@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/gradle/moduleMetadataExtractor.js

@@ -11,7 +11,10 @@ import { extractBuildFileEvidence } from "../detect/buildFileEvidence.js";
 // excerpt" strategy for each key. Comments are stripped first so a
 // commented-out assignment never becomes active metadata (ANDROID-B4-05).
 // ---------------------------------------------------------------------------
-function stripComments(text) {
+// v0.4.1 Batch 4 — exported (was module-private) so the new signing-
+// configuration module can reuse the exact same comment-stripping/literal-
+// extraction/brace-matching technique instead of a second implementation.
+export function stripComments(text) {
     // Replaces comment characters with spaces (not empty string) so any
     // surviving line/column-independent offsets are not shifted — this batch
     // does not track per-field locations, but keeping length stable is cheap
@@ -21,7 +24,7 @@ function stripComments(text) {
         .replace(/\/\/[^\n]*/g, (match) => " ".repeat(match.length));
 }
 const STRING_OR_INT = `(?:'([^']*)'|"([^"]*)"|(-?\\d+))`;
-function extractLiteral(text, keyAlternatives) {
+export function extractLiteral(text, keyAlternatives) {
     const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
     // Anchored to the start of a line (allowing leading indentation) so a key
     // name that merely appears as a word inside an unrelated string literal —
@@ -46,32 +49,45 @@ function extractLiteral(text, keyAlternatives) {
     }
     return {};
 }
-// Finds the top-level named entries inside a `<blockKeyword> { ... }` block
-// (e.g. `buildTypes { debug { ... } release { ... } }` or
-// `sourceSets { main { ... } androidTest { ... } }`), supporting both the
-// bare-identifier Groovy/Kotlin-DSL form and the Kotlin DSL
-// getByName/create/named(...) form. Bounded by brace-depth matching, not a
-// full parser — nested unrelated blocks inside are not descended into for
-// name extraction beyond the immediate children.
-function findNamedBlockEntries(text, blockKeyword) {
+// Returns the inner text of the first `<blockKeyword> { ... }` block found,
+// bounded by brace-depth matching (not a full parser). Shared by
+// findNamedBlockEntries (names only) and extractNamedSubBlocks (v0.4.1
+// Batch 3 — names plus each entry's own block content).
+export function findBlockBody(text, blockKeyword) {
     const blockStart = text.search(new RegExp(`\\b${blockKeyword}\\s*\\{`));
     if (blockStart === -1)
-        return [];
+        return undefined;
     const openBraceIndex = text.indexOf("{", blockStart);
+    return sliceBlockAt(text, openBraceIndex);
+}
+// Given the index of an opening `{`, returns the text between it and its
+// matching `}` (brace-depth bounded), or undefined if unterminated.
+export function sliceBlockAt(text, openBraceIndex) {
+    if (text[openBraceIndex] !== "{")
+        return undefined;
     let depth = 0;
-    let endIndex = text.length;
     for (let i = openBraceIndex; i < text.length; i++) {
         if (text[i] === "{")
             depth += 1;
         else if (text[i] === "}") {
             depth -= 1;
-            if (depth === 0) {
-                endIndex = i;
-                break;
-            }
+            if (depth === 0)
+                return text.slice(openBraceIndex + 1, i);
         }
     }
-    const block = text.slice(openBraceIndex + 1, endIndex);
+    return undefined;
+}
+// Finds the top-level named entries inside a `<blockKeyword> { ... }` block
+// (e.g. `buildTypes { debug { ... } release { ... } }` or
+// `sourceSets { main { ... } androidTest { ... } }`), supporting both the
+// bare-identifier Groovy/Kotlin-DSL form and the Kotlin DSL
+// getByName/create/named(...) form. Bounded by brace-depth matching, not a
+// full parser — nested unrelated blocks inside are not descended into for
+// name extraction beyond the immediate children.
+function findNamedBlockEntries(text, blockKeyword) {
+    const block = findBlockBody(text, blockKeyword);
+    if (block === undefined)
+        return [];
     const names = new Set();
     for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
         names.add(match[1]);
@@ -81,6 +97,95 @@ function findNamedBlockEntries(text, blockKeyword) {
     }
     return [...names].sort((a, b) => a.localeCompare(b));
 }
+// v0.4.1 Batch 3 — like findNamedBlockEntries, but also returns each named
+// entry's own block content so per-build-type literal fields (debuggable,
+// minifyEnabled, etc.) can be extracted. Reuses the exact same bounded
+// brace-matching technique and the same two name-pattern forms — not a
+// second parser, just returning more of what was already being scanned.
+export function extractNamedSubBlocks(text, blockKeyword) {
+    const block = findBlockBody(text, blockKeyword);
+    if (block === undefined)
+        return [];
+    const results = [];
+    const seen = new Set();
+    for (const match of block.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s*\{/g)) {
+        const name = match[1];
+        if (seen.has(name))
+            continue;
+        const openBraceIndex = match.index + match[0].length - 1;
+        const content = sliceBlockAt(block, openBraceIndex);
+        if (content !== undefined) {
+            results.push({ name, content });
+            seen.add(name);
+        }
+    }
+    for (const match of block.matchAll(/\b(?:getByName|create|named)\(\s*["']([\w-]+)["']\s*\)\s*\{/g)) {
+        const name = match[1];
+        if (seen.has(name))
+            continue;
+        const openBraceIndex = match.index + match[0].length - 1;
+        const content = sliceBlockAt(block, openBraceIndex);
+        if (content !== undefined) {
+            results.push({ name, content });
+            seen.add(name);
+        }
+    }
+    return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+const BOOLEAN_TOKEN = `(true|false)`;
+// v0.4.1 Batch 3 — boolean-literal counterpart to extractLiteral (which only
+// matches quoted-string/integer literals — Gradle boolean assignments like
+// `debuggable true` or `isMinifyEnabled = true` are bare tokens, not quoted).
+// Same anchoring/fallback strategy as extractLiteral for consistency.
+export function extractBooleanLiteral(text, keyAlternatives) {
+    const keyPattern = keyAlternatives.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const literalPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=(]?\\s*${BOOLEAN_TOKEN}\\)?`, "m");
+    const literalMatch = text.match(literalPattern);
+    if (literalMatch) {
+        return { value: literalMatch[1] === "true" };
+    }
+    const rawPattern = new RegExp(`^[ \\t]*(?:${keyPattern})\\b\\s*[=(]?\\s*([^\\n]{1,120})`, "m");
+    const rawMatch = text.match(rawPattern);
+    if (rawMatch) {
+        const raw = rawMatch[1].trim();
+        if (raw.length > 0)
+            return { raw };
+    }
+    return {};
+}
+function booleanLiteralState(result) {
+    if (result.value !== undefined)
+        return result.value ? "literal-true" : "literal-false";
+    if (result.raw !== undefined)
+        return "dynamic";
+    return "missing";
+}
+// v0.4.1 Batch 3 — builds bounded literal evidence for one named build-type
+// block. Never evaluates Gradle; signingConfig/matchingFallbacks/initWith
+// are always reference expressions, so only a bounded raw excerpt is kept.
+function buildBuildTypeInfo(name, content) {
+    const debuggable = extractBooleanLiteral(content, ["debuggable", "isDebuggable"]);
+    const minifyEnabled = extractBooleanLiteral(content, ["minifyEnabled", "isMinifyEnabled"]);
+    const shrinkResources = extractBooleanLiteral(content, ["shrinkResources", "isShrinkResources"]);
+    const signingConfig = extractLiteral(content, ["signingConfig"]);
+    const matchingFallbacks = extractLiteral(content, ["matchingFallbacks"]);
+    const initWith = extractLiteral(content, ["initWith"]);
+    return {
+        name,
+        debuggable: debuggable.value,
+        debuggableRaw: debuggable.raw,
+        debuggableState: booleanLiteralState(debuggable),
+        minifyEnabled: minifyEnabled.value,
+        minifyEnabledRaw: minifyEnabled.raw,
+        minifyEnabledState: booleanLiteralState(minifyEnabled),
+        shrinkResources: shrinkResources.value,
+        shrinkResourcesRaw: shrinkResources.raw,
+        shrinkResourcesState: booleanLiteralState(shrinkResources),
+        signingConfigRef: signingConfig.value ?? signingConfig.raw,
+        matchingFallbacksRaw: matchingFallbacks.value ?? matchingFallbacks.raw,
+        initWithRaw: initWith.value ?? initWith.raw,
+    };
+}
 // Extracts bounded static metadata for one module's build file text. `path`
 // is intentionally omitted from the returned info — the caller (the
 // aggregator, which already knows the module path from detection) attaches
@@ -128,6 +233,7 @@ export function extractModuleGradleMetadata(rawText) {
             compileSdk: compileSdk.value,
             compileSdkRaw: compileSdk.raw,
             buildTypes: findNamedBlockEntries(text, "buildTypes"),
+            buildTypeDetails: extractNamedSubBlocks(text, "buildTypes").map(({ name, content }) => buildBuildTypeInfo(name, content)),
             composeEnabled: evidence.composeBuildFeatureEvidence || evidence.composeDependencyEvidence || undefined,
             sourceSetEvidence: findNamedBlockEntries(text, "sourceSets").map((name) => `declared sourceSet: ${name}`),
             testSourceSetEvidence: [],

package/dist/src/mobile/android/manifest/parseAndroidManifest.js

@@ -108,8 +108,17 @@ function parseComponent(kind, element, warnings) {
         component.readPermission = androidAttr(element, "readPermission");
         component.writePermission = androidAttr(element, "writePermission");
         const authoritiesRaw = androidAttr(element, "authorities");
+        component.authoritiesRaw = authoritiesRaw;
         component.authorities = authoritiesRaw ? authoritiesRaw.split(";").map((s) => s.trim()).filter(Boolean) : undefined;
-        component.grantUriPermissions = parseBooleanAttr(element, "grantUriPermissions", warnings, context).value;
+        const grantUriPermissions = parseBooleanAttr(element, "grantUriPermissions", warnings, context);
+        component.grantUriPermissions = grantUriPermissions.value;
+        component.grantUriPermissionsRaw = grantUriPermissions.raw;
+        component.metadata = findChildren(element, "meta-data").map((metadata) => ({
+            name: androidAttr(metadata, "name"),
+            resource: androidAttr(metadata, "resource"),
+            value: androidAttr(metadata, "value"),
+            location: toLocation(metadata.location),
+        }));
     }
     return component;
 }
@@ -202,6 +211,12 @@ export function parseAndroidManifestSource(xmlText, manifestPath) {
     if (applicationElements.length > 1) {
         parseWarnings.push(`Manifest declares ${applicationElements.length} <application> elements; only the first was used.`);
     }
+    const usesCleartextTrafficResult = applicationEl
+        ? parseBooleanAttr(applicationEl, "usesCleartextTraffic", parseWarnings, "<application>")
+        : undefined;
+    const allowBackupResult = applicationEl ? parseBooleanAttr(applicationEl, "allowBackup", parseWarnings, "<application>") : undefined;
+    const debuggableResult = applicationEl ? parseBooleanAttr(applicationEl, "debuggable", parseWarnings, "<application>") : undefined;
+    const testOnlyResult = applicationEl ? parseBooleanAttr(applicationEl, "testOnly", parseWarnings, "<application>") : undefined;
     const application = applicationEl
         ? {
             name: androidAttr(applicationEl, "name"),
@@ -209,10 +224,18 @@ export function parseAndroidManifestSource(xmlText, manifestPath) {
             iconRef: androidAttr(applicationEl, "icon"),
             enabled: parseBooleanAttr(applicationEl, "enabled", parseWarnings, "<application>").value,
             permission: androidAttr(applicationEl, "permission"),
-            allowBackup: parseBooleanAttr(applicationEl, "allowBackup", parseWarnings, "<application>").value,
-            debuggable: parseBooleanAttr(applicationEl, "debuggable", parseWarnings, "<application>").value,
-            usesCleartextTraffic: parseBooleanAttr(applicationEl, "usesCleartextTraffic", parseWarnings, "<application>").value,
+            allowBackup: allowBackupResult?.value,
+            allowBackupRaw: allowBackupResult?.raw,
+            debuggable: debuggableResult?.value,
+            debuggableRaw: debuggableResult?.raw,
+            usesCleartextTraffic: usesCleartextTrafficResult?.value,
+            usesCleartextTrafficRaw: usesCleartextTrafficResult?.raw,
             networkSecurityConfigRef: androidAttr(applicationEl, "networkSecurityConfig"),
+            fullBackupContentRef: androidAttr(applicationEl, "fullBackupContent"),
+            dataExtractionRulesRef: androidAttr(applicationEl, "dataExtractionRules"),
+            testOnly: testOnlyResult?.value,
+            testOnlyRaw: testOnlyResult?.raw,
+            location: toLocation(applicationEl.location),
         }
         : {};
     const activities = applicationEl ? findChildren(applicationEl, "activity").map((el) => parseComponent("activity", el, parseWarnings)) : [];

package/dist/src/mobile/android/manifest/xml/parseXml.js

@@ -92,6 +92,18 @@ class Scanner {
         }
         this.expect(literal);
     }
+    // Like skipUntil, but returns the consumed text before `literal` instead of
+    // discarding it. Used to capture CDATA section content as element text.
+    captureUntil(literal) {
+        let captured = "";
+        while (!this.eof() && !this.startsWith(literal))
+            captured += this.advance();
+        if (this.eof()) {
+            throw new XmlSyntaxError(`Unterminated construct, expected "${literal}"`, this.loc());
+        }
+        this.expect(literal);
+        return captured;
+    }
 }
 function resolveNamespace(prefix, scope) {
     return scope.get(prefix ?? "");
@@ -224,12 +236,13 @@ function parseElement(scanner, parentScope, warnings) {
     scanner.skipWhitespace();
     if (scanner.startsWith("/>")) {
         scanner.expect("/>");
-        return { tagName, prefix, localName, namespaceUri, attributes, children: [], location };
+        return { tagName, prefix, localName, namespaceUri, attributes, children: [], location, textContent: "" };
     }
     scanner.expect(">");
     const children = [];
+    const textParts = [];
     for (;;) {
-        skipTextAndMisc(scanner, warnings);
+        skipTextAndMisc(scanner, warnings, textParts);
         if (scanner.startsWith("</")) {
             scanner.expect("</");
             const closingName = readName(scanner);
@@ -251,16 +264,22 @@ function parseElement(scanner, parentScope, warnings) {
         // element/closing-tag pattern) is treated as malformed input.
         throw new XmlSyntaxError("Unexpected content while looking for a child element or closing tag", scanner.loc());
     }
-    return { tagName, prefix, localName, namespaceUri, attributes, children, location };
+    return { tagName, prefix, localName, namespaceUri, attributes, children, location, textContent: decodeXmlEntities(textParts.join("")) };
 }
-function skipTextAndMisc(scanner, warnings) {
+// v0.4.1 Batch 2 — `textParts` accumulates direct text/CDATA content so
+// callers needing element text content (e.g. Network Security Config's
+// <domain>/<pin> elements) can read it via XmlElement.textContent. Comments,
+// processing instructions, and DOCTYPE are still skipped, never counted as
+// text — only true character data and CDATA sections are captured.
+function skipTextAndMisc(scanner, warnings, textParts) {
     for (;;) {
         if (scanner.startsWith("<!--")) {
             scanner.skipUntil("-->");
             continue;
         }
         if (scanner.startsWith("<![CDATA[")) {
-            scanner.skipUntil("]]>");
+            scanner.expect("<![CDATA[");
+            textParts.push(scanner.captureUntil("]]>"));
             continue;
         }
         if (scanner.startsWith("<?")) {
@@ -271,10 +290,7 @@ function skipTextAndMisc(scanner, warnings) {
             break;
         if (scanner.eof())
             break;
-        // Plain text content between elements — not meaningful for manifest
-        // structure, so it is discarded rather than stored.
-        scanner.advance();
-        continue;
+        textParts.push(scanner.advance());
     }
 }
 // Parses `xmlText` into a small element tree. Never throws: all failures are

package/dist/src/mobile/android/report/model.js

@@ -1,10 +1,29 @@
 import { androidVerdictToHumanLabel } from "../validate/androidVerdict.js";
 const GRADLE_OPERATION_CHECK_PREFIX = "android-gradle-";
 const GRADLE_METADATA_CHECK_ID = "android-gradle-metadata";
+// v0.4.1 Batch 8 — fixed check-id order for the eleven internal advanced
+// checks and four external tools (agents.txt Batch 8 sections 9.1/10.5).
+// Re-declared here (not imported from each check's checkResult.ts) to avoid
+// a report -> advancedSecurity/externalTools import-fan-out; each id is a
+// stable literal already asserted by that check's own regression tests.
+const ADVANCED_SECURITY_CHECK_ID_ORDER = [
+    "android-network-security-audit",
+    "android-backup-configuration-audit",
+    "android-release-configuration-audit",
+    "android-secret-candidates-audit",
+    "android-signing-configuration-audit",
+    "android-webview-security-audit",
+    "android-file-provider-audit",
+    "android-sensitive-storage-audit",
+    "android-sensitive-logging-audit",
+    "android-clipboard-security-audit",
+    "android-firebase-google-services-audit",
+];
+const EXTERNAL_TOOL_CHECK_ID_ORDER = ["android-semgrep-audit", "android-osv-audit", "android-lint-audit", "android-dependency-check-audit"];
 const STATIC_ANALYSIS_LIMITATIONS = [
     "Static Android project analysis does not prove runtime behavior.",
     "Manifests are parsed independently and are not merged.",
-    "Manifest placeholders and resource references are not resolved.",
+    "Selected local resource references are resolved conservatively; manifest placeholders, full resource merging, and overlay precedence are not resolved.",
     "Gradle files are not evaluated (no Groovy/Kotlin execution).",
     "Dynamic Gradle values may remain unresolved.",
     "Same-file duplicate Gradle assignments use first-match extraction (a known limitation — see agents.txt Batch 4/5 notes).",
@@ -33,6 +52,10 @@ export function toAndroidReportModel(result, options = {}) {
     const deepLinkCount = result.manifests.reduce((sum, m) => sum + m.deepLinks.length, 0);
     const gradleOperationResults = result.checks.filter((c) => c.id.startsWith(GRADLE_OPERATION_CHECK_PREFIX) && c.id !== GRADLE_METADATA_CHECK_ID);
     const gradleMetadataCheck = result.checks.find((c) => c.id === GRADLE_METADATA_CHECK_ID);
+    const checksById = new Map(result.checks.map((c) => [c.id, c]));
+    const advancedSecurityChecks = ADVANCED_SECURITY_CHECK_ID_ORDER.map((id) => checksById.get(id)).filter((c) => Boolean(c));
+    const externalToolChecks = EXTERNAL_TOOL_CHECK_ID_ORDER.map((id) => checksById.get(id)).filter((c) => Boolean(c));
+    const candidateEvidenceCount = result.checks.reduce((sum, c) => sum + (c.candidateEvidence?.length ?? 0), 0);
     const verdict = String(result.verdict);
     const isRealVerdict = result.verdict !== "not-calculated";
     return {
@@ -42,6 +65,8 @@ export function toAndroidReportModel(result, options = {}) {
             target: result.target,
             profile: options.profile ?? "android",
             requestedGradleOperations: options.requestedGradleOperations ?? [],
+            requestedExternalTools: options.requestedExternalTools ?? [],
+            externalNetworkPolicy: options.externalNetworkPolicy ?? "deny",
             generatedAt: result.finishedAt,
             totalDurationMs: result.durationMs,
         },
@@ -65,6 +90,12 @@ export function toAndroidReportModel(result, options = {}) {
         },
         gradleCheckSummary: gradleMetadataCheck ? { title: "Gradle metadata check", summary: `status: ${gradleMetadataCheck.status}` } : undefined,
         gradleOperationResults,
+        advancedSecurityChecks,
+        externalToolChecks,
+        candidateEvidenceSummary: {
+            title: "Candidate evidence (review required, not confirmed findings)",
+            summary: `${candidateEvidenceCount} candidate evidence item(s) across all checks`,
+        },
         releaseMetadataSummary: {
             title: "Release metadata",
             summary: result.releaseMetadata

package/dist/src/mobile/android/report/renderAndroidReport.js

@@ -17,6 +17,27 @@ function formatDuration(ms) {
         return `${ms}ms`;
     return `${(ms / 1000).toFixed(1)}s`;
 }
+// v0.4.1 Batch 8 — shared per-check rendering for the new ADVANCED SECURITY
+// CHECKS and EXTERNAL TOOL RESULTS sections. Bounded: prints counts and
+// identifiers, never raw stdout/stderr/environment/complete source (that
+// bound is already enforced by each check builder before evidence reaches
+// this report — this function does not itself receive raw tool output).
+function renderCheckSummaryLines(lines, c) {
+    lines.push(`  ${c.id} [${c.status}] — ${sanitize(c.title)}`);
+    lines.push(`    category: ${c.category}  findings: ${c.findings.length}  candidates: ${c.candidateEvidence?.length ?? 0}`);
+    if (c.evidence.length > 0)
+        lines.push(`    evidence: ${c.evidence.map(sanitize).join(" | ")}`);
+    if (c.durationMs !== undefined)
+        lines.push(`    duration: ${formatDuration(c.durationMs)}`);
+    if (c.skipInfo)
+        lines.push(`    skip reason: ${sanitize(c.skipInfo.reason)}`);
+    for (const w of c.warnings)
+        lines.push(`    warning: ${sanitize(w)}`);
+    for (const e of c.errors)
+        lines.push(`    error: ${sanitize(e)}`);
+    if (c.environmentRequirements.length > 0)
+        lines.push(`    limitations: ${c.environmentRequirements.map(sanitize).join(" | ")}`);
+}
 export function renderAndroidTextReport(model) {
     const lines = [];
     // 1. Summary
@@ -143,6 +164,48 @@ export function renderAndroidTextReport(model) {
         }
     }
     lines.push("");
+    // 15b. Advanced security checks (v0.4.1 Batch 8)
+    lines.push(divider());
+    lines.push("ADVANCED SECURITY CHECKS");
+    lines.push(divider());
+    if (model.advancedSecurityChecks.length === 0) {
+        lines.push("(none ran — not applicable to this target)");
+    }
+    else {
+        for (const c of model.advancedSecurityChecks) {
+            renderCheckSummaryLines(lines, c);
+        }
+    }
+    lines.push("");
+    // 15c. External tool results (v0.4.1 Batch 8)
+    lines.push(divider());
+    lines.push("EXTERNAL TOOL RESULTS");
+    lines.push(divider());
+    lines.push(`Requested external tools: ${model.metadata.requestedExternalTools.length > 0 ? model.metadata.requestedExternalTools.join(", ") : "(none — zero external-tool process execution)"}`);
+    if (model.metadata.requestedExternalTools.length > 0) {
+        lines.push(`Effective network policy: ${model.metadata.externalNetworkPolicy}`);
+    }
+    if (model.externalToolChecks.length === 0) {
+        lines.push("No external tools were requested.");
+    }
+    else {
+        for (const c of model.externalToolChecks) {
+            renderCheckSummaryLines(lines, c);
+        }
+    }
+    lines.push("");
+    // 15d. Candidate evidence (review required, distinct from confirmed findings)
+    lines.push(divider());
+    lines.push("CANDIDATE EVIDENCE (REVIEW REQUIRED — NOT CONFIRMED FINDINGS)");
+    lines.push(divider());
+    lines.push(sanitize(model.candidateEvidenceSummary.summary));
+    for (const c of [...model.advancedSecurityChecks, ...model.externalToolChecks]) {
+        for (const candidate of c.candidateEvidence ?? []) {
+            lines.push(`  [${candidate.confidence}/${candidate.resolutionState}] ${candidate.ruleId} — ${sanitize(candidate.summary)}`);
+            lines.push(`    location: ${candidate.location.path}${candidate.location.line !== undefined ? `:${candidate.location.line}` : ""}`);
+        }
+    }
+    lines.push("");
     // 16. Release metadata
     lines.push(divider());
     lines.push("RELEASE METADATA");

package/dist/src/mobile/android/validate/validateAndroidTarget.js

@@ -18,6 +18,80 @@ import { buildAndroidPlayReadinessChecklist } from "./playReadinessChecklist.js"
 import { calculateAndroidVerdict } from "./androidVerdict.js";
 import { buildAndroidDetectionCheckResult, buildAndroidManifestParsingCheckResult, buildAndroidTargetImmutabilityCheckResult, } from "./detectionAndImmutabilityCheckResults.js";
 import { ANDROID_VALIDATION_ARTIFACT_TYPE, ANDROID_VALIDATION_SCHEMA_VERSION, } from "../validation/result.js";
+import { auditAndroidNetworkSecurity } from "../advancedSecurity/networkSecurity/checkResult.js";
+import { auditAndroidBackupConfiguration } from "../advancedSecurity/backupConfiguration/checkResult.js";
+import { auditAndroidReleaseConfiguration } from "../advancedSecurity/releaseConfiguration/checkResult.js";
+import { auditAndroidSecretCandidates } from "../advancedSecurity/secretCandidates/checkResult.js";
+import { auditAndroidSigningConfiguration } from "../advancedSecurity/signingConfiguration/checkResult.js";
+import { auditAndroidWebViewSecurity } from "../advancedSecurity/webview/checkResult.js";
+import { auditAndroidFileProviders } from "../advancedSecurity/fileProvider/checkResult.js";
+import { auditAndroidSensitiveStorage } from "../advancedSecurity/sensitiveStorage/checkResult.js";
+import { auditAndroidSensitiveLogging } from "../advancedSecurity/sensitiveLogging/checkResult.js";
+import { auditAndroidClipboardSecurity } from "../advancedSecurity/clipboard/checkResult.js";
+import { auditAndroidFirebaseGoogleServices } from "../advancedSecurity/firebaseGoogle/checkResult.js";
+import { runRequestedAndroidExternalTools } from "../advancedSecurity/externalTools/runRequestedAndroidExternalTools.js";
+import { createRealExternalToolExecutor } from "../advancedSecurity/externalTools/runBoundedExternalTool.js";
+import { createRealGradleCommandExecutor } from "../gradle/validate/executor.js";
+function runIsolatedCheck(descriptor) {
+    try {
+        return descriptor.run();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            id: descriptor.id,
+            category: descriptor.category,
+            title: descriptor.title,
+            status: "error",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [`Advanced check raised an unexpected error: ${message}`],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+}
+function buildAdvancedSecurityChecks(targetRoot, detection, manifestEntries, gradleModules) {
+    // Fixed order (agents.txt Batch 8 section 9.1) — never alphabetical, never
+    // derived from filesystem/object iteration.
+    const descriptors = [
+        { id: "android-network-security-audit", category: "android-network-security", title: "Android Network Security Config audit", run: () => auditAndroidNetworkSecurity(targetRoot, detection, manifestEntries) },
+        { id: "android-backup-configuration-audit", category: "android-backup-configuration", title: "Android backup configuration audit", run: () => auditAndroidBackupConfiguration(targetRoot, detection, manifestEntries) },
+        { id: "android-release-configuration-audit", category: "android-release-configuration", title: "Android release configuration audit", run: () => auditAndroidReleaseConfiguration(targetRoot, detection, manifestEntries, gradleModules) },
+        { id: "android-secret-candidates-audit", category: "android-secret-candidates", title: "Android hardcoded secret-candidate audit", run: () => auditAndroidSecretCandidates(targetRoot, detection) },
+        { id: "android-signing-configuration-audit", category: "android-signing-configuration", title: "Android signing configuration audit", run: () => auditAndroidSigningConfiguration(targetRoot, detection, gradleModules) },
+        { id: "android-webview-security-audit", category: "android-webview", title: "Android WebView security audit", run: () => auditAndroidWebViewSecurity(targetRoot, detection) },
+        { id: "android-file-provider-audit", category: "android-file-provider", title: "Android FileProvider security audit", run: () => auditAndroidFileProviders(targetRoot, detection, manifestEntries) },
+        { id: "android-sensitive-storage-audit", category: "android-sensitive-storage", title: "Android sensitive-storage audit", run: () => auditAndroidSensitiveStorage(targetRoot, detection) },
+        { id: "android-sensitive-logging-audit", category: "android-sensitive-logging", title: "Android sensitive-logging audit", run: () => auditAndroidSensitiveLogging(targetRoot, detection) },
+        { id: "android-clipboard-security-audit", category: "android-clipboard", title: "Android clipboard security audit", run: () => auditAndroidClipboardSecurity(targetRoot, detection) },
+        { id: "android-firebase-google-services-audit", category: "android-firebase-google-services", title: "Android Firebase/Google services audit", run: () => auditAndroidFirebaseGoogleServices(targetRoot, detection) },
+    ];
+    return descriptors.map(runIsolatedCheck);
+}
+// Memoizes by Gradle operation id: the fixed allowlist (operations.ts) maps
+// each operation id to fixed args, so within one validation run the same
+// operation id always means the same command — caching by id is safe and
+// prevents running `lintDebug` twice when both --android-gradle-operations
+// lint-debug and --android-external-tools android-lint are requested
+// together (agents.txt Batch 8 section 10.6).
+function createDedupingGradleExecutor(base) {
+    const cache = new Map();
+    return (plan) => {
+        const cached = cache.get(plan.operationId);
+        if (cached)
+            return cached;
+        const promise = base(plan);
+        cache.set(plan.operationId, promise);
+        return promise;
+    };
+}
 function readToolPackageMetadata(toolRoot) {
     try {
         const pkgRaw = fs.readFileSync(path.join(toolRoot, "package.json"), "utf8");
@@ -75,6 +149,11 @@ export async function validateAndroidTarget(options) {
     // batch owner).
     const detectionCheck = buildAndroidDetectionCheckResult(detection);
     const manifestParsingCheck = buildAndroidManifestParsingCheckResult(detection, manifestEntries);
+    // Shared, deduping Gradle executor: reused for both --android-gradle-
+    // operations and (if android-lint is also externally requested) the
+    // Batch 7 Android Lint adapter, so `lintDebug` never runs twice for one
+    // validation run (agents.txt Batch 8 section 10.6).
+    const sharedGradleExecutor = createDedupingGradleExecutor(options.gradleExecutor ?? createRealGradleCommandExecutor());
     // 15-16. Optional Gradle operations — never run unless explicitly requested.
     const requestedOperationIds = options.requestedGradleOperationIds ?? [];
     const gradleOperationResults = requestedOperationIds.length > 0
@@ -83,17 +162,79 @@ export async function validateAndroidTarget(options) {
             targetRoot: resolvedTargetRoot,
             detection,
             operationIds: requestedOperationIds,
-            executor: options.gradleExecutor,
+            executor: sharedGradleExecutor,
             allowWithoutTaskDiscovery: options.allowGradleWithoutTaskDiscovery,
             platform: options.platform,
         })
         : [];
-    // 17. Target mutation evidence — captured regardless of whether Gradle ran,
+    // v0.4.1 Batch 8 — eleven internal advanced Android checks, active by
+    // default (agents.txt Batch 8 section 9.1). Sequential, fixed order,
+    // isolated per-check via runIsolatedCheck. Never executes a process or
+    // touches the network.
+    const advancedSecurityChecks = buildAdvancedSecurityChecks(resolvedTargetRoot, detection, manifestEntries, gradle.modules);
+    // v0.4.1 Batch 8 — optional external-tool integration. Never executes
+    // unless requestedExternalToolIds is non-empty (same "no request, no
+    // execution" convention as Gradle operations). Wrapped in try/catch so a
+    // dispatcher-level failure (e.g. an unknown tool id slipping past CLI
+    // validation in a programmatic caller) cannot discard the checks already
+    // gathered above.
+    const requestedExternalToolIds = options.requestedExternalToolIds ?? [];
+    let externalToolChecks = [];
+    if (requestedExternalToolIds.length > 0) {
+        try {
+            externalToolChecks = await runRequestedAndroidExternalTools({
+                request: {
+                    requestedTools: requestedExternalToolIds,
+                    targetRoot: resolvedTargetRoot,
+                    artifactRoot: options.externalToolArtifactRoot ?? path.join(options.toolRoot, "reports", "security", "external-tools"),
+                    networkPolicy: options.externalNetworkPolicy ?? "deny",
+                },
+                detection,
+                executors: {
+                    semgrep: options.externalToolExecutors?.semgrep ?? createRealExternalToolExecutor(),
+                    osv: options.externalToolExecutors?.osv ?? createRealExternalToolExecutor(),
+                    androidLint: options.externalToolExecutors?.androidLint ?? sharedGradleExecutor,
+                    dependencyCheck: options.externalToolExecutors?.dependencyCheck ?? createRealExternalToolExecutor(),
+                },
+                discover: options.externalToolDiscover,
+                javaAvailable: options.javaAvailable,
+                lintTaskAvailable: options.lintTaskAvailable,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            externalToolChecks = [
+                {
+                    id: "android-external-tools-dispatch",
+                    category: "android-semgrep",
+                    title: "External security-tool dispatch",
+                    status: "error",
+                    requirementLevel: "optional",
+                    ran: false,
+                    skipped: false,
+                    evidence: [],
+                    findings: [],
+                    warnings: [],
+                    errors: [`External-tool dispatch raised an unexpected error: ${message}`],
+                    sourcePaths: [],
+                    confidence: "unknown",
+                    environmentRequirements: [],
+                    candidateEvidence: [],
+                },
+            ];
+        }
+    }
+    // 17. Target mutation evidence — captured after every process this run may
+    // have executed (Gradle operations, advanced checks, and external tools),
     // so the static-only path also proves it made no changes.
     const snapshotAfter = captureTargetSnapshot(resolvedTargetRoot, hasGit);
     const targetMutation = buildTargetMutationReport(snapshotBefore, snapshotAfter);
     const immutabilityCheck = buildAndroidTargetImmutabilityCheckResult(targetMutation);
-    // 18. Assemble checks/findings in deterministic order (agents.txt section 10.3).
+    // 18. Assemble checks/findings in deterministic order (agents.txt Batch 8
+    // section 11.1): the existing v0.4.0 check order is preserved exactly
+    // (ending with immutabilityCheck, as before), and the eleven advanced
+    // checks and any requested external tools are APPENDED after it — never
+    // interleaved into the existing order.
     const checks = [
         detectionCheck,
         manifestParsingCheck,
@@ -104,6 +245,8 @@ export async function validateAndroidTarget(options) {
         gradleMetadataCheck,
         ...gradleOperationResults,
         immutabilityCheck,
+        ...advancedSecurityChecks,
+        ...externalToolChecks,
     ];
     const findingsById = new Map();
     for (const check of checks) {