@dailephd/my-dev-kit-lab 0.3.3 → 0.4.0

package/dist/src/mobile/android/detect/versionCatalogEvidence.js

@@ -0,0 +1,37 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 2 — bounded gradle/libs.versions.toml plugin-alias evidence.
+//
+// This is deliberately not a general TOML parser: it only line-scans the
+// `[plugins]`/`[libraries]` sections for aliases whose declared id/module
+// statically mentions an Android/Kotlin-Android/Compose plugin or library.
+// Anything else in the catalog (bundles, rich versions, references) is left
+// unresolved, matching the "bounded evidence only" requirement for this
+// batch — a full catalog resolver belongs to a later batch if ever needed.
+// ---------------------------------------------------------------------------
+const ALIAS_LINE_PATTERN = /^([A-Za-z0-9_-]+)\s*=\s*(\{.*\}|".*")\s*$/;
+export function extractVersionCatalogEvidence(text) {
+    const androidPluginAliasEvidence = [];
+    const kotlinAndroidPluginAliasEvidence = [];
+    const composeAliasEvidence = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        const match = line.match(ALIAS_LINE_PATTERN);
+        if (!match)
+            continue;
+        const [, alias, body] = match;
+        if (body.includes("com.android.application") || body.includes("com.android.library")) {
+            androidPluginAliasEvidence.push(alias);
+        }
+        if (body.includes("org.jetbrains.kotlin.android")) {
+            kotlinAndroidPluginAliasEvidence.push(alias);
+        }
+        if (/compose/i.test(body) || /androidx\.compose/i.test(body)) {
+            composeAliasEvidence.push(alias);
+        }
+    }
+    return {
+        androidPluginAliasEvidence: androidPluginAliasEvidence.sort((a, b) => a.localeCompare(b)),
+        kotlinAndroidPluginAliasEvidence: kotlinAndroidPluginAliasEvidence.sort((a, b) => a.localeCompare(b)),
+        composeAliasEvidence: composeAliasEvidence.sort((a, b) => a.localeCompare(b)),
+    };
+}

package/dist/src/mobile/android/detection.js

@@ -0,0 +1,28 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android detection result contract.
+// v0.4.0 Batch 2 — narrow inherited-contract correction: ANDROID_PROJECT_KINDS
+// widened (additive) from {application, library, unknown} to also cover
+// project-level outcomes ("multi-module", "mixed", "partial", "non-android")
+// required by Batch 2 classification (see agents.txt Batch 2 section 7.8).
+// The original three values are preserved unchanged and remain the only
+// values a single AndroidModuleDetection.kind can take in practice, so no
+// existing consumer or test is broken by the widening. AndroidModuleDetection
+// also gained optional confidence/evidence fields so per-module
+// classification results (Batch 2 section 7.7) can be evidence-backed
+// without a second module-result type.
+//
+// This is the normalized shape a future detection batch will populate. This
+// batch defines the contract only; no detection algorithm exists yet.
+// "uncertain"/"unknown" outcomes must never be normalized into a positive
+// detection — callers must check `detected` explicitly.
+// ---------------------------------------------------------------------------
+export const ANDROID_PROJECT_KINDS = [
+    "application",
+    "library",
+    "unknown",
+    "multi-module",
+    "mixed",
+    "partial",
+    "non-android",
+];
+export const ANDROID_UI_TOOLKITS = ["compose", "xml-view", "mixed", "uncertain"];

package/dist/src/mobile/android/gradle/gradleMetadataCheckResult.js

@@ -0,0 +1,120 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — static Gradle metadata check-result construction
+// (agents.txt Batch 4 section 7.16).
+//
+// Status policy:
+//   - non-Android target                      -> "unsupported" (optional)
+//   - Android detected but no module build     -> "inconclusive" (required)
+//     file could be read
+//   - Android detected but no metadata field    -> "inconclusive" (required)
+//     could be resolved from any module
+//   - usable evidence resolved                  -> "passed"
+// Unresolved dynamic values and metadata conflicts are represented as
+// warnings/evidence — they never fail this check on their own, matching the
+// "validation evidence, not automatic vulnerability" framing used throughout
+// this batch. There is no reachable "malformed"/"error" path for plain-text
+// Gradle files the way there is for XML: readAndroidGradleMetadata treats an
+// unreadable file the same as an absent one, and all paths inspected here
+// come from the already target-contained Batch 2 detection result.
+// ---------------------------------------------------------------------------
+const CHECK_ID = "android-gradle-metadata";
+export function buildAndroidGradleMetadataCheckResult(detection, gradle) {
+    const sourcePaths = [...gradle.settingsFiles, ...gradle.rootBuildFiles, ...gradle.moduleBuildFiles].sort((a, b) => a.localeCompare(b));
+    const evidence = [];
+    if (gradle.wrapper.versionEvidence)
+        evidence.push(`Gradle wrapper version: ${gradle.wrapper.versionEvidence}`);
+    if (gradle.pluginEvidence.androidGradlePluginVersion)
+        evidence.push(`Android Gradle Plugin version: ${gradle.pluginEvidence.androidGradlePluginVersion}`);
+    if (gradle.pluginEvidence.kotlinAndroidPluginVersion)
+        evidence.push(`Kotlin Android plugin version: ${gradle.pluginEvidence.kotlinAndroidPluginVersion}`);
+    for (const module of gradle.modules) {
+        if (module.namespace || module.applicationId) {
+            evidence.push(`${module.path}: namespace=${module.namespace ?? "(none)"} applicationId=${module.applicationId ?? "(none)"}`);
+        }
+    }
+    const warnings = [...gradle.parseWarnings];
+    if (gradle.conflicts && gradle.conflicts.length > 0) {
+        warnings.push(...gradle.conflicts.map((c) => c.note));
+    }
+    if (detection.projectKind === "non-android") {
+        return {
+            id: CHECK_ID,
+            category: "android-gradle",
+            title: "Android Gradle metadata extraction",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const hasModuleBuildFile = gradle.moduleBuildFiles.length > 0;
+    const hasAnyResolvedModuleMetadata = gradle.modules.some((m) => m.namespace || m.applicationId || m.minSdk || m.targetSdk || m.compileSdk || m.versionName || m.versionCode);
+    if (!hasModuleBuildFile) {
+        return {
+            id: CHECK_ID,
+            category: "android-gradle",
+            title: "Android Gradle metadata extraction",
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "No module build.gradle(.kts) file could be read for metadata extraction."],
+            errors: [],
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (!hasAnyResolvedModuleMetadata) {
+        return {
+            id: CHECK_ID,
+            category: "android-gradle",
+            title: "Android Gradle metadata extraction",
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "Module build file(s) were read but no static metadata field could be resolved."],
+            errors: [],
+            sourcePaths,
+            confidence: gradle.metadataConfidence,
+            environmentRequirements: [],
+        };
+    }
+    const confidence = gradle.metadataConfidence;
+    return {
+        id: CHECK_ID,
+        category: "android-gradle",
+        title: "Android Gradle metadata extraction",
+        status: "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings: [],
+        warnings,
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}

package/dist/src/mobile/android/gradle/moduleMetadataExtractor.js

@@ -0,0 +1,137 @@
+import { extractBuildFileEvidence } from "../detect/buildFileEvidence.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded literal metadata extraction from a single module
+// build.gradle(.kts) file's text.
+//
+// Reuses Batch 2's extractBuildFileEvidence for plugin/Compose boolean
+// evidence (already covers namespace/applicationId at a basic level) and
+// adds the additional literal fields Batch 4 needs (version/SDK fields,
+// build-type names) plus raw/unresolved-expression preservation for every
+// field, using the same generic "try a literal, else capture a bounded raw
+// excerpt" strategy for each key. Comments are stripped first so a
+// commented-out assignment never becomes active metadata (ANDROID-B4-05).
+// ---------------------------------------------------------------------------
+function stripComments(text) {
+    // Replaces comment characters with spaces (not empty string) so any
+    // surviving line/column-independent offsets are not shifted — this batch
+    // does not track per-field locations, but keeping length stable is cheap
+    // and avoids accidentally joining tokens across a removed comment.
+    return text
+        .replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/\/\/[^\n]*/g, (match) => " ".repeat(match.length));
+}
+const STRING_OR_INT = `(?:'([^']*)'|"([^"]*)"|(-?\\d+))`;
+function extractLiteral(text, keyAlternatives) {
+    const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    // Anchored to the start of a line (allowing leading indentation) so a key
+    // name that merely appears as a word inside an unrelated string literal —
+    // e.g. `val note = "the applicationId field below is the real one"` — is
+    // never mistaken for a real assignment (ANDROID-B4-05). Genuine Gradle
+    // property assignments always begin a statement/line.
+    const literalPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=]?\\s*${STRING_OR_INT}`, "m");
+    const literalMatch = text.match(literalPattern);
+    if (literalMatch) {
+        const value = literalMatch[1] ?? literalMatch[2] ?? literalMatch[3];
+        return { value };
+    }
+    const rawPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=]?\\s*([^\\n]{1,120})`, "m");
+    const rawMatch = text.match(rawPattern);
+    if (rawMatch) {
+        const raw = rawMatch[1].trim();
+        // A raw excerpt that is itself just a bare literal (already handled
+        // above) or empty is not meaningfully "dynamic" — only report genuinely
+        // unresolved expressions.
+        if (raw.length > 0)
+            return { raw };
+    }
+    return {};
+}
+// Finds the top-level named entries inside a `<blockKeyword> { ... }` block
+// (e.g. `buildTypes { debug { ... } release { ... } }` or
+// `sourceSets { main { ... } androidTest { ... } }`), supporting both the
+// bare-identifier Groovy/Kotlin-DSL form and the Kotlin DSL
+// getByName/create/named(...) form. Bounded by brace-depth matching, not a
+// full parser — nested unrelated blocks inside are not descended into for
+// name extraction beyond the immediate children.
+function findNamedBlockEntries(text, blockKeyword) {
+    const blockStart = text.search(new RegExp(`\\b${blockKeyword}\\s*\\{`));
+    if (blockStart === -1)
+        return [];
+    const openBraceIndex = text.indexOf("{", blockStart);
+    let depth = 0;
+    let endIndex = text.length;
+    for (let i = openBraceIndex; i < text.length; i++) {
+        if (text[i] === "{")
+            depth += 1;
+        else if (text[i] === "}") {
+            depth -= 1;
+            if (depth === 0) {
+                endIndex = i;
+                break;
+            }
+        }
+    }
+    const block = text.slice(openBraceIndex + 1, endIndex);
+    const names = new Set();
+    for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
+        names.add(match[1]);
+    }
+    for (const match of block.matchAll(/\b(?:getByName|create|named)\(\s*["']([\w-]+)["']/g)) {
+        names.add(match[1]);
+    }
+    return [...names].sort((a, b) => a.localeCompare(b));
+}
+// Extracts bounded static metadata for one module's build file text. `path`
+// is intentionally omitted from the returned info — the caller (the
+// aggregator, which already knows the module path from detection) attaches
+// it, keeping this function pure with respect to filesystem/module identity.
+export function extractModuleGradleMetadata(rawText) {
+    const text = stripComments(rawText);
+    const evidence = extractBuildFileEvidence(text);
+    const unsupportedExpressions = [];
+    const namespace = extractLiteral(text, ["namespace"]);
+    const applicationId = extractLiteral(text, ["applicationId"]);
+    const versionCode = extractLiteral(text, ["versionCode"]);
+    const versionName = extractLiteral(text, ["versionName"]);
+    const minSdk = extractLiteral(text, ["minSdk", "minSdkVersion"]);
+    const targetSdk = extractLiteral(text, ["targetSdk", "targetSdkVersion"]);
+    const compileSdk = extractLiteral(text, ["compileSdk", "compileSdkVersion"]);
+    for (const [field, result] of [
+        ["namespace", namespace],
+        ["applicationId", applicationId],
+        ["versionCode", versionCode],
+        ["versionName", versionName],
+        ["minSdk", minSdk],
+        ["targetSdk", targetSdk],
+        ["compileSdk", compileSdk],
+    ]) {
+        if (result.raw) {
+            unsupportedExpressions.push(`${field}: ${result.raw}`);
+        }
+    }
+    return {
+        info: {
+            isApplication: evidence.androidApplicationPlugin || undefined,
+            isLibrary: evidence.androidLibraryPlugin || undefined,
+            namespace: namespace.value ?? evidence.namespace,
+            namespaceRaw: namespace.raw,
+            applicationId: applicationId.value ?? evidence.applicationId,
+            applicationIdRaw: applicationId.raw,
+            versionCode: versionCode.value,
+            versionCodeRaw: versionCode.raw,
+            versionName: versionName.value,
+            versionNameRaw: versionName.raw,
+            minSdk: minSdk.value,
+            minSdkRaw: minSdk.raw,
+            targetSdk: targetSdk.value,
+            targetSdkRaw: targetSdk.raw,
+            compileSdk: compileSdk.value,
+            compileSdkRaw: compileSdk.raw,
+            buildTypes: findNamedBlockEntries(text, "buildTypes"),
+            composeEnabled: evidence.composeBuildFeatureEvidence || evidence.composeDependencyEvidence || undefined,
+            sourceSetEvidence: findNamedBlockEntries(text, "sourceSets").map((name) => `declared sourceSet: ${name}`),
+            testSourceSetEvidence: [],
+            unsupportedExpressions,
+        },
+    };
+}

package/dist/src/mobile/android/gradle/pluginVersionExtractor.js

@@ -0,0 +1,40 @@
+import { accessorSuffixToCatalogAlias, resolveCatalogVersion } from "./versionCatalogMetadata.js";
+function extractDirectIdVersion(text, pluginId) {
+    const escaped = pluginId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`id\\s*\\(?\\s*['"]${escaped}['"]\\s*\\)?\\s*version\\s*['"]([^'"]+)['"]`);
+    return text.match(pattern)?.[1];
+}
+function extractClasspathVersion(text, groupArtifact) {
+    const escaped = groupArtifact.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`classpath\\s*['"]${escaped}:([^'"]+)['"]`);
+    return text.match(pattern)?.[1];
+}
+function extractCatalogAliasVersion(text, pluginId, catalog) {
+    if (!catalog)
+        return undefined;
+    for (const match of text.matchAll(/alias\(\s*libs\.plugins\.([\w.]+)\s*\)/g)) {
+        const alias = accessorSuffixToCatalogAlias(match[1]);
+        const entry = catalog.plugins[alias];
+        if (entry?.id === pluginId) {
+            return resolveCatalogVersion(catalog, entry);
+        }
+    }
+    return undefined;
+}
+// Resolves a plugin's version from root/module build-file text plus an
+// optional parsed version catalog. `classpathGroupArtifact` is only relevant
+// for the Android Gradle Plugin's legacy buildscript-classpath form.
+export function resolvePluginVersion(text, pluginId, catalog, classpathGroupArtifact) {
+    const direct = extractDirectIdVersion(text, pluginId);
+    if (direct)
+        return { version: direct };
+    if (classpathGroupArtifact) {
+        const classpath = extractClasspathVersion(text, classpathGroupArtifact);
+        if (classpath)
+            return { version: classpath };
+    }
+    const catalogVersion = extractCatalogAliasVersion(text, pluginId, catalog);
+    if (catalogVersion)
+        return { version: catalogVersion };
+    return {};
+}

package/dist/src/mobile/android/gradle/readAndroidGradleMetadata.js

@@ -0,0 +1,210 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { resolveWithinRoot } from "../../../core/pathSafety.js";
+import { extractVersionCatalogEvidence } from "../detect/versionCatalogEvidence.js";
+import { parseWrapperProperties } from "./wrapperMetadata.js";
+import { parseVersionCatalog } from "./versionCatalogMetadata.js";
+import { extractModuleGradleMetadata } from "./moduleMetadataExtractor.js";
+import { resolvePluginVersion } from "./pluginVersionExtractor.js";
+import { parseSettingsMetadata } from "./settingsMetadata.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — static Android Gradle metadata extraction entry point.
+//
+// Static, deterministic, read-only, network-free, and independent of Gradle
+// execution/Java/Android SDK availability — consumes only the Batch 2
+// AndroidDetectionResult (settings/build/wrapper/catalog file paths and
+// module records) plus direct filesystem reads of those same files.
+// ---------------------------------------------------------------------------
+function readTextSafe(absolutePath) {
+    try {
+        return readFileSync(absolutePath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+const ANDROID_APPLICATION_PLUGIN_ID = "com.android.application";
+const ANDROID_LIBRARY_PLUGIN_ID = "com.android.library";
+const KOTLIN_ANDROID_PLUGIN_ID = "org.jetbrains.kotlin.android";
+const AGP_CLASSPATH_GROUP_ARTIFACT = "com.android.tools.build:gradle";
+export function readAndroidGradleMetadata(targetRoot, detection) {
+    const resolvedRoot = path.resolve(targetRoot);
+    const parseWarnings = [];
+    const unsupportedExpressions = [];
+    // ---- Wrapper ---------------------------------------------------------------
+    const wrapperPropertiesPath = "gradle/wrapper/gradle-wrapper.properties";
+    let wrapperPropertiesExists = false;
+    try {
+        resolveWithinRoot(resolvedRoot, wrapperPropertiesPath);
+        wrapperPropertiesExists = true;
+    }
+    catch {
+        wrapperPropertiesExists = false;
+    }
+    const wrapperText = wrapperPropertiesExists ? readTextSafe(path.join(resolvedRoot, wrapperPropertiesPath)) : undefined;
+    const gradlewPresent = readTextSafe(path.join(resolvedRoot, "gradlew")) !== undefined;
+    const gradlewBatPresent = readTextSafe(path.join(resolvedRoot, "gradlew.bat")) !== undefined;
+    const wrapperWarnings = [];
+    let wrapper;
+    if (wrapperText !== undefined) {
+        const parsed = parseWrapperProperties(wrapperText);
+        wrapperWarnings.push(...parsed.warnings);
+        if (!gradlewPresent && !gradlewBatPresent) {
+            wrapperWarnings.push("gradle-wrapper.properties exists but neither gradlew nor gradlew.bat was found.");
+        }
+        wrapper = {
+            present: detection.hasGradleWrapper,
+            wrapperPropertiesPath,
+            versionEvidence: parsed.gradleVersion,
+            distributionUrl: parsed.distributionUrl,
+            distributionType: parsed.distributionType,
+            checksumPropertyPresent: parsed.checksumPropertyPresent,
+            gradlewPresent,
+            gradlewBatPresent,
+            warnings: wrapperWarnings,
+        };
+    }
+    else {
+        if (gradlewPresent || gradlewBatPresent) {
+            wrapperWarnings.push("gradlew/gradlew.bat found but gradle-wrapper.properties is missing or unreadable.");
+        }
+        wrapper = {
+            present: detection.hasGradleWrapper,
+            gradlewPresent,
+            gradlewBatPresent,
+            warnings: wrapperWarnings,
+        };
+    }
+    parseWarnings.push(...wrapperWarnings);
+    // ---- Settings ---------------------------------------------------------------
+    let rootProjectName;
+    for (const settingsPath of detection.gradleSettingsFiles) {
+        const text = readTextSafe(path.join(resolvedRoot, settingsPath));
+        if (!text)
+            continue;
+        const parsed = parseSettingsMetadata(text);
+        if (parsed.rootProjectName && !rootProjectName)
+            rootProjectName = parsed.rootProjectName;
+        if (parsed.includedBuilds.length > 0) {
+            parseWarnings.push(`${settingsPath}: included build(s) present as unsupported/external evidence: ${parsed.includedBuilds.join(", ")}`);
+        }
+    }
+    // ---- Version catalog ---------------------------------------------------------
+    let versionCatalogEvidence;
+    let parsedCatalog;
+    if (detection.versionCatalogFiles.length > 0) {
+        const catalogText = readTextSafe(path.join(resolvedRoot, detection.versionCatalogFiles[0]));
+        if (catalogText) {
+            versionCatalogEvidence = extractVersionCatalogEvidence(catalogText);
+            parsedCatalog = parseVersionCatalog(catalogText);
+        }
+    }
+    // ---- Root build files: plugin/AGP/Kotlin version evidence --------------------
+    const pluginEvidence = {};
+    for (const rootBuildFilePath of detection.rootBuildFiles) {
+        const text = readTextSafe(path.join(resolvedRoot, rootBuildFilePath));
+        if (!text)
+            continue;
+        const hasDirectAgpTextEvidence = text.includes(ANDROID_APPLICATION_PLUGIN_ID) || text.includes(ANDROID_LIBRARY_PLUGIN_ID);
+        if (!pluginEvidence.androidGradlePluginVersion) {
+            const agpVersion = resolvePluginVersion(text, ANDROID_APPLICATION_PLUGIN_ID, parsedCatalog, AGP_CLASSPATH_GROUP_ARTIFACT);
+            if (agpVersion.version)
+                pluginEvidence.androidGradlePluginVersion = agpVersion.version;
+        }
+        if (!pluginEvidence.androidGradlePluginEvidence && (hasDirectAgpTextEvidence || pluginEvidence.androidGradlePluginVersion)) {
+            pluginEvidence.androidGradlePluginEvidence = hasDirectAgpTextEvidence
+                ? `Android Gradle Plugin referenced in ${rootBuildFilePath}`
+                : `Android Gradle Plugin referenced via version-catalog alias in ${rootBuildFilePath}`;
+        }
+        const hasDirectKotlinTextEvidence = text.includes(KOTLIN_ANDROID_PLUGIN_ID);
+        if (!pluginEvidence.kotlinAndroidPluginVersion) {
+            const kotlinVersion = resolvePluginVersion(text, KOTLIN_ANDROID_PLUGIN_ID, parsedCatalog);
+            if (kotlinVersion.version)
+                pluginEvidence.kotlinAndroidPluginVersion = kotlinVersion.version;
+        }
+        if (!pluginEvidence.kotlinAndroidPluginEvidence && (hasDirectKotlinTextEvidence || pluginEvidence.kotlinAndroidPluginVersion)) {
+            pluginEvidence.kotlinAndroidPluginEvidence = hasDirectKotlinTextEvidence
+                ? `Kotlin Android plugin referenced in ${rootBuildFilePath}`
+                : `Kotlin Android plugin referenced via version-catalog alias in ${rootBuildFilePath}`;
+        }
+    }
+    if (versionCatalogEvidence && versionCatalogEvidence.composeAliasEvidence.length > 0) {
+        pluginEvidence.composePluginEvidence = `Version-catalog Compose alias(es): ${versionCatalogEvidence.composeAliasEvidence.join(", ")}`;
+    }
+    if (!pluginEvidence.androidGradlePluginVersion && pluginEvidence.androidGradlePluginEvidence) {
+        unsupportedExpressions.push("Android Gradle Plugin version could not be statically resolved.");
+    }
+    // ---- Modules ------------------------------------------------------------------
+    const moduleBuildFiles = [];
+    const modules = [];
+    const applicationIdsByModule = [];
+    for (const module of detection.modules) {
+        const buildFileCandidates = [`${module.path}/build.gradle.kts`, `${module.path}/build.gradle`];
+        const buildFileRelPath = buildFileCandidates.find((candidate) => readTextSafe(path.join(resolvedRoot, candidate)) !== undefined);
+        if (!buildFileRelPath) {
+            modules.push({
+                path: module.path,
+                buildTypes: [],
+                sourceSetEvidence: [],
+                testSourceSetEvidence: [],
+                unsupportedExpressions: [],
+            });
+            continue;
+        }
+        moduleBuildFiles.push(buildFileRelPath);
+        const text = readTextSafe(path.join(resolvedRoot, buildFileRelPath)) ?? "";
+        const extracted = extractModuleGradleMetadata(text);
+        const javaSourceRoots = detection.javaSourceRoots.filter((p) => p.startsWith(`${module.path}/`));
+        const kotlinSourceRoots = detection.kotlinSourceRoots.filter((p) => p.startsWith(`${module.path}/`));
+        const unitTestRoots = detection.unitTestSourceRoots.filter((p) => p.startsWith(`${module.path}/`));
+        const instrumentedTestRoots = detection.instrumentedTestSourceRoots.filter((p) => p.startsWith(`${module.path}/`));
+        modules.push({
+            path: module.path,
+            buildFilePath: buildFileRelPath,
+            ...extracted.info,
+            sourceSetEvidence: [...extracted.info.sourceSetEvidence, ...javaSourceRoots, ...kotlinSourceRoots].sort((a, b) => a.localeCompare(b)),
+            testSourceSetEvidence: [...unitTestRoots, ...instrumentedTestRoots].sort((a, b) => a.localeCompare(b)),
+        });
+        if (extracted.info.applicationId) {
+            applicationIdsByModule.push({ modulePath: module.path, value: extracted.info.applicationId, sourceFile: buildFileRelPath });
+        }
+        unsupportedExpressions.push(...extracted.info.unsupportedExpressions.map((e) => `${buildFileRelPath}: ${e}`));
+    }
+    // ---- Conflicts ------------------------------------------------------------------
+    const conflicts = [];
+    const applicationModulePaths = new Set(detection.applicationModules);
+    const applicationIdConflictEntries = applicationIdsByModule.filter((e) => applicationModulePaths.has(e.modulePath));
+    const distinctApplicationModuleIds = new Set(applicationIdConflictEntries.map((e) => e.value));
+    if (distinctApplicationModuleIds.size > 1) {
+        conflicts.push({
+            field: "applicationId",
+            modulePath: [...applicationModulePaths].sort((a, b) => a.localeCompare(b)).join(", "),
+            values: applicationIdConflictEntries.map((e) => ({ value: e.value, sourceFile: e.sourceFile })),
+            note: `${distinctApplicationModuleIds.size} distinct applicationId values found across application modules; no primary value was selected.`,
+        });
+    }
+    // ---- Confidence ------------------------------------------------------------------
+    const hasAnyResolvedModuleMetadata = modules.some((m) => m.namespace || m.applicationId || m.minSdk || m.targetSdk || m.compileSdk);
+    const hasUnresolvedEvidence = unsupportedExpressions.length > 0 || conflicts.length > 0;
+    let metadataConfidence = "unknown";
+    if (hasAnyResolvedModuleMetadata) {
+        metadataConfidence = hasUnresolvedEvidence ? "medium" : "high";
+    }
+    else if (moduleBuildFiles.length > 0) {
+        metadataConfidence = "low";
+    }
+    return {
+        wrapper,
+        settingsFiles: detection.gradleSettingsFiles,
+        rootBuildFiles: detection.rootBuildFiles,
+        moduleBuildFiles: moduleBuildFiles.sort((a, b) => a.localeCompare(b)),
+        rootProjectName,
+        pluginEvidence,
+        modules: modules.sort((a, b) => a.path.localeCompare(b.path)),
+        versionCatalogEvidence,
+        conflicts: conflicts.length > 0 ? conflicts : undefined,
+        metadataConfidence,
+        parseWarnings: [...new Set(parseWarnings)],
+        unsupportedExpressions: [...new Set(unsupportedExpressions)].sort((a, b) => a.localeCompare(b)),
+    };
+}

package/dist/src/mobile/android/gradle/releaseMetadataSummary.js

@@ -0,0 +1,64 @@
+// Selects the application module deterministically only when exactly one
+// application module exists (agents.txt Batch 4 section 7.14 — never invent
+// a primary application module when several exist without a deterministic
+// rule).
+export function buildAndroidReleaseMetadataSummary(detection, gradle) {
+    const applicationModulePaths = detection.applicationModules;
+    const unresolvedFields = [];
+    if (applicationModulePaths.length === 0) {
+        return {
+            applicationModuleSelectionNote: "No application module was detected; release metadata is not available.",
+            buildTypes: [],
+            wrapperGradleVersion: gradle.wrapper.versionEvidence,
+            androidGradlePluginVersion: gradle.pluginEvidence.androidGradlePluginVersion,
+            kotlinAndroidPluginVersion: gradle.pluginEvidence.kotlinAndroidPluginVersion,
+            metadataConfidence: gradle.metadataConfidence,
+            unresolvedFields: [],
+            conflicts: gradle.conflicts ?? [],
+        };
+    }
+    if (applicationModulePaths.length > 1) {
+        return {
+            applicationModuleSelectionNote: `${applicationModulePaths.length} application modules were detected (${applicationModulePaths.join(", ")}); no single application module was selected deterministically.`,
+            buildTypes: [],
+            wrapperGradleVersion: gradle.wrapper.versionEvidence,
+            androidGradlePluginVersion: gradle.pluginEvidence.androidGradlePluginVersion,
+            kotlinAndroidPluginVersion: gradle.pluginEvidence.kotlinAndroidPluginVersion,
+            metadataConfidence: gradle.metadataConfidence,
+            unresolvedFields: [],
+            conflicts: gradle.conflicts ?? [],
+        };
+    }
+    const applicationModulePath = applicationModulePaths[0];
+    const moduleInfo = gradle.modules.find((m) => m.path === applicationModulePath);
+    for (const [field, value] of [
+        ["applicationId", moduleInfo?.applicationIdRaw],
+        ["versionCode", moduleInfo?.versionCodeRaw],
+        ["versionName", moduleInfo?.versionNameRaw],
+        ["minSdk", moduleInfo?.minSdkRaw],
+        ["targetSdk", moduleInfo?.targetSdkRaw],
+        ["compileSdk", moduleInfo?.compileSdkRaw],
+    ]) {
+        if (value)
+            unresolvedFields.push(`${field}: ${value}`);
+    }
+    return {
+        applicationModulePath,
+        applicationModuleSelectionNote: `Exactly one application module was detected (${applicationModulePath}); its metadata is used as the release metadata summary.`,
+        applicationId: moduleInfo?.applicationId,
+        namespace: moduleInfo?.namespace,
+        versionCode: moduleInfo?.versionCode,
+        versionName: moduleInfo?.versionName,
+        minSdk: moduleInfo?.minSdk,
+        targetSdk: moduleInfo?.targetSdk,
+        compileSdk: moduleInfo?.compileSdk,
+        buildTypes: moduleInfo?.buildTypes ?? [],
+        wrapperGradleVersion: gradle.wrapper.versionEvidence,
+        androidGradlePluginVersion: gradle.pluginEvidence.androidGradlePluginVersion,
+        kotlinAndroidPluginVersion: gradle.pluginEvidence.kotlinAndroidPluginVersion,
+        composeEnabled: moduleInfo?.composeEnabled,
+        metadataConfidence: gradle.metadataConfidence,
+        unresolvedFields,
+        conflicts: gradle.conflicts ?? [],
+    };
+}

package/dist/src/mobile/android/gradle/settingsMetadata.js

@@ -0,0 +1,20 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded settings.gradle(.kts) metadata beyond Batch 2's
+// module-include parsing.
+//
+// Only extracts a direct `rootProject.name = "..."` / `rootProject.name "..."`
+// literal and detects included-build/plugin-management/dependency-resolution
+// presence as evidence — never evaluates the referenced build's contents.
+// ---------------------------------------------------------------------------
+const ROOT_PROJECT_NAME_PATTERN = /rootProject\.name\s*=?\s*['"]([^'"]+)['"]/;
+export function parseSettingsMetadata(text) {
+    const rootProjectName = text.match(ROOT_PROJECT_NAME_PATTERN)?.[1];
+    const includedBuilds = [...text.matchAll(/includeBuild\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1]);
+    return {
+        rootProjectName,
+        hasPluginManagement: /\bpluginManagement\s*\{/.test(text),
+        hasDependencyResolutionManagement: /\bdependencyResolutionManagement\s*\{/.test(text),
+        hasVersionCatalogDeclaration: /\bversionCatalogs\s*\{/.test(text) || /\bcreate\(\s*['"]libs['"]/.test(text),
+        includedBuilds: includedBuilds.sort((a, b) => a.localeCompare(b)),
+    };
+}

package/dist/src/mobile/android/gradle/types.js

@@ -0,0 +1 @@
+export {};