@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/detect/versionCatalogEvidence.js

@@ -0,0 +1,37 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 2 — bounded gradle/libs.versions.toml plugin-alias evidence.
+//
+// This is deliberately not a general TOML parser: it only line-scans the
+// `[plugins]`/`[libraries]` sections for aliases whose declared id/module
+// statically mentions an Android/Kotlin-Android/Compose plugin or library.
+// Anything else in the catalog (bundles, rich versions, references) is left
+// unresolved, matching the "bounded evidence only" requirement for this
+// batch — a full catalog resolver belongs to a later batch if ever needed.
+// ---------------------------------------------------------------------------
+const ALIAS_LINE_PATTERN = /^([A-Za-z0-9_-]+)\s*=\s*(\{.*\}|".*")\s*$/;
+export function extractVersionCatalogEvidence(text) {
+    const androidPluginAliasEvidence = [];
+    const kotlinAndroidPluginAliasEvidence = [];
+    const composeAliasEvidence = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        const match = line.match(ALIAS_LINE_PATTERN);
+        if (!match)
+            continue;
+        const [, alias, body] = match;
+        if (body.includes("com.android.application") || body.includes("com.android.library")) {
+            androidPluginAliasEvidence.push(alias);
+        }
+        if (body.includes("org.jetbrains.kotlin.android")) {
+            kotlinAndroidPluginAliasEvidence.push(alias);
+        }
+        if (/compose/i.test(body) || /androidx\.compose/i.test(body)) {
+            composeAliasEvidence.push(alias);
+        }
+    }
+    return {
+        androidPluginAliasEvidence: androidPluginAliasEvidence.sort((a, b) => a.localeCompare(b)),
+        kotlinAndroidPluginAliasEvidence: kotlinAndroidPluginAliasEvidence.sort((a, b) => a.localeCompare(b)),
+        composeAliasEvidence: composeAliasEvidence.sort((a, b) => a.localeCompare(b)),
+    };
+}

package/dist/src/mobile/android/detection.js

@@ -0,0 +1,28 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android detection result contract.
+// v0.4.0 Batch 2 — narrow inherited-contract correction: ANDROID_PROJECT_KINDS
+// widened (additive) from {application, library, unknown} to also cover
+// project-level outcomes ("multi-module", "mixed", "partial", "non-android")
+// required by Batch 2 classification (see agents.txt Batch 2 section 7.8).
+// The original three values are preserved unchanged and remain the only
+// values a single AndroidModuleDetection.kind can take in practice, so no
+// existing consumer or test is broken by the widening. AndroidModuleDetection
+// also gained optional confidence/evidence fields so per-module
+// classification results (Batch 2 section 7.7) can be evidence-backed
+// without a second module-result type.
+//
+// This is the normalized shape a future detection batch will populate. This
+// batch defines the contract only; no detection algorithm exists yet.
+// "uncertain"/"unknown" outcomes must never be normalized into a positive
+// detection — callers must check `detected` explicitly.
+// ---------------------------------------------------------------------------
+export const ANDROID_PROJECT_KINDS = [
+    "application",
+    "library",
+    "unknown",
+    "multi-module",
+    "mixed",
+    "partial",
+    "non-android",
+];
+export const ANDROID_UI_TOOLKITS = ["compose", "xml-view", "mixed", "uncertain"];

package/dist/src/mobile/android/gradle/gradleMetadataCheckResult.js

@@ -0,0 +1,120 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — static Gradle metadata check-result construction
+// (agents.txt Batch 4 section 7.16).
+//
+// Status policy:
+//   - non-Android target                      -> "unsupported" (optional)
+//   - Android detected but no module build     -> "inconclusive" (required)
+//     file could be read
+//   - Android detected but no metadata field    -> "inconclusive" (required)
+//     could be resolved from any module
+//   - usable evidence resolved                  -> "passed"
+// Unresolved dynamic values and metadata conflicts are represented as
+// warnings/evidence — they never fail this check on their own, matching the
+// "validation evidence, not automatic vulnerability" framing used throughout
+// this batch. There is no reachable "malformed"/"error" path for plain-text
+// Gradle files the way there is for XML: readAndroidGradleMetadata treats an
+// unreadable file the same as an absent one, and all paths inspected here
+// come from the already target-contained Batch 2 detection result.
+// ---------------------------------------------------------------------------
+const CHECK_ID = "android-gradle-metadata";
+export function buildAndroidGradleMetadataCheckResult(detection, gradle) {
+    const sourcePaths = [...gradle.settingsFiles, ...gradle.rootBuildFiles, ...gradle.moduleBuildFiles].sort((a, b) => a.localeCompare(b));
+    const evidence = [];
+    if (gradle.wrapper.versionEvidence)
+        evidence.push(`Gradle wrapper version: ${gradle.wrapper.versionEvidence}`);
+    if (gradle.pluginEvidence.androidGradlePluginVersion)
+        evidence.push(`Android Gradle Plugin version: ${gradle.pluginEvidence.androidGradlePluginVersion}`);
+    if (gradle.pluginEvidence.kotlinAndroidPluginVersion)
+        evidence.push(`Kotlin Android plugin version: ${gradle.pluginEvidence.kotlinAndroidPluginVersion}`);
+    for (const module of gradle.modules) {
+        if (module.namespace || module.applicationId) {
+            evidence.push(`${module.path}: namespace=${module.namespace ?? "(none)"} applicationId=${module.applicationId ?? "(none)"}`);
+        }
+    }
+    const warnings = [...gradle.parseWarnings];
+    if (gradle.conflicts && gradle.conflicts.length > 0) {
+        warnings.push(...gradle.conflicts.map((c) => c.note));
+    }
+    if (detection.projectKind === "non-android") {
+        return {
+            id: CHECK_ID,
+            category: "android-gradle",
+            title: "Android Gradle metadata extraction",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const hasModuleBuildFile = gradle.moduleBuildFiles.length > 0;
+    const hasAnyResolvedModuleMetadata = gradle.modules.some((m) => m.namespace || m.applicationId || m.minSdk || m.targetSdk || m.compileSdk || m.versionName || m.versionCode);
+    if (!hasModuleBuildFile) {
+        return {
+            id: CHECK_ID,
+            category: "android-gradle",
+            title: "Android Gradle metadata extraction",
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "No module build.gradle(.kts) file could be read for metadata extraction."],
+            errors: [],
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (!hasAnyResolvedModuleMetadata) {
+        return {
+            id: CHECK_ID,
+            category: "android-gradle",
+            title: "Android Gradle metadata extraction",
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence,
+            findings: [],
+            warnings: [...warnings, "Module build file(s) were read but no static metadata field could be resolved."],
+            errors: [],
+            sourcePaths,
+            confidence: gradle.metadataConfidence,
+            environmentRequirements: [],
+        };
+    }
+    const confidence = gradle.metadataConfidence;
+    return {
+        id: CHECK_ID,
+        category: "android-gradle",
+        title: "Android Gradle metadata extraction",
+        status: "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings: [],
+        warnings,
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}

package/dist/src/mobile/android/gradle/moduleMetadataExtractor.js

@@ -0,0 +1,243 @@
+import { extractBuildFileEvidence } from "../detect/buildFileEvidence.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 4 — bounded literal metadata extraction from a single module
+// build.gradle(.kts) file's text.
+//
+// Reuses Batch 2's extractBuildFileEvidence for plugin/Compose boolean
+// evidence (already covers namespace/applicationId at a basic level) and
+// adds the additional literal fields Batch 4 needs (version/SDK fields,
+// build-type names) plus raw/unresolved-expression preservation for every
+// field, using the same generic "try a literal, else capture a bounded raw
+// excerpt" strategy for each key. Comments are stripped first so a
+// commented-out assignment never becomes active metadata (ANDROID-B4-05).
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — exported (was module-private) so the new signing-
+// configuration module can reuse the exact same comment-stripping/literal-
+// extraction/brace-matching technique instead of a second implementation.
+export function stripComments(text) {
+    // Replaces comment characters with spaces (not empty string) so any
+    // surviving line/column-independent offsets are not shifted — this batch
+    // does not track per-field locations, but keeping length stable is cheap
+    // and avoids accidentally joining tokens across a removed comment.
+    return text
+        .replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/\/\/[^\n]*/g, (match) => " ".repeat(match.length));
+}
+const STRING_OR_INT = `(?:'([^']*)'|"([^"]*)"|(-?\\d+))`;
+export function extractLiteral(text, keyAlternatives) {
+    const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    // Anchored to the start of a line (allowing leading indentation) so a key
+    // name that merely appears as a word inside an unrelated string literal —
+    // e.g. `val note = "the applicationId field below is the real one"` — is
+    // never mistaken for a real assignment (ANDROID-B4-05). Genuine Gradle
+    // property assignments always begin a statement/line.
+    const literalPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=]?\\s*${STRING_OR_INT}`, "m");
+    const literalMatch = text.match(literalPattern);
+    if (literalMatch) {
+        const value = literalMatch[1] ?? literalMatch[2] ?? literalMatch[3];
+        return { value };
+    }
+    const rawPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=]?\\s*([^\\n]{1,120})`, "m");
+    const rawMatch = text.match(rawPattern);
+    if (rawMatch) {
+        const raw = rawMatch[1].trim();
+        // A raw excerpt that is itself just a bare literal (already handled
+        // above) or empty is not meaningfully "dynamic" — only report genuinely
+        // unresolved expressions.
+        if (raw.length > 0)
+            return { raw };
+    }
+    return {};
+}
+// Returns the inner text of the first `<blockKeyword> { ... }` block found,
+// bounded by brace-depth matching (not a full parser). Shared by
+// findNamedBlockEntries (names only) and extractNamedSubBlocks (v0.4.1
+// Batch 3 — names plus each entry's own block content).
+export function findBlockBody(text, blockKeyword) {
+    const blockStart = text.search(new RegExp(`\\b${blockKeyword}\\s*\\{`));
+    if (blockStart === -1)
+        return undefined;
+    const openBraceIndex = text.indexOf("{", blockStart);
+    return sliceBlockAt(text, openBraceIndex);
+}
+// Given the index of an opening `{`, returns the text between it and its
+// matching `}` (brace-depth bounded), or undefined if unterminated.
+export function sliceBlockAt(text, openBraceIndex) {
+    if (text[openBraceIndex] !== "{")
+        return undefined;
+    let depth = 0;
+    for (let i = openBraceIndex; i < text.length; i++) {
+        if (text[i] === "{")
+            depth += 1;
+        else if (text[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return text.slice(openBraceIndex + 1, i);
+        }
+    }
+    return undefined;
+}
+// Finds the top-level named entries inside a `<blockKeyword> { ... }` block
+// (e.g. `buildTypes { debug { ... } release { ... } }` or
+// `sourceSets { main { ... } androidTest { ... } }`), supporting both the
+// bare-identifier Groovy/Kotlin-DSL form and the Kotlin DSL
+// getByName/create/named(...) form. Bounded by brace-depth matching, not a
+// full parser — nested unrelated blocks inside are not descended into for
+// name extraction beyond the immediate children.
+function findNamedBlockEntries(text, blockKeyword) {
+    const block = findBlockBody(text, blockKeyword);
+    if (block === undefined)
+        return [];
+    const names = new Set();
+    for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
+        names.add(match[1]);
+    }
+    for (const match of block.matchAll(/\b(?:getByName|create|named)\(\s*["']([\w-]+)["']/g)) {
+        names.add(match[1]);
+    }
+    return [...names].sort((a, b) => a.localeCompare(b));
+}
+// v0.4.1 Batch 3 — like findNamedBlockEntries, but also returns each named
+// entry's own block content so per-build-type literal fields (debuggable,
+// minifyEnabled, etc.) can be extracted. Reuses the exact same bounded
+// brace-matching technique and the same two name-pattern forms — not a
+// second parser, just returning more of what was already being scanned.
+export function extractNamedSubBlocks(text, blockKeyword) {
+    const block = findBlockBody(text, blockKeyword);
+    if (block === undefined)
+        return [];
+    const results = [];
+    const seen = new Set();
+    for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
+        const name = match[1];
+        if (seen.has(name))
+            continue;
+        const openBraceIndex = match.index + match[0].length - 1;
+        const content = sliceBlockAt(block, openBraceIndex);
+        if (content !== undefined) {
+            results.push({ name, content });
+            seen.add(name);
+        }
+    }
+    for (const match of block.matchAll(/\b(?:getByName|create|named)\(\s*["']([\w-]+)["']\s*\)\s*\{/g)) {
+        const name = match[1];
+        if (seen.has(name))
+            continue;
+        const openBraceIndex = match.index + match[0].length - 1;
+        const content = sliceBlockAt(block, openBraceIndex);
+        if (content !== undefined) {
+            results.push({ name, content });
+            seen.add(name);
+        }
+    }
+    return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+const BOOLEAN_TOKEN = `(true|false)`;
+// v0.4.1 Batch 3 — boolean-literal counterpart to extractLiteral (which only
+// matches quoted-string/integer literals — Gradle boolean assignments like
+// `debuggable true` or `isMinifyEnabled = true` are bare tokens, not quoted).
+// Same anchoring/fallback strategy as extractLiteral for consistency.
+export function extractBooleanLiteral(text, keyAlternatives) {
+    const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const literalPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=(]?\\s*${BOOLEAN_TOKEN}\\)?`, "m");
+    const literalMatch = text.match(literalPattern);
+    if (literalMatch) {
+        return { value: literalMatch[1] === "true" };
+    }
+    const rawPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=(]?\\s*([^\\n]{1,120})`, "m");
+    const rawMatch = text.match(rawPattern);
+    if (rawMatch) {
+        const raw = rawMatch[1].trim();
+        if (raw.length > 0)
+            return { raw };
+    }
+    return {};
+}
+function booleanLiteralState(result) {
+    if (result.value !== undefined)
+        return result.value ? "literal-true" : "literal-false";
+    if (result.raw !== undefined)
+        return "dynamic";
+    return "missing";
+}
+// v0.4.1 Batch 3 — builds bounded literal evidence for one named build-type
+// block. Never evaluates Gradle; signingConfig/matchingFallbacks/initWith
+// are always reference expressions, so only a bounded raw excerpt is kept.
+function buildBuildTypeInfo(name, content) {
+    const debuggable = extractBooleanLiteral(content, ["debuggable", "isDebuggable"]);
+    const minifyEnabled = extractBooleanLiteral(content, ["minifyEnabled", "isMinifyEnabled"]);
+    const shrinkResources = extractBooleanLiteral(content, ["shrinkResources", "isShrinkResources"]);
+    const signingConfig = extractLiteral(content, ["signingConfig"]);
+    const matchingFallbacks = extractLiteral(content, ["matchingFallbacks"]);
+    const initWith = extractLiteral(content, ["initWith"]);
+    return {
+        name,
+        debuggable: debuggable.value,
+        debuggableRaw: debuggable.raw,
+        debuggableState: booleanLiteralState(debuggable),
+        minifyEnabled: minifyEnabled.value,
+        minifyEnabledRaw: minifyEnabled.raw,
+        minifyEnabledState: booleanLiteralState(minifyEnabled),
+        shrinkResources: shrinkResources.value,
+        shrinkResourcesRaw: shrinkResources.raw,
+        shrinkResourcesState: booleanLiteralState(shrinkResources),
+        signingConfigRef: signingConfig.value ?? signingConfig.raw,
+        matchingFallbacksRaw: matchingFallbacks.value ?? matchingFallbacks.raw,
+        initWithRaw: initWith.value ?? initWith.raw,
+    };
+}
+// Extracts bounded static metadata for one module's build file text. `path`
+// is intentionally omitted from the returned info — the caller (the
+// aggregator, which already knows the module path from detection) attaches
+// it, keeping this function pure with respect to filesystem/module identity.
+export function extractModuleGradleMetadata(rawText) {
+    const text = stripComments(rawText);
+    const evidence = extractBuildFileEvidence(text);
+    const unsupportedExpressions = [];
+    const namespace = extractLiteral(text, ["namespace"]);
+    const applicationId = extractLiteral(text, ["applicationId"]);
+    const versionCode = extractLiteral(text, ["versionCode"]);
+    const versionName = extractLiteral(text, ["versionName"]);
+    const minSdk = extractLiteral(text, ["minSdk", "minSdkVersion"]);
+    const targetSdk = extractLiteral(text, ["targetSdk", "targetSdkVersion"]);
+    const compileSdk = extractLiteral(text, ["compileSdk", "compileSdkVersion"]);
+    for (const [field, result] of [
+        ["namespace", namespace],
+        ["applicationId", applicationId],
+        ["versionCode", versionCode],
+        ["versionName", versionName],
+        ["minSdk", minSdk],
+        ["targetSdk", targetSdk],
+        ["compileSdk", compileSdk],
+    ]) {
+        if (result.raw) {
+            unsupportedExpressions.push(`${field}: ${result.raw}`);
+        }
+    }
+    return {
+        info: {
+            isApplication: evidence.androidApplicationPlugin || undefined,
+            isLibrary: evidence.androidLibraryPlugin || undefined,
+            namespace: namespace.value ?? evidence.namespace,
+            namespaceRaw: namespace.raw,
+            applicationId: applicationId.value ?? evidence.applicationId,
+            applicationIdRaw: applicationId.raw,
+            versionCode: versionCode.value,
+            versionCodeRaw: versionCode.raw,
+            versionName: versionName.value,
+            versionNameRaw: versionName.raw,
+            minSdk: minSdk.value,
+            minSdkRaw: minSdk.raw,
+            targetSdk: targetSdk.value,
+            targetSdkRaw: targetSdk.raw,
+            compileSdk: compileSdk.value,
+            compileSdkRaw: compileSdk.raw,
+            buildTypes: findNamedBlockEntries(text, "buildTypes"),
+            buildTypeDetails: extractNamedSubBlocks(text, "buildTypes").map(({ name, content }) => buildBuildTypeInfo(name, content)),
+            composeEnabled: evidence.composeBuildFeatureEvidence || evidence.composeDependencyEvidence || undefined,
+            sourceSetEvidence: findNamedBlockEntries(text, "sourceSets").map((name) => `declared sourceSet: ${name}`),
+            testSourceSetEvidence: [],
+            unsupportedExpressions,
+        },
+    };
+}

package/dist/src/mobile/android/gradle/pluginVersionExtractor.js

@@ -0,0 +1,40 @@
+import { accessorSuffixToCatalogAlias, resolveCatalogVersion } from "./versionCatalogMetadata.js";
+function extractDirectIdVersion(text, pluginId) {
+    const escaped = pluginId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`id\\s*\\(?\\s*['"]${escaped}['"]\\s*\\)?\\s*version\\s*['"]([^'"]+)['"]`);
+    return text.match(pattern)?.[1];
+}
+function extractClasspathVersion(text, groupArtifact) {
+    const escaped = groupArtifact.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`classpath\\s*['"]${escaped}:([^'"]+)['"]`);
+    return text.match(pattern)?.[1];
+}
+function extractCatalogAliasVersion(text, pluginId, catalog) {
+    if (!catalog)
+        return undefined;
+    for (const match of text.matchAll(/alias\(\s*libs\.plugins\.([\w.]+)\s*\)/g)) {
+        const alias = accessorSuffixToCatalogAlias(match[1]);
+        const entry = catalog.plugins[alias];
+        if (entry?.id === pluginId) {
+            return resolveCatalogVersion(catalog, entry);
+        }
+    }
+    return undefined;
+}
+// Resolves a plugin's version from root/module build-file text plus an
+// optional parsed version catalog. `classpathGroupArtifact` is only relevant
+// for the Android Gradle Plugin's legacy buildscript-classpath form.
+export function resolvePluginVersion(text, pluginId, catalog, classpathGroupArtifact) {
+    const direct = extractDirectIdVersion(text, pluginId);
+    if (direct)
+        return { version: direct };
+    if (classpathGroupArtifact) {
+        const classpath = extractClasspathVersion(text, classpathGroupArtifact);
+        if (classpath)
+            return { version: classpath };
+    }
+    const catalogVersion = extractCatalogAliasVersion(text, pluginId, catalog);
+    if (catalogVersion)
+        return { version: catalogVersion };
+    return {};
+}