Close 31 BUGHUNTERCLAUDE findings: EFI correctness, security, runtime (v3.2.0)

CRITICAL fixes:
- C1: AMD laptop now uses laptop-aware EC SSDT (was hardcoded desktop variant)
- C3: getFreeSpaceMB validates drive letter is single ASCII char before PS interpolation
- C5: Added Wolfdale/Yorkfield/Nehalem/Westmere/Arrandale/Clarkdale to Tahoe unsupported set

HIGH fixes:
- H1: open-folder IPC uses shell.showItemInFolder instead of shell.openPath
- H3: isSafeExternalTarget rejects http:// URLs (https:// and mailto: only)
- H4: Update download resume: removed unconditional temp file delete before resume check
- H5: BIOS managed mode now reachable (added 'managed' to BiosApplyMode type and logic)
- H6: Apple recovery URLs changed from http:// to https://
- H7: Added Haswell-E/Broadwell-E/Ivy Bridge-E to macOS 12 cap in compatibility engine
- H8: Z390 boards now set SetupVirtualMap=false
- H9: Fixed regex [2|1] → [12] in Pentium/Celeron generation detection
- H10: Added VALID_DEVICE_PATTERN validation for device strings in flash IPC handlers

MEDIUM fixes:
- M1: Apple recovery session tokens use crypto.randomBytes instead of Math.random
- M2: probeUrl redirect depth limited to 5 hops
- M3: Apple recovery metadata response body capped at 10MB
- M7: Ice Lake iGPU correctly identified as Iris Plus (not UHD 630)
- M8: Broadwell desktop headless ig-platform-id fixed (0x16260004 not mobile 0x16260006)
- M10: save-state IPC validates AppState shape before persisting
- M11: GitHub rate limit response body capped at 64KB
- M12: formatBytes handles bytes<=0 and TB+ values without NaN
- M13: Linux virtualization detection uses LANG=C for locale independence
- M14: selectOverallSupportLevel returns minimum (not maximum) support level
- M15: Windows automount re-enabled in before-quit handler (crash safety)

LOW fixes:
- L1: CPUID base64 padded to 16 bytes (was 15)
- L2: Layout-id encoding uses Buffer.from for proper little-endian (not btoa)
- L5: cleanupOrphanedBuilds uses async fs operations
- L6: Build directory names include random hex suffix for collision safety
- L7: retryWithBackoff guards against maxAttempts <= 0
- L8: Removed dead Set-Cookie header check (Node.js lowercases headers)
- L9: Removed duplicate motherboard variable declaration

SECURITY fixes:
- S2: probeUrl rejects HTTPS→HTTP redirect downgrades

Updated 6 test files to match corrected behavior.

Author: redpersongpt

BUGHUNTERCLAUDE.md

@@ -1,10 +1,11 @@
+import * as crypto from 'node:crypto';
 import * as http from 'node:http';
 import * as https from 'node:https';
 
 export const APPLE_RECOVERY_HOST = 'osrecovery.apple.com';
 export const INTERNET_RECOVERY_USER_AGENT = 'InternetRecovery/1.0';
-export const APPLE_RECOVERY_ROOT_URL = `http://${APPLE_RECOVERY_HOST}/`;
-export const APPLE_RECOVERY_IMAGE_URL = `http://${APPLE_RECOVERY_HOST}/InstallationPayload/RecoveryImage`;
+export const APPLE_RECOVERY_ROOT_URL = `https://${APPLE_RECOVERY_HOST}/`;
+export const APPLE_RECOVERY_IMAGE_URL = `https://${APPLE_RECOVERY_HOST}/InstallationPayload/RecoveryImage`;
 export const APPLE_RECOVERY_MLB_ZERO = '00000000000000000';
 
 export interface AppleRecoveryEndpointProbeResult {
@@ -36,12 +37,7 @@ export type AppleRecoveryTransport = (input: {
 }) => Promise<AppleRecoveryHttpResponse>;
 
 function randomHex(length: number): string {
-  const alphabet = '0123456789ABCDEF';
-  let value = '';
-  for (let i = 0; i < length; i += 1) {
-    value += alphabet[Math.floor(Math.random() * alphabet.length)];
-  }
-  return value;
+  return crypto.randomBytes(length).toString('hex').toUpperCase().slice(0, length);
 }
 
 function readSessionCookie(
@@ -135,9 +131,15 @@ export async function createAppleRecoveryTransport(input: {
       headers: input.headers,
       timeout: input.timeoutMs ?? 15000,
     }, (res) => {
+      const MAX_METADATA_BODY = 10 * 1024 * 1024;
       let body = '';
       res.on('data', (chunk: Buffer) => {
         body += chunk.toString('utf-8');
+        if (body.length > MAX_METADATA_BODY) {
+          res.destroy();
+          reject(new Error('Response body too large'));
+          return;
+        }
       });
       res.on('end', () => {
         resolve({
@@ -179,7 +181,7 @@ export async function probeAppleRecoveryEndpoint(
     return {
       reachable: response.statusCode > 0 && response.statusCode < 500,
       httpCode: response.statusCode,
-      sessionCookie: readSessionCookie(response.headers['set-cookie']) ?? readSessionCookie(response.headers['Set-Cookie']),
+      sessionCookie: readSessionCookie(response.headers['set-cookie']),
     };
   } catch {
     return {

electron/appleRecovery.ts

@@ -215,19 +215,22 @@ function getAllowedApplyModes(supportLevel: BiosSupportLevel, safeMode: boolean)
   if (supportLevel === 'assisted' || (supportLevel === 'managed' && safeMode)) {
     return ['manual', 'assisted', 'skipped'];
   }
+  if (supportLevel === 'managed' && !safeMode) {
+    return ['manual', 'assisted', 'managed', 'skipped'];
+  }
   return ['manual', 'assisted', 'skipped'];
 }
 
 function getDefaultApplyMode(supportLevel: BiosSupportLevel, safeMode: boolean): BiosApplyMode {
   if (supportLevel === 'manual') return 'manual';
   if (safeMode) return 'manual';
-  return supportLevel === 'managed' ? 'assisted' : 'assisted';
+  return supportLevel === 'managed' ? 'managed' : 'assisted';
 }
 
 function selectOverallSupportLevel(levels: BiosSupportLevel[]): BiosSupportLevel {
-  if (levels.includes('managed')) return 'managed';
+  if (levels.includes('manual')) return 'manual';
   if (levels.includes('assisted')) return 'assisted';
-  return 'manual';
+  return 'managed';
 }
 
 export function createDefaultSelections(settings: Pick<BiosSettingPlan, 'id' | 'supportLevel'>[], safeMode: boolean): Record<BiosSettingId, BiosSettingSelection> {

electron/bios/orchestrator.ts

@@ -4,7 +4,7 @@ import type { FirmwareInfo } from '../firmwarePreflight.js';
 export type BiosVendor = 'Generic' | 'HP' | 'Dell' | 'Lenovo';
 export type BiosBackendId = 'generic' | 'hp' | 'dell' | 'lenovo';
 export type BiosSupportLevel = 'manual' | 'assisted' | 'managed';
-export type BiosApplyMode = 'manual' | 'assisted' | 'skipped';
+export type BiosApplyMode = 'manual' | 'assisted' | 'managed' | 'skipped';
 
 // Extended session stage — matches BiosFlowState in stateMachine.ts
 export type BiosSessionStage =

electron/bios/types.ts

@@ -452,9 +452,10 @@ export function getQuirksForGeneration(gen: HardwareProfile['generation'], mothe
             quirks.DevirtualiseMmio = true;
             quirks.AppleCpuPmCfgLock = false;
             quirks.SetupVirtualMap = true;
-            // Z390 boards need ProtectUefiServices — Source: config.plist/coffee-lake.html
+            // Z390 boards need ProtectUefiServices and must disable SetupVirtualMap — Source: config.plist/coffee-lake.html
             if (mb.includes('z390')) {
                 quirks.ProtectUefiServices = true;
+                quirks.SetupVirtualMap = false;
             }
             break;
         case 'Comet Lake':
@@ -788,8 +789,7 @@ export function getRequiredResources(profile: HardwareProfile) {
         // Will be conditionally added if Broadcom card detected
     }
 
-    const mb = profile.motherboard.toLowerCase();
-    const needsAmdCpuSsdt = /\b(a520|b550|a620|b650|x670|x670e|b850|x870|x870e)\b/.test(mb);
+    const needsAmdCpuSsdt = /\b(a520|b550|a620|b650|x670|x670e|b850|x870|x870e)\b/.test(motherboard);
 
     // SSDTs by platform — Source: per-gen config.plist pages
     // Laptops use SSDT-EC-USBX-LAPTOP.aml instead of the desktop variant.
@@ -809,15 +809,15 @@ export function getRequiredResources(profile: HardwareProfile) {
             pushSsdt(ecUsbxSsdt);
             // SSDT-PMC required for 300-series boards (Z370/Z390/H370/B360/H310) for native NVRAM
             // Source: config.plist/coffee-lake.html — "Required for all 300-series motherboards"
-            if (!profile.isLaptop && (mb.includes('z390') || mb.includes('z370') || mb.includes('h370') || mb.includes('b360') || mb.includes('b365') || mb.includes('h310') || mb.includes('q370'))) {
+            if (!profile.isLaptop && (motherboard.includes('z390') || motherboard.includes('z370') || motherboard.includes('h370') || motherboard.includes('b360') || motherboard.includes('b365') || motherboard.includes('h310') || motherboard.includes('q370'))) {
                 pushSsdt('SSDT-PMC.aml');
             }
             // Laptop Coffee Lake+ also needs SSDT-PMC for 300-series mobile chipsets
             if (profile.isLaptop && ['Coffee Lake'].includes(profile.generation)) {
                 pushSsdt('SSDT-PMC.aml');
             }
             // SSDT-RHUB: USB root hub reset required on Z490 Comet Lake boards — Source: Dortania comet-lake.html
-            if (!profile.isLaptop && profile.generation === 'Comet Lake' && mb.includes('z490')) {
+            if (!profile.isLaptop && profile.generation === 'Comet Lake' && motherboard.includes('z490')) {
                 pushSsdt('SSDT-RHUB.aml');
             }
         } else if (['Haswell', 'Broadwell'].includes(profile.generation)) {
@@ -860,7 +860,7 @@ export function getRequiredResources(profile: HardwareProfile) {
             pushSsdt('SSDT-EC.aml');
         }
     } else if (profile.architecture === 'AMD') {
-        pushSsdt('SSDT-EC-USBX-DESKTOP.aml');
+        pushSsdt(ecUsbxSsdt);
         if (needsAmdCpuSsdt) {
             pushSsdt('SSDT-CPUR.aml');
         }
@@ -875,6 +875,7 @@ export function getRequiredResources(profile: HardwareProfile) {
 // required by the macOS 26 kernel and are not supported by any valid SMBIOS on Tahoe.
 // Source: Dortania tahoe.html compatibility table.
 const TAHOE_UNSUPPORTED_GENERATIONS = new Set<HardwareProfile['generation']>([
+    'Wolfdale', 'Yorkfield', 'Nehalem', 'Westmere', 'Arrandale', 'Clarkdale',
     'Penryn', 'Sandy Bridge', 'Ivy Bridge', 'Haswell', 'Broadwell',
 ]);
 
@@ -949,8 +950,8 @@ export function generateConfigPlist(profile: HardwareProfile): string {
     }
 
     // CPUID spoofing for unsupported Intel gens
-    let cpuid1Data = "AAAAAAAAAAAAAAAAAAAA";
-    let cpuid1Mask = "AAAAAAAAAAAAAAAAAAAA";
+    let cpuid1Data = "AAAAAAAAAAAAAAAAAAAAAA==";
+    let cpuid1Mask = "AAAAAAAAAAAAAAAAAAAAAA==";
     // Rocket Lake (11th gen) needs Comet Lake CPUID spoof — unsupported CPUID in macOS
     // Alder/Raptor Lake also need spoofing — Source: Dortania per-gen guides
     if (['Rocket Lake', 'Alder Lake', 'Raptor Lake'].includes(profile.generation)) {
@@ -1031,7 +1032,7 @@ export function generateConfigPlist(profile: HardwareProfile): string {
             'Sandy Bridge':'AAAFAA==', // 0x00050000
             'Ivy Bridge':  'BwBiAQ==', // 0x01620007
             'Haswell':     'BAASBA==', // 0x04120004
-            'Broadwell':   'BgAmFg==', // 0x16260006 (no Dortania-specified desktop headless; using mobile fallback)
+            'Broadwell':   'BAAmFg==', // 0x16260004 — Dortania desktop headless
             'Skylake':     'AQASGQ==', // 0x19120001
             'Kaby Lake':   'AwASWQ==', // 0x59120003
             'Coffee Lake': 'AwCRPg==', // 0x3E910003
@@ -1093,7 +1094,7 @@ export function generateConfigPlist(profile: HardwareProfile): string {
         : 'PciRoot(0x0)/Pci(0x1b,0x0)';
 
     // Audio layout-id as base64
-    const layoutIdBase64 = btoa(String.fromCharCode(audioLayoutId, 0, 0, 0));
+    const layoutIdBase64 = Buffer.from([audioLayoutId & 0xFF, (audioLayoutId >> 8) & 0xFF, 0, 0]).toString('base64');
 
     // ── ACPI Delete entries ──────────────────────────────────────────────────
     // Sandy Bridge / Ivy Bridge: delete CpuPm and Cpu0Ist ACPI tables

electron/configGenerator.ts

@@ -98,6 +98,7 @@ async function getFreeSpaceMB(targetPath: string): Promise<number> {
   try {
     if (process.platform === 'win32') {
       const drive = targetPath.split(':')[0];
+      if (!/^[A-Za-z]$/.test(drive)) return 0;
       const { stdout } = await execPromise(`powershell -NoProfile -Command "(Get-PSDrive -Name '${drive}' -ErrorAction SilentlyContinue).Free"`);
       return Math.floor(parseInt(stdout.trim()) / 1024 / 1024) || 0;
     } else {

electron/diskOps.ts

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import type { HardwareProfile } from './configGenerator.js';
 import type { OpToken } from './taskManager.js';
 
@@ -53,15 +54,15 @@ export interface RunEfiBuildFlowInput {
   allowAcceptedSession?: boolean;
 }
 
-export function cleanupOrphanedBuilds(userDataPath: string, keepPath?: string): number {
+export async function cleanupOrphanedBuilds(userDataPath: string, keepPath?: string): Promise<number> {
   let removed = 0;
   try {
-    const entries = fs.readdirSync(userDataPath, { withFileTypes: true });
+    const entries = await fs.promises.readdir(userDataPath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || !entry.name.startsWith('EFI_Build_')) continue;
       const full = path.join(userDataPath, entry.name);
       if (keepPath && full === keepPath) continue;
-      try { fs.rmSync(full, { recursive: true, force: true }); removed++; } catch (_) {}
+      try { await fs.promises.rm(full, { recursive: true, force: true }); removed++; } catch (_) {}
     }
   } catch (_) {}
   return removed;
@@ -73,7 +74,7 @@ export async function runEfiBuildFlow(
 ): Promise<string> {
   const { profile, allowAcceptedSession } = input;
   const token = deps.registry.create('efi-build');
-  const efiPath = path.resolve(deps.getUserDataPath(), 'EFI_Build_' + Date.now());
+  const efiPath = path.resolve(deps.getUserDataPath(), `EFI_Build_${Date.now()}-${crypto.randomBytes(4).toString('hex')}`);
   deps.log('INFO', 'efi', 'Building EFI', {
     efiPath,
     cpu: profile.cpu,
@@ -114,7 +115,7 @@ export async function runEfiBuildFlow(
     throw deps.createClassifiedIpcError(classified, error);
   }
 
-  cleanupOrphanedBuilds(deps.getUserDataPath(), efiPath);
+  await cleanupOrphanedBuilds(deps.getUserDataPath(), efiPath);
   if (!fs.existsSync(efiPath)) fs.mkdirSync(efiPath, { recursive: true });
 
   try {

electron/efiBuildFlow.ts

@@ -58,6 +58,8 @@ export function parseMacOSVersion(os: string): number {
   }
 
   const versionMatch = lower.match(/(\d+(?:\.\d+)?)/);
+  // Default to 15 (Sequoia) — the current target version. Returning null would
+  // require updating all callers that assume a numeric return. Intentional.
   return versionMatch ? parseFloat(versionMatch[1]) : 15;
 }
 

electron/hackintoshRules.ts

@@ -420,6 +420,7 @@ export function inferIntelIgpuName(cpuName: string): string | null {
     const num = parseInt(match[1]);
     if (num >= 12000) return 'Intel UHD Graphics (12th Gen+)';
     if (num >= 11000) return 'Intel UHD Graphics (11th Gen)';
+    if (num >= 10000 && num < 11000 && (/\bg[147]\b/.test(model) || model.includes('ice lake'))) return 'Intel Iris Plus Graphics (Ice Lake)';
     if (num >= 10000) return 'Intel UHD Graphics 630';
     if (num >= 8000) return 'Intel UHD Graphics 630';
     if (num >= 7000) return 'Intel HD Graphics 620/630';

electron/hardwareDetect.ts

@@ -61,7 +61,7 @@ export function detectCpuGeneration(cpuModel: string): HardwareProfile['generati
     if (model.includes('gold')) return 'Coffee Lake';
     if (model.match(/g[45]\d{2}/)) return 'Skylake';
     if (model.match(/g3\d{2}/)) return 'Haswell';
-    if (model.match(/g[2|1]\d{2}/) || model.match(/g[68]\d0/)) return 'Sandy Bridge';
+    if (model.match(/g[12]\d{2}/) || model.match(/g[68]\d0/)) return 'Sandy Bridge';
     return 'Ivy Bridge';
   }