morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4302] [Feature] Interpret Info.plist entry points and capabilities per bundle #1706

New issue

Open

opened 2026-10-16 21:09:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:09:17 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4302

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I understand the contribution scope must be reviewed before integration; open questions are welcome here.
This request does not include credentials, private samples, or sensitive target data.

Area

Native analysis or decompilation

Current limitation

For an Apple app and each nested bundle, inspect_plist should report the entry points and capabilities that bundle's Info.plist declares, with Apple's documented meaning: URL schemes, queried schemes, document types, type declarations, activity types, Services, background modes and tasks, usage descriptions, the extension point, and the effective App Transport Security (ATS) policy under Apple's precedence rules, including pinned domains. Platform- and device-suffixed variants fold into their base key with qualifiers visible. The raw plist value stays unchanged.

An analyst needs to know how other software can reach an app and its extensions, which background modes and protected resources it declares, and what network-security policy it configures. REA 6.5.0 (tag rea-agents-6.5.0, commit 3b79af28e80785afce9f5998d8f03289402a1847) does not interpret any of these keys.

inspect_plist returns the plist as raw JSON value plus five bundle strings (identifier, executable, name, version, short version). project_apple_application_graph lists each bundle's info_plist_path, states that it does not parse plist semantics, and sends agents to inspect_plist "for CFBundleExecutable, identifiers, and declared services", which that tool returns only as raw JSON.

Observed with the release build on macOS 27.0.1 (26A434) arm64, Node.js v26.10.0, using a self-built ./fixture/Demo.app (a copy of /bin/ls as Contents/MacOS/Demo) whose Contents/Info.plist declares NSAppTransportSecurity with NSAllowsArbitraryLoads = true, NSAllowsArbitraryLoadsInWebContent = true and an empty NSExceptionDomains entry for example.com, plus UIBackgroundModes = [audio, teleport] and UISupportedInterfaceOrientations~ipad:

npx -y rea-agents@6.5.0 inspect-plist ./fixture/Demo.app --json

The result echoes the ATS dictionary verbatim and reports limitations: []. Nothing says that Apple ignores NSAllowsArbitraryLoads on iOS 10 and later and macOS 10.12 and later when NSAllowsArbitraryLoadsInWebContent is present, or that example.com is exempt from the global keys. An agent reading NSAllowsArbitraryLoads: true can wrongly conclude that ATS is off everywhere. teleport is returned exactly like the documented mode audio, and UISupportedInterfaceOrientations~ipad appears as an unrelated top-level key. A nested appex's Info.plist can be selected with --relative-path, but its NSExtensionPointIdentifier is likewise a raw string.

Use cases

No response

Desired outcome and success criteria

inspect_plist (CLI inspect-plist and MCP) gains an interpreted section next to the unchanged value and bundle. Each result covers one bundle's Info.plist, named by source_path; to cover the app and every nested bundle, the agent inspects each info_plist_path that project_apple_application_graph lists, using the existing path or --relative-path input. The graph stays an execution-free inventory projection.

Applicability: applied only to a file named exactly Info.plist with a dictionary root; for any other plist the section says it was not applied and why, so a launchd or preferences plist is never read as Info.plist declarations.
Coverage: the section names the key families it interprets; a covered key that is absent is reported as not declared. Other keys stay only in value. Each item carries its exact source key path, the Apple key it was read as, and a short documented meaning.
Entry points: CFBundleURLTypes (schemes, name, role), LSApplicationQueriesSchemes, CFBundleDocumentTypes (content types, name, role, document class, LSHandlerRank), UTExportedTypeDeclarations and UTImportedTypeDeclarations (identifier, conformances, tags; an identifier in both lists notes that the exported declaration takes precedence), NSUserActivityTypes, NSServices (menu item, message, port name, send and return types, key equivalent), and the NSExtensionPointIdentifier of NSExtension.
Capabilities: UIBackgroundModes, BGTaskSchedulerPermittedIdentifiers, and each NS*UsageDescription key with the protected resource it names and the string as written in this file.
Defaults: an absent CFBundleTypeRole or LSHandlerRank is reported with Apple's documented default (None, Default), marked defaulted rather than declared.
Value status: values of keys with a closed documented set (CFBundleTypeRole, LSHandlerRank, UIBackgroundModes) are marked documented or outside Apple's documented values; none are dropped. The NSExtensionPointIdentifier key page is not exhaustive, so extension points are marked listed or not listed on that page, never invalid. A usage-description-shaped key that Protected resources does not list is reported as such.
Fail closed: a covered key with the wrong type (for example CFBundleURLSchemes as a string) is reported as malformed with its raw value while the rest of the result succeeds; undocumented subkeys inside a covered entry are reported raw as undocumented.
Suffix folding: a top-level [key name]-[platform]~[device] key whose qualifiers are among Apple's listed values is grouped under its base key, each variant keeping its qualifiers and exact source key, and covered keys are interpreted per variant. REA does not choose which variant applies at run time. A suffix with unlisted qualifiers is not folded and is reported as an unrecognized qualifier.
ATS globals: for each documented OS range, the effective arbitrary-loads outcome and the rule that produced it. On iOS 9.0 and macOS 10.11, NSAllowsArbitraryLoads applies and the other global exceptions are ignored; on iOS 10 or later and macOS 10.12 or later, NSAllowsArbitraryLoads is ignored (NO) when NSAllowsArbitraryLoadsForMedia, NSAllowsArbitraryLoadsInWebContent or NSAllowsLocalNetworking is present. Other global keys are reported with their values.
ATS domains: each exception domain's keys with documented defaults filled in and marked defaulted (NSExceptionRequiresForwardSecrecy YES, NSExceptionMinimumTLSVersion TLSv1.2), subdomain inclusion, and the statement that global keys do not apply to it, even when its dictionary is empty. Each NSPinnedDomains entry reports subdomain inclusion and its CA and leaf SPKI-SHA256-BASE64 values, with the rule that when both are given ATS requires a match in each category.
Limitations in the Evidence: these are declarations, not observed handlers, granted permissions or network behavior; ATS governs URL Loading System connections and is disabled for apps linked against an SDK older than iOS 9.0 or macOS 10.11, which a plist cannot establish; localized string overrides are not merged.

Acceptance criteria

On ./fixture/Demo.app with CFBundleURLTypes (scheme demo, role Editor), LSApplicationQueriesSchemes = [othertool], a CFBundleDocumentTypes entry (rank Owner, role Viewer), NSCameraUsageDescription and UIBackgroundModes = [audio, teleport], the section reports each declaration with its meaning, marks audio documented and teleport outside Apple's documented values, and value is identical to the release build's.
On the same fixture's ATS dictionary (NSAllowsArbitraryLoads and NSAllowsArbitraryLoadsInWebContent both true, example.com mapped to an empty dictionary), the section reports global arbitrary loads as NO for iOS 10 or later and macOS 10.12 or later and YES for iOS 9.0 and macOS 10.11, names the rule for each, and reports example.com as exempt from global keys with forward secrecy YES and minimum TLS TLSv1.2 marked defaulted.
A fixture NSPinnedDomains entry with one CA and one leaf SPKI-SHA256-BASE64 value is reported with both values and the match-each-category rule.
inspect-plist ./fixture/Demo.app --relative-path Contents/PlugIns/Share.appex/Contents/Info.plist reports extension point com.apple.share-services as listed on the key page. A second appex declaring com.apple.networkextension.packet-tunnel is reported as not listed, not invalid. The app's own result does not include either.
On stock /System/Applications/Stickies.app, the section reports the NSServices entry with message makeStickyFromTextService and its send types, reports its NSExecutable subkey raw as undocumented, and reports the document type's absent LSHandlerRank as Default, marked defaulted.
On stock /System/Applications/Calculator.app, UISupportedInterfaceOrientations~ipad and UISupportedInterfaceOrientations~iphone are grouped under UISupportedInterfaceOrientations with device qualifiers ipad and iphone and their exact source keys.
A fixture key NSUserActivityTypes-amiga~toaster is not folded and is reported as an unrecognized qualifier.
A fixture with CFBundleURLSchemes as a string is reported as malformed with the raw value, and the tool still returns success with the rest of the section.
Inspecting a copy of the fixture's Info.plist saved as /tmp/rea-fixture/other.plist (absolute path input) returns the section as not applied, with the reason, and the same value as the release build.
The inspect_plist tool description and its documentation name the section and the key families it covers.

Expected interaction with targets

Read existing files or captured data

Target and scope details (optional)

Affected area

inspect_plist (CLI inspect-plist and MCP): its result schema, tool description and documentation. project_apple_application_graph output does not change.

Non-goals

launchd, XPC service, privileged-helper, login-item and system-extension relationships between bundles.
Privacy manifests (PrivacyInfo.xcprivacy) and their checks.
Localized values of usage descriptions and other strings from InfoPlist.strings or string catalogs.
Accepting nested bundle directories (.appex, .framework, .xpc) as direct targets; this request uses the existing relative-path selection from the app.
Entitlements, associated domains and provisioning profiles.
Judging whether a declaration is justified, or observing handlers, permissions or connections at run time.
Interpreting Info.plist keys outside the listed families; they stay raw in value.

Verification available so far

I can suggest a sample or manual check

Verification details (optional)

No response

Alternatives considered

Per-bundle declaration nodes in project_apple_application_graph: rejected for this request, because the graph projects inventory Evidence (paths and hashes) and documents that it does not parse plist semantics; it would have to start reading plist bytes. inspect_plist already reads and decodes them.
One call that interprets every bundle in an app at once: convenient, but it duplicates the graph's bundle discovery. Per-file results keep each answer tied to one exact source path.

Possible direction

No response

References

Apple documentation (corpus fetched 2026-09-30):

Information property list: "The file name is case-sensitive and must begin with a capital letter I." https://developer.apple.com/documentation/bundleresources/information-property-list
Managing your app’s information property list values: syntax "[key name]-[platform]~[device]", where "platform and device are optional qualifiers that restrict the value for the key to the platform or device"; platforms freebsd hpux iphoneos linux macos solaris tvos visionos watchos windows, devices appletv applevision applewatch iphone ipad mac. https://developer.apple.com/documentation/bundleresources/managing-your-app-s-information-property-list
URL types: https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleurltypes ; roles Editor, Viewer, Shell, QLGenerator, None, default None: https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleurltypes/cfbundletyperole . Defining a custom URL scheme: "URL schemes offer a potential attack vector into your app" and "If multiple apps register the same scheme, the app the system targets is undefined." https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app
LSApplicationQueriesSchemes has no key page in the corpus; canOpenURL says "you must declare the URL schemes you pass to this method by adding the LSApplicationQueriesSchemes key to your app’s Info.plist file". https://developer.apple.com/documentation/uikit/uiapplication/canopenurl(_:)
Document types CFBundleTypeRole: values Editor, Viewer, Shell, QLGenerator, None, default None. https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundledocumenttypes/cfbundletyperole
LSHandlerRank: "The ranking of this app among apps that declare themselves as editors or viewers of the given file type"; values Owner, Default, Alternate, None, default Default. https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundledocumenttypes/lshandlerrank
Type declarations: https://developer.apple.com/documentation/bundleresources/information-property-list/utexportedtypedeclarations and https://developer.apple.com/documentation/bundleresources/information-property-list/utimportedtypedeclarations ; "If both exported and imported declarations for a type exist, the exported declaration takes precedence over the imported declaration." https://developer.apple.com/documentation/uniformtypeidentifiers/defining-file-and-data-types-for-your-app
Other entry-point and capability keys: https://developer.apple.com/documentation/bundleresources/information-property-list/nsuseractivitytypes , https://developer.apple.com/documentation/bundleresources/information-property-list/nsservices (documented subkeys NSKeyEquivalent, NSMenuItem, NSMessage, NSPortName, NSTimeout, NSReturnTypes, NSSendTypes, NSUserData), https://developer.apple.com/documentation/bundleresources/information-property-list/uibackgroundmodes (14 possible values from audio to voip), https://developer.apple.com/documentation/bundleresources/information-property-list/bgtaskschedulerpermittedidentifiers , and Protected resources for usage descriptions: https://developer.apple.com/documentation/bundleresources/protected-resources
NSAppTransportSecurity: global exceptions apply "except connections to domains specified in the NSExceptionDomains sub-dictionary"; on iOS 9.0 or macOS 10.11 ATS "ignores the other global exceptions"; "When you link your app against an older SDK, ATS is disabled no matter which version of operating system your app runs on." https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity
NSAllowsArbitraryLoads: "In iOS 10 and later and macOS 10.12 and later, the value of the NSAllowsArbitraryLoads key is ignored—and the default value of NO used instead—if any of the following keys are present": NSAllowsArbitraryLoadsForMedia, NSAllowsArbitraryLoadsInWebContent, NSAllowsLocalNetworking. https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nsallowsarbitraryloads
NSExceptionDomains: "If you specify an exception domain dictionary, ATS ignores any global configuration keys, like NSAllowsArbitraryLoads, for that domain. This is true even if you leave the domain-specific dictionary empty". https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nsexceptiondomains ; defaults YES (https://developer.apple.com/documentation/bundleresources/information-property-list/nsexceptionrequiresforwardsecrecy) and TLSv1.2 (https://developer.apple.com/documentation/bundleresources/information-property-list/nsexceptionminimumtlsversion).
NSPinnedDomains: "If you specify both, App Transport Security (ATS) requires a match in each category." https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nspinneddomains
NSExtensionPointIdentifier lists 34 distinct com.apple. values in 35 rows (com.apple.ctk-tokens appears twice), including com.apple.share-services: https://developer.apple.com/documentation/bundleresources/information-property-list/nsextension/nsextensionpointidentifier ; the packet tunnel provider page uses com.apple.networkextension.packet-tunnel, which that list omits: https://developer.apple.com/documentation/networkextension/nepackettunnelprovider

REA source at the release tag; main d52a488 changes only default plist path resolution in these files:

Five-field bundle projection: github.com/morluto/rea@3b79af28e8/src/native/parsers/plist.ts (L252-L266)
Result schema: github.com/morluto/rea@3b79af28e8/src/domain/native/nativeInspection.ts (L162-L175)
Tool contract: github.com/morluto/rea@3b79af28e8/src/contracts/native/nativeToolContracts.ts (L111-L117)
Graph limitations: github.com/morluto/rea@3b79af28e8/src/domain/apple/appleApplication.ts (L448-L449)
Graph documentation ("It does not parse plist or CMS semantics"): github.com/morluto/rea@3b79af28e8/docs/apple-application-analysis.md (L3-L8)
Per-bundle info_plist_path: github.com/morluto/rea@3b79af28e8/src/domain/apple/appleBundleAnatomy.ts (L21-L43)

Related: merged PR #3774 changed how inspect_plist picks its default plist; this request adds interpretation and leaves selection alone. Searches for Info.plist URL schemes, CFBundleURLTypes, App Transport Security, usage descriptions, NSExtensionPointIdentifier and inspect_plist semantics found no existing request.

Originally created by @coygeek on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4302 ### Before submitting - [X] I searched the open and closed issues and pull requests for a related proposal. - [X] I understand the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope) must be reviewed before integration; open questions are welcome here. - [X] This request does not include credentials, private samples, or sensitive target data. ### Area Native analysis or decompilation ### Current limitation For an Apple app and each nested bundle, `inspect_plist` should report the entry points and capabilities that bundle's Info.plist declares, with Apple's documented meaning: URL schemes, queried schemes, document types, type declarations, activity types, Services, background modes and tasks, usage descriptions, the extension point, and the effective App Transport Security (ATS) policy under Apple's precedence rules, including pinned domains. Platform- and device-suffixed variants fold into their base key with qualifiers visible. The raw plist `value` stays unchanged. An analyst needs to know how other software can reach an app and its extensions, which background modes and protected resources it declares, and what network-security policy it configures. REA 6.5.0 (tag `rea-agents-6.5.0`, commit `3b79af28e80785afce9f5998d8f03289402a1847`) does not interpret any of these keys. `inspect_plist` returns the plist as raw JSON `value` plus five `bundle` strings (identifier, executable, name, version, short version). `project_apple_application_graph` lists each bundle's `info_plist_path`, states that it does not parse plist semantics, and sends agents to `inspect_plist` "for CFBundleExecutable, identifiers, and declared services", which that tool returns only as raw JSON. Observed with the release build on macOS 27.0.1 (26A434) arm64, Node.js v26.10.0, using a self-built `./fixture/Demo.app` (a copy of `/bin/ls` as `Contents/MacOS/Demo`) whose `Contents/Info.plist` declares `NSAppTransportSecurity` with `NSAllowsArbitraryLoads = true`, `NSAllowsArbitraryLoadsInWebContent = true` and an empty `NSExceptionDomains` entry for `example.com`, plus `UIBackgroundModes = [audio, teleport]` and `UISupportedInterfaceOrientations~ipad`: ```sh npx -y rea-agents@6.5.0 inspect-plist ./fixture/Demo.app --json ``` The result echoes the ATS dictionary verbatim and reports `limitations: []`. Nothing says that Apple ignores `NSAllowsArbitraryLoads` on iOS 10 and later and macOS 10.12 and later when `NSAllowsArbitraryLoadsInWebContent` is present, or that `example.com` is exempt from the global keys. An agent reading `NSAllowsArbitraryLoads: true` can wrongly conclude that ATS is off everywhere. `teleport` is returned exactly like the documented mode `audio`, and `UISupportedInterfaceOrientations~ipad` appears as an unrelated top-level key. A nested appex's Info.plist can be selected with `--relative-path`, but its `NSExtensionPointIdentifier` is likewise a raw string. ### Use cases _No response_ ### Desired outcome and success criteria `inspect_plist` (CLI `inspect-plist` and MCP) gains an interpreted section next to the unchanged `value` and `bundle`. Each result covers one bundle's Info.plist, named by `source_path`; to cover the app and every nested bundle, the agent inspects each `info_plist_path` that `project_apple_application_graph` lists, using the existing path or `--relative-path` input. The graph stays an execution-free inventory projection. - Applicability: applied only to a file named exactly `Info.plist` with a dictionary root; for any other plist the section says it was not applied and why, so a launchd or preferences plist is never read as Info.plist declarations. - Coverage: the section names the key families it interprets; a covered key that is absent is reported as not declared. Other keys stay only in `value`. Each item carries its exact source key path, the Apple key it was read as, and a short documented meaning. - Entry points: `CFBundleURLTypes` (schemes, name, role), `LSApplicationQueriesSchemes`, `CFBundleDocumentTypes` (content types, name, role, document class, `LSHandlerRank`), `UTExportedTypeDeclarations` and `UTImportedTypeDeclarations` (identifier, conformances, tags; an identifier in both lists notes that the exported declaration takes precedence), `NSUserActivityTypes`, `NSServices` (menu item, message, port name, send and return types, key equivalent), and the `NSExtensionPointIdentifier` of `NSExtension`. - Capabilities: `UIBackgroundModes`, `BGTaskSchedulerPermittedIdentifiers`, and each `NS*UsageDescription` key with the protected resource it names and the string as written in this file. - Defaults: an absent `CFBundleTypeRole` or `LSHandlerRank` is reported with Apple's documented default (`None`, `Default`), marked defaulted rather than declared. - Value status: values of keys with a closed documented set (`CFBundleTypeRole`, `LSHandlerRank`, `UIBackgroundModes`) are marked documented or outside Apple's documented values; none are dropped. The `NSExtensionPointIdentifier` key page is not exhaustive, so extension points are marked listed or not listed on that page, never invalid. A usage-description-shaped key that Protected resources does not list is reported as such. - Fail closed: a covered key with the wrong type (for example `CFBundleURLSchemes` as a string) is reported as malformed with its raw value while the rest of the result succeeds; undocumented subkeys inside a covered entry are reported raw as undocumented. - Suffix folding: a top-level `[key name]-[platform]~[device]` key whose qualifiers are among Apple's listed values is grouped under its base key, each variant keeping its qualifiers and exact source key, and covered keys are interpreted per variant. REA does not choose which variant applies at run time. A suffix with unlisted qualifiers is not folded and is reported as an unrecognized qualifier. - ATS globals: for each documented OS range, the effective arbitrary-loads outcome and the rule that produced it. On iOS 9.0 and macOS 10.11, `NSAllowsArbitraryLoads` applies and the other global exceptions are ignored; on iOS 10 or later and macOS 10.12 or later, `NSAllowsArbitraryLoads` is ignored (`NO`) when `NSAllowsArbitraryLoadsForMedia`, `NSAllowsArbitraryLoadsInWebContent` or `NSAllowsLocalNetworking` is present. Other global keys are reported with their values. - ATS domains: each exception domain's keys with documented defaults filled in and marked defaulted (`NSExceptionRequiresForwardSecrecy` `YES`, `NSExceptionMinimumTLSVersion` `TLSv1.2`), subdomain inclusion, and the statement that global keys do not apply to it, even when its dictionary is empty. Each `NSPinnedDomains` entry reports subdomain inclusion and its CA and leaf `SPKI-SHA256-BASE64` values, with the rule that when both are given ATS requires a match in each category. - Limitations in the Evidence: these are declarations, not observed handlers, granted permissions or network behavior; ATS governs URL Loading System connections and is disabled for apps linked against an SDK older than iOS 9.0 or macOS 10.11, which a plist cannot establish; localized string overrides are not merged. **Acceptance criteria** - On `./fixture/Demo.app` with `CFBundleURLTypes` (scheme `demo`, role `Editor`), `LSApplicationQueriesSchemes = [othertool]`, a `CFBundleDocumentTypes` entry (rank `Owner`, role `Viewer`), `NSCameraUsageDescription` and `UIBackgroundModes = [audio, teleport]`, the section reports each declaration with its meaning, marks `audio` documented and `teleport` outside Apple's documented values, and `value` is identical to the release build's. - On the same fixture's ATS dictionary (`NSAllowsArbitraryLoads` and `NSAllowsArbitraryLoadsInWebContent` both true, `example.com` mapped to an empty dictionary), the section reports global arbitrary loads as `NO` for iOS 10 or later and macOS 10.12 or later and `YES` for iOS 9.0 and macOS 10.11, names the rule for each, and reports `example.com` as exempt from global keys with forward secrecy `YES` and minimum TLS `TLSv1.2` marked defaulted. - A fixture `NSPinnedDomains` entry with one CA and one leaf `SPKI-SHA256-BASE64` value is reported with both values and the match-each-category rule. - `inspect-plist ./fixture/Demo.app --relative-path Contents/PlugIns/Share.appex/Contents/Info.plist` reports extension point `com.apple.share-services` as listed on the key page. A second appex declaring `com.apple.networkextension.packet-tunnel` is reported as not listed, not invalid. The app's own result does not include either. - On stock `/System/Applications/Stickies.app`, the section reports the `NSServices` entry with message `makeStickyFromTextService` and its send types, reports its `NSExecutable` subkey raw as undocumented, and reports the document type's absent `LSHandlerRank` as `Default`, marked defaulted. - On stock `/System/Applications/Calculator.app`, `UISupportedInterfaceOrientations~ipad` and `UISupportedInterfaceOrientations~iphone` are grouped under `UISupportedInterfaceOrientations` with device qualifiers `ipad` and `iphone` and their exact source keys. - A fixture key `NSUserActivityTypes-amiga~toaster` is not folded and is reported as an unrecognized qualifier. - A fixture with `CFBundleURLSchemes` as a string is reported as malformed with the raw value, and the tool still returns success with the rest of the section. - Inspecting a copy of the fixture's Info.plist saved as `/tmp/rea-fixture/other.plist` (absolute path input) returns the section as not applied, with the reason, and the same `value` as the release build. - The `inspect_plist` tool description and its documentation name the section and the key families it covers. ### Expected interaction with targets Read existing files or captured data ### Target and scope details (optional) **Affected area** `inspect_plist` (CLI `inspect-plist` and MCP): its result schema, tool description and documentation. `project_apple_application_graph` output does not change. **Non-goals** - launchd, XPC service, privileged-helper, login-item and system-extension relationships between bundles. - Privacy manifests (`PrivacyInfo.xcprivacy`) and their checks. - Localized values of usage descriptions and other strings from `InfoPlist.strings` or string catalogs. - Accepting nested bundle directories (`.appex`, `.framework`, `.xpc`) as direct targets; this request uses the existing relative-path selection from the app. - Entitlements, associated domains and provisioning profiles. - Judging whether a declaration is justified, or observing handlers, permissions or connections at run time. - Interpreting Info.plist keys outside the listed families; they stay raw in `value`. ### Verification available so far I can suggest a sample or manual check ### Verification details (optional) _No response_ ### Alternatives considered - Per-bundle declaration nodes in `project_apple_application_graph`: rejected for this request, because the graph projects inventory Evidence (paths and hashes) and documents that it does not parse plist semantics; it would have to start reading plist bytes. `inspect_plist` already reads and decodes them. - One call that interprets every bundle in an app at once: convenient, but it duplicates the graph's bundle discovery. Per-file results keep each answer tied to one exact source path. ### Possible direction _No response_ ### References Apple documentation (corpus fetched 2026-09-30): - Information property list: "The file name is case-sensitive and must begin with a capital letter `I`." https://developer.apple.com/documentation/bundleresources/information-property-list - Managing your app’s information property list values: syntax "`[key name]-[platform]~[device]`", where "`platform` and `device` are optional qualifiers that restrict the value for the key to the platform or device"; platforms `freebsd hpux iphoneos linux macos solaris tvos visionos watchos windows`, devices `appletv applevision applewatch iphone ipad mac`. https://developer.apple.com/documentation/bundleresources/managing-your-app-s-information-property-list - URL types: https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleurltypes ; roles `Editor`, `Viewer`, `Shell`, `QLGenerator`, `None`, default `None`: https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleurltypes/cfbundletyperole . Defining a custom URL scheme: "URL schemes offer a potential attack vector into your app" and "If multiple apps register the same scheme, the app the system targets is undefined." https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app - `LSApplicationQueriesSchemes` has no key page in the corpus; canOpenURL says "you must declare the URL schemes you pass to this method by adding the `LSApplicationQueriesSchemes` key to your app’s `Info.plist` file". https://developer.apple.com/documentation/uikit/uiapplication/canopenurl(_:) - Document types `CFBundleTypeRole`: values `Editor`, `Viewer`, `Shell`, `QLGenerator`, `None`, default `None`. https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundledocumenttypes/cfbundletyperole - LSHandlerRank: "The ranking of this app among apps that declare themselves as editors or viewers of the given file type"; values `Owner`, `Default`, `Alternate`, `None`, default `Default`. https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundledocumenttypes/lshandlerrank - Type declarations: https://developer.apple.com/documentation/bundleresources/information-property-list/utexportedtypedeclarations and https://developer.apple.com/documentation/bundleresources/information-property-list/utimportedtypedeclarations ; "If both exported and imported declarations for a type exist, the exported declaration takes precedence over the imported declaration." https://developer.apple.com/documentation/uniformtypeidentifiers/defining-file-and-data-types-for-your-app - Other entry-point and capability keys: https://developer.apple.com/documentation/bundleresources/information-property-list/nsuseractivitytypes , https://developer.apple.com/documentation/bundleresources/information-property-list/nsservices (documented subkeys NSKeyEquivalent, NSMenuItem, NSMessage, NSPortName, NSTimeout, NSReturnTypes, NSSendTypes, NSUserData), https://developer.apple.com/documentation/bundleresources/information-property-list/uibackgroundmodes (14 possible values from `audio` to `voip`), https://developer.apple.com/documentation/bundleresources/information-property-list/bgtaskschedulerpermittedidentifiers , and Protected resources for usage descriptions: https://developer.apple.com/documentation/bundleresources/protected-resources - NSAppTransportSecurity: global exceptions apply "except connections to domains specified in the NSExceptionDomains sub-dictionary"; on iOS 9.0 or macOS 10.11 ATS "ignores the other global exceptions"; "When you link your app against an older SDK, ATS is disabled no matter which version of operating system your app runs on." https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity - NSAllowsArbitraryLoads: "In iOS 10 and later and macOS 10.12 and later, the value of the NSAllowsArbitraryLoads key is ignored—and the default value of `NO` used instead—if any of the following keys are present": NSAllowsArbitraryLoadsForMedia, NSAllowsArbitraryLoadsInWebContent, NSAllowsLocalNetworking. https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nsallowsarbitraryloads - NSExceptionDomains: "If you specify an exception domain dictionary, ATS ignores any global configuration keys, like NSAllowsArbitraryLoads, for that domain. This is true even if you leave the domain-specific dictionary empty". https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nsexceptiondomains ; defaults `YES` (https://developer.apple.com/documentation/bundleresources/information-property-list/nsexceptionrequiresforwardsecrecy) and `TLSv1.2` (https://developer.apple.com/documentation/bundleresources/information-property-list/nsexceptionminimumtlsversion). - NSPinnedDomains: "If you specify both, App Transport Security (ATS) requires a match in each category." https://developer.apple.com/documentation/bundleresources/information-property-list/nsapptransportsecurity/nspinneddomains - NSExtensionPointIdentifier lists 34 distinct `com.apple.` values in 35 rows (`com.apple.ctk-tokens` appears twice), including `com.apple.share-services`: https://developer.apple.com/documentation/bundleresources/information-property-list/nsextension/nsextensionpointidentifier ; the packet tunnel provider page uses `com.apple.networkextension.packet-tunnel`, which that list omits: https://developer.apple.com/documentation/networkextension/nepackettunnelprovider REA source at the release tag; main `d52a488` changes only default plist path resolution in these files: - Five-field bundle projection: https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/native/parsers/plist.ts#L252-L266 - Result schema: https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/domain/native/nativeInspection.ts#L162-L175 - Tool contract: https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/contracts/native/nativeToolContracts.ts#L111-L117 - Graph limitations: https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/domain/apple/appleApplication.ts#L448-L449 - Graph documentation ("It does not parse plist or CMS semantics"): https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/docs/apple-application-analysis.md#L3-L8 - Per-bundle `info_plist_path`: https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/src/domain/apple/appleBundleAnatomy.ts#L21-L43 Related: merged PR #3774 changed how `inspect_plist` picks its default plist; this request adds interpretation and leaves selection alone. Searches for Info.plist URL schemes, `CFBundleURLTypes`, App Transport Security, usage descriptions, `NSExtensionPointIdentifier` and `inspect_plist` semantics found no existing request.

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-31 00:54:50 +00:00

[PR #1706] [MERGED] feat(managed): select declaring types in inspect_managed_members #4768

bsakaguchi referenced this issue

2026-10-31 00:56:27 +00:00

[PR #1897] [MERGED] fix(managed): bind row budget charges to metadata identities #4889

bsakaguchi referenced this issue

2026-10-31 00:56:58 +00:00

[PR #1943] [MERGED] fix(managed): index attribute constructor owners once per layout #4927