bundling: fs/process stdlib + post-link callback + Apple .app in sx

Campaign Weeks 3-6 of /Users/agra/.claude/plans/lets-plan-to-move-splendid-pumpkin.md
land in one push: the bundling pipeline that used to live in
src/target.zig (createBundle, embedFramework, extractEntitlements,
buildInfoPlist, codesign) now lives in
library/modules/platform/bundle.sx and runs in the IR interpreter
after target.link() returns.

New language-side surface:
- library/modules/fs.sx — POSIX libc bindings (open/read/write/close,
  mkdir/unlink/rmdir, chmod, rename, access, basename/dirname). Variadic
  open() lowers to C's varargs via the new args: ..T form. Direct libc
  calls bypass *File method dispatch so they work from the post-link
  IR interpreter.
- library/modules/process.sx — popen-based run(cmd) returning
  ProcessResult{ exit_code, stdout }, plus env() and find_executable().
- library/modules/std.sx — xml_escape(s) and variadic path_join(parts).
- library/modules/compiler.sx — BuildOptions grows
  set_post_link_callback / set_post_link_module / binary_path
  accessors; bundle_path/bundle_id/codesign_identity/provisioning_profile
  setters + accessors; per-target predicates is_macos/is_ios/
  is_ios_device/is_ios_simulator + target_triple; framework_count /
  framework_at(i) / framework_path_count / framework_path_at(i);
  add_asset_dir(src, dest) + asset_dir_count / src_at / dest_at.

Compiler-side wiring:
- src/ir/compiler_hooks.zig — BuildConfig now carries post_link_callback_fn,
  post_link_module, binary_path, bundle_*, target_triple,
  target_frameworks, target_framework_paths, asset_dirs. Hook registry
  exposes every accessor; getters return "" / 0 for unset fields so
  bundle.sx can treat absent values uniformly.
- src/ir/host_ffi.zig (new) — dlsym(RTLD_DEFAULT) + arity-switched cdecl
  trampolines so #foreign("c") declarations resolve through the host
  libc during #run / post-link interpretation.
- src/ir/interp.zig — callForeign dispatch; build_config pointer
  injection so accessor hooks see live state during re-entry.
- src/core.zig — keeps the IR module alive past generateCode; exposes
  invokeByName / invokeByFuncId so main.zig can re-enter the
  interpreter after linking.
- src/main.zig — wires bundle/codesign/provisioning CLI flags +
  target_triple + framework lists into BuildConfig; invokes the
  post-link callback (by FuncId or by <module>.bundle_main lookup) once
  target.link() returns. When --bundle is set but no callback is
  registered, auto-falls-back to post_link_module = "platform.bundle"
  so the legacy --bundle CLI keeps working for any program that imports
  modules/platform/bundle.sx.

Apple .app bundler (library/modules/platform/bundle.sx):
- Single bundle_main entry covers macOS, iOS simulator, iOS device.
  Per-target Info.plist switch keys off is_ios()/is_ios_simulator() —
  iOS emits UIDeviceFamily / LSRequiresIPhoneOS /
  UIApplicationSceneManifest / DTPlatformName (iPhoneOS or
  iPhoneSimulator); macOS emits the minimal CFBundle* set.
- iOS-only steps:
  - Provisioning embed: fs.read_file + fs.write_file to
    <bundle>/embedded.mobileprovision.
  - Framework embed: recursive cp -R per -F search path into
    <bundle>/Frameworks/<Name>.framework/ (until fs.sx grows list_dir).
  - Entitlements extraction: four process.run calls (security cms -D,
    plutil -extract Entitlements xml1, plutil -extract
    ApplicationIdentifierPrefix.0, plutil -replace application-identifier)
    resolving the wildcard <TEAM>.* -> <TEAM>.<bundle_id>.
  - Real codesign with --entitlements when present.
- Asset dirs (add_asset_dir): recursive cp -R src/. into <bundle>/dest/.
  Missing src is treated as "nothing to do" so projects can register
  add_asset_dir("assets", "assets") unconditionally.

Parser:
- parseStmt() now accepts #import \"path\"; and #framework \"Name\"; as
  statement-position tokens. Needed for top-level
  inline if OS == .android { #import \"modules/platform/android.sx\"; }
  blocks (issue-0042 flatten pass surfaces them); chess's
  inline-if-with-#import was rejected at parse time before this fix.

Removals from src/target.zig:
- createBundle, embedFramework, extractEntitlements, buildInfoPlist,
  codesign (~210 lines). main.zig no longer calls createBundle after
  link(); the sx callback is the single entry point.

Tests / regression markers (all run under sx run host JIT):
- examples/115-post-link-callback.sx — callback registration round-trip.
- examples/116-fs-roundtrip.sx — fs.write_file -> fs.read_file -> exists.
- examples/117-process-roundtrip.sx — process.run + env + find_executable.
- examples/118-macos-bundle.sx — macOS .app via bundle_main callback.
- examples/119-interp-cast-ptr-cmp.sx — cast(T) val under interpreter.
- examples/120-interp-variadic-any.sx — variadic ..Any indexing in IR
  interpreter.
- examples/121-ios-sim-bundle.sx — iOS-sim cross-compile + .app with
  iOS-shaped Info.plist (added to tests/cross_compile.sh as the
  ios-sim tuple).
- examples/122-ios-device-bundle.sx — iOS device cross-compile +
  full codesign pipeline (provisioning embed + entitlements
  extraction + --entitlements codesign). Manually verified end-to-end:
  installed via xcrun devicectl device install app + launched
  successfully on iPhone 17 Pro.
- examples/123-inline-if-import-in-body.sx — locks in the parser fix.

zig build && zig build test && bash tests/run_examples.sh => 141 passed,
0 failed; bash tests/cross_compile.sh => 7 passed, 0 failed.

examples/115-post-link-callback.sx

@@ -0,0 +1,26 @@
+#import "modules/std.sx";
+#import "modules/compiler.sx";
+
+// Post-link callback registration. The compiler invokes `post_link`
+// after `target.link()` returns (sx build). Under `sx run` (JIT) the
+// callback is registered but never invoked because there's no link
+// phase — so the only thing this example prints under the test
+// runner is `runtime main`. The post-link path is exercised via
+// `sx build` separately.
+
+puts :: (s: [:0]u8) -> s32 #foreign libc;
+
+post_link :: () -> bool {
+    puts("[post-link] callback fired");
+    true;
+}
+
+configure :: () {
+    opts := build_options();
+    opts.set_post_link_callback(post_link);
+}
+#run configure();
+
+main :: () {
+    print("runtime main\n");
+}

examples/116-fs-roundtrip.sx

@@ -0,0 +1,43 @@
+#import "modules/std.sx";
+#import "modules/fs.sx";
+
+// fs.sx smoke test: every primitive the bundling phase needs.
+// Creates a temp tree, writes/reads/copies/renames/chmod/deletes
+// through it, then exercises basename/dirname.
+
+main :: () {
+    if !create_dir_all("/tmp/sx_fs_test/a/b/c") { print("FAIL mkdir_all\n"); return; }
+    if !exists("/tmp/sx_fs_test/a/b/c") { print("FAIL exists after mkdir_all\n"); return; }
+
+    if !write_file("/tmp/sx_fs_test/hello.txt", "hello fs") { print("FAIL write_file\n"); return; }
+    if r := read_file("/tmp/sx_fs_test/hello.txt") {
+        if r.len != 8 { print("FAIL read length: got {}\n", r.len); return; }
+        print("read: {}\n", r);
+    } else {
+        print("FAIL read_file\n");
+        return;
+    }
+
+    if !copy_file("/tmp/sx_fs_test/hello.txt", "/tmp/sx_fs_test/hello.copy") { print("FAIL copy\n"); return; }
+    if !exists("/tmp/sx_fs_test/hello.copy") { print("FAIL exists after copy\n"); return; }
+
+    if !move("/tmp/sx_fs_test/hello.copy", "/tmp/sx_fs_test/renamed.txt") { print("FAIL rename\n"); return; }
+    if exists("/tmp/sx_fs_test/hello.copy") { print("FAIL old still exists after rename\n"); return; }
+    if !exists("/tmp/sx_fs_test/renamed.txt") { print("FAIL new missing after rename\n"); return; }
+
+    if !set_mode("/tmp/sx_fs_test/hello.txt", 493) { print("FAIL chmod\n"); return; }
+
+    if !delete_file("/tmp/sx_fs_test/hello.txt") { print("FAIL delete_file\n"); return; }
+    if !delete_file("/tmp/sx_fs_test/renamed.txt") { print("FAIL delete renamed\n"); return; }
+    if !delete_dir("/tmp/sx_fs_test/a/b/c") { print("FAIL delete c\n"); return; }
+    if !delete_dir("/tmp/sx_fs_test/a/b") { print("FAIL delete b\n"); return; }
+    if !delete_dir("/tmp/sx_fs_test/a") { print("FAIL delete a\n"); return; }
+    if !delete_dir("/tmp/sx_fs_test") { print("FAIL delete root\n"); return; }
+
+    print("basename(/a/b/c.txt) = {}\n", basename("/a/b/c.txt"));
+    print("basename(foo) = {}\n", basename("foo"));
+    print("dirname(/a/b/c.txt) = {}\n", dirname("/a/b/c.txt"));
+    print("dirname(foo) = {}\n", dirname("foo"));
+
+    print("ok\n");
+}

examples/117-process-roundtrip.sx

@@ -0,0 +1,47 @@
+#import "modules/std.sx";
+#import "modules/process.sx";
+
+// process.sx smoke test: run + env + find_executable, with
+// success-path and failure-path coverage.
+//
+// The PATH-startswith check is stable across machines (PATH always
+// begins with an absolute path); `ls` is guaranteed in /bin on every
+// POSIX host this targets.
+
+main :: () {
+    if r := run("echo hello world") {
+        print("exit={}, stdout={}", r.exit_code, r.stdout);
+    } else {
+        print("FAIL run echo\n");
+        return;
+    }
+
+    if r := run("false") {
+        if r.exit_code == 0 { print("FAIL: false should not exit 0\n"); return; }
+        print("false exit={}\n", r.exit_code);
+    }
+
+    if n := env("SX_DEFINITELY_UNSET_VAR") {
+        print("FAIL: unset var returned: {}\n", n);
+        return;
+    }
+    print("unset var: null (ok)\n");
+
+    if w := find_executable("ls") {
+        // /bin/ls on macOS, /usr/bin/ls on Linux. Either is fine —
+        // we only assert the result is non-empty and absolute.
+        if w.len < 2 { print("FAIL: ls path too short\n"); return; }
+        if w[0] != 47 { print("FAIL: ls path not absolute\n"); return; }
+        print("ls is absolute (ok)\n");
+    } else {
+        print("FAIL find ls\n"); return;
+    }
+
+    if w := find_executable("sx_definitely_no_such_command_12345") {
+        print("FAIL: bogus exec returned: {}\n", w);
+        return;
+    }
+    print("missing exec: null (ok)\n");
+
+    print("ok\n");
+}

examples/118-macos-bundle.sx

@@ -0,0 +1,18 @@
+#import "modules/std.sx";
+#import "modules/compiler.sx";
+#import "modules/platform/bundle.sx";
+
+// Register the sx-side `.app` bundler. Under `sx build` on macOS, the
+// post-link callback runs and writes a real `.app` next to the
+// binary. Under `sx run` (JIT) the callback is registered but never
+// fires — so the test runner only sees `runtime main`.
+
+configure :: () {
+    opts := build_options();
+    opts.set_bundle_path("HelloApp.app");
+    opts.set_bundle_id("co.example.hello");
+    opts.set_post_link_callback(bundle_main);
+}
+#run configure();
+
+main :: () { print("runtime main\n"); }

examples/119-interp-cast-ptr-cmp.sx

@@ -0,0 +1,32 @@
+// `cast(T) val` inside a conditional, evaluated by the IR interpreter
+// during a post-link callback. The `cast` syntax lowers the type arg
+// (`s64`) as a `placeholder` IR op; the interpreter treats placeholders
+// as undef so the comparison runs through unchanged.
+
+#import "modules/std.sx";
+#import "modules/compiler.sx";
+
+libc :: #library "c";
+popen :: (cmd: [:0]u8, mode: [:0]u8) -> *void #foreign libc;
+puts  :: (s: [:0]u8) -> s32 #foreign libc;
+
+R :: struct { x: s32; }
+
+bug :: (cmd: [:0]u8) -> ?R {
+    f := popen(cmd, "r");
+    if cast(s64) f == 0 { return null; }
+    R.{ x = 1 };
+}
+
+post_link :: () -> bool {
+    if r := bug("echo hi") { puts("ok"); } else { puts("null"); }
+    true;
+}
+
+configure :: () {
+    opts := build_options();
+    opts.set_post_link_callback(post_link);
+}
+#run configure();
+
+main :: () { print("rt\n"); }

examples/120-interp-variadic-any.sx

@@ -0,0 +1,29 @@
+// IR interpreter — variadic `..Any` indexing inside post-link callback.
+//
+// `format(fmt, args: ..Any)` lowers to `any_to_string(args[i])` calls.
+// The interpreter must be able to read every element of the packed
+// `[N x Any]` slice from within a `#run`/post-link callback, not just
+// the first two — and not just via JIT.
+
+#import "modules/std.sx";
+#import "modules/compiler.sx";
+
+puts :: (s: [:0]u8) -> s32 #foreign libc;
+
+cb :: () -> bool {
+    a := format("{}", "x");
+    puts("1-arg ok");
+    b := format("{} {}", "x", "y");
+    puts("2-arg ok");
+    c := format("{} {} {}", "x", "y", "z");
+    puts("3-arg ok");
+    true;
+}
+
+configure :: () {
+    opts := build_options();
+    opts.set_post_link_callback(cb);
+}
+#run configure();
+
+main :: () { print("rt\n"); }

examples/121-ios-sim-bundle.sx

@@ -0,0 +1,20 @@
+#import "modules/std.sx";
+#import "modules/compiler.sx";
+#import "modules/platform/bundle.sx";
+
+// Cross-compile regression for the iOS-simulator branch of
+// `platform.bundle`. On a host with the iPhoneSimulator SDK installed,
+// `sx build --target ios-sim` writes a `.app` with the iOS-shaped
+// Info.plist (UIDeviceFamily, LSRequiresIPhoneOS,
+// UIApplicationSceneManifest, DTPlatformName=iPhoneSimulator). Ad-hoc
+// codesign; no provisioning embed needed for the simulator.
+
+configure :: () {
+    opts := build_options();
+    opts.set_bundle_path("IosSimApp.app");
+    opts.set_bundle_id("co.example.iossim");
+    opts.set_post_link_callback(bundle_main);
+}
+#run configure();
+
+main :: () { print("ios-sim runtime main\n"); }

examples/122-ios-device-bundle.sx

@@ -0,0 +1,54 @@
+// iOS *device* end-to-end exercise for `platform.bundle`. Distinct from
+// 121-ios-sim-bundle.sx because the device path adds three steps that
+// don't run on the simulator: provisioning profile embed, entitlements
+// extraction (`security cms` + `plutil` pipeline resolving the
+// wildcard `<TEAM>.*` → `<TEAM>.<bundle_id>`), and codesign with
+// `--entitlements`.
+//
+// Build:
+//   sx build --target ios examples/122-ios-device-bundle.sx -o /tmp/SxDeviceProbe
+//
+// Install + launch (requires the device UDID to be on the profile):
+//   xcrun devicectl device install app --device <name> /tmp/SxDeviceProbe.app
+//   xcrun devicectl device process launch --device <name> co.swipelab.sxprobe
+//
+// The bundle id (`co.swipelab.sxprobe`) and codesign identity below
+// match the test team's wildcard `SwipeS32DevProfile.mobileprovision`.
+// Update the three set_* values to your own identity / profile / id to
+// re-exercise on a different developer account.
+
+#import "modules/std.sx";
+#import "modules/std/uikit.sx";
+#import "modules/compiler.sx";
+#import "modules/platform/bundle.sx";
+
+configure :: () {
+    opts := build_options();
+    opts.set_bundle_path("/tmp/SxDeviceProbe.app");
+    opts.set_bundle_id("co.swipelab.sxprobe");
+    opts.set_codesign_identity("Apple Development: Alexandru Agrapine (DC8VVHJ9W4)");
+    opts.set_provisioning_profile("/Users/agra/Downloads/SwipeS32DevProfile.mobileprovision");
+    opts.set_post_link_callback(bundle_main);
+}
+#run configure();
+
+// IMP for application:didFinishLaunchingWithOptions:
+//   Obj-C: -(BOOL)application:(UIApplication *)app didFinishLaunchingWithOptions:(NSDictionary *)opts
+//   Type encoding: "c@:@@"  -- BOOL (signed char), self, _cmd, id, id
+did_finish_launching :: (self: *void, _cmd: *void, app: *void, opts: *void) -> u8 callconv(.c) {
+    NSLog(ns_string("[sx-device-probe] launched\n".ptr));
+    return 1; // YES
+}
+
+main :: () -> s32 {
+    UIResponder := objc_getClass("UIResponder".ptr);
+    SxAppDelegate := objc_allocateClassPair(UIResponder, "SxAppDelegate".ptr, 0);
+
+    sel := sel_registerName("application:didFinishLaunchingWithOptions:".ptr);
+    class_addMethod(SxAppDelegate, sel, xx did_finish_launching, "c@:@@".ptr);
+
+    objc_registerClassPair(SxAppDelegate);
+
+    // UIApplicationMain blocks driving iOS's run loop.
+    return UIApplicationMain(0, xx 0, xx 0, ns_string("SxAppDelegate".ptr));
+}

examples/123-inline-if-import-in-body.sx

@@ -0,0 +1,20 @@
+// Regression: `#import` inside the body of a top-level
+// `inline if OS == .X { ... }` block. The imports.zig flatten pass
+// (issue-0042) lifts these to the top level before resolution; the
+// parser arm in `parseStmt` that accepts them was missing on macOS /
+// iOS / linux until this commit, so chess's
+// `inline if OS == .android { #import "modules/platform/android.sx"; }`
+// pattern broke parse on every non-Android target.
+//
+// The body here also carries a global decl to mirror chess's shape —
+// the prior bug was specifically about hash_import inside an inline-if
+// body, not the global decl alongside it.
+
+#import "modules/std.sx";
+
+inline if OS == .android {
+    #import "modules/std.sx";
+    g_android_only : s32 = 0;
+}
+
+main :: () { print("ok\n"); }