@mmerterden/dev-toolkit-mcp 2.24.1

package/tools/ios-app-store-audit/rules/binary-size.js

@@ -0,0 +1,70 @@
+/**
+ * binary-size - Validates app bundle size against App Store limits.
+ * Direct port of BinarySizeRule.swift.
+ *
+ * Thresholds:
+ *   error: > 4 GB     - App Store hard limit
+ *   warning: > 500 MB  - pre-thinning, may want App Thinning / ODR
+ *   info: thinned > 200 MB - cellular download warning
+ */
+
+import { directorySize } from "../context.js";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "binary-size";
+export const name = "Binary Size";
+export const description = "Checks .app bundle size against App Store size limits and thresholds";
+
+const HARD_LIMIT_BYTES = 4 * 1024 * 1024 * 1024;
+const CELLULAR_LIMIT_BYTES = 200 * 1024 * 1024;
+const THINNING_RATIO = 0.65;
+const DEFAULT_WARNING_THRESHOLD_MB = 500;
+
+/**
+ * @param {object} ctx - ArchiveContext from context.js
+ * @param {object} [opts]
+ * @param {number} [opts.warningThresholdMB=500]
+ * @returns {Array<object>} violations
+ */
+export function check(ctx, opts = {}) {
+  const warningThresholdBytes = (opts.warningThresholdMB ?? DEFAULT_WARNING_THRESHOLD_MB) * 1024 * 1024;
+  const violations = [];
+
+  const appSize = directorySize(ctx.appPath);
+  const appSizeMB = appSize / (1024 * 1024);
+  const appSizeFormatted = appSizeMB.toFixed(1);
+
+  const estimatedThinned = appSize * THINNING_RATIO;
+  const estimatedThinnedMB = estimatedThinned / (1024 * 1024);
+  const estimatedThinnedFormatted = estimatedThinnedMB.toFixed(0);
+
+  if (appSize > HARD_LIMIT_BYTES) {
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.ERROR,
+      message: `App bundle size (${appSizeFormatted} MB) exceeds App Store limit of 4 GB`,
+      file: ctx.appPath,
+      suggestion: "Reduce binary size by removing unused assets or using On-Demand Resources",
+    }));
+  } else if (appSize > warningThresholdBytes) {
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.WARNING,
+      message: `App bundle size is ${appSizeFormatted} MB (estimated ~${estimatedThinnedFormatted} MB after thinning)`,
+      file: ctx.appPath,
+      suggestion: "Consider App Thinning, On-Demand Resources, or removing unused assets",
+    }));
+  }
+
+  if (estimatedThinned > CELLULAR_LIMIT_BYTES) {
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.INFO,
+      message: `Estimated download size ~${estimatedThinnedFormatted} MB - may trigger cellular download warning (limit: 200 MB)`,
+      file: ctx.appPath,
+      suggestion: "Users on cellular will see a confirmation prompt before downloading",
+    }));
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/code-signing.js

@@ -0,0 +1,95 @@
+/**
+ * code-signing - Validates the archive's signing posture for App Store
+ * submission. Direct port of CodeSigningRule.swift.
+ *
+ * ITMS error codes: 90035, 90034, 90046, 90717, 91065
+ *
+ * Checks:
+ *   1. get-task-allow MUST be false (debug=true → ITMS-90046 reject)
+ *   2. aps-environment MUST be 'production' if present
+ *   3. beta-reports-active warning (TestFlight residue)
+ *   4. application-identifier well-formed (TEAMID.bundle.id)
+ *   5. Main executable passes `codesign --verify --deep --strict`
+ */
+
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "code-signing";
+export const name = "Code Signing";
+export const description = "Checks entitlements, provisioning, and signing for App Store compliance";
+
+function isCodeSigned(executablePath) {
+  try {
+    execSync(`/usr/bin/codesign --verify --deep --strict "${executablePath}"`, {
+      stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function check(ctx) {
+  const violations = [];
+  const ent = ctx.entitlements;
+
+  if (!ent) {
+    violations.push(makeViolation({
+      ruleID: id, guidelineRef: "ITMS-90034", severity: Severity.ERROR,
+      message: "No entitlements found - binary may not be properly signed",
+      suggestion: "Ensure the archive is signed with a valid distribution certificate",
+    }));
+  } else {
+    // get-task-allow must be false for release
+    if (ent["get-task-allow"] === true) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90046", severity: Severity.ERROR,
+        message: "get-task-allow is true - this is a debug build, not valid for App Store",
+        suggestion: "Archive with Release configuration and Apple Distribution certificate",
+      }));
+    }
+
+    // Push notification environment
+    if (ent["aps-environment"] === "development") {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90717", severity: Severity.ERROR,
+        message: "Push notification environment is 'development' instead of 'production'",
+        suggestion: "Use App Store provisioning profile with production push entitlement",
+      }));
+    }
+
+    // beta-reports-active = TestFlight residue
+    if (ent["beta-reports-active"] != null) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90046", severity: Severity.WARNING,
+        message: "beta-reports-active entitlement found - may indicate TestFlight build",
+        suggestion: "Verify this is intended for App Store submission",
+      }));
+    }
+
+    // application-identifier shape: TEAMID.bundle.id (must contain at least one ".")
+    const appID = ent["application-identifier"];
+    if (typeof appID === "string" && !appID.includes(".")) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90034", severity: Severity.ERROR,
+        message: `Invalid application-identifier format: ${appID}`,
+        suggestion: "Format should be TEAMID.com.company.app",
+      }));
+    }
+  }
+
+  // Verify main binary signature
+  if (ctx.executablePath && existsSync(ctx.executablePath)) {
+    if (!isCodeSigned(ctx.executablePath)) {
+      violations.push(makeViolation({
+        ruleID: id, guidelineRef: "ITMS-90035", severity: Severity.ERROR,
+        message: "Main executable failed code signature verification",
+        suggestion: "Re-archive with a valid Apple Distribution certificate",
+      }));
+    }
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/dead-reference.js

@@ -0,0 +1,131 @@
+/**
+ * dead-reference - Detects potentially orphaned image / nib resources at the
+ * .app root that the binary's printable strings never reference.
+ * Direct port of DeadReferenceRule.swift.
+ *
+ * The check is intentionally conservative - false positives are possible
+ * (resource loaded via dynamically-built name, runtime localization, etc.).
+ * Severity is .warning (images) / .info (empty nibs); never .error.
+ */
+
+import { execSync } from "child_process";
+import { existsSync, readdirSync, statSync } from "fs";
+import { join, extname, parse as parsePath } from "path";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "dead-reference";
+export const name = "Dead Reference Detection";
+export const description = "Finds potentially unused resources (images, JSON, nibs) in the app bundle";
+
+const CHECKABLE_EXTENSIONS = new Set(["png", "jpg", "jpeg", "gif", "pdf", "svg"]);
+
+const SYSTEM_PREFIXES = [
+  "AppIcon", "LaunchImage", "Default",
+  "Assets.car", "Info.plist", "PkgInfo",
+  "embedded.mobileprovision", "PrivacyInfo",
+  "CodeResources", "ResourceRules",
+];
+
+/** Return all printable strings in a binary as a Set. */
+function binaryStrings(executablePath) {
+  try {
+    const out = execSync(`/usr/bin/strings "${executablePath}"`, {
+      encoding: "utf-8",
+      maxBuffer: 256 * 1024 * 1024,
+    });
+    return new Set(out.split("\n").filter((s) => s.length > 0));
+  } catch {
+    return new Set();
+  }
+}
+
+export function check(ctx) {
+  const violations = [];
+  if (!ctx.executablePath || !existsSync(ctx.executablePath)) return violations;
+
+  // Skip > 500 MB binaries (string scan would dominate audit runtime).
+  let execStat;
+  try {
+    execStat = statSync(ctx.executablePath);
+  } catch {
+    return violations;
+  }
+  if (execStat.size > 500 * 1024 * 1024) return violations;
+
+  const strings = binaryStrings(ctx.executablePath);
+
+  // Enumerate root-level files in the .app
+  let entries = [];
+  try {
+    entries = readdirSync(ctx.appPath);
+  } catch {
+    return violations;
+  }
+
+  // Unreferenced images
+  const unreferenced = [];
+  for (const file of entries) {
+    const ext = extname(file).slice(1).toLowerCase();
+    if (!CHECKABLE_EXTENSIONS.has(ext)) continue;
+    const name = parsePath(file).name;
+    if (SYSTEM_PREFIXES.some((p) => name.startsWith(p))) continue;
+    const stripped = name
+      .replace("@3x", "")
+      .replace("@2x", "")
+      .replace("~ipad", "")
+      .replace("~iphone", "");
+    if (!strings.has(stripped) && !strings.has(name) && !strings.has(file)) {
+      unreferenced.push(file);
+    }
+  }
+
+  // Dead nib files / empty storyboardc directories
+  const deadNibs = [];
+  for (const file of entries) {
+    const ext = extname(file).slice(1).toLowerCase();
+    const full = join(ctx.appPath, file);
+    if (ext === "nib") {
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isFile() && st.size < 100) deadNibs.push(file);
+    } else if (ext === "storyboardc") {
+      let nested = [];
+      try {
+        nested = readdirSync(full);
+      } catch {
+        continue;
+      }
+      const hasNib = nested.some((n) => extname(n).slice(1).toLowerCase() === "nib");
+      if (!hasNib) deadNibs.push(file);
+    }
+  }
+
+  if (unreferenced.length > 0) {
+    const sample = unreferenced.slice(0, 10).join(", ");
+    const extra = unreferenced.length > 10 ? ` and ${unreferenced.length - 10} more` : "";
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.WARNING,
+      message: `${unreferenced.length} potentially unreferenced image(s): ${sample}${extra}`,
+      file: ctx.appPath,
+      suggestion: "Verify these images are used. Remove unused assets to reduce app size",
+    }));
+  }
+
+  if (deadNibs.length > 0) {
+    const sample = deadNibs.slice(0, 5).join(", ");
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.INFO,
+      message: `${deadNibs.length} empty/tiny nib file(s): ${sample}`,
+      file: ctx.appPath,
+      suggestion: "These may be dead storyboard references - verify they're still needed",
+    }));
+  }
+
+  return violations;
+}

package/tools/ios-app-store-audit/rules/debug-tool-leak.js

@@ -0,0 +1,185 @@
+/**
+ * debug-tool-leak - Detects 40+ known debug/development tools (Netfox, FLEX,
+ * CocoaDebug, Wormholy, DoraemonKit, Lookin, Reveal, Pulse, Hyperion, etc.)
+ * plus 30+ generic patterns for unknown tools that have leaked into a
+ * release archive.
+ * Direct port of DebugToolLeakRule.swift.
+ *
+ * Apple Guidelines: 2.5.1 (Software Requirements), 2.5.2 (Self-Contained).
+ *
+ * 5 detection strategies:
+ *   1. Embedded framework name match
+ *   2. Binary symbol scan (strings | grep -E)
+ *   3. Info.plist URL scheme
+ *   4. NSAllowsLocalNetworking flag (often a debug-tool tell)
+ *   5. Generic name-pattern catch-all
+ */
+
+import { execSync } from "child_process";
+import { existsSync, readFileSync, statSync } from "fs";
+import { dirname, basename, join } from "path";
+import { fileURLToPath } from "url";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "debug-tool-leak";
+export const name = "Debug Tool Leak Detection";
+export const description = "Detects debug/development tools (Netfox, FLEX, CocoaDebug, etc.) that should not ship in App Store builds";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const BLOCKLIST_PATH = join(__dirname, "../data/debug-tools-blocklist.json");
+
+let BLOCKLIST = null;
+function loadBlocklist() {
+  if (BLOCKLIST !== null) return BLOCKLIST;
+  try {
+    BLOCKLIST = JSON.parse(readFileSync(BLOCKLIST_PATH, "utf-8"));
+  } catch {
+    BLOCKLIST = { frameworks: [], symbols: [], urlSchemes: [], genericPatterns: [] };
+  }
+  return BLOCKLIST;
+}
+
+function escapeForGrep(p) {
+  return p.replace(/\(/g, "\\(").replace(/\)/g, "\\)").replace(/\./g, "\\.");
+}
+
+function runStringsGrep(executablePath, patterns) {
+  if (patterns.length === 0) return "";
+  const grepPattern = patterns.map(escapeForGrep).join("|");
+  try {
+    return execSync(
+      `/usr/bin/strings "${executablePath}" | grep -E '${grepPattern}' 2>/dev/null | head -200`,
+      { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }
+    );
+  } catch {
+    return "";
+  }
+}
+
+function checkEmbeddedFrameworks(ctx, detected, list) {
+  const violations = [];
+  for (const fwPath of ctx.embeddedFrameworks ?? []) {
+    const fwName = basename(fwPath).replace(/\.framework$/, "").replace(/\.xcframework$/, "");
+    for (const fw of list.frameworks) {
+      if (!fwName.toLowerCase().includes(fw.name.toLowerCase())) continue;
+      if (detected.has(fw.tool)) continue;
+      detected.add(fw.tool);
+      violations.push(makeViolation({
+        ruleID: id,
+        guidelineRef: "2.5.1",
+        severity: fw.category.includes("Logger") ? Severity.WARNING : Severity.ERROR,
+        message: `Debug tool '${fw.tool}' (${fw.category}) is embedded in the archive`,
+        file: fwPath,
+        suggestion: `Remove ${fw.tool} from the Release build configuration. Use #if DEBUG to conditionally include debug tools`,
+      }));
+    }
+  }
+  return violations;
+}
+
+function checkBinarySymbols(ctx, detected, list) {
+  const violations = [];
+  if (!ctx.executablePath || !existsSync(ctx.executablePath)) return violations;
+  let st;
+  try {
+    st = statSync(ctx.executablePath);
+  } catch {
+    return violations;
+  }
+  if (st.size > 500 * 1024 * 1024) return violations;
+
+  const output = runStringsGrep(ctx.executablePath, list.symbols.map((s) => s.symbol));
+  for (const sym of list.symbols) {
+    if (output.includes(sym.symbol) && !detected.has(sym.tool)) {
+      detected.add(sym.tool);
+      violations.push(makeViolation({
+        ruleID: id,
+        guidelineRef: "2.5.1",
+        severity: Severity.ERROR,
+        message: `Debug tool '${sym.tool}' symbols found in binary (detected: ${sym.symbol})`,
+        suggestion: `Ensure ${sym.tool} is excluded from Release builds. Check build phases and #if DEBUG guards`,
+      }));
+    }
+  }
+  return violations;
+}
+
+function checkURLSchemes(ctx, detected, list) {
+  const violations = [];
+  const urlTypes = ctx.infoPlist?.CFBundleURLTypes;
+  if (!Array.isArray(urlTypes)) return violations;
+  const registered = urlTypes.flatMap((t) =>
+    Array.isArray(t?.CFBundleURLSchemes) ? t.CFBundleURLSchemes : []
+  );
+  for (const debug of list.urlSchemes) {
+    const match = registered.some(
+      (s) => typeof s === "string" && s.toLowerCase() === debug.scheme.toLowerCase()
+    );
+    if (!match || detected.has(debug.tool)) continue;
+    detected.add(debug.tool);
+    violations.push(makeViolation({
+      ruleID: id,
+      guidelineRef: "2.5.1",
+      severity: Severity.ERROR,
+      message: `Debug URL scheme '${debug.scheme}://' registered for ${debug.tool}`,
+      file: "Info.plist",
+      suggestion: `Remove the '${debug.scheme}' URL scheme from CFBundleURLTypes in Release builds`,
+    }));
+  }
+  return violations;
+}
+
+function checkDebugFlags(ctx) {
+  const violations = [];
+  const ats = ctx.infoPlist?.NSAppTransportSecurity;
+  if (ats?.NSAllowsLocalNetworking === true) {
+    violations.push(makeViolation({
+      ruleID: id,
+      guidelineRef: "2.5.1",
+      severity: Severity.INFO,
+      message: "NSAllowsLocalNetworking is enabled - commonly used by debug network tools",
+      file: "Info.plist",
+      suggestion: "Verify this is required for your app's functionality, not just for debug tools",
+    }));
+  }
+  return violations;
+}
+
+function checkGenericPatterns(ctx, detected, list) {
+  const violations = [];
+  if (!ctx.executablePath || !existsSync(ctx.executablePath)) return violations;
+  let st;
+  try {
+    st = statSync(ctx.executablePath);
+  } catch {
+    return violations;
+  }
+  if (st.size > 500 * 1024 * 1024) return violations;
+
+  const output = runStringsGrep(ctx.executablePath, list.genericPatterns.map((p) => p.pattern));
+  for (const p of list.genericPatterns) {
+    if (output.includes(p.pattern) && !detected.has(p.category)) {
+      detected.add(p.category);
+      violations.push(makeViolation({
+        ruleID: id,
+        guidelineRef: "2.5.1",
+        severity: Severity.WARNING,
+        message: `Potential debug tool pattern detected: ${p.category} (matched: '${p.pattern}')`,
+        suggestion: "Verify this is not a debug/development tool. If it is, exclude from Release builds with #if DEBUG",
+      }));
+    }
+  }
+  return violations;
+}
+
+export function check(ctx) {
+  const list = loadBlocklist();
+  const detected = new Set();
+  return [
+    ...checkEmbeddedFrameworks(ctx, detected, list),
+    ...checkBinarySymbols(ctx, detected, list),
+    ...checkURLSchemes(ctx, detected, list),
+    ...checkDebugFlags(ctx),
+    ...checkGenericPatterns(ctx, detected, list),
+  ];
+}

package/tools/ios-app-store-audit/rules/duplicate-resource.js

@@ -0,0 +1,130 @@
+/**
+ * duplicate-resource - Detects duplicate resource files across the .app and
+ * embedded frameworks/extensions. Direct port of DuplicateResourceRule.swift.
+ *
+ * Why it matters: duplicates inflate download size and can lead to
+ * unpredictable runtime behaviour (which copy wins?).
+ */
+
+import { existsSync, readdirSync, statSync } from "fs";
+import { join, basename, extname } from "path";
+import { Severity, makeViolation } from "../models.js";
+
+export const id = "duplicate-resource";
+export const name = "Duplicate Resource Detection";
+export const description = "Finds duplicate files across app bundle and embedded frameworks";
+
+const RESOURCE_EXTENSIONS = new Set([
+  "json", "plist", "png", "jpg", "jpeg", "gif", "pdf", "svg",
+  "strings", "stringsdict", "storyboardc", "nib", "xib",
+  "car", "ttf", "otf", "wav", "mp3", "mp4", "m4a",
+  "js", "html", "css", "xml", "csv", "txt", "dat",
+  "mlmodel", "mlmodelc", "xcmappingmodel",
+  "mom", "momd", "sqlite",
+]);
+
+/** Walk a directory tree, yielding relative paths to every regular file. */
+function* walk(root, prefix = "") {
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const full = join(root, e);
+    const rel = prefix ? `${prefix}/${e}` : e;
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      yield* walk(full, rel);
+    } else if (st.isFile()) {
+      yield { rel, full, size: st.size };
+    }
+  }
+}
+
+function locationFor(relativePath) {
+  if (relativePath.startsWith("Frameworks/")) {
+    const parts = relativePath.split("/");
+    return parts.length >= 2 ? parts[1] : "Frameworks";
+  }
+  if (relativePath.startsWith("PlugIns/")) {
+    const parts = relativePath.split("/");
+    return parts.length >= 2 ? parts[1] : "PlugIns";
+  }
+  return "App Bundle";
+}
+
+export function check(ctx) {
+  const violations = [];
+  if (!ctx.appPath || !existsSync(ctx.appPath)) return violations;
+
+  // filename → { locations: Set<string>, size: number (any one copy) }
+  const fileMap = new Map();
+
+  for (const { rel, size } of walk(ctx.appPath)) {
+    // Skip compiled asset catalog internals
+    if (rel.includes(".car/")) continue;
+    const file = basename(rel);
+    const ext = extname(file).slice(1).toLowerCase();
+    if (!RESOURCE_EXTENSIONS.has(ext)) continue;
+
+    const loc = locationFor(rel);
+    if (!fileMap.has(file)) fileMap.set(file, { locations: new Set([loc]), size });
+    else {
+      const entry = fileMap.get(file);
+      entry.locations.add(loc);
+      // Keep largest size as worst-case waste estimate.
+      if (size > entry.size) entry.size = size;
+    }
+  }
+
+  const duplicates = [...fileMap.entries()]
+    .filter(([, entry]) => entry.locations.size > 1)
+    .sort(([, a], [, b]) => b.locations.size - a.locations.size);
+
+  if (duplicates.length === 0) return violations;
+
+  // Report the top 10 individually.
+  for (const [filename, entry] of duplicates.slice(0, 10)) {
+    const locs = [...entry.locations];
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.WARNING,
+      message: `'${filename}' found in ${locs.length} locations: ${locs.join(", ")}`,
+      file: ctx.appPath,
+      suggestion: "Remove duplicate or ensure only one copy is bundled",
+    }));
+  }
+
+  if (duplicates.length > 10) {
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.INFO,
+      message: `${duplicates.length - 10} more duplicate resources found`,
+      suggestion: "Run with the --format=json output to see the full list",
+    }));
+  }
+
+  // Estimated wasted bytes: (copies - 1) * size, summed across all dup files.
+  let wasted = 0;
+  for (const [, entry] of duplicates) {
+    wasted += (entry.locations.size - 1) * entry.size;
+  }
+  if (wasted > 0) {
+    const wastedMB = (wasted / (1024 * 1024)).toFixed(1);
+    violations.push(makeViolation({
+      ruleID: id,
+      severity: Severity.INFO,
+      message: `Total ${duplicates.length} duplicate resources - estimated ~${wastedMB} MB wasted`,
+      file: ctx.appPath,
+    }));
+  }
+
+  return violations;
+}