@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/externalTools/osv/checkResult.js

@@ -0,0 +1,161 @@
+import path from "node:path";
+import { sortCandidateEvidence } from "../../ordering.js";
+import { discoverAllowlistedExecutable } from "../discoverExecutable.js";
+import { buildMinimalEnvironment } from "../minimalEnvironment.js";
+import { runBoundedExternalTool, buildCommandSummary, VERSION_PROBE_TIMEOUT_MS } from "../runBoundedExternalTool.js";
+import { buildOsvArgs, osvCommandFamilyForVersion, parseOsvMajorVersion } from "./command.js";
+import { parseOsvJson } from "./parseOsvJson.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — standalone Android OSV-Scanner check. Not called from
+// validateAndroidTarget or any active orchestration; not rendered in
+// reports; no CLI effect. Batch 8 integrates.
+//
+// OSV is the one Batch 7 tool that may legitimately need network access
+// (its vulnerability database service). Network is denied by default —
+// running OSV against the network requires both an explicit request for
+// "osv" AND networkPolicy "allow-for-requested-tool"; anything else skips.
+// ---------------------------------------------------------------------------
+export const ANDROID_OSV_AUDIT_CHECK_ID = "android-osv-audit";
+const OSV_CANDIDATES = ["osv-scanner", "osv-scanner.exe"];
+const OSV_TIMEOUT_MS = 5 * 60_000;
+function skippedCheck(reason, environmentRequirements = []) {
+    return {
+        id: ANDROID_OSV_AUDIT_CHECK_ID,
+        category: "android-osv",
+        title: "Android OSV-Scanner audit",
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: ANDROID_OSV_AUDIT_CHECK_ID,
+            reason,
+            requirementLevel: "optional",
+            missingCapability: "osv-scanner-executable-or-network",
+            verdictImpact: "does not apply until Batch 8 integration",
+            recommendedNextAction: "Install osv-scanner locally and/or authorize network access, or run again after Batch 8 wires optional-tool selection into the CLI.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements,
+        candidateEvidence: [],
+    };
+}
+export async function auditAndroidOsv(options) {
+    const targetRoot = path.resolve(options.targetRoot);
+    if (options.networkPolicy !== "allow-for-requested-tool") {
+        return skippedCheck("Network access was not authorized for OSV-Scanner (networkPolicy=deny), and no supported offline/local database mode was used.");
+    }
+    const discovered = (options.discover ?? (() => discoverAllowlistedExecutable(OSV_CANDIDATES, targetRoot)))();
+    if (!discovered.available) {
+        return skippedCheck("osv-scanner executable was not found on PATH.", ["Requires an osv-scanner executable on PATH."]);
+    }
+    const env = buildMinimalEnvironment();
+    const versionOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args: ["--version"], cwd: targetRoot, timeoutMs: VERSION_PROBE_TIMEOUT_MS, env });
+    if (versionOutcome.result.timedOut || versionOutcome.result.exitCode === null) {
+        return skippedCheck("osv-scanner version probe failed or timed out.");
+    }
+    const rawVersion = versionOutcome.stdout.trim();
+    const majorVersion = parseOsvMajorVersion(rawVersion);
+    const family = osvCommandFamilyForVersion(majorVersion);
+    if (!family) {
+        return skippedCheck(`osv-scanner version "${rawVersion || "(unknown)"}" is not a supported version family.`);
+    }
+    const args = buildOsvArgs(family, targetRoot);
+    const commandSummary = buildCommandSummary(discovered.basename, args, targetRoot);
+    const analysisOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args, cwd: targetRoot, timeoutMs: OSV_TIMEOUT_MS, env });
+    const warnings = [];
+    if (analysisOutcome.stdoutTruncated)
+        warnings.push("stdout was truncated; JSON output was not parsed as complete.");
+    if (analysisOutcome.stderrTruncated)
+        warnings.push("stderr was truncated.");
+    if (analysisOutcome.result.timedOut) {
+        return {
+            id: ANDROID_OSV_AUDIT_CHECK_ID,
+            category: "android-osv",
+            title: "Android OSV-Scanner audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `commandFamily=${family}`],
+            findings: [],
+            warnings: [...warnings, `osv-scanner timed out after ${OSV_TIMEOUT_MS}ms.`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "medium",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    if (analysisOutcome.stdoutTruncated) {
+        return {
+            id: ANDROID_OSV_AUDIT_CHECK_ID,
+            category: "android-osv",
+            title: "Android OSV-Scanner audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `commandFamily=${family}`],
+            findings: [],
+            warnings,
+            errors: [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const parsed = parseOsvJson(analysisOutcome.stdout, targetRoot);
+    // osv-scanner exits 1 when vulnerabilities are found — a service/network
+    // failure exits with a different code and typically no valid JSON.
+    const isFindingsExitCode = analysisOutcome.result.exitCode === 0 || analysisOutcome.result.exitCode === 1;
+    if (parsed.malformed) {
+        return {
+            id: ANDROID_OSV_AUDIT_CHECK_ID,
+            category: "android-osv",
+            title: "Android OSV-Scanner audit",
+            status: isFindingsExitCode ? "inconclusive" : "failed",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `commandFamily=${family}`, `exitCode=${analysisOutcome.result.exitCode}`],
+            findings: [],
+            warnings,
+            errors: isFindingsExitCode ? [] : ["osv-scanner exited with a non-findings error and produced no parseable JSON report."],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    if (parsed.truncated)
+        warnings.push("Vulnerability count exceeded the bounded limit; results were truncated.");
+    const findingsById = new Map(parsed.findings.map((f) => [f.id, f]));
+    const candidatesById = new Map(parsed.candidates.map((c) => [c.id, c]));
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    const status = findings.length > 0 ? "failed" : isFindingsExitCode ? "passed" : "error";
+    return {
+        id: ANDROID_OSV_AUDIT_CHECK_ID,
+        category: "android-osv",
+        title: "Android OSV-Scanner audit",
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [`version=${rawVersion}`, `commandFamily=${family}`, `vulnerabilities=${parsed.vulnerabilityCount}`, `command=${commandSummary}`, "networkPolicy=allow-for-requested-tool"],
+        findings,
+        warnings,
+        errors: status === "error" ? ["osv-scanner exited with a non-findings error."] : [],
+        sourcePaths: [],
+        confidence: "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/osv/command.js

@@ -0,0 +1,25 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — fixed OSV-Scanner command planning.
+//
+// Exactly two supported command families, selected only by parsed major
+// version. No caller-provided subcommands, endpoints, or scan paths beyond
+// the validated target are ever accepted.
+// ---------------------------------------------------------------------------
+export function osvCommandFamilyForVersion(majorVersion) {
+    if (majorVersion === undefined)
+        return undefined;
+    if (majorVersion >= 2)
+        return "modern";
+    if (majorVersion === 1)
+        return "legacy";
+    return undefined;
+}
+export function parseOsvMajorVersion(rawVersion) {
+    const match = /(\d+)\.\d+\.\d+/.exec(rawVersion);
+    if (!match)
+        return undefined;
+    return Number.parseInt(match[1], 10);
+}
+export function buildOsvArgs(family, targetRoot) {
+    return family === "modern" ? ["scan", "source", "--recursive", "--format", "json", targetRoot] : ["--recursive", "--format", "json", targetRoot];
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/osv/index.js

@@ -0,0 +1 @@
+export { auditAndroidOsv, ANDROID_OSV_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/externalTools/osv/parseOsvJson.js

@@ -0,0 +1,136 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../../sourceLocation.js";
+import { safeJsonParse, DEFAULT_MAX_MESSAGE_LENGTH } from "../boundedOutput.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded OSV-Scanner JSON normalization.
+//
+// Only the one Batch 1 OSV rule id (android-optional-tool-osv-evidence) is
+// used internally; the OSV vulnerability id and its aliases (CVE/GHSA) are
+// preserved as public identifiers, never redacted or fingerprinted (they
+// are not secrets). Complete advisory details and unbounded affected ranges
+// are never retained.
+// ---------------------------------------------------------------------------
+const MAX_RESULTS = 5_000;
+function severityFromDatabaseSpecific(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const upper = value.toUpperCase();
+    if (upper === "CRITICAL" || upper === "HIGH")
+        return "major";
+    if (upper === "MODERATE" || upper === "MEDIUM")
+        return "minor";
+    if (upper === "LOW")
+        return "informational";
+    return undefined;
+}
+function severityFromCvssScore(severityEntries) {
+    if (!Array.isArray(severityEntries))
+        return undefined;
+    for (const entry of severityEntries) {
+        const record = entry;
+        const score = typeof record.score === "string" ? Number.parseFloat(record.score) : undefined;
+        if (score !== undefined && !Number.isNaN(score)) {
+            if (score >= 7)
+                return "major";
+            if (score >= 4)
+                return "minor";
+            return "informational";
+        }
+    }
+    return undefined;
+}
+function boundedText(value) {
+    const text = typeof value === "string" ? value : "";
+    return text.length > DEFAULT_MAX_MESSAGE_LENGTH ? `${text.slice(0, DEFAULT_MAX_MESSAGE_LENGTH)}...` : text;
+}
+export function parseOsvJson(rawStdout, targetRoot) {
+    const parsed = safeJsonParse(rawStdout);
+    if (!parsed.ok) {
+        return { malformed: true, findings: [], candidates: [], vulnerabilityCount: 0, truncated: parsed.truncated };
+    }
+    const results = Array.isArray(parsed.value.results) ? parsed.value.results : [];
+    const findings = [];
+    const candidates = [];
+    let vulnerabilityCount = 0;
+    let truncated = false;
+    for (const rawResult of results) {
+        const result = rawResult;
+        const source = result.source;
+        const sourcePath = typeof source?.path === "string" ? source.path : undefined;
+        const packages = Array.isArray(result.packages) ? result.packages : [];
+        for (const rawPackage of packages) {
+            const packageEntry = rawPackage;
+            const pkg = packageEntry.package;
+            const packageName = typeof pkg?.name === "string" ? pkg.name : "(unknown-package)";
+            const ecosystem = typeof pkg?.ecosystem === "string" ? pkg.ecosystem : "(unknown-ecosystem)";
+            const packageVersion = typeof pkg?.version === "string" ? pkg.version : undefined;
+            const vulnerabilities = Array.isArray(packageEntry.vulnerabilities) ? packageEntry.vulnerabilities : [];
+            let location;
+            let relativePath;
+            if (sourcePath) {
+                try {
+                    const absolutePath = path.resolve(targetRoot, sourcePath);
+                    location = buildAndroidSourceLocation(targetRoot, absolutePath);
+                    relativePath = location.path;
+                }
+                catch {
+                    location = undefined;
+                }
+            }
+            for (const rawVuln of vulnerabilities) {
+                if (vulnerabilityCount >= MAX_RESULTS) {
+                    truncated = true;
+                    break;
+                }
+                vulnerabilityCount += 1;
+                const vuln = rawVuln;
+                const vulnId = typeof vuln.id === "string" ? vuln.id : "(unknown-id)";
+                const aliases = Array.isArray(vuln.aliases) ? vuln.aliases.filter((a) => typeof a === "string") : [];
+                const summary = boundedText(vuln.summary ?? vuln.details);
+                const severity = severityFromDatabaseSpecific(vuln.database_specific?.severity) ?? severityFromCvssScore(vuln.severity);
+                const identity = `osv:${vulnId}:${ecosystem}:${packageName}:${packageVersion ?? "(unknown-version)"}`;
+                if (!relativePath) {
+                    candidates.push(makeCandidateEvidence({
+                        ruleId: "android-optional-tool-osv-evidence",
+                        category: "android-osv",
+                        confidence: "low",
+                        location: { path: "(unknown)" },
+                        summary: `OSV vulnerability ${vulnId} found for ${packageName}@${packageVersion ?? "?"} but no target-contained manifest path was reported`,
+                        rawValue: undefined,
+                        resolutionState: "unresolved",
+                        staticAnalysisLimitations: ["OSV-Scanner evidence only; does not prove dependency reachability or exploitability."],
+                    }));
+                    continue;
+                }
+                if (severity === undefined) {
+                    candidates.push(makeCandidateEvidence({
+                        ruleId: "android-optional-tool-osv-evidence",
+                        category: "android-osv",
+                        confidence: "medium",
+                        location: location,
+                        summary: `OSV vulnerability ${vulnId} (unknown severity) affects ${packageName}@${packageVersion ?? "?"}`,
+                        rawValue: summary,
+                        resolutionState: "resolved",
+                        staticAnalysisLimitations: [`aliases=${aliases.join(",")}`, "OSV-Scanner evidence only; does not prove dependency reachability or exploitability."],
+                        relatedFindingIds: undefined,
+                    }));
+                    continue;
+                }
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-optional-tool-osv-evidence",
+                    title: `OSV vulnerability ${vulnId} in ${packageName}${packageVersion ? `@${packageVersion}` : ""}`,
+                    severity,
+                    confidence: "medium",
+                    description: summary || `OSV reported a vulnerability for this dependency (ecosystem=${ecosystem}).`,
+                    manifestPath: relativePath,
+                    identity,
+                    evidenceDetails: [`ecosystem=${ecosystem}`, `package=${packageName}`, `version=${packageVersion ?? "(unknown)"}`, `aliases=${aliases.join(",") || "(none)"}`],
+                    recommendation: "Upgrade the affected dependency to a patched version.",
+                }));
+            }
+        }
+    }
+    return { malformed: false, findings, candidates, vulnerabilityCount, truncated };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/runBoundedExternalTool.js

@@ -0,0 +1,51 @@
+import { runSecurityCommand } from "../../../../securityValidation/commandRunner.js";
+import { boundedText, DEFAULT_MAX_STDERR_BYTES, DEFAULT_MAX_STDOUT_BYTES } from "./boundedOutput.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — bounded external-tool execution.
+//
+// Reuses runSecurityCommand (shell:false, argument array, existing
+// cross-platform Windows .cmd/.bat shim handling via resolveCommand) rather
+// than a second process owner — the only new behavior added here is passing
+// a minimized environment and bounding stdout/stderr before they leave this
+// module, mirroring buildGradleOperationCheckResult's boundedSummary()
+// pattern but generalized for reuse across all four Batch 7 adapters.
+// ---------------------------------------------------------------------------
+export const VERSION_PROBE_TIMEOUT_MS = 15_000;
+export function createRealExternalToolExecutor() {
+    return (input) => runSecurityCommand({
+        command: input.command,
+        args: input.args,
+        cwd: input.cwd,
+        timeoutMs: input.timeoutMs,
+        env: input.env,
+    });
+}
+export async function runBoundedExternalTool(executor, input, maxStdoutBytes = DEFAULT_MAX_STDOUT_BYTES, maxStderrBytes = DEFAULT_MAX_STDERR_BYTES) {
+    const result = await executor(input);
+    const stdoutBound = boundedText(result.stdout, maxStdoutBytes);
+    const stderrBound = boundedText(result.stderr, maxStderrBytes);
+    return {
+        result,
+        stdout: stdoutBound.text,
+        stderr: stderrBound.text,
+        stdoutTruncated: stdoutBound.truncated,
+        stderrTruncated: stderrBound.truncated,
+    };
+}
+// Deterministic, sanitized command summary: fixed tool identity + fixed
+// option names, target/artifact roots replaced with symbolic placeholders,
+// never the resolved absolute executable path or any environment value.
+export function buildCommandSummary(toolBasename, args, targetRoot, artifactRoot) {
+    const sanitizedArgs = args.map((arg) => {
+        if (arg === targetRoot)
+            return "<TARGET>";
+        if (artifactRoot && arg === artifactRoot)
+            return "<ARTIFACT_ROOT>";
+        if (arg.startsWith(targetRoot))
+            return `<TARGET>${arg.slice(targetRoot.length).replace(/\\/g, "/")}`;
+        if (artifactRoot && arg.startsWith(artifactRoot))
+            return `<ARTIFACT_ROOT>${arg.slice(artifactRoot.length).replace(/\\/g, "/")}`;
+        return arg;
+    });
+    return [toolBasename, ...sanitizedArgs].join(" ");
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/runRequestedAndroidExternalTools.js

@@ -0,0 +1,54 @@
+import { auditAndroidSemgrep } from "./semgrep/checkResult.js";
+import { auditAndroidOsv } from "./osv/checkResult.js";
+import { auditAndroidLint } from "./androidLint/checkResult.js";
+import { auditAndroidDependencyCheck } from "./dependencyCheck/checkResult.js";
+import { normalizeAndroidExternalToolRequest } from "./types.js";
+export async function runRequestedAndroidExternalTools(options) {
+    const normalized = normalizeAndroidExternalToolRequest(options.request);
+    if (!normalized.ok) {
+        throw new Error(normalized.error);
+    }
+    if (normalized.value.tools.length === 0)
+        return [];
+    const results = [];
+    for (const toolId of normalized.value.tools) {
+        if (toolId === "semgrep" && options.executors.semgrep) {
+            results.push(await auditAndroidSemgrep({
+                targetRoot: normalized.value.targetRoot,
+                artifactRoot: normalized.value.artifactRoot,
+                executor: options.executors.semgrep,
+                discover: options.discover?.semgrep,
+            }));
+            continue;
+        }
+        if (toolId === "osv" && options.executors.osv) {
+            results.push(await auditAndroidOsv({
+                targetRoot: normalized.value.targetRoot,
+                executor: options.executors.osv,
+                networkPolicy: normalized.value.networkPolicy,
+                discover: options.discover?.osv,
+            }));
+            continue;
+        }
+        if (toolId === "android-lint" && options.executors.androidLint) {
+            results.push(await auditAndroidLint({
+                targetRoot: normalized.value.targetRoot,
+                detection: options.detection,
+                executor: options.executors.androidLint,
+                artifactRoot: normalized.value.artifactRoot,
+                taskAvailable: options.lintTaskAvailable,
+            }));
+            continue;
+        }
+        if (toolId === "dependency-check" && options.executors.dependencyCheck) {
+            results.push(await auditAndroidDependencyCheck({
+                targetRoot: normalized.value.targetRoot,
+                artifactRoot: normalized.value.artifactRoot,
+                executor: options.executors.dependencyCheck,
+                javaAvailable: options.javaAvailable,
+                discover: options.discover?.dependencyCheck,
+            }));
+        }
+    }
+    return results;
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/semgrep/checkResult.js

@@ -0,0 +1,170 @@
+import path from "node:path";
+import { sortCandidateEvidence } from "../../ordering.js";
+import { discoverAllowlistedExecutable } from "../discoverExecutable.js";
+import { buildMinimalEnvironment } from "../minimalEnvironment.js";
+import { writeExternalToolArtifact } from "../artifacts.js";
+import { captureTargetSnapshot, buildExternalToolMutationReport } from "../mutation.js";
+import { runBoundedExternalTool, buildCommandSummary, VERSION_PROBE_TIMEOUT_MS } from "../runBoundedExternalTool.js";
+import { serializeSemgrepRulePack } from "./rules.js";
+import { buildSemgrepArgs, parseSemgrepMajorVersion, semgrepCommandFamilyForVersion } from "./command.js";
+import { parseSemgrepJson } from "./parseSemgrepJson.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — standalone Android Semgrep check. Not called from
+// validateAndroidTarget or any active orchestration; not rendered in
+// reports; no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_SEMGREP_AUDIT_CHECK_ID = "android-semgrep-audit";
+const SEMGREP_CANDIDATES = ["semgrep", "semgrep.exe"];
+const SEMGREP_TIMEOUT_MS = 5 * 60_000;
+function skippedCheck(reason, environmentRequirements = []) {
+    return {
+        id: ANDROID_SEMGREP_AUDIT_CHECK_ID,
+        category: "android-semgrep",
+        title: "Android Semgrep audit",
+        status: "skipped",
+        requirementLevel: "optional",
+        ran: false,
+        skipped: true,
+        skipInfo: {
+            checkId: ANDROID_SEMGREP_AUDIT_CHECK_ID,
+            reason,
+            requirementLevel: "optional",
+            missingCapability: "semgrep-executable",
+            verdictImpact: "does not apply until Batch 8 integration",
+            recommendedNextAction: "Install Semgrep locally, or run again after Batch 8 wires optional-tool selection into the CLI.",
+        },
+        evidence: [],
+        findings: [],
+        warnings: [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "unknown",
+        environmentRequirements,
+        candidateEvidence: [],
+    };
+}
+export async function auditAndroidSemgrep(options) {
+    const targetRoot = path.resolve(options.targetRoot);
+    const discovered = (options.discover ?? (() => discoverAllowlistedExecutable(SEMGREP_CANDIDATES, targetRoot)))();
+    if (!discovered.available) {
+        return skippedCheck("Semgrep executable was not found on PATH.", ["Requires a Semgrep executable (semgrep) on PATH."]);
+    }
+    const env = buildMinimalEnvironment();
+    const versionInput = { command: discovered.command, args: ["--version"], cwd: targetRoot, timeoutMs: VERSION_PROBE_TIMEOUT_MS, env };
+    const versionOutcome = await runBoundedExternalTool(options.executor, versionInput);
+    if (versionOutcome.result.timedOut || versionOutcome.result.exitCode === null) {
+        return skippedCheck("Semgrep version probe failed or timed out.");
+    }
+    const rawVersion = versionOutcome.stdout.trim();
+    const majorVersion = parseSemgrepMajorVersion(rawVersion);
+    const family = semgrepCommandFamilyForVersion(majorVersion);
+    if (!family) {
+        return skippedCheck(`Semgrep version "${rawVersion || "(unknown)"}" is not a supported version family.`);
+    }
+    const configArtifact = writeExternalToolArtifact(options.artifactRoot, "semgrep", "android-rules.yaml", serializeSemgrepRulePack(), "text");
+    const configAbsolutePath = path.resolve(options.artifactRoot, configArtifact.relativePath);
+    const args = buildSemgrepArgs(family, configAbsolutePath, targetRoot);
+    const commandSummary = buildCommandSummary(discovered.basename, args, targetRoot, path.resolve(options.artifactRoot));
+    const before = captureTargetSnapshot(targetRoot, true);
+    const analysisOutcome = await runBoundedExternalTool(options.executor, { command: discovered.command, args, cwd: targetRoot, timeoutMs: SEMGREP_TIMEOUT_MS, env });
+    const after = captureTargetSnapshot(targetRoot, true);
+    const mutation = buildExternalToolMutationReport(before, after);
+    const warnings = [];
+    if (analysisOutcome.stdoutTruncated)
+        warnings.push("stdout was truncated; JSON output was not parsed as complete.");
+    if (analysisOutcome.stderrTruncated)
+        warnings.push("stderr was truncated.");
+    if (!mutation.comparable)
+        warnings.push(`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`);
+    if (mutation.unexpectedChanges.length > 0)
+        warnings.push(`Unexpected target change(s) observed: ${mutation.unexpectedChanges.join(", ")}`);
+    if (analysisOutcome.result.timedOut) {
+        return {
+            id: ANDROID_SEMGREP_AUDIT_CHECK_ID,
+            category: "android-semgrep",
+            title: "Android Semgrep audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `commandFamily=${family}`],
+            findings: [],
+            warnings: [...warnings, `Semgrep timed out after ${SEMGREP_TIMEOUT_MS}ms.`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "medium",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    if (analysisOutcome.stdoutTruncated) {
+        return {
+            id: ANDROID_SEMGREP_AUDIT_CHECK_ID,
+            category: "android-semgrep",
+            title: "Android Semgrep audit",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `commandFamily=${family}`],
+            findings: [],
+            warnings,
+            errors: [],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const parsed = parseSemgrepJson(analysisOutcome.stdout, targetRoot, configArtifact.sha256);
+    const isFindingsExitCode = analysisOutcome.result.exitCode === 0 || analysisOutcome.result.exitCode === 1;
+    if (parsed.malformed) {
+        return {
+            id: ANDROID_SEMGREP_AUDIT_CHECK_ID,
+            category: "android-semgrep",
+            title: "Android Semgrep audit",
+            status: isFindingsExitCode ? "inconclusive" : "failed",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [`version=${rawVersion}`, `commandFamily=${family}`, `exitCode=${analysisOutcome.result.exitCode}`],
+            findings: [],
+            warnings,
+            errors: isFindingsExitCode ? [] : ["Semgrep exited with a non-findings error and produced no parseable JSON report."],
+            sourcePaths: [],
+            confidence: "low",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    for (const parserError of parsed.parserErrors) {
+        warnings.push(`Semgrep reported a parser error: ${parserError}`);
+    }
+    if (parsed.truncated)
+        warnings.push(`Finding count exceeded the bounded limit; results were truncated.`);
+    const findingsById = new Map(parsed.findings.map((f) => [f.id, f]));
+    const candidatesById = new Map(parsed.candidates.map((c) => [c.id, c]));
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...candidatesById.values()]);
+    // A findings exit code (0 or 1) with valid JSON is never treated as a
+    // process crash — Semgrep uses 1 to mean "findings were reported", not
+    // "the tool failed" (agents.txt Batch 7 section 10.11).
+    const status = findings.length > 0 ? "failed" : isFindingsExitCode ? "passed" : "error";
+    return {
+        id: ANDROID_SEMGREP_AUDIT_CHECK_ID,
+        category: "android-semgrep",
+        title: "Android Semgrep audit",
+        status,
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: [`version=${rawVersion}`, `commandFamily=${family}`, `scanned=${parsed.scannedCount}`, `command=${commandSummary}`],
+        findings,
+        warnings,
+        errors: status === "error" ? ["Semgrep exited with a non-findings error."] : [],
+        sourcePaths: [],
+        confidence: parsed.parserErrors.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/semgrep/command.js

@@ -0,0 +1,28 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 7 — fixed Semgrep command planning.
+//
+// Exactly two supported command families, selected only by parsed major
+// version — never by trial-and-error after a failed attempt. No caller-
+// provided flags, config identifiers, or excludes are ever accepted.
+// ---------------------------------------------------------------------------
+export const SEMGREP_FIXED_EXCLUDES = [".git", "node_modules", "build", "dist", "out", "coverage", ".gradle", "reports", "lab-output", ".my-dev-kit", "*.apk", "*.aab"];
+export function semgrepCommandFamilyForVersion(majorVersion) {
+    if (majorVersion === undefined)
+        return undefined;
+    if (majorVersion >= 1)
+        return "modern";
+    if (majorVersion === 0)
+        return "legacy";
+    return undefined;
+}
+export function parseSemgrepMajorVersion(rawVersion) {
+    const match = /(\d+)\.\d+\.\d+/.exec(rawVersion);
+    if (!match)
+        return undefined;
+    return Number.parseInt(match[1], 10);
+}
+export function buildSemgrepArgs(family, configPath, targetRoot) {
+    const excludeArgs = SEMGREP_FIXED_EXCLUDES.flatMap((pattern) => ["--exclude", pattern]);
+    const base = ["--config", configPath, "--json", "--metrics=off", "--disable-version-check", ...excludeArgs, targetRoot];
+    return family === "modern" ? ["scan", ...base] : base;
+}

package/dist/src/mobile/android/advancedSecurity/externalTools/semgrep/index.js

@@ -0,0 +1,2 @@
+export { auditAndroidSemgrep, ANDROID_SEMGREP_AUDIT_CHECK_ID } from "./checkResult.js";
+export { ANDROID_SEMGREP_RULE_PACK, assertUniqueSemgrepRuleIds, serializeSemgrepRulePack } from "./rules.js";