@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/manifest/xml/parseXml.js

@@ -0,0 +1,329 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 3 — bounded, deterministic, dependency-free XML parser for
+// AndroidManifest.xml.
+//
+// No XML parsing dependency exists in this repository (see package.json —
+// zero runtime dependencies), so this hand-written recursive-descent scanner
+// avoids adding one, per agents.txt Batch 3 section 7.2 ("prefer a small
+// bounded parser implementation ... Do not use brittle global regular
+// expressions as the primary XML parser"). This is a manual character
+// scanner (no regex-based tokenization), tracks line/column for every
+// element and attribute, and resolves XML namespace URIs from `xmlns`/
+// `xmlns:*` declarations rather than assuming any particular prefix — so an
+// `android:` attribute is recognized even if a manifest (unusually)
+// re-prefixes the Android namespace.
+//
+// Deliberately NOT implemented (out of scope for a manifest-only parser):
+// DTD/entity resolution beyond skipping DOCTYPE, full XML 1.1 conformance,
+// processing-instruction data, and CDATA content extraction (CDATA is
+// skipped as opaque text — AndroidManifest.xml has no meaningful use of it).
+// ---------------------------------------------------------------------------
+export const ANDROID_NAMESPACE_URI = "http://schemas.android.com/apk/res/android";
+class XmlSyntaxError extends Error {
+    location;
+    constructor(message, location) {
+        super(message);
+        this.location = location;
+    }
+}
+const NAME_START_PATTERN = /[A-Za-z_:]/;
+const NAME_CHAR_PATTERN = /[A-Za-z0-9_.:-]/;
+function isNameStartChar(ch) {
+    return ch !== undefined && NAME_START_PATTERN.test(ch);
+}
+function isNameChar(ch) {
+    return ch !== undefined && NAME_CHAR_PATTERN.test(ch);
+}
+function isWhitespace(ch) {
+    return ch === " " || ch === "\t" || ch === "\n" || ch === "\r";
+}
+class Scanner {
+    text;
+    pos = 0;
+    line = 1;
+    column = 1;
+    constructor(text) {
+        // Strip a UTF-8 BOM if present so it doesn't count as document content.
+        this.text = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    }
+    loc() {
+        return { line: this.line, column: this.column };
+    }
+    eof() {
+        return this.pos >= this.text.length;
+    }
+    peek(offset = 0) {
+        return this.text[this.pos + offset];
+    }
+    startsWith(literal) {
+        return this.text.startsWith(literal, this.pos);
+    }
+    advance() {
+        const ch = this.text[this.pos];
+        if (ch === undefined) {
+            throw new XmlSyntaxError("Unexpected end of document", this.loc());
+        }
+        this.pos += 1;
+        if (ch === "\n") {
+            this.line += 1;
+            this.column = 1;
+        }
+        else {
+            this.column += 1;
+        }
+        return ch;
+    }
+    skipWhitespace() {
+        while (!this.eof() && isWhitespace(this.peek()))
+            this.advance();
+    }
+    expect(literal) {
+        if (!this.startsWith(literal)) {
+            throw new XmlSyntaxError(`Expected "${literal}"`, this.loc());
+        }
+        for (let i = 0; i < literal.length; i++)
+            this.advance();
+    }
+    skipUntil(literal) {
+        while (!this.eof() && !this.startsWith(literal))
+            this.advance();
+        if (this.eof()) {
+            throw new XmlSyntaxError(`Unterminated construct, expected "${literal}"`, this.loc());
+        }
+        this.expect(literal);
+    }
+    // Like skipUntil, but returns the consumed text before `literal` instead of
+    // discarding it. Used to capture CDATA section content as element text.
+    captureUntil(literal) {
+        let captured = "";
+        while (!this.eof() && !this.startsWith(literal))
+            captured += this.advance();
+        if (this.eof()) {
+            throw new XmlSyntaxError(`Unterminated construct, expected "${literal}"`, this.loc());
+        }
+        this.expect(literal);
+        return captured;
+    }
+}
+function resolveNamespace(prefix, scope) {
+    return scope.get(prefix ?? "");
+}
+function splitQualifiedName(qualifiedName) {
+    const colonIndex = qualifiedName.indexOf(":");
+    if (colonIndex === -1)
+        return { localName: qualifiedName };
+    return { prefix: qualifiedName.slice(0, colonIndex), localName: qualifiedName.slice(colonIndex + 1) };
+}
+function readName(scanner) {
+    const start = scanner.loc();
+    if (!isNameStartChar(scanner.peek())) {
+        throw new XmlSyntaxError("Expected a name", start);
+    }
+    let name = "";
+    while (isNameChar(scanner.peek()))
+        name += scanner.advance();
+    return name;
+}
+function readQuotedValue(scanner) {
+    const quote = scanner.peek();
+    if (quote !== `"` && quote !== `'`) {
+        throw new XmlSyntaxError("Expected a quoted attribute value", scanner.loc());
+    }
+    scanner.advance();
+    let value = "";
+    while (!scanner.eof() && scanner.peek() !== quote) {
+        value += scanner.advance();
+    }
+    if (scanner.eof()) {
+        throw new XmlSyntaxError("Unterminated attribute value", scanner.loc());
+    }
+    scanner.advance();
+    return decodeXmlEntities(value);
+}
+function decodeXmlEntities(raw) {
+    return raw
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&apos;/g, "'")
+        .replace(/&quot;/g, '"')
+        .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(Number(dec)))
+        .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCodePoint(parseInt(hex, 16)))
+        .replace(/&amp;/g, "&");
+}
+function skipMisc(scanner, warnings) {
+    // Skips whitespace, comments, the XML declaration/processing instructions,
+    // and DOCTYPE declarations that may appear between/around elements.
+    for (;;) {
+        scanner.skipWhitespace();
+        if (scanner.startsWith("<!--")) {
+            scanner.skipUntil("-->");
+            continue;
+        }
+        if (scanner.startsWith("<?")) {
+            scanner.skipUntil("?>");
+            continue;
+        }
+        if (scanner.startsWith("<!DOCTYPE") || scanner.startsWith("<!doctype")) {
+            warnings.push({ message: "DOCTYPE declaration encountered and skipped (not evaluated)", location: scanner.loc() });
+            scanner.skipUntil(">");
+            continue;
+        }
+        if (scanner.startsWith("<![CDATA[")) {
+            scanner.skipUntil("]]>");
+            continue;
+        }
+        break;
+    }
+}
+function parseAttributes(scanner) {
+    const rawAttributes = [];
+    for (;;) {
+        scanner.skipWhitespace();
+        const next = scanner.peek();
+        if (next === undefined || next === "/" || next === ">")
+            break;
+        const location = scanner.loc();
+        const rawName = readName(scanner);
+        scanner.skipWhitespace();
+        scanner.expect("=");
+        scanner.skipWhitespace();
+        const value = readQuotedValue(scanner);
+        rawAttributes.push({ rawName, value, location });
+    }
+    // Build the namespace scope contributed by this element's own xmlns/xmlns:*
+    // attributes so attribute namespace resolution can use it immediately
+    // (XML allows an element to both declare and use a namespace prefix).
+    const localScope = new Map();
+    for (const attr of rawAttributes) {
+        if (attr.rawName === "xmlns") {
+            localScope.set("", attr.value);
+        }
+        else if (attr.rawName.startsWith("xmlns:")) {
+            localScope.set(attr.rawName.slice("xmlns:".length), attr.value);
+        }
+    }
+    return { rawAttributes, localScope };
+}
+// Resolves each raw attribute's namespace URI against the combined
+// (ancestor + this element's own) namespace scope. `xmlns`/`xmlns:*`
+// attributes themselves are preserved as regular attributes (some manifest
+// tooling inspects them) but are not namespace-resolved.
+function resolveAttributeNamespaces(rawAttributes, scope, warnings) {
+    return rawAttributes.map(({ rawName, value, location }) => {
+        const { prefix, localName } = splitQualifiedName(rawName);
+        if (rawName === "xmlns" || rawName.startsWith("xmlns:")) {
+            return { rawName, localName, value, location };
+        }
+        if (prefix === undefined) {
+            return { rawName, localName, value, location };
+        }
+        const namespaceUri = resolveNamespace(prefix, scope);
+        if (namespaceUri === undefined) {
+            warnings.push({ message: `Unresolved namespace prefix "${prefix}" on attribute "${rawName}"`, location });
+        }
+        return { rawName, prefix, localName, namespaceUri, value, location };
+    });
+}
+function parseElement(scanner, parentScope, warnings) {
+    const location = scanner.loc();
+    scanner.expect("<");
+    const tagName = readName(scanner);
+    const { rawAttributes, localScope } = parseAttributes(scanner);
+    const scope = localScope.size > 0 ? new Map([...parentScope, ...localScope]) : parentScope;
+    const attributes = resolveAttributeNamespaces(rawAttributes, scope, warnings);
+    const { prefix, localName } = splitQualifiedName(tagName);
+    const namespaceUri = prefix !== undefined ? resolveNamespace(prefix, scope) : resolveNamespace(undefined, scope);
+    scanner.skipWhitespace();
+    if (scanner.startsWith("/>")) {
+        scanner.expect("/>");
+        return { tagName, prefix, localName, namespaceUri, attributes, children: [], location, textContent: "" };
+    }
+    scanner.expect(">");
+    const children = [];
+    const textParts = [];
+    for (;;) {
+        skipTextAndMisc(scanner, warnings, textParts);
+        if (scanner.startsWith("</")) {
+            scanner.expect("</");
+            const closingName = readName(scanner);
+            scanner.skipWhitespace();
+            scanner.expect(">");
+            if (closingName !== tagName) {
+                throw new XmlSyntaxError(`Mismatched closing tag: expected "</${tagName}>" but found "</${closingName}>"`, location);
+            }
+            break;
+        }
+        if (scanner.eof()) {
+            throw new XmlSyntaxError(`Unterminated element "<${tagName}>" (missing closing tag)`, location);
+        }
+        if (scanner.peek() === "<" && isNameStartChar(scanner.peek(1))) {
+            children.push(parseElement(scanner, scope, warnings));
+            continue;
+        }
+        // Any other content (unexpected `<` not matching a comment/PI/CDATA/
+        // element/closing-tag pattern) is treated as malformed input.
+        throw new XmlSyntaxError("Unexpected content while looking for a child element or closing tag", scanner.loc());
+    }
+    return { tagName, prefix, localName, namespaceUri, attributes, children, location, textContent: decodeXmlEntities(textParts.join("")) };
+}
+// v0.4.1 Batch 2 — `textParts` accumulates direct text/CDATA content so
+// callers needing element text content (e.g. Network Security Config's
+// <domain>/<pin> elements) can read it via XmlElement.textContent. Comments,
+// processing instructions, and DOCTYPE are still skipped, never counted as
+// text — only true character data and CDATA sections are captured.
+function skipTextAndMisc(scanner, warnings, textParts) {
+    for (;;) {
+        if (scanner.startsWith("<!--")) {
+            scanner.skipUntil("-->");
+            continue;
+        }
+        if (scanner.startsWith("<![CDATA[")) {
+            scanner.expect("<![CDATA[");
+            textParts.push(scanner.captureUntil("]]>"));
+            continue;
+        }
+        if (scanner.startsWith("<?")) {
+            scanner.skipUntil("?>");
+            continue;
+        }
+        if (scanner.peek() === "<")
+            break;
+        if (scanner.eof())
+            break;
+        textParts.push(scanner.advance());
+    }
+}
+// Parses `xmlText` into a small element tree. Never throws: all failures are
+// reported via the `ok: false` branch with a bounded message and location.
+export function parseXmlDocument(xmlText) {
+    const warnings = [];
+    try {
+        const scanner = new Scanner(xmlText);
+        skipMisc(scanner, warnings);
+        if (scanner.eof() || scanner.peek() !== "<") {
+            return { ok: false, error: { message: "No root element found", location: scanner.loc() }, warnings };
+        }
+        const root = parseElement(scanner, new Map(), warnings);
+        skipMisc(scanner, warnings);
+        if (!scanner.eof()) {
+            warnings.push({ message: "Unexpected trailing content after the root element was ignored", location: scanner.loc() });
+        }
+        return { ok: true, root, warnings };
+    }
+    catch (error) {
+        if (error instanceof XmlSyntaxError) {
+            return { ok: false, error: { message: error.message, location: error.location }, warnings };
+        }
+        return {
+            ok: false,
+            error: { message: error instanceof Error ? error.message : "Unknown XML parse error", location: { line: 1, column: 1 } },
+            warnings,
+        };
+    }
+}
+export function findChildren(element, localName, namespaceUri) {
+    return element.children.filter((child) => child.localName === localName && (namespaceUri === undefined || child.namespaceUri === namespaceUri));
+}
+export function getAttribute(element, localName, namespaceUri = ANDROID_NAMESPACE_URI) {
+    return element.attributes.find((attr) => attr.localName === localName && attr.namespaceUri === namespaceUri);
+}

package/dist/src/mobile/android/profile.js

@@ -0,0 +1,29 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android profile identity.
+//
+// A single canonical profile id ("android") is used for all Android Gradle
+// projects. Application vs. library vs. Compose-vs-XML/View distinctions are
+// represented as classification data on AndroidDetectionResult (see
+// detection.ts), not as separate profile ids — this keeps the public profile
+// surface minimal, per the batch's "no unnecessary user-facing aliases" rule.
+// ---------------------------------------------------------------------------
+export const ANDROID_PLATFORM = "android";
+export const ANDROID_PROFILE_ID = "android";
+export function createAndroidProfile(partial) {
+    return {
+        id: ANDROID_PROFILE_ID,
+        displayName: "Android",
+        platform: ANDROID_PLATFORM,
+        projectType: partial.projectType,
+        projectSubtype: partial.projectSubtype,
+        profileVersion: partial.profileVersion,
+        detectionConfidence: partial.detectionConfidence,
+        evidence: partial.evidence ?? [],
+        unsupportedNotes: partial.unsupportedNotes ?? [],
+        supportedCapabilities: partial.supportedCapabilities ?? [],
+        limitations: partial.limitations ?? [],
+    };
+}
+export function isAndroidProfile(profile) {
+    return profile.platform === ANDROID_PLATFORM && profile.id === ANDROID_PROFILE_ID;
+}

package/dist/src/mobile/android/report/model.js

@@ -0,0 +1,135 @@
+import { androidVerdictToHumanLabel } from "../validate/androidVerdict.js";
+const GRADLE_OPERATION_CHECK_PREFIX = "android-gradle-";
+const GRADLE_METADATA_CHECK_ID = "android-gradle-metadata";
+// v0.4.1 Batch 8 — fixed check-id order for the eleven internal advanced
+// checks and four external tools (agents.txt Batch 8 sections 9.1/10.5).
+// Re-declared here (not imported from each check's checkResult.ts) to avoid
+// a report -> advancedSecurity/externalTools import-fan-out; each id is a
+// stable literal already asserted by that check's own regression tests.
+const ADVANCED_SECURITY_CHECK_ID_ORDER = [
+    "android-network-security-audit",
+    "android-backup-configuration-audit",
+    "android-release-configuration-audit",
+    "android-secret-candidates-audit",
+    "android-signing-configuration-audit",
+    "android-webview-security-audit",
+    "android-file-provider-audit",
+    "android-sensitive-storage-audit",
+    "android-sensitive-logging-audit",
+    "android-clipboard-security-audit",
+    "android-firebase-google-services-audit",
+];
+const EXTERNAL_TOOL_CHECK_ID_ORDER = ["android-semgrep-audit", "android-osv-audit", "android-lint-audit", "android-dependency-check-audit"];
+const STATIC_ANALYSIS_LIMITATIONS = [
+    "Static Android project analysis does not prove runtime behavior.",
+    "Manifests are parsed independently and are not merged.",
+    "Selected local resource references are resolved conservatively; manifest placeholders, full resource merging, and overlay precedence are not resolved.",
+    "Gradle files are not evaluated (no Groovy/Kotlin execution).",
+    "Dynamic Gradle values may remain unresolved.",
+    "Same-file duplicate Gradle assignments use first-match extraction (a known limitation — see agents.txt Batch 4/5 notes).",
+    "Optional Gradle execution is not performed unless explicitly requested via --android-gradle-operations.",
+    "A successful debug build does not prove release build, signing, runtime security, or Play readiness.",
+    "Android SDK or dependency availability may limit optional checks.",
+    "Digital Asset Links are not verified.",
+    "Domain ownership is not verified.",
+    "Current Google Play policy is not checked by this tool.",
+    "APK/AAB contents and signing are not inspected.",
+];
+function groupFindingsBySeverity(findings) {
+    const grouped = {};
+    for (const finding of findings) {
+        if (!grouped[finding.severity])
+            grouped[finding.severity] = [];
+        grouped[finding.severity].push(finding);
+    }
+    return grouped;
+}
+// Builds the report model from a complete AndroidValidationResult (Batch 5).
+export function toAndroidReportModel(result, options = {}) {
+    const permissionCount = result.manifests.reduce((sum, m) => sum + m.permissions.length, 0);
+    const componentCount = result.manifests.reduce((sum, m) => sum + m.activities.length + (m.activityAliases?.length ?? 0) + m.services.length + m.receivers.length + m.providers.length, 0);
+    const intentFilterCount = result.manifests.reduce((sum, m) => sum + [...m.activities, ...(m.activityAliases ?? []), ...m.services, ...m.receivers].reduce((s, c) => s + c.intentFilters.length, 0), 0);
+    const deepLinkCount = result.manifests.reduce((sum, m) => sum + m.deepLinks.length, 0);
+    const gradleOperationResults = result.checks.filter((c) => c.id.startsWith(GRADLE_OPERATION_CHECK_PREFIX) && c.id !== GRADLE_METADATA_CHECK_ID);
+    const gradleMetadataCheck = result.checks.find((c) => c.id === GRADLE_METADATA_CHECK_ID);
+    const checksById = new Map(result.checks.map((c) => [c.id, c]));
+    const advancedSecurityChecks = ADVANCED_SECURITY_CHECK_ID_ORDER.map((id) => checksById.get(id)).filter((c) => Boolean(c));
+    const externalToolChecks = EXTERNAL_TOOL_CHECK_ID_ORDER.map((id) => checksById.get(id)).filter((c) => Boolean(c));
+    const candidateEvidenceCount = result.checks.reduce((sum, c) => sum + (c.candidateEvidence?.length ?? 0), 0);
+    const verdict = String(result.verdict);
+    const isRealVerdict = result.verdict !== "not-calculated";
+    return {
+        executiveSummary: `Android security-validation summary for ${result.target.local.targetRoot} — ${result.manifests.length} manifest(s), ${result.checks.length} check(s), ${result.findings.length} finding(s).`,
+        metadata: {
+            tool: result.tool,
+            target: result.target,
+            profile: options.profile ?? "android",
+            requestedGradleOperations: options.requestedGradleOperations ?? [],
+            requestedExternalTools: options.requestedExternalTools ?? [],
+            externalNetworkPolicy: options.externalNetworkPolicy ?? "deny",
+            generatedAt: result.finishedAt,
+            totalDurationMs: result.durationMs,
+        },
+        detectionSummary: {
+            title: "Detection",
+            summary: result.detection.detected
+                ? `Detected (confidence: ${result.detection.confidence})`
+                : `Not detected (confidence: ${result.detection.confidence})`,
+        },
+        androidProjectSummary: { title: "Android project classification", summary: result.target.classification.projectKind },
+        uiToolkitSummary: { title: "UI toolkit classification", summary: result.target.classification.uiToolkit },
+        moduleSummary: result.detection.modules.map((m) => ({ path: m.path, kind: m.kind, uiToolkit: m.uiToolkit })),
+        manifestSummary: { title: "Manifests", summary: `${result.manifests.length} manifest(s) parsed independently (not merged)` },
+        permissionsSummary: { title: "Permissions", summary: `${permissionCount} declared permission(s) across all manifests` },
+        componentSummary: { title: "Components", summary: `${componentCount} component(s) across all manifests` },
+        intentFilterSummary: { title: "Intent filters", summary: `${intentFilterCount} intent-filter(s) across all manifests` },
+        deepLinkSummary: { title: "Deep links", summary: `${deepLinkCount} deep-link data entr(y/ies) across all manifests` },
+        gradleMetadataSummary: {
+            title: "Static Gradle metadata",
+            summary: `${result.gradle.modules.length} module(s); confidence: ${result.gradle.metadataConfidence}`,
+        },
+        gradleCheckSummary: gradleMetadataCheck ? { title: "Gradle metadata check", summary: `status: ${gradleMetadataCheck.status}` } : undefined,
+        gradleOperationResults,
+        advancedSecurityChecks,
+        externalToolChecks,
+        candidateEvidenceSummary: {
+            title: "Candidate evidence (review required, not confirmed findings)",
+            summary: `${candidateEvidenceCount} candidate evidence item(s) across all checks`,
+        },
+        releaseMetadataSummary: {
+            title: "Release metadata",
+            summary: result.releaseMetadata
+                ? result.releaseMetadata.applicationModuleSelectionNote
+                : result.releaseMetadataSummary.note,
+        },
+        playReadinessSummary: {
+            title: "Play readiness",
+            summary: result.playReadiness ? result.playReadiness.note : result.playReadinessSummary.note,
+        },
+        playReadinessItems: result.playReadiness?.items.map((i) => ({ id: i.id, title: i.title, status: i.status, detail: i.detail })) ?? [],
+        findingsBySeverity: groupFindingsBySeverity(result.findings),
+        checks: result.checks,
+        skippedChecks: result.skippedChecks,
+        environmentLimitations: result.target.environmentCapabilities.notes,
+        targetMutationSummary: {
+            title: "Target mutation evidence",
+            summary: result.targetMutationEvidence
+                ? result.targetMutationEvidence.comparable
+                    ? `${result.targetMutationEvidence.unexpectedChanges.length} unexpected change(s), ${result.targetMutationEvidence.expectedGeneratedChanges.length} expected generated output(s)`
+                    : `unavailable: ${result.targetMutationEvidence.reason ?? "unknown reason"}`
+                : "not captured",
+        },
+        staticAnalysisLimitations: STATIC_ANALYSIS_LIMITATIONS,
+        verdict,
+        verdictHumanLabel: isRealVerdict ? androidVerdictToHumanLabel(result.verdict) : "not calculated",
+        verdictReasons: result.verdictReasons ?? [],
+        recommendedNextStep: result.recommendedNextStep ?? "",
+        linkedArtifactReferences: result.reportReferences,
+    };
+}
+// Minimal deterministic JSON serializer — object literals above are built
+// with a fixed key order, so equivalent inputs always serialize identically
+// (JSON.stringify preserves string-key insertion order).
+export function serializeAndroidReportModel(model) {
+    return JSON.stringify(model, null, 2);
+}