@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/audits/report/renderAuditTextReport.js

@@ -133,6 +133,43 @@ export function renderAuditTextReport(model) {
         }
     }
     lines.push("");
+    // v0.4.2 Batch 3 -- bounded summary only, mirroring the "Security
+    // validation summary" section above exactly. Confirmed mapped Android
+    // findings are NOT re-listed here -- they already appear in the "Issues"
+    // section below like any other AuditIssue (see spec section 12: "the
+    // existing generic issues section remains the detailed presentation for
+    // confirmed mapped Android findings"). CandidateEvidence bodies never
+    // appear here either -- only counts, with a pointer to the full Android
+    // report for detail.
+    lines.push("Android security validation summary");
+    lines.push(divider("-"));
+    if (!model.androidSecurity.summary.requested) {
+        lines.push("  (not requested -- add --android alongside --types security to include it)");
+    }
+    else {
+        const android = model.androidSecurity.summary;
+        const candidates = model.androidSecurity.candidates;
+        const applicabilityNote = android.applicable === false ? " (target is not an Android project)" : "";
+        lines.push(`  Status: ${android.status}${applicabilityNote}`);
+        lines.push(`  Verdict: ${android.verdict ?? "(unknown)"}`);
+        lines.push(`  Checks: total=${android.totalChecks} passed=${android.passedChecks} withFindings=${android.checksWithFindings} candidateOnly=${android.candidateOnlyChecks} skipped=${android.skippedChecks} inconclusive=${android.inconclusiveChecks} failed=${android.failedChecks}`);
+        lines.push(`  Findings: confirmed=${android.confirmedFindingCount} mappedIssues=${android.mappedIssueCount}`);
+        lines.push(`  Candidates (review evidence, not confirmed vulnerabilities): total=${candidates.totalCount} checksWithCandidates=${candidates.checksWithCandidates}`);
+        if (android.warnings.length > 0) {
+            lines.push(`  Warnings: ${android.warnings.length}`);
+        }
+        if (android.errors.length > 0) {
+            lines.push(`  Errors: ${android.errors.length}`);
+            for (const e of android.errors.slice(0, 5)) {
+                lines.push(`    ${sanitizeLine(e)}`);
+            }
+        }
+        if (android.reportPaths.text || android.reportPaths.json) {
+            lines.push(`  Full report: ${android.reportPaths.text ?? "(none)"} / ${android.reportPaths.json ?? "(none)"}`);
+        }
+        lines.push("  Static analysis only -- does not prove runtime behavior, APK/AAB validity, Play compliance, or pentest results.");
+    }
+    lines.push("");
     lines.push("Issue summary");
     lines.push(divider("-"));
     lines.push(`  Total issues: ${model.summary.totalIssues}`);

package/dist/src/audits/security/androidAuditIntegration.js

@@ -0,0 +1,145 @@
+import path from "node:path";
+import { validateAndroidTarget } from "../../mobile/android/validate/validateAndroidTarget.js";
+import { toAndroidReportModel } from "../../mobile/android/report/model.js";
+import { writeAndroidReportFiles } from "../../mobile/android/report/writeAndroidReportFiles.js";
+import { reportFilenamePrefix } from "../../securityValidation/validate/resolveTarget.js";
+import { mapAndroidSecurityFindingToAuditIssue } from "./mapAndroidSecurityFindingToAuditIssue.js";
+import { ANDROID_AUDIT_NOT_REQUESTED_SUMMARY, EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY, } from "./securityAuditTypes.js";
+const ANDROID_REPORT_SUBDIR = "android";
+// Bounded, redacted — never the thrown value's stack, never raw child-process
+// output (there is none at this boundary; validateAndroidTarget itself never
+// spawns a process unless Gradle/external-tool options are requested, which
+// Batch 2 never supplies).
+const MAX_ANDROID_ERROR_MESSAGE_LENGTH = 500;
+function boundErrorMessage(message) {
+    return message.length <= MAX_ANDROID_ERROR_MESSAGE_LENGTH
+        ? message
+        : `${message.slice(0, MAX_ANDROID_ERROR_MESSAGE_LENGTH)}... [truncated, ${message.length} chars total]`;
+}
+function failedSummary(errorMessage) {
+    return {
+        ...ANDROID_AUDIT_NOT_REQUESTED_SUMMARY,
+        requested: true,
+        applicable: null,
+        status: "failed",
+        errors: [boundErrorMessage(errorMessage)],
+    };
+}
+// Exact-duplicate dedupe by AuditIssue id only, first occurrence wins —
+// mirrors validateAndroidTarget's own findingsById convention. Iterates
+// checks in their own fixed order (never re-sorted) and each check's own
+// findings in their own order — never the top-level, already-flattened
+// result.findings, which has lost per-check identity this mapper needs as
+// context. Exported standalone so aggregation correctness (ordering,
+// dedup, provenance) can be tested against small literal AndroidCheckResult
+// fixtures without needing a full AndroidValidationResult.
+export function aggregateAndroidIssues(checks, reportReference) {
+    const issuesById = new Map();
+    for (const check of checks) {
+        for (const finding of check.findings) {
+            const issue = mapAndroidSecurityFindingToAuditIssue(finding, {
+                checkId: check.id,
+                checkCategory: check.category,
+                checkConfidence: check.confidence,
+                reportReference,
+            });
+            if (!issuesById.has(issue.id)) {
+                issuesById.set(issue.id, issue);
+            }
+        }
+    }
+    return [...issuesById.values()];
+}
+export function buildCandidateSummary(checks) {
+    const byConfidence = { ...EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY.byConfidence };
+    const byResolutionState = { ...EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY.byResolutionState };
+    const byCategory = {};
+    let totalCount = 0;
+    let checksWithCandidates = 0;
+    for (const check of checks) {
+        const candidates = check.candidateEvidence ?? [];
+        if (candidates.length === 0)
+            continue;
+        checksWithCandidates += 1;
+        for (const candidate of candidates) {
+            totalCount += 1;
+            byConfidence[candidate.confidence] += 1;
+            byResolutionState[candidate.resolutionState] += 1;
+            byCategory[candidate.category] = (byCategory[candidate.category] ?? 0) + 1;
+        }
+    }
+    // Deterministic key order regardless of check/candidate traversal order.
+    const sortedByCategory = Object.fromEntries(Object.entries(byCategory).sort(([a], [b]) => a.localeCompare(b)));
+    return { totalCount, checksWithCandidates, byConfidence, byResolutionState, byCategory: sortedByCategory };
+}
+export async function runAndroidAuditIntegration(options) {
+    const runAndroidValidation = options.runAndroidValidation ?? validateAndroidTarget;
+    let result;
+    try {
+        result = await runAndroidValidation({
+            toolRoot: options.toolRoot,
+            targetPath: options.targetPathArg,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { issues: [], summary: failedSummary(`Android validation failed to run: ${message}`) };
+    }
+    const isApplicable = result.detection.projectKind !== "non-android";
+    const reportModel = toAndroidReportModel(result, { profile: "android" });
+    const reportDir = path.join(options.toolRoot, "reports", "security", ANDROID_REPORT_SUBDIR);
+    const prefix = reportFilenamePrefix({
+        isSelf: result.target.local.isSelf,
+        packageName: result.target.local.packageName,
+        packageVersion: result.target.local.packageVersion,
+        targetRoot: result.target.local.targetRoot,
+    });
+    let reportPaths;
+    let writeErrors = [];
+    try {
+        const written = writeAndroidReportFiles({ outDir: reportDir, prefix, report: reportModel, formats: ["text", "json"] });
+        reportPaths = { text: written.textPath, json: written.jsonPath };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        reportPaths = { text: null, json: null };
+        writeErrors = [boundErrorMessage(`Failed to write Android report files: ${message}`)];
+    }
+    const issues = aggregateAndroidIssues(result.checks, reportPaths);
+    const passedChecks = result.checks.filter((c) => c.status === "passed").length;
+    const skippedChecks = result.checks.filter((c) => c.status === "skipped").length;
+    const inconclusiveChecks = result.checks.filter((c) => c.status === "inconclusive").length;
+    const failedChecks = result.checks.filter((c) => c.status === "failed" || c.status === "error").length;
+    const checksWithFindings = result.checks.filter((c) => c.findings.length > 0).length;
+    const candidateOnlyChecks = result.checks.filter((c) => c.findings.length === 0 && (c.candidateEvidence?.length ?? 0) > 0).length;
+    const candidateEvidenceCount = result.checks.reduce((sum, c) => sum + (c.candidateEvidence?.length ?? 0), 0);
+    const summary = {
+        requested: true,
+        applicable: isApplicable,
+        status: "completed",
+        verdict: result.verdict,
+        totalChecks: result.checks.length,
+        passedChecks,
+        checksWithFindings,
+        candidateOnlyChecks,
+        skippedChecks,
+        inconclusiveChecks,
+        failedChecks,
+        confirmedFindingCount: result.findings.length,
+        mappedIssueCount: issues.length,
+        candidateEvidenceCount,
+        // No Gradle/external-tool programmatic passthrough exists yet in Batch 2
+        // (see securityAuditTypes.ts's AndroidAuditSummary comment) — the default
+        // request always executes zero of either.
+        requestedGradleOperationCount: 0,
+        executedGradleOperationCount: 0,
+        requestedExternalToolCount: 0,
+        executedExternalToolCount: 0,
+        skippedExternalToolCount: 0,
+        reportPaths,
+        warnings: result.warnings,
+        errors: [...result.errors, ...writeErrors],
+        candidateSummary: buildCandidateSummary(result.checks),
+    };
+    return { issues, summary };
+}

package/dist/src/audits/security/mapAndroidSecurityFindingToAuditIssue.js

@@ -0,0 +1,116 @@
+import { makeAuditEvidence } from "../core/auditIssue.js";
+import { isBlockingSecuritySeverity, mapSecuritySeverityToAuditSeverity } from "./mapSecurityFindingToAuditIssue.js";
+// ---------------------------------------------------------------------------
+// v0.4.2 Batch 1 — pure Android SecurityFinding -> AuditIssue mapper.
+//
+// Android checks already reuse SecurityFinding as-is (see
+// src/mobile/android/audit/androidFinding.ts's own header comment) — there is
+// no parallel "AndroidSecurityFinding" type. What Android findings lose by
+// reusing the generic SecurityFinding shape is per-family taxonomy: every
+// Android finding's own `category` is the single shared value "static-scan"
+// (a SecurityCheckCategory), while the *specific* Android family (backup,
+// secrets, webview, ...) only lives on the owning AndroidCheckResult.category.
+// This mapper therefore takes a small AndroidAuditMappingContext alongside
+// the finding — supplied by the (future Batch 2) caller that already has the
+// owning AndroidCheckResult in hand — rather than trying to recover that
+// context by parsing the finding's own opaque id/evidence text.
+//
+// Reuses mapSecurityFindingToAuditIssue's severity/blocking policy exactly
+// (SecuritySeverity is the same shared type for Android and non-Android
+// findings) instead of defining a second severity table. Pure, no I/O, no
+// mutation, no CandidateEvidence handling — CandidateEvidence is a distinct
+// type (see src/mobile/android/advancedSecurity/candidateEvidence.ts) and
+// cannot be passed here at all: this function's parameter type is
+// SecurityFinding, not CandidateEvidence.
+// ---------------------------------------------------------------------------
+export const ANDROID_SECURITY_AUDIT_DETECTOR_ID = "android-security-validation-adapter";
+const DEFAULT_CONFIDENCE = "medium";
+const DEFAULT_FALSE_POSITIVE_RISK = "medium";
+// MobileConfidence carries an extra "unknown" state SecurityFinding-derived
+// AuditConfidence has no equivalent for; mapped to the same conservative
+// "medium" default the generic security mapper uses when no per-finding
+// confidence exists at all, rather than inventing a fourth AuditConfidence
+// value.
+function mapCheckConfidenceToAuditConfidence(confidence) {
+    if (confidence === "high" || confidence === "medium" || confidence === "low")
+        return confidence;
+    return DEFAULT_CONFIDENCE;
+}
+// makeAndroidFinding (src/mobile/android/audit/androidFinding.ts) is the sole
+// place Android findings compose their `evidence` string, always in the exact
+// form `location=<relativePath>(:<line>)?` (optionally followed by further
+// ` | `-joined detail segments). Extracting the line from that well-known,
+// single-producer format is not fabricating a source position — it is
+// reading a real value the same codebase already wrote, deterministically.
+// Guarded so a value is only trusted when its path matches the finding's own
+// affectedFiles[0]; anything else is left absent rather than guessed.
+const LOCATION_EVIDENCE_PATTERN = /(?:^|\s\|\s)location=([^\s|]+)/;
+function extractAndroidFindingLine(finding) {
+    if (!finding.evidence)
+        return undefined;
+    const relativePath = finding.affectedFiles?.[0];
+    if (!relativePath)
+        return undefined;
+    const match = LOCATION_EVIDENCE_PATTERN.exec(finding.evidence);
+    if (!match)
+        return undefined;
+    const [locationPath, lineText] = match[1].split(":");
+    if (locationPath !== relativePath || lineText === undefined)
+        return undefined;
+    const line = Number(lineText);
+    return Number.isInteger(line) && line > 0 ? line : undefined;
+}
+export function mapAndroidSecurityFindingToAuditIssue(finding, context) {
+    const severity = mapSecuritySeverityToAuditSeverity(finding.severity);
+    const isBlockingSeverity = isBlockingSecuritySeverity(finding.severity);
+    const relativePath = finding.affectedFiles?.[0];
+    const line = extractAndroidFindingLine(finding);
+    const provenanceSuffix = context.externalToolId ? `, tool=${context.externalToolId}` : "";
+    const evidence = finding.evidence
+        ? [
+            makeAuditEvidence({
+                kind: "observation",
+                message: `Android security validation (${context.checkId}${provenanceSuffix}): ${finding.title}`,
+                excerpt: finding.evidence,
+                filePath: relativePath,
+                line,
+                source: `android-security-validation:${context.checkId}`,
+                confidence: mapCheckConfidenceToAuditConfidence(context.checkConfidence),
+            }),
+        ]
+        : [];
+    const reportPath = context.reportReference?.json ?? context.reportReference?.text ?? undefined;
+    if (reportPath) {
+        evidence.push(makeAuditEvidence({
+            kind: "reference",
+            message: "Original Android security-validation report",
+            filePath: reportPath,
+            source: "android-security-validation:report",
+            confidence: DEFAULT_CONFIDENCE,
+        }));
+    }
+    return {
+        id: `android:${context.checkId}:${finding.id}`,
+        auditType: "security",
+        detectorId: ANDROID_SECURITY_AUDIT_DETECTOR_ID,
+        title: finding.title,
+        description: finding.description,
+        severity,
+        confidence: mapCheckConfidenceToAuditConfidence(context.checkConfidence),
+        falsePositiveRisk: DEFAULT_FALSE_POSITIVE_RISK,
+        // Deliberately the Android-specific check category (e.g.
+        // "android-backup-configuration"), not finding.category — every Android
+        // finding's own `category` is the single shared "static-scan" value, so
+        // reusing it here would make every mapped Android issue's category
+        // uselessly uniform. See module header comment.
+        category: context.checkCategory,
+        evidence,
+        affectedFiles: finding.affectedFiles ?? [],
+        recommendedAction: finding.recommendation ?? "Review the Android security validation report for remediation guidance.",
+        suggestedFixStrategy: finding.recommendation ?? "See the linked Android security validation report for details.",
+        validationCommands: ["npm run security:validate -- --profile android"],
+        releaseBlocking: isBlockingSeverity,
+        implementationBlocking: isBlockingSeverity,
+        autoFixEligible: false,
+    };
+}

package/dist/src/audits/security/mapSecurityFindingToAuditIssue.js

@@ -31,12 +31,22 @@ const SEVERITY_MAP = {
 // false positives) nor discounts it as unreliable.
 const DEFAULT_CONFIDENCE = "medium";
 const DEFAULT_FALSE_POSITIVE_RISK = "medium";
+// Exported so other SecurityFinding-consuming mappers (e.g. the Android
+// audit-adapter mapper, v0.4.2 Batch 1) reuse the same conservative
+// severity policy instead of defining a second one.
+export function mapSecuritySeverityToAuditSeverity(severity) {
+    return SEVERITY_MAP[severity];
+}
+// Mirrors verdict.ts's calculateVerdict: blocker and major findings are what
+// drive a "not-ready-security-blocker-remains" verdict — minor/informational
+// findings never block release or implementation on their own. Exported for
+// reuse by other SecurityFinding-consuming mappers.
+export function isBlockingSecuritySeverity(severity) {
+    return severity === "blocker" || severity === "major";
+}
 export function mapSecurityFindingToAuditIssue(finding) {
-    const severity = SEVERITY_MAP[finding.severity];
-    // Mirrors verdict.ts's calculateVerdict: blocker and major findings are
-    // what drive a "not-ready-security-blocker-remains" verdict — minor/
-    // informational findings never block release or implementation on their own.
-    const isBlockingSeverity = finding.severity === "blocker" || finding.severity === "major";
+    const severity = mapSecuritySeverityToAuditSeverity(finding.severity);
+    const isBlockingSeverity = isBlockingSecuritySeverity(finding.severity);
     const evidence = finding.evidence
         ? [
             makeAuditEvidence({

package/dist/src/audits/security/securityAuditAdapter.js

@@ -6,7 +6,9 @@ import { writeSecurityReportFiles } from "../../securityValidation/report/writeS
 import { DEFAULT_SECURITY_CHECKS, DEFAULT_SECURITY_PROFILE } from "../../securityValidation/validate/cliOptions.js";
 import { verdictToHumanLabel } from "../../securityValidation/validate/verdict.js";
 import { mapSecurityFindingToAuditIssue } from "./mapSecurityFindingToAuditIssue.js";
-export async function runSecurityAuditAdapter(options) {
+import { runAndroidAuditIntegration } from "./androidAuditIntegration.js";
+import { ANDROID_AUDIT_NOT_REQUESTED_SUMMARY, } from "./securityAuditTypes.js";
+export async function runSecurityAuditAdapter(options, dependencies = {}) {
     const { toolRoot, config } = options;
     const summary = await runSecurityValidation({
         cwd: toolRoot,
@@ -60,7 +62,23 @@ export async function runSecurityAuditAdapter(options) {
         verdictReasonSummary: summary.verdictReasonSummary ?? null,
         reportPaths: { text: textPath, json: jsonPath },
     };
-    return { issues, summary: securitySummary };
+    // v0.4.2 Batch 2 — Android integration is strictly additive: existing
+    // non-Android issues/summary above are computed identically whether or not
+    // Android is requested, and Android issues are always appended after them,
+    // never interleaved or reordered.
+    let androidIssues = [];
+    let androidSummary = ANDROID_AUDIT_NOT_REQUESTED_SUMMARY;
+    if (options.android?.enabled) {
+        const androidResult = await runAndroidAuditIntegration({
+            toolRoot,
+            targetPathArg: config.targetPathArg,
+            request: options.android,
+            runAndroidValidation: dependencies.runAndroidValidation,
+        });
+        androidIssues = androidResult.issues;
+        androidSummary = androidResult.summary;
+    }
+    return { issues: [...issues, ...androidIssues], summary: securitySummary, android: androidSummary };
 }
 function buildRunScopedReportSuffix(startedAt, finishedAt) {
     return `${sanitizeTimestamp(startedAt)}-${sanitizeTimestamp(finishedAt)}-${process.pid}`;

package/dist/src/audits/security/securityAuditTypes.js

@@ -15,3 +15,40 @@ export const SECURITY_AUDIT_NOT_RUN_SUMMARY = {
     verdictReasonSummary: null,
     reportPaths: { text: null, json: null },
 };
+// Mirrors SecurityAuditReportSummary's own `ran`-first, always-present
+// convention: a status literal rather than inferring "did it run" from
+// nullable fields, so callers/tests can switch on one value instead of
+// reconstructing a state machine from several optional fields.
+export const ANDROID_AUDIT_STATUSES = ["not-requested", "not-applicable", "completed", "failed"];
+export const EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY = {
+    totalCount: 0,
+    checksWithCandidates: 0,
+    byConfidence: { unknown: 0, low: 0, medium: 0, high: 0 },
+    byResolutionState: { resolved: 0, unresolved: 0, missing: 0, malformed: 0, unsupported: 0, "not-applicable": 0 },
+    byCategory: {},
+};
+export const ANDROID_AUDIT_NOT_REQUESTED_SUMMARY = {
+    requested: false,
+    applicable: null,
+    status: "not-requested",
+    verdict: null,
+    totalChecks: 0,
+    passedChecks: 0,
+    checksWithFindings: 0,
+    candidateOnlyChecks: 0,
+    skippedChecks: 0,
+    inconclusiveChecks: 0,
+    failedChecks: 0,
+    confirmedFindingCount: 0,
+    mappedIssueCount: 0,
+    candidateEvidenceCount: 0,
+    requestedGradleOperationCount: 0,
+    executedGradleOperationCount: 0,
+    requestedExternalToolCount: 0,
+    executedExternalToolCount: 0,
+    skippedExternalToolCount: 0,
+    reportPaths: { text: null, json: null },
+    warnings: [],
+    errors: [],
+    candidateSummary: EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY,
+};