@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/README.md

@@ -1,78 +1,27 @@
 # my-dev-kit-lab
 
-my-dev-kit-lab is the experiment, evidence, reporting, visualization, and security-validation companion for my-dev-kit. It provides controlled raw-full-file versus graph-guided retrieval experiments, deterministic fake-agent demonstrations, reports, plots, gallery artifacts, generic audits, and local security-validation workflows.
+my-dev-kit-lab is the experiment, evidence, reporting, visualization, audit, and security-validation companion for my-dev-kit. It provides controlled retrieval experiments, deterministic demonstrations, reports, plots, galleries, generic audits, and local security-validation workflows.
 
-The current published baseline is `v0.3.4`. The v0.4.0 Android validation implementation is release-prepared on `release/v0.4.0`; publication is pending. It is not published, and the npm registry latest version remains `0.3.4`.
+## Version state
 
-## Current capabilities
-
-- Controlled experiment plugins, reports, plots, screenshots, and gallery artifacts.
-- Generic code-rot and general security audit types through `npm run audit`.
-- Standalone CLI/package security validation through `npm run security:validate`.
-- Android security validation through the canonical `android` profile on the v0.4.0 feature branch.
+`v0.4.1` is the published baseline, with the advanced Android implementation released. `v0.4.0` is the previous published baseline. `v0.4.2` remains future work.
 
 ## Android validation
 
-Run static Android validation with:
-
 ```powershell
 npm run security:validate -- --target "<android-project-path>" --profile android
 ```
 
-This default path executes **no Gradle commands**. It detects/classifies Android projects and UI evidence, parses discovered manifests independently, audits permissions/exported components/intent filters/deep links, extracts static Gradle metadata, assembles release metadata and Play-readiness placeholders, calculates an Android verdict, and writes bounded text and JSON reports.
-
-Reports use the existing `reports/security/` root unless `--out` is supplied. Android report files use the `<prefix>-android-security-validation.txt` and `.json` convention.
-
-Optional Gradle validation is explicit:
-
-```powershell
-npm run security:validate -- --target "<android-project-path>" --profile android --android-gradle-operations wrapper-version,tasks
-```
-
-The only allowed operation IDs are:
-
-- `wrapper-version`
-- `tasks`
-- `assemble-debug`
-- `unit-test-debug`
-- `lint-debug`
+The default Android profile runs nineteen checks: the original eight checks plus eleven advanced internal checks for Network Security Config, backup/data extraction, release configuration, secret candidates, signing configuration, WebView, FileProvider, sensitive storage, sensitive logging, clipboard, and Firebase/Google services. It runs zero Gradle operations, zero external tools, and zero network operations by default.
 
-Unknown or empty lists, arbitrary tasks, and use with a non-Android profile are rejected. Optional operations can require Java, Android SDK components, wrapper distributions, and cached dependencies; environment gaps can produce skipped or inconclusive evidence.
+`SecurityFinding` records confirmed conservative evidence. `CandidateEvidence` remains separate review or unresolved evidence and is not a confirmed vulnerability. Text and JSON reports under `reports/security/` include advanced-security checks, external-tool results, candidate-evidence summaries, artifacts, mutation evidence, verdict reasons, and limitations.
 
-### Verdicts
-
-- `not-ready-security-blocker-remains`: a blocker remains.
-- `inconclusive-audit-environment-incomplete`: required evidence/environment is incomplete.
-- `ready-except-optional-manual-checks`: advisory or manual follow-up remains.
-- `ready-for-release-preparation`: required static evidence passed.
-
-These are validation-evidence states, not claims that an app is published, Play-ready, Play-compliant, runtime-secure, or signing-valid.
-
-### Important Android limitations
-
-- Static analysis does not prove runtime behavior.
-- Manifests are not merged; placeholders and resource references are not resolved.
-- Gradle scripts are not evaluated; dynamic metadata can stay unresolved; same-file duplicate assignment extraction uses the first match.
-- Optional Gradle execution is disabled by default and environment-dependent.
-- APK/AAB contents, signing, emulator/device behavior, Digital Asset Links, domain ownership, and live Google Play policy are not validated.
-- Play Console items such as privacy policy, Data Safety, permissions declarations, store listing, release notes, content rating, and policy review remain manual placeholders.
-
-## Development
-
-```powershell
-npm run typecheck
-npm run build
-npm run test
-npm run verify
-```
+Optional Gradle operations use `--android-gradle-operations` and only accept `wrapper-version`, `tasks`, `assemble-debug`, `unit-test-debug`, and `lint-debug`. They are environment-dependent, record mutations, and never perform cleanup or arbitrary tasks.
 
-Use `npm run security:validate -- --help` for command usage. Help does not run validation or write reports.
+Optional external tools use `--android-external-tools semgrep,osv,android-lint,dependency-check`. Network defaults to `--android-external-network deny`; `allow-requested` authorizes only requested supported network-capable tools. Semgrep uses package-owned local rules, Android Lint reuses the closed offline Gradle path, Dependency-Check disables updates, and OSV requires explicit network authorization. Tools are never installed automatically; unavailable requested tools are skipped or inconclusive, not clean passes.
 
-## Roadmap status
+Verdicts are `not-ready-security-blocker-remains`, `inconclusive-audit-environment-incomplete`, `ready-except-optional-manual-checks`, and `ready-for-release-preparation`. They are evidence states, not runtime, Play, publication, or pentest guarantees.
 
-- `v0.4.0`: Android validation MVP — release-prepared; publication pending.
-- `v0.4.1`: planned advanced Android security checks.
-- `v0.4.2`: planned Android extension of the existing security audit adapter; it will not replace `security:validate`.
-- Manual pentest: deferred post-v1 / version TBD; not part of v0.4.x.
+Selected local references such as supported `@xml` resources are resolved conservatively. Manifests are not merged, full overlay precedence and Gradle evaluation are not implemented, whole-program flow is not performed, and APK/AAB, signing, emulator/device, remote Firebase, live Play policy, and manual pentest validation remain outside scope.
 
-See [docs/PROJECT_OVERVIEW.md](docs/PROJECT_OVERVIEW.md), [docs/COMMANDS.md](docs/COMMANDS.md), [docs/WORKFLOWS.md](docs/WORKFLOWS.md), [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), and [docs/ROADMAP.md](docs/ROADMAP.md).
+See [Project overview](docs/PROJECT_OVERVIEW.md), [Commands](docs/COMMANDS.md), [Workflows](docs/WORKFLOWS.md), [Architecture](docs/ARCHITECTURE.md), and [Roadmap](docs/ROADMAP.md).

package/dist/scripts/security/validate.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import path from "node:path";
 import { runSecurityValidation } from "../../src/securityValidation/validate/runSecurityValidation.js";
 import { resolveValidationTarget, reportFilenamePrefix } from "../../src/securityValidation/validate/resolveTarget.js";
 import { buildSecurityReportFromSummary } from "../../src/securityValidation/report/buildSecurityReport.js";
@@ -15,18 +16,35 @@ import { writeAndroidReportFiles } from "../../src/mobile/android/report/writeAn
 const USAGE = "Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>] " +
     "[--checks deps,package,static,cli-adversarial,fuzz,boundary,subprocess,secrets,network] " +
     "[--profile node-cli-package|local-tool|npm-package|android] [--format text,json] [--fail-on blocker|high|medium|low] " +
-    "[--android-gradle-operations wrapper-version,tasks,assemble-debug,unit-test-debug,lint-debug]\n" +
+    "[--android-gradle-operations wrapper-version,tasks,assemble-debug,unit-test-debug,lint-debug] " +
+    "[--android-external-tools semgrep,osv,android-lint,dependency-check] " +
+    "[--android-external-network deny|allow-requested]\n" +
     "\n" +
     "Android profile:\n" +
     "  --profile android performs static, read-only Android project detection, manifest parsing,\n" +
-    "  permission/exported-component/intent-filter/deep-link audits, and static Gradle metadata\n" +
-    "  extraction. Gradle is never executed by default.\n" +
+    "  permission/exported-component/intent-filter/deep-link audits, static Gradle metadata\n" +
+    "  extraction, and (as of v0.4.1 Batch 8) eleven internal advanced security checks (network\n" +
+    "  security config, backup/release configuration, hardcoded secrets, signing configuration,\n" +
+    "  WebView, FileProvider, sensitive storage/logging, clipboard, and Firebase/Google services).\n" +
+    "  Gradle and external tools are never executed by default.\n" +
     "  --android-gradle-operations explicitly opts into running ONLY the listed allowlisted Gradle\n" +
     "  operations (wrapper-version, tasks, assemble-debug, unit-test-debug, lint-debug) via the\n" +
     "  project's own Gradle wrapper. Arbitrary Gradle tasks cannot be passed. This option is only\n" +
     "  valid together with --profile android.\n" +
+    "  --android-external-tools explicitly opts into running ONLY the listed allowlisted optional\n" +
+    "  external security tools (semgrep, osv, android-lint, dependency-check). No arbitrary tool\n" +
+    "  names, commands, or arguments can be passed. This option is only valid together with\n" +
+    "  --profile android.\n" +
+    "  --android-external-network controls whether a requested tool may use network access.\n" +
+    "  Defaults to deny (osv is skipped unless supported offline data is available; semgrep,\n" +
+    "  android-lint, and dependency-check always run offline/no-update regardless of this flag).\n" +
+    "  allow-requested authorizes network only for an explicitly requested tool whose Batch 7\n" +
+    "  contract supports it (currently only osv). This option is only valid together with\n" +
+    "  --profile android.\n" +
     "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-gradle-operations wrapper-version,tasks";
+    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-gradle-operations wrapper-version,tasks\n" +
+    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-external-tools semgrep,android-lint\n" +
+    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-external-tools osv --android-external-network allow-requested";
 // Parse CLI arguments from process.argv (after the node/tsx and script path).
 const rawArgs = process.argv.slice(2);
 const toolRoot = resolveToolRoot(import.meta.url);
@@ -99,13 +117,27 @@ if (config.profile === "android") {
     else {
         console.log(`Gradle ops : (none requested — static-only validation, zero Gradle process execution)`);
     }
+    // v0.4.1 Batch 8 — external tools remain explicit opt-in, mirroring Gradle
+    // operations exactly. "allow-requested" (the CLI-facing value) maps to the
+    // Batch 7 dispatcher's "allow-for-requested-tool" network policy value.
+    const externalNetworkPolicy = config.androidExternalNetworkPolicy === "allow-requested" ? "allow-for-requested-tool" : "deny";
+    if (config.androidExternalToolIds.length > 0) {
+        console.log(`External   : ${config.androidExternalToolIds.join(", ")} (explicitly requested — network policy: ${config.androidExternalNetworkPolicy})`);
+    }
+    else {
+        console.log(`External   : (none requested — zero external-tool process execution)`);
+    }
     console.log("");
+    const reportsDir = config.out;
     let result;
     try {
         result = await validateAndroidTarget({
             toolRoot,
             targetPath: args.target,
             requestedGradleOperationIds: config.androidGradleOperationIds,
+            requestedExternalToolIds: config.androidExternalToolIds,
+            externalNetworkPolicy: externalNetworkPolicy,
+            externalToolArtifactRoot: path.join(reportsDir, "external-tools"),
         });
     }
     catch (err) {
@@ -117,9 +149,10 @@ if (config.profile === "android") {
     const reportModel = toAndroidReportModel(result, {
         profile: config.profile,
         requestedGradleOperations: config.androidGradleOperationIds,
+        requestedExternalTools: config.androidExternalToolIds,
+        externalNetworkPolicy: config.androidExternalNetworkPolicy,
     });
     const textReport = renderAndroidTextReport(reportModel);
-    const reportsDir = config.out;
     const prefix = args.reportPrefix ??
         reportFilenamePrefix({
             isSelf: result.target.local.isSelf,

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/analyzeBackupConfiguration.js

@@ -0,0 +1,300 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractManifestBackupEvidence } from "./manifestEvidence.js";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+// A conservative, narrow "broad inclusion" signal: the entire root, or an
+// entire sensitive domain with no path narrowing ("." — the whole domain).
+function isBroadInclude(rule) {
+    if (rule.kind !== "include" || rule.malformed)
+        return false;
+    if (rule.domain === "root" || rule.domain === "device_root")
+        return true;
+    const sensitiveDomains = new Set(["sharedpref", "database", "external", "device_sharedpref", "device_database", "device_external"]);
+    return rule.domain !== undefined && sensitiveDomains.has(rule.domain) && rule.path === ".";
+}
+function analyzeRuleEntries(rules, ruleId, scopeLabel, sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath) {
+    const candidates = [];
+    const evidenceText = [];
+    let hasBroadInclude = false;
+    for (const rule of rules) {
+        const location = loc(targetRoot, sourceAbsolutePath, { line: rule.location.line, column: rule.location.column });
+        if (rule.malformed) {
+            candidates.push(makeCandidateEvidence({
+                ruleId,
+                category: "android-backup-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Malformed ${scopeLabel} rule: ${rule.malformedReason}`,
+                rawValue: `${rule.domainRaw ?? ""} ${rule.path ?? ""}`.trim(),
+                resolutionState: "malformed",
+            }));
+            continue;
+        }
+        if (rule.domain === undefined) {
+            candidates.push(makeCandidateEvidence({
+                ruleId,
+                category: "android-backup-configuration",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Unsupported backup domain value in ${scopeLabel}: "${rule.domainRaw}"`,
+                rawValue: rule.domainRaw,
+                resolutionState: "unsupported",
+            }));
+            continue;
+        }
+        if (rule.kind === "exclude") {
+            evidenceText.push(`${sourceRelativePath}: ${scopeLabel} restrictive exclusion — domain=${rule.domain}, path=${rule.path}`);
+            continue;
+        }
+        if (isBroadInclude(rule)) {
+            hasBroadInclude = true;
+            candidates.push(makeCandidateEvidence({
+                ruleId,
+                category: "android-backup-configuration",
+                confidence: "medium",
+                modulePath,
+                location,
+                summary: `Broad ${scopeLabel} inclusion: domain=${rule.domain}, path=${rule.path}`,
+                rawValue: `${rule.domain}:${rule.path}`,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [
+                    "Domain/path naming is conservative evidence only; it does not prove the included data is actually sensitive or that a backup is ever performed.",
+                ],
+            }));
+        }
+    }
+    return { candidates, evidenceText, hasBroadInclude };
+}
+function analyzeBackupRulesParseResult(parseResult, ruleId, sourceRelativePath, targetRoot, modulePath) {
+    const sourceAbsolutePath = path.join(targetRoot, sourceRelativePath);
+    if (parseResult.state === "malformed-xml") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId,
+                    category: "android-backup-configuration",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, sourceAbsolutePath, parseResult.location ? { line: parseResult.location.line, column: parseResult.location.column } : undefined),
+                    summary: `Referenced backup rules file is malformed XML: ${parseResult.reason}`,
+                    rawValue: parseResult.reason,
+                    resolutionState: "malformed",
+                }),
+            ],
+            evidenceText: [],
+            hasBroadCloudOrLegacyInclude: false,
+        };
+    }
+    if (parseResult.state === "unsupported-root") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId,
+                    category: "android-backup-configuration",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, sourceAbsolutePath),
+                    summary: `Referenced XML file has an unsupported root element <${parseResult.rootTagName}>`,
+                    rawValue: parseResult.rootTagName,
+                    resolutionState: "unsupported",
+                }),
+            ],
+            evidenceText: [],
+            hasBroadCloudOrLegacyInclude: false,
+        };
+    }
+    if (parseResult.state === "parsed-full-backup-content") {
+        const result = analyzeRuleEntries(parseResult.model.rules, ruleId, "full-backup-content", sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath);
+        return { candidates: result.candidates, evidenceText: result.evidenceText, hasBroadCloudOrLegacyInclude: result.hasBroadInclude };
+    }
+    // parsed-data-extraction-rules
+    const cloudResult = parseResult.model.cloudBackup
+        ? analyzeRuleEntries(parseResult.model.cloudBackup.rules, ruleId, "cloud-backup", sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath)
+        : { candidates: [], evidenceText: [], hasBroadInclude: false };
+    const transferResult = parseResult.model.deviceTransfer
+        ? analyzeRuleEntries(parseResult.model.deviceTransfer.rules, ruleId, "device-transfer", sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath)
+        : { candidates: [], evidenceText: [], hasBroadInclude: false };
+    // Device-transfer broadness stays a review candidate only — it is local
+    // device-to-device transfer, not cloud exfiltration, so it never
+    // contributes to the allowBackup-level "major" escalation.
+    return {
+        candidates: [...cloudResult.candidates, ...transferResult.candidates],
+        evidenceText: [...cloudResult.evidenceText, ...transferResult.evidenceText],
+        hasBroadCloudOrLegacyInclude: cloudResult.hasBroadInclude,
+    };
+}
+function analyzeXmlReferenceEvidence(evidence, ruleId, targetRoot, manifestAbsolutePath, modulePath, applicationLocation) {
+    switch (evidence.state) {
+        case "absent":
+            return { candidates: [], evidenceText: [], hasBroadInclude: false };
+        case "resolved": {
+            const result = analyzeBackupRulesParseResult(evidence.parseResult, ruleId, evidence.candidate.relativePath, targetRoot, modulePath);
+            return { candidates: result.candidates, evidenceText: result.evidenceText, hasBroadInclude: result.hasBroadCloudOrLegacyInclude };
+        }
+        case "ambiguous": {
+            const candidates = [
+                makeCandidateEvidence({
+                    ruleId,
+                    category: "android-backup-configuration",
+                    confidence: "low",
+                    modulePath,
+                    location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                    summary: `Backup rules reference "${evidence.raw}" resolved to ${evidence.candidates.length} ambiguous candidates across source sets; no candidate was arbitrarily selected`,
+                    rawValue: evidence.raw,
+                    resolutionState: "unresolved",
+                }),
+            ];
+            let hasBroadInclude = false;
+            for (const candidate of evidence.candidates) {
+                const result = analyzeBackupRulesParseResult(candidate.parseResult, ruleId, candidate.candidate.relativePath, targetRoot, modulePath);
+                candidates.push(...result.candidates);
+                hasBroadInclude = hasBroadInclude || result.hasBroadCloudOrLegacyInclude;
+            }
+            return { candidates, evidenceText: [], hasBroadInclude };
+        }
+        case "missing":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: `Backup rules reference "${evidence.raw}" did not resolve to any file in the searched source sets`,
+                        rawValue: evidence.raw,
+                        resolutionState: "missing",
+                        staticAnalysisLimitations: ["A missing referenced rules file is not automatically a vulnerability; runtime behavior cannot be proven statically."],
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+        case "placeholder":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: "Backup rules reference is an unresolved build-time placeholder",
+                        rawValue: evidence.raw,
+                        resolutionState: "unresolved",
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+        case "malformed":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: `Backup rules reference is malformed: ${evidence.reason}`,
+                        rawValue: evidence.raw,
+                        resolutionState: "malformed",
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+        case "unsupported-type":
+        case "package-qualified":
+        case "module-unknown":
+            return {
+                candidates: [
+                    makeCandidateEvidence({
+                        ruleId,
+                        category: "android-backup-configuration",
+                        confidence: "low",
+                        modulePath,
+                        location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+                        summary: evidence.state === "module-unknown"
+                            ? "Backup rules reference could not be resolved because this manifest's module could not be determined"
+                            : `Backup rules reference is not a resolvable target-contained @xml/... resource (${evidence.state})`,
+                        rawValue: evidence.raw,
+                        resolutionState: "unsupported",
+                    }),
+                ],
+                evidenceText: [],
+                hasBroadInclude: false,
+            };
+    }
+}
+// Analyzes one already-parsed manifest's backup/data-extraction evidence.
+// Standalone until a later integration batch.
+export function analyzeManifestBackupConfiguration(targetRoot, entry) {
+    const evidence = extractManifestBackupEvidence(targetRoot, entry);
+    const candidates = [];
+    const findings = [];
+    const evidenceText = [];
+    const modulePath = entry.modulePath;
+    const manifestAbsolutePath = path.join(targetRoot, entry.manifestPath);
+    const applicationLocation = evidence.applicationLocation;
+    let hasBroadInclude = false;
+    // fullBackupContent — legacy literal states never touch the resource
+    // resolver/parser (there is no file to analyze).
+    const fullBackupContent = evidence.fullBackupContent;
+    if (fullBackupContent.state === "legacy-literal-true" || fullBackupContent.state === "legacy-literal-false") {
+        evidenceText.push(`${entry.manifestPath}: fullBackupContent is a legacy literal (${fullBackupContent.raw})`);
+    }
+    else {
+        const result = analyzeXmlReferenceEvidence(fullBackupContent, "android-backup-full-backup-content", targetRoot, manifestAbsolutePath, modulePath, applicationLocation);
+        candidates.push(...result.candidates);
+        evidenceText.push(...result.evidenceText);
+        hasBroadInclude = hasBroadInclude || result.hasBroadInclude;
+    }
+    const dataExtractionResult = analyzeXmlReferenceEvidence(evidence.dataExtractionRules, "android-backup-data-extraction-rules", targetRoot, manifestAbsolutePath, modulePath, applicationLocation);
+    candidates.push(...dataExtractionResult.candidates);
+    evidenceText.push(...dataExtractionResult.evidenceText);
+    hasBroadInclude = hasBroadInclude || dataExtractionResult.hasBroadInclude;
+    // allowBackup analysis — the only source of an actual SecurityFinding in
+    // this analyzer (agents.txt Batch 3 section 9.7/9.17).
+    if (evidence.allowBackup.state === "explicit-true") {
+        findings.push(makeAndroidFinding({
+            ruleId: "android-backup-allow-backup",
+            title: hasBroadInclude
+                ? "Application allows backup with a broad backup-rule inclusion"
+                : "Application manifest explicitly permits backup (android:allowBackup=\"true\")",
+            severity: hasBroadInclude ? "major" : "minor",
+            confidence: hasBroadInclude ? "high" : "medium",
+            description: hasBroadInclude
+                ? "The manifest sets android:allowBackup=\"true\" and the resolved backup rules include a broad root/domain inclusion with no narrowing. This is high-confidence static evidence of a broad backup surface; it does not prove any specific file is actually backed up or that backup ever runs."
+                : "The manifest sets android:allowBackup=\"true\" with no broad-rule evidence found. This alone is not a vulnerability — it is the platform's own default behavior when the attribute is unset on old targetSdk versions, and is a common, legitimate configuration.",
+            manifestPath: entry.manifestPath,
+            location: applicationLocation,
+            evidenceDetails: [`source=manifest-attribute`, `broadRuleEvidence=${hasBroadInclude}`],
+            recommendation: hasBroadInclude
+                ? "Narrow the backup rules to exclude sensitive domains, or set android:allowBackup=\"false\" if backup is not required."
+                : "Review whether backup should remain enabled and whether backup rules narrow the included data appropriately.",
+        }));
+    }
+    else if (evidence.allowBackup.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-backup-allow-backup",
+            category: "android-backup-configuration",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, applicationLocation),
+            summary: "android:allowBackup has an unresolved or malformed value",
+            rawValue: evidence.allowBackup.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (evidence.allowBackup.state === "explicit-false") {
+        evidenceText.push(`${entry.manifestPath}: allowBackup is explicitly false (restrictive)`);
+    }
+    return { evidence, candidates, findings, evidenceText };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/checkResult.js

@@ -0,0 +1,41 @@
+import { buildAndroidManifestCheckResult } from "../../audit/checkResultBuilder.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeManifestBackupConfiguration } from "./analyzeBackupConfiguration.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — standalone Android backup/data-extraction check result.
+//
+// Reuses the existing manifest-audit status-decision policy
+// (buildAndroidManifestCheckResult), mirroring Batch 2's checkResult.ts.
+// Standalone: not called from validateAndroidTarget / any active
+// orchestration, not rendered in reports, no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_BACKUP_CONFIGURATION_AUDIT_CHECK_ID = "android-backup-configuration-audit";
+export function auditAndroidBackupConfiguration(targetRoot, detection, manifests) {
+    const findings = [];
+    const candidateEvidence = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const result = analyzeManifestBackupConfiguration(targetRoot, entry);
+        findings.push(...result.findings);
+        candidateEvidence.push(...result.candidates);
+        evidence.push(`${entry.manifestPath}: allowBackup=${result.evidence.allowBackup.state}, fullBackupContent=${result.evidence.fullBackupContent.state}, dataExtractionRules=${result.evidence.dataExtractionRules.state}`, ...result.evidenceText);
+    }
+    const base = buildAndroidManifestCheckResult({
+        id: ANDROID_BACKUP_CONFIGURATION_AUDIT_CHECK_ID,
+        category: "android-backup-configuration",
+        title: "Android backup and data-extraction configuration audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not evaluate Gradle manifest merging, Android resource overlays, or whether a backup actually occurs at runtime.",
+        ],
+    });
+    return {
+        ...base,
+        candidateEvidence: sortCandidateEvidence(candidateEvidence),
+    };
+}

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/index.js

@@ -0,0 +1,8 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 3 — public exports for the standalone Android backup/data-
+// extraction audit. Mirrors Batch 2's networkSecurity/index.ts convention.
+// ---------------------------------------------------------------------------
+export { parseBackupRules } from "./parseBackupRules.js";
+export { extractManifestBackupEvidence } from "./manifestEvidence.js";
+export { analyzeManifestBackupConfiguration } from "./analyzeBackupConfiguration.js";
+export { auditAndroidBackupConfiguration, ANDROID_BACKUP_CONFIGURATION_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/backupConfiguration/manifestEvidence.js

@@ -0,0 +1,102 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { parseAndroidResourceReference } from "../resourceReference.js";
+import { resolveAndroidXmlResourceReference } from "../resourceResolution.js";
+import { parseBackupRules } from "./parseBackupRules.js";
+function classifyBooleanAttribute(value, raw) {
+    if (value === true)
+        return { state: "explicit-true", raw: raw ?? "true" };
+    if (value === false)
+        return { state: "explicit-false", raw: raw ?? "false" };
+    if (raw !== undefined)
+        return { state: "malformed", raw };
+    return { state: "missing" };
+}
+function parseBackupRulesFile(absolutePath) {
+    let xmlText;
+    try {
+        xmlText = readFileSync(absolutePath, "utf8");
+    }
+    catch (error) {
+        return { state: "malformed-xml", reason: error instanceof Error ? error.message : "Unable to read the resolved backup rules file" };
+    }
+    return parseBackupRules(xmlText);
+}
+function classifyResolution(raw, resolution, targetRoot) {
+    switch (resolution.state) {
+        case "resolved": {
+            const candidate = resolution.candidates[0];
+            return {
+                state: "resolved",
+                raw,
+                modulePath: resolution.modulePath,
+                candidate,
+                parseResult: parseBackupRulesFile(path.join(targetRoot, candidate.relativePath)),
+            };
+        }
+        case "ambiguous":
+            return {
+                state: "ambiguous",
+                raw,
+                modulePath: resolution.modulePath,
+                candidates: resolution.candidates.map((candidate) => ({
+                    candidate,
+                    parseResult: parseBackupRulesFile(path.join(targetRoot, candidate.relativePath)),
+                })),
+            };
+        case "missing":
+            return { state: "missing", raw, modulePath: resolution.modulePath, searchedSourceSets: resolution.searchedSourceSets };
+        case "malformed-reference":
+            return { state: "malformed", raw, reason: resolution.reason };
+        case "unsupported-reference":
+            // Unreachable in practice — see Batch 2's manifestEvidence.ts for the
+            // identical rationale (this function only calls the resolver once a
+            // "parsed" xml-type reference is confirmed).
+            return { state: "unsupported-type", raw, resourceType: "type" in resolution.parsed ? resolution.parsed.type : "unknown" };
+    }
+}
+function classifyXmlReference(targetRoot, entry, raw) {
+    if (raw === undefined)
+        return { state: "absent" };
+    const parsedRef = parseAndroidResourceReference(raw);
+    if (parsedRef.state === "placeholder")
+        return { state: "placeholder", raw };
+    if (parsedRef.state === "malformed")
+        return { state: "malformed", raw, reason: parsedRef.reason };
+    if (parsedRef.state === "empty")
+        return { state: "malformed", raw, reason: "Reference is empty" };
+    if (parsedRef.state === "unsupported-type")
+        return { state: "unsupported-type", raw, resourceType: parsedRef.type };
+    if (parsedRef.state === "package-qualified")
+        return { state: "package-qualified", raw, packageQualifier: parsedRef.packageQualifier };
+    if (entry.modulePath === undefined)
+        return { state: "module-unknown", raw };
+    const moduleAbsolutePath = path.join(targetRoot, entry.modulePath);
+    const resolution = resolveAndroidXmlResourceReference(targetRoot, moduleAbsolutePath, raw);
+    return classifyResolution(raw, resolution, targetRoot);
+}
+function classifyFullBackupContent(targetRoot, entry) {
+    const raw = entry.manifest.application.fullBackupContentRef;
+    if (raw === "true")
+        return { state: "legacy-literal-true", raw };
+    if (raw === "false")
+        return { state: "legacy-literal-false", raw };
+    return classifyXmlReference(targetRoot, entry, raw);
+}
+// Extracts and classifies backup/data-extraction/debuggable/testOnly
+// evidence for one already-parsed manifest. `targetRoot` must be the
+// absolute Android target root.
+export function extractManifestBackupEvidence(targetRoot, entry) {
+    const app = entry.manifest.application;
+    return {
+        manifestPath: entry.manifestPath,
+        modulePath: entry.modulePath,
+        sourceSetKind: entry.sourceSetKind,
+        applicationLocation: app.location,
+        allowBackup: classifyBooleanAttribute(app.allowBackup, app.allowBackupRaw),
+        debuggable: classifyBooleanAttribute(app.debuggable, app.debuggableRaw),
+        testOnly: classifyBooleanAttribute(app.testOnly, app.testOnlyRaw),
+        fullBackupContent: classifyFullBackupContent(targetRoot, entry),
+        dataExtractionRules: classifyXmlReference(targetRoot, entry, app.dataExtractionRulesRef),
+    };
+}