morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3300] [MERGED] fix(apple): keep unrooted extensionless Mach-O in IPA executables #5713

New issue

Closed

opened 2026-10-31 01:08:51 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:51 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3300
Author: @Sriram-PR
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/14/2026
Merged by: @morluto

Base: main ← Head: fix/ipa-unrooted-macho-components

📝 Commits (1)

7185c7f fix(apple): keep unrooted extensionless Mach-O in IPA executables

📊 Changes

2 files changed (+36 additions, -2 deletions)

View changed files

📝 src/domain/apple/appleApplication.test.ts (+29 -0)
📝 src/domain/apple/appleApplication.ts (+7 -2)

📄 Description

Summary

For IPA inventories, project-apple-application-graph keeps components outside every application root, but an extensionless Mach-O there (for example SwiftSupport/HelperTool) was dropped from every component array and never paired with unrooted JavaScript. executables required application-root membership and native_libraries only matched .dylib/.so names, so the helper fit neither.

Fixes #3174

Problem and expected behavior

Smallest trigger: an IPA with SwiftSupport/HelperTool (Mach-O) and SwiftSupport/outside.js. docs/apple-application-analysis.md says IPA components outside every root stay in the component lists and their JavaScript/native candidates pair with other unrooted components. Expected: the helper is listed as a native component, stays unrooted, and forms the outside.js -> HelperTool candidate.

Change and scope

executables in classifyComponents now includes a Mach-O outside every root unless it is already a native library by name. Unrooted .dylib/.so images stay only in native_libraries, as the existing sidecar test expects.
Directory, ZIP and DMG projections are unchanged: their component list is already limited to application roots before classification, so the root check only ever mattered for IPA.
The .dylib/.so test is shared through a small isNativeLibrary helper so both arrays use the same rule.

Contribution scope: ordinary fix within existing boundaries; no scope decision needed.

Contract and boundary impact

Semantic owner and earliest changed stage: src/domain/apple/appleApplication.ts, component classification in the Apple projection.
Contribution scope fit and linked maintainer decision: not applicable (bug fix, #3174).
CLI and MCP/tool-catalog contract: no schema change. IPA components.executables and bridge_candidates can now include unrooted extensionless Mach-O images.
Provider, bridge, target-format, or platform compatibility: IPA only; directory, ZIP and DMG unchanged.
Evidence, artifact, provenance, or reconstruction contract: affected projections gain the missing component and candidate, so their projection_id changes; component paths and hashes are reported as inventoried, and no application-root attribution is added.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated: src/domain/apple/appleApplication.test.ts, an IPA with a rooted executable, SwiftSupport/HelperTool, SwiftSupport/iphoneos/libswiftCore.dylib and SwiftSupport/outside.js. It checks that executables holds the rooted executable and the helper (not the unrooted dylib) and that both unrooted native components pair with outside.js.
Base reproduction: the new test fails on the base revision because executables lacks the helper and the outside.js -> HelperTool candidate is missing. The existing sidecar test, which keeps unrooted dylibs out of executables, still passes.

User-visible CLI output: a real IPA (Mach-O bytes from a darwin/arm64 Go build) through inspect-artifact and project-apple-application-graph:

base: executables ["Payload/Fixture.app/Fixture"]
      bridge      ["SwiftSupport/outside.js -> SwiftSupport/iphoneos/libswiftCore.dylib"]
PR:   executables ["Payload/Fixture.app/Fixture", "SwiftSupport/HelperTool"]
      bridge      ["SwiftSupport/outside.js -> SwiftSupport/HelperTool",
                   "SwiftSupport/outside.js -> SwiftSupport/iphoneos/libswiftCore.dylib"]
both: native_libraries ["SwiftSupport/iphoneos/libswiftCore.dylib"], coverage complete-within-inventory

Remaining proof gaps: ran on Linux x64 only; the projection is pure domain code.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:local -- src/domain/apple/appleApplication.test.ts — 20 passed (new test fails on the base revision)
npm run test:focused on the Apple/Android/Harmony projection boundary and acceptance tests (tests/boundary/filesystem/{appleApplication,android/application,harmony/application}.test.ts, tests/acceptance/applications/mobileFrameworkConventions.test.ts, tests/boundary/cli/jsonInputStatus.test.ts, ArtifactOccurrenceIdentity.test.ts) — 7 files, 93 passed
npm run check:fast — typecheck and lint passed
CLI comparison above, built with npm run build:cached on base and on this branch

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; Linux x64, Node 24.18.0.
Package or release metadata impact: none.
Security, privacy, process, or containment review: none; classification only.

Author readiness

Human owner: @Sriram-PR

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare the current revision ready for maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3300 **Author:** [@Sriram-PR](https://github.com/Sriram-PR) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/14/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/ipa-unrooted-macho-components` --- ### 📝 Commits (1) - [`7185c7f`](https://github.com/morluto/rea/commit/7185c7fc8e990073fbceef04bccfc91278ee8a69) fix(apple): keep unrooted extensionless Mach-O in IPA executables ### 📊 Changes **2 files changed** (+36 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/apple/appleApplication.test.ts` (+29 -0) 📝 `src/domain/apple/appleApplication.ts` (+7 -2) </details> ### 📄 Description ## Summary For IPA inventories, `project-apple-application-graph` keeps components outside every application root, but an extensionless Mach-O there (for example `SwiftSupport/HelperTool`) was dropped from every component array and never paired with unrooted JavaScript. `executables` required application-root membership and `native_libraries` only matched `.dylib`/`.so` names, so the helper fit neither. Fixes #3174 ## Problem and expected behavior Smallest trigger: an IPA with `SwiftSupport/HelperTool` (Mach-O) and `SwiftSupport/outside.js`. `docs/apple-application-analysis.md` says IPA components outside every root stay in the component lists and their JavaScript/native candidates pair with other unrooted components. Expected: the helper is listed as a native component, stays unrooted, and forms the `outside.js -> HelperTool` candidate. ## Change and scope - `executables` in `classifyComponents` now includes a Mach-O outside every root unless it is already a native library by name. Unrooted `.dylib`/`.so` images stay only in `native_libraries`, as the existing sidecar test expects. - Directory, ZIP and DMG projections are unchanged: their component list is already limited to application roots before classification, so the root check only ever mattered for IPA. - The `.dylib`/`.so` test is shared through a small `isNativeLibrary` helper so both arrays use the same rule. Contribution scope: ordinary fix within existing boundaries; no scope decision needed. ## Contract and boundary impact - Semantic owner and earliest changed stage: `src/domain/apple/appleApplication.ts`, component classification in the Apple projection. - Contribution scope fit and linked maintainer decision: not applicable (bug fix, #3174). - CLI and MCP/tool-catalog contract: no schema change. IPA `components.executables` and `bridge_candidates` can now include unrooted extensionless Mach-O images. - Provider, bridge, target-format, or platform compatibility: IPA only; directory, ZIP and DMG unchanged. - Evidence, artifact, provenance, or reconstruction contract: affected projections gain the missing component and candidate, so their `projection_id` changes; component paths and hashes are reported as inventoried, and no application-root attribution is added. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/domain/apple/appleApplication.test.ts`, an IPA with a rooted executable, `SwiftSupport/HelperTool`, `SwiftSupport/iphoneos/libswiftCore.dylib` and `SwiftSupport/outside.js`. It checks that `executables` holds the rooted executable and the helper (not the unrooted dylib) and that both unrooted native components pair with `outside.js`. - Base reproduction: the new test fails on the base revision because `executables` lacks the helper and the `outside.js -> HelperTool` candidate is missing. The existing sidecar test, which keeps unrooted dylibs out of `executables`, still passes. - User-visible CLI output: a real IPA (Mach-O bytes from a darwin/arm64 Go build) through `inspect-artifact` and `project-apple-application-graph`: ``` base: executables ["Payload/Fixture.app/Fixture"] bridge ["SwiftSupport/outside.js -> SwiftSupport/iphoneos/libswiftCore.dylib"] PR: executables ["Payload/Fixture.app/Fixture", "SwiftSupport/HelperTool"] bridge ["SwiftSupport/outside.js -> SwiftSupport/HelperTool", "SwiftSupport/outside.js -> SwiftSupport/iphoneos/libswiftCore.dylib"] both: native_libraries ["SwiftSupport/iphoneos/libswiftCore.dylib"], coverage complete-within-inventory ``` - Remaining proof gaps: ran on Linux x64 only; the projection is pure domain code. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:local -- src/domain/apple/appleApplication.test.ts` — 20 passed (new test fails on the base revision) - `npm run test:focused` on the Apple/Android/Harmony projection boundary and acceptance tests (`tests/boundary/filesystem/{appleApplication,android/application,harmony/application}.test.ts`, `tests/acceptance/applications/mobileFrameworkConventions.test.ts`, `tests/boundary/cli/jsonInputStatus.test.ts`, `ArtifactOccurrenceIdentity.test.ts`) — 7 files, 93 passed - `npm run check:fast` — typecheck and lint passed - CLI comparison above, built with `npm run build:cached` on base and on this branch ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; Linux x64, Node 24.18.0. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none; classification only. ## Author readiness Human owner: @Sriram-PR - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare the current revision ready for maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:51 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:04 +00:00

[PR #5788] [MERGED] fix(native): admit thin arm64_32 Mach-O targets for static inspection #7061

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5713

No description provided.

Rows
Columns