@dailephd/my-dev-kit-lab 0.4.5 → 0.4.6

package/dist/scripts/report-context-integrity-smoke.js

@@ -1,70 +0,0 @@
-// v0.4.5 context-integrity evaluation: report smoke script. Loads the frozen failed-run and
-// corrected-replay fixtures, evaluates them through the existing producer-readiness bridge,
-// and writes JSON/text/HTML reports for manual inspection. Not part of any release-readiness
-// gate; a developer convenience for inspecting ContextIntegrityReportV1 output.
-import { mkdirSync, writeFileSync } from "node:fs";
-import { loadContextIntegrityFixture } from "../src/evaluation/ecosystemFixtures/loadContextIntegrityFixture.js";
-import { evaluateProducerReadinessBridge } from "../src/evaluation/stageContextMetrics/evaluateProducerReadinessBridge.js";
-import { calculateStageContextDeterminism } from "../src/evaluation/stageContextDeterminism/calculateStageContextDeterminism.js";
-import { buildContextIntegrityReport } from "../src/report/experiments/buildContextIntegrityReport.js";
-import { renderContextIntegrityJsonReport } from "../src/report/experiments/renderContextIntegrityJsonReport.js";
-import { renderContextIntegrityText } from "../src/report/experiments/renderContextIntegrityText.js";
-import { renderContextIntegrityHtml } from "../src/report/experiments/renderContextIntegrityHtml.js";
-const CASES = [
-    {
-        kind: "failed-run",
-        root: "tests/fixtures/ecosystem/context-integrity/v0.4.5/failed-run",
-        manifest: "tests/fixtures/ecosystem/context-integrity/v0.4.5/manifests/failed-run-manifest.json"
-    },
-    {
-        kind: "corrected-replay",
-        root: "tests/fixtures/ecosystem/context-integrity/v0.4.5/corrected-replay",
-        manifest: "tests/fixtures/ecosystem/context-integrity/v0.4.5/manifests/corrected-replay-manifest.json"
-    }
-];
-async function main() {
-    const outDir = "lab-output/context-integrity-report-smoke";
-    mkdirSync(outDir, { recursive: true });
-    for (const c of CASES) {
-        const fixture = await loadContextIntegrityFixture(c.root, c.manifest);
-        if (!fixture.ok) {
-            console.error(`Fixture load failed for ${c.kind}:`, fixture.issues);
-            process.exitCode = 1;
-            continue;
-        }
-        const bridgeResult = evaluateProducerReadinessBridge({
-            implementation: { role: "implementation", contextCapsule: fixture.implementationCapsule, retrievalAuditRecord: fixture.implementationAudit },
-            readiness: fixture.runIntegrityEvidence?.gate.implementationContext,
-            runIntegrityEvidence: fixture.runIntegrityEvidence,
-            expectations: {
-                schemaVersion: "1.0.0",
-                caseId: "CASE-SMOKE",
-                title: "smoke",
-                description: "smoke",
-                expectedEvidence: [],
-                expectedStates: {},
-                warnings: [],
-                producerReadinessExpectations: {}
-            }
-        });
-        const determinism = calculateStageContextDeterminism([
-            { runNumber: 1, value: bridgeResult },
-            { runNumber: 2, value: bridgeResult }
-        ]);
-        const report = buildContextIntegrityReport({
-            fixtureKind: c.kind,
-            manifest: fixture.manifest,
-            hashVerification: fixture.hashVerification,
-            capsule: fixture.implementationCapsule,
-            audit: fixture.implementationAudit,
-            bridgeResult,
-            determinism,
-            fixtureSelfImmutable: true
-        });
-        writeFileSync(`${outDir}/${c.kind}.report.json`, renderContextIntegrityJsonReport(report), "utf8");
-        writeFileSync(`${outDir}/${c.kind}.report.txt`, renderContextIntegrityText(report), "utf8");
-        writeFileSync(`${outDir}/${c.kind}.report.html`, renderContextIntegrityHtml(report), "utf8");
-        console.log(`Wrote ${c.kind} reports. endToEnd=${report.endToEnd?.category}`);
-    }
-}
-main();

package/dist/scripts/run-agent-prompt.js

@@ -1,2 +0,0 @@
-import { runAgentPromptCommand } from "../src/commands/runAgentPromptCommand.js";
-process.exitCode = await runAgentPromptCommand(process.argv.slice(2));

package/dist/scripts/run-controlled-experiment.js

@@ -1,2 +0,0 @@
-import { runControlledExperimentCommand } from "../src/commands/runControlledExperimentCommand.js";
-process.exitCode = await runControlledExperimentCommand(process.argv.slice(2));

package/dist/scripts/run-lab-demo.js

@@ -1,5 +0,0 @@
-import { runLabDemoCommand } from "../src/commands/runLabDemo.js";
-const exitCode = await runLabDemoCommand(process.argv.slice(2));
-if (exitCode !== 0) {
-    process.exitCode = exitCode;
-}

package/dist/scripts/run-visualization-demos.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { runVisualizationDemosCommand } from "../src/commands/runVisualizationDemosCommand.js";
-process.exitCode = await runVisualizationDemosCommand(process.argv.slice(2));

package/dist/scripts/security/resolveToolRoot.js

@@ -1,16 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-export function resolveToolRoot(moduleUrl) {
-    let current = path.dirname(fileURLToPath(moduleUrl));
-    while (true) {
-        if (fs.existsSync(path.join(current, "package.json"))) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            return process.cwd();
-        }
-        current = parent;
-    }
-}

package/dist/scripts/security/runCodeql.js

@@ -1,58 +0,0 @@
-#!/usr/bin/env node
-import { runCodeqlCheck } from "../../src/securityValidation/staticScans/codeql.js";
-import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
-import { resolveToolRoot } from "./resolveToolRoot.js";
-const rawArgs = process.argv.slice(2);
-const args = parseArgs(rawArgs);
-const toolRoot = resolveToolRoot(import.meta.url);
-let targetRoot;
-try {
-    const target = resolveValidationTarget(args.target, toolRoot);
-    targetRoot = target.targetRoot;
-    if (!target.isSelf) {
-        console.log(`Target: ${targetRoot}`);
-    }
-}
-catch (err) {
-    console.error(`ERROR: ${err instanceof Error ? err.message : String(err)}`);
-    process.exitCode = 1;
-    process.exit(1);
-}
-console.log("Running CodeQL static analysis check...");
-const result = await runCodeqlCheck({
-    cwd: toolRoot,
-    targetRoot,
-    timeoutMs: 30_000,
-});
-const label = result.status === "skipped"
-    ? `SKIPPED — ${result.skippedReason ?? "tool unavailable"}`
-    : result.status.toUpperCase();
-console.log(`Status: ${label}`);
-if (result.findings.length > 0) {
-    console.log("\nFindings:");
-    for (const f of result.findings) {
-        console.log(`  [${f.severity.toUpperCase()}] ${f.title}`);
-        if (f.description)
-            console.log(`    ${f.description.slice(0, 120)}`);
-    }
-}
-console.log(`\nDuration: ${result.durationMs}ms`);
-if (result.status === "skipped") {
-    console.log("\nCodeQL is optional. Absence does not block release.");
-    process.exitCode = 0;
-}
-else if (result.status === "failed") {
-    process.exitCode = 1;
-}
-else {
-    process.exitCode = 0;
-}
-function parseArgs(argv) {
-    const result = {};
-    for (let i = 0; i < argv.length; i++) {
-        if ((argv[i] === "--target" || argv[i] === "-t") && i + 1 < argv.length) {
-            result.target = argv[++i];
-        }
-    }
-    return result;
-}

package/dist/scripts/security/runDependencyChecks.js

@@ -1,58 +0,0 @@
-#!/usr/bin/env node
-import path from "node:path";
-import { runDependencyChecks } from "../../src/securityValidation/index.js";
-import { DEFAULT_SECURITY_CONFIG } from "../../src/securityValidation/index.js";
-import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
-import { resolveToolRoot } from "./resolveToolRoot.js";
-const rawArgs = process.argv.slice(2);
-const args = parseArgs(rawArgs);
-const toolRoot = resolveToolRoot(import.meta.url);
-let targetRoot;
-try {
-    const target = resolveValidationTarget(args.target, toolRoot);
-    targetRoot = target.targetRoot;
-    if (!target.isSelf) {
-        console.log(`Target: ${targetRoot}`);
-    }
-}
-catch (err) {
-    console.error(`ERROR: ${err instanceof Error ? err.message : String(err)}`);
-    process.exitCode = 1;
-    process.exit(1);
-}
-const config = {
-    ...DEFAULT_SECURITY_CONFIG,
-    reportDir: path.join(toolRoot, DEFAULT_SECURITY_CONFIG.reportDir),
-    rawOutputDir: path.join(toolRoot, DEFAULT_SECURITY_CONFIG.rawOutputDir),
-};
-console.log("Running dependency checks...");
-console.log(`Report directory: ${config.reportDir}`);
-const output = await runDependencyChecks({ cwd: targetRoot, config });
-const passed = output.checks.filter((c) => c.status === "passed").length;
-const failed = output.checks.filter((c) => c.status === "failed").length;
-const warned = output.checks.filter((c) => c.status === "warning").length;
-const skipped = output.checks.filter((c) => c.status === "skipped").length;
-console.log(`\nDependency checks complete:`);
-console.log(`  Passed:  ${passed}`);
-console.log(`  Warned:  ${warned}`);
-console.log(`  Failed:  ${failed}`);
-console.log(`  Skipped: ${skipped}`);
-console.log(`  Findings: ${output.findings.length}`);
-if (output.findings.length > 0) {
-    console.log("\nFindings:");
-    for (const f of output.findings) {
-        console.log(`  [${f.severity.toUpperCase()}] ${f.title}`);
-    }
-}
-console.log(`\nResults written to ${config.reportDir}`);
-const hasBlocker = output.findings.some((f) => f.severity === "blocker");
-process.exitCode = hasBlocker ? 1 : 0;
-function parseArgs(argv) {
-    const result = {};
-    for (let i = 0; i < argv.length; i++) {
-        if ((argv[i] === "--target" || argv[i] === "-t") && i + 1 < argv.length) {
-            result.target = argv[++i];
-        }
-    }
-    return result;
-}

package/dist/scripts/security/runFuzzSmoke.js

@@ -1,29 +0,0 @@
-#!/usr/bin/env node
-import { runAllFuzzTargets } from "../../src/securityValidation/fuzz/fuzzHarness.js";
-import { ALL_FUZZ_TARGETS } from "../../src/securityValidation/fuzz/fuzzTargets.js";
-const SEED = parseInt(process.env["FUZZ_SEED"] ?? "0xDEADBEEF", 16);
-const ITERATIONS = parseInt(process.env["FUZZ_ITERATIONS"] ?? "50", 10);
-console.log(`Running fuzz smoke tests...`);
-console.log(`  Targets   : ${ALL_FUZZ_TARGETS.length}`);
-console.log(`  Seed      : 0x${SEED.toString(16).toUpperCase()}`);
-console.log(`  Iterations: ${ITERATIONS} per target`);
-const result = await runAllFuzzTargets(ALL_FUZZ_TARGETS, {
-    seed: SEED,
-    iterations: ITERATIONS,
-});
-console.log(`\nStatus  : ${result.status.toUpperCase()}`);
-console.log(`Duration: ${result.durationMs}ms`);
-console.log(`Crashes : ${result.findings.length}`);
-if (result.findings.length > 0) {
-    console.log("\nCrash findings:");
-    for (const f of result.findings) {
-        console.log(`  [${f.severity.toUpperCase()}] ${f.title}`);
-        if (f.evidence)
-            console.log(`    Evidence: ${f.evidence.slice(0, 160)}`);
-    }
-    process.exitCode = 1;
-}
-else {
-    console.log("\nAll fuzz targets completed without crashes.");
-    process.exitCode = 0;
-}

package/dist/scripts/security/runPackageChecks.js

@@ -1,57 +0,0 @@
-#!/usr/bin/env node
-import path from "node:path";
-import { runPackageChecks } from "../../src/securityValidation/index.js";
-import { DEFAULT_SECURITY_CONFIG } from "../../src/securityValidation/index.js";
-import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
-import { resolveToolRoot } from "./resolveToolRoot.js";
-const rawArgs = process.argv.slice(2);
-const args = parseArgs(rawArgs);
-const toolRoot = resolveToolRoot(import.meta.url);
-let targetRoot;
-try {
-    const target = resolveValidationTarget(args.target, toolRoot);
-    targetRoot = target.targetRoot;
-    if (!target.isSelf) {
-        console.log(`Target: ${targetRoot}`);
-    }
-}
-catch (err) {
-    console.error(`ERROR: ${err instanceof Error ? err.message : String(err)}`);
-    process.exitCode = 1;
-    process.exit(1);
-}
-const config = {
-    ...DEFAULT_SECURITY_CONFIG,
-    reportDir: path.join(toolRoot, DEFAULT_SECURITY_CONFIG.reportDir),
-    rawOutputDir: path.join(toolRoot, DEFAULT_SECURITY_CONFIG.rawOutputDir),
-};
-console.log("Running package content checks...");
-console.log(`Report directory: ${config.reportDir}`);
-const output = await runPackageChecks({ cwd: targetRoot, config });
-const passed = output.checks.filter((c) => c.status === "passed").length;
-const failed = output.checks.filter((c) => c.status === "failed").length;
-const warned = output.checks.filter((c) => c.status === "warning").length;
-console.log(`\nPackage checks complete:`);
-console.log(`  Passed:  ${passed}`);
-console.log(`  Warned:  ${warned}`);
-console.log(`  Failed:  ${failed}`);
-console.log(`  Findings: ${output.findings.length}`);
-if (output.findings.length > 0) {
-    console.log("\nFindings:");
-    for (const f of output.findings) {
-        console.log(`  [${f.severity.toUpperCase()}] ${f.title}`);
-    }
-}
-console.log(`\nResults written to ${config.reportDir}`);
-const hasBlocker = output.findings.some((f) => f.severity === "blocker");
-const hasMajor = output.findings.some((f) => f.severity === "major");
-process.exitCode = hasBlocker || hasMajor ? 1 : 0;
-function parseArgs(argv) {
-    const result = {};
-    for (let i = 0; i < argv.length; i++) {
-        if ((argv[i] === "--target" || argv[i] === "-t") && i + 1 < argv.length) {
-            result.target = argv[++i];
-        }
-    }
-    return result;
-}

package/dist/scripts/security/runSemgrep.js

@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-import path from "node:path";
-import { runSemgrepCheck } from "../../src/securityValidation/staticScans/semgrep.js";
-import { resolveValidationTarget } from "../../src/securityValidation/validate/resolveTarget.js";
-import { resolveToolRoot } from "./resolveToolRoot.js";
-const rawArgs = process.argv.slice(2);
-const args = parseArgs(rawArgs);
-const toolRoot = resolveToolRoot(import.meta.url);
-let targetRoot;
-try {
-    const target = resolveValidationTarget(args.target, toolRoot);
-    targetRoot = target.targetRoot;
-    if (!target.isSelf) {
-        console.log(`Target: ${targetRoot}`);
-    }
-}
-catch (err) {
-    console.error(`ERROR: ${err instanceof Error ? err.message : String(err)}`);
-    process.exitCode = 1;
-    process.exit(1);
-}
-console.log("Running Semgrep static analysis check...");
-console.log(`Config: ${path.join(toolRoot, ".semgrep.yml")}`);
-const result = await runSemgrepCheck({
-    targetRoot,
-    toolRoot,
-    configPath: path.join(toolRoot, ".semgrep.yml"),
-    timeoutMs: 120_000,
-});
-const label = result.status === "skipped"
-    ? `SKIPPED — ${result.skippedReason ?? "tool unavailable"}`
-    : result.status.toUpperCase();
-console.log(`\nStatus: ${label}`);
-if (result.findings.length > 0) {
-    console.log("\nFindings:");
-    for (const f of result.findings) {
-        console.log(`  [${f.severity.toUpperCase()}] ${f.title}`);
-        if (f.affectedFiles && f.affectedFiles.length > 0) {
-            console.log(`    Location: ${f.affectedFiles[0]}`);
-        }
-        if (f.description)
-            console.log(`    ${f.description.slice(0, 120)}`);
-    }
-}
-console.log(`\nDuration: ${result.durationMs}ms`);
-if (result.status === "skipped") {
-    console.log("\nSemgrep is optional. Absence does not block release.");
-    process.exitCode = 0;
-}
-else if (result.status === "failed") {
-    process.exitCode = 1;
-}
-else {
-    process.exitCode = 0;
-}
-function parseArgs(argv) {
-    const result = {};
-    for (let i = 0; i < argv.length; i++) {
-        if ((argv[i] === "--target" || argv[i] === "-t") && i + 1 < argv.length) {
-            result.target = argv[++i];
-        }
-    }
-    return result;
-}

package/dist/scripts/security/validate.js

@@ -1,266 +0,0 @@
-#!/usr/bin/env node
-import path from "node:path";
-import { runSecurityValidation } from "../../src/securityValidation/validate/runSecurityValidation.js";
-import { resolveValidationTarget, reportFilenamePrefix } from "../../src/securityValidation/validate/resolveTarget.js";
-import { buildSecurityReportFromSummary } from "../../src/securityValidation/report/buildSecurityReport.js";
-import { renderTextReport } from "../../src/securityValidation/report/renderSecurityReport.js";
-import { writeSecurityReportFiles } from "../../src/securityValidation/report/writeSecurityReportFiles.js";
-import { parseSecurityValidateArgs, normalizeSecurityValidateConfig, applyProfileDefaultChecksIfApplicable, } from "../../src/securityValidation/validate/cliOptions.js";
-import { resolveAttackProfile } from "../../src/securityValidation/attackScenarios/attackProfile.js";
-import { findingsBreachFailOnThreshold } from "../../src/securityValidation/validate/verdict.js";
-import { resolveToolRoot } from "./resolveToolRoot.js";
-import { validateAndroidTarget } from "../../src/mobile/android/validate/validateAndroidTarget.js";
-import { toAndroidReportModel } from "../../src/mobile/android/report/model.js";
-import { renderAndroidTextReport } from "../../src/mobile/android/report/renderAndroidReport.js";
-import { writeAndroidReportFiles } from "../../src/mobile/android/report/writeAndroidReportFiles.js";
-const USAGE = "Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>] " +
-    "[--checks deps,package,static,cli-adversarial,fuzz,boundary,subprocess,secrets,network] " +
-    "[--profile node-cli-package|local-tool|npm-package|android] [--format text,json] [--fail-on blocker|high|medium|low] " +
-    "[--android-gradle-operations wrapper-version,tasks,assemble-debug,unit-test-debug,lint-debug] " +
-    "[--android-external-tools semgrep,osv,android-lint,dependency-check] " +
-    "[--android-external-network deny|allow-requested]\n" +
-    "\n" +
-    "Android profile:\n" +
-    "  --profile android performs static, read-only Android project detection, manifest parsing,\n" +
-    "  permission/exported-component/intent-filter/deep-link audits, static Gradle metadata\n" +
-    "  extraction, and (as of v0.4.1 Batch 8) eleven internal advanced security checks (network\n" +
-    "  security config, backup/release configuration, hardcoded secrets, signing configuration,\n" +
-    "  WebView, FileProvider, sensitive storage/logging, clipboard, and Firebase/Google services).\n" +
-    "  Gradle and external tools are never executed by default.\n" +
-    "  --android-gradle-operations explicitly opts into running ONLY the listed allowlisted Gradle\n" +
-    "  operations (wrapper-version, tasks, assemble-debug, unit-test-debug, lint-debug) via the\n" +
-    "  project's own Gradle wrapper. Arbitrary Gradle tasks cannot be passed. This option is only\n" +
-    "  valid together with --profile android.\n" +
-    "  --android-external-tools explicitly opts into running ONLY the listed allowlisted optional\n" +
-    "  external security tools (semgrep, osv, android-lint, dependency-check). No arbitrary tool\n" +
-    "  names, commands, or arguments can be passed. This option is only valid together with\n" +
-    "  --profile android.\n" +
-    "  --android-external-network controls whether a requested tool may use network access.\n" +
-    "  Defaults to deny (osv is skipped unless supported offline data is available; semgrep,\n" +
-    "  android-lint, and dependency-check always run offline/no-update regardless of this flag).\n" +
-    "  allow-requested authorizes network only for an explicitly requested tool whose Batch 7\n" +
-    "  contract supports it (currently only osv). This option is only valid together with\n" +
-    "  --profile android.\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-gradle-operations wrapper-version,tasks\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-external-tools semgrep,android-lint\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-external-tools osv --android-external-network allow-requested";
-// Parse CLI arguments from process.argv (after the node/tsx and script path).
-const rawArgs = process.argv.slice(2);
-const toolRoot = resolveToolRoot(import.meta.url);
-// Help deliberately wins over every other argument. It must remain a
-// no-work path: no target/default resolution, option normalization, report
-// directory creation, validation orchestration, or subprocess execution.
-if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
-    console.log(USAGE);
-    process.exitCode = 0;
-    process.exit(0);
-}
-let args;
-let config;
-try {
-    args = parseSecurityValidateArgs(rawArgs);
-    config = normalizeSecurityValidateConfig(args, toolRoot);
-    // v0.2.2 Batch 5: --profile with no --checks uses that profile's declared
-    // default checks. No-op unless the user passed --profile without --checks
-    // (see applyProfileDefaultChecksIfApplicable's guard) — the true no-flag
-    // case and any explicit --checks case are always unaffected. Skipped for
-    // "android": that profile does not use the classic --checks pipeline.
-    if (config.profile !== "android") {
-        config = applyProfileDefaultChecksIfApplicable(config, resolveAttackProfile(config.profile).defaultCheckIds);
-    }
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = 2;
-    process.exit(2);
-}
-// Resolve and validate target early so we can fail fast with a clean error.
-let target;
-try {
-    target = resolveValidationTarget(args.target, toolRoot);
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = 1;
-    process.exit(1);
-}
-console.log("=".repeat(60));
-console.log("my-dev-kit-lab security:validate");
-console.log("=".repeat(60));
-console.log(`Tool root  : ${toolRoot}`);
-if (!target.isSelf) {
-    console.log(`Target     : ${target.targetRoot}`);
-    if (target.packageName)
-        console.log(`Package    : ${target.packageName}${target.packageVersion ? `@${target.packageVersion}` : ""}`);
-}
-else {
-    console.log(`Mode       : self-validation`);
-}
-console.log(`Profile    : ${config.profile}`);
-// ---------------------------------------------------------------------------
-// v0.4.0 Batch 5 — Android profile path.
-//
-// A separate orchestrator (not the classic check-group/attack-scenario
-// pipeline below) because the Android check/finding/status vocabulary
-// established in Batches 1-4 does not fit SecurityCheckId/SecurityCheckResult.
-// Same command, same --profile flag, same reports/security/ output root.
-// ---------------------------------------------------------------------------
-if (config.profile === "android") {
-    if (config.androidGradleOperationIds.length > 0) {
-        console.log(`Gradle ops : ${config.androidGradleOperationIds.join(", ")} (explicitly requested — will execute via the target's Gradle wrapper)`);
-    }
-    else {
-        console.log(`Gradle ops : (none requested — static-only validation, zero Gradle process execution)`);
-    }
-    // v0.4.1 Batch 8 — external tools remain explicit opt-in, mirroring Gradle
-    // operations exactly. "allow-requested" (the CLI-facing value) maps to the
-    // Batch 7 dispatcher's "allow-for-requested-tool" network policy value.
-    const externalNetworkPolicy = config.androidExternalNetworkPolicy === "allow-requested" ? "allow-for-requested-tool" : "deny";
-    if (config.androidExternalToolIds.length > 0) {
-        console.log(`External   : ${config.androidExternalToolIds.join(", ")} (explicitly requested — network policy: ${config.androidExternalNetworkPolicy})`);
-    }
-    else {
-        console.log(`External   : (none requested — zero external-tool process execution)`);
-    }
-    console.log("");
-    const reportsDir = config.out;
-    let result;
-    try {
-        result = await validateAndroidTarget({
-            toolRoot,
-            targetPath: args.target,
-            requestedGradleOperationIds: config.androidGradleOperationIds,
-            requestedExternalToolIds: config.androidExternalToolIds,
-            externalNetworkPolicy: externalNetworkPolicy,
-            externalToolArtifactRoot: path.join(reportsDir, "external-tools"),
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`\nERROR: Android validation failed to run: ${msg}`);
-        process.exitCode = 3;
-        process.exit(3);
-    }
-    const reportModel = toAndroidReportModel(result, {
-        profile: config.profile,
-        requestedGradleOperations: config.androidGradleOperationIds,
-        requestedExternalTools: config.androidExternalToolIds,
-        externalNetworkPolicy: config.androidExternalNetworkPolicy,
-    });
-    const textReport = renderAndroidTextReport(reportModel);
-    const prefix = args.reportPrefix ??
-        reportFilenamePrefix({
-            isSelf: result.target.local.isSelf,
-            packageName: result.target.local.packageName,
-            packageVersion: result.target.local.packageVersion,
-            targetRoot: result.target.local.targetRoot,
-        });
-    let writtenPaths;
-    try {
-        ({ writtenPaths } = writeAndroidReportFiles({ outDir: reportsDir, prefix, report: reportModel, formats: config.formats }));
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`\nERROR: Failed to write Android report files: ${msg}`);
-        console.error("Validation completed but the report could not be written. The in-memory result was not persisted.");
-        process.exitCode = 4;
-        process.exit(4);
-    }
-    console.log(textReport);
-    console.log(`\nReports written:`);
-    for (const p of writtenPaths) {
-        console.log(`  ${p}`);
-    }
-    const blockerExists = result.verdict === "not-ready-security-blocker-remains";
-    const inconclusive = result.verdict === "inconclusive-audit-environment-incomplete";
-    if (blockerExists) {
-        console.error("\nExit 1 — security blocker remains.");
-        process.exitCode = 1;
-    }
-    else if (inconclusive) {
-        console.warn("\nExit 2 — android environment incomplete.");
-        process.exitCode = 2;
-    }
-    else {
-        console.log("\nExit 0 — validation completed.");
-        process.exitCode = 0;
-    }
-}
-else {
-    // ---------------------------------------------------------------------------
-    // Classic check-group/attack-scenario pipeline (unchanged from prior versions).
-    // ---------------------------------------------------------------------------
-    if (!config.checksWereDefault) {
-        console.log(`Checks     : ${config.checks.join(", ")}`);
-    }
-    if (config.plannedChecksRequested.length > 0) {
-        console.log(`Note       : ${config.plannedChecksRequested.join(", ")} are routed through the attack-scenario framework rather than the classic check-group runners. Review the attack-scenario section in the report for their concrete results.`);
-    }
-    console.log("");
-    const summary = await runSecurityValidation({
-        cwd: toolRoot,
-        targetPath: args.target,
-        fuzzIterations: parseInt(process.env["FUZZ_ITERATIONS"] ?? "50", 10),
-        fuzzSeed: parseInt(process.env["FUZZ_SEED"] ?? "0xDEADBEEF", 16),
-        // Full selection (implemented + planned/attack-scenario ids) — the runner
-        // gates both implemented check groups and attack-scenario checks off the
-        // same selectedChecks set.
-        selectedChecks: config.checks,
-        profile: config.profile,
-    });
-    // v0.2.2 Batch 5: --fail-on breach is additive to (never a substitute for)
-    // the existing verdict-based exit decision below — it can only escalate
-    // exit 0 to exit 1 (e.g. --fail-on medium/low catching minor/informational
-    // findings the verdict policy doesn't already treat as blocking), never
-    // downgrade an existing blocker.
-    const failOnBreached = findingsBreachFailOnThreshold(summary.findings, config.failOnThreshold);
-    // Build report object
-    const report = buildSecurityReportFromSummary(summary, {
-        profile: config.profile,
-        selectedChecks: config.checks,
-        failOnThreshold: config.failOnThreshold,
-        formats: config.formats,
-        failOnBreached,
-    });
-    const textReport = renderTextReport(report);
-    // Determine output directory
-    const reportsDir = config.out;
-    // Determine report filename prefix
-    const prefix = args.reportPrefix ?? reportFilenamePrefix(target);
-    const { writtenPaths } = writeSecurityReportFiles({
-        outDir: reportsDir,
-        prefix,
-        report,
-        formats: config.formats,
-    });
-    // Print report to stdout
-    console.log(textReport);
-    console.log(`\nReports written:`);
-    for (const p of writtenPaths) {
-        console.log(`  ${p}`);
-    }
-    // Exit code based on verdict, escalated (never downgraded) by --fail-on.
-    const blockerExists = summary.verdict === "not-ready-security-blocker-remains";
-    const inconclusive = summary.verdict === "inconclusive-audit-environment-incomplete";
-    if (blockerExists) {
-        console.error("\nExit 1 — security blocker remains.");
-        process.exitCode = 1;
-    }
-    else if (inconclusive) {
-        console.warn("\nExit 2 — audit environment incomplete.");
-        process.exitCode = 2;
-    }
-    else if (failOnBreached) {
-        console.error(`\nExit 1 — --fail-on ${config.failOnThreshold} threshold breached.`);
-        process.exitCode = 1;
-    }
-    else {
-        console.log("\nExit 0 — validation completed.");
-        process.exitCode = 0;
-    }
-}