From 2e1c7cdc3c62aeeb4eb62b96c4d6166c33f1d8ea Mon Sep 17 00:00:00 2001
From: CRT <hi@crt.fyi>
Date: Sat, 24 Oct 2026 12:19:27 +0800
Subject: [PATCH] mas: placeholders the scrub accepts

---
 cli/lib/mas.ts          |  2 +-
 tests/mas-build.test.ts | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/cli/lib/mas.ts b/cli/lib/mas.ts
index a5365bb..0a9d650 100644
--- a/cli/lib/mas.ts
+++ b/cli/lib/mas.ts
@@ -125,7 +125,7 @@ export interface PathFreeInput { home: string; user: string; root: string; cargo
  *  and the home folder; no debug info; symbols stripped. Pure. */
 export function pathFreeEnv(i: PathFreeInput): Record<string, string> {
   const maps: [string, string][] = [
-    [i.root, '/src'], [i.cargoHome ?? `${i.home}/.cargo`, '/cargo'], [i.rustupHome ?? `${i.home}/.rustup`, '/rustup'], [i.home, '/home/build'],
+    [i.root, '/src'], [i.cargoHome ?? `${i.home}/.cargo`, '/cargo'], [i.rustupHome ?? `${i.home}/.rustup`, '/rustup'], [i.home, '/build-home'],
   ];
   const seen = new Set<string>();
   const flags = maps.filter(([from]) => from && !seen.has(from) && seen.add(from)).map(([from, to]) => `--remap-path-prefix=${from}=${to}`);
diff --git a/tests/mas-build.test.ts b/tests/mas-build.test.ts
index b689b02..1fd738c 100644
--- a/tests/mas-build.test.ts
+++ b/tests/mas-build.test.ts
@@ -94,23 +94,23 @@ describe('identities and profiles', () => {
 
 describe('path-free', () => {
   test('remaps checkout, cargo, rustup, home; no debug info', () => {
-    const e = pathFreeEnv({ home: '/Users/dev', user: 'dev', root: '/Users/dev/work/app', rustflags: '-C target-cpu=native' });
+    const e = pathFreeEnv({ home: '/Users/you', user: 'you', root: '/Users/you/work/app', rustflags: '-C target-cpu=native' });
     expect(e.RUSTFLAGS).toContain('-C target-cpu=native');
-    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/dev/work/app=/src');
-    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/dev/.cargo=/cargo');
-    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/dev/.rustup=/rustup');
-    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/dev=/home/build');
+    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/you/work/app=/src');
+    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/you/.cargo=/cargo');
+    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/you/.rustup=/rustup');
+    expect(e.RUSTFLAGS).toContain('--remap-path-prefix=/Users/you=/build-home');
     expect(e.CARGO_PROFILE_RELEASE_DEBUG).toBe('0');
     
   });
   test('leak scan finds the home folder in a binary and a plist', () => {
     const app = mkdtempSync(join(tmp, 'app-'));
     mkdirSync(join(app, 'Contents/MacOS'), { recursive: true });
-    writeFileSync(join(app, 'Contents/MacOS/bin'), Buffer.concat([Buffer.from([0, 1, 2]), Buffer.from('panic at /Users/dev/.cargo/registry/x.rs'), Buffer.from([0])]));
+    writeFileSync(join(app, 'Contents/MacOS/bin'), Buffer.concat([Buffer.from([0, 1, 2]), Buffer.from('panic at /Users/you/.cargo/registry/x.rs'), Buffer.from([0])]));
     writeFileSync(join(app, 'Contents/Info.plist'), 'clean');
-    const leaks = scanPathLeaks(app, ['/Users/dev', '/Users/dev/']);
-    expect(leaks.map(l => `${l.file}:${l.needle}`)).toEqual(['Contents/MacOS/bin:/Users/dev', 'Contents/MacOS/bin:/Users/dev/']);
-    expect(scanPathLeaks(app, ['/Users/nobody'])).toEqual([]);
+    const leaks = scanPathLeaks(app, ['/Users/you', '/Users/you/']);
+    expect(leaks.map(l => `${l.file}:${l.needle}`)).toEqual(['Contents/MacOS/bin:/Users/you', 'Contents/MacOS/bin:/Users/you/']);
+    expect(scanPathLeaks(app, ['/Users/me'])).toEqual([]);
   });
 });
 
@@ -130,7 +130,7 @@ describe('app and pkg checks', () => {
     expect(appProblems({ ...good, entitlements: null, hasProfile: false }, { ...o, signed: false }).errors).toEqual([]);
   });
   test('path leaks are errors with --path-free, warnings without', () => {
-    const leaks = [{ file: 'Contents/MacOS/bin', needle: '/Users/dev', count: 3 }];
+    const leaks = [{ file: 'Contents/MacOS/bin', needle: '/Users/you', count: 3 }];
     expect(appProblems({ ...good, leaks }, o).errors[0]).toContain('local paths');
     const w = appProblems({ ...good, leaks }, { ...o, pathFree: false });
     expect(w.errors).toEqual([]);