Reverse engineer

Three layers, zero MCP daemon, no client config changes. Start at Layer 1; escalate only when Layer 1 cannot answer.

Hard invariants

• Resolve targets with realpath <target>.
• Work on a copy under $TMPDIR/re/$(basename $T); use cp -c on APFS.
• Cap verbose output: native tools pipe to head, REA commands carry --token-limit 8000.
• Cite findings as seen / inferred / unknown; absence is unknown. Static reading is not execution.

Layer 1 — Native recon

First moves:

• Mach-O: file T; lipo -info T; otool -L T; nm -gU T | head; nm -u T | head; strings -a -n 6 T | head -400
• Electron: npx @electron/asar extract app.asar X; rg -uu -l 'ipcMain\.|contextBridge' X --glob '!node_modules'
• Go: go version -m T
• Search: rg -uu -o '.{0,200}NEEDLE.{0,200}' X | head