@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/checkResult.js

@@ -0,0 +1,255 @@
+import fs from "node:fs";
+import path from "node:path";
+import { makeAndroidFinding } from "../../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../../sourceLocation.js";
+import { sortCandidateEvidence } from "../../ordering.js";
+import { buildGradleCommandPlan } from "../../../gradle/validate/planner.js";
+import { captureTargetSnapshot, isExpectedAndroidGeneratedPath } from "../../../gradle/validate/targetMutation.js";
+import { buildExternalToolMutationReport, findFreshFiles } from "../mutation.js";
+import { copyExternalToolArtifactFromTarget } from "../artifacts.js";
+import { parseLintXml } from "./parseLintXml.js";
+import { parseLintSarif } from "./parseLintSarif.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — standalone Android Lint check. Reuses the existing
+// lint-debug Gradle operation as-is (its fixed args already include
+// --offline/--no-daemon/--console=plain — see operations.ts) rather than
+// creating a second Gradle task/operation system. Not called from
+// validateAndroidTarget or any active orchestration; not rendered in
+// reports; no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_LINT_AUDIT_CHECK_ID = "android-lint-audit";
+const LINT_REPORT_EXTENSIONS = [".xml", ".sarif"];
+function skippedCheck(reason, environmentRequirements = []) {
+    return {
+        id: ANDROID_LINT_AUDIT_CHECK_ID,
+        category: "android-lint",
+        title: "Android Lint audit (offline)",
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: ANDROID_LINT_AUDIT_CHECK_ID,
+            reason,
+            requirementLevel: "optional",
+            missingCapability: "gradle-lint-debug",
+            verdictImpact: "does not apply until Batch 8 integration",
+            recommendedNextAction: "Ensure a Gradle wrapper, Java, Android SDK, and cached dependencies are available, or run again after Batch 8 wires optional-tool selection into the CLI.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements,
+        candidateEvidence: [],
+    };
+}
+function severityToProject(severity) {
+    const normalized = severity.toLowerCase();
+    if (normalized === "fatal" || normalized === "error")
+        return "major";
+    if (normalized === "warning")
+        return "minor";
+    if (normalized === "information" || normalized === "informational")
+        return "informational";
+    if (normalized === "ignore")
+        return undefined;
+    return undefined;
+}
+export async function auditAndroidLint(options) {
+    const targetRoot = path.resolve(options.targetRoot);
+    if (options.taskAvailable === false) {
+        return skippedCheck("The lintDebug Gradle task was not found for this target.");
+    }
+    const plan = buildGradleCommandPlan("lint-debug", targetRoot, options.detection);
+    if (plan.rejected) {
+        return skippedCheck(plan.reason);
+    }
+    const before = captureTargetSnapshot(targetRoot, true);
+    const startedAtMs = Date.now();
+    const result = await options.executor(plan);
+    const after = captureTargetSnapshot(targetRoot, true);
+    const mutation = buildExternalToolMutationReport(before, after, isExpectedAndroidGeneratedPath);
+    const warnings = [];
+    if (!mutation.comparable)
+        warnings.push(`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`);
+    if (mutation.unexpectedChanges.length > 0)
+        warnings.push(`Unexpected target change(s) observed: ${mutation.unexpectedChanges.join(", ")}`);
+    if (result.timedOut) {
+        return {
+            id: ANDROID_LINT_AUDIT_CHECK_ID,
+            category: "android-lint",
+            title: "Android Lint audit (offline)",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`exitCode=${result.exitCode ?? "null"}`],
+            findings: [],
+            warnings: [...warnings, `lintDebug timed out after ${plan.timeoutMs}ms.`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "medium",
+            environmentRequirements: plan.environmentLimitations,
+            candidateEvidence: [],
+        };
+    }
+    if (result.exitCode === null) {
+        return skippedCheck("Gradle could not be spawned or resolved for this target (missing Java, wrapper, or environment issue).");
+    }
+    // Discover fresh (created-or-modified-by-this-run) lint report files
+    // rather than trusting a stale pre-existing report from an earlier run.
+    // A small backward epsilon absorbs filesystem mtime rounding/clock-tick
+    // granularity (observed on some Windows filesystems) without meaningfully
+    // weakening the stale-report exclusion, since a genuinely stale report is
+    // from a prior run (seconds/minutes old), not a few tens of milliseconds.
+    const FRESHNESS_EPSILON_MS = 250;
+    const freshFiles = findFreshFiles(targetRoot, LINT_REPORT_EXTENSIONS, startedAtMs - FRESHNESS_EPSILON_MS).filter((f) => /lint-results/i.test(path.basename(f)));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    const limitations = ["Reflects the debug variant lint run only; does not prove the published release variant's lint result.", "Gradle/plugin/report format may drift; unsupported report shapes are represented conservatively."];
+    const finding = (issueId, severity, title, message, relativePath, line, module) => findingsById.set(`lint:${issueId}:${relativePath ?? "(no-path)"}:${line ?? 0}`, makeAndroidFinding({
+        ruleId: "android-optional-tool-lint-evidence",
+        title,
+        severity,
+        confidence: "medium",
+        description: message || `Android Lint reported issue ${issueId}.`,
+        manifestPath: relativePath ?? "(unresolved)",
+        identity: `lint:${issueId}:${module ?? "(root)"}`,
+        location: { line },
+        evidenceDetails: [`externalRuleId=${issueId}`, module ? `module=${module}` : undefined].filter((v) => Boolean(v)),
+        recommendation: "Review the Android Lint issue and remediate or explicitly suppress it with justification.",
+    }));
+    const candidate = (issueId, summary, relativePath, line, confidence = "low") => candidatesById.set(`${issueId}:${relativePath ?? "(no-path)"}:${line ?? 0}:${summary.slice(0, 40)}`, makeCandidateEvidence({
+        ruleId: "android-optional-tool-lint-evidence",
+        category: "android-lint",
+        confidence,
+        location: relativePath ? (() => { try {
+            return buildAndroidSourceLocation(targetRoot, path.resolve(targetRoot, relativePath), { line });
+        }
+        catch {
+            return { path: relativePath, line };
+        } })() : { path: "(unknown)" },
+        summary,
+        rawValue: undefined,
+        resolutionState: "resolved",
+        staticAnalysisLimitations: limitations,
+    }));
+    const seenIssueKeys = new Set();
+    let sawAnyReport = false;
+    for (const filePath of freshFiles) {
+        const content = readFileSafe(filePath);
+        if (content === undefined)
+            continue;
+        const moduleGuess = moduleForPath(targetRoot, filePath, options.detection.modules.map((m) => m.path));
+        const artifact = copyExternalToolArtifactFromTarget(options.artifactRoot, targetRoot, "android-lint", filePath, filePath.toLowerCase().endsWith(".sarif") ? "sarif" : "xml");
+        void artifact;
+        if (filePath.toLowerCase().endsWith(".xml")) {
+            const parsedXml = parseLintXml(content);
+            if (parsedXml.malformed) {
+                warnings.push(`Malformed lint XML report: ${path.basename(filePath)}`);
+                continue;
+            }
+            sawAnyReport = true;
+            for (const issue of parsedXml.issues) {
+                const dedupeKey = `${issue.id}:${issue.file}:${issue.line}`;
+                if (seenIssueKeys.has(dedupeKey))
+                    continue;
+                seenIssueKeys.add(dedupeKey);
+                const relativePath = issue.file ? relativeIfContained(targetRoot, issue.file) : undefined;
+                const projectSeverity = severityToProject(issue.severity);
+                if (projectSeverity === "major" || projectSeverity === "minor") {
+                    finding(issue.id, projectSeverity, `Android Lint: ${issue.id}`, issue.message, relativePath, issue.line, moduleGuess);
+                }
+                else {
+                    candidate(issue.id, `Android Lint ${issue.severity} issue: ${issue.id} — ${issue.message}`, relativePath, issue.line, projectSeverity === "informational" ? "medium" : "low");
+                }
+            }
+        }
+        else {
+            const parsedSarif = parseLintSarif(content);
+            if (parsedSarif.malformed) {
+                warnings.push(`Malformed lint SARIF report: ${path.basename(filePath)}`);
+                continue;
+            }
+            sawAnyReport = true;
+            for (const sarifResult of parsedSarif.results) {
+                const dedupeKey = `${sarifResult.ruleId}:${sarifResult.artifactUri}:${sarifResult.line}`;
+                if (seenIssueKeys.has(dedupeKey))
+                    continue;
+                seenIssueKeys.add(dedupeKey);
+                const relativePath = sarifResult.artifactUri ? relativeIfContained(targetRoot, sarifResult.artifactUri) : undefined;
+                candidate(sarifResult.ruleId, `Android Lint SARIF ${sarifResult.level} result: ${sarifResult.ruleId} — ${sarifResult.message}`, relativePath, sarifResult.line, "low");
+            }
+        }
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    if (!sawAnyReport) {
+        const status = result.exitCode === 0 ? "inconclusive" : "inconclusive";
+        return {
+            id: ANDROID_LINT_AUDIT_CHECK_ID,
+            category: "android-lint",
+            title: "Android Lint audit (offline)",
+            status,
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`exitCode=${result.exitCode}`, "No fresh structured lint report was discovered."],
+            findings: [],
+            warnings,
+            errors: result.exitCode !== 0 ? ["lintDebug exited non-zero and no structured report was produced."] : [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: plan.environmentLimitations,
+            candidateEvidence: [],
+        };
+    }
+    const status = findings.length > 0 ? "failed" : "passed";
+    if (result.exitCode !== 0) {
+        warnings.push(`lintDebug exited with code ${result.exitCode}; a structured report was still discovered and parsed.`);
+    }
+    return {
+        id: ANDROID_LINT_AUDIT_CHECK_ID,
+        category: "android-lint",
+        title: "Android Lint audit (offline)",
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [`exitCode=${result.exitCode}`, `reportsDiscovered=${freshFiles.length}`, `expectedGeneratedPaths=${plan.expectedGeneratedPaths.join(",") || "(none)"}`],
+        findings,
+        warnings,
+        errors: [],
+        sourcePaths: freshFiles.map((f) => relativeIfContained(targetRoot, f) ?? f),
+        confidence: "high",
+        environmentRequirements: plan.environmentLimitations,
+        targetModificationObserved: mutation.comparable ? mutation.unexpectedChanges.length > 0 : undefined,
+        candidateEvidence,
+    };
+}
+function readFileSafe(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function moduleForPath(targetRoot, filePath, modulePaths) {
+    const relative = relativeIfContained(targetRoot, filePath);
+    if (!relative)
+        return undefined;
+    return modulePaths.find((m) => relative.startsWith(`${m}/`));
+}
+function relativeIfContained(root, absoluteOrRelative) {
+    const absolute = path.isAbsolute(absoluteOrRelative) ? absoluteOrRelative : path.resolve(root, absoluteOrRelative);
+    const normalizedRoot = path.resolve(root).replace(/\\/g, "/");
+    const normalizedAbsolute = absolute.replace(/\\/g, "/");
+    if (!normalizedAbsolute.startsWith(`${normalizedRoot}/`))
+        return undefined;
+    return normalizedAbsolute.slice(normalizedRoot.length + 1);
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/index.js

@@ -0,0 +1 @@
+export { auditAndroidLint, ANDROID_LINT_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/parseLintSarif.js

@@ -0,0 +1,37 @@
+import { safeJsonParse, DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+const MAX_RESULTS = 5_000;
+function boundedMessage(text) {
+    const value = typeof text === "string" ? text : "";
+    return value.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${value.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : value;
+}
+export function parseLintSarif(sarifText) {
+    const parsed = safeJsonParse(sarifText);
+    if (!parsed.ok)
+        return { malformed: true, results: [] };
+    const runs = Array.isArray(parsed.value.runs) ? parsed.value.runs : [];
+    const firstRun = runs[0];
+    if (!firstRun)
+        return { malformed: false, results: [] };
+    const driver = firstRun.tool?.driver;
+    const toolVersion = typeof driver?.version === "string" ? driver.version : undefined;
+    const rawResults = Array.isArray(firstRun.results) ? firstRun.results : [];
+    const results = [];
+    for (const rawResult of rawResults.slice(0, MAX_RESULTS)) {
+        const result = rawResult;
+        const message = result.message?.text;
+        const locations = Array.isArray(result.locations) ? result.locations : [];
+        const firstLocation = locations[0];
+        const physicalLocation = firstLocation?.physicalLocation;
+        const artifactLocation = physicalLocation?.artifactLocation;
+        const region = physicalLocation?.region;
+        results.push({
+            ruleId: typeof result.ruleId === "string" ? result.ruleId : "(unknown-rule)",
+            level: typeof result.level === "string" ? result.level : "(unknown)",
+            message: boundedMessage(message),
+            artifactUri: typeof artifactLocation?.uri === "string" ? artifactLocation.uri : undefined,
+            line: typeof region?.startLine === "number" ? region.startLine : undefined,
+            column: typeof region?.startColumn === "number" ? region.startColumn : undefined,
+        });
+    }
+    return { malformed: false, toolVersion, results };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/parseLintXml.js

@@ -0,0 +1,36 @@
+import { parseXmlDocument, findChildren } from "../../../manifest/xml/parseXml.js";
+import { DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+function attr(element, name) {
+    return element.attributes.find((a) => a.localName === name)?.value;
+}
+function boundedMessage(text) {
+    if (!text)
+        return "";
+    return text.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${text.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : text;
+}
+export function parseLintXml(xmlText) {
+    const parsed = parseXmlDocument(xmlText);
+    if (!parsed.ok)
+        return { malformed: true, issues: [] };
+    const root = parsed.root;
+    if (root.localName !== "issues")
+        return { malformed: true, issues: [] };
+    const issues = [];
+    for (const issueElement of findChildren(root, "issue")) {
+        const locations = findChildren(issueElement, "location");
+        const primaryLocation = locations[0];
+        const lineRaw = primaryLocation ? attr(primaryLocation, "line") : undefined;
+        const columnRaw = primaryLocation ? attr(primaryLocation, "column") : undefined;
+        issues.push({
+            id: attr(issueElement, "id") ?? "(unknown-issue)",
+            severity: attr(issueElement, "severity") ?? "(unknown)",
+            message: boundedMessage(attr(issueElement, "message") ?? attr(issueElement, "summary")),
+            category: attr(issueElement, "category"),
+            priority: attr(issueElement, "priority"),
+            file: primaryLocation ? attr(primaryLocation, "file") : undefined,
+            line: lineRaw ? Number.parseInt(lineRaw, 10) : undefined,
+            column: columnRaw ? Number.parseInt(columnRaw, 10) : undefined,
+        });
+    }
+    return { malformed: false, issues, formatVersion: attr(root, "format") };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/artifacts.js

@@ -0,0 +1,95 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { relativeWithinRoot, resolveWithinRoot } from "../../../../core/pathSafety.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded, contained artifact handling for raw external-tool
+// output. New infrastructure: no existing owner copies/hashes generated
+// Gradle or external-tool output (confirmed absent from
+// src/mobile/android/gradle/validate/*). Reuses src/core/pathSafety.ts for
+// containment rather than a second path-safety implementation.
+// ---------------------------------------------------------------------------
+const MAX_ARTIFACT_BYTES = 32 * 1024 * 1024;
+function mediaTypeFor(kind) {
+    switch (kind) {
+        case "json":
+            return "application/json";
+        case "xml":
+            return "application/xml";
+        case "sarif":
+            return "application/sarif+json";
+        case "text":
+            return "text/plain";
+    }
+}
+function sha256Of(buffer) {
+    return `sha256:${createHash("sha256").update(buffer).digest("hex")}`;
+}
+function toolArtifactDir(artifactRoot, toolId) {
+    return resolveWithinRoot(path.resolve(artifactRoot), toolId);
+}
+// Writes tool-generated content (e.g. a materialized Semgrep config, or
+// content the adapter itself produced) under `<artifactRoot>/<toolId>/`.
+// Containment is validated by resolveWithinRoot, which throws on traversal —
+// callers must not catch that away.
+export function writeExternalToolArtifact(artifactRoot, toolId, fileName, content, kind) {
+    const dir = toolArtifactDir(artifactRoot, toolId);
+    fs.mkdirSync(dir, { recursive: true });
+    const absolutePath = resolveWithinRoot(dir, fileName);
+    const buffer = Buffer.from(content, "utf8");
+    const truncated = buffer.byteLength > MAX_ARTIFACT_BYTES;
+    const boundedBuffer = truncated ? buffer.subarray(0, MAX_ARTIFACT_BYTES) : buffer;
+    fs.writeFileSync(absolutePath, boundedBuffer);
+    return {
+        toolId,
+        artifactKind: kind,
+        relativePath: relativeWithinRoot(path.resolve(artifactRoot), absolutePath),
+        mediaType: mediaTypeFor(kind),
+        sizeBytes: boundedBuffer.byteLength,
+        sha256: sha256Of(boundedBuffer),
+        generatedByThisRun: true,
+        copiedFromTarget: false,
+        truncated,
+        parseStatus: "not-attempted",
+    };
+}
+// Copies an existing target-generated report (e.g. a fresh Android Lint XML
+// file) into the artifact root without modifying or deleting the original.
+export function copyExternalToolArtifactFromTarget(artifactRoot, targetRoot, toolId, sourceAbsolutePath, kind) {
+    let stat;
+    try {
+        stat = fs.statSync(sourceAbsolutePath);
+    }
+    catch {
+        return undefined;
+    }
+    if (!stat.isFile())
+        return undefined;
+    const truncated = stat.size > MAX_ARTIFACT_BYTES;
+    const buffer = truncated ? fs.readFileSync(sourceAbsolutePath).subarray(0, MAX_ARTIFACT_BYTES) : fs.readFileSync(sourceAbsolutePath);
+    const dir = toolArtifactDir(artifactRoot, toolId);
+    fs.mkdirSync(dir, { recursive: true });
+    const destFileName = path.basename(sourceAbsolutePath);
+    const destAbsolutePath = resolveWithinRoot(dir, destFileName);
+    fs.writeFileSync(destAbsolutePath, buffer);
+    let sourceTargetRelativePath;
+    try {
+        sourceTargetRelativePath = relativeWithinRoot(path.resolve(targetRoot), sourceAbsolutePath);
+    }
+    catch {
+        sourceTargetRelativePath = undefined;
+    }
+    return {
+        toolId,
+        artifactKind: kind,
+        relativePath: relativeWithinRoot(path.resolve(artifactRoot), destAbsolutePath),
+        mediaType: mediaTypeFor(kind),
+        sizeBytes: buffer.byteLength,
+        sha256: sha256Of(buffer),
+        generatedByThisRun: true,
+        copiedFromTarget: true,
+        sourceTargetRelativePath,
+        truncated,
+        parseStatus: "not-attempted",
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/boundedOutput.js

@@ -0,0 +1,33 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded text/JSON handling for external-tool output.
+//
+// No shared "safe JSON parse" utility existed before this batch (each
+// consumer, e.g. src/securityValidation/staticScans/semgrep.ts, inlines its
+// own unbounded try/catch JSON.parse). This module is the one owner Batch 7
+// adapters share — a truncated document is never handed to JSON.parse, since
+// a truncated-but-syntactically-valid-looking prefix could otherwise parse
+// successfully into a wrong/partial value instead of failing loudly.
+// ---------------------------------------------------------------------------
+export const DEFAULT_MAX_STDOUT_BYTES = 16 * 1024 * 1024;
+export const DEFAULT_MAX_STDERR_BYTES = 2 * 1024 * 1024;
+export const DEFAULT_MAX_REPORT_BYTES = 32 * 1024 * 1024;
+export const DEFAULT_MAX_MESSAGE_LENGTH = 1_000;
+export const DEFAULT_MAX_SNIPPET_LENGTH = 240;
+export function boundedText(text, maxLength) {
+    if (text.length <= maxLength)
+        return { text, truncated: false };
+    return { text: text.slice(0, maxLength), truncated: true };
+}
+// Bounds the input length BEFORE parsing (a truncated document is reported
+// malformed/truncated, never parsed as if it were a smaller valid document).
+export function safeJsonParse(text, maxBytes = DEFAULT_MAX_REPORT_BYTES) {
+    const truncated = text.length > maxBytes;
+    if (truncated)
+        return { ok: false, malformed: true, truncated: true };
+    try {
+        return { ok: true, value: JSON.parse(text), truncated: false };
+    }
+    catch {
+        return { ok: false, malformed: true, truncated: false };
+    }
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/dependencyCheck/checkResult.js

@@ -0,0 +1,173 @@
+import fs from "node:fs";
+import path from "node:path";
+import { sortCandidateEvidence } from "../../ordering.js";
+import { discoverAllowlistedExecutable } from "../discoverExecutable.js";
+import { buildMinimalEnvironment } from "../minimalEnvironment.js";
+import { copyExternalToolArtifactFromTarget } from "../artifacts.js";
+import { captureTargetSnapshot, buildExternalToolMutationReport } from "../mutation.js";
+import { runBoundedExternalTool, buildCommandSummary, VERSION_PROBE_TIMEOUT_MS } from "../runBoundedExternalTool.js";
+import { buildDependencyCheckArgs, DEPENDENCY_CHECK_REPORT_FILE_NAME, sanitizeDependencyCheckProjectName } from "./command.js";
+import { parseDependencyCheckJson } from "./parseDependencyCheckJson.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — standalone Android OWASP Dependency-Check check. Not
+// called from validateAndroidTarget or any active orchestration; not
+// rendered in reports; no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID = "android-dependency-check-audit";
+const DEPENDENCY_CHECK_CANDIDATES = ["dependency-check", "dependency-check.exe", "dependency-check.sh", "dependency-check.bat", "dependency-check.cmd"];
+const DEPENDENCY_CHECK_TIMEOUT_MS = 15 * 60_000;
+const DATABASE_UNAVAILABLE_PATTERN = /database.*(missing|unavailable|not found|corrupt)|no such file.*\.h2\.db/i;
+function skippedCheck(reason, environmentRequirements = []) {
+    return {
+        id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+        category: "android-dependency-check",
+        title: "Android OWASP Dependency-Check audit",
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            reason,
+            requirementLevel: "optional",
+            missingCapability: "dependency-check-executable-or-database",
+            verdictImpact: "does not apply until Batch 8 integration",
+            recommendedNextAction: "Install OWASP Dependency-Check locally with a populated local database, or run again after Batch 8 wires optional-tool selection into the CLI.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements,
+        candidateEvidence: [],
+    };
+}
+export async function auditAndroidDependencyCheck(options) {
+    const targetRoot = path.resolve(options.targetRoot);
+    if (options.javaAvailable === false) {
+        return skippedCheck("Java was not available; OWASP Dependency-Check requires a Java runtime.", ["Requires a Java runtime (JAVA_HOME or java on PATH)."]);
+    }
+    const discovered = (options.discover ?? (() => discoverAllowlistedExecutable(DEPENDENCY_CHECK_CANDIDATES, targetRoot)))();
+    if (!discovered.available) {
+        return skippedCheck("A Dependency-Check executable was not found on PATH.", ["Requires a Dependency-Check executable on PATH."]);
+    }
+    const env = buildMinimalEnvironment({ additionalAllowedKeys: ["JAVA_HOME"] });
+    const versionOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args: ["--version"], cwd: targetRoot, timeoutMs: VERSION_PROBE_TIMEOUT_MS, env });
+    if (versionOutcome.result.timedOut || versionOutcome.result.exitCode === null) {
+        return skippedCheck("Dependency-Check version probe failed or timed out.");
+    }
+    const rawVersion = versionOutcome.stdout.trim();
+    const outDir = path.resolve(options.artifactRoot, "dependency-check", "raw");
+    fs.mkdirSync(outDir, { recursive: true });
+    const projectName = sanitizeDependencyCheckProjectName(path.basename(targetRoot));
+    const args = buildDependencyCheckArgs(projectName, targetRoot, outDir);
+    const commandSummary = buildCommandSummary(discovered.basename, args, targetRoot, path.resolve(options.artifactRoot));
+    const before = captureTargetSnapshot(targetRoot, true);
+    const analysisOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args, cwd: targetRoot, timeoutMs: DEPENDENCY_CHECK_TIMEOUT_MS, env });
+    const after = captureTargetSnapshot(targetRoot, true);
+    const mutation = buildExternalToolMutationReport(before, after);
+    const warnings = [];
+    if (analysisOutcome.stdoutTruncated)
+        warnings.push("stdout was truncated.");
+    if (analysisOutcome.stderrTruncated)
+        warnings.push("stderr was truncated.");
+    if (!mutation.comparable)
+        warnings.push(`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`);
+    if (mutation.unexpectedChanges.length > 0)
+        warnings.push(`Unexpected target change(s) observed: ${mutation.unexpectedChanges.join(", ")}`);
+    if (analysisOutcome.result.timedOut) {
+        return {
+            id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            category: "android-dependency-check",
+            title: "Android OWASP Dependency-Check audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`],
+            findings: [],
+            warnings: [...warnings, `Dependency-Check timed out after ${DEPENDENCY_CHECK_TIMEOUT_MS}ms.`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "medium",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const reportPath = path.join(outDir, DEPENDENCY_CHECK_REPORT_FILE_NAME);
+    const reportExists = fs.existsSync(reportPath);
+    if (!reportExists) {
+        if (DATABASE_UNAVAILABLE_PATTERN.test(analysisOutcome.stderr)) {
+            return skippedCheck("The local OWASP Dependency-Check vulnerability database is unavailable; updates are disabled by policy, so the scan did not run.", [
+                "Requires a populated local Dependency-Check vulnerability database.",
+            ]);
+        }
+        return {
+            id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            category: "android-dependency-check",
+            title: "Android OWASP Dependency-Check audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `exitCode=${analysisOutcome.result.exitCode}`, "No JSON report was produced."],
+            findings: [],
+            warnings,
+            errors: analysisOutcome.result.exitCode !== 0 ? ["Dependency-Check exited non-zero and produced no report."] : [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const artifact = copyExternalToolArtifactFromTarget(options.artifactRoot, targetRoot, "dependency-check", reportPath, "json");
+    void artifact;
+    const rawJson = fs.readFileSync(reportPath, "utf8");
+    const parsed = parseDependencyCheckJson(rawJson, targetRoot);
+    const isFindingsExitCode = analysisOutcome.result.exitCode === 0 || analysisOutcome.result.exitCode === 1;
+    if (parsed.malformed) {
+        return {
+            id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            category: "android-dependency-check",
+            title: "Android OWASP Dependency-Check audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `exitCode=${analysisOutcome.result.exitCode}`],
+            findings: [],
+            warnings,
+            errors: [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    if (parsed.truncated)
+        warnings.push("Dependency count exceeded the bounded limit; results were truncated.");
+    const findingsById = new Map(parsed.findings.map((f) => [f.id, f]));
+    const candidatesById = new Map(parsed.candidates.map((c) => [c.id, c]));
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const status = findings.length > 0 ? "failed" : isFindingsExitCode ? "passed" : "error";
+    return {
+        id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+        category: "android-dependency-check",
+        title: "Android OWASP Dependency-Check audit",
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [`version=${rawVersion}`, `dependencies=${parsed.dependencyCount}`, `command=${commandSummary}`],
+        findings,
+        warnings,
+        errors: status === "error" ? ["Dependency-Check exited with a non-findings error."] : [],
+        sourcePaths: [],
+        confidence: "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/dependencyCheck/command.js

@@ -0,0 +1,33 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — fixed OWASP Dependency-Check command planning.
+//
+// One fixed operation. No caller-provided flags, no database updates, no
+// NVD API key. `--noupdate` is always present; the additional
+// `--disable*` flags are fixed and only prevent additional network-capable
+// analyzers (Node/Yarn/pnpm audit, RetireJS, known-exploited feed) from
+// running, matching the "no unauthorized network access" boundary.
+// ---------------------------------------------------------------------------
+export const DEPENDENCY_CHECK_REPORT_FILE_NAME = "dependency-check-report.json";
+export function sanitizeDependencyCheckProjectName(rawName) {
+    const sanitized = rawName.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 100);
+    return sanitized.length > 0 ? sanitized : "android-target";
+}
+export function buildDependencyCheckArgs(projectName, targetRoot, outDir) {
+    return [
+        "--project",
+        sanitizeDependencyCheckProjectName(projectName),
+        "--scan",
+        targetRoot,
+        "--format",
+        "JSON",
+        "--out",
+        outDir,
+        "--noupdate",
+        "--disableAssembly",
+        "--disableNodeAudit",
+        "--disableYarnAudit",
+        "--disablePnpmAudit",
+        "--disableRetireJS",
+        "--disableKnownExploited",
+    ];
+}