@invarn/cibuild 2.8.0 → 2.8.2

package/dist/src/commands/android-scanner.js

@@ -138,6 +138,419 @@ function extractSecretsPropertiesFile(content) {
     const m = /propertiesFileName\s*=\s*["']([^"']+)["']/.exec(block);
     return m ? m[1] : "local.properties";
 }
+// ---------------------------------------------------------------------------
+// Property keys the build reads out of the Secrets plugin's properties file
+// ---------------------------------------------------------------------------
+/**
+ * True when this build file *applies* the Secrets plugin, as opposed to merely
+ * declaring its version for other modules.
+ *
+ * A root build file almost always carries
+ * `alias(libs.plugins.secrets) apply false` — the plugin is named there so a
+ * module can apply it without repeating the version, and the root project
+ * itself never loads a properties file. Reading that as "the root module
+ * applies it" would aim the source walk below at the whole repository on the
+ * strength of a line that applies nothing.
+ *
+ * Separate from `detectSecretsPlugin` on purpose: that one decides which
+ * warnings are emitted, and this must not change them.
+ */
+function appliesSecretsPlugin(content) {
+    const applied = content
+        .split("\n")
+        .filter((line) => !/\bapply\s+false\b/.test(line))
+        .join("\n");
+    return detectSecretsPlugin(applied);
+}
+/**
+ * The `BuildConfig` fields the Android Gradle Plugin generates by itself.
+ *
+ * `BuildConfig.DEBUG` is the most-referenced constant in Android source, and
+ * every one of these is generated whether or not a properties file exists — so
+ * naming them costs more than the unused line the rest of this scan tolerates.
+ * A property named `DEBUG` would make the Secrets plugin generate a `String
+ * DEBUG` beside AGP's `boolean DEBUG`, and the build that was going to compile
+ * stops compiling because of the file meant to rescue it.
+ *
+ * `FLAVOR_<dimension>` is generated once per flavor dimension, so it is matched
+ * by prefix rather than listed.
+ */
+const AGP_GENERATED_BUILD_CONFIG_FIELDS = new Set([
+    "DEBUG",
+    "APPLICATION_ID",
+    "BUILD_TYPE",
+    "FLAVOR",
+    "VERSION_CODE",
+    "VERSION_NAME",
+    "LIBRARY_PACKAGE_NAME",
+]);
+function isAgpGeneratedField(name) {
+    return AGP_GENERATED_BUILD_CONFIG_FIELDS.has(name) || name.startsWith("FLAVOR_");
+}
+/**
+ * `BuildConfig.SOME_FIELD` references in a source file.
+ *
+ * Screaming snake case only: that is the convention for a generated constant,
+ * and widening it to any identifier would pull in `BuildConfig.javaClass` and
+ * every other member access on the class itself.
+ */
+function extractBuildConfigFieldRefs(content) {
+    const names = [];
+    const re = /\bBuildConfig\.([A-Z][A-Z0-9_]*)\b/g;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+        if (!isAgpGeneratedField(m[1]))
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * The index of the character closing the bracket or parenthesis at `open`,
+ * ignoring anything inside a string literal. -1 when it is never closed.
+ */
+function matchingClose(content, open) {
+    const closing = content[open] === "[" ? "]" : ")";
+    let depth = 0;
+    let quote = "";
+    for (let i = open; i < content.length; i++) {
+        const ch = content[i];
+        if (quote) {
+            if (ch === "\\")
+                i++;
+            else if (ch === quote)
+                quote = "";
+            continue;
+        }
+        if (ch === '"' || ch === "'")
+            quote = ch;
+        else if (ch === "[" || ch === "(")
+            depth++;
+        else if (ch === "]" || ch === ")") {
+            depth--;
+            if (depth === 0)
+                return content[i] === closing ? i : -1;
+        }
+    }
+    return -1;
+}
+/** Split a map-literal body on its top-level commas — not ones nested or quoted. */
+function splitTopLevel(body) {
+    const parts = [];
+    let depth = 0;
+    let quote = "";
+    let start = 0;
+    for (let i = 0; i < body.length; i++) {
+        const ch = body[i];
+        if (quote) {
+            if (ch === "\\")
+                i++;
+            else if (ch === quote)
+                quote = "";
+            continue;
+        }
+        if (ch === '"' || ch === "'")
+            quote = ch;
+        else if (ch === "[" || ch === "(" || ch === "{")
+            depth++;
+        else if (ch === "]" || ch === ")" || ch === "}")
+            depth--;
+        else if (ch === "," && depth === 0) {
+            parts.push(body.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(body.slice(start));
+    return parts;
+}
+/**
+ * The keys of a map literal, in either language's spelling:
+ * Groovy `[key: v, "key": v]`, Kotlin `mapOf("key" to v)`.
+ */
+function mapLiteralKeys(body) {
+    const names = [];
+    for (const entry of splitTopLevel(body)) {
+        const kotlin = /^\s*["']([^"']+)["']\s+to\s/.exec(entry);
+        if (kotlin) {
+            names.push(kotlin[1]);
+            continue;
+        }
+        const groovy = /^\s*(?:["']([^"']+)["']|([A-Za-z_]\w*))\s*:/.exec(entry);
+        if (groovy)
+            names.push(groovy[1] ?? groovy[2]);
+    }
+    return names;
+}
+/**
+ * Keys named in a `manifestPlaceholders` map in a build file.
+ *
+ * The Secrets plugin fills a placeholder from the property of the same name,
+ * so a placeholder the build declares is a property the build reads. Every
+ * spelling the two DSLs offer for the same map:
+ *
+ *     manifestPlaceholders["mapsApiKey"] = …        // both
+ *     manifestPlaceholders.put("mapsApiKey", …)     // Groovy
+ *     manifestPlaceholders = [mapsApiKey: …]        // Groovy
+ *     manifestPlaceholders += mapOf("mapsApiKey" to …)   // Kotlin
+ */
+function extractManifestPlaceholderKeys(content) {
+    const names = [];
+    for (const re of [
+        /manifestPlaceholders\s*\[\s*["']([^"']+)["']\s*\]/g,
+        /manifestPlaceholders\s*\.\s*put\s*\(\s*["']([^"']+)["']/g,
+    ]) {
+        let m;
+        while ((m = re.exec(content)) !== null)
+            names.push(m[1]);
+    }
+    // A whole map assigned, added or put at once. The opening bracket the regex
+    // ends on is where the literal starts; its match is where it ends.
+    const assigned = /manifestPlaceholders\s*(?:\.\s*putAll\s*\(\s*)?(?:\+?=\s*)?(?:mapOf\s*|mutableMapOf\s*)?[[(]/g;
+    let m;
+    while ((m = assigned.exec(content)) !== null) {
+        const open = m.index + m[0].length - 1;
+        const close = matchingClose(content, open);
+        if (close === -1)
+            continue;
+        names.push(...mapLiteralKeys(content.slice(open + 1, close)));
+        assigned.lastIndex = close;
+    }
+    return names;
+}
+/**
+ * Placeholder names referenced in an `AndroidManifest.xml`, other than the ones
+ * the Android Gradle Plugin injects itself.
+ *
+ * **This is what the Secrets plugin is mostly for.** Its own documentation, and
+ * every Google Maps setup guide, puts the key in the manifest and nowhere else:
+ *
+ *     <meta-data android:name="com.google.android.geo.API_KEY"
+ *                android:value="${MAPS_API_KEY}" />
+ *
+ * There is no `BuildConfig` reference and no `manifestPlaceholders` block —
+ * the plugin reads `MAPS_API_KEY` from the properties file and substitutes it
+ * during manifest merging. A scan that reads only build files and source sees
+ * nothing at all in such a repository.
+ *
+ * `applicationId` is excluded because AGP supplies it from the variant. A name
+ * a build file *declares* in `manifestPlaceholders` is not excluded: the build
+ * supplies that one, so naming it costs the usual unused line, and telling the
+ * two apart would mean resolving which module's manifest merges with which
+ * module's build file.
+ */
+const AGP_INJECTED_PLACEHOLDERS = new Set(["applicationId"]);
+function extractManifestXmlPlaceholders(content) {
+    const names = [];
+    const re = /\$\{([A-Za-z_][A-Za-z0-9_.]*)\}/g;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+        if (!AGP_INJECTED_PLACEHOLDERS.has(m[1]))
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * True when this build file loads the properties file itself, rather than
+ * leaving it to the Secrets plugin.
+ *
+ * Every spelling seen in the wild reduces to naming the file or calling a
+ * helper that names it: `rootProject.file("local.properties")`, AGP's own
+ * `gradleLocalProperties(rootDir)`, and Compose's `localPropertiesFile`.
+ */
+function readsPropertiesFileDirectly(content) {
+    return (/\blocal\.properties\b/.test(content) ||
+        /\bgradleLocalProperties\s*\(/.test(content) ||
+        /\blocalPropertiesFile\b/.test(content));
+}
+/**
+ * Keys a build file reads out of a properties file it loaded itself.
+ *
+ * `getProperty("x")` is the direct form, with or without a default. The rest is
+ * for the idiom that hides it: a repository defines its own one-line accessor —
+ *
+ *     def getProps(String name) {
+ *       def f = rootProject.file('local.properties')
+ *       if (f.exists()) { def p = new Properties(); p.load(...); return p[name] }
+ *       return ""
+ *     }
+ *
+ * — and every key then arrives as `getProps("sign.file")`, under a name chosen
+ * by that repository. So a function whose *body* reads the properties file is
+ * treated as an accessor for it, and the string literals at its call sites are
+ * keys. Without that, a repository like this reads as having none.
+ *
+ * `properties["x"]` is deliberately not matched: that is the Gradle *project*
+ * property channel — `gradle.properties` and `-P` — which `extractPropertyRefs`
+ * already reports, and which is not this file.
+ */
+function extractDirectPropertyReads(content) {
+    const names = [];
+    const direct = /\.\s*getProperty\s*\(\s*["']([^"']+)["']/g;
+    let m;
+    while ((m = direct.exec(content)) !== null)
+        names.push(m[1]);
+    for (const accessor of propertiesAccessorNames(content)) {
+        const call = new RegExp(`\\b${escapeForRegExp(accessor)}\\s*\\(\\s*["']([^"']+)["']`, "g");
+        let c;
+        while ((c = call.exec(content)) !== null)
+            names.push(c[1]);
+    }
+    return names;
+}
+function escapeForRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Functions declared in this file whose body reads the properties file. */
+function propertiesAccessorNames(content) {
+    const names = [];
+    // Groovy `def name(...) {` and Kotlin `fun name(...) {`, which is how a
+    // build script declares one.
+    const decl = /\b(?:def|fun)\s+([A-Za-z_]\w*)\s*\([^)]*\)\s*(?::[^{]*)?\{/g;
+    let m;
+    while ((m = decl.exec(content)) !== null) {
+        // `matchingBrace` counts from inside the block, so hand it the index after
+        // the opening brace the declaration regex ended on.
+        const body = m.index + m[0].length;
+        const close = matchingBrace(content, body);
+        if (close === -1)
+            continue;
+        if (readsPropertiesFileDirectly(content.slice(body, close)))
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * Keys that name a location on the machine running the build, not a value the
+ * build needs supplied.
+ *
+ * Writing one into a generated file puts a developer's own SDK path onto a
+ * runner, where it is wrong — and Gradle finds the SDK from `ANDROID_HOME`
+ * when the key is absent, which is how every build on a runner resolves it.
+ * The Secrets plugin ignores `sdk.dir` for the same reason.
+ */
+const MACHINE_LOCAL_KEYS = new Set(["sdk.dir", "ndk.dir", "cmake.dir"]);
+// Bounds on the source walk, the way `findGradleFiles` bounds itself to the
+// files a build actually declares. A repository is an unbounded tree and this
+// runs on every scan of one.
+const SOURCE_EXTENSIONS = [".kt", ".kts", ".java"];
+const SOURCE_SKIP_DIRS = new Set(["build", "node_modules"]);
+const SOURCE_FILE_CAP = 1500;
+const SOURCE_DEPTH_CAP = 12;
+/** Source files under `dir`, up to the shared file budget. */
+function findSourceFiles(dir, budget, depth = 0) {
+    if (depth > SOURCE_DEPTH_CAP || budget.left <= 0)
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const files = [];
+    const subdirs = [];
+    for (const entry of entries) {
+        // Dot directories hold caches and VCS state, never source: `.git`,
+        // `.gradle`, `.idea`, `.kotlin`.
+        if (entry.name.startsWith("."))
+            continue;
+        if (entry.isDirectory()) {
+            if (!SOURCE_SKIP_DIRS.has(entry.name))
+                subdirs.push(join(dir, entry.name));
+        }
+        else if (SOURCE_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) {
+            if (budget.left <= 0)
+                break;
+            budget.left--;
+            files.push(join(dir, entry.name));
+        }
+    }
+    for (const sub of subdirs)
+        files.push(...findSourceFiles(sub, budget, depth + 1));
+    return files;
+}
+/** The directories of `dirs` that no other member of `dirs` contains. */
+function outermost(dirs) {
+    return dirs.filter((dir) => !dirs.some((other) => other !== dir && dir.startsWith(other + "/")));
+}
+/** Manifests under `dir`, up to the shared file budget. */
+function findManifests(dir, budget, depth = 0) {
+    if (depth > SOURCE_DEPTH_CAP || budget.left <= 0)
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const found = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        if (entry.isDirectory()) {
+            if (!SOURCE_SKIP_DIRS.has(entry.name)) {
+                found.push(...findManifests(join(dir, entry.name), budget, depth + 1));
+            }
+        }
+        else if (entry.name === "AndroidManifest.xml") {
+            if (budget.left <= 0)
+                break;
+            budget.left--;
+            found.push(join(dir, entry.name));
+        }
+    }
+    return found;
+}
+/**
+ * The property names the build reads out of the properties file — see
+ * `ScanResult.missingPropertyKeys`. Four sources, because a repository may use
+ * any of them and most use exactly one:
+ *
+ *  - `${KEY}` in an `AndroidManifest.xml`, which the Secrets plugin fills. The
+ *    commonest of the four by a distance, and the one its documentation shows.
+ *  - `manifestPlaceholders` declared in a build file.
+ *  - `BuildConfig.<FIELD>` in source, for a key read as a generated constant.
+ *  - `getProperty("key")` in a build file that loads the properties file
+ *    itself, for a build that does not use the plugin at all.
+ *
+ * Bounded to the modules that either apply the plugin or read the file
+ * directly. A module that does neither cannot be reading a key out of it.
+ */
+function collectPropertyKeys(gradleFiles) {
+    // A module with both a `build.gradle` and a `build.gradle.kts` yields its
+    // directory twice, and walking it twice would spend the file budget twice.
+    const moduleDirs = new Set();
+    const keys = new Set();
+    for (const filePath of gradleFiles) {
+        const content = safeRead(filePath);
+        const plugin = appliesSecretsPlugin(content);
+        const direct = readsPropertiesFileDirectly(content);
+        if (!plugin && !direct)
+            continue;
+        moduleDirs.add(dirname(filePath));
+        for (const key of extractManifestPlaceholderKeys(content))
+            keys.add(key);
+        if (direct)
+            for (const key of extractDirectPropertyReads(content))
+                keys.add(key);
+    }
+    if (moduleDirs.size === 0)
+        return [];
+    const budget = { left: SOURCE_FILE_CAP };
+    for (const dir of outermost([...moduleDirs])) {
+        for (const file of findSourceFiles(dir, budget)) {
+            for (const name of extractBuildConfigFieldRefs(safeRead(file)))
+                keys.add(name);
+        }
+        for (const manifest of findManifests(dir, budget)) {
+            for (const name of extractManifestXmlPlaceholders(safeRead(manifest)))
+                keys.add(name);
+        }
+    }
+    for (const key of MACHINE_LOCAL_KEYS)
+        keys.delete(key);
+    return [...keys].sort();
+}
 /** Parse property keys from a standard .properties file, skipping comments and blank lines. */
 function parsePropertyKeys(propertiesContent) {
     return propertiesContent
@@ -1070,6 +1483,16 @@ export async function scanAndroidProject(projectRoot) {
         }
     }
     // ------------------------------------------------------------------
+    // 4b. Which keys that properties file has to declare
+    // ------------------------------------------------------------------
+    //
+    // Section 4 says the file is absent; this says what is in it. The two are
+    // separate because they answer different questions for different readers —
+    // the warnings above tell a person a file is missing, and this tells a
+    // generator what a stand-in for it has to contain.
+    // ------------------------------------------------------------------
+    const missingPropertyKeys = collectPropertyKeys(gradleFiles);
+    // ------------------------------------------------------------------
     // 5. Firebase / GMS — check google-services.json after scanning all files
     // ------------------------------------------------------------------
     if (gmsDetected) {
@@ -1121,6 +1544,7 @@ export async function scanAndroidProject(projectRoot) {
         detectedJavaVersionSource,
         detectedGradleVersion,
         buildVariants,
+        missingPropertyKeys,
     };
 }
 // ---------------------------------------------------------------------------

package/dist/src/commands/index.d.ts

@@ -23,6 +23,7 @@ export { handleBuildCommand } from "./build.js";
 export { handleResetCommand } from "./reset.js";
 export { detectMobileProjectRoot } from "../shared/detect-project.js";
 export type { MobileProjectType } from "../shared/detect-project.js";
+export { isXcodeContainer, xcodeContainersIn } from "../shared/detect-project.js";
 export { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 export type { IosScanResult, IosWarning, IosWarningCategory, IosWarningSeverity, } from "./ios-scanner.js";
 export { scanAndroidProject, formatScanResult, detectBuildVariants, } from "./android-scanner.js";

package/dist/src/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAOrE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EACV,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,UAAU,IAAI,iBAAiB,EAC/B,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAOlF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvE,YAAY,EACV,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,UAAU,IAAI,iBAAiB,EAC/B,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,4BAA4B,CAAC"}

package/dist/src/commands/index.js

@@ -19,6 +19,9 @@ export { handleBuildCommand } from "./build.js";
 export { handleResetCommand } from "./reset.js";
 // Helpers useful for callers that implement their own variations.
 export { detectMobileProjectRoot } from "../shared/detect-project.js";
+// The one answer to "is this `.xcodeproj` a project", exported so the Invarn
+// CLI's own scans cannot drift from cibuild's.
+export { isXcodeContainer, xcodeContainersIn } from "../shared/detect-project.js";
 // Project scanners — pure, toolchain-free file-content detectors. Exposed
 // so external callers (the Invarn CLI) can detect build variables and
 // secret-bearing files from a checkout and push them to the backend,

package/dist/src/commands/ios-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/ios-scanner.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAC;CACzB;AAuFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,EAAE,CAEV;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CxC;AAmLD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgGhF;AAaD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAkDjE"}
+{"version":3,"file":"ios-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/ios-scanner.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAC;CACzB;AAiFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,EAAE,CAEV;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CxC;AAkLD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgGhF;AAaD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAkDjE"}

package/dist/src/commands/ios-scanner.js

@@ -1,5 +1,6 @@
 import { resolve, relative } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { xcodeContainersIn } from "../shared/detect-project.js";
 // ---------------------------------------------------------------------------
 // File discovery
 // ---------------------------------------------------------------------------
@@ -18,17 +19,16 @@ function relPath(root, filePath) {
  * Finds the primary Xcode project path.
  * Prefers .xcworkspace over .xcodeproj (CocoaPods projects use workspace).
  * Returns the relative path from root, or empty string if not found.
+ *
+ * A candidate must be a real container — `isXcodeContainer` — and not merely
+ * a directory with the right suffix. `Uwi0/Oakane` ships `iosApp.xcodeproj`
+ * with no `project.pbxproj` beside the `oakane.xcodeproj` that has one, and
+ * this function returned the husk because it was first.
  */
 function findXcodeProjectPath(root) {
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return "";
-    }
-    const workspaces = entries.filter((e) => e.endsWith(".xcworkspace"));
-    const projects = entries.filter((e) => e.endsWith(".xcodeproj"));
+    const containers = xcodeContainersIn(root);
+    const workspaces = containers.filter((e) => e.endsWith(".xcworkspace"));
+    const projects = containers.filter((e) => e.endsWith(".xcodeproj"));
     // Prefer workspace (CocoaPods / multi-package setups use these)
     if (workspaces.length > 0)
         return workspaces[0];
@@ -43,14 +43,7 @@ function findXcodeProjectPath(root) {
  */
 const COMPANION_SCHEME = /(extension|widget|clip|intents?|notification|tvos|macos|watchos|visionos|tests?|screenshots?|staging|prototype|codegen)/i;
 function readSchemeFacts(root, name) {
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return undefined;
-    }
-    for (const entry of entries) {
+    for (const entry of xcodeContainersIn(root)) {
         if (!entry.endsWith(".xcodeproj"))
             continue;
         const path = resolve(root, entry, "xcshareddata", "xcschemes", `${name}.xcscheme`);
@@ -194,13 +187,11 @@ export function rankSchemesWithReason(root, projectPath, schemes) {
  */
 function detectSchemes(root) {
     const schemes = new Set();
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return [];
-    }
+    // Real projects only. The fallback below invents a scheme from the
+    // directory's name, so a husk with no shared schemes contributes a scheme
+    // named after a project that cannot be opened — which is how `Uwi0/Oakane`
+    // got `IOS_SCHEME: iosApp` as well as `IOS_PROJECT_PATH: iosApp.xcodeproj`.
+    const entries = xcodeContainersIn(root);
     for (const entry of entries) {
         if (!entry.endsWith(".xcodeproj"))
             continue;

package/dist/src/commands/ios-scheme-ranking.test.js

@@ -30,6 +30,11 @@ afterEach(() => {
 function scheme(project, name, { runnable, testable, appExtension }) {
     const dir = join(root, `${project}.xcodeproj`, "xcshareddata", "xcschemes");
     mkdirSync(dir, { recursive: true });
+    // A `.xcodeproj` is its `project.pbxproj`; without one Xcode refuses to open
+    // it and the scanners now skip it, so a fixture that omits it is describing
+    // a directory that cannot exist outside a test. Content is irrelevant here —
+    // the scheme XML is what the ranking reads — but it has to be there.
+    writeFileSync(join(root, `${project}.xcodeproj`, "project.pbxproj"), "// !$*UTF8*$!\n");
     writeFileSync(join(dir, `${name}.xcscheme`), `<?xml version="1.0" encoding="UTF-8"?>
 <Scheme LastUpgradeVersion = "1600"${appExtension ? `\n   wasCreatedForAppExtension = "YES"` : ""} version = "1.7">
    <TestAction buildConfiguration = "Debug">

package/dist/src/shared/detect-project.d.ts

@@ -1,5 +1,37 @@
 export type MobileProjectType = "android" | "ios" | "kmm";
 declare function isDirectory(path: string): boolean;
+/**
+ * True when a path that is *named* like an Xcode container actually is one.
+ *
+ * **The** predicate — every question of the form "is this `.xcodeproj` a
+ * project" goes through here, and nothing else in cibuild joins a directory
+ * name to "there is a project there".
+ *
+ * A `.xcodeproj` is a directory whose whole content is `project.pbxproj`;
+ * without it `xcodebuild` refuses to open the project at all — "missing its
+ * project.pbxproj file". A `.xcworkspace` is `contents.xcworkspacedata` in
+ * the same way. Anything else ending in those suffixes is a directory with a
+ * suggestive name, and offering one is offering something Xcode would reject.
+ *
+ * `Uwi0/Oakane` is the row that found it. Its `iosApp/` ships two: a tracked
+ * `iosApp.xcodeproj` holding nothing but `project.xcworkspace/`, and the real
+ * `oakane.xcodeproj` beside it with a 20 217-byte `project.pbxproj`. The husk
+ * carries the name the KMM wizard gives, so the conventional name outranked
+ * the project that exists — and it supplied BOTH `IOS_PROJECT_PATH` and, via
+ * the scheme scan's project-name fallback, `IOS_SCHEME`. The build reached
+ * step 9 and died on "Unable to read project 'iosApp.xcodeproj'".
+ *
+ * This is the iOS twin of the Gradle module scan once treating "a directory
+ * holding a file called build.gradle" as a module: wrong in the same
+ * direction, and fixed the same way — one reader, used by everyone.
+ *
+ * The `.pbxproj` is deliberately NOT parsed. Its existence and non-emptiness
+ * is the whole question; a shared `.xcscheme` remains the oracle for what a
+ * project builds.
+ */
+export declare function isXcodeContainer(path: string): boolean;
+/** The entries of `dir` that are real Xcode containers, in `readdir` order. */
+export declare function xcodeContainersIn(dir: string): string[];
 /**
  * Detects whether the given directory is the root of an Android, iOS, or
  * KMM project. Returns the detected project type, or null if none match.

package/dist/src/shared/detect-project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect-project.d.ts","sourceRoot":"","sources":["../../../src/shared/detect-project.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC;AAoB1D,iBAAS,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM1C;AA+ED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAiC7E;AAED,oEAAoE;AACpE,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"detect-project.d.ts","sourceRoot":"","sources":["../../../src/shared/detect-project.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC;AAoB1D,iBAAS,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM1C;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAYtD;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAYvD;AAuED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CA4B7E;AAED,oEAAoE;AACpE,OAAO,EAAE,WAAW,EAAE,CAAC"}