@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/secretCandidates/analyzeSecretCandidates.js

@@ -0,0 +1,116 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { fingerprintCandidateValue, redactedPreviewForCandidate } from "../redaction.js";
+import { matchPrivateKeyBlocks, matchSensitiveAssignments } from "./matchSecretCandidates.js";
+import { isReferenceSyntax, shouldSuppressEntirely } from "./suppressValue.js";
+function fileKindFor(relativePath) {
+    const lower = relativePath.toLowerCase();
+    if (lower.endsWith(".kt") || lower.endsWith(".kts") || lower.endsWith(".java") || lower.endsWith(".gradle") || lower.endsWith(".gradle.kts")) {
+        return "code";
+    }
+    if (lower.endsWith(".properties") || lower.endsWith(".yaml") || lower.endsWith(".yml") || lower.endsWith(".toml")) {
+        return "config-unquoted";
+    }
+    // .xml/.json use quoted-form matching (JSON always quotes; XML attribute
+    // values are quoted by construction).
+    return "config-quotable";
+}
+function classifyIdentifier(identifier) {
+    const normalized = identifier.toLowerCase().replace(/[-_]/g, "");
+    if (["storepassword", "keypassword", "signingpassword"].includes(normalized)) {
+        return { ruleId: "android-signing-password-literal", sensitiveDataCategory: "signing-password" };
+    }
+    if (["databasepassword", "dbpassword"].includes(normalized)) {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "database-credential" };
+    }
+    if (["password", "passwd", "pwd"].includes(normalized)) {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "password" };
+    }
+    if (normalized === "clientsecret") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "oauth-client-secret" };
+    }
+    if (normalized === "accesstoken") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "access-token" };
+    }
+    if (normalized === "bearertoken") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "bearer-token" };
+    }
+    if (normalized === "authtoken") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "access-token" };
+    }
+    if (normalized === "apisecret") {
+        return { ruleId: "android-secret-token-password-candidate", sensitiveDataCategory: "cloud-secret-key" };
+    }
+    // Bare "secret" and any other sensitive-pattern match not covered above.
+    return { ruleId: "android-secret-hardcoded-candidate", sensitiveDataCategory: "unknown-sensitive-value" };
+}
+export function analyzeSecretCandidateFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const fileKind = fileKindFor(file.relativePath);
+    for (const block of matchPrivateKeyBlocks(file.content)) {
+        const location = buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: block.line });
+        const fingerprint = fingerprintCandidateValue(block.rawBlock);
+        if (!block.terminated) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-secret-private-key-candidate",
+                category: "android-secret-candidates",
+                confidence: "medium",
+                modulePath: file.modulePath,
+                location,
+                summary: `Unterminated ${block.headerLabel} block found; treated conservatively`,
+                rawValue: block.rawBlock,
+                resolutionState: "malformed",
+                staticAnalysisLimitations: ["Block was not terminated by a matching END marker within the bounded scan window; content was not validated as a real key."],
+            }));
+            continue;
+        }
+        findings.push(makeAndroidFinding({
+            ruleId: "android-secret-private-key-candidate",
+            title: `Private key material found (${block.headerLabel})`,
+            severity: "major",
+            confidence: "high",
+            description: `A ${block.headerLabel} block was found in target-contained text. This is high-confidence structural evidence of committed private key material; the key was not opened, parsed, or validated.`,
+            manifestPath: file.relativePath,
+            identity: fingerprint,
+            location: { line: block.line },
+            evidenceDetails: [`redactedPreview=${redactedPreviewForCandidate(block.rawBlock, { maxLength: 40 })}`],
+            recommendation: "Remove the private key from source control immediately and rotate the corresponding credential/certificate.",
+        }));
+    }
+    for (const match of matchSensitiveAssignments(file.content, fileKind)) {
+        if (shouldSuppressEntirely(match.rawValue))
+            continue;
+        const location = buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: match.line });
+        const classification = classifyIdentifier(match.identifier);
+        if (isReferenceSyntax(match.rawValue)) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: classification.ruleId,
+                category: classification.ruleId === "android-signing-password-literal" ? "android-signing-configuration" : "android-secret-candidates",
+                confidence: "low",
+                modulePath: file.modulePath,
+                location,
+                summary: `"${match.identifier}" is assigned an environment/property/placeholder reference, not a literal value`,
+                rawValue: match.rawValue,
+                resolutionState: "not-applicable",
+                staticAnalysisLimitations: ["Reference syntax was detected; the resolved value was not evaluated and is not treated as a hardcoded credential."],
+            }));
+            continue;
+        }
+        const fingerprint = fingerprintCandidateValue(match.rawValue);
+        findings.push(makeAndroidFinding({
+            ruleId: classification.ruleId,
+            title: `Hardcoded ${match.identifier} literal found`,
+            severity: "major",
+            confidence: "high",
+            description: `The identifier "${match.identifier}" is assigned a literal, non-placeholder value. This is high-confidence static evidence of a hardcoded credential; it is not proof the credential is currently valid or in active use.`,
+            manifestPath: file.relativePath,
+            identity: fingerprint,
+            location: { line: match.line },
+            evidenceDetails: [`identifier=${match.identifier}`, `redactedPreview=${redactedPreviewForCandidate(match.rawValue)}`],
+            recommendation: "Remove the hardcoded credential, rotate it, and load it from a secure secrets mechanism instead.",
+        }));
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/checkResult.js

@@ -0,0 +1,80 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "./discoverSecretSourceFiles.js";
+import { analyzeSecretCandidateFile } from "./analyzeSecretCandidates.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — standalone Android secret-candidate check result.
+//
+// Operates over discovered files rather than parsed manifests, so it cannot
+// reuse buildAndroidManifestCheckResult (Batch 3's manifest-audit builder) —
+// this is a distinct, still-conservative status-decision policy: never-run
+// for a non-Android target, "failed" only when a reportable (non-
+// informational) finding exists, otherwise "passed". Standalone: not called
+// from validateAndroidTarget / any active orchestration, not rendered in
+// reports, no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID = "android-secret-candidates-audit";
+export function auditAndroidSecretCandidates(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID,
+            category: "android-secret-candidates",
+            title: "Android hardcoded secret-candidate audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of files) {
+        const result = analyzeSecretCandidateFile(targetRoot, file);
+        for (const finding of result.findings)
+            findingsById.set(finding.id, finding);
+        for (const candidate of result.candidates)
+            candidatesById.set(candidate.id, candidate);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const evidence = [`${files.length} file(s) scanned across ${new Set(files.map((f) => f.modulePath ?? "(root)")).size} module scope(s)`];
+    const warnings = skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID,
+        category: "android-secret-candidates",
+        title: "Android hardcoded secret-candidate audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence,
+        findings,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not validate credentials, contact external services, or scan Git history.",
+        ],
+        errors: [],
+        sourcePaths: files.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/discoverSecretSourceFiles.js

@@ -0,0 +1,152 @@
+import fs from "node:fs";
+import { collectFilesForGlobs } from "../../../../core/fileGlobs.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — bounded, deterministic file discovery for the secret-
+// candidate scanner.
+//
+// Reuses the existing target-contained glob collector
+// (src/core/fileGlobs.ts's collectFilesForGlobs, which itself uses
+// src/core/pathSafety.ts for containment) for traversal — no second
+// traversal engine. Adds narrow, documented bounds (size cap, binary
+// detection) co-located here because no existing shared utility exposes
+// structured skip evidence (the closest existing owner,
+// src/securityValidation/attackScenarios/boundedSourceScan.ts, silently
+// drops oversized/unreadable/binary files with no skip record, and is owned
+// by an unrelated security-validation feature, not Android).
+// ---------------------------------------------------------------------------
+// Extension-based recursive globs plus explicit root-level literals — the
+// existing glob matcher's "**/*.ext" form requires at least one path
+// separator, so genuinely root-level files (e.g. local.properties sitting
+// directly in the target root) need an explicit literal entry too.
+export const SECRET_SCAN_GLOBS = [
+    "**/*.kt",
+    "**/*.kts",
+    "**/*.java",
+    "**/*.xml",
+    "**/*.gradle",
+    "**/*.gradle.kts",
+    "**/*.properties",
+    "**/*.json",
+    "**/*.yaml",
+    "**/*.yml",
+    "**/*.toml",
+    "gradle.properties",
+    "local.properties",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+];
+// Path segments excluded beyond src/core/fileGlobs.ts's own directory
+// exclusions (node_modules/dist/build/coverage/.git/lab-output/.my-dev-kit),
+// matching the wider Android-appropriate set already used by
+// src/mobile/android/detect/traversal.ts.
+const EXCLUDED_PATH_SEGMENTS = [".gradle/", "out/", "reports/", ".idea/", ".vscode/", ".vs/"];
+function isExcludedPath(relativePath) {
+    const normalized = `${relativePath.replace(/\\/g, "/")}/`;
+    return EXCLUDED_PATH_SEGMENTS.some((segment) => normalized === segment || normalized.startsWith(segment) || normalized.includes(`/${segment}`));
+}
+// Documented, co-located bounds (no existing shared constant applies here).
+export const MAX_SECRET_SCAN_FILE_BYTES = 1_000_000;
+export const MAX_SECRET_SCAN_FILE_COUNT = 5_000;
+const NUL_CHAR = String.fromCharCode(0);
+function inferModulePath(relativePath, knownModulePaths) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    let best;
+    for (const modulePath of knownModulePaths) {
+        const prefix = `${modulePath.replace(/\\/g, "/")}/`;
+        if (normalized.startsWith(prefix) && (best === undefined || modulePath.length > best.length)) {
+            best = modulePath;
+        }
+    }
+    return best;
+}
+// Discovers a bounded, deterministic set of target-contained text files
+// eligible for secret-candidate scanning. Never throws for missing glob base
+// paths (per-glob isolation, same rationale as boundedSourceScan.ts), never
+// reads beyond the size cap, and reports every skip with a structured
+// reason rather than silently dropping files.
+export function discoverSecretSourceFiles(targetRoot, knownModulePaths = []) {
+    const candidateMap = new Map();
+    for (const glob of SECRET_SCAN_GLOBS) {
+        let matches;
+        try {
+            matches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            continue;
+        }
+        for (const match of matches) {
+            const normalizedRel = match.relativePath.replace(/\\/g, "/");
+            if (isExcludedPath(normalizedRel))
+                continue;
+            candidateMap.set(normalizedRel, match.absolutePath);
+        }
+    }
+    const candidates = [...candidateMap.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .slice(0, MAX_SECRET_SCAN_FILE_COUNT)
+        .map(([relativePath, absolutePath]) => ({ relativePath, absolutePath }));
+    const files = [];
+    const skipped = [];
+    for (const candidate of candidates) {
+        let stat;
+        try {
+            stat = fs.lstatSync(candidate.absolutePath);
+        }
+        catch (error) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        // Symlinks are not followed outside the target: resolve the real path
+        // and re-check containment before ever reading content.
+        let realAbsolutePath = candidate.absolutePath;
+        if (stat.isSymbolicLink()) {
+            try {
+                realAbsolutePath = fs.realpathSync(candidate.absolutePath);
+            }
+            catch {
+                skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: "broken symlink" });
+                continue;
+            }
+            const normalizedRoot = targetRoot.replace(/\\/g, "/");
+            const normalizedReal = realAbsolutePath.replace(/\\/g, "/");
+            if (!normalizedReal.startsWith(normalizedRoot)) {
+                skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: "symlink escapes target root" });
+                continue;
+            }
+            try {
+                stat = fs.statSync(realAbsolutePath);
+            }
+            catch (error) {
+                skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+                continue;
+            }
+        }
+        if (!stat.isFile())
+            continue;
+        if (stat.size > MAX_SECRET_SCAN_FILE_BYTES) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "oversized", detail: `${stat.size} bytes exceeds ${MAX_SECRET_SCAN_FILE_BYTES}` });
+            continue;
+        }
+        let content;
+        try {
+            content = fs.readFileSync(realAbsolutePath, "utf8");
+        }
+        catch (error) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        if (content.indexOf(NUL_CHAR) !== -1) {
+            skipped.push({ relativePath: candidate.relativePath, reason: "binary-like" });
+            continue;
+        }
+        files.push({
+            relativePath: candidate.relativePath,
+            absolutePath: candidate.absolutePath,
+            modulePath: inferModulePath(candidate.relativePath, knownModulePaths),
+            content,
+        });
+    }
+    return { files, skipped };
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/index.js

@@ -0,0 +1,9 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — public exports for the standalone Android secret-
+// candidate audit. Deliberately does not export the raw matcher
+// (matchSecretCandidates.ts), suppression internals, or raw match types —
+// only the discovery/analysis/check-result layers that already redact.
+// ---------------------------------------------------------------------------
+export { discoverSecretSourceFiles, SECRET_SCAN_GLOBS, MAX_SECRET_SCAN_FILE_BYTES, MAX_SECRET_SCAN_FILE_COUNT } from "./discoverSecretSourceFiles.js";
+export { analyzeSecretCandidateFile } from "./analyzeSecretCandidates.js";
+export { auditAndroidSecretCandidates, ANDROID_SECRET_CANDIDATES_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/secretCandidates/matchSecretCandidates.js

@@ -0,0 +1,136 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — narrow, deterministic in-memory secret-candidate matching.
+//
+// This is the ONLY layer that ever holds a raw candidate value. Callers
+// (analyzeSecretCandidates.ts) must redact/fingerprint immediately and never
+// store, log, or export the raw value from this module. Nothing in this
+// file is exported through index.ts.
+//
+// No entropy scoring is implemented: the structural markers (PEM headers)
+// and explicit sensitive-identifier context already meet the "high
+// confidence" bar the batch requires without it, and entropy alone must
+// never create a finding per agents.txt Batch 4 section 9.8 — omitting it
+// avoids speculative complexity with no corresponding required rule.
+// ---------------------------------------------------------------------------
+const PRIVATE_KEY_HEADER_PATTERN = /-----BEGIN ([A-Z0-9 ]*?PRIVATE KEY)-----/g;
+function findBlockEnd(content, searchStart, headerLabel) {
+    const footer = `-----END ${headerLabel}-----`;
+    const footerIndex = content.indexOf(footer, searchStart);
+    if (footerIndex === -1) {
+        // Unterminated block — bound the captured region rather than reading to
+        // end of file unbounded.
+        const MAX_UNTERMINATED_BLOCK_LENGTH = 4000;
+        return { end: Math.min(content.length, searchStart + MAX_UNTERMINATED_BLOCK_LENGTH), terminated: false };
+    }
+    return { end: footerIndex + footer.length, terminated: true };
+}
+function lineNumberAt(content, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < content.length; i++) {
+        if (content[i] === "\n")
+            line++;
+    }
+    return line;
+}
+// Public keys and certificates ("-----BEGIN PUBLIC KEY-----",
+// "-----BEGIN CERTIFICATE-----") never match PRIVATE_KEY_HEADER_PATTERN
+// (which requires the literal substring "PRIVATE KEY") — the boundary is
+// enforced by construction, not a separate exclusion check.
+export function matchPrivateKeyBlocks(content) {
+    const matches = [];
+    for (const headerMatch of content.matchAll(PRIVATE_KEY_HEADER_PATTERN)) {
+        const headerLabel = headerMatch[1];
+        const startIndex = headerMatch.index ?? 0;
+        const { end, terminated } = findBlockEnd(content, startIndex, headerLabel);
+        matches.push({
+            line: lineNumberAt(content, startIndex),
+            headerLabel,
+            rawBlock: content.slice(startIndex, end),
+            terminated,
+        });
+    }
+    return matches;
+}
+// Sensitive identifier names that, when paired with a literal (never a
+// reference/placeholder), are treated as high-confidence secret-shaped
+// evidence. Deliberately narrow — matches agents.txt Batch 4 section 9.5.
+//
+// Splits the identifier into words (snake_case and camelCase boundaries)
+// rather than using a single \b-anchored regex, so real-world constant
+// naming like `SECRET_TOKEN`, `DB_PASSWORD`, or `placeholderSecret` is
+// recognized — a plain `\bsecret\b` regex fails on these because
+// underscore and camelCase transitions are not `\b` word boundaries.
+const SENSITIVE_SINGLE_WORDS = new Set(["password", "passwd", "pwd", "secret"]);
+const SENSITIVE_WORD_PAIRS = [
+    ["client", "secret"],
+    ["access", "token"],
+    ["bearer", "token"],
+    ["auth", "token"],
+    ["api", "secret"],
+    ["signing", "password"],
+    ["store", "password"],
+    ["key", "password"],
+    ["database", "password"],
+    ["db", "password"],
+];
+function splitIdentifierWords(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .split(/[_\-.\s]+/)
+        .map((word) => word.toLowerCase())
+        .filter((word) => word.length > 0);
+}
+function isSensitiveIdentifier(identifier) {
+    const words = splitIdentifierWords(identifier);
+    if (words.some((word) => SENSITIVE_SINGLE_WORDS.has(word)))
+        return true;
+    for (const [first, second] of SENSITIVE_WORD_PAIRS) {
+        for (let i = 0; i < words.length - 1; i++) {
+            if (words[i] === first && words[i + 1] === second)
+                return true;
+        }
+    }
+    return false;
+}
+// Finds `identifier = "value"` / `identifier: "value"` / `identifier="value"`
+// / `"identifier": "value"` (JSON-style quoted key) pairs anywhere on a line
+// (the value side quoting is required — code files never match an unquoted
+// right-hand side, so a variable/function reference such as
+// `val password = getPassword()` can never be mistaken for a literal).
+const KEY_VALUE_QUOTED_PATTERN = /["']?([A-Za-z_][A-Za-z0-9_]*)["']?\s*[:=]\s*["']([^"']*)["']/g;
+// Properties/YAML/TOML permit unquoted scalar values on a `key = value` /
+// `key: value` line; still requires the key itself to match the sensitive
+// identifier pattern.
+const KEY_VALUE_UNQUOTED_PATTERN = /^\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*[:=]\s*(\S.*?)\s*$/;
+// Scans line-by-line (bounds work naturally; also gives exact line numbers
+// without a second pass). Returns only pairs whose *captured identifier*
+// (not just the line generally) matches a sensitive name — reference/
+// placeholder/empty-value filtering happens in analyzeSecretCandidates.ts,
+// which also owns redaction, so this function's return values are the last
+// point at which a raw value exists before that immediate conversion.
+export function matchSensitiveAssignments(content, fileKind) {
+    const matches = [];
+    const lines = content.split(/\r\n|\r|\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (fileKind === "config-unquoted") {
+            const unquoted = line.match(KEY_VALUE_UNQUOTED_PATTERN);
+            if (unquoted && isSensitiveIdentifier(unquoted[1])) {
+                matches.push({ line: i + 1, identifier: unquoted[1], rawValue: stripSurroundingQuotes(unquoted[2]) });
+            }
+            continue;
+        }
+        for (const pairMatch of line.matchAll(KEY_VALUE_QUOTED_PATTERN)) {
+            if (isSensitiveIdentifier(pairMatch[1])) {
+                matches.push({ line: i + 1, identifier: pairMatch[1], rawValue: pairMatch[2] });
+            }
+        }
+    }
+    return matches;
+}
+function stripSurroundingQuotes(value) {
+    if (value.length >= 2 && ((value[0] === '"' && value.endsWith('"')) || (value[0] === "'" && value.endsWith("'")))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/suppressValue.js

@@ -0,0 +1,61 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — conservative placeholder/example/reference suppression.
+//
+// Deliberately a small, exact/narrow-normalized check list rather than a
+// large heuristic catalog (agents.txt Batch 4 section 9.9). Operates only on
+// the already-captured raw value (never re-reads the file), and this module
+// is not exported through index.ts.
+// ---------------------------------------------------------------------------
+const EXACT_PLACEHOLDER_VALUES = new Set([
+    "changeme",
+    "change_me",
+    "change-me",
+    "password",
+    "secret",
+    "example",
+    "sample",
+    "dummy",
+    "fake",
+    "test",
+    "your-token-here",
+    "your_token_here",
+    "replace-me",
+    "replace_me",
+    "redacted",
+    "masked",
+    "todo",
+    "xxx",
+    "placeholder",
+    "n/a",
+    "none",
+].map((v) => v.toLowerCase()));
+export function isEmptyValue(value) {
+    return value.trim().length === 0;
+}
+export function isObviousPlaceholderValue(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized.length === 0)
+        return true;
+    if (EXACT_PLACEHOLDER_VALUES.has(normalized))
+        return true;
+    // Fully repeated single character (e.g. "****", "xxxxxxxx", "00000000").
+    if (/^(.)\1*$/.test(normalized))
+        return true;
+    return false;
+}
+// Environment/property/manifest-placeholder reference syntax embedded in the
+// literal itself (e.g. a Kotlin string template `"${DB_PASSWORD}"`, a
+// properties-file `${some.property}`, a shell-style `$VAR`, a Windows
+// `%VAR%`, or an Android manifest `@string/...`/`@xml/...` reference). Any
+// of these means the "literal" is not actually a hardcoded value.
+const REFERENCE_SYNTAX_PATTERN = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z_][A-Za-z0-9_]*%|^@(string|xml|raw|array|integer|bool)\//;
+export function isReferenceSyntax(value) {
+    return REFERENCE_SYNTAX_PATTERN.test(value.trim());
+}
+// True when the value should never become a finding/candidate at all —
+// empty or an obvious placeholder/example. Reference syntax is handled
+// separately by the caller because it should surface as non-literal
+// metadata (Batch 4 section 9.12), not be silently dropped.
+export function shouldSuppressEntirely(value) {
+    return isEmptyValue(value) || isObviousPlaceholderValue(value);
+}

package/dist/src/mobile/android/advancedSecurity/secretCandidates/types.js

@@ -0,0 +1,11 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 4 — bounded secret-candidate scan contracts.
+//
+// Local to this feature; does not duplicate Batch 1's CandidateEvidence,
+// SecurityFinding, or the shared bounded-source-scan utility
+// (src/securityValidation/attackScenarios/boundedSourceScan.ts) — it wraps
+// the existing target-containment/glob-collection primitives
+// (src/core/fileGlobs.ts) with Android-appropriate exclusions and adds
+// structured skip evidence, which neither existing utility provides.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/sensitiveCategories.js

@@ -0,0 +1,34 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — sensitive-data category vocabulary for later secret/
+// signing/configuration candidate scanners.
+//
+// Deliberately small and additive. This is not a security-severity scale
+// (see SecuritySeverity in src/securityValidation/types.ts, reused as-is by
+// candidateEvidence.ts) — it only classifies *what kind* of value a static
+// candidate looks like.
+//
+// A bare Firebase API key (the public `apiKey` field in google-services.json
+// / Firebase web config) must NOT be classified as "cloud-secret-key" or any
+// other private-secret category by default: Firebase API keys identify a
+// Firebase project but are not treated as confidential by Google's own
+// documentation, and misclassifying them would produce a permanent, noisy
+// false positive for a huge fraction of real Android apps. A later batch's
+// Firebase scanner should classify that value as "unknown-sensitive-value"
+// (or omit a candidate entirely) rather than a private-secret category.
+// ---------------------------------------------------------------------------
+export const SENSITIVE_DATA_CATEGORIES = [
+    "password",
+    "access-token",
+    "bearer-token",
+    "oauth-client-secret",
+    "cloud-secret-key",
+    "private-key",
+    "database-credential",
+    "signing-password",
+    "recovery-code",
+    "personal-data",
+    "unknown-sensitive-value",
+];
+export function isSensitiveDataCategory(value) {
+    return SENSITIVE_DATA_CATEGORIES.includes(value);
+}