@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/resourceResolution.js

@@ -0,0 +1,118 @@
+import fs from "node:fs";
+import path from "node:path";
+import { relativeWithinRoot, resolveWithinRoot } from "../../../core/pathSafety.js";
+import { parseAndroidResourceReference } from "./resourceReference.js";
+const DEFAULT_SOURCE_SETS = ["main", "debug", "release"];
+// Returns true only when `candidatePath` both lexically resolves within root
+// (resolveWithinRoot) AND, if it is or passes through a symlink, its real
+// path also resolves within root. Never throws — a filesystem error (e.g.
+// broken symlink) is treated as "does not safely resolve".
+function isSafelyContainedExistingFile(root, candidatePath) {
+    try {
+        resolveWithinRoot(root, candidatePath);
+    }
+    catch {
+        return false;
+    }
+    let stat;
+    try {
+        stat = fs.lstatSync(candidatePath);
+    }
+    catch {
+        return false;
+    }
+    if (!stat.isFile() && !stat.isSymbolicLink()) {
+        return false;
+    }
+    if (stat.isSymbolicLink()) {
+        let realPath;
+        try {
+            realPath = fs.realpathSync(candidatePath);
+        }
+        catch {
+            return false;
+        }
+        try {
+            resolveWithinRoot(root, realPath);
+        }
+        catch {
+            return false;
+        }
+        try {
+            if (!fs.statSync(realPath).isFile())
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+function listCandidateSourceSets(root, modulePath) {
+    const srcDir = path.join(modulePath, "src");
+    let entries;
+    try {
+        entries = fs.readdirSync(srcDir);
+    }
+    catch {
+        return [...DEFAULT_SOURCE_SETS];
+    }
+    const discovered = new Set(DEFAULT_SOURCE_SETS);
+    for (const entry of entries) {
+        const entryPath = path.join(srcDir, entry);
+        try {
+            resolveWithinRoot(root, entryPath);
+        }
+        catch {
+            continue;
+        }
+        let stat;
+        try {
+            stat = fs.lstatSync(entryPath);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isDirectory() || stat.isSymbolicLink()) {
+            discovered.add(entry);
+        }
+    }
+    // Deterministic order: independent of readdirSync's filesystem-dependent
+    // enumeration order.
+    return [...discovered].sort((a, b) => a.localeCompare(b));
+}
+export function resolveAndroidXmlResourceReference(root, modulePath, rawReference) {
+    const parsed = parseAndroidResourceReference(rawReference);
+    if (parsed.state === "malformed" || parsed.state === "empty" || parsed.state === "placeholder") {
+        return {
+            state: "malformed-reference",
+            reference: rawReference,
+            modulePath: relativeWithinRoot(root, modulePath),
+            reason: parsed.state === "malformed" ? parsed.reason : `Reference is ${parsed.state}, not a concrete resource value`,
+        };
+    }
+    if (parsed.state === "unsupported-type" || parsed.state === "package-qualified") {
+        return {
+            state: "unsupported-reference",
+            reference: rawReference,
+            modulePath: relativeWithinRoot(root, modulePath),
+            parsed,
+        };
+    }
+    const sourceSets = listCandidateSourceSets(root, modulePath);
+    const candidates = [];
+    for (const sourceSet of sourceSets) {
+        const candidatePath = path.join(modulePath, "src", sourceSet, "res", parsed.type, `${parsed.name}.xml`);
+        if (isSafelyContainedExistingFile(root, candidatePath)) {
+            candidates.push({ sourceSet, relativePath: relativeWithinRoot(root, candidatePath) });
+        }
+    }
+    const relativeModulePath = relativeWithinRoot(root, modulePath);
+    if (candidates.length === 0) {
+        return { state: "missing", reference: rawReference, modulePath: relativeModulePath, searchedSourceSets: sourceSets };
+    }
+    if (candidates.length === 1) {
+        return { state: "resolved", reference: rawReference, modulePath: relativeModulePath, candidates: [candidates[0]] };
+    }
+    return { state: "ambiguous", reference: rawReference, modulePath: relativeModulePath, candidates };
+}

package/dist/src/mobile/android/advancedSecurity/ruleIds.js

@@ -0,0 +1,141 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — stable rule identifiers for the advanced Android security
+// checks planned for later v0.4.1 batches.
+//
+// This file defines identifiers only. No detector, finding, or check runs
+// because a rule id exists here — later batches implement the check logic
+// and reference these ids. Follows the existing per-audit-file "android-"
+// prefixed string-literal convention (see src/mobile/android/audit/*.ts:
+// android-permission-*, android-component-*, android-deep-link-*,
+// android-intent-filter-*) rather than inventing a second id scheme.
+// ---------------------------------------------------------------------------
+export const ANDROID_NETWORK_SECURITY_RULE_IDS = [
+    "android-network-cleartext-traffic",
+    "android-network-security-config",
+    "android-network-user-added-trust-anchor",
+    "android-network-debug-trust-override",
+    "android-network-broad-domain-config",
+    "android-network-pinning-metadata",
+    "android-network-pinning-unresolved",
+];
+export const ANDROID_BACKUP_RELEASE_RULE_IDS = [
+    "android-backup-allow-backup",
+    "android-backup-full-backup-content",
+    "android-backup-data-extraction-rules",
+    "android-release-debuggable",
+    "android-release-test-only",
+    "android-release-build-type-configuration",
+];
+export const ANDROID_SECRETS_SIGNING_RULE_IDS = [
+    "android-secret-hardcoded-candidate",
+    "android-secret-private-key-candidate",
+    "android-secret-token-password-candidate",
+    "android-signing-password-literal",
+    "android-signing-keystore-candidate",
+    "android-signing-path-leakage",
+    "android-signing-debug-in-release",
+];
+export const ANDROID_WEBVIEW_RULE_IDS = [
+    "android-webview-javascript-enabled",
+    "android-webview-javascript-interface-exposure",
+    "android-webview-file-content-access",
+    "android-webview-universal-file-url-access",
+    "android-webview-mixed-content",
+    "android-webview-ssl-error-proceed",
+    "android-webview-debugging-enabled",
+    "android-webview-suspicious-url-loading",
+];
+export const ANDROID_FILE_PROVIDER_RULE_IDS = [
+    "android-file-provider-exported",
+    "android-file-provider-missing-protection",
+    "android-file-provider-broad-paths",
+    "android-file-provider-missing-paths-xml",
+    "android-file-provider-malformed-paths-xml",
+    "android-file-provider-unresolved-reference",
+];
+export const ANDROID_SENSITIVE_DATA_RULE_IDS = [
+    "android-sensitive-external-storage",
+    "android-sensitive-preferences",
+    "android-sensitive-unsafe-file-database-storage",
+    "android-sensitive-logging",
+    "android-sensitive-clipboard-write",
+    "android-sensitive-clipboard-read-review",
+];
+export const ANDROID_FIREBASE_GOOGLE_RULE_IDS = [
+    "android-firebase-realtime-database-permissive-rules",
+    "android-firebase-firestore-permissive-rules",
+    "android-firebase-storage-permissive-rules",
+    "android-firebase-missing-local-rules",
+    "android-firebase-google-configuration-evidence",
+];
+export const ANDROID_OPTIONAL_TOOL_RULE_IDS = [
+    "android-optional-tool-semgrep-evidence",
+    "android-optional-tool-osv-evidence",
+    "android-optional-tool-lint-evidence",
+    "android-optional-tool-dependency-check-evidence",
+];
+// All planned v0.4.1 advanced Android rule ids in one deterministic,
+// duplicate-free list. Uniqueness across every family is verified by a
+// regression test (ANDROID-V041-B1-01) rather than assumed.
+export const ANDROID_ADVANCED_RULE_IDS = [
+    ...ANDROID_NETWORK_SECURITY_RULE_IDS,
+    ...ANDROID_BACKUP_RELEASE_RULE_IDS,
+    ...ANDROID_SECRETS_SIGNING_RULE_IDS,
+    ...ANDROID_WEBVIEW_RULE_IDS,
+    ...ANDROID_FILE_PROVIDER_RULE_IDS,
+    ...ANDROID_SENSITIVE_DATA_RULE_IDS,
+    ...ANDROID_FIREBASE_GOOGLE_RULE_IDS,
+    ...ANDROID_OPTIONAL_TOOL_RULE_IDS,
+];
+// New v0.4.1 check categories, additive to ANDROID_CHECK_CATEGORIES in
+// src/mobile/android/validation/checkResult.ts. Kept here (rather than only
+// inline in that file) so rule ids and their owning category live next to
+// each other; checkResult.ts re-exports/spreads this list additively.
+export const ANDROID_ADVANCED_CHECK_CATEGORIES = [
+    "android-network-security",
+    "android-backup-configuration",
+    "android-release-configuration",
+    "android-secret-candidates",
+    "android-signing-configuration",
+    "android-webview",
+    "android-file-provider",
+    "android-sensitive-storage",
+    "android-sensitive-logging",
+    "android-clipboard",
+    "android-firebase-google-services",
+    "android-semgrep",
+    "android-osv",
+    "android-lint",
+    "android-dependency-check",
+];
+const RULE_ID_TO_CATEGORY = new Map([
+    ...ANDROID_NETWORK_SECURITY_RULE_IDS.map((id) => [id, "android-network-security"]),
+    ...ANDROID_BACKUP_RELEASE_RULE_IDS.map((id) => [id, id.startsWith("android-backup-") ? "android-backup-configuration" : "android-release-configuration"]),
+    ...ANDROID_SECRETS_SIGNING_RULE_IDS.map((id) => [id, id.startsWith("android-secret-") ? "android-secret-candidates" : "android-signing-configuration"]),
+    ...ANDROID_WEBVIEW_RULE_IDS.map((id) => [id, "android-webview"]),
+    ...ANDROID_FILE_PROVIDER_RULE_IDS.map((id) => [id, "android-file-provider"]),
+    ...ANDROID_SENSITIVE_DATA_RULE_IDS.map((id) => {
+        if (id === "android-sensitive-logging")
+            return [id, "android-sensitive-logging"];
+        if (id.startsWith("android-sensitive-clipboard"))
+            return [id, "android-clipboard"];
+        return [id, "android-sensitive-storage"];
+    }),
+    ...ANDROID_FIREBASE_GOOGLE_RULE_IDS.map((id) => [id, "android-firebase-google-services"]),
+    ...ANDROID_OPTIONAL_TOOL_RULE_IDS.map((id) => {
+        if (id === "android-optional-tool-semgrep-evidence")
+            return [id, "android-semgrep"];
+        if (id === "android-optional-tool-osv-evidence")
+            return [id, "android-osv"];
+        if (id === "android-optional-tool-lint-evidence")
+            return [id, "android-lint"];
+        return [id, "android-dependency-check"];
+    }),
+]);
+export function categoryForAdvancedRuleId(ruleId) {
+    const category = RULE_ID_TO_CATEGORY.get(ruleId);
+    if (category === undefined) {
+        throw new Error(`No category registered for advanced Android rule id: ${ruleId}`);
+    }
+    return category;
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/analyzeSecretCandidates.js

@@ -0,0 +1,116 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { fingerprintCandidateValue, redactedPreviewForCandidate } from "../redaction.js";
+import { matchPrivateKeyBlocks, matchSensitiveAssignments } from "./matchSecretCandidates.js";
+import { isReferenceSyntax, shouldSuppressEntirely } from "./suppressValue.js";
+function fileKindFor(relativePath) {
+    const lower = relativePath.toLowerCase();
+    if (lower.endsWith(".kt") || lower.endsWith(".kts") || lower.endsWith(".java") || lower.endsWith(".gradle") || lower.endsWith(".gradle.kts")) {
+        return "code";
+    }
+    if (lower.endsWith(".properties") || lower.endsWith(".yaml") || lower.endsWith(".yml") || lower.endsWith(".toml")) {
+        return "config-unquoted";
+    }
+    // .xml/.json use quoted-form matching (JSON always quotes; XML attribute
+    // values are quoted by construction).
+    return "config-quotable";
+}
+function classifyIdentifier(identifier) {
+    const normalized = identifier.toLowerCase().replace(/[-_]/g, "");
+    if (["storepassword", "keypassword", "signingpassword"].includes(normalized)) {
+        return { ruleId: "android-signing-password-literal", sensitiveDataCategory: "signing-password" };
+    }
+    if (["databasepassword", "dbpassword"].includes(normalized)) {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "database-credential" };
+    }
+    if (["password", "passwd", "pwd"].includes(normalized)) {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "password" };
+    }
+    if (normalized === "clientsecret") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "oauth-client-secret" };
+    }
+    if (normalized === "accesstoken") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "access-token" };
+    }
+    if (normalized === "bearertoken") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "bearer-token" };
+    }
+    if (normalized === "authtoken") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "access-token" };
+    }
+    if (normalized === "apisecret") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "cloud-secret-key" };
+    }
+    // Bare "secret" and any other sensitive-pattern match not covered above.
+    return { ruleId: "android-secret-hardcoded-candidate", sensitiveDataCategory: "unknown-sensitive-value" };
+}
+export function analyzeSecretCandidateFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const fileKind = fileKindFor(file.relativePath);
+    for (const block of matchPrivateKeyBlocks(file.content)) {
+        const location = buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: block.line });
+        const fingerprint = fingerprintCandidateValue(block.rawBlock);
+        if (!block.terminated) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-secret-private-key-candidate",
+                category: "android-secret-candidates",
+                confidence: "medium",
+                modulePath: file.modulePath,
+                location,
+                summary: `Unterminated ${block.headerLabel} block found; treated conservatively`,
+                rawValue: block.rawBlock,
+                resolutionState: "malformed",
+                staticAnalysisLimitations: ["Block was not terminated by a matching END marker within the bounded scan window; content was not validated as a real key."],
+            }));
+            continue;
+        }
+        findings.push(makeAndroidFinding({
+            ruleId: "android-secret-private-key-candidate",
+            title: `Private key material found (${block.headerLabel})`,
+            severity: "major",
+            confidence: "high",
+            description: `A ${block.headerLabel} block was found in target-contained text. This is high-confidence structural evidence of committed private key material; the key was not opened, parsed, or validated.`,
+            manifestPath: file.relativePath,
+            identity: fingerprint,
+            location: { line: block.line },
+            evidenceDetails: [`redactedPreview=${redactedPreviewForCandidate(block.rawBlock, { maxLength: 40 })}`],
+            recommendation: "Remove the private key from source control immediately and rotate the corresponding credential/certificate.",
+        }));
+    }
+    for (const match of matchSensitiveAssignments(file.content, fileKind)) {
+        if (shouldSuppressEntirely(match.rawValue))
+            continue;
+        const location = buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: match.line });
+        const classification = classifyIdentifier(match.identifier);
+        if (isReferenceSyntax(match.rawValue)) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: classification.ruleId,
+                category: classification.ruleId === "android-signing-password-literal" ? "android-signing-configuration" : "android-secret-candidates",
+                confidence: "low",
+                modulePath: file.modulePath,
+                location,
+                summary: `"${match.identifier}" is assigned an environment/property/placeholder reference, not a literal value`,
+                rawValue: match.rawValue,
+                resolutionState: "not-applicable",
+                staticAnalysisLimitations: ["Reference syntax was detected; the resolved value was not evaluated and is not treated as a hardcoded credential."],
+            }));
+            continue;
+        }
+        const fingerprint = fingerprintCandidateValue(match.rawValue);
+        findings.push(makeAndroidFinding({
+            ruleId: classification.ruleId,
+            title: `Hardcoded ${match.identifier} literal found`,
+            severity: "major",
+            confidence: "high",
+            description: `The identifier "${match.identifier}" is assigned a literal, non-placeholder value. This is high-confidence static evidence of a hardcoded credential; it is not proof the credential is currently valid or in active use.`,
+            manifestPath: file.relativePath,
+            identity: fingerprint,
+            location: { line: match.line },
+            evidenceDetails: [`identifier=${match.identifier}`, `redactedPreview=${redactedPreviewForCandidate(match.rawValue)}`],
+            recommendation: "Remove the hardcoded credential, rotate it, and load it from a secure secrets mechanism instead.",
+        }));
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/checkResult.js

@@ -0,0 +1,80 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "./discoverSecretSourceFiles.js";
+import { analyzeSecretCandidateFile } from "./analyzeSecretCandidates.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — standalone Android secret-candidate check result.
+//
+// Operates over discovered files rather than parsed manifests, so it cannot
+// reuse buildAndroidManifestCheckResult (Batch 3's manifest-audit builder) —
+// this is a distinct, still-conservative status-decision policy: never-run
+// for a non-Android target, "failed" only when a reportable (non-
+// informational) finding exists, otherwise "passed". Standalone: not called
+// from validateAndroidTarget / any active orchestration, not rendered in
+// reports, no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID = "android-secret-candidates-audit";
+export function auditAndroidSecretCandidates(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID,
+            category: "android-secret-candidates",
+            title: "Android hardcoded secret-candidate audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of files) {
+        const result = analyzeSecretCandidateFile(targetRoot, file);
+        for (const finding of result.findings)
+            findingsById.set(finding.id, finding);
+        for (const candidate of result.candidates)
+            candidatesById.set(candidate.id, candidate);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const evidence = [`${files.length} file(s) scanned across ${new Set(files.map((f) => f.modulePath ?? "(root)")).size} module scope(s)`];
+    const warnings = skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID,
+        category: "android-secret-candidates",
+        title: "Android hardcoded secret-candidate audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not validate credentials, contact external services, or scan Git history.",
+        ],
+        errors: [],
+        sourcePaths: files.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/discoverSecretSourceFiles.js

@@ -0,0 +1,152 @@
+import fs from "node:fs";
+import { collectFilesForGlobs } from "../../../../core/fileGlobs.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — bounded, deterministic file discovery for the secret-
+// candidate scanner.
+//
+// Reuses the existing target-contained glob collector
+// (src/core/fileGlobs.ts's collectFilesForGlobs, which itself uses
+// src/core/pathSafety.ts for containment) for traversal — no second
+// traversal engine. Adds narrow, documented bounds (size cap, binary
+// detection) co-located here because no existing shared utility exposes
+// structured skip evidence (the closest existing owner,
+// src/securityValidation/attackScenarios/boundedSourceScan.ts, silently
+// drops oversized/unreadable/binary files with no skip record, and is owned
+// by an unrelated security-validation feature, not Android).
+// ---------------------------------------------------------------------------
+// Extension-based recursive globs plus explicit root-level literals — the
+// existing glob matcher's "**/*.ext" form requires at least one path
+// separator, so genuinely root-level files (e.g. local.properties sitting
+// directly in the target root) need an explicit literal entry too.
+export const SECRET_SCAN_GLOBS = [
+    "**/*.kt",
+    "**/*.kts",
+    "**/*.java",
+    "**/*.xml",
+    "**/*.gradle",
+    "**/*.gradle.kts",
+    "**/*.properties",
+    "**/*.json",
+    "**/*.yaml",
+    "**/*.yml",
+    "**/*.toml",
+    "gradle.properties",
+    "local.properties",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+];
+// Path segments excluded beyond src/core/fileGlobs.ts's own directory
+// exclusions (node_modules/dist/build/coverage/.git/lab-output/.my-dev-kit),
+// matching the wider Android-appropriate set already used by
+// src/mobile/android/detect/traversal.ts.
+const EXCLUDED_PATH_SEGMENTS = [".gradle/", "out/", "reports/", ".idea/", ".vscode/", ".vs/"];
+function isExcludedPath(relativePath) {
+    const normalized = `${relativePath.replace(/\\/g, "/")}/`;
+    return EXCLUDED_PATH_SEGMENTS.some((segment) => normalized === segment || normalized.startsWith(segment) || normalized.includes(`/${segment}`));
+}
+// Documented, co-located bounds (no existing shared constant applies here).
+export const MAX_SECRET_SCAN_FILE_BYTES = 1_000_000;
+export const MAX_SECRET_SCAN_FILE_COUNT = 5_000;
+const NUL_CHAR = String.fromCharCode(0);
+function inferModulePath(relativePath, knownModulePaths) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    let best;
+    for (const modulePath of knownModulePaths) {
+        const prefix = `${modulePath.replace(/\\/g, "/")}/`;
+        if (normalized.startsWith(prefix) && (best === undefined || modulePath.length > best.length)) {
+            best = modulePath;
+        }
+    }
+    return best;
+}
+// Discovers a bounded, deterministic set of target-contained text files
+// eligible for secret-candidate scanning. Never throws for missing glob base
+// paths (per-glob isolation, same rationale as boundedSourceScan.ts), never
+// reads beyond the size cap, and reports every skip with a structured
+// reason rather than silently dropping files.
+export function discoverSecretSourceFiles(targetRoot, knownModulePaths = []) {
+    const candidateMap = new Map();
+    for (const glob of SECRET_SCAN_GLOBS) {
+        let matches;
+        try {
+            matches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            continue;
+        }
+        for (const match of matches) {
+            const normalizedRel = match.relativePath.replace(/\\/g, "/");
+            if (isExcludedPath(normalizedRel))
+                continue;
+            candidateMap.set(normalizedRel, match.absolutePath);
+        }
+    }
+    const candidates = [...candidateMap.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .slice(0, MAX_SECRET_SCAN_FILE_COUNT)
+        .map(([relativePath, absolutePath]) => ({ relativePath, absolutePath }));
+    const files = [];
+    const skipped = [];
+    for (const candidate of candidates) {
+        let stat;
+        try {
+            stat = fs.lstatSync(candidate.absolutePath);
+        }
+        catch (error) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        // Symlinks are not followed outside the target: resolve the real path
+        // and re-check containment before ever reading content.
+        let realAbsolutePath = candidate.absolutePath;
+        if (stat.isSymbolicLink()) {
+            try {
+                realAbsolutePath = fs.realpathSync(candidate.absolutePath);
+            }
+            catch {
+                skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: "broken symlink" });
+                continue;
+            }
+            const normalizedRoot = targetRoot.replace(/\\/g, "/");
+            const normalizedReal = realAbsolutePath.replace(/\\/g, "/");
+            if (!normalizedReal.startsWith(normalizedRoot)) {
+                skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: "symlink escapes target root" });
+                continue;
+            }
+            try {
+                stat = fs.statSync(realAbsolutePath);
+            }
+            catch (error) {
+                skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+                continue;
+            }
+        }
+        if (!stat.isFile())
+            continue;
+        if (stat.size > MAX_SECRET_SCAN_FILE_BYTES) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "oversized", detail: `${stat.size} bytes exceeds ${MAX_SECRET_SCAN_FILE_BYTES}` });
+            continue;
+        }
+        let content;
+        try {
+            content = fs.readFileSync(realAbsolutePath, "utf8");
+        }
+        catch (error) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        if (content.indexOf(NUL_CHAR) !== -1) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "binary-like" });
+            continue;
+        }
+        files.push({
+            relativePath: candidate.relativePath,
+            absolutePath: candidate.absolutePath,
+            modulePath: inferModulePath(candidate.relativePath, knownModulePaths),
+            content,
+        });
+    }
+    return { files, skipped };
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/index.js

@@ -0,0 +1,9 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — public exports for the standalone Android secret-
+// candidate audit. Deliberately does not export the raw matcher
+// (matchSecretCandidates.ts), suppression internals, or raw match types —
+// only the discovery/analysis/check-result layers that already redact.
+// ---------------------------------------------------------------------------
+export { discoverSecretSourceFiles, SECRET_SCAN_GLOBS, MAX_SECRET_SCAN_FILE_BYTES, MAX_SECRET_SCAN_FILE_COUNT } from "./discoverSecretSourceFiles.js";
+export { analyzeSecretCandidateFile } from "./analyzeSecretCandidates.js";
+export { auditAndroidSecretCandidates, ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID } from "./checkResult.js";