Add brief inspect command and Artifact report

[andrew]

Second step after #126: wire the binary package into a brief inspect <path> subcommand that accepts either a bare native object or a package archive, and add brief.Artifact as the report type.

A bare ELF/Mach-O/PE input goes straight to binary.Inspect and is returned as a single-entry Artifact. An archive is opened with git-pkgs/archives, hashed, extracted to a temp directory, and walked; each regular file gets a 512-byte magic.DetectPrefix read and native hits are collected into Artifact.NativeObjects with archive-relative paths. Artifact.Format is the physical container (zip, gzip, elf, ...); packaging-level identity (wheel/gem/jar) and the extracted-source toolchain scan are the next PR.

The default command auto-routes to inspect when its positional argument is a regular file whose header sniffs as a native object or archive, so brief foo.whl and brief foo.so work without the subcommand. Only the shared -json/-human flags carry over from cmdScan; scan-specific flags are dropped rather than handed to a FlagSet that would reject them. report.ArtifactHuman runs every object-derived string through sanitize so a hostile soname or dylib path cannot inject terminal escapes.

go.mod adds git-pkgs/archives v0.5.0 and promotes git-pkgs/magic to v0.2.0 as direct requires; ulikunitz/xz arrives indirect via archives.

On an orjson manylinux wheel:

Format:      zip
SHA256:      be4fa4f0af7fa18951f7ab3fc2148e223af211bf03f59e1c6034ec3f97f21d61
Entries:     11 files, 1 native objects

Object:      orjson/orjson.cpython-312-x86_64-linux-gnu.so
  Format:    elf amd64
  Producer:  GCC: (GNU) 16.1.1 20260501 (Red Hat 16.1.1-1)
  Producer:  Linker: LLD 22.1.4
  Producer:  rustc version 1.97.0-nightly (f53b654a8 2026-04-30)
  Producer:  clang version 22.1.4 (Fedora 22.1.4-1.fc45)
  Needed:    libc.so.6

8.4ms

Benchmarks (M1 Pro):

BenchmarkInspectBareObject-8      1014    2357136 ns/op   116062 B/op    487 allocs/op
BenchmarkInspectArchive-8           79   29164732 ns/op  3823036 B/op   4214 allocs/op
BenchmarkShouldAutoInspect-8    156339      15253 ns/op     1016 B/op      6 allocs/op

The archive number is dominated by ExtractAll writing to disk; walking the archive in memory via fs.FS is a later refactor. Two known binary/ follow-ups surfaced by inspecting brief itself, deferred to the static-hint PR: the regex source strings in static.go sit in brief's own rodata and match themselves, and scanStatic on a ~60MB Go rodata section takes ~1.5s.

[Copilot]

Pull request overview

This PR adds an artifact-inspection flow to brief, introducing a new brief inspect <path> subcommand (and auto-routing from the default command) to report native-object metadata for bare binaries and package archives, plus a new brief.Artifact report type with JSON and human output.

Changes:

• Add brief inspect subcommand and auto-route brief <file> to inspect when the argument sniffs as a native object or supported archive.
• Introduce brief.Artifact plus JSON/human formatters (with sanitization in human output).
• Add archive extraction + per-entry magic sniffing to find embedded native objects; add tests and benchmarks; update Go module deps.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
report/report.go	Adds ArtifactJSON/ArtifactHuman output formatters for the new artifact report type.
cmd/brief/main.go	Routes brief <path> to inspect automatically when the arg is a native object/archive.
cmd/brief/inspect.go	Implements brief inspect, archive extraction + walking, and magic-based sniffing/dispatch.
cmd/brief/inspect_test.go	Adds unit tests for inspect behavior, sanitization test, and benchmarks.
artifact.go	Introduces brief.Artifact report type backing the new inspect output.
go.mod	Adds git-pkgs/archives and promotes git-pkgs/magic to a direct dependency.
go.sum	Records checksums for new/updated dependencies (archives, magic, xz).
.gitignore	Ignores bin/ directory.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.