@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/analyzeSensitiveLogging.js

@@ -0,0 +1,117 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { collectLoggingEvidence } from "./collectLoggingEvidence.js";
+// Authorization/Bearer/Cookie/session/token identifiers are already covered
+// by classifySensitiveIdentifier's shared vocabulary (no separate header
+// word list here) — a bare string literal equal to a header *name* (e.g.
+// "Authorization" used as a log tag) is deliberately never inspected for
+// content, so it never produces a finding (see module header note above).
+function sensitiveIdentifierNameFor(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    if (classification.kind !== "identifier" && classification.kind !== "member-access")
+        return undefined;
+    const name = expression.replace(/^.*\./, "");
+    const result = classifySensitiveIdentifier(name);
+    return result ? { sensitiveDataCategory: result } : undefined;
+}
+function isExceptionMessageExpression(expression) {
+    if (expression === undefined)
+        return false;
+    return /\.(message|localizedMessage)$/.test(expression) || /\.(getMessage|stackTraceToString)\s*\(\s*\)$/.test(expression);
+}
+export function analyzeSensitiveLoggingFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const matches = collectLoggingEvidence(file.content);
+    const limitations = [
+        "Bounded lexical source analysis; does not prove a log call executed, that logs are present on a device, or that Crashlytics uploaded data.",
+    ];
+    const location = (m) => buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: m.line });
+    const finding = (m, title, evidenceDetails) => findings.push(makeAndroidFinding({
+        ruleId: "android-sensitive-logging",
+        title,
+        severity: m.debugGuarded ? "minor" : "major",
+        confidence: "high",
+        description: `${title} via ${m.api}. Static source evidence only; does not prove the call executed or that logs were collected.`,
+        manifestPath: file.relativePath,
+        identity: `${m.api}:${m.line}`,
+        location: { line: m.line },
+        evidenceDetails: [...evidenceDetails, m.debugGuarded ? "debug-guard=present" : "debug-guard=none"],
+        recommendation: "Remove sensitive values from log statements, or guard them out of release builds entirely.",
+    }));
+    const candidate = (m, summary, rawValue, confidence = "medium", resolutionState = "resolved") => candidates.push(makeCandidateEvidence({
+        ruleId: "android-sensitive-logging",
+        category: "android-sensitive-logging",
+        confidence,
+        modulePath: file.modulePath,
+        location: location(m),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    for (const m of matches) {
+        if (m.kind === "isloggable") {
+            candidate(m, "Log.isLoggable is contextual evidence; it is not a security control by itself", undefined, "low", "not-applicable");
+            continue;
+        }
+        if (m.kind === "print-stack-trace") {
+            candidate(m, "printStackTrace() called; review evidence only, does not prove secrets are present", m.throwableExpression, "low", "not-applicable");
+            continue;
+        }
+        if (m.kind === "crashlytics") {
+            if (m.api === "Crashlytics.recordException") {
+                candidate(m, "Crashlytics recordException() called", undefined, "low", "not-applicable");
+                continue;
+            }
+            if (m.api === "Crashlytics.setCustomKey") {
+                const keyLiteral = m.tagExpression !== undefined ? classifyDirectExpression(m.tagExpression) : undefined;
+                const sensitive = keyLiteral?.kind === "string-literal" && keyLiteral.literalValue !== undefined ? classifySensitiveIdentifier(keyLiteral.literalValue) : sensitiveIdentifierNameFor(m.tagExpression);
+                if (sensitive) {
+                    finding(m, "Sensitive Crashlytics custom key or value set", [`key=${m.tagExpression}`]);
+                }
+                else {
+                    candidate(m, "Crashlytics setCustomKey() called", m.messageExpression, "low");
+                }
+                continue;
+            }
+            if (m.api === "Crashlytics.setUserId") {
+                const sensitive = sensitiveIdentifierNameFor(m.messageExpression);
+                if (sensitive) {
+                    finding(m, "Direct personal identifier supplied to Crashlytics setUserId", [`value=${m.messageExpression}`]);
+                }
+                else {
+                    candidate(m, "Crashlytics setUserId() called; privacy review evidence", m.messageExpression, "low");
+                }
+                continue;
+            }
+            // Crashlytics.log — same sensitive-message policy as Log/Timber below.
+        }
+        // Log / Timber / stdout / Crashlytics.log share one sensitive-argument policy.
+        const tagSensitive = sensitiveIdentifierNameFor(m.tagExpression);
+        const messageSensitive = sensitiveIdentifierNameFor(m.messageExpression);
+        if (tagSensitive || messageSensitive) {
+            finding(m, `Direct sensitive value logged via ${m.api}`, [`argument=${messageSensitive ? m.messageExpression : m.tagExpression}`]);
+            continue;
+        }
+        if (isExceptionMessageExpression(m.messageExpression)) {
+            candidate(m, "Exception message/stack-trace text logged; content not inspected", m.messageExpression, "low", "not-applicable");
+            continue;
+        }
+        if (m.messageExpression !== undefined) {
+            const classification = classifyDirectExpression(m.messageExpression);
+            if (classification.kind === "method-call" || classification.kind === "collection-object" || classification.kind === "member-access" || classification.kind === "dynamic-unsupported") {
+                candidate(m, `Dynamic ${classification.kind.replace("-", " ")} logged; contents not inspected`, m.messageExpression, "low", "unresolved");
+            }
+            else if (classification.kind === "identifier") {
+                candidate(m, "Dynamic log message logged; identifier not recognized as sensitive by name", m.messageExpression, "low", "unresolved");
+            }
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/checkResult.js

@@ -0,0 +1,74 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+import { analyzeSensitiveLoggingFile } from "./analyzeSensitiveLogging.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android sensitive-logging check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID = "android-sensitive-logging-audit";
+export function auditAndroidSensitiveLogging(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID,
+            category: "android-sensitive-logging",
+            title: "Android sensitive-logging audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const sourceFiles = files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of sourceFiles) {
+        const result = analyzeSensitiveLoggingFile(targetRoot, file);
+        for (const f of result.findings)
+            findingsById.set(f.id, f);
+        for (const c of result.candidates)
+            candidatesById.set(c.id, c);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID,
+        category: "android-sensitive-logging",
+        title: "Android sensitive-logging audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${sourceFiles.length} Java/Kotlin file(s) scanned`],
+        findings,
+        warnings: [
+            ...skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: does not prove log calls executed, that logcat is accessible, or that Crashlytics uploaded data.",
+        ],
+        errors: [],
+        sourcePaths: sourceFiles.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/collectLoggingEvidence.js

@@ -0,0 +1,87 @@
+import { executableMask, lineForOffset } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded direct evidence collection for sensitive-logging
+// sinks (Android Log, Timber, stdout/stderr, printStackTrace, and
+// Crashlytics payload sinks). Purely lexical, over comment/string-masked
+// text with argument text re-sliced from the original content via regex
+// match indices (see sensitiveStorage/collectStorageEvidence.ts for the same
+// pattern and its rationale). Nothing here constructs CandidateEvidence or
+// SecurityFinding.
+// ---------------------------------------------------------------------------
+const LOG_CALL = /\bLog\.(v|d|i|w|e|wtf|println)\s*\(([^;\n]*?)\)/gd;
+const TIMBER_CALL = /\bTimber\.(v|d|i|w|e|wtf|log|tag)\s*\(([^;\n]*?)\)/gd;
+const STDOUT_CALL = /(System\.out|System\.err)\.(print|println)\s*\(([^;\n]*?)\)/gd;
+const KOTLIN_PRINT = /(?<![.\w])(print|println)\s*\(([^;\n]*?)\)/gd;
+const PRINT_STACK_TRACE = /([A-Za-z_][\w.]*)\.printStackTrace\s*\(\s*\)/gd;
+const CRASHLYTICS_CALL = /\b(FirebaseCrashlytics(?:\.getInstance\(\))?|crashlytics)\.(log|setCustomKey|setUserId|recordException)\s*\(([^;\n]*?)\)/gd;
+const IS_LOGGABLE = /\bLog\.isLoggable\s*\(([^;\n]*?)\)/gd;
+const DEBUG_GUARD_WINDOW = 3;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    if (!span)
+        return match[group];
+    return content.slice(span[0], span[1]);
+}
+function isDebugGuarded(content, offset) {
+    const startLine = lineForOffset(content, offset) - DEBUG_GUARD_WINDOW;
+    const lines = content.split("\n");
+    const from = Math.max(0, startLine - 1);
+    const window = lines.slice(from, lineForOffset(content, offset)).join("\n");
+    return /BuildConfig\.DEBUG|\bDEBUG\b/.test(window);
+}
+function push(list, content, kind, api, offset, extra) {
+    list.push({
+        kind,
+        api,
+        debugGuarded: isDebugGuarded(content, offset),
+        offset,
+        line: lineForOffset(content, offset),
+        ...extra,
+    });
+}
+export function collectLoggingEvidence(content) {
+    const mask = executableMask(content);
+    const matches = [];
+    for (const match of mask.matchAll(LOG_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        if (match[1] === "println") {
+            push(matches, content, "log", `Log.println`, offset, { messageExpression: args[args.length - 1], tagExpression: args[1] });
+            continue;
+        }
+        push(matches, content, "log", `Log.${match[1]}`, offset, { tagExpression: args[0], messageExpression: args[1], throwableExpression: args[2] });
+    }
+    for (const match of mask.matchAll(IS_LOGGABLE)) {
+        const offset = match.index ?? 0;
+        push(matches, content, "isloggable", "Log.isLoggable", offset, {});
+    }
+    for (const match of mask.matchAll(TIMBER_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, "timber", `Timber.${match[1]}`, offset, { messageExpression: args[0], throwableExpression: args[1] });
+    }
+    for (const match of mask.matchAll(STDOUT_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        push(matches, content, "stdout", `${match[1]}.${match[2]}`, offset, { messageExpression: args[0] });
+    }
+    for (const match of mask.matchAll(KOTLIN_PRINT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, "stdout", match[1], offset, { messageExpression: args[0] });
+    }
+    for (const match of mask.matchAll(PRINT_STACK_TRACE)) {
+        const offset = match.index ?? 0;
+        push(matches, content, "print-stack-trace", "printStackTrace", offset, { throwableExpression: match[1] });
+    }
+    for (const match of mask.matchAll(CRASHLYTICS_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        push(matches, content, "crashlytics", `Crashlytics.${match[2]}`, offset, {
+            tagExpression: match[2] === "setCustomKey" ? args[0] : undefined,
+            messageExpression: args[match[2] === "setCustomKey" ? 1 : 0],
+        });
+    }
+    return matches.sort((a, b) => a.offset - b.offset);
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/index.js

@@ -0,0 +1 @@
+export { auditAndroidSensitiveLogging, ANDROID_SENSITIVE_LOGGING_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/sensitiveLogging/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/analyzeSensitiveStorage.js

@@ -0,0 +1,182 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { splitIdentifierWords } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { collectStorageEvidence } from "./collectStorageEvidence.js";
+const SENSITIVE_FILE_NAME_WORDS = new Set([
+    "credentials",
+    "password",
+    "passwords",
+    "token",
+    "tokens",
+    "secret",
+    "secrets",
+    "session",
+    "auth",
+    "cookies",
+    "privatekey",
+    "account",
+    "userprofile",
+]);
+function literalOf(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    return classification.kind === "string-literal" ? classification.literalValue : undefined;
+}
+function isIdentifierExpression(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    return classification.kind === "identifier" || classification.kind === "member-access" ? expression.replace(/^.*\./, "") : undefined;
+}
+function fileNameLooksSensitive(pathHint) {
+    const literal = literalOf(pathHint);
+    const candidate = literal ?? pathHint;
+    if (!candidate)
+        return false;
+    const words = splitIdentifierWords(candidate.replace(/\.[a-z0-9]+$/i, ""));
+    return words.some((word) => SENSITIVE_FILE_NAME_WORDS.has(word));
+}
+function hasWorldMode(modeExpression) {
+    return modeExpression !== undefined && /MODE_WORLD_READABLE|MODE_WORLD_WRITEABLE/.test(modeExpression);
+}
+function hasPrivateMode(modeExpression) {
+    return modeExpression !== undefined && /MODE_PRIVATE/.test(modeExpression) && !hasWorldMode(modeExpression);
+}
+function sensitiveIdentifierFor(expression) {
+    if (expression === undefined)
+        return undefined;
+    const literal = literalOf(expression);
+    if (literal !== undefined)
+        return classifySensitiveIdentifier(literal);
+    const identifier = isIdentifierExpression(expression);
+    return identifier !== undefined ? classifySensitiveIdentifier(identifier) : undefined;
+}
+export function analyzeSensitiveStorageFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const matches = collectStorageEvidence(file.content);
+    const location = (m) => buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: m.line });
+    const limitations = ["Bounded lexical source analysis; does not evaluate runtime storage contents, filesystem permissions, or scoped-storage behavior for a specific device or API level."];
+    const finding = (ruleId, title, m, evidenceDetails, severity = "major") => findings.push(makeAndroidFinding({
+        ruleId,
+        title,
+        severity,
+        confidence: "high",
+        description: `${title}. Static source evidence only; does not prove data was stored at runtime or that another application can access it.`,
+        manifestPath: file.relativePath,
+        identity: `${m.api}:${m.line}`,
+        location: { line: m.line },
+        evidenceDetails,
+        recommendation: "Avoid storing sensitive data in plaintext; use EncryptedSharedPreferences/EncryptedFile or an equivalent platform-provided encryption wrapper.",
+    }));
+    const candidate = (ruleId, m, summary, rawValue, confidence, resolutionState = "resolved") => candidates.push(makeCandidateEvidence({
+        ruleId,
+        category: "android-sensitive-storage",
+        confidence,
+        modulePath: file.modulePath,
+        location: location(m),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    for (const m of matches) {
+        if (m.kind === "shared-preferences-get") {
+            if (hasWorldMode(m.modeExpression)) {
+                finding("android-sensitive-preferences", "SharedPreferences opened with a world-readable/world-writable mode", m, [`mode=${m.modeExpression}`]);
+            }
+            else if (hasPrivateMode(m.modeExpression)) {
+                candidate("android-sensitive-preferences", m, "SharedPreferences opened with MODE_PRIVATE (restrictive, not encryption)", m.modeExpression, "low", "not-applicable");
+            }
+            else if (m.modeExpression !== undefined && classifyDirectExpression(m.modeExpression).kind !== "string-literal") {
+                candidate("android-sensitive-preferences", m, "SharedPreferences mode is dynamic or unresolved", m.modeExpression, "low", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "shared-preferences-write") {
+            const sensitive = sensitiveIdentifierFor(m.keyExpression);
+            if (!sensitive || m.valueExpression === undefined)
+                continue;
+            const valueClassification = classifyDirectExpression(m.valueExpression);
+            if (valueClassification.kind === "string-literal") {
+                finding("android-sensitive-preferences", `Direct ${sensitive.sensitiveDataCategory} written to plaintext SharedPreferences`, m, [`key=${m.keyExpression}`]);
+            }
+            else {
+                candidate("android-sensitive-preferences", m, `Sensitive key "${m.keyExpression}" written with a dynamic SharedPreferences value`, m.valueExpression, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "datastore-write") {
+            const sensitive = sensitiveIdentifierFor(m.keyExpression);
+            if (!sensitive)
+                continue;
+            candidate("android-sensitive-preferences", m, `Sensitive DataStore key "${m.keyExpression}" written`, m.valueExpression, "medium", "unresolved");
+            continue;
+        }
+        if (m.kind === "internal-file-write") {
+            if (hasWorldMode(m.modeExpression)) {
+                finding("android-sensitive-unsafe-file-database-storage", "Internal file opened with a world-readable/world-writable mode", m, [`mode=${m.modeExpression}`]);
+                continue;
+            }
+            const nameSensitive = fileNameLooksSensitive(m.pathHint) || (m.receiver !== "(unresolved)" && Boolean(sensitiveIdentifierFor(m.receiver)));
+            const valueSensitive = sensitiveIdentifierFor(m.valueExpression);
+            if (!nameSensitive && !valueSensitive)
+                continue;
+            const valueClassification = m.valueExpression !== undefined ? classifyDirectExpression(m.valueExpression) : undefined;
+            if (valueSensitive && valueClassification?.kind === "string-literal") {
+                finding("android-sensitive-unsafe-file-database-storage", "Direct sensitive value written to a plaintext internal file", m, [`file=${m.pathHint ?? m.receiver}`]);
+            }
+            else {
+                candidate("android-sensitive-unsafe-file-database-storage", m, "Sensitive internal file write candidate", m.valueExpression ?? m.pathHint, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "external-file-write") {
+            const isPublic = /getExternalStorageDirectory|getExternalStoragePublicDirectory/.test(m.api);
+            const isCache = /ExternalCacheDir/.test(m.api);
+            const nameSensitive = fileNameLooksSensitive(m.pathHint);
+            if (!nameSensitive)
+                continue;
+            if (isPublic) {
+                finding("android-sensitive-external-storage", "Sensitive-looking path written to shared public external storage", m, [`path=${m.pathHint}`]);
+            }
+            else if (isCache) {
+                candidate("android-sensitive-external-storage", m, "Sensitive-looking path written to external cache", m.pathHint, "medium");
+            }
+            else {
+                candidate("android-sensitive-external-storage", m, "Sensitive-looking path written to app-specific external storage", m.pathHint, "medium");
+            }
+            continue;
+        }
+        if (m.kind === "database-write") {
+            if (m.api === "ContentValues.put") {
+                const sensitive = sensitiveIdentifierFor(m.keyExpression);
+                if (!sensitive)
+                    continue;
+                const valueClassification = m.valueExpression !== undefined ? classifyDirectExpression(m.valueExpression) : undefined;
+                if (valueClassification?.kind === "string-literal") {
+                    finding("android-sensitive-unsafe-file-database-storage", "Direct sensitive value inserted into a local database column", m, [`column=${m.keyExpression}`]);
+                }
+                else {
+                    candidate("android-sensitive-unsafe-file-database-storage", m, `Sensitive database column "${m.keyExpression}" candidate`, m.valueExpression, "medium", "unresolved");
+                }
+            }
+            else if (m.api === "execSQL" && m.valueExpression !== undefined) {
+                const words = splitIdentifierWords(m.valueExpression);
+                if (words.some((word) => classifySensitiveIdentifier(word))) {
+                    candidate("android-sensitive-unsafe-file-database-storage", m, "Sensitive-looking column name referenced in a raw SQL statement", m.valueExpression, "low");
+                }
+            }
+            continue;
+        }
+        if (m.kind === "encrypted-storage-reference") {
+            candidate("android-sensitive-preferences", m, `Protective encrypted-storage API referenced: ${m.api}`, m.api, "low", "not-applicable");
+            continue;
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/checkResult.js

@@ -0,0 +1,74 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+import { analyzeSensitiveStorageFile } from "./analyzeSensitiveStorage.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android sensitive-storage check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID = "android-sensitive-storage-audit";
+export function auditAndroidSensitiveStorage(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID,
+            category: "android-sensitive-storage",
+            title: "Android sensitive-storage audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const sourceFiles = files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of sourceFiles) {
+        const result = analyzeSensitiveStorageFile(targetRoot, file);
+        for (const f of result.findings)
+            findingsById.set(f.id, f);
+        for (const c of result.candidates)
+            candidatesById.set(c.id, c);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID,
+        category: "android-sensitive-storage",
+        title: "Android sensitive-storage audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${sourceFiles.length} Java/Kotlin file(s) scanned`],
+        findings,
+        warnings: [
+            ...skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: does not inspect runtime storage contents, filesystem permissions, or database records.",
+        ],
+        errors: [],
+        sourcePaths: sourceFiles.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/collectStorageEvidence.js

@@ -0,0 +1,109 @@
+import { executableMask, lineForOffset } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded direct evidence collection for sensitive-storage
+// APIs (SharedPreferences, DataStore, internal/external file writes,
+// database/ContentValues writes, and encrypted-storage references).
+//
+// Purely lexical: call shapes are matched over comment/string-masked text
+// (so nothing inside a comment or string literal is matched as executable
+// code), but every captured group offset is then re-sliced out of the
+// ORIGINAL, unmasked content (via regex match "indices", the `d` flag) —
+// masked text has string-literal interiors blanked out, so reading argument
+// text directly from a masked capture group would silently lose every
+// string-literal key/value. Nothing in this file constructs CandidateEvidence
+// or SecurityFinding, and nothing here is exported outside sensitiveStorage/.
+// ---------------------------------------------------------------------------
+const PUT_CALL = /([A-Za-z_][\w.]*)\.(?:edit\(\)\.)?(putString|putStringSet|putInt|putLong|putFloat|putBoolean|remove|clear|apply|commit)\s*\(([^;\n]*?)\)/gd;
+const GET_PREFS = /(?:([A-Za-z_][\w.]*)\.)?(getSharedPreferences|PreferenceManager\.getDefaultSharedPreferences)\s*\(([^;\n]*?)\)/gd;
+const DATASTORE_EDIT = /([A-Za-z_][\w.]*)\[\s*([A-Za-z_][\w.]*)\s*\]\s*=\s*([^;\n]+)/gd;
+const INTERNAL_FILE_WRITE = /(?:([A-Za-z_][\w.]*)\.)?(openFileOutput|writeText|appendText)\s*\(([^;\n]*?)\)/gd;
+const FILE_STREAM_CTOR = /new\s+(FileOutputStream|FileWriter|BufferedWriter)\s*\(([^;\n]*?)\)/gd;
+const EXTERNAL_PATH_API = /(Environment\.getExternalStorageDirectory|Environment\.getExternalStoragePublicDirectory|[A-Za-z_][\w.]*\.getExternalFilesDir|[A-Za-z_][\w.]*\.externalFilesDir|[A-Za-z_][\w.]*\.getExternalCacheDir|[A-Za-z_][\w.]*\.externalCacheDir)\s*\(?([^;\n)]*)\)?/gd;
+const CONTENT_VALUES_PUT = /([A-Za-z_][\w.]*)\.put\s*\(([^;\n]*?)\)/gd;
+const EXEC_SQL = /([A-Za-z_][\w.]*)\.execSQL\s*\(([^;\n]*?)\)/gd;
+const ENCRYPTED_STORAGE_REFERENCE = /\b(EncryptedSharedPreferences|EncryptedFile|MasterKey|AndroidKeyStore|SQLCipher)\b/gd;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    if (!span)
+        return match[group];
+    return content.slice(span[0], span[1]);
+}
+function pushMatch(list, content, kind, api, offset, extra) {
+    list.push({ kind, api, receiver: extra.receiver ?? "(unresolved)", offset, line: lineForOffset(content, offset), ...extra });
+}
+export function collectStorageEvidence(content) {
+    const mask = executableMask(content);
+    const matches = [];
+    for (const match of mask.matchAll(PUT_CALL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        pushMatch(matches, content, "shared-preferences-write", `SharedPreferences.Editor.${match[2]}`, offset, {
+            receiver: match[1],
+            keyExpression: args[0],
+            valueExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(GET_PREFS)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        pushMatch(matches, content, "shared-preferences-get", match[2], offset, {
+            receiver: match[1] ?? match[2],
+            pathHint: args[0],
+            modeExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(DATASTORE_EDIT)) {
+        const offset = match.index ?? 0;
+        pushMatch(matches, content, "datastore-write", "DataStore.edit[key]=", offset, {
+            receiver: match[1],
+            keyExpression: match[2],
+            valueExpression: realGroup(content, match, 3),
+        });
+    }
+    for (const match of mask.matchAll(INTERNAL_FILE_WRITE)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        pushMatch(matches, content, "internal-file-write", match[2], offset, {
+            receiver: match[1],
+            pathHint: match[2] === "openFileOutput" ? args[0] : undefined,
+            modeExpression: match[2] === "openFileOutput" ? args[1] : undefined,
+            valueExpression: match[2] !== "openFileOutput" ? args[0] : undefined,
+        });
+    }
+    for (const match of mask.matchAll(FILE_STREAM_CTOR)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        pushMatch(matches, content, "internal-file-write", `new ${match[1]}`, offset, {
+            pathHint: args[0],
+        });
+    }
+    for (const match of mask.matchAll(EXTERNAL_PATH_API)) {
+        const offset = match.index ?? 0;
+        pushMatch(matches, content, "external-file-write", match[1], offset, {
+            pathHint: realGroup(content, match, 2),
+        });
+    }
+    for (const match of mask.matchAll(CONTENT_VALUES_PUT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        pushMatch(matches, content, "database-write", "ContentValues.put", offset, {
+            receiver: match[1],
+            keyExpression: args[0],
+            valueExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(EXEC_SQL)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        pushMatch(matches, content, "database-write", "execSQL", offset, {
+            receiver: match[1],
+            valueExpression: args[0],
+        });
+    }
+    for (const match of mask.matchAll(ENCRYPTED_STORAGE_REFERENCE)) {
+        const offset = match.index ?? 0;
+        pushMatch(matches, content, "encrypted-storage-reference", match[1], offset, {});
+    }
+    return matches.sort((a, b) => a.offset - b.offset);
+}

package/dist/src/mobile/android/advancedSecurity/sensitiveStorage/index.js

@@ -0,0 +1 @@
+export { auditAndroidSensitiveStorage, ANDROID_SENSITIVE_STORAGE_AUDIT_CHECK_ID } from "./checkResult.js";