fix(cli): refuse to stage a Mach-O the kernel won't spawn

Staging the wrong Mach-O as a bundle's CFBundleExecutable produces an app
that passes every check and then dies at launch with "Launchd job spawn
failed". The dSYM skip one commit earlier stops the known way in, but
nothing downstream would notice another.

Nothing else can: a dSYM companion is a legitimate Mach-O that signs and
verifies exactly like the real binary, so `codesign` is blind to it, and
the executable bit is no signal either since this packager sets it on
whatever it staged. The two differ only in the header's `filetype` — 0x2
MH_EXECUTE against 0xa MH_DSYM — with the first twelve bytes identical.

So read those four bytes after staging the app executable and each CEF
helper, and fail the package when they say the file cannot be spawned.

The reader judges only thin little-endian Mach-O, where the 64- and 32-bit
layouts agree up to `filetype`. Universal binaries and non-Mach-O files
read as unknown and pass: rejecting only what can be proven wrong keeps a
format this reader does not understand from becoming a build failure.
Covering fat archives means walking the arch table, noted where it would go.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tonyfettes

cli/package/error.mbt

@@ -22,6 +22,7 @@ pub(all) suberror PackagePlanError {
   UnsupportedResourceGlob(path~ : String)
   MissingInput(path~ : String)
   MissingExecutable(path~ : String)
+  NotLaunchableMachO(path~ : String, filetype~ : Int)
   InputOutsideProject(path~ : String)
   MissingIcon(path~ : String)
 } derive(Debug, Eq)
@@ -113,6 +114,12 @@ pub fn PackagePlanError::message(self : PackagePlanError) -> String {
       "package executable not found under " +
       path +
       "; run proton package without --no-build first"
+    NotLaunchableMachO(path~, filetype~) =>
+      "staged bundle executable " +
+      path +
+      " is a Mach-O of type " +
+      macho_filetype_name(filetype) +
+      ", not MH_EXECUTE; the kernel refuses to spawn it"
     InputOutsideProject(path~) =>
       "package input must stay inside the project: " + path
     MissingIcon(path~) => "package icon is missing: " + path

cli/package/package.mbt

@@ -838,6 +838,72 @@ async fn stage_macos_app(
   }
 }
 
+///|
+/// Mach-O `filetype` values this packager can name. Only `MH_EXECUTE` is
+/// spawnable; `MH_DSYM` is the one that actually shows up here, because a
+/// debug build mirrors the executable's basename inside
+/// `<name>.dSYM/Contents/Resources/DWARF/`.
+const MachoExecute : Int = 0x2
+
+///|
+fn macho_filetype_name(filetype : Int) -> String {
+  match filetype {
+    0x1 => "MH_OBJECT"
+    0x2 => "MH_EXECUTE"
+    0x6 => "MH_DYLIB"
+    0x8 => "MH_BUNDLE"
+    0xa => "MH_DSYM"
+    _ => "0x" + filetype.to_string()
+  }
+}
+
+///|
+fn macho_u32_le(data : Bytes, offset : Int) -> Int {
+  data[offset].to_int() |
+  (data[offset + 1].to_int() << 8) |
+  (data[offset + 2].to_int() << 16) |
+  (data[offset + 3].to_int() << 24)
+}
+
+///|
+/// The `filetype` of a thin little-endian Mach-O, or `None` for anything this
+/// reader will not judge.
+///
+/// 64- and 32-bit thin headers agree up to `filetype`, so one offset serves
+/// both. Universal binaries (`FAT_MAGIC`) and non-Mach-O files return `None`
+/// on purpose: the caller rejects only what it can prove wrong, so a format
+/// this function does not understand is never turned into a build failure.
+/// Extending to fat archives means walking the arch table and judging each
+/// contained header.
+fn macho_thin_filetype(data : Bytes) -> Int? {
+  guard data.length() >= 16 else { return None }
+  let magic = macho_u32_le(data, 0)
+  guard magic == 0xfeedfacf || magic == 0xfeedface else { return None }
+  Some(macho_u32_le(data, 12))
+}
+
+///|
+/// Refuse to ship a bundle executable the kernel will not spawn.
+///
+/// `codesign` cannot stand in for this: a dSYM companion is a legitimate
+/// Mach-O and signs and verifies exactly like the real binary, differing
+/// only in the header's `filetype`. Nor can the executable bit, which this
+/// packager sets on whatever it staged. So a bundle carrying symbols where
+/// its binary belongs passes every other check and then fails at launch with
+/// `Launchd job spawn failed` — this is the only place that catches it.
+async fn require_launchable_macho(path : String) -> Unit {
+  let data = @async_fs.read_file(path) catch {
+    error =>
+      raise PackageFileSystemError::Read(
+        path~,
+        detail=@debug.render(Repr(error)),
+      )
+  }
+  guard macho_thin_filetype(data.binary()) is Some(filetype) else { return }
+  guard filetype != MachoExecute else { return }
+  raise PackagePlanError::NotLaunchableMachO(path~, filetype~)
+}
+
 ///|
 async fn stage_macos_app_impl(
   plan : PackagePlan,
@@ -868,6 +934,7 @@ async fn stage_macos_app_impl(
           @debug.render(Repr(error)),
       )
   }
+  require_launchable_macho(staged_executable)
   copy_tree(runtime, @fsutil.resolve_path(resources, "proton"))
   stage_release_project_config(
     plan.config_path,
@@ -901,6 +968,7 @@ async fn stage_macos_app_impl(
             @debug.render(Repr(error)),
         )
     }
+    require_launchable_macho(helper_executable)
     write_text(
       @fsutil.resolve_path(helper_app, "Contents/Info.plist"),
       helper_info_plist(plan, helper),

cli/package/package_wbtest.mbt

@@ -1204,3 +1204,41 @@ async test "Windows portable staging flattens runtime bin beside app executable"
     @mbfs.path_exists(@fsutil.resolve_path(portable, "bin/proton.dll")),
   )
 }
+
+///|
+test "a thin Mach-O header yields its filetype" {
+  // An arm64 executable and its dSYM mirror: identical for twelve bytes, then
+  // MH_EXECUTE (2) against MH_DSYM (10). Nothing cheaper tells them apart —
+  // not the magic, not the size, not codesign.
+  let executable = b"\xcf\xfa\xed\xfe\x0c\x00\x00\x01\x00\x00\x00\x00\x02\x00\x00\x00"
+  let dsym = b"\xcf\xfa\xed\xfe\x0c\x00\x00\x01\x00\x00\x00\x00\x0a\x00\x00\x00"
+  assert_eq(macho_thin_filetype(executable), Some(0x2))
+  assert_eq(macho_thin_filetype(dsym), Some(0xa))
+  // 32-bit thin headers agree up to `filetype`, so one offset reads both.
+  let thin32 = b"\xce\xfa\xed\xfe\x0c\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00"
+  assert_eq(macho_thin_filetype(thin32), Some(0x6))
+}
+
+///|
+test "unjudgeable inputs are left alone rather than failed" {
+  // The caller rejects only what it can prove wrong, so a universal binary, a
+  // script, and a truncated file all read as None. A format this reader does
+  // not understand must never become a packaging failure.
+  let fat = b"\xca\xfe\xba\xbe\x00\x00\x00\x02\x01\x00\x00\x0c\x00\x00\x00\x00"
+  assert_eq(macho_thin_filetype(fat), None)
+  assert_eq(macho_thin_filetype(b"#!/bin/sh\necho hi\n"), None)
+  assert_eq(macho_thin_filetype(b"\xcf\xfa\xed\xfe"), None)
+}
+
+///|
+test "the rejection names the filetype it found" {
+  inspect(macho_filetype_name(0x2), content="MH_EXECUTE")
+  inspect(macho_filetype_name(0xa), content="MH_DSYM")
+  inspect(
+    PackagePlanError::NotLaunchableMachO(
+      path="SeekMoon.app/Contents/MacOS/seekmoon",
+      filetype=0xa,
+    ).message(),
+    content="staged bundle executable SeekMoon.app/Contents/MacOS/seekmoon is a Mach-O of type MH_DSYM, not MH_EXECUTE; the kernel refuses to spawn it",
+  )
+}