fix(fixup): specs-grammar-safe loader detection + macOS keeps cfg-trust semantics

Two regressions the first CI round caught (exactly the environments local
verification can't fake):

1. gcc specs corruption (linux): the rewritten detect walked the loader
   path to 'whitespace/:;' — but specs embed the baked loader inside
   %-spec conditionals (%{mmusl:...;:/baked/ld-linux-x86-64.so.2}), so the
   scan swallowed closing braces and the rewrite corrupted the spec
   grammar ('braced spec body ... is invalid' from every g++ run after).
   Now: path-character whitelist scan, skip pristine /lib* multilib
   defaults, unit-tested against the real spec grammar (incl. aarch64
   loader names). detect_baked_loader is exported for the tests.
   Fixup rev bumped (hermetic-2) so payloads stamped by the broken pass
   re-run the fixup.

2. macOS host/cfg semantics: the cfg-bypass host flags and the
   -nostdinc++/-stdlib=libc++ cfg regeneration are LINUX semantics; a bare
   macOS link has no libc++abi handling (that lives in the main build's
   needs_explicit_libcxx path) and died with undefined __cxa_* /
   __gxx_personality_v0. build.mcpp host compiles keep trusting the cfg
   off-Linux, and the macOS cfg keeps its historical shape
   (--sysroot=<sdk> + payload libc++ headers only).

Author: Sunrisepeak

src/build/build_program.cppm

@@ -14,6 +14,7 @@ export module mcpp.build.build_program;
 
 import std;
 import mcpp.manifest;
+import mcpp.platform;
 import mcpp.platform.process;
 import mcpp.toolchain.fingerprint;   // hash_file / hash_string (FNV-1a, 16 hex)
 import mcpp.toolchain.linkmodel;     // shared C-library / clang-cfg-bypass model
@@ -119,12 +120,17 @@ std::vector<std::string> host_base_flags(const mcpp::toolchain::Toolchain& tc) {
     std::vector<std::string> f;
     const auto lm = mcpp::toolchain::resolve_link_model(tc);
 
-    // Clang with a bundled cfg: bypass it (--no-default-config) and provide
-    // everything explicitly, same as the main build — the cfg is an
-    // install-time-generated artifact whose content varies per machine and
-    // install path, so trusting it here while bypassing it in the main build
-    // meant two different toolchains for the same project.
+    // Clang with a bundled cfg on LINUX: bypass it (--no-default-config) and
+    // provide everything explicitly, same as the main build — the cfg is an
+    // install-time-generated artifact, so trusting it here while bypassing
+    // it in the main build meant two different toolchains for one project.
+    // On macOS/Windows keep trusting the cfg: the macOS link additionally
+    // needs the platform's libc++abi/unwind handling that the main build's
+    // needs_explicit_libcxx path owns (duplicating it for a host compile
+    // produced undefined __cxa_*/__gxx_personality_v0), and the fixup
+    // pipeline regenerates the cfg deterministically anyway.
     if (mcpp::toolchain::is_clang(tc)) {
+        if constexpr (!mcpp::platform::is_linux) return f;
         const auto dm = mcpp::toolchain::resolve_clang_driver(tc);
         if (dm.hasCfg) {
             f.push_back("--no-default-config");

src/toolchain/post_install.cppm

@@ -92,28 +92,37 @@ export void patchelf_walk(const std::filesystem::path& dir,
 // gcc specs file. xim bakes the installing user's XLINGS_HOME into specs at
 // install time, so the DIR varies per machine, and the loader NAME varies
 // per arch — detect both instead of hardcoding either.
-std::string detect_baked_loader(const std::string& specsContent) {
+export std::string detect_baked_loader(const std::string& specsContent) {
+    // Path-character whitelist. Specs embed loader paths inside %-spec
+    // syntax (`%{mmusl:...;:/baked/dir/ld-linux-x86-64.so.2}`), so scanning
+    // to "whitespace or :;" is NOT a valid boundary — it would swallow the
+    // closing braces, and replacing that string corrupts the spec grammar
+    // ("braced spec body ... is invalid" from every subsequent g++ run).
+    auto is_path_char = [](char c) {
+        return std::isalnum(static_cast<unsigned char>(c))
+            || c == '/' || c == '.' || c == '-' || c == '_' || c == '+';
+    };
+
+    // The baked GNU loader is the ld-linux entry whose directory is NOT a
+    // standard /lib* location — specs also contain pristine defaults
+    // (/lib/ld-linux.so.2, /libx32/…) for other multilib branches that must
+    // never be rewritten.
     constexpr std::string_view kLoaderMark = "/ld-linux-";
-    auto pos = specsContent.find(kLoaderMark);
-    if (pos == std::string::npos) return "";
-    // Walk backwards to find start of the absolute path…
-    auto start = pos;
-    while (start > 0 && specsContent[start - 1] != ' '
-                     && specsContent[start - 1] != ':'
-                     && specsContent[start - 1] != ';'
-                     && specsContent[start - 1] != '\n') {
-        --start;
+    for (std::size_t pos = specsContent.find(kLoaderMark);
+         pos != std::string::npos;
+         pos = specsContent.find(kLoaderMark, pos + 1)) {
+        auto start = pos;
+        while (start > 0 && is_path_char(specsContent[start - 1])) --start;
+        auto end = pos + 1;
+        while (end < specsContent.size() && is_path_char(specsContent[end])) ++end;
+        auto loader = specsContent.substr(start, end - start);
+        if (loader.empty() || loader[0] != '/') continue;
+        auto dir = std::filesystem::path(loader).parent_path().string();
+        if (dir == "/lib" || dir == "/lib64" || dir == "/lib32" || dir == "/libx32")
+            continue;  // pristine multilib default, not a baked path
+        return loader;
     }
-    // …and forwards to its end.
-    auto end = pos + kLoaderMark.size();
-    while (end < specsContent.size()
-           && !std::isspace(static_cast<unsigned char>(specsContent[end]))
-           && specsContent[end] != ':' && specsContent[end] != ';') {
-        ++end;
-    }
-    auto loader = specsContent.substr(start, end - start);
-    if (loader.empty() || loader[0] != '/') return "";
-    return loader;
+    return "";
 }
 
 void fixup_gcc_specs(const std::filesystem::path& gccPkgRoot,
@@ -199,9 +208,18 @@ export void fixup_clang_cfg(const std::filesystem::path& payloadRoot,
     }
 
     std::string common, cxxOnly;
+    auto cxxInclude = payloadRoot / "include" / "c++" / "v1";
     if constexpr (mcpp::platform::is_macos) {
+        // macOS keeps its historical cfg semantics: the C library and the
+        // C++ runtime LINK both come from the SDK; only the libc++ HEADERS
+        // come from the payload. Do NOT add -nostdinc++/-stdlib=libc++
+        // here — a bare cfg-driven link has no libc++abi handling (that
+        // lives in the main build's needs_explicit_libcxx path) and dies
+        // with undefined __cxa_* / __gxx_personality_v0.
         if (auto sdk = mcpp::platform::macos::sdk_path())
             common += "--sysroot=" + sdk->string() + "\n";
+        if (std::filesystem::exists(cxxInclude))
+            cxxOnly += "-isystem " + cxxInclude.string() + "\n";
     } else {
         if (!glibcLibDir.empty()) {
             auto loader = resolve_loader(glibcLibDir, triple);
@@ -212,21 +230,20 @@ export void fixup_clang_cfg(const std::filesystem::path& payloadRoot,
             common += "-Wl,--enable-new-dtags,-rpath," + glibcLibDir.string() + "\n";
         }
         common += "-fuse-ld=lld\n--rtlib=compiler-rt\n--unwindlib=libunwind\n";
-    }
 
-    auto cxxInclude = payloadRoot / "include" / "c++" / "v1";
-    if (std::filesystem::exists(cxxInclude)) {
-        cxxOnly += "-nostdinc++\n-stdlib=libc++\n";
-        cxxOnly += "-isystem " + cxxInclude.string() + "\n";
-    }
-    if (!triple.empty()) {
-        auto tripleInclude = payloadRoot / "include" / triple / "c++" / "v1";
-        if (std::filesystem::exists(tripleInclude))
-            cxxOnly += "-isystem " + tripleInclude.string() + "\n";
-        auto tripleLib = payloadRoot / "lib" / triple;
-        if (std::filesystem::exists(tripleLib)) {
-            cxxOnly += "-L" + tripleLib.string() + "\n";
-            cxxOnly += "-Wl,-rpath," + tripleLib.string() + "\n";
+        if (std::filesystem::exists(cxxInclude)) {
+            cxxOnly += "-nostdinc++\n-stdlib=libc++\n";
+            cxxOnly += "-isystem " + cxxInclude.string() + "\n";
+        }
+        if (!triple.empty()) {
+            auto tripleInclude = payloadRoot / "include" / triple / "c++" / "v1";
+            if (std::filesystem::exists(tripleInclude))
+                cxxOnly += "-isystem " + tripleInclude.string() + "\n";
+            auto tripleLib = payloadRoot / "lib" / triple;
+            if (std::filesystem::exists(tripleLib)) {
+                cxxOnly += "-L" + tripleLib.string() + "\n";
+                cxxOnly += "-Wl,-rpath," + tripleLib.string() + "\n";
+            }
         }
     }
 
@@ -334,7 +351,7 @@ void llvm_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
 // runtime libs. Idempotent via a content-fingerprinted marker.
 //
 // Bump when the fixup logic changes so existing installs re-run it.
-constexpr std::string_view kFixupRev = "hermetic-1";
+constexpr std::string_view kFixupRev = "hermetic-2";
 
 export void ensure_post_install_fixup(const mcpp::config::GlobalConfig& cfg,
                                       const std::filesystem::path& payloadRoot,

tests/unit/test_post_install.cpp

@@ -0,0 +1,60 @@
+#include <gtest/gtest.h>
+
+import std;
+import mcpp.toolchain.post_install;
+
+// detect_baked_loader parses gcc SPECS GRAMMAR, not plain text. The baked
+// loader path is embedded inside %-spec conditionals, e.g.
+//   %{mmusl:/lib/ld-musl-x86_64.so.1;:/baked/dir/ld-linux-x86-64.so.2}
+// A scanner that treats "whitespace or :;" as the boundary swallows the
+// closing braces; replacing that string then corrupts the spec grammar and
+// EVERY subsequent g++ invocation dies with "braced spec body ... is
+// invalid" (observed on CI). These tests pin the exact grammar shape.
+
+namespace {
+
+using mcpp::toolchain::detect_baked_loader;
+
+// Realistic *link_spec fragment as xim bakes it (64-bit branch rewritten to
+// the installing user's home; other multilib branches pristine).
+const std::string kBakedSpecs =
+    "*link:\n"
+    "%{m16|m32|mx32:;:-m elf_x86_64} %{shared:-shared} %{!shared: %{!static: "
+    "%{m16|m32:-dynamic-linker %{muclibc:/lib/ld-uClibc.so.0;:%{mbionic:/system/bin/linker;:"
+    "%{mmusl:/lib/ld-musl-i386.so.1;:/lib/ld-linux.so.2}}}} "
+    "%{m16|m32|mx32:;:-dynamic-linker %{muclibc:/lib/ld64-uClibc.so.0;:%{mbionic:/system/bin/linker64;:"
+    "%{mmusl:/lib/ld-musl-x86_64.so.1;:/opt/other-home/.xlings/data/xpkgs/xim-x-glibc/2.39/lib64/ld-linux-x86-64.so.2}}}}} "
+    "%{static:-static}}\n";
+
+TEST(DetectBakedLoader, ExtractsExactPathWithoutSpecBraces) {
+    auto got = detect_baked_loader(kBakedSpecs);
+    EXPECT_EQ(got,
+        "/opt/other-home/.xlings/data/xpkgs/xim-x-glibc/2.39/lib64/ld-linux-x86-64.so.2");
+    // The regression: any brace in the result corrupts the specs on rewrite.
+    EXPECT_EQ(got.find('}'), std::string::npos);
+    EXPECT_EQ(got.find('{'), std::string::npos);
+}
+
+TEST(DetectBakedLoader, IgnoresPristineMultilibDefaults) {
+    // An unbaked spec (all-standard /lib*/ paths) must not be rewritten.
+    const std::string pristine =
+        "%{mmusl:/lib/ld-musl-x86_64.so.1;:/lib64/ld-linux-x86-64.so.2} "
+        "%{m16|m32:-dynamic-linker /lib/ld-linux.so.2} "
+        "%{mx32:-dynamic-linker /libx32/ld-linux-x32.so.2}";
+    EXPECT_EQ(detect_baked_loader(pristine), "");
+}
+
+TEST(DetectBakedLoader, Aarch64LoaderNameDetected) {
+    const std::string specs =
+        "-dynamic-linker %{mmusl:/lib/ld-musl-aarch64.so.1;:"
+        "/srv/build/.xlings/xpkgs/xim-x-glibc/2.39/lib/ld-linux-aarch64.so.1}";
+    EXPECT_EQ(detect_baked_loader(specs),
+        "/srv/build/.xlings/xpkgs/xim-x-glibc/2.39/lib/ld-linux-aarch64.so.1");
+}
+
+TEST(DetectBakedLoader, EmptyWhenNoGnuLoaderPresent) {
+    EXPECT_EQ(detect_baked_loader("no loaders here"), "");
+    EXPECT_EQ(detect_baked_loader("%{mmusl:/lib/ld-musl-x86_64.so.1}"), "");
+}
+
+}  // namespace