@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/webview/checkResult.js

@@ -0,0 +1,210 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+export const ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID = "android-webview-security-audit";
+const CALL = /(?:([A-Za-z_][\w.]*(?:\.getSettings\(\))?)\.)?(setJavaScriptEnabled|addJavascriptInterface|setAllowFileAccess|setAllowContentAccess|setAllowFileAccessFromFileURLs|setAllowUniversalAccessFromFileURLs|setMixedContentMode|setWebContentsDebuggingEnabled|loadUrl|postUrl|loadData|loadDataWithBaseURL|proceed|cancel)\s*\(([^\n)]*)\)/g;
+const PROPERTY = /([A-Za-z_][\w.]*)\.(javaScriptEnabled|allowFileAccess|allowContentAccess|allowFileAccessFromFileURLs|allowUniversalAccessFromFileURLs|mixedContentMode)\s*=\s*([^;\n}]+)/g;
+const SETTINGS_ALIAS = /(?:\bWebSettings\s+|\b(?:val|var)\s+)([A-Za-z_]\w*)\s*=\s*([A-Za-z_][\w.]*)\s*(?:\.getSettings\(\)|\.settings)/g;
+const MAX_ARGUMENT = 240;
+function lineAt(text, offset) { return text.slice(0, offset).split("\n").length; }
+// Masks comments and string *contents* while preserving offsets/newlines.
+// Calls are matched only in code; the original text is then used for the
+// bounded argument summary. This intentionally local scanner is not a Java
+// or Kotlin parser and never attempts type/provenance resolution.
+function executableMask(source) {
+    let out = "";
+    let i = 0;
+    let state = "code";
+    let quote = "";
+    while (i < source.length) {
+        const ch = source[i], next = source[i + 1];
+        if (state === "code" && ch === "/" && next === "/") {
+            out += "  ";
+            i += 2;
+            state = "line";
+            continue;
+        }
+        if (state === "code" && ch === "/" && next === "*") {
+            out += "  ";
+            i += 2;
+            state = "block";
+            continue;
+        }
+        if (state === "code" && source.slice(i, i + 3) === '\"\"\"') {
+            out += '\"\"\"';
+            i += 3;
+            state = "raw";
+            continue;
+        }
+        if (state === "code" && (ch === '"' || ch === "'")) {
+            quote = ch;
+            out += ch;
+            i++;
+            state = "quote";
+            continue;
+        }
+        if (state === "line") {
+            out += ch === "\n" ? "\n" : " ";
+            if (ch === "\n")
+                state = "code";
+            i++;
+            continue;
+        }
+        if (state === "block") {
+            out += ch === "\n" ? "\n" : " ";
+            if (ch === "*" && next === "/") {
+                out = out.slice(0, -1) + "  ";
+                i += 2;
+                state = "code";
+            }
+            else
+                i++;
+            continue;
+        }
+        if (state === "raw") {
+            if (source.slice(i, i + 3) === '\"\"\"') {
+                out += '\"\"\"';
+                i += 3;
+                state = "code";
+            }
+            else {
+                out += ch === "\n" ? "\n" : " ";
+                i++;
+            }
+            continue;
+        }
+        if (state === "quote") {
+            if (ch === "\\") {
+                out += "  ";
+                i += 2;
+                continue;
+            }
+            out += ch === "\n" ? "\n" : (ch === quote ? ch : " ");
+            if (ch === quote)
+                state = "code";
+            i++;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+function braceEnd(mask, open) { let depth = 0; for (let i = open; i < mask.length; i++) {
+    if (mask[i] === "{")
+        depth++;
+    else if (mask[i] === "}" && --depth === 0)
+        return i;
+} return mask.length; }
+function scopeRanges(mask) { const ranges = []; const header = /(?:\bfun\s+([A-Za-z_]\w*)\s*\([^)]*\)|\b(?:public|private|protected|override|static|final|suspend|void|[A-Z][\w<>?\[\]]*)[\s\w<>?\[\]]*?\s+([A-Za-z_]\w*)\s*\([^)]*\))\s*\{/g; for (const match of mask.matchAll(header)) {
+    const from = (match.index ?? 0);
+    const open = from + match[0].length - 1;
+    ranges.push({ from, to: braceEnd(mask, open), id: `${match[1] ?? match[2] ?? "scope"}@${from}` });
+} return ranges; }
+function sslRanges(mask) { const ranges = []; for (const match of mask.matchAll(/onReceivedSslError\s*\([^)]*\)\s*\{/g)) {
+    const start = (match.index ?? 0) + match[0].length - 1;
+    ranges.push([start, braceEnd(mask, start)]);
+} return ranges; }
+function literal(argument) {
+    const trimmed = argument.trim();
+    return trimmed === "true" ? "true" : trimmed === "false" ? "false" : undefined;
+}
+function finding(ruleId, title, file, line, identity, severity) {
+    return makeAndroidFinding({ ruleId, title, severity, confidence: "high", description: `${title}. This is static source evidence only and does not prove runtime execution or exploitability.`, manifestPath: file, identity, location: { line }, recommendation: "Review the configuration and keep WebView capabilities limited to documented requirements." });
+}
+function candidate(ruleId, targetRoot, file, line, summary, rawValue) {
+    return makeCandidateEvidence({ ruleId, category: "android-webview", confidence: "medium", modulePath: file.modulePath, location: buildAndroidSourceLocation(targetRoot, file.absolutePath, { line }), summary, rawValue: rawValue.slice(0, MAX_ARGUMENT), resolutionState: "resolved", staticAnalysisLimitations: ["Bounded lexical source analysis; receiver types, call ordering, and dynamic values are not resolved."] });
+}
+export function auditAndroidWebViewSecurity(targetRoot, detection) {
+    if (detection.projectKind === "non-android")
+        return { id: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, category: "android-webview", title: "Android WebView security audit", status: "unsupported", requirementLevel: "optional", ran: false, skipped: true, skipInfo: { checkId: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, reason: "Target was not detected as Android.", requirementLevel: "optional", verdictImpact: "does not apply", recommendedNextAction: "Run against an Android project." }, evidence: [], findings: [], warnings: [], errors: [], sourcePaths: [], confidence: "unknown", environmentRequirements: [], candidateEvidence: [] };
+    const discovered = discoverSecretSourceFiles(targetRoot, detection.modules.map((m) => m.path));
+    const files = discovered.files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findings = [];
+    const candidates = [];
+    for (const file of files) {
+        const mask = executableMask(file.content);
+        const ssl = sslRanges(mask);
+        const scopes = scopeRanges(mask);
+        const calls = [];
+        const contextAt = (offset) => scopes.filter((scope) => offset >= scope.from && offset <= scope.to).sort((a, b) => a.to - a.from - (b.to - b.from))[0]?.id ?? "(unresolved-scope)";
+        const aliases = new Map();
+        for (const match of mask.matchAll(SETTINGS_ALIAS))
+            aliases.set(`${contextAt(match.index ?? 0)}:${match[1]}`, match[2]);
+        const normalize = (receiver, method, context) => { const stripped = receiver.replace(/\.getSettings\(\)$|\.settings$/, ""); if (stripped !== receiver)
+            return stripped; if (method.startsWith("set") && aliases.has(`${context}:${receiver}`))
+            return aliases.get(`${context}:${receiver}`); return receiver; };
+        CALL.lastIndex = 0;
+        for (let match; (match = CALL.exec(mask));) {
+            const start = match.index;
+            const original = file.content.slice(start, start + match[0].length);
+            const argument = original.slice(original.indexOf("(") + 1, -1).slice(0, MAX_ARGUMENT);
+            const line = lineAt(file.content, start);
+            const context = contextAt(start);
+            calls.push({ receiver: normalize(match[1] ?? "(unresolved)", match[2], context), method: match[2], argument, line, context, inSslCallback: ssl.some(([from, to]) => start > from && start < to) });
+        }
+        PROPERTY.lastIndex = 0;
+        for (let match; (match = PROPERTY.exec(mask));) {
+            const start = match.index;
+            const original = file.content.slice(start, start + match[0].length);
+            const eq = original.indexOf("=");
+            const propertyToMethod = { javaScriptEnabled: "setJavaScriptEnabled", allowFileAccess: "setAllowFileAccess", allowContentAccess: "setAllowContentAccess", allowFileAccessFromFileURLs: "setAllowFileAccessFromFileURLs", allowUniversalAccessFromFileURLs: "setAllowUniversalAccessFromFileURLs", mixedContentMode: "setMixedContentMode" };
+            const method = propertyToMethod[match[2]], context = contextAt(start);
+            calls.push({ receiver: normalize(match[1], method, context), method, argument: original.slice(eq + 1).trim().slice(0, MAX_ARGUMENT), line: lineAt(file.content, start), context, inSslCallback: ssl.some(([from, to]) => start > from && start < to) });
+        }
+        for (const call of calls) {
+            const value = literal(call.argument);
+            if (call.method === "setAllowUniversalAccessFromFileURLs" && value === "true")
+                findings.push(finding("android-webview-universal-file-url-access", "WebView universal file URL access is explicitly enabled", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setMixedContentMode" && /MIXED_CONTENT_ALWAYS_ALLOW|0\b/.test(call.argument))
+                findings.push(finding("android-webview-mixed-content", "WebView mixed content is explicitly always allowed", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setWebContentsDebuggingEnabled" && value === "true" && /(?:^|\.)WebView$/.test(call.receiver))
+                findings.push(finding("android-webview-debugging-enabled", "WebView debugging is explicitly enabled", file.relativePath, call.line, call.context, "minor"));
+            else if (call.method === "proceed" && call.inSslCallback)
+                findings.push(finding("android-webview-ssl-error-proceed", "SSL error callback proceeds despite the certificate error", file.relativePath, call.line, call.context, "major"));
+            else if (call.method === "setJavaScriptEnabled" && value !== "false")
+                candidates.push(candidate("android-webview-javascript-enabled", targetRoot, file, call.line, value === "true" ? "JavaScript is explicitly enabled" : "JavaScript enablement is dynamic or unresolved", call.argument));
+            else if (["setAllowFileAccess", "setAllowContentAccess", "setAllowFileAccessFromFileURLs", "setAllowUniversalAccessFromFileURLs"].includes(call.method) && value !== "false")
+                candidates.push(candidate(call.method === "setAllowUniversalAccessFromFileURLs" ? "android-webview-universal-file-url-access" : "android-webview-file-content-access", targetRoot, file, call.line, `WebView ${call.method} is ${value === "true" ? "enabled" : "dynamic or unresolved"}`, call.argument));
+            else if (call.method === "addJavascriptInterface")
+                candidates.push(candidate("android-webview-javascript-interface-exposure", targetRoot, file, call.line, "JavaScript interface registration source evidence", call.argument));
+            else if (call.method === "setMixedContentMode" && /MIXED_CONTENT_COMPATIBILITY_MODE|1\b/.test(call.argument))
+                candidates.push(candidate("android-webview-mixed-content", targetRoot, file, call.line, "WebView mixed-content compatibility mode is configured", call.argument));
+            else if (call.method === "setMixedContentMode" && !/MIXED_CONTENT_NEVER_ALLOW|2\b/.test(call.argument))
+                candidates.push(candidate("android-webview-mixed-content", targetRoot, file, call.line, "WebView mixed-content mode is dynamic or unresolved", call.argument));
+            else if (call.method === "setWebContentsDebuggingEnabled" && value !== "false")
+                candidates.push(candidate("android-webview-debugging-enabled", targetRoot, file, call.line, "WebView debugging state is dynamic or receiver context is unresolved", call.argument));
+            else if (["loadUrl", "postUrl", "loadData", "loadDataWithBaseURL"].includes(call.method)) {
+                if (/^\s*["']javascript:/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "javascript: WebView URL loading evidence", call.argument));
+                else if (/^\s*["'](?:http|file|content):/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "WebView loads a review-oriented literal scheme", call.argument));
+                else if (!/^\s*["']https:/i.test(call.argument))
+                    candidates.push(candidate("android-webview-suspicious-url-loading", targetRoot, file, call.line, "Dynamic or unsupported WebView content loading argument", call.argument));
+            }
+        }
+        for (const [from, to] of ssl) {
+            const contained = calls.filter((call) => call.inSslCallback && call.method === "proceed" || call.inSslCallback && call.method === "cancel");
+            if (contained.length === 0)
+                candidates.push(candidate("android-webview-ssl-error-proceed", targetRoot, file, lineAt(file.content, from), mask.slice(from, Math.min(to, from + MAX_ARGUMENT)).trim() ? "SSL error callback delegates or has unresolved local behavior" : "SSL error callback is empty", file.content.slice(from, Math.min(to, from + MAX_ARGUMENT))));
+        }
+        const same = (a, b) => a.receiver !== "(unresolved)" && a.receiver === b.receiver && a.context === b.context;
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const bridge of calls.filter((c) => c.method === "addJavascriptInterface" && same(c, js)))
+                findings.push(finding("android-webview-javascript-interface-exposure", "JavaScript and addJavascriptInterface occur on the same receiver in one method", file.relativePath, bridge.line, `${js.receiver}:${js.context}`, "major"));
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const access of calls.filter((c) => ["setAllowFileAccessFromFileURLs", "setAllowUniversalAccessFromFileURLs"].includes(c.method) && literal(c.argument) === "true" && same(c, js)))
+                findings.push(finding("android-webview-file-content-access", "JavaScript and file URL access occur on the same receiver in one method", file.relativePath, access.line, `${js.receiver}:${js.context}`, "major"));
+        for (const js of calls.filter((c) => c.method === "setJavaScriptEnabled" && literal(c.argument) === "true"))
+            for (const url of calls.filter((c) => c.method === "loadUrl" && /^\s*["']javascript:/i.test(c.argument) && same(c, js)))
+                findings.push(finding("android-webview-suspicious-url-loading", "JavaScript is enabled and a javascript: URL is loaded on the same receiver", file.relativePath, url.line, `${js.receiver}:${js.context}`, "major"));
+        for (const mixed of calls.filter((c) => c.method === "setMixedContentMode" && /MIXED_CONTENT_ALWAYS_ALLOW|0\b/.test(c.argument)))
+            for (const url of calls.filter((c) => c.method === "loadUrl" && /^\s*["']http:\/\//i.test(c.argument) && same(c, mixed)))
+                findings.push(finding("android-webview-mixed-content", "Always-allowed mixed content and HTTP loading occur on the same receiver", file.relativePath, url.line, `${mixed.receiver}:${mixed.context}`, "major"));
+    }
+    const uniqueFindings = [...new Map(findings.map((item) => [item.id, item])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const uniqueCandidates = [...new Map(candidates.map((item) => [item.id, item])).values()];
+    return { id: ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID, category: "android-webview", title: "Android WebView security audit", status: uniqueFindings.length ? "failed" : "passed", requirementLevel: "required", ran: true, skipped: false, evidence: [`${files.length} Java/Kotlin file(s) scanned`], findings: uniqueFindings, warnings: [...discovered.skipped.map((item) => `${item.relativePath}: skipped (${item.reason})`), "Static analysis only: no compiler, runtime, URL provenance, or whole-program analysis was used."], errors: [], sourcePaths: files.map((file) => file.relativePath), confidence: discovered.skipped.length ? "medium" : "high", environmentRequirements: [], candidateEvidence: sortCandidateEvidence(uniqueCandidates) };
+}

package/dist/src/mobile/android/advancedSecurity/webview/index.js

@@ -0,0 +1 @@
+export { auditAndroidWebViewSecurity, ANDROID_WEBVIEW_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/gradle/moduleMetadataExtractor.js

@@ -11,7 +11,10 @@ import { extractBuildFileEvidence } from "../detect/buildFileEvidence.js";
 // excerpt" strategy for each key. Comments are stripped first so a
 // commented-out assignment never becomes active metadata (ANDROID-B4-05).
 // ---------------------------------------------------------------------------
-function stripComments(text) {
+// v0.4.1 Batch 4 — exported (was module-private) so the new signing-
+// configuration module can reuse the exact same comment-stripping/literal-
+// extraction/brace-matching technique instead of a second implementation.
+export function stripComments(text) {
     // Replaces comment characters with spaces (not empty string) so any
     // surviving line/column-independent offsets are not shifted — this batch
     // does not track per-field locations, but keeping length stable is cheap
@@ -21,7 +24,7 @@ function stripComments(text) {
         .replace(/\/\/[^\n]*/g, (match) => " ".repeat(match.length));
 }
 const STRING_OR_INT = `(?:'([^']*)'|"([^"]*)"|(-?\\d+))`;
-function extractLiteral(text, keyAlternatives) {
+export function extractLiteral(text, keyAlternatives) {
     const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
     // Anchored to the start of a line (allowing leading indentation) so a key
     // name that merely appears as a word inside an unrelated string literal —
@@ -46,32 +49,45 @@ function extractLiteral(text, keyAlternatives) {
     }
     return {};
 }
-// Finds the top-level named entries inside a `<blockKeyword> { ... }` block
-// (e.g. `buildTypes { debug { ... } release { ... } }` or
-// `sourceSets { main { ... } androidTest { ... } }`), supporting both the
-// bare-identifier Groovy/Kotlin-DSL form and the Kotlin DSL
-// getByName/create/named(...) form. Bounded by brace-depth matching, not a
-// full parser — nested unrelated blocks inside are not descended into for
-// name extraction beyond the immediate children.
-function findNamedBlockEntries(text, blockKeyword) {
+// Returns the inner text of the first `<blockKeyword> { ... }` block found,
+// bounded by brace-depth matching (not a full parser). Shared by
+// findNamedBlockEntries (names only) and extractNamedSubBlocks (v0.4.1
+// Batch 3 — names plus each entry's own block content).
+export function findBlockBody(text, blockKeyword) {
     const blockStart = text.search(new RegExp(`\\b${blockKeyword}\\s*\\{`));
     if (blockStart === -1)
-        return [];
+        return undefined;
     const openBraceIndex = text.indexOf("{", blockStart);
+    return sliceBlockAt(text, openBraceIndex);
+}
+// Given the index of an opening `{`, returns the text between it and its
+// matching `}` (brace-depth bounded), or undefined if unterminated.
+export function sliceBlockAt(text, openBraceIndex) {
+    if (text[openBraceIndex] !== "{")
+        return undefined;
     let depth = 0;
-    let endIndex = text.length;
     for (let i = openBraceIndex; i < text.length; i++) {
         if (text[i] === "{")
             depth += 1;
         else if (text[i] === "}") {
             depth -= 1;
-            if (depth === 0) {
-                endIndex = i;
-                break;
-            }
+            if (depth === 0)
+                return text.slice(openBraceIndex + 1, i);
         }
     }
-    const block = text.slice(openBraceIndex + 1, endIndex);
+    return undefined;
+}
+// Finds the top-level named entries inside a `<blockKeyword> { ... }` block
+// (e.g. `buildTypes { debug { ... } release { ... } }` or
+// `sourceSets { main { ... } androidTest { ... } }`), supporting both the
+// bare-identifier Groovy/Kotlin-DSL form and the Kotlin DSL
+// getByName/create/named(...) form. Bounded by brace-depth matching, not a
+// full parser — nested unrelated blocks inside are not descended into for
+// name extraction beyond the immediate children.
+function findNamedBlockEntries(text, blockKeyword) {
+    const block = findBlockBody(text, blockKeyword);
+    if (block === undefined)
+        return [];
     const names = new Set();
     for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
         names.add(match[1]);
@@ -81,6 +97,95 @@ function findNamedBlockEntries(text, blockKeyword) {
     }
     return [...names].sort((a, b) => a.localeCompare(b));
 }
+// v0.4.1 Batch 3 — like findNamedBlockEntries, but also returns each named
+// entry's own block content so per-build-type literal fields (debuggable,
+// minifyEnabled, etc.) can be extracted. Reuses the exact same bounded
+// brace-matching technique and the same two name-pattern forms — not a
+// second parser, just returning more of what was already being scanned.
+export function extractNamedSubBlocks(text, blockKeyword) {
+    const block = findBlockBody(text, blockKeyword);
+    if (block === undefined)
+        return [];
+    const results = [];
+    const seen = new Set();
+    for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
+        const name = match[1];
+        if (seen.has(name))
+            continue;
+        const openBraceIndex = match.index + match[0].length - 1;
+        const content = sliceBlockAt(block, openBraceIndex);
+        if (content !== undefined) {
+            results.push({ name, content });
+            seen.add(name);
+        }
+    }
+    for (const match of block.matchAll(/\b(?:getByName|create|named)\(\s*["']([\w-]+)["']\s*\)\s*\{/g)) {
+        const name = match[1];
+        if (seen.has(name))
+            continue;
+        const openBraceIndex = match.index + match[0].length - 1;
+        const content = sliceBlockAt(block, openBraceIndex);
+        if (content !== undefined) {
+            results.push({ name, content });
+            seen.add(name);
+        }
+    }
+    return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+const BOOLEAN_TOKEN = `(true|false)`;
+// v0.4.1 Batch 3 — boolean-literal counterpart to extractLiteral (which only
+// matches quoted-string/integer literals — Gradle boolean assignments like
+// `debuggable true` or `isMinifyEnabled = true` are bare tokens, not quoted).
+// Same anchoring/fallback strategy as extractLiteral for consistency.
+export function extractBooleanLiteral(text, keyAlternatives) {
+    const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const literalPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=(]?\\s*${BOOLEAN_TOKEN}\\)?`, "m");
+    const literalMatch = text.match(literalPattern);
+    if (literalMatch) {
+        return { value: literalMatch[1] === "true" };
+    }
+    const rawPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=(]?\\s*([^\\n]{1,120})`, "m");
+    const rawMatch = text.match(rawPattern);
+    if (rawMatch) {
+        const raw = rawMatch[1].trim();
+        if (raw.length > 0)
+            return { raw };
+    }
+    return {};
+}
+function booleanLiteralState(result) {
+    if (result.value !== undefined)
+        return result.value ? "literal-true" : "literal-false";
+    if (result.raw !== undefined)
+        return "dynamic";
+    return "missing";
+}
+// v0.4.1 Batch 3 — builds bounded literal evidence for one named build-type
+// block. Never evaluates Gradle; signingConfig/matchingFallbacks/initWith
+// are always reference expressions, so only a bounded raw excerpt is kept.
+function buildBuildTypeInfo(name, content) {
+    const debuggable = extractBooleanLiteral(content, ["debuggable", "isDebuggable"]);
+    const minifyEnabled = extractBooleanLiteral(content, ["minifyEnabled", "isMinifyEnabled"]);
+    const shrinkResources = extractBooleanLiteral(content, ["shrinkResources", "isShrinkResources"]);
+    const signingConfig = extractLiteral(content, ["signingConfig"]);
+    const matchingFallbacks = extractLiteral(content, ["matchingFallbacks"]);
+    const initWith = extractLiteral(content, ["initWith"]);
+    return {
+        name,
+        debuggable: debuggable.value,
+        debuggableRaw: debuggable.raw,
+        debuggableState: booleanLiteralState(debuggable),
+        minifyEnabled: minifyEnabled.value,
+        minifyEnabledRaw: minifyEnabled.raw,
+        minifyEnabledState: booleanLiteralState(minifyEnabled),
+        shrinkResources: shrinkResources.value,
+        shrinkResourcesRaw: shrinkResources.raw,
+        shrinkResourcesState: booleanLiteralState(shrinkResources),
+        signingConfigRef: signingConfig.value ?? signingConfig.raw,
+        matchingFallbacksRaw: matchingFallbacks.value ?? matchingFallbacks.raw,
+        initWithRaw: initWith.value ?? initWith.raw,
+    };
+}
 // Extracts bounded static metadata for one module's build file text. `path`
 // is intentionally omitted from the returned info — the caller (the
 // aggregator, which already knows the module path from detection) attaches
@@ -128,6 +233,7 @@ export function extractModuleGradleMetadata(rawText) {
             compileSdk: compileSdk.value,
             compileSdkRaw: compileSdk.raw,
             buildTypes: findNamedBlockEntries(text, "buildTypes"),
+            buildTypeDetails: extractNamedSubBlocks(text, "buildTypes").map(({ name, content }) => buildBuildTypeInfo(name, content)),
             composeEnabled: evidence.composeBuildFeatureEvidence || evidence.composeDependencyEvidence || undefined,
             sourceSetEvidence: findNamedBlockEntries(text, "sourceSets").map((name) => `declared sourceSet: ${name}`),
             testSourceSetEvidence: [],

package/dist/src/mobile/android/manifest/parseAndroidManifest.js

@@ -108,8 +108,17 @@ function parseComponent(kind, element, warnings) {
         component.readPermission = androidAttr(element, "readPermission");
         component.writePermission = androidAttr(element, "writePermission");
         const authoritiesRaw = androidAttr(element, "authorities");
+        component.authoritiesRaw = authoritiesRaw;
         component.authorities = authoritiesRaw ? authoritiesRaw.split(";").map((s) => s.trim()).filter(Boolean) : undefined;
-        component.grantUriPermissions = parseBooleanAttr(element, "grantUriPermissions", warnings, context).value;
+        const grantUriPermissions = parseBooleanAttr(element, "grantUriPermissions", warnings, context);
+        component.grantUriPermissions = grantUriPermissions.value;
+        component.grantUriPermissionsRaw = grantUriPermissions.raw;
+        component.metadata = findChildren(element, "meta-data").map((metadata) => ({
+            name: androidAttr(metadata, "name"),
+            resource: androidAttr(metadata, "resource"),
+            value: androidAttr(metadata, "value"),
+            location: toLocation(metadata.location),
+        }));
     }
     return component;
 }
@@ -202,6 +211,12 @@ export function parseAndroidManifestSource(xmlText, manifestPath) {
     if (applicationElements.length > 1) {
         parseWarnings.push(`Manifest declares ${applicationElements.length} <application> elements; only the first was used.`);
     }
+    const usesCleartextTrafficResult = applicationEl
+        ? parseBooleanAttr(applicationEl, "usesCleartextTraffic", parseWarnings, "<application>")
+        : undefined;
+    const allowBackupResult = applicationEl ? parseBooleanAttr(applicationEl, "allowBackup", parseWarnings, "<application>") : undefined;
+    const debuggableResult = applicationEl ? parseBooleanAttr(applicationEl, "debuggable", parseWarnings, "<application>") : undefined;
+    const testOnlyResult = applicationEl ? parseBooleanAttr(applicationEl, "testOnly", parseWarnings, "<application>") : undefined;
     const application = applicationEl
         ? {
             name: androidAttr(applicationEl, "name"),
@@ -209,10 +224,18 @@ export function parseAndroidManifestSource(xmlText, manifestPath) {
             iconRef: androidAttr(applicationEl, "icon"),
             enabled: parseBooleanAttr(applicationEl, "enabled", parseWarnings, "<application>").value,
             permission: androidAttr(applicationEl, "permission"),
-            allowBackup: parseBooleanAttr(applicationEl, "allowBackup", parseWarnings, "<application>").value,
-            debuggable: parseBooleanAttr(applicationEl, "debuggable", parseWarnings, "<application>").value,
-            usesCleartextTraffic: parseBooleanAttr(applicationEl, "usesCleartextTraffic", parseWarnings, "<application>").value,
+            allowBackup: allowBackupResult?.value,
+            allowBackupRaw: allowBackupResult?.raw,
+            debuggable: debuggableResult?.value,
+            debuggableRaw: debuggableResult?.raw,
+            usesCleartextTraffic: usesCleartextTrafficResult?.value,
+            usesCleartextTrafficRaw: usesCleartextTrafficResult?.raw,
             networkSecurityConfigRef: androidAttr(applicationEl, "networkSecurityConfig"),
+            fullBackupContentRef: androidAttr(applicationEl, "fullBackupContent"),
+            dataExtractionRulesRef: androidAttr(applicationEl, "dataExtractionRules"),
+            testOnly: testOnlyResult?.value,
+            testOnlyRaw: testOnlyResult?.raw,
+            location: toLocation(applicationEl.location),
         }
         : {};
     const activities = applicationEl ? findChildren(applicationEl, "activity").map((el) => parseComponent("activity", el, parseWarnings)) : [];

package/dist/src/mobile/android/manifest/xml/parseXml.js

@@ -92,6 +92,18 @@ class Scanner {
         }
         this.expect(literal);
     }
+    // Like skipUntil, but returns the consumed text before `literal` instead of
+    // discarding it. Used to capture CDATA section content as element text.
+    captureUntil(literal) {
+        let captured = "";
+        while (!this.eof() && !this.startsWith(literal))
+            captured += this.advance();
+        if (this.eof()) {
+            throw new XmlSyntaxError(`Unterminated construct, expected "${literal}"`, this.loc());
+        }
+        this.expect(literal);
+        return captured;
+    }
 }
 function resolveNamespace(prefix, scope) {
     return scope.get(prefix ?? "");
@@ -224,12 +236,13 @@ function parseElement(scanner, parentScope, warnings) {
     scanner.skipWhitespace();
     if (scanner.startsWith("/>")) {
         scanner.expect("/>");
-        return { tagName, prefix, localName, namespaceUri, attributes, children: [], location };
+        return { tagName, prefix, localName, namespaceUri, attributes, children: [], location, textContent: "" };
     }
     scanner.expect(">");
     const children = [];
+    const textParts = [];
     for (;;) {
-        skipTextAndMisc(scanner, warnings);
+        skipTextAndMisc(scanner, warnings, textParts);
         if (scanner.startsWith("</")) {
             scanner.expect("</");
             const closingName = readName(scanner);
@@ -251,16 +264,22 @@ function parseElement(scanner, parentScope, warnings) {
         // element/closing-tag pattern) is treated as malformed input.
         throw new XmlSyntaxError("Unexpected content while looking for a child element or closing tag", scanner.loc());
     }
-    return { tagName, prefix, localName, namespaceUri, attributes, children, location };
+    return { tagName, prefix, localName, namespaceUri, attributes, children, location, textContent: decodeXmlEntities(textParts.join("")) };
 }
-function skipTextAndMisc(scanner, warnings) {
+// v0.4.1 Batch 2 — `textParts` accumulates direct text/CDATA content so
+// callers needing element text content (e.g. Network Security Config's
+// <domain>/<pin> elements) can read it via XmlElement.textContent. Comments,
+// processing instructions, and DOCTYPE are still skipped, never counted as
+// text — only true character data and CDATA sections are captured.
+function skipTextAndMisc(scanner, warnings, textParts) {
     for (;;) {
         if (scanner.startsWith("<!--")) {
             scanner.skipUntil("-->");
             continue;
         }
         if (scanner.startsWith("<![CDATA[")) {
-            scanner.skipUntil("]]>");
+            scanner.expect("<![CDATA[");
+            textParts.push(scanner.captureUntil("]]>"));
             continue;
         }
         if (scanner.startsWith("<?")) {
@@ -271,10 +290,7 @@ function skipTextAndMisc(scanner, warnings) {
             break;
         if (scanner.eof())
             break;
-        // Plain text content between elements — not meaningful for manifest
-        // structure, so it is discarded rather than stored.
-        scanner.advance();
-        continue;
+        textParts.push(scanner.advance());
     }
 }
 // Parses `xmlText` into a small element tree. Never throws: all failures are

package/dist/src/mobile/android/report/model.js

@@ -1,10 +1,29 @@
 import { androidVerdictToHumanLabel } from "../validate/androidVerdict.js";
 const GRADLE_OPERATION_CHECK_PREFIX = "android-gradle-";
 const GRADLE_METADATA_CHECK_ID = "android-gradle-metadata";
+// v0.4.1 Batch 8 — fixed check-id order for the eleven internal advanced
+// checks and four external tools (agents.txt Batch 8 sections 9.1/10.5).
+// Re-declared here (not imported from each check's checkResult.ts) to avoid
+// a report -> advancedSecurity/externalTools import-fan-out; each id is a
+// stable literal already asserted by that check's own regression tests.
+const ADVANCED_SECURITY_CHECK_ID_ORDER = [
+    "android-network-security-audit",
+    "android-backup-configuration-audit",
+    "android-release-configuration-audit",
+    "android-secret-candidates-audit",
+    "android-signing-configuration-audit",
+    "android-webview-security-audit",
+    "android-file-provider-audit",
+    "android-sensitive-storage-audit",
+    "android-sensitive-logging-audit",
+    "android-clipboard-security-audit",
+    "android-firebase-google-services-audit",
+];
+const EXTERNAL_TOOL_CHECK_ID_ORDER = ["android-semgrep-audit", "android-osv-audit", "android-lint-audit", "android-dependency-check-audit"];
 const STATIC_ANALYSIS_LIMITATIONS = [
     "Static Android project analysis does not prove runtime behavior.",
     "Manifests are parsed independently and are not merged.",
-    "Manifest placeholders and resource references are not resolved.",
+    "Selected local resource references are resolved conservatively; manifest placeholders, full resource merging, and overlay precedence are not resolved.",
     "Gradle files are not evaluated (no Groovy/Kotlin execution).",
     "Dynamic Gradle values may remain unresolved.",
     "Same-file duplicate Gradle assignments use first-match extraction (a known limitation — see agents.txt Batch 4/5 notes).",
@@ -33,6 +52,10 @@ export function toAndroidReportModel(result, options = {}) {
     const deepLinkCount = result.manifests.reduce((sum, m) => sum + m.deepLinks.length, 0);
     const gradleOperationResults = result.checks.filter((c) => c.id.startsWith(GRADLE_OPERATION_CHECK_PREFIX) && c.id !== GRADLE_METADATA_CHECK_ID);
     const gradleMetadataCheck = result.checks.find((c) => c.id === GRADLE_METADATA_CHECK_ID);
+    const checksById = new Map(result.checks.map((c) => [c.id, c]));
+    const advancedSecurityChecks = ADVANCED_SECURITY_CHECK_ID_ORDER.map((id) => checksById.get(id)).filter((c) => Boolean(c));
+    const externalToolChecks = EXTERNAL_TOOL_CHECK_ID_ORDER.map((id) => checksById.get(id)).filter((c) => Boolean(c));
+    const candidateEvidenceCount = result.checks.reduce((sum, c) => sum + (c.candidateEvidence?.length ?? 0), 0);
     const verdict = String(result.verdict);
     const isRealVerdict = result.verdict !== "not-calculated";
     return {
@@ -42,6 +65,8 @@ export function toAndroidReportModel(result, options = {}) {
             target: result.target,
             profile: options.profile ?? "android",
             requestedGradleOperations: options.requestedGradleOperations ?? [],
+            requestedExternalTools: options.requestedExternalTools ?? [],
+            externalNetworkPolicy: options.externalNetworkPolicy ?? "deny",
             generatedAt: result.finishedAt,
             totalDurationMs: result.durationMs,
         },
@@ -65,6 +90,12 @@ export function toAndroidReportModel(result, options = {}) {
         },
         gradleCheckSummary: gradleMetadataCheck ? { title: "Gradle metadata check", summary: `status: ${gradleMetadataCheck.status}` } : undefined,
         gradleOperationResults,
+        advancedSecurityChecks,
+        externalToolChecks,
+        candidateEvidenceSummary: {
+            title: "Candidate evidence (review required, not confirmed findings)",
+            summary: `${candidateEvidenceCount} candidate evidence item(s) across all checks`,
+        },
         releaseMetadataSummary: {
             title: "Release metadata",
             summary: result.releaseMetadata