_)}`, { cause });
+            throw new NativeDmgCommandFailure("cancelled", "DMG operation cancelled", execFileOutputFailure(cause)?.stdout ?? "", { cause });
+        const output = execFileOutputFailure(cause);
+        throw new NativeDmgCommandFailure(commandFailureReason(cause, arguments_[0]), `hdiutil ${arguments_[0] ?? "operation"} failed: ${describeCommandFailure(cause, arguments_)}`, output?.stdout ?? "", { cause, processNotStarted: processNotStarted(cause) });
     }
     if (result.exitCode !== 0) {
         const failure = {
@@ -253,9 +338,9 @@ const runChecked = async (host, arguments_, signal, options) => {
         const reason = commandFailureReason(failure, arguments_[0]);
         const details = describeCommandFailure(failure, arguments_);
         const unknownVerifyFailure = arguments_[0] === "verify" && reason === "unavailable";
-        throw new ArtifactReaderFailure(reason, unknownVerifyFailure
+        throw new NativeDmgCommandFailure(reason, unknownVerifyFailure
             ? `hdiutil verify failed; captured diagnostics do not establish the failure cause: ${details}`
-            : `hdiutil ${arguments_[0] ?? "operation"} failed: ${details}`, result.cause === undefined ? undefined : { cause: result.cause });
+            : `hdiutil ${arguments_[0] ?? "operation"} failed: ${details}`, result.stdout, { cause: result.cause ?? failure });
     }
     return { stdout: result.stdout, exitCode: 0 };
 };