rea-agents 6.4.0 → 6.7.0

package/dist/native/AppleObjcDispatchFacets.js

@@ -1,10 +1,17 @@
+import { err, ok } from "../domain/result.js";
 import { boundClassName, decodeObjcCategories } from "./AppleObjcCategories.js";
 import { readObjcPropertiesOf } from "./AppleObjcProperties.js";
 import { createObjcProtocolReader } from "./AppleObjcProtocols.js";
 const hex = (value) => `0x${value.toString(16)}`;
 const decoded = { status: "decoded", reason: null };
-/** Name of a class defined in this image, from its class_ro_t. */
-const localClassName = (read, address) => read.string(read.pointer((read.pointer(address + 32n) & ~7n) + 24n));
+/** Admit the local class identity once for classes, superclasses and categories. */
+const readLocalClass = (read, address) => {
+    const ro = read.pointer(address + 32n) & ~7n;
+    const name = read.string(read.pointer(ro + 24n));
+    if (name.length === 0)
+        throw new TypeError(`Objective-C class at ${hex(address)} has an empty name`);
+    return { ro, name };
+};
 /**
  * Resolve a class's superclass: a bind to `_OBJC_CLASS_$_Name` names a class
  * in another image; otherwise the pointer is a class_t in this image.
@@ -17,18 +24,19 @@ const resolveSuperclass = (read, address, className, failures) => {
     if (superclass === 0n)
         return { name: null, address: null };
     try {
-        return { name: localClassName(read, superclass), address: hex(superclass) };
+        return {
+            name: readLocalClass(read, superclass).name,
+            address: hex(superclass),
+        };
     }
     catch (cause) {
-        // Superclass resolution failure is recorded; the cause adds no identity.
-        void cause;
-        failures.push(`Superclass pointer ${hex(superclass)} of ${className} requires unsupported binding/fixup resolution`);
+        failures.push(`Superclass pointer ${hex(superclass)} of ${className} could not be decoded: ${cause instanceof Error ? cause.message : String(cause)}`);
         return { name: null, address: hex(superclass) };
     }
 };
 /** Decode Objective-C protocol lists, classlists, methods, and ivars into `result`. */
 export const decodeObjcDispatchFacets = (input) => {
-    const { bytes, sections, segments, readers: read, budget, result } = input;
+    const { bytes, sections, segments, readers: read, budget, maxListSlots, result, } = input;
     const failures = [];
     const categoryIssues = [];
     let examined = 0;
@@ -88,6 +96,8 @@ export const decodeObjcDispatchFacets = (input) => {
                 void cause;
             }
             const selector = read.string(selectorAddress);
+            if (selector.length === 0)
+                throw new TypeError("Objective-C method has an empty selector");
             selectors.push(selector);
             result.objc_dispatch_implementations.push({
                 class_name: className,
@@ -123,6 +133,32 @@ export const decodeObjcDispatchFacets = (input) => {
         result,
         failures,
     });
+    // Each list scan has its own slot bound: zero and duplicate pointers do
+    // not produce records, but still consume pointer-reading work. The bound
+    // is per list so one list's slots cannot starve the other list's scan.
+    // Record decoders retain their existing admission ownership.
+    let objcListScanTruncated = false;
+    let objcClassListScanTruncated = false;
+    const createListSlotReader = () => {
+        let listSlotsExamined = 0;
+        return (field) => {
+            if (listSlotsExamined >= maxListSlots) {
+                objcListScanTruncated = true;
+                return err("exhausted");
+            }
+            listSlotsExamined++;
+            try {
+                return ok(read.pointer(field));
+            }
+            catch (cause) {
+                const admitted = budget.admit();
+                failures.push(`${hex(field)}: ${cause instanceof Error ? cause.message : String(cause)}`);
+                return err(admitted ? "unmapped" : "exhausted");
+            }
+        };
+    };
+    const readProtocolListSlot = createListSlotReader();
+    const readClassListSlot = createListSlotReader();
     for (const section of sections.filter(({ name }) => name === "__objc_protolist")) {
         if (section.size % 8 !== 0)
             throw new RangeError("Misaligned Objective-C protocol list");
@@ -131,7 +167,21 @@ export const decodeObjcDispatchFacets = (input) => {
                 budget.markTruncated();
                 break;
             }
-            protocolReader.record(read.pointer(section.address + BigInt(index * 8)));
+            const field = section.address + BigInt(index * 8);
+            const pointer = readProtocolListSlot(field);
+            if (!pointer.ok) {
+                if (pointer.error === "exhausted")
+                    break;
+                continue;
+            }
+            try {
+                protocolReader.record(pointer.value);
+            }
+            catch (cause) {
+                // record() admits the slot itself before decoding, so admitting
+                // again here would count one protocol twice.
+                failures.push(`${hex(field)}: ${cause instanceof Error ? cause.message : String(cause)}`);
+            }
         }
     }
     const visited = new Set();
@@ -139,8 +189,7 @@ export const decodeObjcDispatchFacets = (input) => {
         if (address === 0n || visited.has(hex(address)) || !budget.admit())
             return;
         visited.add(hex(address));
-        const ro = read.pointer(address + 32n) & ~7n;
-        const name = read.string(read.pointer(ro + 24n));
+        const { ro, name } = readLocalClass(read, address);
         const root = (read.u32(ro) & 2) !== 0;
         const superclass = resolveSuperclass(read, address, name, failures);
         if (superclass.name === null && superclass.address === null && !root)
@@ -166,13 +215,22 @@ export const decodeObjcDispatchFacets = (input) => {
                     void cause;
                     failures.push(`Unresolved ivar offset pointer ${hex(encodedOffset)}`);
                 }
+                const ivarName = read.string(read.pointer(entry + 8n));
+                if (ivarName.length === 0)
+                    throw new TypeError("Objective-C ivar has an empty name");
+                const alignment = read.u32(entry + 24n);
                 result.objc_ivars.push({
                     class_name: name,
-                    name: read.string(read.pointer(entry + 8n)),
+                    name: ivarName,
                     type_encoding: read.string(read.pointer(entry + 16n)),
                     offset: value,
                     size: read.u32(entry + 28n),
-                    alignment: read.u32(entry + 24n) < 31 ? 2 ** read.u32(entry + 24n) : null,
+                    // objc4 ivar_t::alignment(): ~0 means word alignment (8 for 32-byte entries).
+                    alignment: alignment === 0xffffffff
+                        ? 8
+                        : alignment < 31
+                            ? 2 ** alignment
+                            : null,
                     location: read.location(entry),
                     decode: value === null
                         ? { status: "partial", reason: "ivar_offset_pointer_unresolved" }
@@ -235,12 +293,26 @@ export const decodeObjcDispatchFacets = (input) => {
                 budget.markTruncated();
                 break;
             }
-            examined++;
             const field = section.address + BigInt(index * 8);
+            const pointer = readClassListSlot(field);
+            if (pointer.ok || pointer.error === "unmapped")
+                examined++;
+            if (!pointer.ok) {
+                if (pointer.error === "exhausted") {
+                    objcClassListScanTruncated = true;
+                    break;
+                }
+                continue;
+            }
             try {
-                readClass(read.pointer(field));
+                readClass(pointer.value);
             }
             catch (cause) {
+                // The slot was already admitted inside readClass before anything
+                // could throw (its admit runs before the first pointer read), so
+                // admitting again here would count one class twice: at the budget
+                // boundary it would break before appending the failure reason, and
+                // with larger limits malformed classes would starve valid ones.
                 failures.push(`${hex(field)}: ${cause instanceof Error ? cause.message : String(cause)}`);
             }
         }
@@ -249,12 +321,18 @@ export const decodeObjcDispatchFacets = (input) => {
         sections,
         read,
         result,
-        failures,
         issues: categoryIssues,
         admit: () => budget.admit(),
         methods,
         protocols: (list) => protocolReader.list(list),
-        localClassName: (address) => localClassName(read, address),
+        localClassName: (address) => readLocalClass(read, address).name,
     });
-    return { failures, categoryIssues, examined, categoriesExamined };
+    return {
+        failures,
+        categoryIssues,
+        examined,
+        categoriesExamined,
+        objcListScanTruncated,
+        objcClassListScanTruncated,
+    };
 };

package/dist/native/AppleObjcProperties.js

@@ -3,15 +3,24 @@ import { issue } from "./AppleDispatchDecodeFacts.js";
  * Parse an `@property` attribute string such as `T@"NSString",C,N,V_name`.
  * Each comma-separated token is one attribute; `T` is the type encoding.
  */
-export const parsePropertyAttributes = (name, attributes) => {
-    const tokens = attributes.length === 0 ? [] : splitAttributes(attributes);
+export const parsePropertyAttributes = (name, attributes) => decodePropertyAttributes(name, attributes).property;
+/**
+ * Decode one attribute string. A quoted class name that never closes leaves
+ * the string incomplete: later attributes may be inside the unfinished type,
+ * so a missing `N` or `R` does not establish the Objective-C defaults.
+ */
+const decodePropertyAttributes = (name, attributes) => {
+    const { tokens, complete } = attributes.length === 0
+        ? { tokens: [], complete: true }
+        : splitAttributes(attributes);
     const typeAttributes = tokens.filter((token) => token[0] === "T");
     const typeAttribute = typeAttributes.length === 1 ? typeAttributes[0] : undefined;
     const typeEncoding = typeAttribute !== undefined && typeAttribute.length > 1
         ? typeAttribute.slice(1)
         : null;
     const value = (code) => tokens.find((token) => token[0] === code)?.slice(1) ?? null;
-    return {
+    const defaultsEstablished = typeEncoding !== null && complete;
+    const property = {
         name,
         type_encoding: typeEncoding,
         attributes: tokens.map((token) => ({
@@ -20,19 +29,23 @@ export const parsePropertyAttributes = (name, attributes) => {
         })),
         atomicity: tokens.includes("N")
             ? "nonatomic"
-            : typeEncoding === null
-                ? null
-                : "atomic",
+            : defaultsEstablished
+                ? "atomic"
+                : null,
         is_readonly: tokens.includes("R")
             ? true
-            : typeEncoding === null
-                ? null
-                : false,
+            : defaultsEstablished
+                ? false
+                : null,
         getter: value("G"),
         setter: value("S"),
     };
+    return { property, complete };
 };
-/** Split on commas that are outside a quoted class name in the type encoding. */
+/**
+ * Split on commas that are outside a quoted class name in the type encoding,
+ * and report whether every quote closed.
+ */
 const splitAttributes = (attributes) => {
     const tokens = [];
     let current = "";
@@ -48,29 +61,60 @@ const splitAttributes = (attributes) => {
             current += character;
     }
     tokens.push(current);
-    return tokens.filter((token) => token.length > 0);
+    return {
+        tokens: tokens.filter((token) => token.length > 0),
+        complete: !quoted,
+    };
 };
-/** Decode `property_list_t { entsize_and_flags, count, property_t[] }`. */
+/**
+ * Decode `property_list_t { entsize_and_flags, count, property_t[] }`. Each
+ * entry is decoded on its own, so one malformed entry is reported without
+ * discarding the properties decoded before or after it.
+ */
 export const readObjcPropertyList = (read, list, admit) => {
+    const properties = [];
+    const issues = [];
     if (list === 0n)
-        return [];
+        return { properties, issues };
     const entrySize = read.u32(list) & ~3;
     const count = read.u32(list + 4n);
     if (entrySize !== 16)
         throw new TypeError(`Unsupported Objective-C property entry size ${entrySize}`);
-    const properties = [];
     for (let index = 0; index < count; index++) {
         if (!admit())
             break;
         const entry = list + 8n + BigInt(index * entrySize);
-        properties.push(parsePropertyAttributes(read.string(read.pointer(entry)), read.string(read.pointer(entry + 8n))));
+        const location = `0x${entry.toString(16)}`;
+        try {
+            const name = read.string(read.pointer(entry));
+            if (name.length === 0)
+                throw new TypeError("the property name is empty");
+            const decoded = decodePropertyAttributes(name, read.string(read.pointer(entry + 8n)));
+            properties.push(decoded.property);
+            if (!decoded.complete)
+                issues.push({
+                    code: "property_attributes_incomplete",
+                    message: `property ${name} has an unterminated quoted class name in its type attribute, so atomicity and unestablished read-only state are unknown`,
+                    location,
+                });
+        }
+        catch (cause) {
+            issues.push({
+                code: "property_decode_failed",
+                message: `property ${String(index)} could not be decoded: ${cause instanceof Error ? cause.message : String(cause)}`,
+                location,
+            });
+        }
     }
-    return properties;
+    return { properties, issues };
 };
 /** Decode a property list, recording a failure for `owner` instead of throwing. */
 export const readObjcPropertiesOf = (read, list, context) => {
     try {
-        return readObjcPropertyList(read, list, context.admit);
+        const { properties, issues } = readObjcPropertyList(read, list, context.admit);
+        for (const item of issues)
+            context.issues.push(issue("objc_properties_categories", item.code, `${context.owner}: ${item.message}`, item.location));
+        return properties;
     }
     catch (cause) {
         context.issues.push(issue("objc_properties_categories", "property_decode_failed", `${context.owner}: ${cause instanceof Error ? cause.message : String(cause)}`, context.location));

package/dist/native/AppleObjcProtocols.js

@@ -20,7 +20,9 @@ export const createObjcProtocolReader = (input) => {
         }
         return names;
     };
-    const methods = (address, required, instance) => {
+    const methods = (address, required, instance, 
+    /** Entries skipped for an empty selector, reported by the declaring protocol. */
+    emptySelectors) => {
         const output = [];
         if (address === 0n)
             return output;
@@ -38,8 +40,15 @@ export const createObjcProtocolReader = (input) => {
                 : read.pointer(entry);
             if (relative && (flags & 0x40000000) === 0)
                 selector = read.pointer(selector);
+            // One empty selector is reported on its own, so the protocol and its
+            // other method declarations keep their decoded records.
+            const selectorName = read.string(selector);
+            if (selectorName.length === 0) {
+                emptySelectors.push(`${required ? "required" : "optional"} ${instance ? "instance" : "class"} method ${String(index)} at 0x${entry.toString(16)} has an empty selector`);
+                continue;
+            }
             output.push({
-                selector: read.string(selector),
+                selector: selectorName,
                 method_type: instance ? "instance" : "class",
                 address: null,
                 is_required: required,
@@ -56,15 +65,22 @@ export const createObjcProtocolReader = (input) => {
             if (read.u32(address + 64n) < 72)
                 throw new RangeError("Truncated Objective-C protocol declaration");
             const protocolName = name(address);
+            // Adopted protocols are independent declarations; decode them before
+            // rejecting a parent whose own name is empty.
             const adopted = list(read.pointer(address + 16n));
+            if (protocolName.length === 0)
+                throw new TypeError("Objective-C protocol has an empty name");
+            const skipped = [];
             const required = [
-                ...methods(read.pointer(address + 24n), true, true),
-                ...methods(read.pointer(address + 32n), true, false),
+                ...methods(read.pointer(address + 24n), true, true, skipped),
+                ...methods(read.pointer(address + 32n), true, false, skipped),
             ];
             const optional = [
-                ...methods(read.pointer(address + 40n), false, true),
-                ...methods(read.pointer(address + 48n), false, false),
+                ...methods(read.pointer(address + 40n), false, true, skipped),
+                ...methods(read.pointer(address + 48n), false, false, skipped),
             ];
+            for (const message of skipped)
+                failures.push(`Protocol 0x${address.toString(16)}: Objective-C protocol ${protocolName} ${message}`);
             result.objc_protocols.push({
                 name: protocolName,
                 methods: required,
@@ -77,7 +93,9 @@ export const createObjcProtocolReader = (input) => {
                 methods: required,
                 optional_methods: optional,
                 location: read.location(address),
-                decode: { status: "decoded", reason: null },
+                decode: skipped.length === 0
+                    ? { status: "decoded", reason: null }
+                    : { status: "partial", reason: "protocol_method_selector_empty" },
                 evidence: read.evidence(address, "Objective-C protocol declaration and encoded method lists; IMP fields are not handler targets"),
             });
         }

package/dist/native/AppleSwiftVtables.js

@@ -35,6 +35,8 @@ export const decodeSwiftClassVtables = (input) => {
             if (count > 20000 || tableOffset + count > positiveWords)
                 throw new RangeError("Swift vtable count or offset exceeds declared metadata bounds");
             const owner = read.string(read.relative(descriptor + 8n));
+            if (owner.length === 0)
+                throw new RangeError("Swift class vtable descriptor class name is empty");
             for (let index = 0; index < count; index++) {
                 const entry = header + 8n + BigInt(index * 8);
                 if (!read.admit()) {

package/dist/native/CommandRunner.js

@@ -3,11 +3,19 @@ import { createHash, randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { realpath } from "node:fs/promises";
 import { err, ok } from "../domain/result.js";
+import { DarwinProcessOwnershipInspectionError } from "../process/DarwinProcessRunTokenReader.js";
 import { OwnedCommandFailure, runOwnedCommand, } from "../process/OwnedCommand.js";
+import { boundedUtf8Text } from "../process/boundedUtf8Text.js";
 /** Maximum wall-clock duration for one native command. */
 export const NATIVE_COMMAND_TIMEOUT_MS = 60_000;
 /** Retain complete command output up to a bounded aggregate size. */
 export const NATIVE_COMMAND_OUTPUT_BUDGET_BYTES = 64 * 1024 * 1024;
+/**
+ * Failure diagnostics keep only an excerpt of each stream. Successful
+ * analysis needs complete output, but a failed command's error would
+ * otherwise repeat up to the whole output budget to the caller.
+ */
+export const NATIVE_FAILURE_DIAGNOSTIC_BYTES = 64 * 1024;
 /** Native command failure with retained partial output and cleanup status. */
 export class NativeCommandFailure extends Error {
     tool;
@@ -16,6 +24,10 @@ export class NativeCommandFailure extends Error {
     capture;
     cleanupFailure;
     cleanupResources;
+    cleanupOwner;
+    cleanupFailures;
+    detail;
+    preparationFailure;
     constructor(tool, reason, exitCode = null, options, capture = null, cleanupFailure = null, cleanupResources = []) {
         super(`Native command ${tool} failed: ${reason}`, options);
         this.tool = tool;
@@ -24,37 +36,114 @@ export class NativeCommandFailure extends Error {
         this.capture = capture;
         this.cleanupFailure = cleanupFailure;
         this.cleanupResources = cleanupResources;
+        this.cleanupOwner = options?.cleanupOwner;
+        this.cleanupFailures = options?.cleanupFailures ?? [];
+        this.preparationFailure =
+            options?.cause instanceof DarwinProcessOwnershipInspectionError
+                ? options.cause
+                : options?.cause instanceof NativeCommandFailure ||
+                    options?.cause instanceof OwnedCommandFailure
+                    ? options.cause.preparationFailure
+                    : undefined;
+        this.detail = options?.detail ?? this.preparationFailure?.message ?? null;
     }
 }
 /** Run allowlisted Xcode tools directly without a shell. */
 export class XcrunCommandRunner {
     resolveTool;
+    launcher;
     environment;
-    constructor(environment, resolveTool = (tool, signal) => resolveXcrunTool(tool, this.environment, signal)) {
+    #pendingCleanup = new Set();
+    #cleanupAttempt;
+    constructor(environment, resolveTool = (tool, signal) => resolveXcrunTool(tool, this.environment, signal, this.launcher), launcher) {
         this.resolveTool = resolveTool;
+        this.launcher = launcher;
         this.environment = snapshotEnvironment(environment);
     }
     run(tool, arguments_, options) {
         if (!ALLOWED_TOOLS.has(tool))
             return Promise.resolve(err(new NativeCommandFailure(tool, "unavailable")));
-        return this.resolveTool(tool, options.signal).then(async (resolved) => {
-            if (!resolved.ok)
-                return resolved;
-            const captured = await captureProcess(resolved.value.path, arguments_, tool, options, this.environment);
-            return captured.ok
-                ? ok({
-                    ...captured.value,
-                    tool,
-                    executable: resolved.value.path,
-                    executableSha256: resolved.value.sha256,
-                    toolVersion: null,
-                    versionReason: "Tool exposes no uniform stable version flag; executable SHA-256 is a prelaunch file sample and does not prove atomic OS image binding.",
-                    arguments: [...arguments_],
-                })
-                : captured;
+        return this.#runAfterCleanup(tool, arguments_, options);
+    }
+    /** Retry every retained owner; a failed retry prevents another command launch. */
+    retryCleanup() {
+        if (this.#pendingCleanup.size === 0)
+            return Promise.resolve([]);
+        if (this.#cleanupAttempt !== undefined)
+            return this.#cleanupAttempt;
+        this.#cleanupAttempt = this.#retryCleanup().finally(() => {
+            this.#cleanupAttempt = undefined;
         });
+        return this.#cleanupAttempt;
+    }
+    async #runAfterCleanup(tool, arguments_, options) {
+        const pendingFailures = await this.retryCleanup();
+        if (pendingFailures.length > 0)
+            return err(commandCleanupFailure(tool, pendingFailures));
+        const resolved = await this.resolveTool(tool, options.signal, this.launcher);
+        if (!resolved.ok) {
+            if (resolved.error.cleanupOwner !== undefined)
+                this.#pendingCleanup.add(resolved.error.cleanupOwner);
+            return resolved;
+        }
+        const captured = await captureProcess(resolved.value.path, arguments_, tool, options, this.environment, this.launcher);
+        if (!captured.ok && captured.error.cleanupOwner !== undefined)
+            this.#pendingCleanup.add(captured.error.cleanupOwner);
+        return captured.ok
+            ? ok({
+                ...captured.value,
+                tool,
+                executable: resolved.value.path,
+                executableSha256: resolved.value.sha256,
+                toolVersion: null,
+                versionReason: "Tool exposes no uniform stable version flag; executable SHA-256 is a prelaunch file sample and does not prove atomic OS image binding.",
+                arguments: [...arguments_],
+            })
+            : captured;
+    }
+    async #retryCleanup() {
+        const failures = [];
+        for (const owner of this.#pendingCleanup) {
+            let reason;
+            try {
+                const stopped = await owner.stop();
+                if (stopped.status !== "incomplete") {
+                    this.#pendingCleanup.delete(owner);
+                    continue;
+                }
+                reason = stopped.reason || "native command cleanup remains unverified";
+            }
+            catch (cause) {
+                reason =
+                    cause instanceof Error
+                        ? cause.message || cause.name
+                        : String(cause) || "native command cleanup failed unexpectedly";
+            }
+            failures.push({
+                owner,
+                reason: reason ?? "native command cleanup remains unverified",
+                resources: commandProcessResources(owner),
+            });
+        }
+        return failures;
     }
 }
+const commandProcessResources = (owner) => {
+    const ownership = owner.launch.ownership;
+    return ownership === undefined
+        ? ["native-command-process"]
+        : [
+            ownership.runId,
+            `pid:${String(ownership.leaderPid)}`,
+            `process-group:${String(ownership.processGroupId)}`,
+        ];
+};
+const commandCleanupFailure = (tool, failures) => new NativeCommandFailure(tool, "io", null, {
+    cleanupFailures: failures,
+    cause: new AggregateError(failures.map(({ reason, resources }) => new Error(`${reason} (${resources.join(", ")})`)), "Previously owned native command cleanup remains incomplete"),
+}, null, failures
+    .map(({ reason, resources }) => `${resources.join(", ")}: ${reason}`)
+    .join("; "), [...new Set(failures.flatMap(({ resources }) => resources))]);
 const ALLOWED_TOOLS = new Set([
     "codesign",
     "dyld_info",
@@ -69,13 +158,24 @@ const ALLOWED_TOOLS = new Set([
     "vtool",
 ]);
 /** Locate an Xcode tool through `xcrun --find` and sample its executable digest. */
-export const resolveXcrunTool = async (tool, environment, signal) => {
-    const found = await captureProcess("/usr/bin/xcrun", ["--find", tool], "xcrun", signal === undefined ? {} : { signal }, environment);
+export const resolveXcrunTool = async (tool, environment, signal, launcher) => {
+    const found = await captureProcess("/usr/bin/xcrun", ["--find", tool], "xcrun", signal === undefined ? {} : { signal }, environment, launcher);
     if (!found.ok) {
         return err(new NativeCommandFailure(tool, found.error.reason === "nonzero-exit" ||
             found.error.reason === "unavailable"
             ? "unavailable"
-            : found.error.reason, found.error.exitCode, { cause: found.error }, found.error.capture, found.error.cleanupFailure, found.error.cleanupResources));
+            : found.error.reason, found.error.exitCode, {
+            cause: found.error,
+            ...(found.error.cleanupOwner === undefined
+                ? {}
+                : { cleanupOwner: found.error.cleanupOwner }),
+            ...(found.error.cleanupFailures.length === 0
+                ? {}
+                : { cleanupFailures: found.error.cleanupFailures }),
+            ...(found.error.detail === null
+                ? {}
+                : { detail: found.error.detail }),
+        }, found.error.capture, found.error.cleanupFailure, found.error.cleanupResources));
     }
     if (found.value.exitCode !== 0)
         return err(new NativeCommandFailure(tool, "unavailable", found.value.exitCode, undefined, failureCapture(found.value, false)));
@@ -93,16 +193,22 @@ export const resolveXcrunTool = async (tool, environment, signal) => {
         return err(new NativeCommandFailure(tool, "io", capture.exitCode, { cause }, capture));
     }
 };
-const failureCapture = (capture, truncated) => ({
-    stdout: capture.stdout,
-    stderr: capture.stderr,
-    stdoutBytes: capture.stdoutBytes,
-    stderrBytes: capture.stderrBytes,
-    exitCode: capture.exitCode,
-    signal: capture.signal,
-    truncated,
-});
-const captureProcess = async (executable, arguments_, tool, options, environment) => {
+/** Bound one command's output for failure diagnostics, keeping observed byte totals. */
+export const failureCapture = (capture, truncated) => {
+    const stdout = boundedUtf8Text(capture.stdout, NATIVE_FAILURE_DIAGNOSTIC_BYTES);
+    const stderr = boundedUtf8Text(capture.stderr, NATIVE_FAILURE_DIAGNOSTIC_BYTES);
+    return {
+        stdout: stdout.text,
+        stderr: stderr.text,
+        // Byte counts stay the observed totals, not the excerpt lengths.
+        stdoutBytes: capture.stdoutBytes,
+        stderrBytes: capture.stderrBytes,
+        exitCode: capture.exitCode,
+        signal: capture.signal,
+        truncated: truncated || stdout.truncated || stderr.truncated,
+    };
+};
+const captureProcess = async (executable, arguments_, tool, options, environment, launcher) => {
     const runId = `rea-native-command-${randomUUID()}`;
     try {
         const snapshot = await runOwnedCommand({
@@ -119,7 +225,7 @@ const captureProcess = async (executable, arguments_, tool, options, environment
             timeoutMs: NATIVE_COMMAND_TIMEOUT_MS,
             diagnosticBytes: NATIVE_COMMAND_OUTPUT_BUDGET_BYTES,
             acceptNonZeroExit: options.acceptNonZero === true,
-        });
+        }, launcher === undefined ? {} : { launcher });
         return ok(processCaptureFromSnapshot(snapshot));
     }
     catch (cause) {
@@ -129,9 +235,17 @@ const captureProcess = async (executable, arguments_, tool, options, environment
                 : failureCapture(processCaptureFromSnapshot(cause.snapshot), cause.snapshot.diagnosticTruncated === true);
             return err(new NativeCommandFailure(tool, cause.reason === "process"
                 ? processFailureReason(capture)
-                : cause.reason, capture?.exitCode ?? null, { cause }, capture, cause.cleanupFailure, cause.resources));
+                : cause.reason, capture?.exitCode ?? null, {
+                cause,
+                ...(cause.cleanupOwner === undefined
+                    ? {}
+                    : { cleanupOwner: cause.cleanupOwner }),
+            }, capture, cause.cleanupFailure, cause.resources));
         }
-        return err(new NativeCommandFailure(tool, "io", null, { cause }));
+        return err(new NativeCommandFailure(tool, cause instanceof DarwinProcessOwnershipInspectionError &&
+            cause.cancellation !== undefined
+            ? "cancelled"
+            : "io", null, { cause }));
     }
 };
 const processFailureReason = (capture) => capture !== null &&