@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/networkSecurity/parseNetworkSecurityConfig.js

@@ -0,0 +1,186 @@
+import { findChildren, parseXmlDocument } from "../../manifest/xml/parseXml.js";
+import { MAX_DOMAIN_CONFIG_DEPTH, } from "./types.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 2 — dependency-free Network Security Config XML parser.
+//
+// Builds on the existing bounded XML tree parser
+// (src/mobile/android/manifest/xml/parseXml.ts) rather than creating a
+// second tokenizer — this file only adds NSC-specific semantic parsing on
+// top of the generic XmlElement tree, per agents.txt Batch 2 section 12.
+//
+// Parses exactly one already-resolved, target-contained file. Never merges
+// multiple files, never evaluates resource overlays, never invokes Gradle/
+// Android SDK/network. Malformed XML or an unsupported root never throws —
+// both map to a structured, non-"parsed" result state.
+// ---------------------------------------------------------------------------
+const MAX_PIN_VALUE_PREVIEW_LENGTH = 128;
+const SUPPORTED_PIN_DIGESTS = new Set(["SHA-256"]);
+function getUnprefixedAttribute(element, localName) {
+    return element.attributes.find((attr) => attr.prefix === undefined && attr.localName === localName)?.value;
+}
+function parseBooleanAttribute(element, localName) {
+    const raw = getUnprefixedAttribute(element, localName);
+    if (raw === undefined)
+        return {};
+    if (raw === "true")
+        return { value: true, raw };
+    if (raw === "false")
+        return { value: false, raw };
+    return { raw };
+}
+function boundedPreview(value, maxLength = MAX_PIN_VALUE_PREVIEW_LENGTH) {
+    const normalized = value.replace(/\s+/g, "").trim();
+    if (normalized.length <= maxLength)
+        return normalized;
+    return `${normalized.slice(0, maxLength)}... [truncated, ${normalized.length} chars total]`;
+}
+function classifyCertificateSource(srcRaw) {
+    if (srcRaw === "system")
+        return { sourceKind: "system" };
+    if (srcRaw === "user")
+        return { sourceKind: "user" };
+    if (srcRaw?.startsWith("@raw/"))
+        return { sourceKind: "raw-resource", rawResourceName: srcRaw.slice("@raw/".length) };
+    return { sourceKind: "unknown" };
+}
+function parseTrustAnchors(element) {
+    const certificates = findChildren(element, "certificates").map((certEl) => {
+        const srcRaw = getUnprefixedAttribute(certEl, "src");
+        const { sourceKind, rawResourceName } = classifyCertificateSource(srcRaw);
+        const overridePinsResult = parseBooleanAttribute(certEl, "overridePins");
+        return {
+            srcRaw,
+            sourceKind,
+            rawResourceName,
+            overridePins: overridePinsResult.value,
+            overridePinsRaw: overridePinsResult.raw,
+            location: certEl.location,
+        };
+    });
+    return { certificates, location: element.location };
+}
+function parsePinEntry(pinEl) {
+    const digestRaw = getUnprefixedAttribute(pinEl, "digest");
+    const digestSupported = digestRaw !== undefined && SUPPORTED_PIN_DIGESTS.has(digestRaw);
+    const rawText = pinEl.textContent.trim();
+    const malformed = rawText.length === 0 || digestRaw === undefined;
+    const malformedReason = rawText.length === 0 ? "Pin element has no text content" : digestRaw === undefined ? "Pin element is missing a digest attribute" : undefined;
+    return {
+        digestRaw,
+        digestSupported,
+        valuePreview: boundedPreview(rawText),
+        malformed,
+        malformedReason,
+        location: pinEl.location,
+    };
+}
+function parsePinSet(element) {
+    const expirationRaw = getUnprefixedAttribute(element, "expiration");
+    // A syntactically valid expiration is YYYY-MM-DD; anything else is
+    // preserved verbatim and flagged malformed rather than guessed at.
+    const expirationMalformed = expirationRaw !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(expirationRaw);
+    const pins = findChildren(element, "pin").map(parsePinEntry);
+    return { expirationRaw, expirationMalformed, pins, location: element.location };
+}
+function normalizeDomainText(raw) {
+    let normalized = raw.trim().toLowerCase();
+    if (normalized.endsWith(".") && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function parseDomainEntry(domainEl) {
+    const includeSubdomainsResult = parseBooleanAttribute(domainEl, "includeSubdomains");
+    const textRaw = domainEl.textContent;
+    const normalized = normalizeDomainText(textRaw);
+    return {
+        textRaw,
+        normalized,
+        includeSubdomains: includeSubdomainsResult.value,
+        includeSubdomainsRaw: includeSubdomainsResult.raw,
+        malformed: normalized.length === 0,
+        location: domainEl.location,
+    };
+}
+const DOMAIN_CONFIG_KNOWN_CHILDREN = new Set(["domain", "trust-anchors", "pin-set", "domain-config"]);
+function parseDomainConfig(element, depth, warnings) {
+    const cleartextResult = parseBooleanAttribute(element, "cleartextTrafficPermitted");
+    const domains = findChildren(element, "domain").map(parseDomainEntry);
+    const trustAnchorsEl = findChildren(element, "trust-anchors")[0];
+    const pinSetEl = findChildren(element, "pin-set")[0];
+    const unsupportedChildren = element.children.filter((child) => !DOMAIN_CONFIG_KNOWN_CHILDREN.has(child.localName)).map((child) => `<${child.tagName}> at line ${child.location.line}`);
+    const nestedElements = findChildren(element, "domain-config");
+    let nestingTruncated = false;
+    let nested = [];
+    if (nestedElements.length > 0) {
+        if (depth >= MAX_DOMAIN_CONFIG_DEPTH) {
+            nestingTruncated = true;
+            warnings.push(`<domain-config> nesting exceeds the bounded depth of ${MAX_DOMAIN_CONFIG_DEPTH} at line ${element.location.line}; deeper nodes were not parsed.`);
+        }
+        else {
+            nested = nestedElements.map((child) => parseDomainConfig(child, depth + 1, warnings));
+        }
+    }
+    return {
+        cleartextTrafficPermitted: cleartextResult.value,
+        cleartextTrafficPermittedRaw: cleartextResult.raw,
+        domains,
+        trustAnchors: trustAnchorsEl ? parseTrustAnchors(trustAnchorsEl) : undefined,
+        pinSet: pinSetEl ? parsePinSet(pinSetEl) : undefined,
+        nested,
+        location: element.location,
+        unsupportedChildren,
+        nestingTruncated,
+    };
+}
+function parseBaseConfig(element) {
+    const cleartextResult = parseBooleanAttribute(element, "cleartextTrafficPermitted");
+    const trustAnchorsEl = findChildren(element, "trust-anchors")[0];
+    const pinSetEl = findChildren(element, "pin-set")[0];
+    return {
+        cleartextTrafficPermitted: cleartextResult.value,
+        cleartextTrafficPermittedRaw: cleartextResult.raw,
+        trustAnchors: trustAnchorsEl ? parseTrustAnchors(trustAnchorsEl) : undefined,
+        pinSet: pinSetEl ? parsePinSet(pinSetEl) : undefined,
+        location: element.location,
+    };
+}
+function parseDebugOverrides(element) {
+    const trustAnchorsEl = findChildren(element, "trust-anchors")[0];
+    return { trustAnchors: trustAnchorsEl ? parseTrustAnchors(trustAnchorsEl) : undefined, location: element.location };
+}
+// Parses Network Security Config XML text. Never throws for ordinary
+// malformed external input — always returns a structured result.
+export function parseNetworkSecurityConfig(xmlText) {
+    const parsed = parseXmlDocument(xmlText);
+    if (!parsed.ok) {
+        return { state: "malformed-xml", reason: parsed.error.message, location: parsed.error.location };
+    }
+    const root = parsed.root;
+    if (root.localName !== "network-security-config") {
+        return { state: "unsupported-root", rootTagName: root.tagName };
+    }
+    const warnings = parsed.warnings.map((w) => `${w.message} (line ${w.location.line})`);
+    const baseConfigEl = findChildren(root, "base-config")[0];
+    if (findChildren(root, "base-config").length > 1) {
+        warnings.push(`Multiple <base-config> elements found; only the first was used.`);
+    }
+    const debugOverridesEl = findChildren(root, "debug-overrides")[0];
+    if (findChildren(root, "debug-overrides").length > 1) {
+        warnings.push(`Multiple <debug-overrides> elements found; only the first was used.`);
+    }
+    const domainConfigEls = findChildren(root, "domain-config");
+    const knownRootChildren = new Set(["base-config", "domain-config", "debug-overrides"]);
+    for (const child of root.children) {
+        if (!knownRootChildren.has(child.localName)) {
+            warnings.push(`Unsupported <${child.tagName}> element at line ${child.location.line} was not parsed.`);
+        }
+    }
+    return {
+        state: "parsed",
+        baseConfig: baseConfigEl ? parseBaseConfig(baseConfigEl) : undefined,
+        domainConfigs: domainConfigEls.map((el) => parseDomainConfig(el, 0, warnings)),
+        debugOverrides: debugOverridesEl ? parseDebugOverrides(debugOverridesEl) : undefined,
+        warnings,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/types.js

@@ -0,0 +1 @@
+export const MAX_DOMAIN_CONFIG_DEPTH = 10;

package/dist/src/mobile/android/advancedSecurity/ordering.js

@@ -0,0 +1,44 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — deterministic ordering for candidate evidence produced by
+// later v0.4.1 detectors. Mirrors the existing localeCompare-by-id pattern
+// already used for finding/module ordering (e.g.
+// src/mobile/android/validate/validateAndroidTarget.ts's
+// `.sort((a, b) => a.id.localeCompare(b.id))`, detect/detectAndroidProject.ts)
+// rather than introducing a different comparator convention.
+//
+// Ordering key precedence: category, then rule id, then module path, then
+// source path, then line, then column, then fingerprint (final tiebreaker —
+// guarantees a total order even for two otherwise-identical locations).
+// Must never depend on filesystem enumeration order or object insertion
+// order.
+// ---------------------------------------------------------------------------
+function compareOptionalNumber(a, b) {
+    if (a === b)
+        return 0;
+    if (a === undefined)
+        return -1;
+    if (b === undefined)
+        return 1;
+    return a - b;
+}
+function compareOptionalString(a, b) {
+    if (a === b)
+        return 0;
+    if (a === undefined)
+        return -1;
+    if (b === undefined)
+        return 1;
+    return a.localeCompare(b);
+}
+export function compareCandidateEvidence(a, b) {
+    return (a.category.localeCompare(b.category) ||
+        a.ruleId.localeCompare(b.ruleId) ||
+        compareOptionalString(a.modulePath, b.modulePath) ||
+        a.location.path.localeCompare(b.location.path) ||
+        compareOptionalNumber(a.location.line, b.location.line) ||
+        compareOptionalNumber(a.location.column, b.location.column) ||
+        a.fingerprint.localeCompare(b.fingerprint));
+}
+export function sortCandidateEvidence(evidence) {
+    return [...evidence].sort(compareCandidateEvidence);
+}

package/dist/src/mobile/android/advancedSecurity/redaction.js

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import { stripUnsafeControlChars } from "../../../securityValidation/attackScenarios/exploitEvidence.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — redaction and fingerprint primitives for later Android
+// secret/signing/configuration candidate evidence.
+//
+// Reuses stripUnsafeControlChars from the existing exploit-evidence redaction
+// owner (src/securityValidation/attackScenarios/exploitEvidence.ts) rather
+// than re-implementing control-character stripping. That module's
+// redactPreview() fully masks any secret-*looking* substring behind a
+// "[REDACTED:Nchars]" marker with no prefix/suffix, which is the right
+// behavior for exploit-scenario evidence (never show any of a real exploit
+// payload). Android candidate evidence has a different, narrower need: a
+// human reviewing a static-candidate finding benefits from a short prefix/
+// suffix so they can recognize *which* secret in their own source it is
+// without the full value ever being reconstructable — so this module adds
+// that prefix/suffix-preserving preview and a non-reversible fingerprint on
+// top of the shared control-character stripping, instead of creating a
+// second, competing full-redaction implementation.
+// ---------------------------------------------------------------------------
+const DEFAULT_MAX_PREVIEW_LENGTH = 64;
+const DEFAULT_EDGE_LENGTH = 3;
+const MASK = "***";
+// Distinguishes "no input was available to redact" (e.g. a value could not
+// be read) from "the input was an empty string literal" — callers must not
+// conflate the two.
+export function redactedPreviewForCandidate(input, options = {}) {
+    if (input === undefined)
+        return "[unavailable]";
+    if (input.length === 0)
+        return "[empty]";
+    const maxLength = options.maxLength ?? DEFAULT_MAX_PREVIEW_LENGTH;
+    const edgeLength = options.edgeLength ?? DEFAULT_EDGE_LENGTH;
+    const normalized = stripUnsafeControlChars(input).replace(/\r\n|\r|\n/g, "\\n");
+    const bounded = normalized.length > maxLength ? `${normalized.slice(0, maxLength)}...` : normalized;
+    // Too short to safely show both a prefix and a suffix without
+    // reconstructing most or all of the value — mask it entirely instead.
+    if (bounded.length <= edgeLength * 2) {
+        return MASK;
+    }
+    const prefix = bounded.slice(0, edgeLength);
+    const suffix = bounded.slice(-edgeLength);
+    return `${prefix}${MASK}${suffix}`;
+}
+// Stable, non-reversible fingerprint for deduplication. Uses Node's built-in
+// sha256 (no new dependency). Distinct from redactedPreviewForCandidate: the
+// fingerprint is stored for dedup, the preview is stored for human review —
+// neither one can be used to recover the raw value.
+export function fingerprintCandidateValue(input) {
+    if (input === undefined)
+        return "unavailable";
+    const hash = createHash("sha256").update(input, "utf8").digest("hex");
+    return `sha256:${hash}`;
+}

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/analyzeReleaseConfiguration.js

@@ -0,0 +1,221 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractManifestReleaseEvidence } from "./manifestEvidence.js";
+const RELEASE_BUILD_TYPE_NAME = "release";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+// Exact-name match only (agents.txt Batch 3 section 9.11) — no guessing by
+// substring, no flavor/variant evaluation. All matches are preserved (a
+// module could in principle declare more than one via extraction quirks);
+// ambiguity is never resolved arbitrarily.
+function findReleaseLikeBuildTypes(gradleModule) {
+    return (gradleModule?.buildTypeDetails ?? []).filter((buildType) => buildType.name === RELEASE_BUILD_TYPE_NAME);
+}
+export function analyzeApplicationReleaseConfiguration(targetRoot, entry, gradleModules) {
+    const manifestEvidence = extractManifestReleaseEvidence(entry);
+    const candidates = [];
+    const findings = [];
+    const evidenceText = [];
+    const modulePath = entry.modulePath;
+    const manifestAbsolutePath = path.join(targetRoot, entry.manifestPath);
+    const gradleModule = gradleModules.find((m) => m.path === modulePath);
+    // Only suppressed (downgraded to candidate) when a module is confidently
+    // library-only — an ambiguous/unknown module type is still treated as an
+    // application for conservative reporting purposes.
+    const isLibraryOnlyModule = gradleModule?.isLibrary === true && gradleModule?.isApplication !== true;
+    // --- manifest debuggable ---
+    if (manifestEvidence.debuggable.state === "explicit-true") {
+        if (isLibraryOnlyModule) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-release-debuggable",
+                category: "android-release-configuration",
+                confidence: "low",
+                modulePath,
+                location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+                summary: 'android:debuggable="true" declared in a library module manifest (not an installable application)',
+                rawValue: manifestEvidence.debuggable.raw,
+                resolutionState: "not-applicable",
+            }));
+        }
+        else {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-release-debuggable",
+                title: 'Manifest explicitly enables debuggable (android:debuggable="true")',
+                severity: "major",
+                confidence: "high",
+                description: 'The manifest\'s <application> element sets android:debuggable="true". This is high-confidence static evidence of a risky configuration if shipped in a release build; it does not prove the published/installed APK is actually debuggable — Gradle build-type configuration and manifest merging are not evaluated here.',
+                manifestPath: entry.manifestPath,
+                location: manifestEvidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute"],
+                recommendation: 'Set android:debuggable="false" (or omit it) for release builds; confirm no debug manifest overlay reaches production.',
+            }));
+        }
+    }
+    else if (manifestEvidence.debuggable.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-debuggable",
+            category: "android-release-configuration",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "android:debuggable has an unresolved or malformed value",
+            rawValue: manifestEvidence.debuggable.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (manifestEvidence.debuggable.state === "explicit-false") {
+        evidenceText.push(`${entry.manifestPath}: manifest debuggable is explicitly false (safe)`);
+    }
+    // --- manifest testOnly ---
+    if (manifestEvidence.testOnly.state === "explicit-true") {
+        if (isLibraryOnlyModule) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-release-test-only",
+                category: "android-release-configuration",
+                confidence: "low",
+                modulePath,
+                location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+                summary: 'android:testOnly="true" declared in a library module manifest',
+                rawValue: manifestEvidence.testOnly.raw,
+                resolutionState: "not-applicable",
+            }));
+        }
+        else {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-release-test-only",
+                title: 'Manifest explicitly marks the application test-only (android:testOnly="true")',
+                severity: "major",
+                confidence: "high",
+                description: 'The manifest\'s <application> element sets android:testOnly="true", which the platform install mechanism (and Play Store) treats as release-blocking. This does not prove the package was ever installed or published.',
+                manifestPath: entry.manifestPath,
+                location: manifestEvidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute"],
+                recommendation: 'Remove android:testOnly="true" before release; confirm no test/debug manifest overlay reaches production.',
+            }));
+        }
+    }
+    else if (manifestEvidence.testOnly.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-test-only",
+            category: "android-release-configuration",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "android:testOnly has an unresolved or malformed value",
+            rawValue: manifestEvidence.testOnly.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    // --- Gradle release build-type ---
+    const releaseBuildTypes = findReleaseLikeBuildTypes(gradleModule);
+    const buildFileRelativePath = gradleModule?.buildFilePath;
+    const buildFileAbsolutePath = buildFileRelativePath !== undefined ? path.join(targetRoot, buildFileRelativePath) : undefined;
+    const fallbackLocation = buildFileAbsolutePath !== undefined ? loc(targetRoot, buildFileAbsolutePath) : loc(targetRoot, manifestAbsolutePath);
+    if (releaseBuildTypes.length === 0) {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-build-type-configuration",
+            category: "android-release-configuration",
+            confidence: "low",
+            modulePath,
+            location: fallbackLocation,
+            summary: `No "release" build type was statically found for module ${modulePath ?? "(unknown)"}`,
+            rawValue: undefined,
+            resolutionState: "missing",
+            staticAnalysisLimitations: [
+                "A missing release build type is not automatically a vulnerability; Gradle default build types, convention plugins, and variant configuration are not evaluated.",
+            ],
+        }));
+    }
+    let gradleReleaseDebuggableTrue = false;
+    let gradleReleaseDebuggableFalse = false;
+    for (const buildType of releaseBuildTypes) {
+        if (buildType.debuggableState === "literal-true") {
+            gradleReleaseDebuggableTrue = true;
+            if (!isLibraryOnlyModule) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-release-debuggable",
+                    title: `Release build type "${buildType.name}" sets debuggable=true`,
+                    severity: "major",
+                    confidence: "high",
+                    description: `The Gradle release build type "${buildType.name}" sets a literal debuggable=true. This is high-confidence static evidence; it does not prove a built APK is actually debuggable — build-type/flavor/variant selection and Gradle conventions are not evaluated.`,
+                    manifestPath: buildFileRelativePath ?? entry.manifestPath,
+                    identity: buildType.name,
+                    evidenceDetails: [`buildType=${buildType.name}`, "source=gradle-literal"],
+                    recommendation: "Set debuggable=false (or remove the override) for the release build type.",
+                }));
+            }
+            else {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-release-debuggable",
+                    category: "android-release-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location: fallbackLocation,
+                    summary: `Library module's "${buildType.name}" build type sets debuggable=true (not an installable application)`,
+                    rawValue: buildType.debuggableRaw,
+                    resolutionState: "not-applicable",
+                }));
+            }
+        }
+        else if (buildType.debuggableState === "literal-false") {
+            gradleReleaseDebuggableFalse = true;
+            evidenceText.push(`${modulePath ?? "(unknown module)"}: release build type "${buildType.name}" debuggable is explicitly false (safe)`);
+        }
+        else if (buildType.debuggableState === "dynamic") {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-release-debuggable",
+                category: "android-release-configuration",
+                confidence: "medium",
+                modulePath,
+                location: fallbackLocation,
+                summary: `Release build type "${buildType.name}" debuggable value is a dynamic/unresolved expression`,
+                rawValue: buildType.debuggableRaw,
+                resolutionState: "unresolved",
+            }));
+        }
+        // Minification/resource-shrinking/signingConfig — release-hardening
+        // metadata only, never a finding (agents.txt Batch 3 sections 9.13/9.16).
+        evidenceText.push(`${modulePath ?? "(unknown module)"}: release build type "${buildType.name}" minifyEnabled=${buildType.minifyEnabledState}, shrinkResources=${buildType.shrinkResourcesState}`);
+        if (buildType.signingConfigRef !== undefined) {
+            evidenceText.push(`${modulePath ?? "(unknown module)"}: release build type "${buildType.name}" signingConfig=${buildType.signingConfigRef}`);
+        }
+    }
+    // --- manifest/Gradle correlation (never invents a build-time winner) ---
+    if (manifestEvidence.debuggable.state === "explicit-true" && gradleReleaseDebuggableTrue) {
+        evidenceText.push(`${entry.manifestPath}: manifest debuggable=true aligns with release build type debuggable=true (aligned risky evidence)`);
+    }
+    else if (manifestEvidence.debuggable.state === "explicit-true" && gradleReleaseDebuggableFalse) {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-debuggable",
+            category: "android-release-configuration",
+            confidence: "medium",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "Manifest debuggable=true conflicts with the release build type's literal debuggable=false",
+            rawValue: manifestEvidence.debuggable.raw,
+            resolutionState: "resolved",
+            staticAnalysisLimitations: [
+                "Precedence between the manifest attribute and Gradle build-type configuration was not evaluated; this is conflicting static evidence, not a confirmed build-time value.",
+            ],
+        }));
+    }
+    else if (manifestEvidence.debuggable.state === "explicit-false" && gradleReleaseDebuggableTrue) {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-release-debuggable",
+            category: "android-release-configuration",
+            confidence: "medium",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, manifestEvidence.applicationLocation),
+            summary: "Manifest debuggable=false conflicts with the release build type's literal debuggable=true",
+            rawValue: manifestEvidence.debuggable.raw,
+            resolutionState: "resolved",
+            staticAnalysisLimitations: [
+                "Precedence between the manifest attribute and Gradle build-type configuration was not evaluated; this is conflicting static evidence, not a confirmed build-time value.",
+            ],
+        }));
+    }
+    return { manifestEvidence, candidates, findings, evidenceText };
+}

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/checkResult.js

@@ -0,0 +1,39 @@
+import { buildAndroidManifestCheckResult } from "../../audit/checkResultBuilder.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeApplicationReleaseConfiguration } from "./analyzeReleaseConfiguration.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — standalone Android debuggable/testOnly/release build-type
+// check result. Mirrors Batch 2/Batch 3-backup's checkResult.ts convention.
+// Standalone: not called from validateAndroidTarget / any active
+// orchestration, not rendered in reports, no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_RELEASE_CONFIGURATION_AUDIT_CHECK_ID = "android-release-configuration-audit";
+export function auditAndroidReleaseConfiguration(targetRoot, detection, manifests, gradleModules) {
+    const findings = [];
+    const candidateEvidence = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const result = analyzeApplicationReleaseConfiguration(targetRoot, entry, gradleModules);
+        findings.push(...result.findings);
+        candidateEvidence.push(...result.candidates);
+        evidence.push(`${entry.manifestPath}: debuggable=${result.manifestEvidence.debuggable.state}, testOnly=${result.manifestEvidence.testOnly.state}`, ...result.evidenceText);
+    }
+    const base = buildAndroidManifestCheckResult({
+        id: ANDROID_RELEASE_CONFIGURATION_AUDIT_CHECK_ID,
+        category: "android-release-configuration",
+        title: "Android debuggable, testOnly, and release build-type configuration audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not evaluate Gradle variant/flavor selection, manifest merging, or whether a published APK is actually debuggable.",
+        ],
+    });
+    return {
+        ...base,
+        candidateEvidence: sortCandidateEvidence(candidateEvidence),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/index.js

@@ -0,0 +1,7 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — public exports for the standalone Android debuggable/
+// testOnly/release build-type audit.
+// ---------------------------------------------------------------------------
+export { extractManifestReleaseEvidence } from "./manifestEvidence.js";
+export { analyzeApplicationReleaseConfiguration } from "./analyzeReleaseConfiguration.js";
+export { auditAndroidReleaseConfiguration, ANDROID_RELEASE_CONFIGURATION_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/releaseConfiguration/manifestEvidence.js

@@ -0,0 +1,19 @@
+function classifyBooleanAttribute(value, raw) {
+    if (value === true)
+        return { state: "explicit-true", raw: raw ?? "true" };
+    if (value === false)
+        return { state: "explicit-false", raw: raw ?? "false" };
+    if (raw !== undefined)
+        return { state: "malformed", raw };
+    return { state: "missing" };
+}
+export function extractManifestReleaseEvidence(entry) {
+    const app = entry.manifest.application;
+    return {
+        manifestPath: entry.manifestPath,
+        modulePath: entry.modulePath,
+        applicationLocation: app.location,
+        debuggable: classifyBooleanAttribute(app.debuggable, app.debuggableRaw),
+        testOnly: classifyBooleanAttribute(app.testOnly, app.testOnlyRaw),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/resourceReference.js

@@ -0,0 +1,69 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — Android resource-reference parsing (`@xml/...` and
+// similar). This is genuinely new: no resource-reference resolution exists
+// anywhere in the codebase yet (the manifest parser stores refs like
+// `application.networkSecurityConfigRef` verbatim, by design — see
+// src/mobile/android/manifest/types.ts's comment). This module only parses
+// the reference string into a structured shape; resourceResolution.ts
+// resolves it against the filesystem.
+// ---------------------------------------------------------------------------
+export const SUPPORTED_ANDROID_RESOURCE_TYPES = ["xml"];
+const RESOURCE_NAME_PATTERN = /^[a-z0-9_]+$/;
+// Parses a raw manifest/resource attribute value such as `@xml/network_security_config`.
+// Never throws — every input maps to a structured state.
+export function parseAndroidResourceReference(raw) {
+    if (raw.length === 0) {
+        return { state: "empty", raw };
+    }
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return { state: "malformed", raw, reason: "Reference is whitespace-only" };
+    }
+    // A `@string/app_name`-style placeholder that itself resolves to another
+    // resource is out of scope for this parser (only concrete @xml/... value
+    // references are supported); an unresolved build-variable placeholder such
+    // as `${networkSecurityConfig}` is reported distinctly.
+    if (/^\$\{.*\}$/.test(trimmed)) {
+        return { state: "placeholder", raw };
+    }
+    if (!trimmed.startsWith("@")) {
+        return { state: "malformed", raw, reason: "Reference does not start with \"@\"" };
+    }
+    const body = trimmed.slice(1);
+    if (body.length === 0) {
+        return { state: "malformed", raw, reason: "Reference has no content after \"@\"" };
+    }
+    // Package-qualified external reference: @com.example.lib:xml/name
+    const colonIndex = body.indexOf(":");
+    let packageQualifier;
+    let rest = body;
+    if (colonIndex !== -1) {
+        packageQualifier = body.slice(0, colonIndex);
+        rest = body.slice(colonIndex + 1);
+        if (packageQualifier.length === 0) {
+            return { state: "malformed", raw, reason: "Empty package qualifier before \":\"" };
+        }
+    }
+    const slashIndex = rest.indexOf("/");
+    if (slashIndex === -1) {
+        return { state: "malformed", raw, reason: "Reference is missing a \"/\" between resource type and name" };
+    }
+    const type = rest.slice(0, slashIndex);
+    const name = rest.slice(slashIndex + 1);
+    if (type.length === 0) {
+        return { state: "malformed", raw, reason: "Reference is missing a resource type" };
+    }
+    if (name.length === 0) {
+        return { state: "malformed", raw, reason: "Reference is missing a resource name" };
+    }
+    if (!RESOURCE_NAME_PATTERN.test(name)) {
+        return { state: "malformed", raw, reason: `Resource name "${name}" is not a valid Android resource identifier` };
+    }
+    if (packageQualifier !== undefined) {
+        return { state: "package-qualified", raw, packageQualifier, type, name };
+    }
+    if (!SUPPORTED_ANDROID_RESOURCE_TYPES.includes(type)) {
+        return { state: "unsupported-type", raw, type, name };
+    }
+    return { state: "parsed", raw, type: type, name };
+}