From fd5dd225438d84154908933c224913be314f0dc1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 10:35:32 +0000
Subject: [PATCH 1/3] webdetect: scope service ES-level scan to the entry graph
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A Node service's ES level was derived from every `.js` under the
service directory (a recursive `collect_js` walk). That wrongly pulls in
vendored code — `node_modules`, or a streaming server the app spawns on
its own bundled Node — whose syntax level says nothing about what the
firmware's Node.js executes. A package that ships its own newer Node
would be failed against the TV's old Node purely on that vendored code.

Grade only the code the firmware Node actually runs: start at
`package.json` `main` (default `index.js`) and follow the static,
relative module graph via `require('./x')`, `import`/`export … from`,
`import('./x')`, and side-effect `import './x'`. Bare specifiers
(npm packages, built-ins) are not followed, and traversal is confined
to the service directory. Add unit tests covering entry-graph scoping,
require/import resolution, and exclusion of vendored/bare-specifier code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XtKyCd9ucV7PRGH9LQZRRg
---
 common/webdetect/src/js.rs      | 161 +++++++++++++++++++++++++++++++-
 common/webdetect/src/service.rs |  87 +++++++++++++++--
 2 files changed, 236 insertions(+), 12 deletions(-)

diff --git a/common/webdetect/src/js.rs b/common/webdetect/src/js.rs
index 5a6b034..6371f3b 100644
--- a/common/webdetect/src/js.rs
+++ b/common/webdetect/src/js.rs
@@ -6,9 +6,9 @@
 //! means keywords/operators/identifiers inside strings, comments and regex
 //! literals are ignored.
 
-use std::collections::{BTreeMap, HashSet};
+use std::collections::{BTreeMap, HashSet, VecDeque};
 use std::fs;
-use std::path::Path;
+use std::path::{Component, Path, PathBuf};
 
 use ress::prelude::*;
 
@@ -64,6 +64,163 @@ pub(crate) fn collect_js(dir: &Path, depth: usize, out: &mut Vec<(String, String
     }
 }
 
+/// Module-resolution extensions tried for an extensionless specifier and for a
+/// directory's `index` file, in Node's precedence order.
+const RESOLVE_EXTS: [&str; 3] = ["js", "cjs", "mjs"];
+
+/// Gather the JS a Node service's entry point actually pulls in: starting from
+/// `main` (default `index.js`), follow the **static** module graph via relative
+/// `require`/`import`/`export … from`/`import(...)` specifiers, staying inside
+/// `dir`.
+///
+/// Unlike [`collect_js`] (used for a web app's flat bundle), this does *not*
+/// slurp every `.js` under the tree. A service commonly ships vendored code —
+/// `node_modules`, or a server it spawns on its **own** bundled Node — whose ES
+/// level says nothing about what the firmware's Node runs. Only first-party code
+/// reachable from `main` runs on the firmware Node, so only that is graded.
+/// Bare specifiers (npm packages, built-ins) are deliberately not followed.
+pub(crate) fn collect_service_js(dir: &Path, main: Option<&str>, out: &mut Vec<(String, String)>) {
+    let Some(entry) = resolve_module(dir, dir, main.unwrap_or("index.js")) else {
+        return;
+    };
+    let mut visited: HashSet<PathBuf> = HashSet::new();
+    let mut queue: VecDeque<PathBuf> = VecDeque::new();
+    queue.push_back(entry);
+    while let Some(path) = queue.pop_front() {
+        if out.len() >= MAX_JS_FILES {
+            return;
+        }
+        if !visited.insert(path.clone()) {
+            continue;
+        }
+        if fs::metadata(&path).map(|m| m.len()).unwrap_or(u64::MAX) > MAX_FILE_BYTES {
+            continue;
+        }
+        let Ok(bytes) = fs::read(&path) else { continue };
+        let content = String::from_utf8_lossy(&bytes).into_owned();
+        let base = path.parent().unwrap_or(dir);
+        for spec in extract_relative_specifiers(&content) {
+            if let Some(dep) = resolve_module(dir, base, &spec) {
+                if !visited.contains(&dep) {
+                    queue.push_back(dep);
+                }
+            }
+        }
+        let name = path.file_name().unwrap().to_string_lossy().into_owned();
+        out.push((name, content));
+    }
+}
+
+/// Resolve a relative module specifier `spec` (or an entry `main`) against
+/// `base`, Node-style: try the path as a JS file, then with a `.js/.cjs/.mjs`
+/// extension, then as a directory's `index` file. Returns the resolved path only
+/// when it exists and stays lexically within `root`.
+fn resolve_module(root: &Path, base: &Path, spec: &str) -> Option<PathBuf> {
+    let candidate = base.join(spec);
+    // 1. Exact path to an existing JS-family file (an explicit extension).
+    if candidate.is_file() {
+        return has_js_ext(&candidate).then(|| contain(root, &candidate)).flatten();
+    }
+    // 2. Bare specifier + extension (`./foo` → `./foo.js`). Appends rather than
+    //    replacing, so a dotted basename (`./foo.bar`) isn't mangled.
+    for ext in RESOLVE_EXTS {
+        let p = PathBuf::from(format!("{}.{ext}", candidate.to_string_lossy()));
+        if p.is_file() {
+            return contain(root, &p);
+        }
+    }
+    // 3. Directory index (`./dir` → `./dir/index.js`).
+    if candidate.is_dir() {
+        for ext in RESOLVE_EXTS {
+            let p = candidate.join(format!("index.{ext}"));
+            if p.is_file() {
+                return contain(root, &p);
+            }
+        }
+    }
+    None
+}
+
+fn has_js_ext(path: &Path) -> bool {
+    matches!(
+        path.extension().and_then(|e| e.to_str()),
+        Some("js") | Some("cjs") | Some("mjs")
+    )
+}
+
+/// Keep `path` only if it stays within `root` after lexically resolving `.`/`..`
+/// (an extracted package has no on-disk symlinks, so this matches the real
+/// tree). Guards against a specifier like `../../etc/passwd`.
+fn contain(root: &Path, path: &Path) -> Option<PathBuf> {
+    let root = lexical_normalize(root);
+    let path = lexical_normalize(path);
+    path.starts_with(&root).then_some(path)
+}
+
+fn lexical_normalize(path: &Path) -> PathBuf {
+    let mut out = PathBuf::new();
+    for comp in path.components() {
+        match comp {
+            Component::ParentDir => {
+                out.pop();
+            }
+            Component::CurDir => {}
+            other => out.push(other.as_os_str()),
+        }
+    }
+    out
+}
+
+/// A token, reduced to just what the module-specifier lookback needs.
+enum SpecTok {
+    Import,
+    OpenParen,
+    Ident(String),
+    Str(String),
+    Other,
+}
+
+/// Extract the **relative** module specifiers (`./`, `../`) a source statically
+/// references via `require('x')`, `import(...)`, `import 'x'`, and
+/// `import`/`export … from 'x'`. Tokenizing means specifiers written as string
+/// literals in comments or unrelated strings are not matched.
+fn extract_relative_specifiers(content: &str) -> Vec<String> {
+    let mut specs = Vec::new();
+    // The last two meaningful (non-comment) tokens, for lookback.
+    let mut prev: Option<SpecTok> = None;
+    let mut prev2: Option<SpecTok> = None;
+    for item in Scanner::new(content) {
+        let Ok(item) = item else { break };
+        let cur = match &item.token {
+            Token::Comment(_) => continue,
+            Token::String(s) => SpecTok::Str(s.as_ref().to_string()),
+            Token::Ident(id) => SpecTok::Ident(id.as_ref().to_string()),
+            Token::Keyword(Keyword::Import(_)) => SpecTok::Import,
+            Token::Punct(Punct::OpenParen) => SpecTok::OpenParen,
+            _ => SpecTok::Other,
+        };
+        if let SpecTok::Str(s) = &cur {
+            let is_specifier = match (&prev, &prev2) {
+                // require('x')
+                (Some(SpecTok::OpenParen), Some(SpecTok::Ident(n))) if n == "require" => true,
+                // import('x')
+                (Some(SpecTok::OpenParen), Some(SpecTok::Import)) => true,
+                // import … from 'x' / export … from 'x' (`from` is contextual)
+                (Some(SpecTok::Ident(n)), _) if n == "from" => true,
+                // side-effect import 'x'
+                (Some(SpecTok::Import), _) => true,
+                _ => false,
+            };
+            if is_specifier && (s.starts_with("./") || s.starts_with("../")) {
+                specs.push(s.clone());
+            }
+        }
+        prev2 = prev.take();
+        prev = Some(cur);
+    }
+    specs
+}
+
 /// Analyze JS sources for ES syntax level and static runtime-API usage.
 /// `html_module` marks a `<script type="module">` (web only) as an extra
 /// engine-level signal. Returns `es_level = None` only when there is nothing to
diff --git a/common/webdetect/src/service.rs b/common/webdetect/src/service.rs
index 2cda4b4..1c92e5e 100644
--- a/common/webdetect/src/service.rs
+++ b/common/webdetect/src/service.rs
@@ -14,9 +14,15 @@ struct PackageJson {
     main: Option<String>,
 }
 
-/// Inspect a service directory: read `package.json` for the entry point, and
-/// analyze the service's own `.js` code for its ES language level
-/// (checked against the firmware's Node.js) and runtime-API usage.
+/// Inspect a service directory: read `package.json` for the entry point, then
+/// analyze the code the firmware's Node.js actually runs for its ES language
+/// level (checked against that Node.js) and runtime-API usage.
+///
+/// The scan starts at `main` and follows only the static, relative module graph
+/// (`require`/`import`) — not every `.js` in the tree. A service often bundles
+/// vendored code (`node_modules`, or a server it spawns on its own bundled Node)
+/// whose ES level says nothing about the firmware Node; grading that would
+/// wrongly fail packages that ship a newer Node themselves.
 ///
 /// Note: `engines.node` is deliberately NOT read — webOS services don't set it
 /// reliably. The ES level, by contrast, is derived from the actual code and so
@@ -26,7 +32,7 @@ pub fn detect_service_runtime(dir: &Path) -> ServiceRuntimeDetection {
     let pkg: PackageJson = serde_json::from_str(&text).unwrap_or_default();
 
     let mut sources: Vec<(String, String)> = Vec::new();
-    js::collect_js(dir, 0, &mut sources);
+    js::collect_service_js(dir, pkg.main.as_deref(), &mut sources);
     let analysis = js::analyze_js(&sources, false);
 
     ServiceRuntimeDetection {
@@ -41,20 +47,27 @@ pub fn detect_service_runtime(dir: &Path) -> ServiceRuntimeDetection {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io::Write;
+    use crate::EsLevel;
+    use std::path::Path;
+
+    fn write(dir: &Path, rel: &str, body: &str) {
+        let path = dir.join(rel);
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).unwrap();
+        }
+        fs::write(path, body).unwrap();
+    }
 
     fn write_pkg(body: &str) -> tempfile::TempDir {
         let dir = tempfile::TempDir::new().unwrap();
-        let mut f = fs::File::create(dir.path().join("package.json")).unwrap();
-        f.write_all(body.as_bytes()).unwrap();
+        write(dir.path(), "package.json", body);
         dir
     }
 
     #[test]
     fn parses_main() {
-        let dir = write_pkg(
-            r#"{ "main": "service.js", "name": "com.example.app.service" }"#,
-        );
+        let dir = write_pkg(r#"{ "main": "service.js", "name": "com.example.app.service" }"#);
+        write(dir.path(), "service.js", "var x = 1;");
         let d = detect_service_runtime(dir.path());
         assert_eq!(d.main.as_deref(), Some("service.js"));
     }
@@ -64,5 +77,59 @@ mod tests {
         let dir = tempfile::TempDir::new().unwrap();
         let d = detect_service_runtime(dir.path());
         assert!(d.main.is_none());
+        assert!(d.es_level.is_none());
+    }
+
+    #[test]
+    fn grades_only_the_entry_graph_not_the_whole_tree() {
+        // The entry point is plain ES5 and pulls in nothing; a vendored server
+        // and node_modules ship modern syntax but never run on the firmware Node.
+        let dir = write_pkg(r#"{ "main": "service.js" }"#);
+        write(dir.path(), "service.js", "var x = 1; function f() { return x; }");
+        write(dir.path(), "server/index.js", "const y = a?.b ?? c;"); // ES2020, spawned separately
+        write(dir.path(), "node_modules/dep/index.js", "const z = () => 2;"); // ES2015, vendored
+        let d = detect_service_runtime(dir.path());
+        assert_eq!(d.es_level, Some(EsLevel::Es5));
+    }
+
+    #[test]
+    fn follows_relative_require() {
+        let dir = write_pkg(r#"{ "main": "service.js" }"#);
+        write(dir.path(), "service.js", "var helper = require('./lib/helper');");
+        write(dir.path(), "lib/helper.js", "const v = a ?? b;"); // ES2020
+        let d = detect_service_runtime(dir.path());
+        assert_eq!(d.es_level, Some(EsLevel::Es2020));
+    }
+
+    #[test]
+    fn follows_relative_import_and_export_from() {
+        let dir = write_pkg(r#"{ "main": "service.js" }"#);
+        write(
+            dir.path(),
+            "service.js",
+            "import x from './a.js'; export { y } from './b.js';",
+        );
+        write(dir.path(), "a.js", "var a = 1;");
+        write(dir.path(), "b.js", "class Widget {}"); // ES2015
+        let d = detect_service_runtime(dir.path());
+        assert_eq!(d.es_level, Some(EsLevel::Es2015));
+    }
+
+    #[test]
+    fn does_not_follow_bare_specifiers() {
+        // `require('modern-dep')` resolves into node_modules — not graded.
+        let dir = write_pkg(r#"{ "main": "service.js" }"#);
+        write(dir.path(), "service.js", "var d = require('modern-dep');");
+        write(dir.path(), "node_modules/modern-dep/index.js", "const z = a?.b;"); // ES2020
+        let d = detect_service_runtime(dir.path());
+        assert_eq!(d.es_level, Some(EsLevel::Es5));
+    }
+
+    #[test]
+    fn defaults_entry_to_index_js() {
+        let dir = write_pkg(r#"{ "name": "com.example.app.service" }"#);
+        write(dir.path(), "index.js", "const v = a ?? b;"); // ES2020
+        let d = detect_service_runtime(dir.path());
+        assert_eq!(d.es_level, Some(EsLevel::Es2020));
     }
 }

From b6969a3e3f1012cc8625dcea40f7ce379a155e4d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 10:55:35 +0000
Subject: [PATCH 2/3] ipk-verify: report a JS service's bundled native binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A JS/Node service run by the firmware's Node can still ship native ELF
binaries beside its scripts — its own `node`, `ffmpeg`, and `.so`s — but
the report showed nothing about them (only native components list an
exe/libs). That hides exactly the detail a reviewer needs to understand a
"bundles its own runtime" package, e.g. that every binary is 32-bit ARM
(so aarch64 TVs are out).

Scan a non-native service's directory at parse time and classify each
bundled ELF as an executable or shared library (a PT_INTERP program
header distinguishes a PIE executable from a real shared object) with its
architecture. Surface the list as supplementary `--details` info that
never affects the verdict: folded into a <details> block on Markdown,
a plain bullet list otherwise.

New `bin_lib::BundledArtifact` does the header-only classification;
`ServiceInfo` carries the list to the verifier and renderer. Adds unit
tests for classification and the parse-time scan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XtKyCd9ucV7PRGH9LQZRRg
---
 common/bin/src/artifact.rs             | 109 ++++++++++++++++++++++
 common/bin/src/lib.rs                  |   3 +
 common/ipk/src/component.rs            | 121 ++++++++++++++++++++++++-
 common/ipk/src/lib.rs                  |   7 +-
 common/verify/src/ipk/mod.rs           |   6 +-
 packages/ipk-verify/src/main.rs        |  46 +++++++++-
 packages/ipk-verify/tests/detection.rs |   1 +
 7 files changed, 286 insertions(+), 7 deletions(-)
 create mode 100644 common/bin/src/artifact.rs

diff --git a/common/bin/src/artifact.rs b/common/bin/src/artifact.rs
new file mode 100644
index 0000000..68b8f35
--- /dev/null
+++ b/common/bin/src/artifact.rs
@@ -0,0 +1,109 @@
+//! Lightweight ELF classification for *bundled* artifacts.
+//!
+//! Unlike [`crate::BinaryInfo`]/[`crate::LibraryInfo`] (which parse the dynamic
+//! symbol/needed tables for link verification), this only reads the ELF header
+//! and program headers to answer two questions cheaply: is this file an
+//! executable or a shared library, and for which architecture? It is used to
+//! surface the native binaries a JS service ships alongside its scripts (its own
+//! `node`, `ffmpeg`, `.so`s) as supplementary report info.
+
+use std::io::{Read, Seek};
+
+use elf::endian::AnyEndian;
+use elf::file::Class;
+use elf::{abi, ElfStream};
+use serde::{Deserialize, Serialize};
+
+/// Whether a bundled ELF is a program or a shared library.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ArtifactKind {
+    Executable,
+    SharedLibrary,
+}
+
+impl ArtifactKind {
+    pub fn label(self) -> &'static str {
+        match self {
+            ArtifactKind::Executable => "executable",
+            ArtifactKind::SharedLibrary => "shared library",
+        }
+    }
+}
+
+/// A native ELF file bundled inside a component, described just enough for a
+/// report line: its path within the component, kind, and architecture.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BundledArtifact {
+    /// Slash-separated path relative to the component directory.
+    pub path: String,
+    pub kind: ArtifactKind,
+    /// Human-readable architecture (e.g. "ARM (32-bit)"), or `None` if unknown.
+    pub arch: Option<String>,
+}
+
+impl BundledArtifact {
+    /// Classify an ELF stream. Returns `None` for anything that isn't an ELF
+    /// executable or shared library (data files, scripts, unreadable files).
+    pub fn identify<S, P>(source: S, path: P) -> Option<Self>
+    where
+        S: Read + Seek,
+        P: Into<String>,
+    {
+        let elf = ElfStream::<AnyEndian, S>::open_stream(source).ok()?;
+        let e_type = elf.ehdr.e_type;
+        let e_machine = elf.ehdr.e_machine;
+        let class = elf.ehdr.class;
+        // A `PT_INTERP` program header marks a file that requests an interpreter
+        // — i.e. a program to run, not a library to load. This is what tells a
+        // PIE executable (also `ET_DYN`) apart from a real shared object.
+        let has_interp = elf.segments().iter().any(|ph| ph.p_type == abi::PT_INTERP);
+        let kind = match e_type {
+            abi::ET_EXEC => ArtifactKind::Executable,
+            abi::ET_DYN if has_interp => ArtifactKind::Executable,
+            abi::ET_DYN => ArtifactKind::SharedLibrary,
+            _ => return None,
+        };
+        Some(BundledArtifact {
+            path: path.into(),
+            kind,
+            arch: arch_label(e_machine, class),
+        })
+    }
+}
+
+/// Map an ELF machine + class to a readable architecture label.
+fn arch_label(machine: u16, class: Class) -> Option<String> {
+    let name = match machine {
+        abi::EM_ARM => "ARM (32-bit)",
+        abi::EM_AARCH64 => "AArch64 (64-bit)",
+        abi::EM_386 => "x86",
+        abi::EM_X86_64 => "x86-64",
+        _ => {
+            return Some(match class {
+                Class::ELF32 => "unknown (32-bit)".to_string(),
+                Class::ELF64 => "unknown (64-bit)".to_string(),
+            })
+        }
+    };
+    Some(name.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    #[test]
+    fn identifies_sample_fixture() {
+        let mut content = Cursor::new(include_bytes!("fixtures/sample.bin"));
+        let a = BundledArtifact::identify(&mut content, "sample.bin").expect("is an ELF");
+        // The fixture links libc.so.6, so it's an ELF of some kind with an arch.
+        assert!(a.arch.is_some());
+    }
+
+    #[test]
+    fn rejects_non_elf() {
+        let mut content = Cursor::new(b"#!/bin/sh\necho hi\n");
+        assert!(BundledArtifact::identify(&mut content, "script.sh").is_none());
+    }
+}
diff --git a/common/bin/src/lib.rs b/common/bin/src/lib.rs
index b09a4ec..a17a3df 100644
--- a/common/bin/src/lib.rs
+++ b/common/bin/src/lib.rs
@@ -1,8 +1,11 @@
 use serde::{Deserialize, Serialize};
 
+pub mod artifact;
 pub mod binary;
 pub mod library;
 
+pub use artifact::{ArtifactKind, BundledArtifact};
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct BinaryInfo {
     pub name: String,
diff --git a/common/ipk/src/component.rs b/common/ipk/src/component.rs
index 6608247..bce9cf0 100644
--- a/common/ipk/src/component.rs
+++ b/common/ipk/src/component.rs
@@ -6,9 +6,9 @@ use std::fs::File;
 use std::io::{Error, ErrorKind};
 use std::path::{Path, PathBuf};
 
-use path_slash::CowExt;
+use path_slash::{CowExt, PathExt};
 
-use bin_lib::{BinaryInfo, LibraryInfo, LibraryPriority};
+use bin_lib::{BinaryInfo, BundledArtifact, LibraryInfo, LibraryPriority};
 
 use crate::path::ensure_within;
 use crate::{AppInfo, Component, ServiceInfo, Symlinks};
@@ -92,9 +92,11 @@ impl Component<ServiceInfo> {
             .map_err(|e| Error::new(ErrorKind::InvalidData, format!("Bad appinfo.json: {e:?}")))?;
         if !info.is_native() {
             // JS/Node service: detect the declared Node.js runtime from the
-            // bundled package.json while the extracted files still exist.
+            // bundled package.json while the extracted files still exist, and
+            // note any native binaries it ships (its own node/ffmpeg/.so).
             let mut info = info;
             info.runtime = Some(webdetect_lib::detect_service_runtime(dir));
+            info.bundled = scan_bundled_artifacts(dir);
             return Ok(Self {
                 id: info.id.clone(),
                 info: info.clone(),
@@ -129,6 +131,54 @@ impl Component<ServiceInfo> {
     }
 }
 
+/// Recursion depth cap for the bundled-artifact walk.
+const BUNDLED_MAX_DEPTH: usize = 12;
+/// Stop after collecting this many bundled artifacts.
+const BUNDLED_MAX: usize = 256;
+
+/// Walk a service directory and classify every bundled ELF (its own `node`,
+/// `ffmpeg`, `.so`s, ...). Non-ELF files (scripts, JSON, assets) are skipped.
+/// Paths are relative to `dir`, slash-separated, and the list is sorted for
+/// stable report output.
+fn scan_bundled_artifacts(dir: &Path) -> Vec<BundledArtifact> {
+    let mut out = Vec::new();
+    walk_bundled(dir, dir, 0, &mut out);
+    out.sort_by(|a, b| a.path.cmp(&b.path));
+    out
+}
+
+fn walk_bundled(root: &Path, dir: &Path, depth: usize, out: &mut Vec<BundledArtifact>) {
+    if depth > BUNDLED_MAX_DEPTH || out.len() >= BUNDLED_MAX {
+        return;
+    }
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        if out.len() >= BUNDLED_MAX {
+            return;
+        }
+        let Ok(ft) = entry.file_type() else { continue };
+        let path = entry.path();
+        if ft.is_dir() {
+            walk_bundled(root, &path, depth + 1, out);
+            continue;
+        }
+        if !ft.is_file() {
+            continue;
+        }
+        let Ok(file) = File::open(&path) else { continue };
+        let rel = path
+            .strip_prefix(root)
+            .unwrap_or(&path)
+            .to_slash_lossy()
+            .into_owned();
+        if let Some(artifact) = BundledArtifact::identify(file, rel) {
+            out.push(artifact);
+        }
+    }
+}
+
 impl<T> Component<T> {
     pub fn find_lib(&self, name: &str) -> Option<&'_ LibraryInfo> {
         return self.libs.iter().find(|lib| lib.has_name(name));
@@ -239,3 +289,68 @@ impl<T> Component<T> {
         Ok(libs.into_values().collect())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bin_lib::ArtifactKind;
+    use std::collections::HashMap;
+
+    fn empty_links() -> Symlinks {
+        Symlinks::new(HashMap::new())
+    }
+
+    #[test]
+    fn js_service_reports_bundled_binaries() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let d = dir.path();
+        // A non-native service: no `engine`/`executable` → runs on system Node.
+        fs::write(d.join("services.json"), r#"{"id":"com.example.app.service"}"#).unwrap();
+        fs::write(d.join("package.json"), r#"{"main":"launch.js"}"#).unwrap();
+        fs::write(d.join("launch.js"), "var x = 1;").unwrap();
+        // A bundled native binary next to the scripts.
+        fs::create_dir_all(d.join("bin")).unwrap();
+        fs::write(
+            d.join("bin/node"),
+            &include_bytes!("../../bin/src/fixtures/sample.bin")[..],
+        )
+        .unwrap();
+
+        let svc = Component::<ServiceInfo>::parse(d, &empty_links()).unwrap();
+        assert!(
+            svc.info
+                .bundled
+                .iter()
+                .any(|a| a.path == "bin/node" && a.arch.is_some()),
+            "expected bin/node to be reported, got {:?}",
+            svc.info.bundled
+        );
+    }
+
+    #[test]
+    fn js_service_without_binaries_reports_none() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let d = dir.path();
+        fs::write(d.join("services.json"), r#"{"id":"com.example.app.service"}"#).unwrap();
+        fs::write(d.join("package.json"), r#"{"main":"launch.js"}"#).unwrap();
+        fs::write(d.join("launch.js"), "var x = 1;").unwrap();
+
+        let svc = Component::<ServiceInfo>::parse(d, &empty_links()).unwrap();
+        assert!(svc.info.bundled.is_empty());
+    }
+
+    #[test]
+    fn kind_classifies_sample_fixture() {
+        // Sanity: the shared fixture classifies as one of the two kinds.
+        let d = tempfile::TempDir::new().unwrap();
+        fs::write(
+            d.path().join("f"),
+            &include_bytes!("../../bin/src/fixtures/lib_runpath.so")[..],
+        )
+        .unwrap();
+        let a =
+            BundledArtifact::identify(File::open(d.path().join("f")).unwrap(), "lib_runpath.so")
+                .unwrap();
+        assert_eq!(a.kind, ArtifactKind::SharedLibrary);
+    }
+}
diff --git a/common/ipk/src/lib.rs b/common/ipk/src/lib.rs
index bb315ce..8c073e6 100644
--- a/common/ipk/src/lib.rs
+++ b/common/ipk/src/lib.rs
@@ -2,7 +2,7 @@ use serde::Deserialize;
 use std::collections::HashMap;
 use std::path::PathBuf;
 
-use bin_lib::{BinaryInfo, LibraryInfo};
+use bin_lib::{BinaryInfo, BundledArtifact, LibraryInfo};
 use webdetect_lib::{ServiceRuntimeDetection, WebAppDetection};
 
 mod component;
@@ -57,6 +57,11 @@ pub struct ServiceInfo {
     /// not part of services.json).
     #[serde(skip)]
     pub runtime: Option<ServiceRuntimeDetection>,
+    /// Native ELF files (own `node`, `ffmpeg`, `.so`s) a JS service bundles
+    /// alongside its scripts. Supplementary report info; filled at parse time,
+    /// not part of services.json.
+    #[serde(skip)]
+    pub bundled: Vec<BundledArtifact>,
 }
 
 #[derive(Debug)]
diff --git a/common/verify/src/ipk/mod.rs b/common/verify/src/ipk/mod.rs
index 83421bd..2b296df 100644
--- a/common/verify/src/ipk/mod.rs
+++ b/common/verify/src/ipk/mod.rs
@@ -1,4 +1,4 @@
-use bin_lib::LibraryInfo;
+use bin_lib::{BundledArtifact, LibraryInfo};
 use fw_lib::WebEngine;
 use ipk_lib::{AppInfo, Component, Package, ServiceInfo};
 use semver::Version;
@@ -56,6 +56,9 @@ pub enum DetectionResult {
         /// Whether the firmware's Node.js natively provides the runtime APIs the
         /// service uses (advisory).
         api: CompatVerdict,
+        /// Native ELF files the service bundles (its own node/ffmpeg/.so).
+        /// Supplementary info; does not affect the verdict.
+        bundled: Vec<BundledArtifact>,
     },
 }
 
@@ -178,6 +181,7 @@ fn service_detection(
         available_node: node.cloned(),
         node: node_verdict,
         api,
+        bundled: svc.info.bundled.clone(),
     });
 }
 
diff --git a/packages/ipk-verify/src/main.rs b/packages/ipk-verify/src/main.rs
index e931c54..3192ced 100644
--- a/packages/ipk-verify/src/main.rs
+++ b/packages/ipk-verify/src/main.rs
@@ -228,7 +228,7 @@ fn print_component_details(
 ) -> Result<bool, Error> {
     let (_, result) = *results.first().unwrap();
     if result.detection.is_some() {
-        print_detection_details(&results, out)?;
+        print_detection_details(&results, out, out_fmt)?;
         return Ok(results.iter().all(|r| r.1.is_good()));
     }
     out.h4(result.exe.name())?;
@@ -393,6 +393,7 @@ fn es_support_title(level: Option<webdetect_lib::EsLevel>) -> String {
 fn print_detection_details(
     results: &Vec<(&Firmware, &ComponentVerifyResult)>,
     out: &mut Box<dyn ReportOutput>,
+    out_fmt: &OutputFormat,
 ) -> Result<(), Error> {
     let (_, first) = results.first().unwrap();
     let detection = first.detection.as_ref().unwrap();
@@ -414,13 +415,18 @@ fn print_detection_details(
                 out.write_fmt(format_args!("* Remote resource: {url}\n"))?;
             }
         }
-        DetectionResult::Service { detection: svc, .. } => {
+        DetectionResult::Service {
+            detection: svc,
+            bundled,
+            ..
+        } => {
             out.h4("JS service")?;
             if !svc.es_features.is_empty() {
                 let feats: Vec<&str> = svc.es_features.iter().map(|f| f.label()).collect();
                 out.write_fmt(format_args!("* Language features used: {}\n", feats.join(", ")))?;
             }
             print_api_details(&svc.es_apis, &svc.polyfills, out)?;
+            print_bundled_artifacts(bundled, out, out_fmt)?;
         }
     }
     // Report incompatible firmwares with their reason (gating verdicts only).
@@ -468,6 +474,42 @@ fn print_api_details(
     return Ok(());
 }
 
+/// List the native binaries a JS service bundles (its own node/ffmpeg/.so).
+/// Supplementary info — never affects the verdict. On Markdown it is folded into
+/// a `<details>` block so the report stays scannable; other formats get a plain
+/// bulleted list.
+fn print_bundled_artifacts(
+    bundled: &[bin_lib::BundledArtifact],
+    out: &mut Box<dyn ReportOutput>,
+    out_fmt: &OutputFormat,
+) -> Result<(), Error> {
+    if bundled.is_empty() {
+        return Ok(());
+    }
+    let fold = *out_fmt == OutputFormat::Markdown;
+    if fold {
+        out.write_fmt(format_args!(
+            "<details>\n<summary>Bundles {} native binar{}</summary>\n\n",
+            bundled.len(),
+            if bundled.len() == 1 { "y" } else { "ies" },
+        ))?;
+    } else {
+        out.write_fmt(format_args!("Bundled native binaries:\n"))?;
+    }
+    for a in bundled {
+        match &a.arch {
+            Some(arch) => {
+                out.write_fmt(format_args!("* {} — {}, {}\n", a.path, a.kind.label(), arch))?
+            }
+            None => out.write_fmt(format_args!("* {} — {}\n", a.path, a.kind.label()))?,
+        }
+    }
+    if fold {
+        out.write_fmt(format_args!("</details>\n"))?;
+    }
+    return Ok(());
+}
+
 fn framework_label(fw: &webdetect_lib::FrameworkInfo) -> String {
     match &fw.version {
         Some(v) => format!("{} {}", fw.kind.label(), v),
diff --git a/packages/ipk-verify/tests/detection.rs b/packages/ipk-verify/tests/detection.rs
index d168681..65d7eca 100644
--- a/packages/ipk-verify/tests/detection.rs
+++ b/packages/ipk-verify/tests/detection.rs
@@ -57,6 +57,7 @@ fn node_service(id: &str, es: EsLevel) -> Component<ServiceInfo> {
                 es_apis: vec![],
                 polyfills: vec![],
             }),
+            bundled: vec![],
         },
         exe: None,
         libs: vec![],

From 9e9daf7510ac7a9aca608edf3bf3c3ab6963f2cf Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Jul 2026 11:54:38 +0000
Subject: [PATCH 3/3] ipk-verify: verify a JS service's bundled runtime against
 firmware libs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Building on the bundled-binary inventory, actually check whether the
native runtime a JS service ships (its own node/ffmpeg + their .so's)
can load on each target firmware — the same binary/library resolution a
native component gets, but supplementary (it never gates the verdict).

At parse time each bundled executable becomes a verifiable unit: its
`exe` plus the libraries reachable via its rpath and its sibling `lib`
dir (these runtimes locate libs through the loader's `--library-path`
at spawn, not a DT_RPATH, so the sibling `lib/` is treated as a search
path). `verify_for_firmware` then verifies each against the firmware's
libraries. The report renders one native-style table — bundled
executables, then the unique bundled libraries, OK/failed per firmware —
folded into a <details> block.

Also harden `BinaryInfo`/`LibraryInfo` parsing to treat an ELF with no
`.dynstr`/`.dynsym` as having no dynamic deps instead of panicking; a
bundled statically-linked `ffmpeg` hit that latent unwrap.

Adds Clone to BinaryInfo/Component (to store bundled units), a `bundled`
field on ComponentVerifyResult, and tests for the parse-time wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XtKyCd9ucV7PRGH9LQZRRg
---
 common/bin/src/binary.rs               | 60 ++++++++--------
 common/bin/src/lib.rs                  |  2 +-
 common/bin/src/library.rs              | 65 +++++++++--------
 common/ipk/src/component.rs            | 88 ++++++++++++++++++-----
 common/ipk/src/lib.rs                  |  8 ++-
 common/verify/src/ipk/component.rs     |  2 +
 common/verify/src/ipk/mod.rs           | 13 ++++
 packages/ipk-verify/src/main.rs        | 97 ++++++++++++++++++++++++++
 packages/ipk-verify/tests/detection.rs |  1 +
 9 files changed, 258 insertions(+), 78 deletions(-)

diff --git a/common/bin/src/binary.rs b/common/bin/src/binary.rs
index 97e30bd..92d8aca 100644
--- a/common/bin/src/binary.rs
+++ b/common/bin/src/binary.rs
@@ -20,40 +20,42 @@ impl BinaryInfo {
             .map(|tbl| tbl.iter().collect())
             .unwrap_or_default();
 
-        let dynstr_header = *elf.section_header_by_name(".dynstr")?.unwrap();
-        let dynstr_table = elf.section_data_as_strtab(&dynstr_header).unwrap();
-        for entry in dynamic_entries {
-            match entry.d_tag {
-                abi::DT_NEEDED => {
-                    needed.push(String::from(
-                        dynstr_table.get(entry.d_val() as usize).unwrap(),
-                    ));
-                }
-                abi::DT_RPATH | abi::DT_RUNPATH => {
-                    if with_rpath {
-                        rpath.extend(
-                            dynstr_table
-                                .get(entry.d_val() as usize)
-                                .unwrap()
-                                .split(":")
-                                .map(|s| String::from(s)),
-                        )
+        // A statically-linked / non-dynamic ELF (some bundled `ffmpeg` builds,
+        // for instance) has no `.dynstr`/`.dynsym`. Treat it as having no dynamic
+        // dependencies or imports rather than panicking.
+        if let Some(dynstr_header) = elf.section_header_by_name(".dynstr")?.copied() {
+            let dynstr_table = elf.section_data_as_strtab(&dynstr_header)?;
+            for entry in dynamic_entries {
+                match entry.d_tag {
+                    abi::DT_NEEDED => {
+                        if let Ok(s) = dynstr_table.get(entry.d_val() as usize) {
+                            needed.push(String::from(s));
+                        }
+                    }
+                    abi::DT_RPATH | abi::DT_RUNPATH => {
+                        if with_rpath {
+                            if let Ok(s) = dynstr_table.get(entry.d_val() as usize) {
+                                rpath.extend(s.split(":").map(|s| String::from(s)));
+                            }
+                        }
                     }
+                    _ => {}
                 }
-                _ => {}
             }
         }
 
-        let (sym_table, str) = elf.dynamic_symbol_table()?.unwrap();
-        let symbols: Vec<(Symbol, String)> = sym_table
-            .iter()
-            .map(move |sym| {
-                (
-                    sym.clone(),
-                    String::from(str.get(sym.st_name as usize).unwrap_or("")),
-                )
-            })
-            .collect();
+        let symbols: Vec<(Symbol, String)> = match elf.dynamic_symbol_table()? {
+            Some((sym_table, str)) => sym_table
+                .iter()
+                .map(move |sym| {
+                    (
+                        sym.clone(),
+                        String::from(str.get(sym.st_name as usize).unwrap_or("")),
+                    )
+                })
+                .collect(),
+            None => Vec::new(),
+        };
         let ver_table = elf.symbol_version_table()?;
 
         let undefined: Vec<String> = symbols
diff --git a/common/bin/src/lib.rs b/common/bin/src/lib.rs
index a17a3df..198775d 100644
--- a/common/bin/src/lib.rs
+++ b/common/bin/src/lib.rs
@@ -6,7 +6,7 @@ pub mod library;
 
 pub use artifact::{ArtifactKind, BundledArtifact};
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct BinaryInfo {
     pub name: String,
     pub rpath: Vec<String>,
diff --git a/common/bin/src/library.rs b/common/bin/src/library.rs
index 6f1736c..accc8ee 100644
--- a/common/bin/src/library.rs
+++ b/common/bin/src/library.rs
@@ -54,41 +54,44 @@ impl LibraryInfo {
             .map(|tbl| tbl.iter().collect())
             .unwrap_or_default();
 
-        let dynstr_header = *elf.section_header_by_name(".dynstr")?.unwrap();
-        let dynstr_table = elf.section_data_as_strtab(&dynstr_header).unwrap();
-        for entry in dynamic_entries {
-            match entry.d_tag {
-                abi::DT_NEEDED => {
-                    needed.push(String::from(
-                        dynstr_table.get(entry.d_val() as usize).unwrap(),
-                    ));
-                }
-                abi::DT_SONAME => {
-                    name = String::from(dynstr_table.get(entry.d_val() as usize).unwrap());
-                }
-                abi::DT_RPATH | abi::DT_RUNPATH => {
-                    rpath.extend(
-                        dynstr_table
-                            .get(entry.d_val() as usize)
-                            .unwrap()
-                            .split(":")
-                            .map(|s| String::from(s)),
-                    );
+        // Guard against an ELF without `.dynstr`/`.dynsym` (not a real shared
+        // object) instead of panicking.
+        if let Some(dynstr_header) = elf.section_header_by_name(".dynstr")?.copied() {
+            let dynstr_table = elf.section_data_as_strtab(&dynstr_header)?;
+            for entry in dynamic_entries {
+                match entry.d_tag {
+                    abi::DT_NEEDED => {
+                        if let Ok(s) = dynstr_table.get(entry.d_val() as usize) {
+                            needed.push(String::from(s));
+                        }
+                    }
+                    abi::DT_SONAME => {
+                        if let Ok(s) = dynstr_table.get(entry.d_val() as usize) {
+                            name = String::from(s);
+                        }
+                    }
+                    abi::DT_RPATH | abi::DT_RUNPATH => {
+                        if let Ok(s) = dynstr_table.get(entry.d_val() as usize) {
+                            rpath.extend(s.split(":").map(|s| String::from(s)));
+                        }
+                    }
+                    _ => {}
                 }
-                _ => {}
             }
         }
 
-        let (sym_table, str) = elf.dynamic_symbol_table()?.unwrap();
-        let all_syms: Vec<(Symbol, String)> = sym_table
-            .iter()
-            .map(move |sym| {
-                (
-                    sym.clone(),
-                    String::from(str.get(sym.st_name as usize).unwrap_or("")),
-                )
-            })
-            .collect();
+        let all_syms: Vec<(Symbol, String)> = match elf.dynamic_symbol_table()? {
+            Some((sym_table, str)) => sym_table
+                .iter()
+                .map(move |sym| {
+                    (
+                        sym.clone(),
+                        String::from(str.get(sym.st_name as usize).unwrap_or("")),
+                    )
+                })
+                .collect(),
+            None => Vec::new(),
+        };
         let ver_table = elf.symbol_version_table()?;
         let mut symbols: Vec<String> = all_syms
             .iter()
diff --git a/common/ipk/src/component.rs b/common/ipk/src/component.rs
index bce9cf0..23c9482 100644
--- a/common/ipk/src/component.rs
+++ b/common/ipk/src/component.rs
@@ -96,7 +96,9 @@ impl Component<ServiceInfo> {
             // note any native binaries it ships (its own node/ffmpeg/.so).
             let mut info = info;
             info.runtime = Some(webdetect_lib::detect_service_runtime(dir));
-            info.bundled = scan_bundled_artifacts(dir);
+            let scan = scan_bundled(dir, links);
+            info.bundled = scan.artifacts;
+            info.bundled_bins = scan.bins;
             return Ok(Self {
                 id: info.id.clone(),
                 info: info.clone(),
@@ -136,32 +138,42 @@ const BUNDLED_MAX_DEPTH: usize = 12;
 /// Stop after collecting this many bundled artifacts.
 const BUNDLED_MAX: usize = 256;
 
-/// Walk a service directory and classify every bundled ELF (its own `node`,
-/// `ffmpeg`, `.so`s, ...). Non-ELF files (scripts, JSON, assets) are skipped.
-/// Paths are relative to `dir`, slash-separated, and the list is sorted for
-/// stable report output.
-fn scan_bundled_artifacts(dir: &Path) -> Vec<BundledArtifact> {
-    let mut out = Vec::new();
-    walk_bundled(dir, dir, 0, &mut out);
-    out.sort_by(|a, b| a.path.cmp(&b.path));
-    out
+/// The bundled native content of a JS service: an inventory of every ELF (kind +
+/// arch, for a quick listing) and, for each bundled *executable*, a verifiable
+/// unit (its `exe` plus the libraries reachable via its rpath / sibling `lib`
+/// dir) so the bundled runtime can be checked against a firmware's libraries.
+#[derive(Default)]
+pub(crate) struct BundledScan {
+    pub artifacts: Vec<BundledArtifact>,
+    pub bins: Vec<Component<()>>,
 }
 
-fn walk_bundled(root: &Path, dir: &Path, depth: usize, out: &mut Vec<BundledArtifact>) {
-    if depth > BUNDLED_MAX_DEPTH || out.len() >= BUNDLED_MAX {
+/// Walk a service directory: classify every bundled ELF and, for each
+/// executable, build a verifiable [`Component`]. Non-ELF files (scripts, JSON,
+/// assets) are skipped. Output is sorted by path for stable report ordering.
+pub(crate) fn scan_bundled(dir: &Path, links: &Symlinks) -> BundledScan {
+    let mut scan = BundledScan::default();
+    walk_bundled(dir, dir, 0, links, &mut scan);
+    scan.artifacts.sort_by(|a, b| a.path.cmp(&b.path));
+    scan.bins.sort_by(|a, b| a.id.cmp(&b.id));
+    scan
+}
+
+fn walk_bundled(root: &Path, dir: &Path, depth: usize, links: &Symlinks, scan: &mut BundledScan) {
+    if depth > BUNDLED_MAX_DEPTH || scan.artifacts.len() >= BUNDLED_MAX {
         return;
     }
     let Ok(entries) = fs::read_dir(dir) else {
         return;
     };
     for entry in entries.flatten() {
-        if out.len() >= BUNDLED_MAX {
+        if scan.artifacts.len() >= BUNDLED_MAX {
             return;
         }
         let Ok(ft) = entry.file_type() else { continue };
         let path = entry.path();
         if ft.is_dir() {
-            walk_bundled(root, &path, depth + 1, out);
+            walk_bundled(root, &path, depth + 1, links, scan);
             continue;
         }
         if !ft.is_file() {
@@ -173,12 +185,47 @@ fn walk_bundled(root: &Path, dir: &Path, depth: usize, out: &mut Vec<BundledArti
             .unwrap_or(&path)
             .to_slash_lossy()
             .into_owned();
-        if let Some(artifact) = BundledArtifact::identify(file, rel) {
-            out.push(artifact);
+        let Some(artifact) = BundledArtifact::identify(file, rel.clone()) else {
+            continue;
+        };
+        let is_exe = artifact.kind == bin_lib::ArtifactKind::Executable;
+        scan.artifacts.push(artifact);
+        if is_exe {
+            if let Some(component) = verifiable_bundled_exe(&path, rel, links) {
+                scan.bins.push(component);
+            }
         }
     }
 }
 
+/// Parse a bundled executable and discover the libraries it can load, mirroring
+/// how a native component resolves its own libraries. These services locate
+/// their libs via the loader's `--library-path <dir>/lib` at spawn time rather
+/// than a `DT_RPATH`, so the executable's sibling `lib/` directory is treated as
+/// a search path (rpath precedence) in addition to any real rpath.
+fn verifiable_bundled_exe(path: &Path, rel: String, links: &Symlinks) -> Option<Component<()>> {
+    let bin = BinaryInfo::parse(
+        File::open(path).ok()?,
+        path.file_name().unwrap().to_string_lossy(),
+        true,
+    )
+    .ok()?;
+    let parent = path.parent()?;
+    let mut rpath = Component::<()>::rpath(&bin.rpath, path);
+    if let Ok(sibling_lib) = parent.join("lib").canonicalize() {
+        if !rpath.contains(&sibling_lib) {
+            rpath.push(sibling_lib);
+        }
+    }
+    let libs = Component::<()>::list_libs(parent, &rpath, links).ok()?;
+    Some(Component {
+        id: rel,
+        info: (),
+        exe: Some(bin),
+        libs,
+    })
+}
+
 impl<T> Component<T> {
     pub fn find_lib(&self, name: &str) -> Option<&'_ LibraryInfo> {
         return self.libs.iter().find(|lib| lib.has_name(name));
@@ -325,6 +372,15 @@ mod tests {
             "expected bin/node to be reported, got {:?}",
             svc.info.bundled
         );
+        // The bundled executable also becomes a verifiable unit.
+        assert!(
+            svc.info
+                .bundled_bins
+                .iter()
+                .any(|c| c.id == "bin/node" && c.exe.is_some()),
+            "expected bin/node as a verifiable component, got {:?}",
+            svc.info.bundled_bins.iter().map(|c| &c.id).collect::<Vec<_>>()
+        );
     }
 
     #[test]
diff --git a/common/ipk/src/lib.rs b/common/ipk/src/lib.rs
index 8c073e6..430b1ba 100644
--- a/common/ipk/src/lib.rs
+++ b/common/ipk/src/lib.rs
@@ -18,7 +18,7 @@ pub struct Package {
     pub services: Vec<Component<ServiceInfo>>,
 }
 
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct Component<T> {
     pub id: String,
     pub info: T,
@@ -62,6 +62,12 @@ pub struct ServiceInfo {
     /// not part of services.json.
     #[serde(skip)]
     pub bundled: Vec<BundledArtifact>,
+    /// Each bundled executable as its own verifiable unit (its `exe` plus the
+    /// libraries reachable via its rpath), so the bundled runtime can be checked
+    /// against a firmware's libraries the same way a native component is. Filled
+    /// at parse time; supplementary (never gates the verdict).
+    #[serde(skip)]
+    pub bundled_bins: Vec<Component<()>>,
 }
 
 #[derive(Debug)]
diff --git a/common/verify/src/ipk/component.rs b/common/verify/src/ipk/component.rs
index 9429410..14c24fe 100644
--- a/common/verify/src/ipk/component.rs
+++ b/common/verify/src/ipk/component.rs
@@ -122,6 +122,7 @@ impl<T> Verify<ComponentVerifyResult> for Component<T> {
                 },
                 libs: Default::default(),
                 detection: None,
+                bundled: Default::default(),
             };
         };
         let bin = self.verify_bin(exe, find_library);
@@ -183,6 +184,7 @@ impl<T> Verify<ComponentVerifyResult> for Component<T> {
             libs,
             // Filled in by Package::verify_for_firmware for non-native components.
             detection: None,
+            bundled: Default::default(),
         };
     }
 }
diff --git a/common/verify/src/ipk/mod.rs b/common/verify/src/ipk/mod.rs
index 2b296df..09a3253 100644
--- a/common/verify/src/ipk/mod.rs
+++ b/common/verify/src/ipk/mod.rs
@@ -22,6 +22,10 @@ pub struct ComponentVerifyResult {
     /// Non-native technology detection + per-firmware compatibility. `None` for
     /// native components (which go through the exe/libs path instead).
     pub detection: Option<DetectionResult>,
+    /// A JS service's bundled native binaries, each verified against the
+    /// firmware's libraries like a native component. Supplementary — these
+    /// results never gate the package verdict. Empty for everything else.
+    pub bundled: Vec<ComponentVerifyResult>,
 }
 
 #[derive(Debug, Eq, PartialEq)]
@@ -146,6 +150,15 @@ impl VerifyForFirmware for Package {
         result.app.detection = web_detection(&self.app, engine);
         for (svc_result, svc) in result.services.iter_mut().zip(self.services.iter()) {
             svc_result.detection = service_detection(svc, node);
+            // Verify each bundled native binary like a native component, so the
+            // report can show whether the service's own runtime loads on this
+            // firmware. Supplementary: does not affect `svc_result.is_good()`.
+            svc_result.bundled = svc
+                .info
+                .bundled_bins
+                .iter()
+                .map(|component| component.verify(find_library))
+                .collect();
         }
         return result;
     }
diff --git a/packages/ipk-verify/src/main.rs b/packages/ipk-verify/src/main.rs
index 3192ced..67dc9ef 100644
--- a/packages/ipk-verify/src/main.rs
+++ b/packages/ipk-verify/src/main.rs
@@ -427,6 +427,7 @@ fn print_detection_details(
             }
             print_api_details(&svc.es_apis, &svc.polyfills, out)?;
             print_bundled_artifacts(bundled, out, out_fmt)?;
+            print_bundled_compat(results, out, out_fmt)?;
         }
     }
     // Report incompatible firmwares with their reason (gating verdicts only).
@@ -510,6 +511,102 @@ fn print_bundled_artifacts(
     return Ok(());
 }
 
+/// Verify report for a JS service's bundled native binaries — a single
+/// native-style table whose rows are the bundled executables (its own
+/// node/ffmpeg) followed by the unique bundled libraries, each OK/failed per
+/// firmware. Folded into a `<details>` block on Markdown. Supplementary: this
+/// table never changes the package verdict.
+fn print_bundled_compat(
+    results: &Vec<(&Firmware, &ComponentVerifyResult)>,
+    out: &mut Box<dyn ReportOutput>,
+    out_fmt: &OutputFormat,
+) -> Result<(), Error> {
+    let (_, first) = results.first().unwrap();
+    if first.bundled.is_empty() {
+        return Ok(());
+    }
+    let fold = *out_fmt == OutputFormat::Markdown;
+    if fold {
+        out.write_fmt(format_args!(
+            "<details>\n<summary>Bundled runtime — library compatibility</summary>\n\n"
+        ))?;
+    } else {
+        out.write_fmt(format_args!("Bundled runtime — library compatibility:\n\n"))?;
+    }
+
+    let mut table = Table::new();
+    table.set_format(out.table_format(out_fmt));
+    table.set_titles(Row::from_iter(iter::once(String::new()).chain(
+        results.iter().map(|(fw, _)| fw.info.release.to_string()),
+    )));
+
+    // Bundled executables (its own node/ffmpeg/...), one row each.
+    for idx in 0..first.bundled.len() {
+        let name = first.bundled[idx].exe.name().to_string();
+        table.add_row(Row::new(
+            iter::once(Cell::new(&name))
+                .chain(
+                    results
+                        .iter()
+                        .map(|(_, r)| out.result_cell(&r.bundled[idx].exe, out_fmt)),
+                )
+                .collect(),
+        ));
+    }
+
+    // Bundled libraries, deduped by name (versioned file + soname alias resolve
+    // to the same library) and sorted.
+    let mut lib_names: Vec<String> = Vec::new();
+    for comp in &first.bundled {
+        for (_, lib) in &comp.libs {
+            let n = lib.name().to_string();
+            if !lib_names.contains(&n) {
+                lib_names.push(n);
+            }
+        }
+    }
+    lib_names.sort();
+    for lib_name in &lib_names {
+        table.add_row(Row::new(
+            iter::once(Cell::new(&format!("lib {lib_name}")))
+                .chain(
+                    results
+                        .iter()
+                        .map(|(_, r)| out.result_cell(worst_bundled_lib(r, lib_name), out_fmt)),
+                )
+                .collect(),
+        ));
+    }
+
+    out.print_table(&table)?;
+    if fold {
+        out.write_fmt(format_args!("</details>\n"))?;
+    }
+    return Ok(());
+}
+
+/// The status of a bundled library across all of a service's bundled binaries:
+/// `Failed` if it fails to resolve for any of them, otherwise the first result.
+/// The same library file resolves identically for every binary on a given
+/// firmware, so this only ever collapses duplicate rows.
+fn worst_bundled_lib<'a>(
+    result: &'a ComponentVerifyResult,
+    name: &str,
+) -> &'a ComponentBinVerifyResult {
+    let mut found: Option<&ComponentBinVerifyResult> = None;
+    for comp in &result.bundled {
+        for (_, lib) in &comp.libs {
+            if lib.name() == name {
+                if matches!(lib, ComponentBinVerifyResult::Failed(_)) {
+                    return lib;
+                }
+                found.get_or_insert(lib);
+            }
+        }
+    }
+    found.expect("library is present in every firmware's bundled set")
+}
+
 fn framework_label(fw: &webdetect_lib::FrameworkInfo) -> String {
     match &fw.version {
         Some(v) => format!("{} {}", fw.kind.label(), v),
diff --git a/packages/ipk-verify/tests/detection.rs b/packages/ipk-verify/tests/detection.rs
index 65d7eca..9cdef61 100644
--- a/packages/ipk-verify/tests/detection.rs
+++ b/packages/ipk-verify/tests/detection.rs
@@ -58,6 +58,7 @@ fn node_service(id: &str, es: EsLevel) -> Component<ServiceInfo> {
                 polyfills: vec![],
             }),
             bundled: vec![],
+            bundled_bins: vec![],
         },
         exe: None,
         libs: vec![],