@dailephd/my-dev-kit-lab 0.3.3 → 0.4.0

package/dist/src/securityValidation/attackScenarios/profiles/androidProfile.js

@@ -0,0 +1,20 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 5 — registry placeholder for the "android" profile.
+//
+// Unlike the other three profiles, "android" does NOT route through the
+// classic check-group/attack-scenario pipeline that this definition
+// describes (src/mobile/android/validate/validateAndroidTarget.ts is an
+// entirely separate orchestrator — see agents.txt Batch 5 section 6.1). This
+// entry exists only so SECURITY_PROFILE_IDS including "android" satisfies
+// PROFILE_REGISTRY's Record<SecurityProfileId, AttackProfileDefinition> type;
+// its check-id lists are deliberately empty so nothing here ever appears to
+// select or gate a classic check group for the Android path.
+// ---------------------------------------------------------------------------
+export const ANDROID_PROFILE = {
+    id: "android",
+    label: "Android",
+    description: "Profile for an Android Gradle project, validated through a dedicated Android orchestrator (detection, manifest audits, Gradle metadata, optional Gradle operations) rather than the classic check-group/attack-scenario pipeline this definition otherwise describes.",
+    defaultCheckIds: [],
+    applicableCheckIds: [],
+    scenarioGroups: [],
+};

package/dist/src/securityValidation/validate/cliOptions.js

@@ -35,7 +35,15 @@ export const PLANNED_SECURITY_CHECK_IDS = [
     "network",
 ];
 export const DEFAULT_SECURITY_CHECKS = IMPLEMENTED_SECURITY_CHECK_IDS;
-export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package"];
+// v0.4.0 Batch 5 — "android" added additively. Unlike the other three
+// profiles (which select --checks defaults for the classic
+// check-group/attack-scenario pipeline), "android" routes to an entirely
+// separate orchestrator (src/mobile/android/validate/validateAndroidTarget.ts)
+// because the Android check/finding/status vocabulary established in
+// Batches 1-4 does not fit SecurityCheckId/SecurityCheckResult — seeagents.txt
+// Batch 5 section 6.1-6.2. The CLI still exposes it through the same
+// --profile flag on the same security:validate command (no second CLI).
+export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package", "android"];
 export const DEFAULT_SECURITY_PROFILE = "node-cli-package";
 export const SECURITY_OUTPUT_FORMATS = ["text", "json"];
 export const DEFAULT_SECURITY_OUTPUT_FORMATS = ["text", "json"];
@@ -52,14 +60,31 @@ const FLAGS_WITH_VALUE = {
     "--profile": "profile",
     "--format": "format",
     "--fail-on": "failOn",
+    "--android-gradle-operations": "androidGradleOperations",
 };
+// v0.4.0 Batch 5 — the exact allowlisted optional Gradle operation ids
+// (agents.txt Batch 5 section 7.3). Deliberately re-declared here rather than
+// imported from src/mobile/android/gradle/validate/operations.ts: this keeps
+// the foundational CLI-parsing module free of a new securityValidation ->
+// mobile dependency direction for five short string literals. Both lists
+// must stay in sync; a regression test in tests/security/ asserts they do.
+export const ANDROID_GRADLE_OPERATION_IDS = ["wrapper-version", "tasks", "assemble-debug", "unit-test-debug", "lint-debug"];
 export function parseSecurityValidateArgs(argv) {
     const result = {};
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         const key = FLAGS_WITH_VALUE[arg];
-        if (!key)
+        if (!key) {
+            // Keep the conventional argument separator harmless while rejecting
+            // misspelled or unsupported top-level options before any validation
+            // configuration, target resolution, or report work begins.
+            if (arg === "--")
+                continue;
+            if (arg.startsWith("-")) {
+                throw new Error(`Unknown option: ${arg}.`);
+            }
             continue;
+        }
         if (i + 1 >= argv.length) {
             throw new Error(`Missing value for ${arg}. Expected a value after ${arg}.`);
         }
@@ -73,6 +98,7 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
     const formats = parseFormatOption(raw.format);
     const failOn = parseFailOnOption(raw.failOn);
     const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
+    const androidGradleOperationIds = parseAndroidGradleOperationsOption(raw.androidGradleOperations, profile.value);
     return {
         target: raw.target,
         out,
@@ -88,8 +114,26 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
         formatsWereDefault: formats.wasDefault,
         failOnThreshold: failOn.value,
         failOnWasDefault: failOn.wasDefault,
+        androidGradleOperationIds,
     };
 }
+// Parses --android-gradle-operations. Absent by default (empty array — zero
+// Gradle execution). Rejects unknown operation ids and non-"android"-profile
+// usage before any validation work begins (agents.txt Batch 5 section 7.3).
+function parseAndroidGradleOperationsOption(raw, profile) {
+    if (raw === undefined)
+        return [];
+    if (profile !== "android") {
+        throw new Error(`--android-gradle-operations requires --profile android (got --profile ${profile}).`);
+    }
+    const parts = splitAndNormalizeList(raw, "--android-gradle-operations");
+    const invalid = parts.filter((p) => !ANDROID_GRADLE_OPERATION_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --android-gradle-operations value(s): ${invalid.join(", ")}. Valid values are: ${ANDROID_GRADLE_OPERATION_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    return ANDROID_GRADLE_OPERATION_IDS.filter((id) => unique.has(id));
+}
 // ---------------------------------------------------------------------------
 // v0.2.2 Batch 5 — profile-aware default checks
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {
@@ -71,6 +71,7 @@
     "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
     "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
     "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
+    "docs:check": "node scripts/check-docs.mjs",
     "verify": "npm run build && npm run test && npm run test:benchmarks && npm run test:report && npm run test:screenshot && npm run test:evaluation && npm run test:agents && npm run test:experiments && npm run test:plots && npm run test:visualization-demos && npm run test:gallery && npm run test:demo && npm run test:integration && npm run test:e2e && npm run verify:benchmarks",
     "security:deps": "tsx scripts/security/runDependencyChecks.ts",
     "security:package": "tsx scripts/security/runPackageChecks.ts",

package/tests/fixtures/android/compose-app/app/build.gradle.kts

@@ -0,0 +1,21 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+android {
+    namespace = "com.example.composeapp"
+    compileSdk = 34
+
+    defaultConfig {
+        applicationId = "com.example.composeapp"
+        minSdk = 24
+        targetSdk = 34
+        versionCode = 1
+        versionName = "1.0"
+    }
+
+    buildFeatures {
+        compose = true
+    }
+}

package/tests/fixtures/android/compose-app/app/src/main/AndroidManifest.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:label="Compose App"
+        android:icon="@mipmap/ic_launcher"
+        android:allowBackup="true">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+    </application>
+
+</manifest>

package/tests/fixtures/android/compose-app/app/src/main/java/com/example/composeapp/MainActivity.kt

@@ -0,0 +1,11 @@
+package com.example.composeapp
+
+import androidx.compose.runtime.Composable
+import androidx.compose.material3.Text
+
+class MainActivity
+
+@Composable
+fun Greeting(name: String) {
+    Text(text = "Hello, $name!")
+}

package/tests/fixtures/android/compose-app/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+    id("com.android.application") version "8.2.0" apply false
+    id("org.jetbrains.kotlin.android") version "1.9.22" apply false
+}

package/tests/fixtures/android/compose-app/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,4 @@
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists

package/tests/fixtures/android/compose-app/settings.gradle.kts

@@ -0,0 +1,2 @@
+rootProject.name = "compose-app"
+include(":app")

package/tests/fixtures/android/gradle-metadata-fixtures/catalog-only-plugin/build.gradle.kts

@@ -0,0 +1,3 @@
+plugins {
+    alias(libs.plugins.android.application) apply false
+}

package/tests/fixtures/android/gradle-metadata-fixtures/catalog-only-plugin/gradle/libs.versions.toml

@@ -0,0 +1,5 @@
+[versions]
+agp = "8.2.2"
+
+[plugins]
+android-application = { id = "com.android.application", version.ref = "agp" }

package/tests/fixtures/android/gradle-metadata-fixtures/comment-safety.gradle.kts

@@ -0,0 +1,21 @@
+plugins {
+    id("com.android.application")
+}
+
+// applicationId = "com.example.commented-out-should-not-be-used"
+/*
+namespace = "com.example.also-commented-out"
+*/
+
+android {
+    namespace = "com.example.commentsafety"
+    // A string that merely mentions "applicationId" in prose should not match.
+    val note = "the applicationId field below is the real one"
+
+    defaultConfig {
+        applicationId = "com.example.commentsafety"
+        minSdk = 24
+        targetSdk = 34
+        compileSdk = 34
+    }
+}

package/tests/fixtures/android/gradle-metadata-fixtures/dynamic-values.gradle.kts

@@ -0,0 +1,17 @@
+plugins {
+    id("com.android.application")
+}
+
+val gitVersionName = providers.exec { commandLine("git", "describe") }.standardOutput.asText.get()
+
+android {
+    namespace = "com.example.dynamic"
+    compileSdk = libs.versions.compileSdk.get().toInt()
+
+    defaultConfig {
+        applicationId = appIdFromProperties()
+        versionName = gitVersionName
+        targetSdk = project.property("targetSdkFromProperties") as Int
+        minSdk = 24
+    }
+}

package/tests/fixtures/android/gradle-metadata-fixtures/groovy-literal.gradle

@@ -0,0 +1,23 @@
+apply plugin: 'com.android.application'
+
+android {
+    namespace "com.example.groovyliteral"
+    compileSdkVersion 33
+
+    defaultConfig {
+        applicationId "com.example.groovyliteral"
+        minSdkVersion 21
+        targetSdkVersion 33
+        versionCode 2
+        versionName "2.0"
+    }
+
+    buildTypes {
+        debug {
+        }
+        release {
+        }
+        staging {
+        }
+    }
+}

package/tests/fixtures/android/gradle-metadata-fixtures/wrapper-malformed.properties

@@ -0,0 +1,4 @@
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/not-a-real-distribution.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists

package/tests/fixtures/android/gradle-metadata-fixtures/wrapper-missing-url.properties

@@ -0,0 +1,3 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists

package/tests/fixtures/android/gradle-metadata-fixtures/wrapper-with-checksum.properties

@@ -0,0 +1,5 @@
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-all.zip
+distributionSha256Sum=abcdef1234567890
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists

package/tests/fixtures/android/java-app/app/build.gradle

@@ -0,0 +1,16 @@
+plugins {
+    id 'com.android.application'
+}
+
+android {
+    namespace 'com.example.javaapp'
+    compileSdk 34
+
+    defaultConfig {
+        applicationId 'com.example.javaapp'
+        minSdk 21
+        targetSdk 34
+        versionCode 1
+        versionName '1.0'
+    }
+}

package/tests/fixtures/android/java-app/app/src/main/AndroidManifest.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <application
+        android:label="Java App"
+        android:icon="@mipmap/ic_launcher">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+    </application>
+
+</manifest>

package/tests/fixtures/android/java-app/app/src/main/java/com/example/javaapp/MainActivity.java

@@ -0,0 +1,4 @@
+package com.example.javaapp;
+
+public class MainActivity {
+}

package/tests/fixtures/android/java-app/build.gradle

@@ -0,0 +1,3 @@
+plugins {
+    id 'com.android.application' version '8.2.0' apply false
+}

package/tests/fixtures/android/java-app/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,4 @@
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists

package/tests/fixtures/android/java-app/settings.gradle

@@ -0,0 +1,2 @@
+rootProject.name = 'java-app'
+include ':app'

package/tests/fixtures/android/library/build.gradle.kts

@@ -0,0 +1,3 @@
+plugins {
+    id("com.android.library") version "8.2.0" apply false
+}

package/tests/fixtures/android/library/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,4 @@
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists

package/tests/fixtures/android/library/mylibrary/build.gradle.kts

@@ -0,0 +1,13 @@
+plugins {
+    id("com.android.library")
+}
+
+android {
+    namespace = "com.example.mylibrary"
+    compileSdk = 34
+
+    defaultConfig {
+        minSdk = 21
+        targetSdk = 34
+    }
+}

package/tests/fixtures/android/library/mylibrary/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android" />

package/tests/fixtures/android/library/settings.gradle.kts

@@ -0,0 +1,2 @@
+rootProject.name = "library"
+include(":mylibrary")

package/tests/fixtures/android/manifest-audit-fixtures/incomplete-intent-filter.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity android:name=".EmptyFilterActivity" android:exported="true">
+            <intent-filter>
+            </intent-filter>
+        </activity>
+        <activity android:name=".BrowsableOnlyActivity" android:exported="true">
+            <intent-filter>
+                <category android:name="android.intent.category.BROWSABLE" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/malformed-exported.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity android:name=".WeirdActivity" android:exported="maybe">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/malformed.xml

@@ -0,0 +1,5 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity android:name=".MainActivity">
+    </application>
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/missing-application.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.missingapp">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/missing-component-name.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/permission-coverage.xml

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.permissions">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" />
+    <uses-permission android:name="android.permission.READ_CONTACTS" />
+    <uses-permission android:name="android.permission.READ_CALENDAR" />
+    <uses-permission android:name="android.permission.SEND_SMS" />
+    <uses-permission android:name="android.permission.READ_CALL_LOG" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="com.example.permissions.CUSTOM_PERMISSION" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission-sdk-23 android:name="android.permission.BLUETOOTH_CONNECT" />
+
+    <application>
+        <activity android:name=".MainActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/risky-components.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.risky">
+
+    <application>
+
+        <activity android:name=".MainActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <activity android:name=".UnprotectedExportedActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="com.example.risky.CUSTOM_ACTION" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+        </activity>
+
+        <activity android:name=".ProtectedExportedActivity"
+            android:exported="true"
+            android:permission="com.example.risky.permission.ADMIN" />
+
+        <activity android:name=".UnspecifiedExportedActivity">
+            <intent-filter>
+                <action android:name="com.example.risky.ANOTHER_ACTION" />
+            </intent-filter>
+        </activity>
+
+        <activity android:name=".NotExportedActivity" android:exported="false" />
+
+        <service android:name=".UnprotectedExportedService" android:exported="true">
+            <intent-filter>
+                <action android:name="com.example.risky.SERVICE_ACTION" />
+            </intent-filter>
+        </service>
+
+        <receiver android:name=".UnprotectedExportedReceiver" android:exported="true">
+            <intent-filter>
+                <action android:name="com.example.risky.RECEIVER_ACTION" />
+            </intent-filter>
+        </receiver>
+
+        <provider android:name=".UnprotectedExportedProvider"
+            android:authorities="com.example.risky.provider"
+            android:exported="true" />
+
+        <provider android:name=".PartiallyProtectedProvider"
+            android:authorities="com.example.risky.provider2"
+            android:exported="true"
+            android:readPermission="com.example.risky.permission.READ" />
+
+        <provider android:name=".FullyProtectedProvider"
+            android:authorities="com.example.risky.provider3"
+            android:exported="true"
+            android:readPermission="com.example.risky.permission.READ"
+            android:writePermission="com.example.risky.permission.WRITE" />
+
+    </application>
+
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/risky-deep-links.xml

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.deeplinks">
+
+    <application>
+
+        <activity android:name=".CustomSchemeNoHostActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="myapp" />
+            </intent-filter>
+        </activity>
+
+        <activity android:name=".HttpNoHostActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="https" />
+            </intent-filter>
+        </activity>
+
+        <activity android:name=".BroadPathPatternActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="https" android:host="example.com" android:pathPattern=".*" />
+            </intent-filter>
+        </activity>
+
+        <activity android:name=".BoundedSafeDeepLinkActivity" android:exported="true">
+            <intent-filter android:autoVerify="true">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="https" android:host="example.com" android:pathPrefix="/product" />
+            </intent-filter>
+        </activity>
+
+    </application>
+
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/unresolved-placeholder.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="${applicationId}">
+    <application android:label="@string/app_name" android:icon="@mipmap/ic_launcher">
+        <activity android:name=".ShareActivity" android:exported="true">
+            <intent-filter android:autoVerify="true">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="${deepLinkScheme}" android:host="@string/deep_link_host" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>

package/tests/fixtures/android/manifest-audit-fixtures/unusual-namespace-prefix.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:x="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity x:name=".MainActivity" x:exported="true">
+            <intent-filter>
+                <action x:name="android.intent.action.MAIN" />
+                <category x:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>

package/tests/fixtures/android/multi-module/app/build.gradle.kts

@@ -0,0 +1,22 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+android {
+    namespace = "com.example.multimodule.app"
+    compileSdk = 34
+
+    defaultConfig {
+        applicationId = "com.example.multimodule.app"
+        minSdk = 24
+        targetSdk = 34
+        versionCode = 1
+        versionName = "1.0"
+    }
+}
+
+dependencies {
+    implementation(project(":core"))
+    implementation(project(":feature-login"))
+}

package/tests/fixtures/android/multi-module/app/src/androidTest/java/com/example/multimodule/app/ExampleInstrumentedTest.kt

@@ -0,0 +1,3 @@
+package com.example.multimodule.app
+
+class ExampleInstrumentedTest