#!/bin/zsh
# macOS 27. Native offline inventory; no VM started and no daemon changed.
set -euo pipefail
umask 077
out="pwnescape-audit-macos.json"
while (( $# )); do
  case "$1" in
    --out) out="${2:?--out requires a path}"; shift 2 ;;
    --help) print -r -- 'zsh pwnescape-macos.zsh [--out report.json]'; exit 0 ;;
    *) print -u2 -r -- 'Unknown option.'; exit 1 ;;
  esac
done
[[ "$(uname -s)" == Darwin ]] || { print -u2 -r -- 'macOS is required.'; exit 1; }
version="$(sw_vers -productVersion)"
darwin="$(uname -r)"
arch="$(uname -m)"
docker=not_detected
orbstack=not_detected
for app in /Applications/Docker.app "$HOME/Applications/Docker.app"; do
  if [[ -d "$app" ]]; then
    docker="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$app/Contents/Info.plist" 2>/dev/null || print unknown)"
    break
  fi
done
for app in /Applications/OrbStack.app "$HOME/Applications/OrbStack.app"; do
  if [[ -d "$app" ]]; then
    orbstack="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$app/Contents/Info.plist" 2>/dev/null || print unknown)"
    break
  fi
done
lima=not_detected
colima=not_detected
if command -v limactl >/dev/null 2>&1; then lima=command_present; fi
if command -v colima >/dev/null 2>&1; then colima=command_present; fi
for value in "$version" "$darwin" "$arch" "$docker" "$orbstack"; do
  [[ "$value" =~ '^[A-Za-z0-9._+() -]+$' ]] || { print -u2 -r -- 'Unexpected version metadata.'; exit 1; }
done
printf '{\n  "cve": "CVE-2026-99999",\n  "macos": "%s",\n  "darwin": "%s",\n  "architecture": "%s",\n  "native_kernel_scope": "CVE_RECORD_NAMES_LINUX",\n  "docker_desktop_version": "%s",\n  "orbstack_version": "%s",\n  "lima": "%s",\n  "colima": "%s",\n  "other_linux_vms": "NOT_ENUMERATED_CHECK_WITH_OWNER",\n  "verdict": "LINUX_BACKEND_VENDOR_CONFIRMATION_REQUIRED"\n}\n' \
  "$version" "$darwin" "$arch" "$docker" "$orbstack" "$lima" "$colima" >"$out"
print -r -- 'Audit saved locally. Review each Linux VM kernel with its vendor.'
# Updating macOS or a container image is not evidence that a Linux VM is fixed.
exit 2