@dailephd/my-dev-kit-lab 0.4.4 → 0.4.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (225) hide show
  1. package/CHANGELOG.md +484 -0
  2. package/README.md +39 -3
  3. package/dist/scripts/cli.js +9 -0
  4. package/dist/src/audits/core/typescriptJavaScriptAnalyzer.js +30 -12
  5. package/dist/src/cli/help.js +300 -0
  6. package/dist/src/cli/index.js +2 -0
  7. package/dist/src/cli/runLabCli.js +229 -0
  8. package/dist/src/commands/runAuditCommand.js +132 -0
  9. package/dist/src/commands/runControlledExperimentCommand.js +7 -3
  10. package/dist/{scripts/experiments/describeExperiment.js → src/commands/runExperimentDescribeCommand.js} +14 -10
  11. package/dist/{scripts/experiments/listExperiments.js → src/commands/runExperimentListCommand.js} +3 -6
  12. package/dist/{scripts/experiments/runExperiment.js → src/commands/runExperimentRunCommand.js} +80 -22
  13. package/dist/src/commands/runFinalDemoCommand.js +2 -3
  14. package/dist/src/commands/runSecurityValidationCommand.js +271 -0
  15. package/dist/src/evaluation/ecosystemFixtures/index.js +3 -0
  16. package/dist/src/evaluation/ecosystemFixtures/loadContextIntegrityFixture.js +102 -0
  17. package/dist/src/evaluation/ecosystemFixtures/manifestTypes.js +1 -0
  18. package/dist/src/evaluation/ecosystemFixtures/validateManifest.js +82 -0
  19. package/dist/src/evaluation/ecosystemFixtures/verifyFixtureHashes.js +45 -0
  20. package/dist/src/evaluation/stageContextMetrics/calculateAllocationMetrics.js +169 -0
  21. package/dist/src/evaluation/stageContextMetrics/calculateConditionCoverageMetrics.js +74 -0
  22. package/dist/src/evaluation/stageContextMetrics/calculateProducerConditionAgreement.js +113 -0
  23. package/dist/src/evaluation/stageContextMetrics/calculateReadinessAgreement.js +60 -0
  24. package/dist/src/evaluation/stageContextMetrics/calculateRunIntegrityAgreement.js +309 -0
  25. package/dist/src/evaluation/stageContextMetrics/calculateSupplementalRawAgreement.js +12 -2
  26. package/dist/src/evaluation/stageContextMetrics/calculateTruncationClassification.js +100 -0
  27. package/dist/src/evaluation/stageContextMetrics/evaluateProducerReadinessBridge.js +76 -5
  28. package/dist/src/evaluation/stageContextMetrics/index.js +4 -0
  29. package/dist/src/evaluation/stageContextMetrics/runIntegrityAgreementTypes.js +1 -0
  30. package/dist/src/evaluation/stageContextSelectors/contextArtifactConsistency.js +7 -0
  31. package/dist/src/evaluation/stageContextSelectors/index.js +1 -0
  32. package/dist/src/evaluation/stageContextSelectors/orchestratorRunIntegritySelectors.js +64 -0
  33. package/dist/src/evaluation/upstreamArtifacts/index.js +2 -0
  34. package/dist/src/evaluation/upstreamArtifacts/orchestratorRunIntegrityV1.js +33 -0
  35. package/dist/src/evaluation/upstreamArtifacts/readOrchestratorRunIntegrityV1.js +9 -0
  36. package/dist/src/evaluation/upstreamArtifacts/validateMyDevKitContextCapsuleV1.js +59 -2
  37. package/dist/src/evaluation/upstreamArtifacts/validateMyDevKitRetrievalAuditRecordV1.js +6 -1
  38. package/dist/src/evaluation/upstreamArtifacts/validateOrchestratorRunIntegrityV1.js +177 -0
  39. package/dist/src/report/experiments/buildContextIntegrityReport.js +204 -0
  40. package/dist/src/report/experiments/contextIntegrityReportModel.js +1 -0
  41. package/dist/src/report/experiments/index.js +5 -0
  42. package/dist/src/report/experiments/renderContextIntegrityHtml.js +98 -0
  43. package/dist/src/report/experiments/renderContextIntegrityJsonReport.js +3 -0
  44. package/dist/src/report/experiments/renderContextIntegrityText.js +111 -0
  45. package/dist/src/runtime/index.js +3 -0
  46. package/dist/src/runtime/labExecutionContext.js +22 -0
  47. package/dist/src/runtime/packageResource.js +22 -0
  48. package/dist/src/runtime/packageRoot.js +37 -0
  49. package/dist/src/securityValidation/packageChecks/requiredPackageContents.js +46 -0
  50. package/dist/src/securityValidation/packageChecks/runPackageChecks.js +11 -5
  51. package/docs/METRICS.md +83 -0
  52. package/package.json +10 -8
  53. package/dist/scripts/audits/runAudit.js +0 -135
  54. package/dist/scripts/build-gallery.js +0 -3
  55. package/dist/scripts/capture-demo-report.js +0 -3
  56. package/dist/scripts/evaluate-token-savings.js +0 -2
  57. package/dist/scripts/generate-experiment-plots.js +0 -3
  58. package/dist/scripts/generate-prompt-variants.js +0 -2
  59. package/dist/scripts/render-experiment-report.js +0 -2
  60. package/dist/scripts/run-agent-prompt.js +0 -2
  61. package/dist/scripts/run-controlled-experiment.js +0 -2
  62. package/dist/scripts/run-lab-demo.js +0 -5
  63. package/dist/scripts/run-visualization-demos.js +0 -3
  64. package/dist/scripts/security/resolveToolRoot.js +0 -16
  65. package/dist/scripts/security/runCodeql.js +0 -58
  66. package/dist/scripts/security/runDependencyChecks.js +0 -58
  67. package/dist/scripts/security/runFuzzSmoke.js +0 -29
  68. package/dist/scripts/security/runPackageChecks.js +0 -57
  69. package/dist/scripts/security/runSemgrep.js +0 -64
  70. package/dist/scripts/security/validate.js +0 -266
  71. package/dist/scripts/verify-benchmarks.js +0 -202
  72. package/examples/demo-report-input.json +0 -78
  73. package/examples/lab-demo-cases.json +0 -35
  74. package/examples/real-agent-campaign-cases.json +0 -118
  75. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/debug/res/xml/ambiguous_backup_rules.xml +0 -4
  76. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/ambiguous_backup_rules.xml +0 -4
  77. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/backup_rules.xml +0 -5
  78. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/broad_backup_rules.xml +0 -4
  79. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/data_extraction_rules.xml +0 -10
  80. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/unsupported_domain_rules.xml +0 -4
  81. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/malformed_backup_rules.xml +0 -4
  82. package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/unsupported_root.xml +0 -4
  83. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/debug/res/xml/ambiguous_config.xml +0 -4
  84. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/ambiguous_config.xml +0 -4
  85. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/base_cleartext_false.xml +0 -8
  86. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/broad_and_duplicate_domains.xml +0 -8
  87. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/empty_domain.xml +0 -6
  88. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/malformed_pin.xml +0 -11
  89. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/network_security_config.xml +0 -26
  90. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/malformed_network_security_config.xml +0 -6
  91. package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/unsupported_root.xml +0 -4
  92. package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-dynamic.gradle +0 -7
  93. package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-false.gradle +0 -9
  94. package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-true.gradle +0 -13
  95. package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-false.gradle.kts +0 -7
  96. package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-true.gradle.kts +0 -10
  97. package/tests/fixtures/android/advanced-security-fixtures/release-configuration/missing-release-build-type.gradle.kts +0 -7
  98. package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/debug/res/xml/network_security_config.xml +0 -8
  99. package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/backup_rules.xml +0 -4
  100. package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/network_security_config.xml +0 -8
  101. package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-b/src/main/res/xml/malformed_network_security_config.xml +0 -7
  102. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/SampleActivity.java +0 -8
  103. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/SampleActivity.kt +0 -9
  104. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/build.gradle +0 -11
  105. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/build.gradle.kts +0 -11
  106. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/google-services.json +0 -16
  107. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates/local.properties +0 -3
  108. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates-bounds/module/binary.properties +0 -0
  109. package/tests/fixtures/android/advanced-security-fixtures/secret-candidates-bounds/module/oversized.json +0 -1
  110. package/tests/fixtures/android/advanced-security-fixtures/signing-configuration/app/fake-release-keystore.jks +0 -1
  111. package/tests/fixtures/android/advanced-security-fixtures/signing-configuration/build/generated-fake.keystore +0 -1
  112. package/tests/fixtures/android/compose-app/app/build.gradle.kts +0 -21
  113. package/tests/fixtures/android/compose-app/app/src/main/AndroidManifest.xml +0 -22
  114. package/tests/fixtures/android/compose-app/app/src/main/java/com/example/composeapp/MainActivity.kt +0 -11
  115. package/tests/fixtures/android/compose-app/build.gradle.kts +0 -4
  116. package/tests/fixtures/android/compose-app/gradle/wrapper/gradle-wrapper.properties +0 -4
  117. package/tests/fixtures/android/compose-app/settings.gradle.kts +0 -2
  118. package/tests/fixtures/android/gradle-metadata-fixtures/catalog-only-plugin/build.gradle.kts +0 -3
  119. package/tests/fixtures/android/gradle-metadata-fixtures/catalog-only-plugin/gradle/libs.versions.toml +0 -5
  120. package/tests/fixtures/android/gradle-metadata-fixtures/comment-safety.gradle.kts +0 -21
  121. package/tests/fixtures/android/gradle-metadata-fixtures/dynamic-values.gradle.kts +0 -17
  122. package/tests/fixtures/android/gradle-metadata-fixtures/groovy-literal.gradle +0 -23
  123. package/tests/fixtures/android/gradle-metadata-fixtures/wrapper-malformed.properties +0 -4
  124. package/tests/fixtures/android/gradle-metadata-fixtures/wrapper-missing-url.properties +0 -3
  125. package/tests/fixtures/android/gradle-metadata-fixtures/wrapper-with-checksum.properties +0 -5
  126. package/tests/fixtures/android/java-app/app/build.gradle +0 -16
  127. package/tests/fixtures/android/java-app/app/src/main/AndroidManifest.xml +0 -19
  128. package/tests/fixtures/android/java-app/app/src/main/java/com/example/javaapp/MainActivity.java +0 -4
  129. package/tests/fixtures/android/java-app/build.gradle +0 -3
  130. package/tests/fixtures/android/java-app/gradle/wrapper/gradle-wrapper.properties +0 -4
  131. package/tests/fixtures/android/java-app/settings.gradle +0 -2
  132. package/tests/fixtures/android/library/build.gradle.kts +0 -3
  133. package/tests/fixtures/android/library/gradle/wrapper/gradle-wrapper.properties +0 -4
  134. package/tests/fixtures/android/library/mylibrary/build.gradle.kts +0 -13
  135. package/tests/fixtures/android/library/mylibrary/src/main/AndroidManifest.xml +0 -2
  136. package/tests/fixtures/android/library/settings.gradle.kts +0 -2
  137. package/tests/fixtures/android/manifest-audit-fixtures/incomplete-intent-filter.xml +0 -14
  138. package/tests/fixtures/android/manifest-audit-fixtures/malformed-exported.xml +0 -10
  139. package/tests/fixtures/android/manifest-audit-fixtures/malformed.xml +0 -5
  140. package/tests/fixtures/android/manifest-audit-fixtures/missing-application.xml +0 -7
  141. package/tests/fixtures/android/manifest-audit-fixtures/missing-component-name.xml +0 -11
  142. package/tests/fixtures/android/manifest-audit-fixtures/permission-coverage.xml +0 -29
  143. package/tests/fixtures/android/manifest-audit-fixtures/risky-components.xml +0 -62
  144. package/tests/fixtures/android/manifest-audit-fixtures/risky-deep-links.xml +0 -45
  145. package/tests/fixtures/android/manifest-audit-fixtures/unresolved-placeholder.xml +0 -14
  146. package/tests/fixtures/android/manifest-audit-fixtures/unusual-namespace-prefix.xml +0 -11
  147. package/tests/fixtures/android/multi-module/app/build.gradle.kts +0 -22
  148. package/tests/fixtures/android/multi-module/app/src/androidTest/java/com/example/multimodule/app/ExampleInstrumentedTest.kt +0 -3
  149. package/tests/fixtures/android/multi-module/app/src/main/AndroidManifest.xml +0 -11
  150. package/tests/fixtures/android/multi-module/app/src/test/java/com/example/multimodule/app/ExampleUnitTest.kt +0 -3
  151. package/tests/fixtures/android/multi-module/build.gradle.kts +0 -5
  152. package/tests/fixtures/android/multi-module/core/build.gradle.kts +0 -14
  153. package/tests/fixtures/android/multi-module/core/src/main/AndroidManifest.xml +0 -2
  154. package/tests/fixtures/android/multi-module/feature-login/build.gradle.kts +0 -18
  155. package/tests/fixtures/android/multi-module/feature-login/src/main/AndroidManifest.xml +0 -2
  156. package/tests/fixtures/android/multi-module/gradle/libs.versions.toml +0 -8
  157. package/tests/fixtures/android/multi-module/gradle/wrapper/gradle-wrapper.properties +0 -4
  158. package/tests/fixtures/android/multi-module/settings.gradle.kts +0 -4
  159. package/tests/fixtures/android/non-android-gradle/build.gradle.kts +0 -3
  160. package/tests/fixtures/android/non-android-gradle/core/build.gradle.kts +0 -3
  161. package/tests/fixtures/android/non-android-gradle/core/src/main/java/com/example/core/Core.java +0 -4
  162. package/tests/fixtures/android/non-android-gradle/gradle/wrapper/gradle-wrapper.properties +0 -4
  163. package/tests/fixtures/android/non-android-gradle/settings.gradle.kts +0 -2
  164. package/tests/fixtures/android/partial/app/build.gradle.kts +0 -7
  165. package/tests/fixtures/android/partial/settings.gradle.kts +0 -2
  166. package/tests/fixtures/android/xml-view-app/app/build.gradle.kts +0 -17
  167. package/tests/fixtures/android/xml-view-app/app/src/main/AndroidManifest.xml +0 -31
  168. package/tests/fixtures/android/xml-view-app/app/src/main/kotlin/com/example/xmlviewapp/MainActivity.kt +0 -7
  169. package/tests/fixtures/android/xml-view-app/app/src/main/res/layout/activity_main.xml +0 -4
  170. package/tests/fixtures/android/xml-view-app/build.gradle.kts +0 -4
  171. package/tests/fixtures/android/xml-view-app/gradle/wrapper/gradle-wrapper.properties +0 -4
  172. package/tests/fixtures/android/xml-view-app/settings.gradle.kts +0 -2
  173. package/tests/fixtures/audits/mixed-language/mixed-docs-claims/README.md +0 -16
  174. package/tests/fixtures/audits/mixed-language/mixed-docs-claims/build.gradle.kts +0 -4
  175. package/tests/fixtures/audits/mixed-language/mixed-docs-claims/src/main/java/com/example/Widget.java +0 -7
  176. package/tests/fixtures/audits/mixed-language/mixed-docs-claims/src/main/kotlin/com/example/Gadget.kt +0 -7
  177. package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/README.md +0 -10
  178. package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/build/Main.class +0 -1
  179. package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/dist/index.js +0 -1
  180. package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/generated/schema.ts +0 -1
  181. package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/src/index.ts +0 -3
  182. package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/vendor/lib.py +0 -2
  183. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/README.md +0 -10
  184. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/build.gradle.kts +0 -8
  185. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/settings.gradle.kts +0 -1
  186. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/main/java/com/example/FooService.java +0 -7
  187. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/main/kotlin/com/example/BarService.kt +0 -7
  188. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/test/java/com/example/FooServiceTest.java +0 -8
  189. package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/test/kotlin/com/example/BarServiceTest.kt +0 -8
  190. package/tests/fixtures/audits/mixed-language/mixed-python-ts/README.md +0 -8
  191. package/tests/fixtures/audits/mixed-language/mixed-python-ts/src/app.py +0 -7
  192. package/tests/fixtures/audits/mixed-language/mixed-python-ts/src/index.ts +0 -3
  193. package/tests/fixtures/audits/mixed-language/mixed-python-ts/tests/test_app.py +0 -5
  194. package/tests/fixtures/audits/mixed-language/mixed-ts-js/README.md +0 -7
  195. package/tests/fixtures/audits/mixed-language/mixed-ts-js/src/helper.js +0 -5
  196. package/tests/fixtures/audits/mixed-language/mixed-ts-js/src/index.ts +0 -3
  197. package/tests/fixtures/audits/mixed-language/mixed-ts-js/tests/index.sample.ts +0 -5
  198. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/README.md +0 -10
  199. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/build.gradle.kts +0 -4
  200. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/pytests/test_app.py +0 -5
  201. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/app.py +0 -2
  202. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/helper.js +0 -5
  203. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/index.ts +0 -3
  204. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/main/java/com/example/Multiplier.java +0 -7
  205. package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/main/kotlin/com/example/Divider.kt +0 -7
  206. package/tests/fixtures/fake-adversarial-cli.js +0 -152
  207. package/tests/fixtures/fake-my-dev-kit-cli.js +0 -83
  208. package/tests/fixtures/full-workflow-library/complete-v1.0.0.json +0 -24
  209. package/tests/fixtures/full-workflow-library/future-minor-v1.1.0-additive.json +0 -25
  210. package/tests/fixtures/stage-context-expectations/complete-v1.0.0.json +0 -230
  211. package/tests/fixtures/stage-context-expectations/future-minor-v1.1.0-additive.json +0 -232
  212. package/tests/fixtures/stage-context-expectations/invalid/malformed-json.txt +0 -1
  213. package/tests/fixtures/stage-context-expectations/invalid/non-object-root.json +0 -1
  214. package/tests/fixtures/stage-context-expectations/minimal-v1.0.0.json +0 -18
  215. package/tests/fixtures/upstream-artifacts/invalid/malformed-json.txt +0 -1
  216. package/tests/fixtures/upstream-artifacts/invalid/non-object-root.json +0 -1
  217. package/tests/fixtures/upstream-artifacts/my-dev-kit/1.10.2/context-capsule/complete-v1.0.0.json +0 -504
  218. package/tests/fixtures/upstream-artifacts/my-dev-kit/1.10.2/context-capsule/future-minor-v1.1.0-additive.json +0 -955
  219. package/tests/fixtures/upstream-artifacts/my-dev-kit/1.10.2/retrieval-audit-record/complete-v1.0.0.json +0 -190
  220. package/tests/fixtures/upstream-artifacts/my-dev-kit/1.10.2/retrieval-audit-record/future-minor-v1.1.0-additive.json +0 -327
  221. package/tests/fixtures/upstream-artifacts/my-dev-kit-1.10.2-identity/PROVENANCE.txt +0 -13
  222. package/tests/fixtures/upstream-artifacts/my-dev-kit-1.10.2-identity/context-capsule.json +0 -7874
  223. package/tests/fixtures/upstream-artifacts/my-dev-kit-1.10.2-identity/retrieval-audit-record.json +0 -1076
  224. package/tests/fixtures/upstream-artifacts/my-dev-kit-orchestrator/1.2.1/workflow-instruction-packet/complete-v1.0.0.json +0 -160
  225. package/tests/fixtures/upstream-artifacts/my-dev-kit-orchestrator/1.2.1/workflow-instruction-packet/future-minor-v1.1.0-additive.json +0 -186
@@ -1,2 +0,0 @@
1
- rootProject.name = "non-android-gradle"
2
- include(":core")
@@ -1,7 +0,0 @@
1
- plugins {
2
- id("com.android.application")
3
- }
4
-
5
- android {
6
- namespace = "com.example.partial"
7
- }
@@ -1,2 +0,0 @@
1
- rootProject.name = "partial"
2
- include(":app")
@@ -1,17 +0,0 @@
1
- plugins {
2
- id("com.android.application")
3
- id("org.jetbrains.kotlin.android")
4
- }
5
-
6
- android {
7
- namespace = "com.example.xmlviewapp"
8
- compileSdk = 34
9
-
10
- defaultConfig {
11
- applicationId = "com.example.xmlviewapp"
12
- minSdk = 21
13
- targetSdk = 34
14
- versionCode = 1
15
- versionName = "1.0"
16
- }
17
- }
@@ -1,31 +0,0 @@
1
- <?xml version="1.0" encoding="utf-8"?>
2
- <manifest xmlns:android="http://schemas.android.com/apk/res/android">
3
-
4
- <application
5
- android:label="XML View App"
6
- android:icon="@mipmap/ic_launcher"
7
- android:allowBackup="false">
8
-
9
- <activity
10
- android:name=".MainActivity"
11
- android:exported="true">
12
- <intent-filter>
13
- <action android:name="android.intent.action.MAIN" />
14
- <category android:name="android.intent.category.LAUNCHER" />
15
- </intent-filter>
16
- </activity>
17
-
18
- <activity
19
- android:name=".DeepLinkActivity"
20
- android:exported="true">
21
- <intent-filter android:autoVerify="true">
22
- <action android:name="android.intent.action.VIEW" />
23
- <category android:name="android.intent.category.DEFAULT" />
24
- <category android:name="android.intent.category.BROWSABLE" />
25
- <data android:scheme="https" android:host="example.com" android:pathPrefix="/share" />
26
- </intent-filter>
27
- </activity>
28
-
29
- </application>
30
-
31
- </manifest>
@@ -1,7 +0,0 @@
1
- package com.example.xmlviewapp
2
-
3
- class MainActivity {
4
- fun bindViews() {
5
- val view = findViewById<Any>(0)
6
- }
7
- }
@@ -1,4 +0,0 @@
1
- <?xml version="1.0" encoding="utf-8"?>
2
- <FrameLayout xmlns:android="http://schemas.android.com/apk/res/android"
3
- android:layout_width="match_parent"
4
- android:layout_height="match_parent" />
@@ -1,4 +0,0 @@
1
- plugins {
2
- id("com.android.application") version "8.2.0" apply false
3
- id("org.jetbrains.kotlin.android") version "1.9.22" apply false
4
- }
@@ -1,4 +0,0 @@
1
- distributionBase=GRADLE_USER_HOME
2
- distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
3
- distributionPath=wrapper/dists
4
- zipStorePath=wrapper/dists
@@ -1,2 +0,0 @@
1
- rootProject.name = "xml-view-app"
2
- include(":app")
@@ -1,16 +0,0 @@
1
- # mixed-docs-claims fixture
2
-
3
- Current: this fixture ships `com.example.Widget` (Java) and `com.example.Gadget`
4
- (Kotlin), matching the classes actually present under `src/main/java` and
5
- `src/main/kotlin` -- these are current, accurate claims about this fixture's
6
- own source.
7
-
8
- Planned (not yet implemented): Android-specific validation of this project's
9
- JVM sources is planned for a later `v0.4.x` release track.
10
-
11
- Out of scope: this fixture's `build.gradle.kts` is never executed by Gradle,
12
- and `pom.xml`-style Maven execution is not performed against this project --
13
- static classification only.
14
-
15
- Future (not yet implemented): a combined `quality`, `project`, or `all`
16
- audit type covering this fixture does not exist yet.
@@ -1,4 +0,0 @@
1
- plugins {
2
- id("java")
3
- kotlin("jvm") version "1.9.0"
4
- }
@@ -1,7 +0,0 @@
1
- package com.example;
2
-
3
- public class Widget {
4
- public String label() {
5
- return "widget";
6
- }
7
- }
@@ -1,7 +0,0 @@
1
- package com.example
2
-
3
- class Gadget {
4
- fun label(): String {
5
- return "gadget"
6
- }
7
- }
@@ -1,10 +0,0 @@
1
- # mixed-generated-vendor fixture
2
-
3
- Current: a single real source file (`src/index.ts`) alongside
4
- `generated/schema.ts`, `dist/index.js`, `build/Main.class`, and
5
- `vendor/lib.py` -- files that live under path segments the existing
6
- `projectInventory.ts` policy already classifies as generated/build-output/
7
- vendor. Used to prove those files do not pollute source-facts collection
8
- (role stays generated/build-output/vendor, not source/test) and are excluded
9
- from `SourceFactsSnapshot.files` the same way `sourceFacts.test.ts`'s
10
- existing vendor/generated test already proves for a single language.
@@ -1 +0,0 @@
1
- module.exports = { identity: (v) => v };
@@ -1 +0,0 @@
1
- export type GeneratedSchema = { id: string };
@@ -1,3 +0,0 @@
1
- export function identity<T>(value: T): T {
2
- return value;
3
- }
@@ -1,2 +0,0 @@
1
- def vendored():
2
- return "vendored"
@@ -1,10 +0,0 @@
1
- # mixed-java-kotlin fixture
2
-
3
- Current: a conventional Gradle Kotlin DSL JVM project layout with one Java
4
- class (`src/main/java/com/example/FooService.java`), one Kotlin class
5
- (`src/main/kotlin/com/example/BarService.kt`), and matching test classes
6
- under `src/test/java` and `src/test/kotlin`. `build.gradle.kts` and
7
- `settings.gradle.kts` are present to prove Gradle Kotlin DSL build scripts
8
- are classified as config, not Kotlin source. Used to prove Java and Kotlin
9
- source facts coexist in one JVM-style project without disrupting each
10
- other's declarations or role classification.
@@ -1,8 +0,0 @@
1
- plugins {
2
- id("java")
3
- kotlin("jvm") version "1.9.0"
4
- }
5
-
6
- repositories {
7
- mavenCentral()
8
- }
@@ -1 +0,0 @@
1
- rootProject.name = "mixed-java-kotlin-fixture"
@@ -1,7 +0,0 @@
1
- package com.example;
2
-
3
- public class FooService {
4
- public String greet(String name) {
5
- return "Hello, " + name;
6
- }
7
- }
@@ -1,7 +0,0 @@
1
- package com.example
2
-
3
- class BarService {
4
- fun greet(name: String): String {
5
- return "Hello, $name"
6
- }
7
- }
@@ -1,8 +0,0 @@
1
- package com.example;
2
-
3
- public class FooServiceTest {
4
- public void testGreet() {
5
- FooService service = new FooService();
6
- assert service.greet("world").equals("Hello, world");
7
- }
8
- }
@@ -1,8 +0,0 @@
1
- package com.example
2
-
3
- class BarServiceTest {
4
- fun testGreet() {
5
- val service = BarService()
6
- assert(service.greet("world") == "Hello, world")
7
- }
8
- }
@@ -1,8 +0,0 @@
1
- # mixed-python-ts fixture
2
-
3
- Current: a Python module (`src/app.py`) and a TypeScript module
4
- (`src/index.ts`) that both declare an equivalent `add` function/declaration,
5
- plus one Python test file. Used to prove Python and TypeScript source facts
6
- coexist without schema or ordering drift, and that a duplicate-name
7
- declaration across languages is not merged into a single cross-language
8
- candidate.
@@ -1,7 +0,0 @@
1
- def add(a, b):
2
- return a + b
3
-
4
-
5
- class Calculator:
6
- def compute(self, a, b):
7
- return add(a, b)
@@ -1,3 +0,0 @@
1
- export function add(a: number, b: number): number {
2
- return a + b;
3
- }
@@ -1,5 +0,0 @@
1
- from src.app import add
2
-
3
-
4
- def test_add():
5
- assert add(1, 2) == 3
@@ -1,7 +0,0 @@
1
- # mixed-ts-js fixture
2
-
3
- Current: a minimal TypeScript entrypoint (`src/index.ts`) calling a plain
4
- JavaScript helper (`src/helper.js`), with one test file. Used by
5
- `tests/audits/mixedLanguageSourceFacts.test.ts` to prove TypeScript and
6
- JavaScript files coexist in a single source-facts collection without schema
7
- or ordering drift.
@@ -1,5 +0,0 @@
1
- function greet(name) {
2
- return "Hello, " + name;
3
- }
4
-
5
- module.exports = { greet };
@@ -1,3 +0,0 @@
1
- export function main(name: string): string {
2
- return `Hello, ${name}`;
3
- }
@@ -1,5 +0,0 @@
1
- import { main } from "../src/index.js";
2
-
3
- test("main returns a greeting", () => {
4
- expect(main("world")).toContain("world");
5
- });
@@ -1,10 +0,0 @@
1
- # mixed-ts-python-jvm fixture
2
-
3
- Current: TypeScript, JavaScript, Python, Java, and Kotlin source files
4
- coexisting in one target, plus a `build.gradle.kts` JVM metadata file. Used
5
- to prove all currently-supported language families (v0.3.3 baseline) can be
6
- collected together without crashing, without cross-language schema drift,
7
- and without one analyzer's output disturbing another's.
8
-
9
- Planned (not implemented): Android-specific source-set validation and
10
- manual pentest coverage are out of scope for this fixture and for v0.3.4.
@@ -1,4 +0,0 @@
1
- plugins {
2
- id("java")
3
- kotlin("jvm") version "1.9.0"
4
- }
@@ -1,5 +0,0 @@
1
- from src.app import multiply
2
-
3
-
4
- def test_multiply():
5
- assert multiply(2, 3) == 6
@@ -1,2 +0,0 @@
1
- def multiply(a, b):
2
- return a * b
@@ -1,5 +0,0 @@
1
- function double(x) {
2
- return x * 2;
3
- }
4
-
5
- module.exports = { double };
@@ -1,3 +0,0 @@
1
- export function multiply(a: number, b: number): number {
2
- return a * b;
3
- }
@@ -1,7 +0,0 @@
1
- package com.example;
2
-
3
- public class Multiplier {
4
- public int multiply(int a, int b) {
5
- return a * b;
6
- }
7
- }
@@ -1,7 +0,0 @@
1
- package com.example
2
-
3
- class Divider {
4
- fun divide(a: Int, b: Int): Int {
5
- return a / b
6
- }
7
- }
@@ -1,152 +0,0 @@
1
- #!/usr/bin/env node
2
- /**
3
- * Deterministic fake CLI for the security-validation adversarial harness.
4
- *
5
- * Simulates a "well-behaved" my-dev-kit-style CLI for CI tests that cannot
6
- * depend on a globally installed package.
7
- *
8
- * Supported flags:
9
- * --root <dir> Source root (treated as read-only; not validated for traversal)
10
- * --out <dir> Output directory for generated artifacts
11
- * --index <dir> Index artifact directory (also written with fake manifest)
12
- * --file <path> Path to read (simulates source retrieval)
13
- * --path <path> Graph path argument (logged only)
14
- * --node <id> Graph node argument (logged only)
15
- * --query <q> Search query (logged only)
16
- * --format <f> Output format: "json" | "text" (default: text)
17
- * --emit-stderr <msg> Write msg to stderr (simulates a warning)
18
- * --escape-to <dir> [HARNESS TESTING ONLY] Write an escape sentinel file here
19
- * Used to verify the harness can detect writes outside workspace.
20
- * --fail Exit with code 1 (simulates a CLI error)
21
- *
22
- * On success: writes a fake manifest.json to --out and/or --index, exits 0.
23
- * On --fail: emits an error message and exits 1.
24
- * Does NOT modify any files in --root.
25
- * Does NOT write anywhere other than --out and --index (unless --escape-to is set).
26
- */
27
-
28
- import { mkdirSync, writeFileSync } from "node:fs";
29
- import path from "node:path";
30
-
31
- function parseArgs(argv) {
32
- const args = argv.slice(2);
33
- const result = {
34
- root: null,
35
- out: null,
36
- index: null,
37
- file: null,
38
- path: null,
39
- node: null,
40
- query: null,
41
- format: "text",
42
- emitStderr: null,
43
- escapeTo: null,
44
- fail: false,
45
- };
46
- for (let i = 0; i < args.length; i++) {
47
- const a = args[i];
48
- if (a === "--root") result.root = args[++i];
49
- else if (a === "--out") result.out = args[++i];
50
- else if (a === "--index") result.index = args[++i];
51
- else if (a === "--file") result.file = args[++i];
52
- else if (a === "--path") result.path = args[++i];
53
- else if (a === "--node") result.node = args[++i];
54
- else if (a === "--query") result.query = args[++i];
55
- else if (a === "--format") result.format = args[++i];
56
- else if (a === "--emit-stderr") result.emitStderr = args[++i];
57
- else if (a === "--escape-to") result.escapeTo = args[++i];
58
- else if (a === "--fail") result.fail = true;
59
- }
60
- return result;
61
- }
62
-
63
- function fakeManifest(root) {
64
- return JSON.stringify(
65
- {
66
- schemaVersion: 1,
67
- version: "0.0.0-fake",
68
- generatedAt: new Date().toISOString(),
69
- root: root ?? "",
70
- files: [],
71
- },
72
- null,
73
- 2
74
- );
75
- }
76
-
77
- function run() {
78
- const opts = parseArgs(process.argv);
79
-
80
- if (opts.emitStderr) {
81
- process.stderr.write(`[fake-cli] warning: ${opts.emitStderr}\n`);
82
- }
83
-
84
- if (opts.fail) {
85
- if (opts.format === "json") {
86
- process.stdout.write(
87
- JSON.stringify({ error: "fake-cli: --fail was requested" }) + "\n"
88
- );
89
- } else {
90
- process.stderr.write("fake-cli: --fail was requested\n");
91
- }
92
- process.exit(1);
93
- }
94
-
95
- const manifest = fakeManifest(opts.root);
96
-
97
- if (opts.out) {
98
- try {
99
- mkdirSync(opts.out, { recursive: true });
100
- writeFileSync(path.join(opts.out, "manifest.json"), manifest, "utf8");
101
- } catch (err) {
102
- process.stderr.write(`fake-cli: failed to write --out: ${err.message}\n`);
103
- process.exit(1);
104
- }
105
- }
106
-
107
- if (opts.index) {
108
- try {
109
- mkdirSync(opts.index, { recursive: true });
110
- writeFileSync(path.join(opts.index, "manifest.json"), manifest, "utf8");
111
- } catch (err) {
112
- process.stderr.write(`fake-cli: failed to write --index: ${err.message}\n`);
113
- process.exit(1);
114
- }
115
- }
116
-
117
- // FOR HARNESS TESTING ONLY: deliberately write outside declared paths.
118
- // This flag exists solely so the harness can verify its own detection logic.
119
- if (opts.escapeTo) {
120
- try {
121
- mkdirSync(opts.escapeTo, { recursive: true });
122
- writeFileSync(
123
- path.join(opts.escapeTo, "escape-sentinel.txt"),
124
- "harness-escape-detection-test\n",
125
- "utf8"
126
- );
127
- } catch (err) {
128
- process.stderr.write(`fake-cli: --escape-to failed: ${err.message}\n`);
129
- }
130
- }
131
-
132
- if (opts.format === "json") {
133
- process.stdout.write(
134
- JSON.stringify({
135
- status: "ok",
136
- root: opts.root,
137
- out: opts.out,
138
- index: opts.index,
139
- }) + "\n"
140
- );
141
- } else {
142
- if (opts.out || opts.index) {
143
- process.stdout.write("fake-cli: artifacts written\n");
144
- } else {
145
- process.stdout.write("fake-cli: ok (no output requested)\n");
146
- }
147
- }
148
-
149
- process.exit(0);
150
- }
151
-
152
- run();
@@ -1,83 +0,0 @@
1
- #!/usr/bin/env node
2
- import fs from "node:fs";
3
- import path from "node:path";
4
-
5
- function argValue(flag) {
6
- const index = process.argv.indexOf(flag);
7
- return index >= 0 ? process.argv[index + 1] : undefined;
8
- }
9
-
10
- function benchmarkProjectFromIndexPath(indexPath) {
11
- const normalized = String(indexPath || "").replace(/\\/g, "/");
12
- if (normalized.includes("todo-ts")) return "todo-ts";
13
- if (normalized.includes("todo-python")) return "todo-python";
14
- if (normalized.includes("todo-js")) return "todo-js";
15
- if (normalized.includes("todo-mixed-ts-py")) return "todo-mixed-ts-py";
16
- return "unknown";
17
- }
18
-
19
- const command = process.argv[2];
20
- if (command === "index") {
21
- const outDir = argValue("--out");
22
- if (outDir) {
23
- fs.mkdirSync(outDir, { recursive: true });
24
- fs.writeFileSync(path.join(outDir, "fake-index.json"), JSON.stringify({ ok: true }));
25
- fs.writeFileSync(path.join(outDir, "manifest.json"), JSON.stringify({ ok: true, fake: true }));
26
- }
27
- console.log(JSON.stringify({ ok: true, command: "index", outDir }));
28
- process.exit(0);
29
- }
30
-
31
- if (command === "search") {
32
- const indexPath = argValue("--index");
33
- const project = benchmarkProjectFromIndexPath(indexPath);
34
- const mapping = {
35
- "todo-ts": { nodeId: "todo-ts:createTask", file: "src/taskService.ts", symbol: "createTask" },
36
- "todo-python": { nodeId: "todo-python:complete_task", file: "src/task_service.py", symbol: "complete_task" },
37
- "todo-js": { nodeId: "todo-js:listOpenTasks", file: "src/taskService.js", symbol: "listOpenTasks" },
38
- "todo-mixed-ts-py": { nodeId: "todo-mixed:summarize_tasks", file: "python/task_service.py", symbol: "summarize_tasks" }
39
- };
40
- console.log(JSON.stringify({ results: [mapping[project] || { nodeId: "unknown", file: "unknown", symbol: "unknown" }] }));
41
- process.exit(0);
42
- }
43
-
44
- if (command === "lookup") {
45
- const node = argValue("--node");
46
- console.log(JSON.stringify({ nodeId: node, summary: `lookup for ${node}` }));
47
- process.exit(0);
48
- }
49
-
50
- if (command === "slice") {
51
- const node = argValue("--node");
52
- console.log(JSON.stringify({ nodeId: node, slice: `slice for ${node}` }));
53
- process.exit(0);
54
- }
55
-
56
- if (command === "source") {
57
- const node = argValue("--node");
58
- const sourceMap = {
59
- "todo-ts:createTask": "1 export class TaskService {\n2 createTask(title: string) {\n3 return this.store.create(title.trim());\n4 }\n5 }",
60
- "todo-python:complete_task": "1 class TaskService:\n2 def complete_task(self, task_id: str) -> dict:\n3 return self._store.update(task_id, lambda task: {**task, 'completed': True})",
61
- "todo-js:listOpenTasks": "1 export class TaskService {\n2 listOpenTasks() {\n3 return this.store.list().filter((task) => !task.completed);\n4 }\n5 }",
62
- "todo-mixed:summarize_tasks": "1 def summarize_tasks(self) -> dict:\n2 completed = len([task for task in self._tasks if task['completed']])\n3 return {'total': len(self._tasks), 'open': len(self._tasks) - completed, 'completed': completed}"
63
- };
64
- process.stdout.write(sourceMap[node] || `1 source for ${node}`);
65
- process.exit(0);
66
- }
67
-
68
- if (command === "view") {
69
- const graph = argValue("--graph") || "unknown";
70
- const outPath = argValue("--out");
71
- if (outPath) {
72
- fs.mkdirSync(path.dirname(outPath), { recursive: true });
73
- fs.writeFileSync(
74
- outPath,
75
- `<svg xmlns="http://www.w3.org/2000/svg" width="320" height="160"><text x="20" y="40">fake ${graph}</text><circle cx="80" cy="90" r="18" fill="#2563eb" /><circle cx="200" cy="90" r="18" fill="#16a34a" /><line x1="98" y1="90" x2="182" y2="90" stroke="#344054" /></svg>\n`
76
- );
77
- }
78
- console.log(JSON.stringify({ ok: true, command: "view", graph, outPath }));
79
- process.exit(0);
80
- }
81
-
82
- process.stderr.write(`Unsupported fake my-dev-kit command: ${command}`);
83
- process.exit(1);
@@ -1,24 +0,0 @@
1
- {
2
- "schemaVersion": "1.0.0",
3
- "fixtureId": "FULL-WORKFLOW-LIBRARY-V043-001",
4
- "title": "Complete workflow instruction library",
5
- "description": "Deterministic full-workflow-library fixture for v0.4.3 strategy execution.",
6
- "workflowIds": ["workflow.feature", "workflow.release"],
7
- "stageIds": [
8
- "stage.feature.architecture",
9
- "stage.feature.implementation",
10
- "stage.feature.test-implementation",
11
- "stage.release.readiness"
12
- ],
13
- "commandIds": [
14
- "command.context.inspect",
15
- "command.test.focused",
16
- "command.test.full",
17
- "command.release.publish"
18
- ],
19
- "ruleIds": ["rule.scope.bounded", "rule.testing.required", "rule.release.publish-last"],
20
- "reportContractIds": ["report.implementation", "report.release"],
21
- "provenanceEvidenceIds": ["provenance.workflow.feature", "provenance.workflow.release"],
22
- "rawText": "A deterministic complete workflow instruction library fixture containing architecture, implementation, test, validation, release, and reporting instructions.",
23
- "warnings": []
24
- }
@@ -1,25 +0,0 @@
1
- {
2
- "schemaVersion": "1.1.0",
3
- "fixtureId": "FULL-WORKFLOW-LIBRARY-V043-001",
4
- "title": "Complete workflow instruction library",
5
- "description": "Deterministic full-workflow-library fixture for v0.4.3 strategy execution.",
6
- "futureMinorRootField": "preserved",
7
- "workflowIds": ["workflow.feature", "workflow.release"],
8
- "stageIds": [
9
- "stage.feature.architecture",
10
- "stage.feature.implementation",
11
- "stage.feature.test-implementation",
12
- "stage.release.readiness"
13
- ],
14
- "commandIds": [
15
- "command.context.inspect",
16
- "command.test.focused",
17
- "command.test.full",
18
- "command.release.publish"
19
- ],
20
- "ruleIds": ["rule.scope.bounded", "rule.testing.required", "rule.release.publish-last"],
21
- "reportContractIds": ["report.implementation", "report.release"],
22
- "provenanceEvidenceIds": ["provenance.workflow.feature", "provenance.workflow.release"],
23
- "rawText": "A deterministic complete workflow instruction library fixture containing architecture, implementation, test, validation, release, and reporting instructions.",
24
- "warnings": []
25
- }