narvy-cli 1.1.0__tar.gz → 1.1.2__tar.gz

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/CHANGELOG.md

@@ -5,6 +5,88 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.2]
+
+### Added
+
+- `python -m narvy` (`py -m narvy` on Windows) runs the CLI. It works when
+  pip put the `narvy` command in a directory that is not on PATH, the
+  default for a user install on Windows and macOS. Run that way, Narvy
+  prints once the command that adds the directory to PATH (PowerShell on
+  Windows, your shell rc file elsewhere). It never changes PATH itself;
+  `NARVY_NO_PATH_HINT=1` turns the hint off.
+- README: install steps for Windows, macOS (Homebrew
+  `externally-managed-environment`) and Linux, with pipx first.
+
+### Fixed
+
+- A user install run as `python -m narvy` (or by the launcher's full path)
+  did not find semgrep in the same off-PATH directory, skipped the code pass
+  and reported only dependency CVEs. semgrep is now looked up there and its
+  directory is put on the PATH it runs with (it starts `pysemgrep` through
+  PATH).
+- macOS: when no Java 11+ was installed, the downloaded JRE was never found
+  ("no bin/ dir found inside"), so APK scans failed on every such Mac. The
+  macOS layout (`Contents/Home/bin`) is handled, Apple Silicon and ARM Linux
+  get the native aarch64 JRE instead of x64, and a cached JRE that does not
+  run is downloaded again.
+- Windows: jadx failed to start when its path contained a space (a user name
+  like `Jean Dupont`, or `C:\Program Files`), because `cmd /c` stripped the
+  wrong quotes. The jadx command line now goes through `cmd /d /s /c` as one
+  quoted string.
+- Windows: tool output (semgrep, jadx, nuclei, ssh) is decoded as UTF-8
+  instead of the console code page, semgrep runs in Python UTF-8 mode, and
+  output redirected to a file or pipe replaces a character the code page
+  cannot encode instead of stopping the scan with `UnicodeEncodeError`.
+- A file still locked in a temporary directory (antivirus, a slow child
+  process) no longer fails the scan at cleanup.
+- SCA: only one version of each package was checked. A lockfile that holds
+  `minimist 1.2.8` and a nested `minimist 0.0.8` now checks both. A version
+  taken from a manifest range is still dropped when a lockfile resolves that
+  package.
+- yarn.lock (berry): the package comes from the `resolution:` line, so
+  aliases (`string-width-cjs@npm:string-width@...`) and `patch:` entries
+  name the real package, and `__metadata`, workspace, git and local entries
+  are no longer sent to OSV as packages.
+- semgrep with more than one worker drops taint-mode results at random with
+  no error. Every rule pack that holds a taint rule now runs in its own
+  single-worker semgrep process (packs still run side by side). Files where
+  a rule hit the per-file timeout are named in the scan notes.
+
+### Changed
+
+- Community rule precision round (PHP, JavaScript, Go, Java, Python, Ruby):
+  fewer findings on code that is not reachable by an attacker. Informational
+  rules are lowered to LOW with the reason.
+
+## [1.1.1]
+
+### Added
+
+- Flask cookie checks: `set_cookie()` without `httponly=True` or
+  `secure=True`, the same checks Django already had.
+- `scan` warns when files or folders could not be read (permissions) instead
+  of skipping them silently; `-v` lists them and the JSON report has
+  `summary.unreadable_paths`.
+- `scan --format` is accepted as an alias of `--output`, like the other
+  commands.
+
+### Fixed
+
+- A second `scan` of the same folder picked up the report written by the
+  first one (`narvy.sarif`, the JSON report) and flagged the rule text quoted
+  in it as secrets. Narvy reports are now recognized by their content, and
+  the `--file` target is never scanned.
+- `--upload` with only `NARVY_TOKEN` set printed "Uploading ... to  for
+  server-side curation". The line now names the server (`narvy.io`, or
+  `NARVY_URL`), and a failed upload or login says which server refused it.
+- `web-scan http://localhost` said "internal/metadata addresses"; it now says
+  the address is loopback and explains why local and private targets are
+  refused.
+- The web-scan, host-audit and cloud-scan JSON output carries a `tool` field.
+- `narvy doctor` documents its exit codes (0 all required checks pass, 1 one
+  failed).
+
 ## [1.1.0]
 
 First release of the community rule set. The 1.0.x preview releases were

{narvy_cli-1.1.0/narvy_cli.egg-info → narvy_cli-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.1.0
+Version: 1.1.2
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -63,11 +63,83 @@ exactly in [Telemetry](#telemetry), which you can turn off.
 ## Install
 
 ```bash
-pip install narvy-cli
+pipx install narvy-cli      # recommended, puts `narvy` on PATH (run `pipx ensurepath` once)
+pip install narvy-cli       # or plain pip
 ```
 
-Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
-auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+If your shell says `narvy: command not found` / `The term 'narvy' is not
+recognized`, pip installed the command into a directory that is not on your
+PATH. `python -m narvy` always works (`py -m narvy` on Windows), and prints
+once the command that adds that directory to PATH. Narvy never edits PATH
+itself.
+
+### Windows
+
+Recommended, with [pipx](https://pipx.pypa.io):
+
+```powershell
+py -m pip install --user pipx
+py -m pipx ensurepath          # then close and reopen the terminal
+pipx install narvy-cli
+narvy scan app.apk
+```
+
+Without pipx:
+
+```powershell
+py -m pip install narvy-cli
+py -m narvy scan app.apk
+```
+
+To use the short `narvy` command after a plain `pip install`, add pip's
+Scripts directory to PATH. For the current PowerShell window only
+(Python 3.14 from python.org; change `Python314` to your version):
+
+```powershell
+$env:Path += ";$env:APPDATA\Python\Python314\Scripts"
+```
+
+To make it permanent for your user account, then open a new terminal:
+
+```powershell
+[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$env:APPDATA\Python\Python314\Scripts", "User")
+```
+
+The exact directory is in pip's `WARNING: The script narvy.exe is installed
+in ... which is not on PATH` line, and in the hint `py -m narvy` prints. The
+Microsoft Store Python uses a different one (under
+`%LOCALAPPDATA%\Packages\PythonSoftwareFoundation.Python.3.x_...\LocalCache\local-packages`).
+Windows on ARM: semgrep has no Windows ARM64 build, use x64 Python.
+
+### macOS
+
+Homebrew's Python refuses `pip install` outside a virtualenv
+(`error: externally-managed-environment`). Use pipx:
+
+```bash
+brew install pipx && pipx ensurepath   # then open a new terminal
+pipx install narvy-cli
+```
+
+or a virtualenv (`python3 -m venv ~/.venvs/narvy && ~/.venvs/narvy/bin/pip install narvy-cli`).
+A `pip install --user` puts `narvy` in `~/Library/Python/3.x/bin`, which is
+not on PATH: add it with
+`echo 'export PATH="$HOME/Library/Python/3.14/bin:$PATH"' >> ~/.zshrc`, or run
+`python3 -m narvy`.
+
+### Linux
+
+pipx (`sudo apt install pipx` / `dnf install pipx`, then `pipx ensurepath`) is
+the simplest. Debian 12+ and Ubuntu 23.04+ refuse a system-wide `pip install`
+the same way Homebrew does. A `pip install --user` puts `narvy` in
+`~/.local/bin`; if that is not on PATH, add
+`export PATH="$HOME/.local/bin:$PATH"` to `~/.bashrc`, or run
+`python3 -m narvy`.
+
+### Requirements
+
+Android scans need Java 11+. If none is found, a JRE (and jadx) is
+downloaded into `~/.narvy/tools` on the first APK scan. Everything else
 is pure Python plus a couple of optional extras:
 
 ```bash
@@ -143,6 +215,9 @@ command. `narvy scans` lists recent scans on your account from the terminal.
 | 4 | The scan, login, upload or report write failed |
 | 130 | Interrupted (Ctrl-C, SIGTERM) |
 
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
 ### Resource limits
 
 The structural analysis pass runs with at most 4 parallel workers and a
@@ -165,7 +240,7 @@ Exactly these fields are sent:
 |-------|---------|
 | `schema` | `1`, the event format version |
 | `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
-| `cli_version`, `python_version`, `os` | `1.1.0`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
 | `ci` | `true` when a CI environment variable is set |
 | `command` | `scan`, `web-scan`, `host-audit`, ... |
 | `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |
@@ -212,6 +287,9 @@ number of checks it did not run. It never hides a finding it did compute.
   in its own output when it applies.
 - Only one architecture's native libraries are checked in a multi-ABI
   APK/split bundle.
+- Windows: a decompiled file whose full path passes 260 characters is only
+  read when Windows long-path support is enabled
+  (`LongPathsEnabled`); a very deep package tree in `%TEMP%` can hit it.
 
 See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
 exact commands this README's examples were run against.

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/README.md

@@ -30,11 +30,83 @@ exactly in [Telemetry](#telemetry), which you can turn off.
 ## Install
 
 ```bash
-pip install narvy-cli
+pipx install narvy-cli      # recommended, puts `narvy` on PATH (run `pipx ensurepath` once)
+pip install narvy-cli       # or plain pip
 ```
 
-Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
-auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+If your shell says `narvy: command not found` / `The term 'narvy' is not
+recognized`, pip installed the command into a directory that is not on your
+PATH. `python -m narvy` always works (`py -m narvy` on Windows), and prints
+once the command that adds that directory to PATH. Narvy never edits PATH
+itself.
+
+### Windows
+
+Recommended, with [pipx](https://pipx.pypa.io):
+
+```powershell
+py -m pip install --user pipx
+py -m pipx ensurepath          # then close and reopen the terminal
+pipx install narvy-cli
+narvy scan app.apk
+```
+
+Without pipx:
+
+```powershell
+py -m pip install narvy-cli
+py -m narvy scan app.apk
+```
+
+To use the short `narvy` command after a plain `pip install`, add pip's
+Scripts directory to PATH. For the current PowerShell window only
+(Python 3.14 from python.org; change `Python314` to your version):
+
+```powershell
+$env:Path += ";$env:APPDATA\Python\Python314\Scripts"
+```
+
+To make it permanent for your user account, then open a new terminal:
+
+```powershell
+[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$env:APPDATA\Python\Python314\Scripts", "User")
+```
+
+The exact directory is in pip's `WARNING: The script narvy.exe is installed
+in ... which is not on PATH` line, and in the hint `py -m narvy` prints. The
+Microsoft Store Python uses a different one (under
+`%LOCALAPPDATA%\Packages\PythonSoftwareFoundation.Python.3.x_...\LocalCache\local-packages`).
+Windows on ARM: semgrep has no Windows ARM64 build, use x64 Python.
+
+### macOS
+
+Homebrew's Python refuses `pip install` outside a virtualenv
+(`error: externally-managed-environment`). Use pipx:
+
+```bash
+brew install pipx && pipx ensurepath   # then open a new terminal
+pipx install narvy-cli
+```
+
+or a virtualenv (`python3 -m venv ~/.venvs/narvy && ~/.venvs/narvy/bin/pip install narvy-cli`).
+A `pip install --user` puts `narvy` in `~/Library/Python/3.x/bin`, which is
+not on PATH: add it with
+`echo 'export PATH="$HOME/Library/Python/3.14/bin:$PATH"' >> ~/.zshrc`, or run
+`python3 -m narvy`.
+
+### Linux
+
+pipx (`sudo apt install pipx` / `dnf install pipx`, then `pipx ensurepath`) is
+the simplest. Debian 12+ and Ubuntu 23.04+ refuse a system-wide `pip install`
+the same way Homebrew does. A `pip install --user` puts `narvy` in
+`~/.local/bin`; if that is not on PATH, add
+`export PATH="$HOME/.local/bin:$PATH"` to `~/.bashrc`, or run
+`python3 -m narvy`.
+
+### Requirements
+
+Android scans need Java 11+. If none is found, a JRE (and jadx) is
+downloaded into `~/.narvy/tools` on the first APK scan. Everything else
 is pure Python plus a couple of optional extras:
 
 ```bash
@@ -110,6 +182,9 @@ command. `narvy scans` lists recent scans on your account from the terminal.
 | 4 | The scan, login, upload or report write failed |
 | 130 | Interrupted (Ctrl-C, SIGTERM) |
 
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
 ### Resource limits
 
 The structural analysis pass runs with at most 4 parallel workers and a
@@ -132,7 +207,7 @@ Exactly these fields are sent:
 |-------|---------|
 | `schema` | `1`, the event format version |
 | `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
-| `cli_version`, `python_version`, `os` | `1.1.0`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
 | `ci` | `true` when a CI environment variable is set |
 | `command` | `scan`, `web-scan`, `host-audit`, ... |
 | `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |
@@ -179,6 +254,9 @@ number of checks it did not run. It never hides a finding it did compute.
   in its own output when it applies.
 - Only one architecture's native libraries are checked in a multi-ABI
   APK/split bundle.
+- Windows: a decompiled file whose full path passes 260 characters is only
+  read when Windows long-path support is enabled
+  (`LongPathsEnabled`); a very deep package tree in `%TEMP%` can hit it.
 
 See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
 exact commands this README's examples were run against.

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.1.0"
+__version__ = "1.1.2"

narvy_cli-1.1.2/narvy/__main__.py

@@ -0,0 +1,30 @@
+"""`python -m narvy` (or `py -m narvy` on Windows) runs the CLI.
+
+Works even when pip put the `narvy` command in a Scripts/bin directory that is
+not on PATH, which is the default for a user install on Windows and macOS.
+"""
+import os
+import sys
+
+
+def _prog() -> str:
+    """Name shown in usage lines: the interpreter the user actually typed, plus -m narvy."""
+    argv0 = (getattr(sys, "orig_argv", None) or [""])[0]
+    name = os.path.basename(argv0)
+    if name.lower().endswith(".exe"):
+        name = name[:-4]
+    if not name.lower().startswith(("python", "py")):
+        name = "python"
+    return f"{name} -m narvy"
+
+
+def main() -> None:
+    from .pathhint import maybe_print_path_hint
+    from .main import cli
+
+    maybe_print_path_hint()
+    cli(prog=_prog())
+
+
+if __name__ == "__main__":
+    main()

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/apk_memory_preflight.py

@@ -73,7 +73,7 @@ def available_ram_mb() -> Optional[int]:
         elif system == "Darwin":
             # vm_stat exposes reclaimable inactive+purgeable pools that SC_AVPHYS_PAGES omits.
             import subprocess
-            out = subprocess.run(["vm_stat"], capture_output=True, text=True, timeout=10).stdout
+            out = subprocess.run(["vm_stat"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10).stdout
             page = 4096
             pm = re.search(r"page size of (\d+) bytes", out)
             if pm:

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/decompiler.py

@@ -30,8 +30,14 @@ JADX_BIN = os.path.join(JADX_HOME, "bin", "jadx.bat" if _IS_WINDOWS else "jadx")
 # jadx 1.5.0 needs Java 11+; a JRE is fetched when the system has none.
 _JRE_MAJOR = "17"
 _JRE_ADOPTIUM_OS = "windows" if _IS_WINDOWS else ("mac" if _IS_MAC else "linux")
-# x64 only: ARM Linux is unsupported and fails loudly on the archive.
-_JRE_ADOPTIUM_ARCH = "x64"
+# Apple Silicon and ARM Linux get the native aarch64 build (an x64 JRE needs
+# Rosetta on a Mac and does not run at all on ARM Linux). Windows stays x64:
+# Temurin 17 has no Windows ARM JRE, and Windows on ARM emulates x64.
+_JRE_ADOPTIUM_ARCH = (
+    "aarch64"
+    if not _IS_WINDOWS and platform.machine().lower() in ("arm64", "aarch64")
+    else "x64"
+)
 JRE_URL = (
     f"https://api.adoptium.net/v3/binary/latest/{_JRE_MAJOR}/ga/"
     f"{_JRE_ADOPTIUM_OS}/{_JRE_ADOPTIUM_ARCH}/jre/hotspot/normal/eclipse"
@@ -69,7 +75,7 @@ def resolve_jadx_binary():
 
 def _java_major_version(java_bin):
     try:
-        result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, timeout=10)
+        result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10)
     except Exception:
         return None
     out = result.stderr or result.stdout or ""
@@ -87,10 +93,12 @@ def _jre_bin_dir():
     # Discovered, not hardcoded: the Adoptium top-level dir carries the patch version.
     if not os.path.isdir(JRE_HOME):
         return None
-    for entry in os.listdir(JRE_HOME):
-        candidate = os.path.join(JRE_HOME, entry, "bin")
-        if os.path.isdir(candidate):
-            return candidate
+    for entry in sorted(os.listdir(JRE_HOME)):
+        # Linux/Windows: <jdk-17...-jre>/bin. macOS: <jdk-17...-jre>/Contents/Home/bin.
+        for sub in (("bin",), ("Contents", "Home", "bin")):
+            candidate = os.path.join(JRE_HOME, entry, *sub)
+            if os.path.isdir(candidate):
+                return candidate
     return None
 
 
@@ -133,16 +141,31 @@ def resolve_java_home():
 
     bin_dir = _jre_bin_dir()
     if bin_dir:
-        return bin_dir
+        java = os.path.join(bin_dir, "java.exe" if _IS_WINDOWS else "java")
+        # A JRE left by an older narvy can be the wrong architecture (x64 on
+        # Apple Silicon without Rosetta): it must actually run, or it is replaced.
+        if (_java_major_version(java) or 0) >= 11:
+            return bin_dir
+        logger.warning(f"The cached JRE in {JRE_HOME} does not run here - downloading a fresh one")
 
     return _download_jre()
 
 
 def _jadx_cmd(jadx_bin, extra_args):
-    # A .bat needs `cmd /c`; shell=True would mis-quote paths.
-    if _IS_WINDOWS and jadx_bin.lower().endswith(".bat"):
-        return ["cmd", "/c", jadx_bin] + extra_args
-    return [jadx_bin] + extra_args
+    """argv for jadx. On Windows a .bat goes through cmd.exe as ONE string.
+
+    A list like ["cmd", "/c", bat, ...] breaks as soon as the .bat path is quoted
+    (a space in the user name, or C:\\Program Files): cmd /c strips the first
+    and the last quote of the line and runs `C:\\Users\\Jean`. With /s and the
+    whole line wrapped in one extra pair of quotes, cmd strips exactly that pair.
+    """
+    if _IS_WINDOWS and jadx_bin.lower().endswith((".bat", ".cmd")):
+        return 'cmd /d /s /c "' + subprocess.list2cmdline([jadx_bin] + list(extra_args)) + '"'
+    return [jadx_bin] + list(extra_args)
+
+
+def _cmd_text(cmd):
+    return cmd if isinstance(cmd, str) else " ".join(str(c) for c in cmd)
 
 
 def _validate_apk_zip(apk_path: str):
@@ -260,7 +283,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
         process = subprocess.run(
             cmd,
             capture_output=True,
-            text=True,
+            text=True, encoding="utf-8", errors="replace",
             check=True,
             timeout=900,
             env=jadx_env,
@@ -269,7 +292,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
         return True, ""
     except subprocess.CalledProcessError as e:
         # jadx/cmd.exe don't consistently use stderr; report both streams.
-        parts = [f"JADX failed (exit code {e.returncode})", f"Command run: {' '.join(str(c) for c in cmd)}"]
+        parts = [f"JADX failed (exit code {e.returncode})", f"Command run: {_cmd_text(cmd)}"]
         if e.stdout:
             parts.append(f"JADX stdout:\n{e.stdout}")
         if e.stderr:
@@ -279,7 +302,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
                 "No output captured on either stdout or stderr. Run "
                 "`narvy doctor` to check your Java/jadx setup, or try "
                 f"running this exact command yourself to see the raw error: "
-                f"{' '.join(str(c) for c in cmd)}"
+                f"{_cmd_text(cmd)}"
             )
         # OOM is unambiguous; a bare -9 (SIGKILL) is ambiguous, so they differ.
         _combined_output = (e.stdout or "") + (e.stderr or "")

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/doctor.py

@@ -18,7 +18,7 @@ console = Console()
 
 def _java_version(java_bin):
     """Run `java -version` and return (version_line, major_version_int_or_None)."""
-    result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, timeout=10)
+    result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10)
     out = result.stderr or result.stdout or ""
     version_line = out.splitlines()[0] if out else "unknown version"
     # Handles both the old "1.8.0_501" scheme and the modern "17.0.2" one.

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/host/lynis_bootstrap.py

@@ -225,7 +225,7 @@ def scp_to_remote(conn: HostConn, local_path: str, remote_path: str,
             argv = ["sshpass", "-e", *argv]
 
         try:
-            proc = subprocess.run(argv, capture_output=True, text=True,
+            proc = subprocess.run(argv, capture_output=True, text=True, encoding="utf-8", errors="replace",
                                   timeout=timeout, env=env)
         except subprocess.TimeoutExpired as exc:
             raise LynisBootstrapError(

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/host/ssh_exec.py

@@ -85,7 +85,7 @@ def capture_host_key(hostname: str, port: int = 22,
     try:
         proc = subprocess.run(
             ["ssh-keyscan", "-p", str(port), "-T", str(timeout), hostname],
-            capture_output=True, text=True, timeout=timeout + 10,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout + 10,
         )
     except (subprocess.TimeoutExpired, OSError):
         return None
@@ -178,7 +178,7 @@ def ssh_exec(conn: HostConn, remote_cmd: str,
 
         try:
             proc = subprocess.run(
-                argv, capture_output=True, text=True, timeout=timeout, env=env,
+                argv, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout, env=env,
             )
         except subprocess.TimeoutExpired as exc:
             raise SSHExecError(

{narvy_cli-1.1.0 → narvy_cli-1.1.2}/narvy/ios/binary_analyzer.py

@@ -54,7 +54,7 @@ def _icdump_class_count(binary_path: str, timeout: int = 60
     try:
         proc = subprocess.run(
             [_sys.executable, "-c", _ICDUMP_PROBE_SCRIPT, binary_path],
-            capture_output=True, text=True, timeout=timeout,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout,
         )
     except subprocess.TimeoutExpired:
         return False, 0, 0, f"timed out after {timeout}s"
@@ -997,7 +997,7 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
             framework_members = [n for n in names if n.startswith(frameworks_prefix)]
 
             import tempfile
-            with tempfile.TemporaryDirectory(prefix="narvy-ios-") as tmpdir:
+            with tempfile.TemporaryDirectory(prefix="narvy-ios-", ignore_cleanup_errors=True) as tmpdir:
                 main_binary_path = _safe_extract_member(zf, main_binary_member, tmpdir)
                 if main_binary_path is None:
                     result["error"] = f"Failed to extract main binary {main_binary_member} " \