@dailephd/my-dev-kit-lab 0.3.4 → 0.4.0

package/dist/src/audits/codeRot/detectors/architectureDriftDetector.js

@@ -42,6 +42,7 @@ export const ARCHITECTURE_DRIFT_DETECTOR = {
     },
     run: (ctx) => {
         const issues = [];
+        const hasAndroidValidationSource = fs.existsSync(path.join(ctx.target.rootPath, "src", "mobile", "android", "validate", "validateAndroidTarget.ts"));
         const currentStateDocs = ctx.inventory.docsFiles.filter((f) => CURRENT_STATE_DOC_BASENAMES.has(path.basename(f.relativePath).toLowerCase()));
         for (const docFile of currentStateDocs) {
             const content = readBoundedFileText(ctx.target.rootPath, docFile.relativePath, docFile.sizeBytes, MAX_READ_BYTES);
@@ -61,7 +62,7 @@ export const ARCHITECTURE_DRIFT_DETECTOR = {
             const content = readBoundedFileText(ctx.target.rootPath, docFile.relativePath, docFile.sizeBytes, MAX_READ_BYTES);
             if (content === null)
                 continue;
-            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content));
+            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content, hasAndroidValidationSource));
         }
         return deduplicateIssuesById(issues);
     },
@@ -227,13 +228,15 @@ function findMajorDirsAbsentFromArchitectureDoc(ctx, docRelativePath, content) {
     }
     return issues;
 }
-function findUnsupportedCurrentClaims(docRelativePath, content) {
+function findUnsupportedCurrentClaims(docRelativePath, content, hasAndroidValidationSource) {
     const issues = [];
     const subjects = [
         { id: "manual-pentest", label: "manual pentest", pattern: "manual pentest" },
         { id: "android-validation", label: "Android/mobile validation", pattern: "(?:android (?:validation|support))" },
     ];
     for (const subject of subjects) {
+        if (subject.id === "android-validation" && hasAndroidValidationSource)
+            continue;
         const pattern = currentClaimPatternFor(subject.pattern);
         const match = pattern.exec(content);
         if (!match)

package/dist/src/audits/codeRot/detectors/securityValidationAssumptionRotDetector.js

@@ -67,6 +67,7 @@ export const SECURITY_VALIDATION_ASSUMPTION_ROT_DETECTOR = {
         const pkgVersion = ctx.sourceOfTruth.package?.version ?? null;
         const hasSecurityValidationSourceDir = ctx.sourceOfTruth.security.hasSecurityValidationSourceDir;
         const hasAttackScenariosDir = fs.existsSync(path.join(ctx.target.rootPath, "src", "securityValidation", "attackScenarios"));
+        const hasAndroidValidationSource = fs.existsSync(path.join(ctx.target.rootPath, "src", "mobile", "android", "validate", "validateAndroidTarget.ts"));
         for (const docFile of ctx.inventory.docsFiles) {
             const content = readBoundedFileText(ctx.target.rootPath, docFile.relativePath, docFile.sizeBytes, MAX_READ_BYTES);
             if (content === null)
@@ -75,7 +76,7 @@ export const SECURITY_VALIDATION_ASSUMPTION_ROT_DETECTOR = {
             issues.push(...findSkippedEqualsPassed(docFile.relativePath, content));
             issues.push(...findExhaustiveSecretClaim(docFile.relativePath, content));
             issues.push(...findCompleteNetworkIsolationClaim(docFile.relativePath, content));
-            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content));
+            issues.push(...findUnsupportedCurrentClaims(docFile.relativePath, content, hasAndroidValidationSource));
             if (pkgVersion)
                 issues.push(...findStaleV021SecurityMention(docFile.relativePath, content, pkgVersion));
             if (hasSecurityValidationSourceDir && hasAttackScenariosDir) {
@@ -237,13 +238,15 @@ function findCompleteNetworkIsolationClaim(relativePath, content) {
         }),
     ];
 }
-function findUnsupportedCurrentClaims(relativePath, content) {
+function findUnsupportedCurrentClaims(relativePath, content, hasAndroidValidationSource) {
     const issues = [];
     const subjects = [
         { id: "manual-pentest", label: "manual pentest", pattern: "manual pentest" },
         { id: "android-validation", label: "Android/mobile validation", pattern: "(?:android (?:validation|support)|mobile validation)" },
     ];
     for (const subject of subjects) {
+        if (subject.id === "android-validation" && hasAndroidValidationSource)
+            continue;
         const match = currentClaimPatternFor(subject.pattern).exec(content);
         if (!match)
             continue;

package/dist/src/mobile/android/audit/androidFinding.js

@@ -0,0 +1,68 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — Android SecurityFinding factory.
+//
+// Reuses SecurityFinding as-is (no parallel Android finding schema). Android
+// findings use category "static-scan" — an existing SecurityCheckCategory
+// value that already covers static-analysis-derived findings (CodeQL,
+// Semgrep) and accurately describes manifest analysis, so no widening of the
+// shared, heavily-tested SecurityCheckCategory union was needed. Per-finding
+// audit family is instead carried by the owning AndroidCheckResult.category
+// (android-permissions/android-components/android-intent-filters/
+// android-deep-links) and by the finding id/title.
+//
+// SecurityFinding has no `confidence` or structured `location` field (the
+// existing codebase convention, e.g. AttackResult, keeps confidence on the
+// *check result*, not the individual finding — see
+// src/securityValidation/attackScenarios/attackResult.ts). Android check
+// results already carry `confidence: MobileConfidence` (Batch 1). Per-finding
+// confidence and location are therefore folded into the free-text `evidence`
+// field here, consistent with how existing scenario code joins evidence
+// previews into that same field.
+// ---------------------------------------------------------------------------
+function slug(value) {
+    return value
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .toLowerCase();
+}
+// Deterministic, content-derived id — never depends on a counter, timestamp,
+// or enumeration order, so equivalent evidence always yields the same id.
+function buildFindingId(ruleId, manifestPath, identity, location) {
+    const parts = [ruleId, slug(manifestPath), identity ? slug(identity) : undefined, location?.line !== undefined ? `l${location.line}` : undefined].filter((part) => Boolean(part));
+    return parts.join("--");
+}
+function defaultReleaseImpact(severity) {
+    switch (severity) {
+        case "blocker":
+            return "Must fix before release";
+        case "major":
+            return "Should fix before release";
+        case "minor":
+            return "Review recommended before release";
+        case "informational":
+            return "No release impact; informational only";
+        case "skipped":
+            return "Not evaluated";
+    }
+}
+export function makeAndroidFinding(input) {
+    const id = buildFindingId(input.ruleId, input.manifestPath, input.identity, input.location);
+    const locationSuffix = input.location?.line !== undefined ? `:${input.location.line}` : "";
+    const evidenceParts = [
+        `confidence=${input.confidence}`,
+        input.identity ? `identity=${input.identity}` : undefined,
+        `location=${input.manifestPath}${locationSuffix}`,
+        ...(input.evidenceDetails ?? []),
+    ].filter((part) => Boolean(part));
+    return {
+        id,
+        title: input.title,
+        severity: input.severity,
+        category: "static-scan",
+        description: input.description,
+        evidence: evidenceParts.join(" | "),
+        affectedFiles: [input.manifestPath],
+        recommendation: input.recommendation,
+        releaseImpact: input.releaseImpact ?? defaultReleaseImpact(input.severity),
+    };
+}

package/dist/src/mobile/android/audit/checkResultBuilder.js

@@ -0,0 +1,97 @@
+function isMalformed(entry) {
+    return entry.manifest.parseWarnings.some((w) => w.startsWith("Malformed XML:"));
+}
+export function buildAndroidManifestCheckResult(input) {
+    const { id, category, title, detection, manifests, findings, evidence, warnings } = input;
+    const sourcePaths = manifests.map((m) => m.manifestPath);
+    if (detection.projectKind === "non-android") {
+        return {
+            id,
+            category,
+            title,
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: id,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (manifests.length === 0) {
+        return {
+            id,
+            category,
+            title,
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "No AndroidManifest.xml was found for this target; audit could not run."],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const malformedEntries = manifests.filter(isMalformed);
+    const allMalformed = malformedEntries.length === manifests.length;
+    if (allMalformed) {
+        return {
+            id,
+            category,
+            title,
+            status: "error",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings,
+            errors: malformedEntries.flatMap((entry) => entry.manifest.parseWarnings.filter((w) => w.startsWith("Malformed XML:"))),
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const confidence = malformedEntries.length > 0 ? "medium" : "high";
+    // Informational-only findings (e.g. "standard launcher activity is
+    // exported, as expected") are evidence/inventory, not a reportable issue —
+    // only minor/major/blocker findings cause a "failed" status, matching
+    // section 7.17's "completed and found no reportable issues may pass".
+    const hasReportableFinding = findings.some((finding) => finding.severity !== "informational");
+    const status = hasReportableFinding ? "failed" : "passed";
+    return {
+        id,
+        category,
+        title,
+        status,
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [
+            ...warnings,
+            ...malformedEntries.flatMap((entry) => entry.manifest.parseWarnings.filter((w) => w.startsWith("Malformed XML:"))),
+        ],
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}

package/dist/src/mobile/android/audit/deepLinkAudit.js

@@ -0,0 +1,183 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — initial deep-link audit.
+//
+// Distinguishes web links (http/https) from custom-scheme deep links, flags
+// missing host/scheme restrictions and broad path patterns, and treats
+// BROWSABLE-without-VIEW and VIEW-without-BROWSABLE as separate "incomplete
+// filter" observations (agents.txt Batch 3 section 7.16). Never claims
+// Digital Asset Links verification, domain ownership, or exploitability —
+// findings are framed as static exposure/configuration review, at most
+// "major" for the narrow high-confidence case of an explicitly exported,
+// unprotected, wildcard-path activity.
+// ---------------------------------------------------------------------------
+const VIEW_ACTION = "android.intent.action.VIEW";
+const BROWSABLE_CATEGORY = "android.intent.category.BROWSABLE";
+const WILDCARD_PATTERN = /[*.]{1,2}\*|\.\*/;
+function isPlaceholder(value) {
+    return value !== undefined && (value.includes("${") || value.startsWith("@"));
+}
+function classifyScheme(dataElements) {
+    const schemes = dataElements.map((d) => d.dataScheme).filter((s) => Boolean(s));
+    if (schemes.length === 0)
+        return "none";
+    if (schemes.some((s) => s === "http" || s === "https"))
+        return "web";
+    return "custom";
+}
+function auditDeepLinkFilter(entry, kind, component, filter, findings) {
+    const identity = component.name || "(unnamed component)";
+    const actions = filter.actions ?? [];
+    const categories = filter.categories ?? [];
+    const dataElements = filter.dataElements ?? filter.filterData;
+    const hasView = actions.includes(VIEW_ACTION);
+    const hasBrowsable = categories.includes(BROWSABLE_CATEGORY);
+    if (!hasView && !hasBrowsable)
+        return;
+    if (hasBrowsable && !hasView) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-browsable-without-view",
+            title: `BROWSABLE category without a VIEW action on ${kind} "${identity}"`,
+            severity: "informational",
+            confidence: "high",
+            description: "This <intent-filter> declares category BROWSABLE without action VIEW, so it will not actually be treated as a browsable web/deep link by the platform.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+        }));
+        return;
+    }
+    if (hasView && !hasBrowsable && dataElements.length === 0) {
+        // Plain VIEW with no data and no BROWSABLE — not a deep link, nothing to audit here.
+        return;
+    }
+    const exportedExplicitTrue = component.exported === true;
+    const unprotected = !component.permission;
+    const scheme = classifyScheme(dataElements);
+    const hasHost = dataElements.some((d) => Boolean(d.dataHost));
+    const placeholderEvidence = dataElements.some((d) => isPlaceholder(d.dataScheme) || isPlaceholder(d.dataHost) || isPlaceholder(d.dataPath) || isPlaceholder(d.dataPathPrefix) || isPlaceholder(d.dataPathPattern));
+    const broadPattern = dataElements.some((d) => (d.dataPathPattern && WILDCARD_PATTERN.test(d.dataPathPattern)) || d.dataPathPattern === ".*" || d.dataPathPattern === "*");
+    const evidenceDetails = [
+        `scheme=${scheme}`,
+        `hasHost=${hasHost}`,
+        `exported=${component.exported ?? "unspecified"}`,
+        `hasComponentPermission=${!unprotected}`,
+        `dataElementCount=${dataElements.length}`,
+    ];
+    if (placeholderEvidence) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-placeholder-value",
+            title: `Deep-link data on ${kind} "${identity}" contains an unresolved placeholder or resource reference`,
+            severity: "informational",
+            confidence: "low",
+            description: "One or more deep-link data attributes (scheme/host/path) reference an unresolved manifest placeholder (e.g. ${applicationId}) or Android resource (e.g. @string/...). Effective exposure cannot be assessed statically.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+        }));
+        return;
+    }
+    if (broadPattern) {
+        const strongEvidence = exportedExplicitTrue && unprotected;
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-broad-path-pattern",
+            title: `Broad/wildcard deep-link path pattern on ${kind} "${identity}"`,
+            severity: strongEvidence ? "major" : "minor",
+            confidence: strongEvidence ? "high" : "medium",
+            description: strongEvidence
+                ? "This deep-link filter uses a highly permissive pathPattern, the component is explicitly exported, and no component-level permission protects it — a strong static combination of broad matching and open reachability."
+                : "This deep-link filter uses a broad/wildcard-like pathPattern. Broad path matching is not automatically exploitable, but widens the set of URLs the app will handle.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Narrow the pathPattern to only the routes the app actually needs to handle, and validate any path/query data before use.",
+        }));
+        return;
+    }
+    if (scheme === "web" && !hasHost) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-web-link-without-host",
+            title: `HTTP/HTTPS deep link on ${kind} "${identity}" has no host restriction`,
+            severity: "minor",
+            confidence: "medium",
+            description: "This web-link intent filter declares an http/https scheme without a host, so it is not restricted to a specific domain.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Add android:host to restrict which domains this filter matches.",
+        }));
+        return;
+    }
+    if (scheme === "custom" && !hasHost) {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-deep-link-custom-scheme-without-host",
+            title: `Custom-scheme deep link on ${kind} "${identity}" has no host restriction`,
+            severity: "minor",
+            confidence: "medium",
+            description: "This custom-scheme intent filter declares no host restriction. Custom schemes are not automatically vulnerabilities, but an unrestricted scheme accepts any host/path combination.",
+            manifestPath: entry.manifestPath,
+            identity,
+            location: filter.location,
+            evidenceDetails,
+            recommendation: "Consider restricting the host or validating incoming URIs defensively in the handling code.",
+        }));
+        return;
+    }
+    // Bounded/safe deep link: explicit scheme + host (+ optional path
+    // restriction), no wildcard pattern, no placeholders — recorded for
+    // inventory purposes at informational severity only (ANDROID-B3-24).
+    findings.push(makeAndroidFinding({
+        ruleId: "android-deep-link-bounded",
+        title: `Deep link declared on ${kind} "${identity}"`,
+        severity: "informational",
+        confidence: "high",
+        description: "This deep-link filter declares an explicit scheme and host with bounded path evidence. No static exposure concern was identified.",
+        manifestPath: entry.manifestPath,
+        identity,
+        location: filter.location,
+        evidenceDetails,
+    }));
+}
+function componentGroups(entry) {
+    return [
+        { kind: "activity", components: entry.manifest.activities },
+        { kind: "activity-alias", components: entry.manifest.activityAliases ?? [] },
+    ];
+}
+export function auditAndroidDeepLinks(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        let candidateCount = 0;
+        for (const group of componentGroups(entry)) {
+            for (const component of group.components) {
+                for (const filter of component.intentFilters) {
+                    const actions = filter.actions ?? [];
+                    const categories = filter.categories ?? [];
+                    if (actions.includes(VIEW_ACTION) || categories.includes(BROWSABLE_CATEGORY)) {
+                        candidateCount += 1;
+                        auditDeepLinkFilter(entry, group.kind, component, filter, findings);
+                    }
+                }
+            }
+        }
+        if (candidateCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${candidateCount} deep-link candidate intent-filter(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-deep-links-audit",
+        category: "android-deep-links",
+        title: "Android deep-link audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}

package/dist/src/mobile/android/audit/exportedComponentAudit.js

@@ -0,0 +1,183 @@
+import { makeAndroidFinding } from "./androidFinding.js";
+import { buildAndroidManifestCheckResult } from "./checkResultBuilder.js";
+function componentGroups(manifest) {
+    return [
+        { kind: "activity", components: manifest.activities },
+        { kind: "activity-alias", components: manifest.activityAliases ?? [] },
+        { kind: "service", components: manifest.services },
+        { kind: "receiver", components: manifest.receivers },
+        { kind: "provider", components: manifest.providers },
+    ];
+}
+function isProtectedNonProvider(component, applicationPermission) {
+    return Boolean(component.permission) || Boolean(applicationPermission);
+}
+function providerProtection(component) {
+    if (component.permission)
+        return "protected";
+    if (component.readPermission && component.writePermission)
+        return "protected";
+    if (component.readPermission || component.writePermission)
+        return "partial";
+    return "unprotected";
+}
+export function auditAndroidExportedComponents(detection, manifests) {
+    const findings = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const applicationPermission = entry.manifest.application.permission;
+        let inspectedCount = 0;
+        for (const group of componentGroups(entry.manifest)) {
+            for (const component of group.components) {
+                inspectedCount += 1;
+                const hasFilters = component.intentFilters.length > 0;
+                const identity = component.name || "(unnamed component)";
+                // Malformed exported value: never normalized to true or false.
+                if (component.exported === undefined && component.exportedRaw !== undefined) {
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-malformed-exported",
+                        title: `${group.kind} "${identity}" has a malformed android:exported value`,
+                        severity: "minor",
+                        confidence: "low",
+                        description: `android:exported="${component.exportedRaw}" could not be statically resolved to true or false. Effective exported state is unknown and must be reviewed manually.`,
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`, `exportedRaw=${component.exportedRaw}`],
+                        recommendation: "Resolve the android:exported value to an explicit true/false literal.",
+                    }));
+                    continue;
+                }
+                if (component.exported === false) {
+                    continue;
+                }
+                if (component.exported === undefined) {
+                    if (hasFilters) {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-component-unspecified-exported-with-filter",
+                            title: `${group.kind} "${identity}" has an intent filter but no explicit android:exported value`,
+                            severity: "minor",
+                            confidence: "medium",
+                            description: "This component declares an intent filter but does not set android:exported explicitly. Effective exported state depends on the target/compile SDK and manifest context, and must be reviewed rather than assumed.",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [`kind=${group.kind}`, `intentFilterCount=${component.intentFilters.length}`],
+                            recommendation: "Set android:exported explicitly to document the intended behavior.",
+                        }));
+                    }
+                    continue;
+                }
+                // component.exported === true from here on.
+                if (group.kind === "provider") {
+                    const protection = providerProtection(component);
+                    if (protection === "unprotected") {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-provider-exported-unprotected",
+                            title: `Exported provider "${identity}" has no permission protection`,
+                            severity: "major",
+                            confidence: "high",
+                            description: "This <provider> is explicitly exported and declares no permission, readPermission, or writePermission. Any app on the device may query or modify its data unless finer-grained protection exists elsewhere (e.g. path-level permissions not visible here).",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [
+                                `authorities=${(component.authorities ?? []).join(",") || "(none parsed)"}`,
+                                `grantUriPermissions=${component.grantUriPermissions ?? "unspecified"}`,
+                            ],
+                            recommendation: "Add android:permission, or both readPermission and writePermission, or set android:exported=\"false\" if external access is not required.",
+                        }));
+                    }
+                    else if (protection === "partial") {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-provider-exported-partial-protection",
+                            title: `Exported provider "${identity}" only protects one of read/write access`,
+                            severity: "minor",
+                            confidence: "medium",
+                            description: "This <provider> defines only one of readPermission/writePermission, leaving the other operation unprotected.",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [`readPermission=${component.readPermission ?? "(none)"}`, `writePermission=${component.writePermission ?? "(none)"}`],
+                            recommendation: "Protect both read and write access, or document why only one is intentionally protected.",
+                        }));
+                    }
+                    else {
+                        findings.push(makeAndroidFinding({
+                            ruleId: "android-provider-exported-protected",
+                            title: `Exported provider "${identity}" is permission-protected`,
+                            severity: "informational",
+                            confidence: "high",
+                            description: "This <provider> is explicitly exported but protection evidence (permission or read+write permissions) is present.",
+                            manifestPath: entry.manifestPath,
+                            identity,
+                            location: component.location,
+                            evidenceDetails: [`permission=${component.permission ?? "(none)"}`],
+                        }));
+                    }
+                    continue;
+                }
+                const protected_ = isProtectedNonProvider(component, applicationPermission);
+                if (protected_) {
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-exported-protected",
+                        title: `Exported ${group.kind} "${identity}" is permission-protected`,
+                        severity: "informational",
+                        confidence: "high",
+                        description: `This ${group.kind} is explicitly exported and protected by ${component.permission ? `component-level permission "${component.permission}"` : `an application-level permission ("${applicationPermission}")`}.`,
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`, `hasIntentFilters=${hasFilters}`, `permission=${component.permission ?? applicationPermission}`],
+                    }));
+                }
+                else if (component.isLauncherActivity) {
+                    // A standard launcher activity being exported and unprotected is
+                    // expected, required Android behavior (it must be exported to be
+                    // launchable from the home screen) — informational only, not a
+                    // review-required finding (agents.txt Batch 3 section 7.19,
+                    // "Standard launcher activity evidence" = informational/low tier).
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-launcher-activity-exported",
+                        title: `Launcher activity "${identity}" is exported (expected)`,
+                        severity: "informational",
+                        confidence: "high",
+                        description: "This is the app's launcher activity (MAIN/LAUNCHER intent filter). Being exported without permission protection is expected, standard behavior for a launcher entry point.",
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`],
+                    }));
+                }
+                else {
+                    findings.push(makeAndroidFinding({
+                        ruleId: "android-component-exported-unprotected",
+                        title: `Exported ${group.kind} "${identity}" has no deterministic permission protection`,
+                        severity: "minor",
+                        confidence: hasFilters ? "high" : "medium",
+                        description: `This ${group.kind} is explicitly exported and no component-level or application-level permission was found in this manifest. Effective protection could still exist via a permission defined in another source set or module, which lowers confidence here.`,
+                        manifestPath: entry.manifestPath,
+                        identity,
+                        location: component.location,
+                        evidenceDetails: [`kind=${group.kind}`, `hasIntentFilters=${hasFilters}`],
+                        recommendation: "Add android:permission if this component should not be freely reachable by other apps, or confirm android:exported=\"true\" is intentional.",
+                    }));
+                }
+            }
+        }
+        if (inspectedCount > 0) {
+            evidence.push(`${entry.manifestPath}: ${inspectedCount} component(s) inspected`);
+        }
+    }
+    return buildAndroidManifestCheckResult({
+        id: "android-exported-components-audit",
+        category: "android-components",
+        title: "Android exported-component audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings,
+    });
+}