@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseFirebaseConfig.js

@@ -0,0 +1,75 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded, safe firebase.json and .firebaserc parsing.
+// Only the sections relevant to Android security review (rules file
+// references, project aliases) are extracted; hosting/functions/emulators
+// sections are intentionally ignored (they are unrelated to Android
+// security findings per agents.txt Batch 6 section 13.7).
+// ---------------------------------------------------------------------------
+function asRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function collectRulesPaths(section) {
+    const paths = [];
+    const record = asRecord(section);
+    if (record) {
+        const rules = asString(record.rules);
+        if (rules)
+            paths.push(rules);
+        return paths;
+    }
+    const array = asArray(section);
+    if (array) {
+        for (const entry of array) {
+            const entryRecord = asRecord(entry);
+            const rules = asString(entryRecord?.rules);
+            if (rules)
+                paths.push(rules);
+        }
+    }
+    return paths;
+}
+export function parseFirebaseJson(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, databaseRulesPaths: [], firestoreRulesPaths: [], storageRulesPaths: [] };
+    }
+    const root = asRecord(parsed);
+    if (!root)
+        return { file, malformed: true, databaseRulesPaths: [], firestoreRulesPaths: [], storageRulesPaths: [] };
+    return {
+        file,
+        malformed: false,
+        databaseRulesPaths: collectRulesPaths(root.database),
+        firestoreRulesPaths: collectRulesPaths(root.firestore),
+        storageRulesPaths: collectRulesPaths(root.storage),
+    };
+}
+export function parseFirebaseRc(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, aliases: {} };
+    }
+    const root = asRecord(parsed);
+    const projects = asRecord(root?.projects);
+    if (!projects)
+        return { file, malformed: false, aliases: {} };
+    const aliases = {};
+    for (const [alias, value] of Object.entries(projects)) {
+        const projectId = asString(value);
+        if (projectId)
+            aliases[alias] = projectId;
+    }
+    return { file, malformed: false, defaultProject: aliases.default, aliases };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseFirestoreStorageRules.js

@@ -0,0 +1,88 @@
+import { executableMask, lineForOffset } from "../sensitiveData/localSourceContext.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded local Firestore/Storage security-rules parser.
+//
+// A brace-aware, comment/string-masked local scanner over `match { ... }` /
+// `allow ...: if ...;` syntax — not a full Firebase rules-language compiler.
+// Functions, imports, and complex boolean expressions are preserved only as
+// a bounded condition summary; this module never evaluates a condition and
+// never claims a rule is (or is not) the deployed configuration.
+// ---------------------------------------------------------------------------
+const MAX_MATCH_BLOCKS = 500;
+const MAX_ALLOW_STATEMENTS = 1000;
+const MAX_CONDITION_LENGTH = 300;
+const MATCH_HEADER = /\bmatch\s+([^\n{]+?)\s*\{/g;
+const ALLOW_STATEMENT = /\ballow\s+([A-Za-z,\s]+?)\s*(?::\s*if\s+([^;]+?))?\s*;/g;
+const TEST_MODE_TIME = /request\.time\s*[<>]=?\s*timestamp\.(date|value)\s*\(/;
+function braceEnd(mask, openBraceIndex) {
+    let depth = 0;
+    for (let i = openBraceIndex; i < mask.length; i += 1) {
+        if (mask[i] === "{")
+            depth += 1;
+        else if (mask[i] === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return mask.length - 1;
+}
+function boundedCondition(condition) {
+    if (condition === undefined)
+        return "(no condition — always allowed)";
+    const trimmed = condition.trim();
+    return trimmed.length > MAX_CONDITION_LENGTH ? `${trimmed.slice(0, MAX_CONDITION_LENGTH)}...` : trimmed;
+}
+export function parseFirestoreOrStorageRules(file, service) {
+    const mask = executableMask(file.content);
+    let boundsExceeded = false;
+    const blocks = [];
+    for (const match of mask.matchAll(MATCH_HEADER)) {
+        if (blocks.length >= MAX_MATCH_BLOCKS) {
+            boundsExceeded = true;
+            break;
+        }
+        const from = match.index ?? 0;
+        const openBrace = from + match[0].length - 1;
+        blocks.push({ pattern: match[1].trim(), from, to: braceEnd(mask, openBrace) });
+    }
+    function enclosingPattern(offset) {
+        let best;
+        for (const block of blocks) {
+            if (offset >= block.from && offset <= block.to) {
+                if (best === undefined || block.to - block.from < best.to - best.from)
+                    best = block;
+            }
+        }
+        return best?.pattern ?? "(unresolved match scope)";
+    }
+    const matches = [];
+    let allowCount = 0;
+    for (const match of mask.matchAll(ALLOW_STATEMENT)) {
+        if (allowCount >= MAX_ALLOW_STATEMENTS) {
+            boundsExceeded = true;
+            break;
+        }
+        allowCount += 1;
+        const offset = match.index ?? 0;
+        const operations = match[1]
+            .split(",")
+            .map((op) => op.trim())
+            .filter(Boolean);
+        const conditionRaw = match[2]?.trim();
+        const isLiteralTrue = conditionRaw === undefined || conditionRaw === "true";
+        const isLiteralFalse = conditionRaw === "false";
+        matches.push({
+            service,
+            matchPath: enclosingPattern(offset),
+            operations,
+            conditionSummary: boundedCondition(conditionRaw),
+            isLiteralTrue,
+            isLiteralFalse,
+            hasAuthCondition: conditionRaw !== undefined && /request\.auth/.test(conditionRaw),
+            isTestModeTimeCondition: conditionRaw !== undefined && TEST_MODE_TIME.test(conditionRaw),
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return { file, malformed: false, matches, boundsExceeded };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseGoogleServicesConfig.js

@@ -0,0 +1,55 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded, safe google-services.json parsing.
+//
+// A bare Firebase API key is not a private secret by format (see
+// sensitiveCategories.ts) — this parser only records bounded presence
+// metadata (a count) for oauth_client/api_key entries, never the values
+// themselves. Malformed JSON is handled safely (never throws to the
+// caller); unsupported/unexpected shapes degrade to an empty client list
+// rather than crashing.
+// ---------------------------------------------------------------------------
+function asRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+export function parseGoogleServicesConfig(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, clients: [] };
+    }
+    const root = asRecord(parsed);
+    if (!root)
+        return { file, malformed: true, clients: [] };
+    const projectInfo = asRecord(root.project_info);
+    const clientsRaw = asArray(root.client) ?? [];
+    const clients = clientsRaw.map((entry) => {
+        const clientRecord = asRecord(entry) ?? {};
+        const clientInfo = asRecord(clientRecord.client_info);
+        const androidClientInfo = asRecord(clientInfo?.android_client_info);
+        const oauthClient = asArray(clientRecord.oauth_client) ?? [];
+        const apiKey = asArray(clientRecord.api_key) ?? [];
+        return {
+            packageName: asString(androidClientInfo?.package_name),
+            mobileSdkAppId: asString(clientInfo?.mobilesdk_app_id),
+            apiKeyCount: apiKey.length,
+            oauthClientCount: oauthClient.length,
+        };
+    });
+    return {
+        file,
+        malformed: false,
+        projectId: asString(projectInfo?.project_id),
+        projectNumber: asString(projectInfo?.project_number),
+        storageBucket: asString(projectInfo?.storage_bucket),
+        firebaseUrl: asString(projectInfo?.firebase_url),
+        clients,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/types.js

@@ -0,0 +1,6 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — Firebase/Google services semantic contracts. Local to
+// this feature; does not duplicate Batch 1's CandidateEvidence/
+// SecurityFinding/AndroidCheckResult.
+// ---------------------------------------------------------------------------
+export {};

package/dist/src/mobile/android/advancedSecurity/networkSecurity/analyzeNetworkSecurity.js

@@ -0,0 +1,394 @@
+import path from "node:path";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { extractManifestNetworkSecurityEvidence } from "./manifestEvidence.js";
+import { deriveEffectiveNetworkPolicy } from "./deriveEffectiveNetworkPolicy.js";
+function loc(targetRoot, absolutePath, position) {
+    return buildAndroidSourceLocation(targetRoot, absolutePath, position);
+}
+function analyzeScopeCleartext(scope, sourceRelativePath) {
+    if (scope.cleartextTrafficPermitted !== true)
+        return undefined;
+    const isBase = scope.kind === "base";
+    const domainsText = scope.domains.map((d) => d.normalized).filter((d) => d.length > 0).join(", ");
+    return makeAndroidFinding({
+        ruleId: "android-network-cleartext-traffic",
+        title: isBase
+            ? "Network Security Config base configuration permits cleartext traffic"
+            : `Network Security Config domain configuration permits cleartext traffic${domainsText ? ` (${domainsText})` : ""}`,
+        severity: isBase ? "major" : "minor",
+        confidence: "high",
+        description: isBase
+            ? "The Network Security Config's <base-config> sets cleartextTrafficPermitted=\"true\", which is high-confidence static evidence that cleartext (unencrypted) HTTP traffic is permitted application-wide unless narrowed by a more specific domain-config. This does not prove cleartext traffic actually occurs at runtime."
+            : `A <domain-config> sets cleartextTrafficPermitted="true" for the scoped domain(s) above. This is high-confidence static evidence limited to that domain scope${scope.domains.some((d) => d.includeSubdomains) ? " (including subdomains for at least one entry)" : ""}, not proof that cleartext traffic actually occurs at runtime.`,
+        manifestPath: sourceRelativePath,
+        identity: scope.scopeId,
+        location: { line: scope.location.line, column: scope.location.column },
+        evidenceDetails: [
+            `scope=${scope.kind}`,
+            `cleartextTrafficSource=${scope.cleartextTrafficSource}`,
+            ...(isBase ? [] : [`domains=${domainsText || "(none declared; scope has no resolvable domain list)"}`]),
+        ],
+        recommendation: "Disable cleartext traffic unless a specific, documented use case requires it, and scope any exception as narrowly as possible.",
+    });
+}
+function analyzeScopeTrustAnchors(scope, sourceAbsolutePath, targetRoot, modulePath, sourceRelativePath) {
+    const candidates = [];
+    const findings = [];
+    if (scope.trustAnchorsChain.length === 0)
+        return { candidates, findings };
+    // The nearest entry in the chain is the one that actually governs this
+    // scope (own, or the closest ancestor it inherited from) — not every
+    // entry in the chain, which would double-count inherited certificates
+    // once per descendant scope.
+    const nearest = scope.trustAnchorsChain[0];
+    for (const cert of nearest.certificates) {
+        const location = loc(targetRoot, sourceAbsolutePath, { line: cert.location.line, column: cert.location.column });
+        if (cert.sourceKind === "user") {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-network-user-added-trust-anchor",
+                title: `${scope.kind === "base" ? "Base" : "Domain-scoped"} configuration trusts user-added certificate authorities`,
+                severity: scope.kind === "base" ? "major" : "minor",
+                confidence: "high",
+                description: "The configuration includes <certificates src=\"user\">, meaning certificates a device user has added to the trust store are trusted for TLS connections in this scope. This is high-confidence static evidence of the trust configuration itself, not proof of an active interception (e.g. MITM) attack.",
+                manifestPath: sourceRelativePath,
+                identity: scope.scopeId,
+                location: { line: cert.location.line, column: cert.location.column },
+                evidenceDetails: [`scope=${scope.kind}`, `certificatesSrc=user`, cert.overridePinsRaw !== undefined ? `overridePins=${cert.overridePinsRaw}` : undefined].filter((v) => Boolean(v)),
+                recommendation: "Avoid trusting user-added CAs in release configuration unless a specific, reviewed use case (e.g. enterprise proxy/MDM) requires it.",
+            }));
+        }
+        else if (cert.sourceKind === "raw-resource") {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-user-added-trust-anchor",
+                category: "android-network-security",
+                confidence: "medium",
+                modulePath,
+                location,
+                summary: `Custom raw certificate authority referenced (@raw/${cert.rawResourceName ?? "?"}) in ${scope.kind} configuration`,
+                rawValue: cert.rawResourceName,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: ["Certificate contents were not inspected or validated; a custom CA is not automatically unsafe."],
+            }));
+        }
+        else if (cert.sourceKind === "unknown") {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-user-added-trust-anchor",
+                category: "android-network-security",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Unrecognized <certificates src="..."> value in ${scope.kind} configuration`,
+                rawValue: cert.srcRaw,
+                resolutionState: "unsupported",
+            }));
+        }
+        // "system" is normal evidence, not a finding or candidate by itself.
+    }
+    return { candidates, findings };
+}
+function analyzeDebugOverrides(debugTrustAnchors, sourceAbsolutePath, targetRoot, modulePath) {
+    if (!debugTrustAnchors)
+        return [];
+    return debugTrustAnchors.certificates.map((cert) => makeCandidateEvidence({
+        ruleId: "android-network-debug-trust-override",
+        category: "android-network-security",
+        confidence: "low",
+        modulePath,
+        location: loc(targetRoot, sourceAbsolutePath, { line: cert.location.line, column: cert.location.column }),
+        summary: `Debug-only trust override: <certificates src="${cert.srcRaw ?? "unknown"}">`,
+        rawValue: cert.srcRaw,
+        resolutionState: "resolved",
+        staticAnalysisLimitations: [
+            "<debug-overrides> only applies to builds with android:debuggable=\"true\" and must never be treated as active release-build policy.",
+        ],
+    }));
+}
+const BROAD_DOMAIN_MAX_SINGLE_LABEL_LENGTH = 3;
+function analyzeDomainBroadness(scope, sourceAbsolutePath, targetRoot, modulePath) {
+    const candidates = [];
+    for (const domain of scope.domains) {
+        const location = loc(targetRoot, sourceAbsolutePath, { line: domain.location.line, column: domain.location.column });
+        if (domain.malformed) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-broad-domain-config",
+                category: "android-network-security",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: "Empty or malformed <domain> entry",
+                rawValue: domain.textRaw,
+                resolutionState: "malformed",
+            }));
+            continue;
+        }
+        const isWildcardLike = domain.normalized.includes("*");
+        // A conservative "narrow" broadness signal only: a bare, very short
+        // single-label host (no dot at all) is unusual for a real public/
+        // internal domain and worth a low-confidence review candidate. Ordinary
+        // multi-label domains (including internal-looking ones) never match —
+        // per section 9.8, ambiguous/potentially-legitimate internal domains
+        // must remain unflagged rather than produce false positives.
+        const isSuspiciouslyShortSingleLabel = !domain.normalized.includes(".") && domain.normalized.length <= BROAD_DOMAIN_MAX_SINGLE_LABEL_LENGTH;
+        if (isWildcardLike || isSuspiciouslyShortSingleLabel) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-broad-domain-config",
+                category: "android-network-security",
+                confidence: "low",
+                modulePath,
+                location,
+                summary: `Potentially broad domain candidate: "${domain.normalized}"${domain.includeSubdomains ? " (includeSubdomains)" : ""}`,
+                rawValue: domain.textRaw,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [
+                    "Domain registrability/ownership was not verified (no network or public-suffix-list access); this may be a legitimate internal or short hostname.",
+                ],
+            }));
+        }
+    }
+    return candidates;
+}
+function analyzePinSet(pinSet, sourceAbsolutePath, targetRoot, modulePath) {
+    if (!pinSet)
+        return [];
+    const candidates = [];
+    candidates.push(makeCandidateEvidence({
+        ruleId: "android-network-pinning-metadata",
+        category: "android-network-security",
+        confidence: "high",
+        modulePath,
+        location: loc(targetRoot, sourceAbsolutePath, { line: pinSet.location.line, column: pinSet.location.column }),
+        summary: `Certificate pin-set present (${pinSet.pins.length} pin(s)${pinSet.expirationRaw ? `, expiration=${pinSet.expirationRaw}` : ", no expiration set"})`,
+        rawValue: pinSet.expirationRaw,
+        resolutionState: pinSet.expirationMalformed ? "malformed" : "resolved",
+        staticAnalysisLimitations: [
+            "Pin values were not validated against any live certificate or TLS connection; presence of pin metadata does not prove pinning is effective at runtime, and its absence is not automatically a vulnerability.",
+            ...(pinSet.expirationMalformed ? ["expiration attribute is not in the expected YYYY-MM-DD format."] : []),
+        ],
+    }));
+    for (const pin of pinSet.pins) {
+        if (pin.malformed || !pin.digestSupported) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-pinning-unresolved",
+                category: "android-network-security",
+                confidence: "medium",
+                modulePath,
+                location: loc(targetRoot, sourceAbsolutePath, { line: pin.location.line, column: pin.location.column }),
+                summary: pin.malformed ? `Malformed pin entry: ${pin.malformedReason}` : `Unsupported pin digest algorithm: "${pin.digestRaw}"`,
+                rawValue: pin.valuePreview,
+                resolutionState: pin.malformed ? "malformed" : "unsupported",
+            }));
+        }
+    }
+    return candidates;
+}
+function analyzeParsedFile(parseResult, fileRelativePath, targetRoot, modulePath) {
+    const fileAbsolutePath = path.join(targetRoot, fileRelativePath);
+    const policy = deriveEffectiveNetworkPolicy(parseResult);
+    const candidates = [];
+    const findings = [];
+    const scopes = [...(policy.baseScope ? [policy.baseScope] : []), ...policy.domainScopes];
+    for (const scope of scopes) {
+        const cleartextFinding = analyzeScopeCleartext(scope, fileRelativePath);
+        if (cleartextFinding)
+            findings.push(cleartextFinding);
+        const trustResult = analyzeScopeTrustAnchors(scope, fileAbsolutePath, targetRoot, modulePath, fileRelativePath);
+        candidates.push(...trustResult.candidates);
+        findings.push(...trustResult.findings);
+        candidates.push(...analyzeDomainBroadness(scope, fileAbsolutePath, targetRoot, modulePath));
+        candidates.push(...analyzePinSet(scope.pinSet, fileAbsolutePath, targetRoot, modulePath));
+    }
+    candidates.push(...analyzeDebugOverrides(policy.debugTrustAnchors, fileAbsolutePath, targetRoot, modulePath));
+    return { candidates, findings, baseCleartextExplicitFalse: policy.baseScope?.cleartextTrafficPermitted === false };
+}
+function analyzeResolvedOrAmbiguousFile(fileRelativePath, parseResult, targetRoot, modulePath) {
+    const fileAbsolutePath = path.join(targetRoot, fileRelativePath);
+    if (parseResult.state === "malformed-xml") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-network-security-config",
+                    category: "android-network-security",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, fileAbsolutePath, parseResult.location ? { line: parseResult.location.line, column: parseResult.location.column } : undefined),
+                    summary: `Referenced Network Security Config is malformed XML: ${parseResult.reason}`,
+                    rawValue: parseResult.reason,
+                    resolutionState: "malformed",
+                }),
+            ],
+            findings: [],
+            baseCleartextExplicitFalse: false,
+        };
+    }
+    if (parseResult.state === "unsupported-root") {
+        return {
+            candidates: [
+                makeCandidateEvidence({
+                    ruleId: "android-network-security-config",
+                    category: "android-network-security",
+                    confidence: "medium",
+                    modulePath,
+                    location: loc(targetRoot, fileAbsolutePath),
+                    summary: `Referenced XML file has an unsupported root element <${parseResult.rootTagName}>, not <network-security-config>`,
+                    rawValue: parseResult.rootTagName,
+                    resolutionState: "unsupported",
+                }),
+            ],
+            findings: [],
+            baseCleartextExplicitFalse: false,
+        };
+    }
+    return analyzeParsedFile(parseResult, fileRelativePath, targetRoot, modulePath);
+}
+// Analyzes one already-parsed manifest's cleartext/Network Security Config
+// evidence, without touching validateAndroidTarget or any active
+// orchestration (this function is standalone until a later integration
+// batch).
+export function analyzeManifestNetworkSecurity(targetRoot, entry) {
+    const evidence = extractManifestNetworkSecurityEvidence(targetRoot, entry);
+    const candidates = [];
+    const findings = [];
+    const modulePath = entry.modulePath;
+    const manifestAbsolutePath = path.join(targetRoot, entry.manifestPath);
+    const nsc = evidence.networkSecurityConfig;
+    let anyResolvedNsc = false;
+    let anyResolvedBaseExplicitFalse = false;
+    if (nsc.state === "resolved") {
+        anyResolvedNsc = true;
+        const result = analyzeResolvedOrAmbiguousFile(nsc.candidate.relativePath, nsc.parseResult, targetRoot, modulePath);
+        candidates.push(...result.candidates);
+        findings.push(...result.findings);
+        anyResolvedBaseExplicitFalse = result.baseCleartextExplicitFalse;
+    }
+    else if (nsc.state === "ambiguous") {
+        anyResolvedNsc = true;
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: `networkSecurityConfig reference "${nsc.raw}" resolved to ${nsc.candidates.length} ambiguous candidates across source sets; no candidate was arbitrarily selected`,
+            rawValue: nsc.raw,
+            resolutionState: "unresolved",
+            staticAnalysisLimitations: ["Android resource-overlay precedence between the candidates was not evaluated."],
+        }));
+        let anyBaseFalse = false;
+        for (const candidate of nsc.candidates) {
+            const result = analyzeResolvedOrAmbiguousFile(candidate.candidate.relativePath, candidate.parseResult, targetRoot, modulePath);
+            candidates.push(...result.candidates);
+            findings.push(...result.findings);
+            anyBaseFalse = anyBaseFalse || result.baseCleartextExplicitFalse;
+        }
+        anyResolvedBaseExplicitFalse = anyBaseFalse;
+    }
+    else if (nsc.state === "missing") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: `networkSecurityConfig reference "${nsc.raw}" did not resolve to any file in the searched source sets`,
+            rawValue: nsc.raw,
+            resolutionState: "missing",
+            staticAnalysisLimitations: ["A missing referenced configuration is not automatically a vulnerability; runtime behavior in this case cannot be proven statically."],
+        }));
+    }
+    else if (nsc.state === "placeholder") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: "networkSecurityConfig is an unresolved build-time placeholder",
+            rawValue: nsc.raw,
+            resolutionState: "unresolved",
+        }));
+    }
+    else if (nsc.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: `networkSecurityConfig reference is malformed: ${nsc.reason}`,
+            rawValue: nsc.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (nsc.state === "unsupported-type" || nsc.state === "package-qualified" || nsc.state === "module-unknown") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-security-config",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: nsc.state === "module-unknown"
+                ? "networkSecurityConfig reference could not be resolved because this manifest's module could not be determined"
+                : `networkSecurityConfig reference is not a resolvable target-contained @xml/... resource (${nsc.state})`,
+            rawValue: nsc.raw,
+            resolutionState: "unsupported",
+        }));
+    }
+    if (evidence.usesCleartextTraffic.state === "malformed") {
+        candidates.push(makeCandidateEvidence({
+            ruleId: "android-network-cleartext-traffic",
+            category: "android-network-security",
+            confidence: "low",
+            modulePath,
+            location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+            summary: "android:usesCleartextTraffic has an unresolved or malformed value",
+            rawValue: evidence.usesCleartextTraffic.raw,
+            resolutionState: "malformed",
+        }));
+    }
+    else if (evidence.usesCleartextTraffic.state === "explicit-true") {
+        if (!anyResolvedNsc) {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-network-cleartext-traffic",
+                title: "Manifest explicitly permits cleartext traffic (android:usesCleartextTraffic=\"true\")",
+                severity: "major",
+                confidence: "high",
+                description: "The manifest's <application> element sets android:usesCleartextTraffic=\"true\" with no resolvable Network Security Config to narrow it. This is high-confidence static evidence that cleartext (unencrypted) HTTP traffic is permitted application-wide; it is not proof that cleartext traffic actually occurs at runtime.",
+                manifestPath: entry.manifestPath,
+                location: evidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute", "networkSecurityConfig=absent-or-unresolved"],
+                recommendation: "Set android:usesCleartextTraffic=\"false\" unless a specific, documented use case requires cleartext traffic.",
+            }));
+        }
+        else if (anyResolvedBaseExplicitFalse) {
+            candidates.push(makeCandidateEvidence({
+                ruleId: "android-network-cleartext-traffic",
+                category: "android-network-security",
+                confidence: "medium",
+                modulePath,
+                location: loc(targetRoot, manifestAbsolutePath, evidence.applicationLocation),
+                summary: "android:usesCleartextTraffic=\"true\" conflicts with the resolved Network Security Config's <base-config cleartextTrafficPermitted=\"false\">",
+                rawValue: evidence.usesCleartextTraffic.raw,
+                resolutionState: "resolved",
+                staticAnalysisLimitations: [
+                    "Precedence between the manifest attribute and the Network Security Config was not evaluated for a specific Android API level; this is conflicting static configuration, not a confirmed runtime state.",
+                ],
+            }));
+        }
+        else {
+            findings.push(makeAndroidFinding({
+                ruleId: "android-network-cleartext-traffic",
+                title: "Manifest explicitly permits cleartext traffic (android:usesCleartextTraffic=\"true\")",
+                severity: "major",
+                confidence: "high",
+                description: "The manifest's <application> element sets android:usesCleartextTraffic=\"true\". A Network Security Config is present but does not explicitly set cleartextTrafficPermitted=\"false\" at the base level, so this attribute's effect is not contradicted by static evidence.",
+                manifestPath: entry.manifestPath,
+                location: evidence.applicationLocation,
+                evidenceDetails: ["source=manifest-attribute", "networkSecurityConfig=resolved-non-contradicting"],
+                recommendation: "Set android:usesCleartextTraffic=\"false\" unless a specific, documented use case requires cleartext traffic.",
+            }));
+        }
+    }
+    return { evidence, candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/checkResult.js

@@ -0,0 +1,47 @@
+import { buildAndroidManifestCheckResult } from "../../audit/checkResultBuilder.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeManifestNetworkSecurity } from "./analyzeNetworkSecurity.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 2 — standalone Android network-security check result.
+//
+// Reuses the existing manifest-audit status-decision policy
+// (buildAndroidManifestCheckResult, src/mobile/android/audit/
+// checkResultBuilder.ts) rather than inventing a second one — this check
+// operates over the same AndroidManifestParseEntry[] shape as the four
+// v0.4.0 manifest audits.
+//
+// Deliberately standalone: this function is exercised directly by tests but
+// is NOT called from validateAndroidTarget / any active orchestration, not
+// rendered in text/JSON reports, and does not affect the CLI. A later
+// integration batch (Batch 8 per the version plan) wires it in.
+// ---------------------------------------------------------------------------
+export const ANDROID_NETWORK_SECURITY_AUDIT_CHECK_ID = "android-network-security-audit";
+export function auditAndroidNetworkSecurity(targetRoot, detection, manifests) {
+    const findings = [];
+    const candidateEvidence = [];
+    const evidence = [];
+    const warnings = [];
+    for (const entry of manifests) {
+        const result = analyzeManifestNetworkSecurity(targetRoot, entry);
+        findings.push(...result.findings);
+        candidateEvidence.push(...result.candidates);
+        evidence.push(`${entry.manifestPath}: usesCleartextTraffic=${result.evidence.usesCleartextTraffic.state}, networkSecurityConfig=${result.evidence.networkSecurityConfig.state}`);
+    }
+    const base = buildAndroidManifestCheckResult({
+        id: ANDROID_NETWORK_SECURITY_AUDIT_CHECK_ID,
+        category: "android-network-security",
+        title: "Android cleartext traffic and Network Security Config audit",
+        detection,
+        manifests,
+        findings,
+        evidence,
+        warnings: [
+            ...warnings,
+            "Static analysis only: does not evaluate Gradle manifest merging, Android resource overlays, or runtime network/TLS behavior.",
+        ],
+    });
+    return {
+        ...base,
+        candidateEvidence: sortCandidateEvidence(candidateEvidence),
+    };
+}