narvy-cli 1.1.1__tar.gz → 1.1.3__tar.gz

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/CHANGELOG.md

@@ -5,6 +5,90 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.3]
+
+### Fixed
+
+- APK scans were refused before decompiling on machines with less free
+  memory than `--max-mem` needs (about 1.3x the heap plus 1 GB), even for
+  small apps. On an 8 GB laptop at the default `--max-mem 4g` that was
+  nearly every app, and on macOS the free-memory reading was low by
+  several GB. `--max-mem` is a ceiling: when it does not fit but a smaller
+  heap still covers the app's estimated need by 1.5x, jadx now runs with
+  that smaller heap and the scan says so. A machine that cannot hold even
+  that is still refused, with the same advice as before.
+- macOS: available memory comes from the kernel's own figure
+  (`kern.memorystatus_level`, what `memory_pressure` reports), which counts
+  memory the compressor can reclaim. The `vm_stat` page count is the
+  fallback and now includes speculative pages.
+- APK scans: a structural (Semgrep) pass that failed was reported as
+  complete with 0 findings when semgrep exited with an error but still
+  printed JSON. It is now reported as incomplete with the error, after one
+  retry with a single worker. A run whose path filters matched none of the
+  app's own source files is reported the same way instead of as a clean
+  pass. Rule ids no longer depend on where the package is installed.
+
+### Changed
+
+- Platform CI: the check removes the user Scripts/bin directory from PATH
+  before running scans (hosted runners ship with it on PATH, a new user's
+  shell does not), and prints the APK scan output on success so the
+  structural-pass status is in the log.
+
+## [1.1.2]
+
+### Added
+
+- `python -m narvy` (`py -m narvy` on Windows) runs the CLI. It works when
+  pip put the `narvy` command in a directory that is not on PATH, the
+  default for a user install on Windows and macOS. Run that way, Narvy
+  prints once the command that adds the directory to PATH (PowerShell on
+  Windows, your shell rc file elsewhere). It never changes PATH itself;
+  `NARVY_NO_PATH_HINT=1` turns the hint off.
+- README: install steps for Windows, macOS (Homebrew
+  `externally-managed-environment`) and Linux, with pipx first.
+
+### Fixed
+
+- A user install run as `python -m narvy` (or by the launcher's full path)
+  did not find semgrep in the same off-PATH directory, skipped the code pass
+  and reported only dependency CVEs. semgrep is now looked up there and its
+  directory is put on the PATH it runs with (it starts `pysemgrep` through
+  PATH).
+- macOS: when no Java 11+ was installed, the downloaded JRE was never found
+  ("no bin/ dir found inside"), so APK scans failed on every such Mac. The
+  macOS layout (`Contents/Home/bin`) is handled, Apple Silicon and ARM Linux
+  get the native aarch64 JRE instead of x64, and a cached JRE that does not
+  run is downloaded again.
+- Windows: jadx failed to start when its path contained a space (a user name
+  like `Jean Dupont`, or `C:\Program Files`), because `cmd /c` stripped the
+  wrong quotes. The jadx command line now goes through `cmd /d /s /c` as one
+  quoted string.
+- Windows: tool output (semgrep, jadx, nuclei, ssh) is decoded as UTF-8
+  instead of the console code page, semgrep runs in Python UTF-8 mode, and
+  output redirected to a file or pipe replaces a character the code page
+  cannot encode instead of stopping the scan with `UnicodeEncodeError`.
+- A file still locked in a temporary directory (antivirus, a slow child
+  process) no longer fails the scan at cleanup.
+- SCA: only one version of each package was checked. A lockfile that holds
+  `minimist 1.2.8` and a nested `minimist 0.0.8` now checks both. A version
+  taken from a manifest range is still dropped when a lockfile resolves that
+  package.
+- yarn.lock (berry): the package comes from the `resolution:` line, so
+  aliases (`string-width-cjs@npm:string-width@...`) and `patch:` entries
+  name the real package, and `__metadata`, workspace, git and local entries
+  are no longer sent to OSV as packages.
+- semgrep with more than one worker drops taint-mode results at random with
+  no error. Every rule pack that holds a taint rule now runs in its own
+  single-worker semgrep process (packs still run side by side). Files where
+  a rule hit the per-file timeout are named in the scan notes.
+
+### Changed
+
+- Community rule precision round (PHP, JavaScript, Go, Java, Python, Ruby):
+  fewer findings on code that is not reachable by an attacker. Informational
+  rules are lowered to LOW with the reason.
+
 ## [1.1.1]
 
 ### Added

{narvy_cli-1.1.1/narvy_cli.egg-info → narvy_cli-1.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.1.1
+Version: 1.1.3
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -63,11 +63,83 @@ exactly in [Telemetry](#telemetry), which you can turn off.
 ## Install
 
 ```bash
-pip install narvy-cli
+pipx install narvy-cli      # recommended, puts `narvy` on PATH (run `pipx ensurepath` once)
+pip install narvy-cli       # or plain pip
 ```
 
-Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
-auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+If your shell says `narvy: command not found` / `The term 'narvy' is not
+recognized`, pip installed the command into a directory that is not on your
+PATH. `python -m narvy` always works (`py -m narvy` on Windows), and prints
+once the command that adds that directory to PATH. Narvy never edits PATH
+itself.
+
+### Windows
+
+Recommended, with [pipx](https://pipx.pypa.io):
+
+```powershell
+py -m pip install --user pipx
+py -m pipx ensurepath          # then close and reopen the terminal
+pipx install narvy-cli
+narvy scan app.apk
+```
+
+Without pipx:
+
+```powershell
+py -m pip install narvy-cli
+py -m narvy scan app.apk
+```
+
+To use the short `narvy` command after a plain `pip install`, add pip's
+Scripts directory to PATH. For the current PowerShell window only
+(Python 3.14 from python.org; change `Python314` to your version):
+
+```powershell
+$env:Path += ";$env:APPDATA\Python\Python314\Scripts"
+```
+
+To make it permanent for your user account, then open a new terminal:
+
+```powershell
+[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$env:APPDATA\Python\Python314\Scripts", "User")
+```
+
+The exact directory is in pip's `WARNING: The script narvy.exe is installed
+in ... which is not on PATH` line, and in the hint `py -m narvy` prints. The
+Microsoft Store Python uses a different one (under
+`%LOCALAPPDATA%\Packages\PythonSoftwareFoundation.Python.3.x_...\LocalCache\local-packages`).
+Windows on ARM: semgrep has no Windows ARM64 build, use x64 Python.
+
+### macOS
+
+Homebrew's Python refuses `pip install` outside a virtualenv
+(`error: externally-managed-environment`). Use pipx:
+
+```bash
+brew install pipx && pipx ensurepath   # then open a new terminal
+pipx install narvy-cli
+```
+
+or a virtualenv (`python3 -m venv ~/.venvs/narvy && ~/.venvs/narvy/bin/pip install narvy-cli`).
+A `pip install --user` puts `narvy` in `~/Library/Python/3.x/bin`, which is
+not on PATH: add it with
+`echo 'export PATH="$HOME/Library/Python/3.14/bin:$PATH"' >> ~/.zshrc`, or run
+`python3 -m narvy`.
+
+### Linux
+
+pipx (`sudo apt install pipx` / `dnf install pipx`, then `pipx ensurepath`) is
+the simplest. Debian 12+ and Ubuntu 23.04+ refuse a system-wide `pip install`
+the same way Homebrew does. A `pip install --user` puts `narvy` in
+`~/.local/bin`; if that is not on PATH, add
+`export PATH="$HOME/.local/bin:$PATH"` to `~/.bashrc`, or run
+`python3 -m narvy`.
+
+### Requirements
+
+Android scans need Java 11+. If none is found, a JRE (and jadx) is
+downloaded into `~/.narvy/tools` on the first APK scan. Everything else
 is pure Python plus a couple of optional extras:
 
 ```bash
@@ -215,6 +287,9 @@ number of checks it did not run. It never hides a finding it did compute.
   in its own output when it applies.
 - Only one architecture's native libraries are checked in a multi-ABI
   APK/split bundle.
+- Windows: a decompiled file whose full path passes 260 characters is only
+  read when Windows long-path support is enabled
+  (`LongPathsEnabled`); a very deep package tree in `%TEMP%` can hit it.
 
 See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
 exact commands this README's examples were run against.

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/README.md

@@ -30,11 +30,83 @@ exactly in [Telemetry](#telemetry), which you can turn off.
 ## Install
 
 ```bash
-pip install narvy-cli
+pipx install narvy-cli      # recommended, puts `narvy` on PATH (run `pipx ensurepath` once)
+pip install narvy-cli       # or plain pip
 ```
 
-Requires a Java 11+ JRE on your `PATH` for Android scanning (jadx itself is
-auto-downloaded on first scan into `~/.narvy/tools`). Everything else
+If your shell says `narvy: command not found` / `The term 'narvy' is not
+recognized`, pip installed the command into a directory that is not on your
+PATH. `python -m narvy` always works (`py -m narvy` on Windows), and prints
+once the command that adds that directory to PATH. Narvy never edits PATH
+itself.
+
+### Windows
+
+Recommended, with [pipx](https://pipx.pypa.io):
+
+```powershell
+py -m pip install --user pipx
+py -m pipx ensurepath          # then close and reopen the terminal
+pipx install narvy-cli
+narvy scan app.apk
+```
+
+Without pipx:
+
+```powershell
+py -m pip install narvy-cli
+py -m narvy scan app.apk
+```
+
+To use the short `narvy` command after a plain `pip install`, add pip's
+Scripts directory to PATH. For the current PowerShell window only
+(Python 3.14 from python.org; change `Python314` to your version):
+
+```powershell
+$env:Path += ";$env:APPDATA\Python\Python314\Scripts"
+```
+
+To make it permanent for your user account, then open a new terminal:
+
+```powershell
+[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "User") + ";$env:APPDATA\Python\Python314\Scripts", "User")
+```
+
+The exact directory is in pip's `WARNING: The script narvy.exe is installed
+in ... which is not on PATH` line, and in the hint `py -m narvy` prints. The
+Microsoft Store Python uses a different one (under
+`%LOCALAPPDATA%\Packages\PythonSoftwareFoundation.Python.3.x_...\LocalCache\local-packages`).
+Windows on ARM: semgrep has no Windows ARM64 build, use x64 Python.
+
+### macOS
+
+Homebrew's Python refuses `pip install` outside a virtualenv
+(`error: externally-managed-environment`). Use pipx:
+
+```bash
+brew install pipx && pipx ensurepath   # then open a new terminal
+pipx install narvy-cli
+```
+
+or a virtualenv (`python3 -m venv ~/.venvs/narvy && ~/.venvs/narvy/bin/pip install narvy-cli`).
+A `pip install --user` puts `narvy` in `~/Library/Python/3.x/bin`, which is
+not on PATH: add it with
+`echo 'export PATH="$HOME/Library/Python/3.14/bin:$PATH"' >> ~/.zshrc`, or run
+`python3 -m narvy`.
+
+### Linux
+
+pipx (`sudo apt install pipx` / `dnf install pipx`, then `pipx ensurepath`) is
+the simplest. Debian 12+ and Ubuntu 23.04+ refuse a system-wide `pip install`
+the same way Homebrew does. A `pip install --user` puts `narvy` in
+`~/.local/bin`; if that is not on PATH, add
+`export PATH="$HOME/.local/bin:$PATH"` to `~/.bashrc`, or run
+`python3 -m narvy`.
+
+### Requirements
+
+Android scans need Java 11+. If none is found, a JRE (and jadx) is
+downloaded into `~/.narvy/tools` on the first APK scan. Everything else
 is pure Python plus a couple of optional extras:
 
 ```bash
@@ -182,6 +254,9 @@ number of checks it did not run. It never hides a finding it did compute.
   in its own output when it applies.
 - Only one architecture's native libraries are checked in a multi-ABI
   APK/split bundle.
+- Windows: a decompiled file whose full path passes 260 characters is only
+  read when Windows long-path support is enabled
+  (`LongPathsEnabled`); a very deep package tree in `%TEMP%` can hit it.
 
 See [SETUP.md](SETUP.md) for detailed install/troubleshooting steps and the
 exact commands this README's examples were run against.

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.1.1"
+__version__ = "1.1.3"

narvy_cli-1.1.3/narvy/__main__.py

@@ -0,0 +1,30 @@
+"""`python -m narvy` (or `py -m narvy` on Windows) runs the CLI.
+
+Works even when pip put the `narvy` command in a Scripts/bin directory that is
+not on PATH, which is the default for a user install on Windows and macOS.
+"""
+import os
+import sys
+
+
+def _prog() -> str:
+    """Name shown in usage lines: the interpreter the user actually typed, plus -m narvy."""
+    argv0 = (getattr(sys, "orig_argv", None) or [""])[0]
+    name = os.path.basename(argv0)
+    if name.lower().endswith(".exe"):
+        name = name[:-4]
+    if not name.lower().startswith(("python", "py")):
+        name = "python"
+    return f"{name} -m narvy"
+
+
+def main() -> None:
+    from .pathhint import maybe_print_path_hint
+    from .main import cli
+
+    maybe_print_path_hint()
+    cli(prog=_prog())
+
+
+if __name__ == "__main__":
+    main()

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/apk_memory_preflight.py

@@ -24,6 +24,13 @@ JVM_RSS_OVERHEAD = 1.30
 
 RAM_SAFETY_RESERVE_MB = 1024
 
+# When --max-mem does not fit in free RAM but a smaller heap still leaves this
+# much headroom over the estimate, jadx runs with that smaller -Xmx instead of
+# the scan being refused. -Xmx bounds the JVM, so the smaller heap is what keeps
+# memory in check. Measured: four real apps (6.5k to 60k classes) decompiled
+# fully at 1.5x the estimate, peak RSS about 1.2x that heap.
+AUTO_LOWER_MARGIN = 1.5
+
 
 class DexStats(NamedTuple):
     methods: int
@@ -41,6 +48,8 @@ class PreflightVerdict(NamedTuple):
     max_mem_mb: int
     available_mb: Optional[int]
     stats: DexStats
+    # -Xmx value to run jadx with when it differs from --max-mem, else None.
+    lowered_max_mem: Optional[str] = None
 
 
 def parse_mem_arg(value: str) -> Optional[int]:
@@ -71,19 +80,7 @@ def available_ram_mb() -> Optional[int]:
                     if line.startswith("MemAvailable:"):
                         return int(line.split()[1]) // 1024
         elif system == "Darwin":
-            # vm_stat exposes reclaimable inactive+purgeable pools that SC_AVPHYS_PAGES omits.
-            import subprocess
-            out = subprocess.run(["vm_stat"], capture_output=True, text=True, timeout=10).stdout
-            page = 4096
-            pm = re.search(r"page size of (\d+) bytes", out)
-            if pm:
-                page = int(pm.group(1))
-            counts = dict(re.findall(r"^(.+?):\s+(\d+)\.", out, re.M))
-            free = int(counts.get("Pages free", 0))
-            inactive = int(counts.get("Pages inactive", 0))
-            purgeable = int(counts.get("Pages purgeable", 0))
-            if free or inactive:
-                return ((free + inactive + purgeable) * page) // (1024 * 1024)
+            return _darwin_available_mb()
         elif system == "Windows":
             class _MemStatusEx(ctypes.Structure):
                 _fields_ = [
@@ -109,6 +106,58 @@ def available_ram_mb() -> Optional[int]:
     return None
 
 
+def _sysctl_int(name: str) -> Optional[int]:
+    import subprocess
+    try:
+        out = subprocess.run(["sysctl", "-n", name], capture_output=True, text=True,
+                             encoding="utf-8", errors="replace", timeout=10).stdout.strip()
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return int(out) if out.isdigit() else None
+
+
+def _vm_stat_available_mb(out: str) -> Optional[int]:
+    """free + inactive + speculative + purgeable pages from `vm_stat` output, in MB."""
+    page = 4096
+    pm = re.search(r"page size of (\d+) bytes", out)
+    if pm:
+        page = int(pm.group(1))
+    counts = dict(re.findall(r"^(.+?):\s+(\d+)\.", out, re.M))
+    pages = sum(int(counts.get(k, 0)) for k in
+                ("Pages free", "Pages inactive", "Pages speculative", "Pages purgeable"))
+    if not pages:
+        return None
+    return (pages * page) // (1024 * 1024)
+
+
+def _darwin_available_mb(memsize: Optional[int] = None, level: Optional[int] = None,
+                         vm_stat_out: Optional[str] = None) -> Optional[int]:
+    """Available memory on macOS.
+
+    The kernel's own figure is kern.memorystatus_level (the "free percentage"
+    `memory_pressure` prints), which counts memory the compressor can reclaim.
+    Page counts from vm_stat miss that and read a few GB low on a machine that
+    is not under pressure at all, so they are only the fallback.
+    """
+    import subprocess
+    if memsize is None:
+        memsize = _sysctl_int("hw.memsize")
+    if level is None:
+        level = _sysctl_int("kern.memorystatus_level")
+    from_level = None
+    if memsize and level is not None and 0 < level <= 100:
+        from_level = (memsize * level // 100) // (1024 * 1024)
+    if vm_stat_out is None:
+        try:
+            vm_stat_out = subprocess.run(["vm_stat"], capture_output=True, text=True,
+                                         encoding="utf-8", errors="replace", timeout=10).stdout
+        except (OSError, subprocess.SubprocessError):
+            vm_stat_out = ""
+    from_pages = _vm_stat_available_mb(vm_stat_out or "")
+    known = [v for v in (from_level, from_pages) if v is not None]
+    return max(known) if known else None
+
+
 def _is_app_dex(name: str) -> bool:
     """True for app-code DEX (APK `classes*.dex` or App Bundle `<module>/dex/classes*.dex`), not asset .dex."""
     base = name.rsplit("/", 1)[-1]
@@ -225,8 +274,20 @@ def check_memory_preflight(apk_path: str, max_mem: str,
 
     if available_mb is not None:
         needed_rss = int(max_mem_mb * JVM_RSS_OVERHEAD)
-        if needed_rss > (available_mb - RAM_SAFETY_RESERVE_MB):
-            safe_gb = max(1, int((available_mb - RAM_SAFETY_RESERVE_MB) / JVM_RSS_OVERHEAD / 1024))
+        room_mb = available_mb - RAM_SAFETY_RESERVE_MB
+        if needed_rss > room_mb:
+            # -Xmx is a ceiling the JVM only grows to under pressure: when a smaller
+            # heap still fits this app with room to spare, use that instead of refusing.
+            fit_mb = (max(0, int(room_mb / JVM_RSS_OVERHEAD)) // 256) * 256
+            if fit_mb >= max(MIN_ESTIMATE_MB, need_mb * AUTO_LOWER_MARGIN):
+                note = (
+                    f"Only {_fmt_mb(available_mb)} of memory is available right now, so JADX runs "
+                    f"with a {_fmt_mb(fit_mb)} Java heap instead of --max-mem {max_mem} "
+                    f"(this app needs about {_fmt_mb(need_mb)})."
+                )
+                return PreflightVerdict(False, "lowered", note, need_mb, max_mem_mb,
+                                        available_mb, stats, f"{fit_mb}m")
+            safe_gb = max(1, int(room_mb / JVM_RSS_OVERHEAD / 1024))
             lower_line = f"  - lower to --max-mem {safe_gb}g, which fits in what's free"
             if safe_gb * 1024 < need_mb:
                 lower_line += (f" (though this app looks like it needs about {_fmt_mb(need_mb)}, "
@@ -234,7 +295,8 @@ def check_memory_preflight(apk_path: str, max_mem: str,
             msg = (
                 f"--max-mem {max_mem} asks JADX for {_fmt_mb(max_mem_mb)} of Java heap, which needs "
                 f"about {_fmt_mb(needed_rss)} of real memory once JVM overhead is counted. This "
-                f"machine only has {_fmt_mb(available_mb)} available right now.\n\n"
+                f"machine only has {_fmt_mb(available_mb)} available right now, not enough for "
+                f"this app ({scale}, about {_fmt_mb(need_mb)} of heap).\n\n"
                 f"Running this would push the machine into swap and most likely get JADX killed by "
                 f"the OS out-of-memory killer (and may take other apps down with it). Options:\n"
                 f"  - free up memory and try again\n"

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/decompiler.py

@@ -30,8 +30,14 @@ JADX_BIN = os.path.join(JADX_HOME, "bin", "jadx.bat" if _IS_WINDOWS else "jadx")
 # jadx 1.5.0 needs Java 11+; a JRE is fetched when the system has none.
 _JRE_MAJOR = "17"
 _JRE_ADOPTIUM_OS = "windows" if _IS_WINDOWS else ("mac" if _IS_MAC else "linux")
-# x64 only: ARM Linux is unsupported and fails loudly on the archive.
-_JRE_ADOPTIUM_ARCH = "x64"
+# Apple Silicon and ARM Linux get the native aarch64 build (an x64 JRE needs
+# Rosetta on a Mac and does not run at all on ARM Linux). Windows stays x64:
+# Temurin 17 has no Windows ARM JRE, and Windows on ARM emulates x64.
+_JRE_ADOPTIUM_ARCH = (
+    "aarch64"
+    if not _IS_WINDOWS and platform.machine().lower() in ("arm64", "aarch64")
+    else "x64"
+)
 JRE_URL = (
     f"https://api.adoptium.net/v3/binary/latest/{_JRE_MAJOR}/ga/"
     f"{_JRE_ADOPTIUM_OS}/{_JRE_ADOPTIUM_ARCH}/jre/hotspot/normal/eclipse"
@@ -69,7 +75,7 @@ def resolve_jadx_binary():
 
 def _java_major_version(java_bin):
     try:
-        result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, timeout=10)
+        result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10)
     except Exception:
         return None
     out = result.stderr or result.stdout or ""
@@ -87,10 +93,12 @@ def _jre_bin_dir():
     # Discovered, not hardcoded: the Adoptium top-level dir carries the patch version.
     if not os.path.isdir(JRE_HOME):
         return None
-    for entry in os.listdir(JRE_HOME):
-        candidate = os.path.join(JRE_HOME, entry, "bin")
-        if os.path.isdir(candidate):
-            return candidate
+    for entry in sorted(os.listdir(JRE_HOME)):
+        # Linux/Windows: <jdk-17...-jre>/bin. macOS: <jdk-17...-jre>/Contents/Home/bin.
+        for sub in (("bin",), ("Contents", "Home", "bin")):
+            candidate = os.path.join(JRE_HOME, entry, *sub)
+            if os.path.isdir(candidate):
+                return candidate
     return None
 
 
@@ -133,16 +141,31 @@ def resolve_java_home():
 
     bin_dir = _jre_bin_dir()
     if bin_dir:
-        return bin_dir
+        java = os.path.join(bin_dir, "java.exe" if _IS_WINDOWS else "java")
+        # A JRE left by an older narvy can be the wrong architecture (x64 on
+        # Apple Silicon without Rosetta): it must actually run, or it is replaced.
+        if (_java_major_version(java) or 0) >= 11:
+            return bin_dir
+        logger.warning(f"The cached JRE in {JRE_HOME} does not run here - downloading a fresh one")
 
     return _download_jre()
 
 
 def _jadx_cmd(jadx_bin, extra_args):
-    # A .bat needs `cmd /c`; shell=True would mis-quote paths.
-    if _IS_WINDOWS and jadx_bin.lower().endswith(".bat"):
-        return ["cmd", "/c", jadx_bin] + extra_args
-    return [jadx_bin] + extra_args
+    """argv for jadx. On Windows a .bat goes through cmd.exe as ONE string.
+
+    A list like ["cmd", "/c", bat, ...] breaks as soon as the .bat path is quoted
+    (a space in the user name, or C:\\Program Files): cmd /c strips the first
+    and the last quote of the line and runs `C:\\Users\\Jean`. With /s and the
+    whole line wrapped in one extra pair of quotes, cmd strips exactly that pair.
+    """
+    if _IS_WINDOWS and jadx_bin.lower().endswith((".bat", ".cmd")):
+        return 'cmd /d /s /c "' + subprocess.list2cmdline([jadx_bin] + list(extra_args)) + '"'
+    return [jadx_bin] + list(extra_args)
+
+
+def _cmd_text(cmd):
+    return cmd if isinstance(cmd, str) else " ".join(str(c) for c in cmd)
 
 
 def _validate_apk_zip(apk_path: str):
@@ -199,6 +222,10 @@ def _as_limit_preexec(max_mem_mb):
     return _set_limits
 
 
+# Set by decompile_apk when it ran jadx with a smaller heap than --max-mem; the caller prints it.
+LAST_HEAP_NOTE = None
+
+
 def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bool = False,
                   extra_inputs=None):
     """Decompile an APK with jadx; returns (success, error_detail). jadx keeps the FIRST input's manifest, so apk_path stays first; `extra_inputs` merge into one tree."""
@@ -206,10 +233,16 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
     if validation_error:
         return False, validation_error
 
+    global LAST_HEAP_NOTE
+    LAST_HEAP_NOTE = None
     if not force:
         verdict = check_memory_preflight(apk_path, max_mem)
         if verdict.should_block:
             return False, verdict.message
+        lowered = getattr(verdict, "lowered_max_mem", None)
+        if lowered:
+            max_mem = lowered
+            LAST_HEAP_NOTE = verdict.message
 
     try:
         jadx_bin = resolve_jadx_binary()
@@ -260,7 +293,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
         process = subprocess.run(
             cmd,
             capture_output=True,
-            text=True,
+            text=True, encoding="utf-8", errors="replace",
             check=True,
             timeout=900,
             env=jadx_env,
@@ -269,7 +302,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
         return True, ""
     except subprocess.CalledProcessError as e:
         # jadx/cmd.exe don't consistently use stderr; report both streams.
-        parts = [f"JADX failed (exit code {e.returncode})", f"Command run: {' '.join(str(c) for c in cmd)}"]
+        parts = [f"JADX failed (exit code {e.returncode})", f"Command run: {_cmd_text(cmd)}"]
         if e.stdout:
             parts.append(f"JADX stdout:\n{e.stdout}")
         if e.stderr:
@@ -279,7 +312,7 @@ def decompile_apk(apk_path: str, output_dir: str, max_mem: str = "4g", force: bo
                 "No output captured on either stdout or stderr. Run "
                 "`narvy doctor` to check your Java/jadx setup, or try "
                 f"running this exact command yourself to see the raw error: "
-                f"{' '.join(str(c) for c in cmd)}"
+                f"{_cmd_text(cmd)}"
             )
         # OOM is unambiguous; a bare -9 (SIGKILL) is ambiguous, so they differ.
         _combined_output = (e.stdout or "") + (e.stderr or "")

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/doctor.py

@@ -18,7 +18,7 @@ console = Console()
 
 def _java_version(java_bin):
     """Run `java -version` and return (version_line, major_version_int_or_None)."""
-    result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, timeout=10)
+    result = subprocess.run([java_bin, "-version"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=10)
     out = result.stderr or result.stdout or ""
     version_line = out.splitlines()[0] if out else "unknown version"
     # Handles both the old "1.8.0_501" scheme and the modern "17.0.2" one.

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/host/lynis_bootstrap.py

@@ -225,7 +225,7 @@ def scp_to_remote(conn: HostConn, local_path: str, remote_path: str,
             argv = ["sshpass", "-e", *argv]
 
         try:
-            proc = subprocess.run(argv, capture_output=True, text=True,
+            proc = subprocess.run(argv, capture_output=True, text=True, encoding="utf-8", errors="replace",
                                   timeout=timeout, env=env)
         except subprocess.TimeoutExpired as exc:
             raise LynisBootstrapError(

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/host/ssh_exec.py

@@ -85,7 +85,7 @@ def capture_host_key(hostname: str, port: int = 22,
     try:
         proc = subprocess.run(
             ["ssh-keyscan", "-p", str(port), "-T", str(timeout), hostname],
-            capture_output=True, text=True, timeout=timeout + 10,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout + 10,
         )
     except (subprocess.TimeoutExpired, OSError):
         return None
@@ -178,7 +178,7 @@ def ssh_exec(conn: HostConn, remote_cmd: str,
 
         try:
             proc = subprocess.run(
-                argv, capture_output=True, text=True, timeout=timeout, env=env,
+                argv, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout, env=env,
             )
         except subprocess.TimeoutExpired as exc:
             raise SSHExecError(

{narvy_cli-1.1.1 → narvy_cli-1.1.3}/narvy/ios/binary_analyzer.py

@@ -54,7 +54,7 @@ def _icdump_class_count(binary_path: str, timeout: int = 60
     try:
         proc = subprocess.run(
             [_sys.executable, "-c", _ICDUMP_PROBE_SCRIPT, binary_path],
-            capture_output=True, text=True, timeout=timeout,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout,
         )
     except subprocess.TimeoutExpired:
         return False, 0, 0, f"timed out after {timeout}s"
@@ -997,7 +997,7 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
             framework_members = [n for n in names if n.startswith(frameworks_prefix)]
 
             import tempfile
-            with tempfile.TemporaryDirectory(prefix="narvy-ios-") as tmpdir:
+            with tempfile.TemporaryDirectory(prefix="narvy-ios-", ignore_cleanup_errors=True) as tmpdir:
                 main_binary_path = _safe_extract_member(zf, main_binary_member, tmpdir)
                 if main_binary_path is None:
                     result["error"] = f"Failed to extract main binary {main_binary_member} " \