@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/validation/checkResult.js

@@ -1,3 +1,4 @@
+import { ANDROID_ADVANCED_CHECK_CATEGORIES } from "../advancedSecurity/ruleIds.js";
 // ---------------------------------------------------------------------------
 // v0.4.0 Batch 1 — Android check-result and skip-representation contracts.
 //
@@ -34,6 +35,11 @@ export const ANDROID_NON_PASSING_STATUSES = [
 // v0.4.0 Batch 5 — added "android-target-immutability" (additive) for the
 // required target mutation/immutability check (agents.txt Batch 5 section
 // 10.1).
+// v0.4.1 Batch 1 — added the advanced-security check-category families
+// (network/backup/release/secrets/signing/webview/file-provider/sensitive-
+// storage/sensitive-logging/clipboard/firebase/optional-tool) required by
+// later v0.4.1 batches. These categories are additive only: no check in this
+// batch is registered against them yet (see advancedSecurity/ruleIds.ts).
 export const ANDROID_CHECK_CATEGORIES = [
     "android-detection",
     "android-manifest",
@@ -45,6 +51,7 @@ export const ANDROID_CHECK_CATEGORIES = [
     "android-release-metadata",
     "android-play-readiness",
     "android-target-immutability",
+    ...ANDROID_ADVANCED_CHECK_CATEGORIES,
 ];
 export function isPassingAndroidStatus(status) {
     return status === "passed";

package/dist/src/securityValidation/commandRunner.js

@@ -8,11 +8,19 @@ export function resolveNpmCommand() {
 // Runs a security check command with an argument array (no shell interpolation).
 // npm audit returns exit code 1 on vulnerabilities; that is not treated as a
 // spawn failure here — the caller inspects the output and exit code separately.
+//
+// `env` is optional and additive (v0.4.1 Batch 7): omitted, it defaults to
+// `process.env` exactly as before this option existed, so every pre-existing
+// caller is unaffected. A caller that supplies a minimized environment (e.g.
+// the Batch 7 external-tool adapters, which must not propagate arbitrary
+// caller credentials to a spawned child process) gets that environment used
+// for both PATH resolution and the actual spawn.
 export async function runSecurityCommand(options) {
     const started = Date.now();
+    const env = options.env ?? process.env;
     const resolved = resolveCommand(options.command, {
         cwd: options.cwd,
-        env: process.env,
+        env,
         allowPowerShellShim: false,
     });
     const command = resolved.command;
@@ -48,6 +56,7 @@ export async function runSecurityCommand(options) {
                 cwd: options.cwd,
                 shell: false,
                 stdio: ["ignore", "pipe", "pipe"],
+                env,
             });
         }
         catch (spawnErr) {

package/dist/src/securityValidation/validate/cliOptions.js

@@ -61,6 +61,8 @@ const FLAGS_WITH_VALUE = {
     "--format": "format",
     "--fail-on": "failOn",
     "--android-gradle-operations": "androidGradleOperations",
+    "--android-external-tools": "androidExternalTools",
+    "--android-external-network": "androidExternalNetwork",
 };
 // v0.4.0 Batch 5 — the exact allowlisted optional Gradle operation ids
 // (agents.txt Batch 5 section 7.3). Deliberately re-declared here rather than
@@ -69,6 +71,14 @@ const FLAGS_WITH_VALUE = {
 // mobile dependency direction for five short string literals. Both lists
 // must stay in sync; a regression test in tests/security/ asserts they do.
 export const ANDROID_GRADLE_OPERATION_IDS = ["wrapper-version", "tasks", "assemble-debug", "unit-test-debug", "lint-debug"];
+// v0.4.1 Batch 8 — the exact allowlisted external-tool ids (agents.txt Batch
+// 8 section 10.1). Deliberately re-declared here for the same reason
+// ANDROID_GRADLE_OPERATION_IDS is re-declared above: this module stays free
+// of a securityValidation -> mobile import for four short string literals.
+// Both lists must stay in sync; a regression test asserts they do.
+export const ANDROID_EXTERNAL_TOOL_CLI_IDS = ["semgrep", "osv", "android-lint", "dependency-check"];
+export const ANDROID_EXTERNAL_NETWORK_POLICIES = ["deny", "allow-requested"];
+export const DEFAULT_ANDROID_EXTERNAL_NETWORK_POLICY = "deny";
 export function parseSecurityValidateArgs(argv) {
     const result = {};
     for (let i = 0; i < argv.length; i++) {
@@ -99,6 +109,8 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
     const failOn = parseFailOnOption(raw.failOn);
     const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
     const androidGradleOperationIds = parseAndroidGradleOperationsOption(raw.androidGradleOperations, profile.value);
+    const androidExternalToolIds = parseAndroidExternalToolsOption(raw.androidExternalTools, profile.value);
+    const androidExternalNetworkPolicy = parseAndroidExternalNetworkOption(raw.androidExternalNetwork, profile.value);
     return {
         target: raw.target,
         out,
@@ -115,6 +127,8 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
         failOnThreshold: failOn.value,
         failOnWasDefault: failOn.wasDefault,
         androidGradleOperationIds,
+        androidExternalToolIds,
+        androidExternalNetworkPolicy,
     };
 }
 // Parses --android-gradle-operations. Absent by default (empty array — zero
@@ -134,6 +148,38 @@ function parseAndroidGradleOperationsOption(raw, profile) {
     const unique = new Set(parts);
     return ANDROID_GRADLE_OPERATION_IDS.filter((id) => unique.has(id));
 }
+// Parses --android-external-tools. Absent by default (empty array — zero
+// external-tool execution). Rejects unknown tool ids and non-"android"-
+// profile usage before any validation work begins (agents.txt Batch 8
+// section 10.1) — same shape as parseAndroidGradleOperationsOption.
+function parseAndroidExternalToolsOption(raw, profile) {
+    if (raw === undefined)
+        return [];
+    if (profile !== "android") {
+        throw new Error(`--android-external-tools requires --profile android (got --profile ${profile}).`);
+    }
+    const parts = splitAndNormalizeList(raw, "--android-external-tools");
+    const invalid = parts.filter((p) => !ANDROID_EXTERNAL_TOOL_CLI_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --android-external-tools value(s): ${invalid.join(", ")}. Valid values are: ${ANDROID_EXTERNAL_TOOL_CLI_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    return ANDROID_EXTERNAL_TOOL_CLI_IDS.filter((id) => unique.has(id));
+}
+// Parses --android-external-network. Defaults to "deny" (agents.txt Batch 8
+// section 10.2) — network is never authorized unless explicitly requested.
+function parseAndroidExternalNetworkOption(raw, profile) {
+    if (raw === undefined)
+        return DEFAULT_ANDROID_EXTERNAL_NETWORK_POLICY;
+    if (profile !== "android") {
+        throw new Error(`--android-external-network requires --profile android (got --profile ${profile}).`);
+    }
+    const value = raw.trim();
+    if (!ANDROID_EXTERNAL_NETWORK_POLICIES.includes(value)) {
+        throw new Error(`Invalid --android-external-network value: "${raw}". Valid values are: ${ANDROID_EXTERNAL_NETWORK_POLICIES.join(", ")}.`);
+    }
+    return value;
+}
 // ---------------------------------------------------------------------------
 // v0.2.2 Batch 5 — profile-aware default checks
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/debug/res/xml/ambiguous_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/ambiguous_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <exclude domain="database" path="fake.db" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+    <exclude domain="database" path="fake-cache.db" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/broad_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="root" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup disableIfNoEncryptionCapabilities="true">
+        <include domain="sharedpref" path="." />
+        <exclude domain="database" path="fake-secrets.db" />
+    </cloud-backup>
+    <device-transfer>
+        <include domain="root" path="." />
+    </device-transfer>
+</data-extraction-rules>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/unsupported_domain_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="not-a-real-domain" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/malformed_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+    <!-- missing closing tag on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/unsupported_root.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="not_backup_rules">true</string>
+</resources>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/debug/res/xml/ambiguous_config.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true" />
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/ambiguous_config.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/base_cleartext_false.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/broad_and_duplicate_domains.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain>ab</domain>
+        <domain>Example.COM.</domain>
+        <domain>example.com</domain>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/empty_domain.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain includeSubdomains="true"></domain>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/malformed_pin.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain>example.org</domain>
+        <pin-set expiration="not-a-date">
+            <pin>MISSING_DIGEST_ATTRIBUTE_FAKE_PIN=</pin>
+            <pin digest="SHA-1">UNSUPPORTED_DIGEST_FAKE_PIN=</pin>
+            <pin digest="SHA-256"></pin>
+        </pin-set>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="true">example.com</domain>
+        <pin-set expiration="2030-01-01">
+            <pin digest="SHA-256">FAKEPINHASHFAKEPINHASHFAKEPINHASHFAKEPINHASH=</pin>
+        </pin-set>
+        <domain-config>
+            <domain includeSubdomains="false">nested.example.com</domain>
+            <trust-anchors>
+                <certificates src="@raw/my_custom_ca" />
+            </trust-anchors>
+        </domain-config>
+    </domain-config>
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="user" overridePins="true" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/malformed_network_security_config.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+    <!-- missing closing tags on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/unsupported_root.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="not_a_network_security_config">true</string>
+</resources>

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-dynamic.gradle

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        release {
+            debuggable rootProject.ext.fakeIsDebugFlag
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-false.gradle

@@ -0,0 +1,9 @@
+android {
+    buildTypes {
+        release {
+            debuggable false
+            minifyEnabled true
+            shrinkResources true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-true.gradle

@@ -0,0 +1,13 @@
+android {
+    buildTypes {
+        release {
+            debuggable true
+            minifyEnabled true
+            shrinkResources true
+            signingConfig signingConfigs.release
+        }
+        debug {
+            debuggable true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-false.gradle.kts

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        getByName("release") {
+            isDebuggable = false
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-true.gradle.kts

@@ -0,0 +1,10 @@
+android {
+    buildTypes {
+        getByName("release") {
+            isDebuggable = true
+            isMinifyEnabled = true
+            isShrinkResources = true
+            signingConfig = signingConfigs.getByName("release")
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/missing-release-build-type.gradle.kts

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        debug {
+            isDebuggable = true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/debug/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="user" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <exclude domain="sharedpref" path="fake-secrets.xml" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-b/src/main/res/xml/malformed_network_security_config.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    <!-- missing closing tag for base-config and network-security-config on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/SampleActivity.java

@@ -0,0 +1,8 @@
+package com.example.fixtures;
+
+// Fixture only — every value below is fake and unmistakably not a real
+// credential. Used by later v0.4.1 secret-candidate scanner batches.
+public class SampleActivity {
+    private static final String SECRET_TOKEN = "FAKE-DUMMY-TOKEN-0000000000000000";
+    private static final String DB_PASSWORD = "test-fake-db-password";
+}

package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/SampleActivity.kt

@@ -0,0 +1,9 @@
+package com.example.fixtures
+
+// Fixture only — every value below is fake and unmistakably not a real
+// credential. Used by later v0.4.1 secret-candidate scanner batches.
+class SampleActivity {
+    private val apiToken = "FAKE_TOKEN_1234567890ABCDEFGHIJ"
+    private val password = "changeme-fake-password"
+    private val placeholderSecret = "your-api-key-here"
+}

package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/build.gradle

@@ -0,0 +1,11 @@
+// Fixture only — every value below is fake. Gradle Groovy DSL candidate.
+android {
+    signingConfigs {
+        release {
+            storeFile file("fake-release-keystore.jks")
+            storePassword "FAKE-KEYSTORE-PASSWORD-0000"
+            keyAlias "fake-release-key"
+            keyPassword "FAKE-KEY-PASSWORD-0000"
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/build.gradle.kts

@@ -0,0 +1,11 @@
+// Fixture only — every value below is fake. Gradle Kotlin DSL candidate.
+android {
+    signingConfigs {
+        create("release") {
+            storeFile = file("fake-release-keystore.jks")
+            storePassword = "FAKE-KEYSTORE-PASSWORD-0000"
+            keyAlias = "fake-release-key"
+            keyPassword = "FAKE-KEY-PASSWORD-0000"
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/google-services.json

@@ -0,0 +1,16 @@
+{
+  "project_info": {
+    "project_number": "000000000000",
+    "project_id": "fake-fixture-project",
+    "storage_bucket": "fake-fixture-project.appspot.com"
+  },
+  "client": [
+    {
+      "client_info": {
+        "mobilesdk_app_id": "1:000000000000:android:0000000000000000000000",
+        "android_client_info": { "package_name": "com.example.fixtures" }
+      },
+      "api_key": [{ "current_key": "FAKE-FIREBASE-WEB-API-KEY-0000000000" }]
+    }
+  ]
+}

package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/local.properties

@@ -0,0 +1,3 @@
+# Fixture only — every value below is fake.
+sdk.dir=/fake/path/to/android/sdk
+fake.api.key=FAKE-LOCAL-PROPERTIES-KEY-0000000000