@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/externalTools/artifacts.js

@@ -0,0 +1,95 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { relativeWithinRoot, resolveWithinRoot } from "../../../../core/pathSafety.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded, contained artifact handling for raw external-tool
+// output. New infrastructure: no existing owner copies/hashes generated
+// Gradle or external-tool output (confirmed absent from
+// src/mobile/android/gradle/validate/*). Reuses src/core/pathSafety.ts for
+// containment rather than a second path-safety implementation.
+// ---------------------------------------------------------------------------
+const MAX_ARTIFACT_BYTES = 32 * 1024 * 1024;
+function mediaTypeFor(kind) {
+    switch (kind) {
+        case "json":
+            return "application/json";
+        case "xml":
+            return "application/xml";
+        case "sarif":
+            return "application/sarif+json";
+        case "text":
+            return "text/plain";
+    }
+}
+function sha256Of(buffer) {
+    return `sha256:${createHash("sha256").update(buffer).digest("hex")}`;
+}
+function toolArtifactDir(artifactRoot, toolId) {
+    return resolveWithinRoot(path.resolve(artifactRoot), toolId);
+}
+// Writes tool-generated content (e.g. a materialized Semgrep config, or
+// content the adapter itself produced) under `<artifactRoot>/<toolId>/`.
+// Containment is validated by resolveWithinRoot, which throws on traversal —
+// callers must not catch that away.
+export function writeExternalToolArtifact(artifactRoot, toolId, fileName, content, kind) {
+    const dir = toolArtifactDir(artifactRoot, toolId);
+    fs.mkdirSync(dir, { recursive: true });
+    const absolutePath = resolveWithinRoot(dir, fileName);
+    const buffer = Buffer.from(content, "utf8");
+    const truncated = buffer.byteLength > MAX_ARTIFACT_BYTES;
+    const boundedBuffer = truncated ? buffer.subarray(0, MAX_ARTIFACT_BYTES) : buffer;
+    fs.writeFileSync(absolutePath, boundedBuffer);
+    return {
+        toolId,
+        artifactKind: kind,
+        relativePath: relativeWithinRoot(path.resolve(artifactRoot), absolutePath),
+        mediaType: mediaTypeFor(kind),
+        sizeBytes: boundedBuffer.byteLength,
+        sha256: sha256Of(boundedBuffer),
+        generatedByThisRun: true,
+        copiedFromTarget: false,
+        truncated,
+        parseStatus: "not-attempted",
+    };
+}
+// Copies an existing target-generated report (e.g. a fresh Android Lint XML
+// file) into the artifact root without modifying or deleting the original.
+export function copyExternalToolArtifactFromTarget(artifactRoot, targetRoot, toolId, sourceAbsolutePath, kind) {
+    let stat;
+    try {
+        stat = fs.statSync(sourceAbsolutePath);
+    }
+    catch {
+        return undefined;
+    }
+    if (!stat.isFile())
+        return undefined;
+    const truncated = stat.size > MAX_ARTIFACT_BYTES;
+    const buffer = truncated ? fs.readFileSync(sourceAbsolutePath).subarray(0, MAX_ARTIFACT_BYTES) : fs.readFileSync(sourceAbsolutePath);
+    const dir = toolArtifactDir(artifactRoot, toolId);
+    fs.mkdirSync(dir, { recursive: true });
+    const destFileName = path.basename(sourceAbsolutePath);
+    const destAbsolutePath = resolveWithinRoot(dir, destFileName);
+    fs.writeFileSync(destAbsolutePath, buffer);
+    let sourceTargetRelativePath;
+    try {
+        sourceTargetRelativePath = relativeWithinRoot(path.resolve(targetRoot), sourceAbsolutePath);
+    }
+    catch {
+        sourceTargetRelativePath = undefined;
+    }
+    return {
+        toolId,
+        artifactKind: kind,
+        relativePath: relativeWithinRoot(path.resolve(artifactRoot), destAbsolutePath),
+        mediaType: mediaTypeFor(kind),
+        sizeBytes: buffer.byteLength,
+        sha256: sha256Of(buffer),
+        generatedByThisRun: true,
+        copiedFromTarget: true,
+        sourceTargetRelativePath,
+        truncated,
+        parseStatus: "not-attempted",
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/boundedOutput.js

@@ -0,0 +1,33 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded text/JSON handling for external-tool output.
+//
+// No shared "safe JSON parse" utility existed before this batch (each
+// consumer, e.g. src/securityValidation/staticScans/semgrep.ts, inlines its
+// own unbounded try/catch JSON.parse). This module is the one owner Batch 7
+// adapters share — a truncated document is never handed to JSON.parse, since
+// a truncated-but-syntactically-valid-looking prefix could otherwise parse
+// successfully into a wrong/partial value instead of failing loudly.
+// ---------------------------------------------------------------------------
+export const DEFAULT_MAX_STDOUT_BYTES = 16 * 1024 * 1024;
+export const DEFAULT_MAX_STDERR_BYTES = 2 * 1024 * 1024;
+export const DEFAULT_MAX_REPORT_BYTES = 32 * 1024 * 1024;
+export const DEFAULT_MAX_MESSAGE_LENGTH = 1_000;
+export const DEFAULT_MAX_SNIPPET_LENGTH = 240;
+export function boundedText(text, maxLength) {
+    if (text.length <= maxLength)
+        return { text, truncated: false };
+    return { text: text.slice(0, maxLength), truncated: true };
+}
+// Bounds the input length BEFORE parsing (a truncated document is reported
+// malformed/truncated, never parsed as if it were a smaller valid document).
+export function safeJsonParse(text, maxBytes = DEFAULT_MAX_REPORT_BYTES) {
+    const truncated = text.length > maxBytes;
+    if (truncated)
+        return { ok: false, malformed: true, truncated: true };
+    try {
+        return { ok: true, value: JSON.parse(text), truncated: false };
+    }
+    catch {
+        return { ok: false, malformed: true, truncated: false };
+    }
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/dependencyCheck/checkResult.js

@@ -0,0 +1,173 @@
+import fs from "node:fs";
+import path from "node:path";
+import { sortCandidateEvidence } from "../../ordering.js";
+import { discoverAllowlistedExecutable } from "../discoverExecutable.js";
+import { buildMinimalEnvironment } from "../minimalEnvironment.js";
+import { copyExternalToolArtifactFromTarget } from "../artifacts.js";
+import { captureTargetSnapshot, buildExternalToolMutationReport } from "../mutation.js";
+import { runBoundedExternalTool, buildCommandSummary, VERSION_PROBE_TIMEOUT_MS } from "../runBoundedExternalTool.js";
+import { buildDependencyCheckArgs, DEPENDENCY_CHECK_REPORT_FILE_NAME, sanitizeDependencyCheckProjectName } from "./command.js";
+import { parseDependencyCheckJson } from "./parseDependencyCheckJson.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — standalone Android OWASP Dependency-Check check. Not
+// called from validateAndroidTarget or any active orchestration; not
+// rendered in reports; no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID = "android-dependency-check-audit";
+const DEPENDENCY_CHECK_CANDIDATES = ["dependency-check", "dependency-check.exe", "dependency-check.sh", "dependency-check.bat", "dependency-check.cmd"];
+const DEPENDENCY_CHECK_TIMEOUT_MS = 15 * 60_000;
+const DATABASE_UNAVAILABLE_PATTERN = /database.*(missing|unavailable|not found|corrupt)|no such file.*\.h2\.db/i;
+function skippedCheck(reason, environmentRequirements = []) {
+    return {
+        id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+        category: "android-dependency-check",
+        title: "Android OWASP Dependency-Check audit",
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            reason,
+            requirementLevel: "optional",
+            missingCapability: "dependency-check-executable-or-database",
+            verdictImpact: "does not apply until Batch 8 integration",
+            recommendedNextAction: "Install OWASP Dependency-Check locally with a populated local database, or run again after Batch 8 wires optional-tool selection into the CLI.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements,
+        candidateEvidence: [],
+    };
+}
+export async function auditAndroidDependencyCheck(options) {
+    const targetRoot = path.resolve(options.targetRoot);
+    if (options.javaAvailable === false) {
+        return skippedCheck("Java was not available; OWASP Dependency-Check requires a Java runtime.", ["Requires a Java runtime (JAVA_HOME or java on PATH)."]);
+    }
+    const discovered = (options.discover ?? (() => discoverAllowlistedExecutable(DEPENDENCY_CHECK_CANDIDATES, targetRoot)))();
+    if (!discovered.available) {
+        return skippedCheck("A Dependency-Check executable was not found on PATH.", ["Requires a Dependency-Check executable on PATH."]);
+    }
+    const env = buildMinimalEnvironment({ additionalAllowedKeys: ["JAVA_HOME"] });
+    const versionOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args: ["--version"], cwd: targetRoot, timeoutMs: VERSION_PROBE_TIMEOUT_MS, env });
+    if (versionOutcome.result.timedOut || versionOutcome.result.exitCode === null) {
+        return skippedCheck("Dependency-Check version probe failed or timed out.");
+    }
+    const rawVersion = versionOutcome.stdout.trim();
+    const outDir = path.resolve(options.artifactRoot, "dependency-check", "raw");
+    fs.mkdirSync(outDir, { recursive: true });
+    const projectName = sanitizeDependencyCheckProjectName(path.basename(targetRoot));
+    const args = buildDependencyCheckArgs(projectName, targetRoot, outDir);
+    const commandSummary = buildCommandSummary(discovered.basename, args, targetRoot, path.resolve(options.artifactRoot));
+    const before = captureTargetSnapshot(targetRoot, true);
+    const analysisOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args, cwd: targetRoot, timeoutMs: DEPENDENCY_CHECK_TIMEOUT_MS, env });
+    const after = captureTargetSnapshot(targetRoot, true);
+    const mutation = buildExternalToolMutationReport(before, after);
+    const warnings = [];
+    if (analysisOutcome.stdoutTruncated)
+        warnings.push("stdout was truncated.");
+    if (analysisOutcome.stderrTruncated)
+        warnings.push("stderr was truncated.");
+    if (!mutation.comparable)
+        warnings.push(`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`);
+    if (mutation.unexpectedChanges.length > 0)
+        warnings.push(`Unexpected target change(s) observed: ${mutation.unexpectedChanges.join(", ")}`);
+    if (analysisOutcome.result.timedOut) {
+        return {
+            id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            category: "android-dependency-check",
+            title: "Android OWASP Dependency-Check audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`],
+            findings: [],
+            warnings: [...warnings, `Dependency-Check timed out after ${DEPENDENCY_CHECK_TIMEOUT_MS}ms.`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "medium",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const reportPath = path.join(outDir, DEPENDENCY_CHECK_REPORT_FILE_NAME);
+    const reportExists = fs.existsSync(reportPath);
+    if (!reportExists) {
+        if (DATABASE_UNAVAILABLE_PATTERN.test(analysisOutcome.stderr)) {
+            return skippedCheck("The local OWASP Dependency-Check vulnerability database is unavailable; updates are disabled by policy, so the scan did not run.", [
+                "Requires a populated local Dependency-Check vulnerability database.",
+            ]);
+        }
+        return {
+            id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            category: "android-dependency-check",
+            title: "Android OWASP Dependency-Check audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `exitCode=${analysisOutcome.result.exitCode}`, "No JSON report was produced."],
+            findings: [],
+            warnings,
+            errors: analysisOutcome.result.exitCode !== 0 ? ["Dependency-Check exited non-zero and produced no report."] : [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const artifact = copyExternalToolArtifactFromTarget(options.artifactRoot, targetRoot, "dependency-check", reportPath, "json");
+    void artifact;
+    const rawJson = fs.readFileSync(reportPath, "utf8");
+    const parsed = parseDependencyCheckJson(rawJson, targetRoot);
+    const isFindingsExitCode = analysisOutcome.result.exitCode === 0 || analysisOutcome.result.exitCode === 1;
+    if (parsed.malformed) {
+        return {
+            id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+            category: "android-dependency-check",
+            title: "Android OWASP Dependency-Check audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `exitCode=${analysisOutcome.result.exitCode}`],
+            findings: [],
+            warnings,
+            errors: [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    if (parsed.truncated)
+        warnings.push("Dependency count exceeded the bounded limit; results were truncated.");
+    const findingsById = new Map(parsed.findings.map((f) => [f.id, f]));
+    const candidatesById = new Map(parsed.candidates.map((c) => [c.id, c]));
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const status = findings.length > 0 ? "failed" : isFindingsExitCode ? "passed" : "error";
+    return {
+        id: ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID,
+        category: "android-dependency-check",
+        title: "Android OWASP Dependency-Check audit",
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [`version=${rawVersion}`, `dependencies=${parsed.dependencyCount}`, `command=${commandSummary}`],
+        findings,
+        warnings,
+        errors: status === "error" ? ["Dependency-Check exited with a non-findings error."] : [],
+        sourcePaths: [],
+        confidence: "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/dependencyCheck/command.js

@@ -0,0 +1,33 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — fixed OWASP Dependency-Check command planning.
+//
+// One fixed operation. No caller-provided flags, no database updates, no
+// NVD API key. `--noupdate` is always present; the additional
+// `--disable*` flags are fixed and only prevent additional network-capable
+// analyzers (Node/Yarn/pnpm audit, RetireJS, known-exploited feed) from
+// running, matching the "no unauthorized network access" boundary.
+// ---------------------------------------------------------------------------
+export const DEPENDENCY_CHECK_REPORT_FILE_NAME = "dependency-check-report.json";
+export function sanitizeDependencyCheckProjectName(rawName) {
+    const sanitized = rawName.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 100);
+    return sanitized.length > 0 ? sanitized : "android-target";
+}
+export function buildDependencyCheckArgs(projectName, targetRoot, outDir) {
+    return [
+        "--project",
+        sanitizeDependencyCheckProjectName(projectName),
+        "--scan",
+        targetRoot,
+        "--format",
+        "JSON",
+        "--out",
+        outDir,
+        "--noupdate",
+        "--disableAssembly",
+        "--disableNodeAudit",
+        "--disableYarnAudit",
+        "--disablePnpmAudit",
+        "--disableRetireJS",
+        "--disableKnownExploited",
+    ];
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/dependencyCheck/index.js

@@ -0,0 +1 @@
+export { auditAndroidDependencyCheck, ANDROID_DEPENDENCY_CHECK_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/externalTools/dependencyCheck/parseDependencyCheckJson.js

@@ -0,0 +1,133 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../../sourceLocation.js";
+import { safeJsonParse, DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded OWASP Dependency-Check JSON normalization.
+//
+// Only the one Batch 1 Dependency-Check rule id
+// (android-optional-tool-dependency-check-evidence) is used internally; the
+// vulnerability id (CVE/GHSA/etc.) is preserved as a public identifier.
+// External cache paths (dependencies resolved from ~/.gradle, ~/.m2, etc.)
+// are never used as a source location — only target-contained paths are.
+// ---------------------------------------------------------------------------
+const MAX_DEPENDENCIES = 5_000;
+function boundedText(value) {
+    const text = typeof value === "string" ? value : "";
+    return text.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${text.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : text;
+}
+function severityFromCvss(vuln) {
+    const cvssv3 = vuln.cvssv3;
+    const cvssv2 = vuln.cvssv2;
+    const v3Score = typeof cvssv3?.baseScore === "number" ? cvssv3.baseScore : undefined;
+    if (v3Score !== undefined) {
+        return { severity: v3Score >= 7 ? "major" : v3Score >= 4 ? "minor" : v3Score > 0 ? "informational" : undefined, cvssVersion: "3", score: v3Score };
+    }
+    const v2Score = typeof cvssv2?.score === "number" ? cvssv2.score : undefined;
+    if (v2Score !== undefined) {
+        return { severity: v2Score >= 7 ? "major" : v2Score >= 4 ? "minor" : v2Score > 0 ? "informational" : undefined, cvssVersion: "2", score: v2Score };
+    }
+    const toolSeverity = typeof vuln.severity === "string" ? vuln.severity.toUpperCase() : undefined;
+    if (toolSeverity === "CRITICAL" || toolSeverity === "HIGH")
+        return { severity: "major" };
+    if (toolSeverity === "MEDIUM")
+        return { severity: "minor" };
+    if (toolSeverity === "LOW")
+        return { severity: "informational" };
+    return { severity: undefined };
+}
+function normalizeDependencyPath(targetRoot, filePath) {
+    if (!filePath)
+        return { isExternal: true };
+    const absolute = path.isAbsolute(filePath) ? filePath : path.resolve(targetRoot, filePath);
+    const normalizedRoot = path.resolve(targetRoot).replace(/\\/g, "/");
+    const normalizedAbsolute = absolute.replace(/\\/g, "/");
+    if (normalizedAbsolute.startsWith(`${normalizedRoot}/`)) {
+        try {
+            return { relativePath: buildAndroidSourceLocation(targetRoot, absolute).path, isExternal: false };
+        }
+        catch {
+            return { isExternal: true };
+        }
+    }
+    return { isExternal: true };
+}
+export function parseDependencyCheckJson(rawJson, targetRoot) {
+    const parsed = safeJsonParse(rawJson);
+    if (!parsed.ok)
+        return { malformed: true, findings: [], candidates: [], dependencyCount: 0, truncated: parsed.truncated };
+    const dependencies = Array.isArray(parsed.value.dependencies) ? parsed.value.dependencies : [];
+    const findings = [];
+    const candidates = [];
+    let truncated = dependencies.length > MAX_DEPENDENCIES;
+    for (const rawDependency of dependencies.slice(0, MAX_DEPENDENCIES)) {
+        const dependency = rawDependency;
+        const fileName = typeof dependency.fileName === "string" ? dependency.fileName : "(unknown-dependency)";
+        const filePath = typeof dependency.filePath === "string" ? dependency.filePath : undefined;
+        const { relativePath, isExternal } = normalizeDependencyPath(targetRoot, filePath);
+        const vulnerabilities = Array.isArray(dependency.vulnerabilities) ? dependency.vulnerabilities : [];
+        const suppressed = Array.isArray(dependency.suppressedVulnerabilities) ? dependency.suppressedVulnerabilities : [];
+        const suppressedNames = new Set(suppressed.map((v) => (typeof v?.name === "string" ? v.name : undefined)).filter(Boolean));
+        for (const rawVuln of vulnerabilities) {
+            const vuln = rawVuln;
+            const vulnName = typeof vuln.name === "string" ? vuln.name : "(unknown-vulnerability)";
+            const cwes = Array.isArray(vuln.cwes) ? vuln.cwes.filter((c) => typeof c === "string") : [];
+            const description = boundedText(vuln.description);
+            const { severity, cvssVersion, score } = severityFromCvss(vuln);
+            const identity = `dependency-check:${vulnName}:${fileName}:${relativePath ?? "(external)"}`;
+            const sourcePath = relativePath ?? `(external-cache) ${fileName}`;
+            if (suppressedNames.has(vulnName)) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-optional-tool-dependency-check-evidence",
+                    category: "android-dependency-check",
+                    confidence: "low",
+                    location: relativePath ? buildAndroidSourceLocation(targetRoot, path.resolve(targetRoot, relativePath)) : { path: sourcePath },
+                    summary: `Dependency-Check reports ${vulnName} as suppressed for ${fileName} (tool-reported; not independently verified)`,
+                    rawValue: undefined,
+                    resolutionState: "not-applicable",
+                    staticAnalysisLimitations: ["Suppression is tool-reported only; this analysis does not verify the suppression is justified."],
+                }));
+                continue;
+            }
+            if (isExternal) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-optional-tool-dependency-check-evidence",
+                    category: "android-dependency-check",
+                    confidence: "low",
+                    location: { path: sourcePath },
+                    summary: `Dependency-Check vulnerability ${vulnName} affects ${fileName} (resolved from an external cache, not a target-contained path)`,
+                    rawValue: undefined,
+                    resolutionState: "unresolved",
+                    staticAnalysisLimitations: ["Dependency resolved outside the target; not used as a target source location."],
+                }));
+                continue;
+            }
+            if (severity === undefined) {
+                candidates.push(makeCandidateEvidence({
+                    ruleId: "android-optional-tool-dependency-check-evidence",
+                    category: "android-dependency-check",
+                    confidence: "medium",
+                    location: buildAndroidSourceLocation(targetRoot, path.resolve(targetRoot, relativePath)),
+                    summary: `Dependency-Check vulnerability ${vulnName} (unknown severity) affects ${fileName}`,
+                    rawValue: description,
+                    resolutionState: "resolved",
+                    staticAnalysisLimitations: [`cwes=${cwes.join(",")}`, "Dependency-Check evidence only; does not prove the dependency is packaged into the final APK."],
+                }));
+                continue;
+            }
+            findings.push(makeAndroidFinding({
+                ruleId: "android-optional-tool-dependency-check-evidence",
+                title: `Dependency-Check vulnerability ${vulnName} in ${fileName}`,
+                severity,
+                confidence: "medium",
+                description: description || `Dependency-Check reported a vulnerability for this dependency.`,
+                manifestPath: relativePath,
+                identity,
+                evidenceDetails: [`cwes=${cwes.join(",") || "(none)"}`, cvssVersion ? `cvssV${cvssVersion}=${score}` : undefined].filter((v) => Boolean(v)),
+                recommendation: "Upgrade the affected dependency to a patched version.",
+            }));
+        }
+    }
+    return { malformed: false, findings, candidates, dependencyCount: dependencies.length, truncated };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/discoverExecutable.js

@@ -0,0 +1,13 @@
+import { resolveCommand } from "../../../../core/resolveCommand.js";
+// PATH resolution itself legitimately needs the real environment (a
+// minimized env would defeat PATH search); only the later *analysis* spawn
+// uses the minimized environment built by minimalEnvironment.ts.
+export function discoverAllowlistedExecutable(candidateBasenames, cwd) {
+    for (const basename of candidateBasenames) {
+        const resolved = resolveCommand(basename, { cwd, env: process.env, allowPowerShellShim: false });
+        if (resolved.resolutionKind !== "unavailable") {
+            return { available: true, command: basename, basename };
+        }
+    }
+    return { available: false };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/index.js

@@ -0,0 +1,8 @@
+export { ANDROID_EXTERNAL_TOOL_IDS, ANDROID_EXTERNAL_TOOL_ORDER, ANDROID_EXTERNAL_TOOL_NETWORK_POLICIES, ANDROID_EXTERNAL_TOOL_STATUSES, isAndroidExternalSecurityToolId, normalizeAndroidExternalToolRequest, notRequestedResult, } from "./types.js";
+export { discoverAllowlistedExecutable } from "./discoverExecutable.js";
+export { buildMinimalEnvironment } from "./minimalEnvironment.js";
+export { boundedText, safeJsonParse, DEFAULT_MAX_STDOUT_BYTES, DEFAULT_MAX_STDERR_BYTES, DEFAULT_MAX_REPORT_BYTES, DEFAULT_MAX_MESSAGE_LENGTH, DEFAULT_MAX_SNIPPET_LENGTH } from "./boundedOutput.js";
+export { writeExternalToolArtifact, copyExternalToolArtifactFromTarget } from "./artifacts.js";
+export { captureTargetSnapshot, buildExternalToolMutationReport, findFreshFiles } from "./mutation.js";
+export { runBoundedExternalTool, buildCommandSummary, createRealExternalToolExecutor, VERSION_PROBE_TIMEOUT_MS } from "./runBoundedExternalTool.js";
+export { runRequestedAndroidExternalTools } from "./runRequestedAndroidExternalTools.js";

package/dist/src/mobile/android/advancedSecurity/externalTools/minimalEnvironment.js

@@ -0,0 +1,26 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — minimal child-process environment construction.
+//
+// Neither existing process runner (runSecurityCommand, runMeasuredCommand)
+// minimizes the environment — both inherit the full caller process.env.
+// External tools are the first Batch 7 use case that must NOT propagate
+// arbitrary caller credentials (SEMGREP_APP_TOKEN, GITHUB_TOKEN, NVD_API_KEY,
+// cloud credentials, ...) to a spawned child, so this is new, additive
+// infrastructure rather than a correction to either existing runner.
+// ---------------------------------------------------------------------------
+const ALWAYS_ALLOWED_KEYS = ["PATH", "Path", "SystemRoot", "ComSpec", "COMSPEC", "PATHEXT", "TEMP", "TMP", "HOME", "USERPROFILE", "LANG", "LC_ALL"];
+// Never returns a value that was not explicitly allowlisted — this is a
+// security invariant (agents.txt Batch 7 section 9.10/23.15), not a
+// convenience default. A key present in the source env but not in the
+// allowlist is silently omitted, never partially masked or renamed.
+export function buildMinimalEnvironment(options = {}) {
+    const source = options.source ?? process.env;
+    const allowedKeys = new Set([...ALWAYS_ALLOWED_KEYS, ...(options.additionalAllowedKeys ?? [])]);
+    const env = {};
+    for (const key of allowedKeys) {
+        const value = source[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    return env;
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/mutation.js

@@ -0,0 +1,77 @@
+import { captureTargetSnapshot, diffTargetSnapshots } from "../../../../securityValidation/attackScenarios/targetSnapshot.js";
+import fs from "node:fs";
+import path from "node:path";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — target mutation evidence for external-tool execution.
+//
+// Reuses the existing generic snapshot/diff primitives
+// (src/securityValidation/attackScenarios/targetSnapshot.ts) exactly as
+// src/mobile/android/gradle/validate/targetMutation.ts does — no second
+// target-status model. Semgrep, OSV, and Dependency-Check are expected to
+// produce zero target mutation (all their output goes to the external
+// artifact root); Android Lint reuses the existing Android-generated-path
+// classifier since it runs through the existing Gradle lint-debug operation.
+// ---------------------------------------------------------------------------
+export { captureTargetSnapshot };
+export function buildExternalToolMutationReport(before, after, isExpectedGeneratedPath = () => false) {
+    const diff = diffTargetSnapshots(before, after);
+    if (!diff.comparable) {
+        return { comparable: false, reason: diff.reason, expectedGeneratedChanges: [], unexpectedChanges: [] };
+    }
+    const expectedGeneratedChanges = [];
+    const unexpectedChanges = [];
+    for (const entry of diff.newEntries) {
+        const isUntrackedOrAdded = entry.code === "??" || entry.code.includes("A");
+        if (isUntrackedOrAdded && isExpectedGeneratedPath(entry.path)) {
+            expectedGeneratedChanges.push(entry.path);
+        }
+        else {
+            unexpectedChanges.push(entry.path);
+        }
+    }
+    return {
+        comparable: true,
+        expectedGeneratedChanges: expectedGeneratedChanges.sort((a, b) => a.localeCompare(b)),
+        unexpectedChanges: unexpectedChanges.sort((a, b) => a.localeCompare(b)),
+    };
+}
+// Bounded, best-effort discovery of files under `dir` that did not exist (or
+// had a different mtime) before the run — used by the Android Lint adapter
+// to find fresh XML/SARIF reports without trusting a stale pre-existing
+// report. Never follows symlinks outside `dir`, never recurses unbounded.
+export function findFreshFiles(dir, extensions, sinceEpochMs, maxDepth = 6) {
+    const results = [];
+    function walk(current, depth) {
+        if (depth > maxDepth)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                walk(full, depth + 1);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (!extensions.some((ext) => entry.name.toLowerCase().endsWith(ext)))
+                continue;
+            let stat;
+            try {
+                stat = fs.statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (stat.mtimeMs >= sinceEpochMs)
+                results.push(full);
+        }
+    }
+    walk(dir, 0);
+    return results.sort((a, b) => a.localeCompare(b));
+}