@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/clipboard/analyzeClipboardSecurity.js

@@ -0,0 +1,166 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier, splitIdentifierWords } from "../sensitiveData/classifySensitiveIdentifier.js";
+import { executableMask } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+import { collectClipboardEvidence } from "./collectClipboardEvidence.js";
+const USER_TRIGGER_METHOD_NAMES = /^(onClick|onLongClick|onMenuItemClick|copy|copyToClipboard|handleCopy|share)$/i;
+const BACKGROUND_LIKE_CLASS_SUFFIX = /(Service|Receiver|Worker)$/;
+function literalOf(expression) {
+    if (expression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(expression);
+    return classification.kind === "string-literal" ? classification.literalValue : undefined;
+}
+function labelSensitive(labelExpression) {
+    if (labelExpression === undefined)
+        return undefined;
+    const literal = literalOf(labelExpression);
+    if (literal !== undefined) {
+        const words = splitIdentifierWords(literal);
+        for (const word of words) {
+            const result = classifySensitiveIdentifier(word);
+            if (result)
+                return result;
+        }
+        return undefined;
+    }
+    const identifier = classifyDirectExpression(labelExpression).kind === "identifier" ? labelExpression : undefined;
+    return identifier ? classifySensitiveIdentifier(identifier) : undefined;
+}
+function valueSensitive(valueExpression) {
+    if (valueExpression === undefined)
+        return undefined;
+    const classification = classifyDirectExpression(valueExpression);
+    if (classification.kind !== "identifier" && classification.kind !== "member-access")
+        return undefined;
+    const name = valueExpression.replace(/^.*\./, "");
+    return classifySensitiveIdentifier(name);
+}
+function nearestBefore(mask, offset, pattern) {
+    const window = mask.slice(Math.max(0, offset - 4000), offset);
+    let last = null;
+    let match;
+    const re = new RegExp(pattern.source, "g");
+    while ((match = re.exec(window)) !== null)
+        last = match;
+    return last?.[1];
+}
+export function analyzeClipboardSecurityFile(targetRoot, file) {
+    const candidates = [];
+    const findings = [];
+    const mask = executableMask(file.content);
+    const matches = collectClipboardEvidence(file.content);
+    const creates = matches.filter((m) => m.kind === "clip-create");
+    const markerOffsets = matches.filter((m) => m.kind === "sensitive-marker").map((m) => m.offset);
+    const clearOffsetsByScope = new Map();
+    for (const m of matches.filter((m) => m.kind === "clip-clear")) {
+        const list = clearOffsetsByScope.get(m.scopeId) ?? [];
+        list.push(m.offset);
+        clearOffsetsByScope.set(m.scopeId, list);
+    }
+    const limitations = [
+        "Bounded lexical source analysis; does not prove clipboard content was actually set or read, that another application accessed the clipboard, or that a UI callback executed.",
+    ];
+    const location = (m) => buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: m.line });
+    const finding = (m, title, evidenceDetails) => findings.push(makeAndroidFinding({
+        ruleId: "android-sensitive-clipboard-write",
+        title,
+        severity: "major",
+        confidence: "high",
+        description: `${title} via ${m.api}. Static source evidence only; does not prove clipboard content was set at runtime or read by another application.`,
+        manifestPath: file.relativePath,
+        identity: `${m.api}:${m.line}`,
+        location: { line: m.line },
+        evidenceDetails,
+        recommendation: "Avoid copying credentials or recovery codes to the system clipboard; mark unavoidable sensitive clips with ClipDescription.EXTRA_IS_SENSITIVE and clear them promptly.",
+    }));
+    const candidate = (ruleId, m, summary, rawValue, confidence = "medium", resolutionState = "resolved") => candidates.push(makeCandidateEvidence({
+        ruleId,
+        category: "android-clipboard",
+        confidence,
+        modulePath: file.modulePath,
+        location: location(m),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    function resolveClip(argumentExpression, scopeId) {
+        if (argumentExpression === undefined)
+            return undefined;
+        const inline = /^ClipData\.(?:newPlainText|newHtmlText|newUri)\(([\s\S]*)\)$/.exec(argumentExpression.trim());
+        if (inline) {
+            const args = splitTopLevelArguments(inline[1]);
+            return { label: args[0], value: args[1], markerNearby: false };
+        }
+        const alias = classifyDirectExpression(argumentExpression).kind === "identifier" ? argumentExpression : undefined;
+        if (alias !== undefined) {
+            const source = creates.find((c) => c.assignedVariable === alias && c.scopeId === scopeId);
+            if (source)
+                return { label: source.labelExpression, value: source.valueExpression, markerNearby: false };
+        }
+        return undefined;
+    }
+    for (const m of matches) {
+        if (m.kind === "clip-set") {
+            const resolved = resolveClip(m.argumentExpression, m.scopeId);
+            const nearMarker = markerOffsets.some((offset) => Math.abs(offset - m.offset) < 400);
+            const clearedNearby = (clearOffsetsByScope.get(m.scopeId) ?? []).some((offset) => offset > m.offset);
+            const methodName = nearestBefore(mask, m.offset, /(?:fun|void)\s+([A-Za-z_]\w*)\s*\(/);
+            const userTriggered = methodName !== undefined && USER_TRIGGER_METHOD_NAMES.test(methodName);
+            if (!resolved) {
+                candidate("android-sensitive-clipboard-write", m, "Dynamic ClipData object set on the clipboard; contents not resolved", m.argumentExpression, "low", "unresolved");
+                continue;
+            }
+            const sensitive = labelSensitive(resolved.label) ?? valueSensitive(resolved.value);
+            if (!sensitive)
+                continue;
+            const valueClassification = resolved.value !== undefined ? classifyDirectExpression(resolved.value) : undefined;
+            if (valueClassification?.kind === "string-literal" || valueClassification?.kind === "identifier" || valueClassification?.kind === "member-access") {
+                const title = nearMarker
+                    ? `Sensitive clipboard write with an EXTRA_IS_SENSITIVE marker present nearby (${sensitive.sensitiveDataCategory})`
+                    : `Direct ${sensitive.sensitiveDataCategory} copied to the system clipboard`;
+                if (nearMarker || userTriggered) {
+                    candidate("android-sensitive-clipboard-write", m, title, resolved.value, "medium");
+                }
+                else {
+                    finding(m, title, [`label=${resolved.label ?? "(none)"}`, `marker=${nearMarker}`, `cleared=${clearedNearby}`]);
+                }
+            }
+            else {
+                candidate("android-sensitive-clipboard-write", m, `Sensitive-looking clipboard label with a dynamic payload (${sensitive.sensitiveDataCategory})`, resolved.value, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "legacy-set-text") {
+            const sensitive = valueSensitive(m.valueExpression);
+            if (!sensitive)
+                continue;
+            const classification = m.valueExpression !== undefined ? classifyDirectExpression(m.valueExpression) : undefined;
+            if (classification?.kind === "string-literal" || classification?.kind === "identifier") {
+                finding(m, `Direct ${sensitive.sensitiveDataCategory} copied via legacy ClipboardManager.setText`, [`value=${m.valueExpression}`]);
+            }
+            else {
+                candidate("android-sensitive-clipboard-write", m, "Sensitive-looking legacy clipboard write with a dynamic value", m.valueExpression, "medium", "unresolved");
+            }
+            continue;
+        }
+        if (m.kind === "clip-get") {
+            const className = nearestBefore(mask, m.offset, /class\s+([A-Za-z_]\w*)/);
+            const methodName = nearestBefore(mask, m.offset, /(?:fun|void)\s+([A-Za-z_]\w*)\s*\(/);
+            const backgroundLike = className !== undefined && BACKGROUND_LIKE_CLASS_SUFFIX.test(className);
+            const userTriggered = methodName !== undefined && USER_TRIGGER_METHOD_NAMES.test(methodName);
+            if (backgroundLike) {
+                candidate("android-sensitive-clipboard-read-review", m, `Clipboard read from a background-like class (${className})`, undefined, "medium", "unresolved");
+            }
+            else if (!userTriggered) {
+                candidate("android-sensitive-clipboard-read-review", m, "Clipboard read outside a recognized user-triggered paste flow", undefined, "low", "unresolved");
+            }
+            continue;
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/checkResult.js

@@ -0,0 +1,74 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+import { analyzeClipboardSecurityFile } from "./analyzeClipboardSecurity.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android clipboard-security check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID = "android-clipboard-security-audit";
+export function auditAndroidClipboardSecurity(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID,
+            category: "android-clipboard",
+            title: "Android clipboard security audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, modulePaths);
+    const sourceFiles = files.filter((file) => /\.(java|kt)$/.test(file.relativePath));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    for (const file of sourceFiles) {
+        const result = analyzeClipboardSecurityFile(targetRoot, file);
+        for (const f of result.findings)
+            findingsById.set(f.id, f);
+        for (const c of result.candidates)
+            candidatesById.set(c.id, c);
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const hasReportableFinding = findings.some((f) => f.severity !== "informational");
+    return {
+        id: ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID,
+        category: "android-clipboard",
+        title: "Android clipboard security audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${sourceFiles.length} Java/Kotlin file(s) scanned`],
+        findings,
+        warnings: [
+            ...skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: does not prove clipboard content was set or read, or that another application accessed the clipboard.",
+        ],
+        errors: [],
+        sourcePaths: sourceFiles.map((f) => f.relativePath),
+        confidence: skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/collectClipboardEvidence.js

@@ -0,0 +1,82 @@
+import { executableMask, lineForOffset, methodScopes, scopeAt } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded direct evidence collection for clipboard APIs
+// (ClipData creation, setPrimaryClip/getPrimaryClip/clearPrimaryClip, legacy
+// android.text.ClipboardManager, and the EXTRA_IS_SENSITIVE marker). Purely
+// lexical over comment/string-masked text, argument text re-sliced from
+// original content via regex match indices — see
+// sensitiveStorage/collectStorageEvidence.ts for the same pattern.
+// ---------------------------------------------------------------------------
+// Greedy (not lazy) argument capture: setPrimaryClip's single argument is
+// frequently itself a nested ClipData.newPlainText(...) call, and a lazy
+// quantifier would stop at that inner call's closing paren instead of the
+// outer call's. Still bounded to one statement by excluding newlines/`;`.
+const CLIP_CREATE = /(?:(?:val|var|ClipData)\s+([A-Za-z_]\w*)\s*=\s*)?ClipData\.(newPlainText|newHtmlText|newUri)\s*\(([^;\n]*)\)/gd;
+const CLIP_SET = /([A-Za-z_][\w.]*)\.setPrimaryClip\s*\(([^;\n]*)\)/gd;
+const LEGACY_SET_TEXT = /([A-Za-z_][\w.]*[Cc]lipboard[A-Za-z_]*)\.setText\s*\(([^;\n]*)\)/gd;
+const CLIP_GET_CALL = /([A-Za-z_][\w.]*)\.(getPrimaryClip|hasPrimaryClip|getItemAt|coerceToText)\s*\(([^;\n]*?)\)/gd;
+const CLIP_GET_PROPERTY = /([A-Za-z_][\w.]*[Cc]lipboard[A-Za-z_]*)\.(primaryClip|hasText)\b(?!\s*\()/gd;
+const LEGACY_GET_TEXT = /([A-Za-z_][\w.]*[Cc]lipboard[A-Za-z_]*)\.getText\s*\(\s*\)/gd;
+const CLIP_CLEAR = /([A-Za-z_][\w.]*)\.clearPrimaryClip\s*\(\s*\)/gd;
+const SENSITIVE_MARKER = /\bClipDescription\.EXTRA_IS_SENSITIVE\b/g;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    if (!span)
+        return match[group];
+    return content.slice(span[0], span[1]);
+}
+function push(list, content, scopes, kind, api, offset, extra) {
+    list.push({ kind, api, offset, line: lineForOffset(content, offset), scopeId: scopeAt(scopes, offset)?.id, ...extra });
+}
+export function collectClipboardEvidence(content) {
+    const mask = executableMask(content);
+    const scopes = methodScopes(mask);
+    const matches = [];
+    for (const match of mask.matchAll(CLIP_CREATE)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 3) ?? "");
+        push(matches, content, scopes, "clip-create", `ClipData.${match[2]}`, offset, {
+            assignedVariable: match[1],
+            labelExpression: args[0],
+            valueExpression: args[1],
+        });
+    }
+    for (const match of mask.matchAll(CLIP_SET)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, scopes, "clip-set", "ClipboardManager.setPrimaryClip", offset, {
+            receiver: match[1],
+            argumentExpression: args[0],
+        });
+    }
+    for (const match of mask.matchAll(LEGACY_SET_TEXT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(content, match, 2) ?? "");
+        push(matches, content, scopes, "legacy-set-text", "ClipboardManager.setText", offset, {
+            receiver: match[1],
+            valueExpression: args[0],
+        });
+    }
+    for (const match of mask.matchAll(CLIP_GET_CALL)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-get", `ClipboardManager.${match[2]}`, offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(CLIP_GET_PROPERTY)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-get", `ClipboardManager.${match[2]}`, offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(LEGACY_GET_TEXT)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-get", "ClipboardManager.getText", offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(CLIP_CLEAR)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "clip-clear", "ClipboardManager.clearPrimaryClip", offset, { receiver: match[1] });
+    }
+    for (const match of mask.matchAll(SENSITIVE_MARKER)) {
+        const offset = match.index ?? 0;
+        push(matches, content, scopes, "sensitive-marker", "ClipDescription.EXTRA_IS_SENSITIVE", offset, {});
+    }
+    return matches.sort((a, b) => a.offset - b.offset);
+}

package/dist/src/mobile/android/advancedSecurity/clipboard/index.js

@@ -0,0 +1 @@
+export { auditAndroidClipboardSecurity, ANDROID_CLIPBOARD_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/clipboard/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/checkResult.js

@@ -0,0 +1,255 @@
+import fs from "node:fs";
+import path from "node:path";
+import { makeAndroidFinding } from "../../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../../sourceLocation.js";
+import { sortCandidateEvidence } from "../../ordering.js";
+import { buildGradleCommandPlan } from "../../../gradle/validate/planner.js";
+import { captureTargetSnapshot, isExpectedAndroidGeneratedPath } from "../../../gradle/validate/targetMutation.js";
+import { buildExternalToolMutationReport, findFreshFiles } from "../mutation.js";
+import { copyExternalToolArtifactFromTarget } from "../artifacts.js";
+import { parseLintXml } from "./parseLintXml.js";
+import { parseLintSarif } from "./parseLintSarif.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — standalone Android Lint check. Reuses the existing
+// lint-debug Gradle operation as-is (its fixed args already include
+// --offline/--no-daemon/--console=plain — see operations.ts) rather than
+// creating a second Gradle task/operation system. Not called from
+// validateAndroidTarget or any active orchestration; not rendered in
+// reports; no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_LINT_AUDIT_CHECK_ID = "android-lint-audit";
+const LINT_REPORT_EXTENSIONS = [".xml", ".sarif"];
+function skippedCheck(reason, environmentRequirements = []) {
+    return {
+        id: ANDROID_LINT_AUDIT_CHECK_ID,
+        category: "android-lint",
+        title: "Android Lint audit (offline)",
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: ANDROID_LINT_AUDIT_CHECK_ID,
+            reason,
+            requirementLevel: "optional",
+            missingCapability: "gradle-lint-debug",
+            verdictImpact: "does not apply until Batch 8 integration",
+            recommendedNextAction: "Ensure a Gradle wrapper, Java, Android SDK, and cached dependencies are available, or run again after Batch 8 wires optional-tool selection into the CLI.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements,
+        candidateEvidence: [],
+    };
+}
+function severityToProject(severity) {
+    const normalized = severity.toLowerCase();
+    if (normalized === "fatal" || normalized === "error")
+        return "major";
+    if (normalized === "warning")
+        return "minor";
+    if (normalized === "information" || normalized === "informational")
+        return "informational";
+    if (normalized === "ignore")
+        return undefined;
+    return undefined;
+}
+export async function auditAndroidLint(options) {
+    const targetRoot = path.resolve(options.targetRoot);
+    if (options.taskAvailable === false) {
+        return skippedCheck("The lintDebug Gradle task was not found for this target.");
+    }
+    const plan = buildGradleCommandPlan("lint-debug", targetRoot, options.detection);
+    if (plan.rejected) {
+        return skippedCheck(plan.reason);
+    }
+    const before = captureTargetSnapshot(targetRoot, true);
+    const startedAtMs = Date.now();
+    const result = await options.executor(plan);
+    const after = captureTargetSnapshot(targetRoot, true);
+    const mutation = buildExternalToolMutationReport(before, after, isExpectedAndroidGeneratedPath);
+    const warnings = [];
+    if (!mutation.comparable)
+        warnings.push(`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`);
+    if (mutation.unexpectedChanges.length > 0)
+        warnings.push(`Unexpected target change(s) observed: ${mutation.unexpectedChanges.join(", ")}`);
+    if (result.timedOut) {
+        return {
+            id: ANDROID_LINT_AUDIT_CHECK_ID,
+            category: "android-lint",
+            title: "Android Lint audit (offline)",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`exitCode=${result.exitCode ?? "null"}`],
+            findings: [],
+            warnings: [...warnings, `lintDebug timed out after ${plan.timeoutMs}ms.`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "medium",
+            environmentRequirements: plan.environmentLimitations,
+            candidateEvidence: [],
+        };
+    }
+    if (result.exitCode === null) {
+        return skippedCheck("Gradle could not be spawned or resolved for this target (missing Java, wrapper, or environment issue).");
+    }
+    // Discover fresh (created-or-modified-by-this-run) lint report files
+    // rather than trusting a stale pre-existing report from an earlier run.
+    // A small backward epsilon absorbs filesystem mtime rounding/clock-tick
+    // granularity (observed on some Windows filesystems) without meaningfully
+    // weakening the stale-report exclusion, since a genuinely stale report is
+    // from a prior run (seconds/minutes old), not a few tens of milliseconds.
+    const FRESHNESS_EPSILON_MS = 250;
+    const freshFiles = findFreshFiles(targetRoot, LINT_REPORT_EXTENSIONS, startedAtMs - FRESHNESS_EPSILON_MS).filter((f) => /lint-results/i.test(path.basename(f)));
+    const findingsById = new Map();
+    const candidatesById = new Map();
+    const limitations = ["Reflects the debug variant lint run only; does not prove the published release variant's lint result.", "Gradle/plugin/report format may drift; unsupported report shapes are represented conservatively."];
+    const finding = (issueId, severity, title, message, relativePath, line, module) => findingsById.set(`lint:${issueId}:${relativePath ?? "(no-path)"}:${line ?? 0}`, makeAndroidFinding({
+        ruleId: "android-optional-tool-lint-evidence",
+        title,
+        severity,
+        confidence: "medium",
+        description: message || `Android Lint reported issue ${issueId}.`,
+        manifestPath: relativePath ?? "(unresolved)",
+        identity: `lint:${issueId}:${module ?? "(root)"}`,
+        location: { line },
+        evidenceDetails: [`externalRuleId=${issueId}`, module ? `module=${module}` : undefined].filter((v) => Boolean(v)),
+        recommendation: "Review the Android Lint issue and remediate or explicitly suppress it with justification.",
+    }));
+    const candidate = (issueId, summary, relativePath, line, confidence = "low") => candidatesById.set(`${issueId}:${relativePath ?? "(no-path)"}:${line ?? 0}:${summary.slice(0, 40)}`, makeCandidateEvidence({
+        ruleId: "android-optional-tool-lint-evidence",
+        category: "android-lint",
+        confidence,
+        location: relativePath ? (() => { try {
+            return buildAndroidSourceLocation(targetRoot, path.resolve(targetRoot, relativePath), { line });
+        }
+        catch {
+            return { path: relativePath, line };
+        } })() : { path: "(unknown)" },
+        summary,
+        rawValue: undefined,
+        resolutionState: "resolved",
+        staticAnalysisLimitations: limitations,
+    }));
+    const seenIssueKeys = new Set();
+    let sawAnyReport = false;
+    for (const filePath of freshFiles) {
+        const content = readFileSafe(filePath);
+        if (content === undefined)
+            continue;
+        const moduleGuess = moduleForPath(targetRoot, filePath, options.detection.modules.map((m) => m.path));
+        const artifact = copyExternalToolArtifactFromTarget(options.artifactRoot, targetRoot, "android-lint", filePath, filePath.toLowerCase().endsWith(".sarif") ? "sarif" : "xml");
+        void artifact;
+        if (filePath.toLowerCase().endsWith(".xml")) {
+            const parsedXml = parseLintXml(content);
+            if (parsedXml.malformed) {
+                warnings.push(`Malformed lint XML report: ${path.basename(filePath)}`);
+                continue;
+            }
+            sawAnyReport = true;
+            for (const issue of parsedXml.issues) {
+                const dedupeKey = `${issue.id}:${issue.file}:${issue.line}`;
+                if (seenIssueKeys.has(dedupeKey))
+                    continue;
+                seenIssueKeys.add(dedupeKey);
+                const relativePath = issue.file ? relativeIfContained(targetRoot, issue.file) : undefined;
+                const projectSeverity = severityToProject(issue.severity);
+                if (projectSeverity === "major" || projectSeverity === "minor") {
+                    finding(issue.id, projectSeverity, `Android Lint: ${issue.id}`, issue.message, relativePath, issue.line, moduleGuess);
+                }
+                else {
+                    candidate(issue.id, `Android Lint ${issue.severity} issue: ${issue.id} — ${issue.message}`, relativePath, issue.line, projectSeverity === "informational" ? "medium" : "low");
+                }
+            }
+        }
+        else {
+            const parsedSarif = parseLintSarif(content);
+            if (parsedSarif.malformed) {
+                warnings.push(`Malformed lint SARIF report: ${path.basename(filePath)}`);
+                continue;
+            }
+            sawAnyReport = true;
+            for (const sarifResult of parsedSarif.results) {
+                const dedupeKey = `${sarifResult.ruleId}:${sarifResult.artifactUri}:${sarifResult.line}`;
+                if (seenIssueKeys.has(dedupeKey))
+                    continue;
+                seenIssueKeys.add(dedupeKey);
+                const relativePath = sarifResult.artifactUri ? relativeIfContained(targetRoot, sarifResult.artifactUri) : undefined;
+                candidate(sarifResult.ruleId, `Android Lint SARIF ${sarifResult.level} result: ${sarifResult.ruleId} — ${sarifResult.message}`, relativePath, sarifResult.line, "low");
+            }
+        }
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    if (!sawAnyReport) {
+        const status = result.exitCode === 0 ? "inconclusive" : "inconclusive";
+        return {
+            id: ANDROID_LINT_AUDIT_CHECK_ID,
+            category: "android-lint",
+            title: "Android Lint audit (offline)",
+            status,
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`exitCode=${result.exitCode}`, "No fresh structured lint report was discovered."],
+            findings: [],
+            warnings,
+            errors: result.exitCode !== 0 ? ["lintDebug exited non-zero and no structured report was produced."] : [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: plan.environmentLimitations,
+            candidateEvidence: [],
+        };
+    }
+    const status = findings.length > 0 ? "failed" : "passed";
+    if (result.exitCode !== 0) {
+        warnings.push(`lintDebug exited with code ${result.exitCode}; a structured report was still discovered and parsed.`);
+    }
+    return {
+        id: ANDROID_LINT_AUDIT_CHECK_ID,
+        category: "android-lint",
+        title: "Android Lint audit (offline)",
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [`exitCode=${result.exitCode}`, `reportsDiscovered=${freshFiles.length}`, `expectedGeneratedPaths=${plan.expectedGeneratedPaths.join(",") || "(none)"}`],
+        findings,
+        warnings,
+        errors: [],
+        sourcePaths: freshFiles.map((f) => relativeIfContained(targetRoot, f) ?? f),
+        confidence: "high",
+        environmentRequirements: plan.environmentLimitations,
+        targetModificationObserved: mutation.comparable ? mutation.unexpectedChanges.length > 0 : undefined,
+        candidateEvidence,
+    };
+}
+function readFileSafe(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function moduleForPath(targetRoot, filePath, modulePaths) {
+    const relative = relativeIfContained(targetRoot, filePath);
+    if (!relative)
+        return undefined;
+    return modulePaths.find((m) => relative.startsWith(`${m}/`));
+}
+function relativeIfContained(root, absoluteOrRelative) {
+    const absolute = path.isAbsolute(absoluteOrRelative) ? absoluteOrRelative : path.resolve(root, absoluteOrRelative);
+    const normalizedRoot = path.resolve(root).replace(/\\/g, "/");
+    const normalizedAbsolute = absolute.replace(/\\/g, "/");
+    if (!normalizedAbsolute.startsWith(`${normalizedRoot}/`))
+        return undefined;
+    return normalizedAbsolute.slice(normalizedRoot.length + 1);
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/index.js

@@ -0,0 +1 @@
+export { auditAndroidLint, ANDROID_LINT_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/parseLintSarif.js

@@ -0,0 +1,37 @@
+import { safeJsonParse, DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+const MAX_RESULTS = 5_000;
+function boundedMessage(text) {
+    const value = typeof text === "string" ? text : "";
+    return value.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${value.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : value;
+}
+export function parseLintSarif(sarifText) {
+    const parsed = safeJsonParse(sarifText);
+    if (!parsed.ok)
+        return { malformed: true, results: [] };
+    const runs = Array.isArray(parsed.value.runs) ? parsed.value.runs : [];
+    const firstRun = runs[0];
+    if (!firstRun)
+        return { malformed: false, results: [] };
+    const driver = firstRun.tool?.driver;
+    const toolVersion = typeof driver?.version === "string" ? driver.version : undefined;
+    const rawResults = Array.isArray(firstRun.results) ? firstRun.results : [];
+    const results = [];
+    for (const rawResult of rawResults.slice(0, MAX_RESULTS)) {
+        const result = rawResult;
+        const message = result.message?.text;
+        const locations = Array.isArray(result.locations) ? result.locations : [];
+        const firstLocation = locations[0];
+        const physicalLocation = firstLocation?.physicalLocation;
+        const artifactLocation = physicalLocation?.artifactLocation;
+        const region = physicalLocation?.region;
+        results.push({
+            ruleId: typeof result.ruleId === "string" ? result.ruleId : "(unknown-rule)",
+            level: typeof result.level === "string" ? result.level : "(unknown)",
+            message: boundedMessage(message),
+            artifactUri: typeof artifactLocation?.uri === "string" ? artifactLocation.uri : undefined,
+            line: typeof region?.startLine === "number" ? region.startLine : undefined,
+            column: typeof region?.startColumn === "number" ? region.startColumn : undefined,
+        });
+    }
+    return { malformed: false, toolVersion, results };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/androidLint/parseLintXml.js

@@ -0,0 +1,36 @@
+import { parseXmlDocument, findChildren } from "../../../manifest/xml/parseXml.js";
+import { DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+function attr(element, name) {
+    return element.attributes.find((a) => a.localName === name)?.value;
+}
+function boundedMessage(text) {
+    if (!text)
+        return "";
+    return text.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${text.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : text;
+}
+export function parseLintXml(xmlText) {
+    const parsed = parseXmlDocument(xmlText);
+    if (!parsed.ok)
+        return { malformed: true, issues: [] };
+    const root = parsed.root;
+    if (root.localName !== "issues")
+        return { malformed: true, issues: [] };
+    const issues = [];
+    for (const issueElement of findChildren(root, "issue")) {
+        const locations = findChildren(issueElement, "location");
+        const primaryLocation = locations[0];
+        const lineRaw = primaryLocation ? attr(primaryLocation, "line") : undefined;
+        const columnRaw = primaryLocation ? attr(primaryLocation, "column") : undefined;
+        issues.push({
+            id: attr(issueElement, "id") ?? "(unknown-issue)",
+            severity: attr(issueElement, "severity") ?? "(unknown)",
+            message: boundedMessage(attr(issueElement, "message") ?? attr(issueElement, "summary")),
+            category: attr(issueElement, "category"),
+            priority: attr(issueElement, "priority"),
+            file: primaryLocation ? attr(primaryLocation, "file") : undefined,
+            line: lineRaw ? Number.parseInt(lineRaw, 10) : undefined,
+            column: columnRaw ? Number.parseInt(columnRaw, 10) : undefined,
+        });
+    }
+    return { malformed: false, issues, formatVersion: attr(root, "format") };
+}