[hironow]

Summary

Add an opt-in brotli-doctor command alongside ca-doctor to inventory Brotli-related evidence in installed native CLI binaries. Updating an OS library or the active Bun installation does not replace C code embedded in an existing executable, so installed and standalone artifacts need their own inspection.

The Go 1.27 CLI uses only the standard library. By default it inventories every installed mise version and files directly on PATH; explicit file arguments inspect only those files. It reads ELF, Mach-O (including fat images), PE, Go build metadata, symbols and bounded string evidence without executing the inspected binaries, running ldd, updating packages or making CVE lookup requests. It reports direct imports, defined/undefined C symbols, module versions/replacements, weak string hints and UNKNOWN independently. JSON and text output distinguish incomplete inspection from absence of evidence. Exit 0 means operational completion, never security clearance.

Bun incident handling

Include candidate-version guidance for CVE-2026-111497, using Bun 1.4.4 as a reviewed source-release threshold. Proposal #46351 changes both the C decoder and Rust FFI/error handling; the actual release inclusion is through merged #46392, updating Brotli to 1.2.1.

Embedded Bun version strings are candidates only: every assessment keeps binary identity and patch status unverified, including versions at or above the threshold. Complete-token parsing preserves prerelease/custom-version uncertainty and conflicting candidates; limits and read failures propagate as incomplete. Existing bun build --compile artifacts require a separately verified rebuild/replacement, not merely a host runtime update.

Safety and integration

• Restrict recursive inventory to bounded mise install roots; reject outward links and broad roots. PATH traversal is non-recursive and duplicate targets are deduplicated.
• Reject special files, cap image size and inventory size, batch directory enumeration before allocating entries, and bound PE descriptor/name reads with cancellation checks.
• Add explicit build/run/six-target build recipes and ignore generated binaries. Do not add this potentially large scan to the existing doctor command.
• Document usage, source provenance, remediation guidance and detection limits in docs/runbook/brotli-doctor.md.

Verification

• Ready-for-review CI on 78abc7a00dee1c6d24646ecc9d8ded8e70e28c43: all five current workflows and all six jobs succeeded, including the PowerShell job. Just Sandbox Tests executed 126 passed, no skipped tests. Earlier draft-only skipped runs are not counted as successful verification.
• Mandatory independent plan reviews and an independent acceptance review completed. Two resource-bounding findings were fixed with regression tests; the focused follow-up found no actionable blockers.
• just check: passed on the final implementation.
• Publication gate: pre-commit hooks and just ci passed, including 1,773 host unit tests (33 skipped). just check-all did not pass overall: its final test-install command could not connect to the container backend. The owner explicitly approved publishing a draft with this infrastructure limitation unresolved; no hook or test was bypassed.
• Module go test -race -count=1 ./..., go vet, golangci-lint and formatter checks: passed.
• Native build and Linux/macOS/Windows amd64+arm64 cross-builds: passed. Cross-builds are not native execution tests for those other platforms.
• Generated native-format fixtures, malformed images/symbols, fat-image failure handling, inventory containment/cancellation/caps, counting-reader PE bounds, Bun token split/suffix cases, mixed candidates and text/JSON semantics are covered.
• Real installed-file inventory smoke correctly returned exit 1/incomplete for broken or out-of-scope links, permission failures and an oversized executable; that is not a clean vulnerability result. A local Bun file yielded a 1.4.4 version candidate while retaining unverified identity/patch fields.

Container verification limitation

Local containers use Podman, not OrbStack. The existing Podman VM was started with owner approval and its compatibility API was confirmed, but the connection was subsequently lost; another ordinary start failed to connect to the gvproxy socket. The attempted full sandbox runs returned 15 passed, 111 skipped, so local Podman runtime verification remains incomplete. The subsequent ready-for-review CI sandbox run independently executed all 126 tests successfully, as recorded above. No VM deletion/recreation, rootful switch, global Docker context change or weakening of skip/check behavior was performed.

This PR does not claim exploitability, binary authenticity, a complete transitive dependency inventory, or successful native execution on the other build targets. No software upgrade or deployment is included.