Fix fsync with --app=bundleId

[zemanj]

Fixes #593.

According to libimobiledevice issue 193 from 2015 (in particular, this comment), the service com.apple.mobile.house_arrest doesn't support the VendContainer command anymore (unless the app was installed via XCode).
However, for apps that have UIFileSharingEnabled set to true in their information property list, the VendDocuments command can be used instead to access the app's /Documents directory.

This PR replaces VendContainer by VendDocuments to make this work.

Note that when using the go-iOS fsync command with the option --app=BUNDLE_ID set, the PATH passed with the option --path=PATH has to start with /Documents (in particular, / won't work).
For example, to use the fsync tree command for a specific app, one has to call ios fsync --app=BUNDLE_ID tree --path=/Documents.

[aluedeke]

@zemanj this code change cannot be merged like this, vendContainer and vendDocuments serve different purposes. One for xcode installed apps and one for apps sharing their documents, vendContainer doesn't work if an app doesn't share files. If you could come up with an proposal on how to support both modes we could merge this.

[danielpaulus]

Thanks for digging into this. I reviewed the current diff and this is not just a rename: the behavior changes the house_arrest request from VendContainer to VendDocuments. That may be the right mode for some workflows, but it also changes the filesystem root that iOS vends for fsync --app.\n\nI do not think we should merge this as-is before we have real-device/e2e coverage for the affected command. The safer direction is probably:\n\n- keep the existing --app behavior tied to VendContainer, unless proven wrong by device tests;\n- add explicit support for VendDocuments as a separate CLI mode/flag if that is what users need;\n- add e2e coverage proving which paths are visible for both modes.\n\nLeaving this note here so we do not lose the finding when we return to the PR.

[danielpaulus]

Maintainer review notes — thanks for this, @zemanj, and for the precise libimobiledevice writeup. The diagnosis is correct: house_arrest no longer supports VendContainer for apps that weren't installed via Xcode, and VendDocuments is the right command for normal apps that set UIFileSharingEnabled (#593). We want this fixed. Flagging two things before it can land, so it doesn't get merged as-is and cause a regression:

1. The PR has gone stale (CONFLICTING). Since it was opened, the afc package was refactored. The functions this PR edits — NewContainer / VendContainer in ios/afc/fsync.go — no longer exist on main. The vend logic now lives in ios/house_arrest/house_arrest.go as a private vendContainer, and house_arrest.New(...) returns an *afc.Client. So the change needs to be re-pointed at house_arrest.go.

2. ⚠️ A blanket swap to VendDocuments would break XCUITest running. house_arrest.New is shared by two callers:

• cmd_device_files.go — the user-facing ios file / ios fsync --app=<bundleID> command (what this PR is about), and
• ios/testmanagerd/xcuitestrunner.go:555 — the XCUITest runner (how go-ios launches WebDriverAgent / DeviceKit / any runtest).

The runner writes its test config to tmp/<uuid>.xctestconfiguration (createTestConfigOnDevice) — i.e. the app-container root, not /Documents. VendDocuments only vends /Documents, so switching the shared New to VendDocuments would make the runner's Open("tmp/...") fail and break WDA/DeviceKit/runtest entirely. (The runner apps are Xcode/dev-installed, so VendContainer keeps working for them — they must stay on it.)

Recommended approach (surgical, no regression):

• Keep house_arrest.New on VendContainer (used by testmanagerd — must not change).
• Add a house_arrest.NewDocuments(device, bundleID) that vends via VendDocuments (factor the shared vend/checkResponse/plistFromBytes to take the command string).
• In runFsyncCommand (and the ios file --app path), try house_arrest.New first, and on failure fall back to house_arrest.NewDocuments — dev apps keep full-container access, normal UIFileSharingEnabled apps get /Documents. After a failed VendContainer the service closes the connection, so the fallback opens a fresh ConnectToService.
• Note in --app help text that for normal apps paths are rooted at /Documents (e.g. ios fsync --app=BUNDLE_ID tree --path=/Documents), matching what you documented here.

Your core insight (VendDocuments for file-sharing apps) is exactly right and will be preserved with credit when this is ported onto current main. Parking it here for now rather than merging a stale/regressing diff. 🙏