catalyst-core 0.3.0-beta.5 → 0.3.0-canary.2

package/dist/native/androidProject/app/src/test/java/io/yourname/androidproject/security/FridaDetectorTest.kt

@@ -0,0 +1,193 @@
+package io.yourname.androidproject.security
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+import java.net.InetSocketAddress
+import java.net.ServerSocket
+
+/**
+ * Unit tests for FridaDetector (Android coverage batch 3), previously
+ * entirely untested (0/~96 lines).
+ *
+ * FridaDetector is a pure-JVM `object` for its core isFridaDetected() path
+ * -- java.io.File existence checks, a real SocketChannel connect against
+ * Frida's default ports, /proc/self/maps line scanning, and
+ * Class.forName() lookups. None of that needs Context or a View, so this
+ * suite exercises it directly with no Mockito mocking of Android types at
+ * all:
+ *
+ * - checkFridaPorts: verified empirically (see task history) that binding
+ *   a real java.net.ServerSocket on 127.0.0.1:27042 makes
+ *   isFridaDetected() return true via the real non-blocking
+ *   SocketChannel.connect()/finishConnect() loop; no listener there means
+ *   the connect fails/times out and the check contributes false. This is
+ *   more reliable than trying to mock java.nio.channels.SocketChannel
+ *   (a concrete JDK class, not a mockable Android stub).
+ * - checkFridaFiles / checkHookingFrameworks' XposedBridge.jar file check:
+ *   these check hardcoded absolute paths (e.g. /data/local/tmp/
+ *   frida-server, /system/framework/XposedBridge.jar) that do not exist on
+ *   a dev/CI JVM test runner, so they deterministically contribute false
+ *   here. This suite does not attempt to fake those paths into existing
+ *   (would require filesystem root manipulation out of scope for a unit
+ *   test) -- the false branch is exercised implicitly by every test that
+ *   doesn't plant a listening socket.
+ * - checkLoadedLibraries reads the real /proc/self/maps, which does not
+ *   exist on macOS (only Linux) -- mapsFile.exists() is false there, so
+ *   this check deterministically contributes false regardless of
+ *   platform. On a Linux CI runner it would read the actual test JVM's
+ *   real maps, which won't contain Frida/Xposed library names in a normal
+ *   run either. Not independently forced true in this suite (would
+ *   require a fake /proc/self/maps, not feasible without a mockable JDK
+ *   File).
+ * - checkHookingFrameworks' Class.forName() checks (XposedBridge,
+ *   substrate.MS) genuinely throw ClassNotFoundException on the plain JVM
+ *   test classpath, exercising their catch-and-return-false branches for
+ *   real -- no mocking needed.
+ *
+ * Deliberately OUT OF SCOPE: getFridaCheckDetails() as a whole. It builds
+ * its return value as a single `mapOf(...)` literal, so the "isDebuggable"
+ * entry's Build.FINGERPRINT/Build.TAGS access (static final fields under
+ * the mockable android.jar, NOT interceptable by Mockito) is evaluated
+ * eagerly and unconditionally -- confirmed empirically to throw an
+ * uncaught NullPointerException before the function can even return.
+ * There is no reachable subset of that function's behavior to test
+ * without touching those two fields, so it is skipped entirely (see the
+ * dedicated comment above its section for detail) rather than chased for
+ * partial coverage.
+ */
+class FridaDetectorTest {
+
+    // ============================================================
+    // isFridaDetected -- no hooking indicators present (baseline)
+    // ============================================================
+
+    @Test
+    fun `isFridaDetected returns false in a clean test environment with no listener and no suspicious files`() {
+        // Unlike the positive tests below (which need a specific port
+        // bound and should fail loudly if that's not possible), this
+        // negative assertion's only real dependency is that NOTHING is
+        // listening on Frida's ports right now -- if something is (even,
+        // ironically, a real frida-server on the host), that's an
+        // environment fact this test can't control, so skip rather than
+        // fail. checkPortFree(...) reports that state without binding
+        // anything itself, avoiding a bind-vs-connect race with the
+        // detector's own check.
+        org.junit.Assume.assumeTrue(
+            "Something is already listening on port 27042 or 27043 in this environment — skipping",
+            checkPortFree(27042) && checkPortFree(27043)
+        )
+        assertFalse(FridaDetector.isFridaDetected())
+    }
+
+    // ============================================================
+    // isFridaDetected -- Frida port check forced positive
+    // ============================================================
+
+    @Test
+    fun `isFridaDetected returns true when a listener is bound on Frida's default port 27042`() {
+        val server = bindOrFailLoudly(27042)
+        try {
+            assertTrue(FridaDetector.isFridaDetected())
+        } finally {
+            server.close()
+        }
+    }
+
+    @Test
+    fun `isFridaDetected returns true when a listener is bound on Frida's alternate port 27043`() {
+        val server = bindOrFailLoudly(27043)
+        try {
+            assertTrue(FridaDetector.isFridaDetected())
+        } finally {
+            server.close()
+        }
+    }
+
+    // ============================================================
+    // checkFridaFiles indirectly, via isFridaDetected -- files absent
+    // ============================================================
+
+    @Test
+    fun `isFridaDetected does not false-positive on unrelated existing files`() {
+        // Sanity check that checkFridaFiles is checking specific hardcoded
+        // paths, not "any file exists somewhere" -- a real file existing
+        // elsewhere on disk must not trip detection.
+        val unrelated = File.createTempFile("not-frida", ".tmp")
+        try {
+            assertFalse(FridaDetector.isFridaDetected())
+        } finally {
+            unrelated.delete()
+        }
+    }
+
+    // ============================================================
+    // getFridaCheckDetails -- NOT tested, entirely out of scope.
+    //
+    // Empirically confirmed (java.lang.NullPointerException at the
+    // Build.FINGERPRINT.lowercase() call): the function builds its
+    // return value as a single Kotlin `mapOf(...)` literal, which
+    // eagerly evaluates every entry -- including the "isDebuggable"
+    // entry's inline `Build.FINGERPRINT.lowercase().contains(...) ||
+    // Build.TAGS.lowercase().contains(...)` expression -- before the
+    // map is ever constructed. Build.FINGERPRINT/Build.TAGS are null
+    // under the mockable android.jar (isReturnDefaultValues=true), so
+    // calling getFridaCheckDetails() at all throws uncaught, with no
+    // try/catch anywhere in the function to absorb it. Unlike
+    // EmulatorDetector.getEmulatorCheckDetails or FridaDetector's own
+    // isFridaDetected() (which wraps checks in try/catch and degrades to
+    // false), there is no reachable code path here that avoids touching
+    // those two fields. Per the task's Build.* limitation, this function
+    // is skipped entirely rather than partially asserted on.
+    // ============================================================
+    // helpers
+    // ============================================================
+
+    /**
+     * Binds a real listening socket on the given loopback port. Frida's
+     * default ports (27042/27043) are vanishingly unlikely to already be
+     * occupied on a dev/CI machine, but fail loudly with a clear message
+     * rather than producing a mystery assertion failure if they are.
+     *
+     * Named to reflect what it actually does (previously `bindOrSkip`,
+     * which never skipped anything -- CodeRabbit flagged the mismatch).
+     * These positive-detection tests intentionally do NOT tolerate a
+     * bind failure the way the negative test above does: if the port is
+     * already occupied, that's worth knowing loudly rather than quietly
+     * skipping a test meant to prove isFridaDetected() actually detects
+     * something.
+     */
+    private fun bindOrFailLoudly(port: Int): ServerSocket {
+        return try {
+            ServerSocket().apply {
+                reuseAddress = true
+                bind(InetSocketAddress("127.0.0.1", port))
+            }
+        } catch (e: Exception) {
+            throw IllegalStateException(
+                "Could not bind port $port for FridaDetector test -- is something " +
+                    "already listening on it (ironically, maybe even a real frida-server)?",
+                e
+            )
+        }
+    }
+
+    /**
+     * Reports whether a loopback port currently has nothing listening on
+     * it, without holding a bind itself (so it can't race the detector's
+     * own connect attempt in isFridaDetected()). Used only to decide
+     * whether the clean-environment negative test should run at all.
+     */
+    private fun checkPortFree(port: Int): Boolean {
+        return try {
+            ServerSocket().use {
+                it.reuseAddress = true
+                it.bind(InetSocketAddress("127.0.0.1", port))
+            }
+            true
+        } catch (e: Exception) {
+            false
+        }
+    }
+}

package/dist/native/androidProject/app/src/test/java/io/yourname/androidproject/security/SecurityCheckManagerTest.kt

@@ -0,0 +1,260 @@
+package io.yourname.androidproject.security
+
+import android.content.Context
+import android.content.SharedPreferences
+import kotlinx.coroutines.test.runTest
+import org.json.JSONObject
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.mockito.kotlin.any
+import org.mockito.kotlin.doAnswer
+import org.mockito.kotlin.doReturn
+import org.mockito.kotlin.mock
+import java.io.ByteArrayInputStream
+import java.net.InetSocketAddress
+import java.net.ServerSocket
+
+/**
+ * Unit tests for SecurityCheckManager (Android coverage batch 3),
+ * previously entirely untested (0/~67 lines).
+ *
+ * SecurityCheckManager is an `object` that only needs a Context (for
+ * `RootBeer(context)` and `context.getSharedPreferences(...)`) -- no
+ * Views. It orchestrates EmulatorDetector / FridaDetector / RootBeer via
+ * coroutines (Dispatchers.Default, real -- not Dispatchers.Main, so
+ * kotlinx-coroutines-test's virtual-time scheduler does not intercept it;
+ * runTest{} is used only to satisfy the `suspend` signature, matching this
+ * project's established pattern for suspend functions under test, e.g.
+ * WebCacheManagerTest).
+ *
+ * Key empirically-verified facts this suite relies on (see task history):
+ * - `RootBeer(context).isRooted` throws an uncaught NullPointerException
+ *   against a plain Mockito Context mock (PackageManager is null under
+ *   the mockable jar) -- but checkRooted() wraps the call in try/catch,
+ *   so in every test here isRooted resolves to false. This suite does NOT
+ *   attempt to force isRooted=true: RootBeer is constructed directly
+ *   inside checkRooted() (not injected), and RootBeer is a real
+ *   non-Android library class with no Context-driven seam to intercept
+ *   its result -- forcing a rooted result would require Mockito's
+ *   inline mockConstruction, which is unverified to fire reliably across
+ *   the coroutine worker thread checkRooted() actually runs on
+ *   (Dispatchers.Default), so it is deliberately not attempted.
+ * - EmulatorDetector.isEmulator(mockContext) returns false cleanly (its
+ *   own outer try/catch absorbs the Build.FINGERPRINT-driven NPE path;
+ *   see FridaDetectorTest and EmulatorDetector's own known Build.* limits)
+ *   -- so isEmulator is always false in this suite. Forcing it true would
+ *   require mocking Build.* static final fields, which Mockito cannot do
+ *   (see project-wide rule).
+ * - FridaDetector.isFridaDetected() CAN be deterministically forced true
+ *   by binding a real listening socket on Frida's default port 127.0.0.1:
+ *   27042 (see FridaDetectorTest) -- this is therefore the only one of
+ *   the three local checks this suite drives to the BLOCK-triggering
+ *   branch, and it is enough to exercise isCompromised=true /
+ *   recommendation="BLOCK" end-to-end through performSecurityChecks
+ *   without touching Build.* or RootBeer at all.
+ *
+ * Covered: performSecurityChecks' ALLOW path (nothing detected) and BLOCK
+ * path (via the Frida-socket trick), its JSONObject field shape,
+ * saveLatestResults/getLatestSecurityResults round-trip through a mocked
+ * SharedPreferences, calculateRecommendation's branches (exercised
+ * indirectly through performSecurityChecks, since it's private), and
+ * getSecurityMode's present/default/malformed-config branches via a mocked
+ * AssetManager.
+ *
+ * Deliberately OUT OF SCOPE: createErrorResponse() is only reachable when
+ * the try block in performSecurityChecks throws -- every checked call
+ * inside it (checkRooted/checkEmulator/checkFridaDetected) has its own
+ * internal try/catch that swallows exceptions and returns false, and
+ * saveLatestResults also catches internally, so there is no reachable
+ * failure path to trigger it from the public API surface without
+ * reflection or bytecode manipulation. Not attempted. All of the
+ * commented-out Play Integrity code (getGoogleToken,
+ * performPlayIntegrityCheck, cachePlayIntegrityResult, etc.) is inactive
+ * source (commented out) and not compiled, so there is nothing to test.
+ */
+class SecurityCheckManagerTest {
+
+    private lateinit var prefsStorage: MutableMap<String, String?>
+    private lateinit var sharedPreferences: SharedPreferences
+    private lateinit var editor: SharedPreferences.Editor
+    private lateinit var context: Context
+
+    @Before
+    fun setUp() {
+        prefsStorage = mutableMapOf()
+
+        editor = mock {
+            on { putString(any(), any()) } doAnswer { invocation ->
+                val key = invocation.getArgument<String>(0)
+                val value = invocation.getArgument<String?>(1)
+                prefsStorage[key] = value
+                editor
+            }
+        }
+        // apply() is Unit-returning; default mock behavior (no-op) is fine,
+        // but we still want the stored value visible without invoking a
+        // real Android disk write.
+        org.mockito.kotlin.doNothing().`when`(editor).apply()
+
+        sharedPreferences = mock {
+            on { getString(any(), org.mockito.kotlin.anyOrNull()) } doAnswer { invocation ->
+                val key = invocation.getArgument<String>(0)
+                val default = invocation.getArgument<String?>(1)
+                prefsStorage[key] ?: default
+            }
+            on { edit() } doReturn editor
+        }
+
+        context = mock {
+            on { getSharedPreferences(any(), any()) } doReturn sharedPreferences
+        }
+    }
+
+    @After
+    fun tearDown() {
+        prefsStorage.clear()
+    }
+
+    // ============================================================
+    // performSecurityChecks -- ALLOW path (clean environment)
+    // ============================================================
+
+    @Test
+    fun `performSecurityChecks returns ALLOW and not compromised when no local threat is detected`() = runTest {
+        val results = SecurityCheckManager.performSecurityChecks(context)
+
+        assertFalse(results.getBoolean("isRooted"))
+        assertFalse(results.getBoolean("isEmulator"))
+        assertFalse(results.getBoolean("isFridaDetected"))
+        assertFalse(results.getBoolean("isCompromised"))
+        assertEquals("ALLOW", results.getString("recommendation"))
+        assertFalse(results.getBoolean("pending"))
+        assertTrue(results.has("timestamp"))
+    }
+
+    @Test
+    fun `performSecurityChecks does not include a playIntegrity entry while Play Integrity is disabled`() {
+        runTest {
+            val results = SecurityCheckManager.performSecurityChecks(context)
+            assertFalse(results.has("playIntegrity"))
+        }
+    }
+
+    @Test
+    fun `performSecurityChecks persists the latest results to SharedPreferences`() = runTest {
+        SecurityCheckManager.performSecurityChecks(context)
+
+        val saved = prefsStorage["latest_security_results"]
+        assertTrue(saved != null)
+        val savedJson = JSONObject(saved!!)
+        assertEquals("ALLOW", savedJson.getString("recommendation"))
+    }
+
+    // ============================================================
+    // performSecurityChecks -- BLOCK path (Frida socket trick)
+    // ============================================================
+
+    @Test
+    fun `performSecurityChecks returns BLOCK and compromised when Frida is detected`() = runTest {
+        val server = bindOrSkip(27042)
+        try {
+            val results = SecurityCheckManager.performSecurityChecks(context)
+
+            assertTrue(results.getBoolean("isFridaDetected"))
+            assertTrue(results.getBoolean("isCompromised"))
+            assertEquals("BLOCK", results.getString("recommendation"))
+        } finally {
+            server.close()
+        }
+    }
+
+    // ============================================================
+    // getLatestSecurityResults
+    // ============================================================
+
+    @Test
+    fun `getLatestSecurityResults returns null when nothing has been saved yet`() {
+        assertNull(SecurityCheckManager.getLatestSecurityResults(context))
+    }
+
+    @Test
+    fun `getLatestSecurityResults returns the previously saved results`() = runTest {
+        SecurityCheckManager.performSecurityChecks(context)
+
+        val latest = SecurityCheckManager.getLatestSecurityResults(context)
+        assertTrue(latest != null)
+        assertEquals("ALLOW", latest!!.getString("recommendation"))
+    }
+
+    @Test
+    fun `getLatestSecurityResults returns null when SharedPreferences access throws`() {
+        val throwingContext: Context = mock {
+            on { getSharedPreferences(any(), any()) } doAnswer { throw RuntimeException("boom") }
+        }
+
+        assertNull(SecurityCheckManager.getLatestSecurityResults(throwingContext))
+    }
+
+    // ============================================================
+    // getSecurityMode
+    // ============================================================
+
+    @Test
+    fun `getSecurityMode returns the configured value when present`() {
+        val propsContext = contextWithProperties("android.security.mode=strict\n")
+
+        assertEquals("strict", SecurityCheckManager.getSecurityMode(propsContext))
+    }
+
+    @Test
+    fun `getSecurityMode defaults to 'default' when the key is absent`() {
+        val propsContext = contextWithProperties("some.other.key=value\n")
+
+        assertEquals("default", SecurityCheckManager.getSecurityMode(propsContext))
+    }
+
+    @Test
+    fun `getSecurityMode defaults to 'default' when reading the properties file throws`() {
+        val throwingAssets: android.content.res.AssetManager = mock {
+            on { open(any()) } doAnswer { throw java.io.IOException("no such asset") }
+        }
+        val propsContext: Context = mock {
+            on { getAssets() } doReturn throwingAssets
+        }
+
+        assertEquals("default", SecurityCheckManager.getSecurityMode(propsContext))
+    }
+
+    // ============================================================
+    // helpers
+    // ============================================================
+
+    private fun contextWithProperties(propertiesContent: String): Context {
+        val assets: android.content.res.AssetManager = mock {
+            on { open("webview_config.properties") } doReturn ByteArrayInputStream(propertiesContent.toByteArray())
+        }
+        return mock {
+            on { getAssets() } doReturn assets
+        }
+    }
+
+    private fun bindOrSkip(port: Int): ServerSocket {
+        return try {
+            ServerSocket().apply {
+                reuseAddress = true
+                bind(InetSocketAddress("127.0.0.1", port))
+            }
+        } catch (e: Exception) {
+            throw IllegalStateException(
+                "Could not bind port $port for SecurityCheckManager test -- is something " +
+                    "already listening on it?",
+                e
+            )
+        }
+    }
+}

package/dist/native/androidProject/app/src/test/java/io/yourname/androidproject/security/SecurityCheckSchedulerTest.kt

@@ -0,0 +1,166 @@
+package io.yourname.androidproject.security
+
+import android.content.Context
+import android.content.SharedPreferences
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.test.StandardTestDispatcher
+import kotlinx.coroutines.test.resetMain
+import kotlinx.coroutines.test.runTest
+import kotlinx.coroutines.test.setMain
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.mockito.kotlin.any
+import org.mockito.kotlin.doAnswer
+import org.mockito.kotlin.doReturn
+import org.mockito.kotlin.mock
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+
+/**
+ * Unit tests for SecurityCheckScheduler (Android coverage batch 4),
+ * previously entirely untested (0/19 lines).
+ *
+ * Scope: this is a thin Context + CoroutineScope wrapper that delegates to
+ * SecurityCheckManager.performSecurityChecks(context) (already covered in
+ * depth by SecurityCheckManagerTest -- its ALLOW/BLOCK branches, JSON
+ * shape, and persistence are NOT re-verified here). This suite only
+ * verifies that SecurityCheckScheduler.initialize():
+ *  - launches the check in the given scope and the callback receives the
+ *    results SecurityCheckManager produced,
+ *  - works with no callback at all (callback is nullable, `callback?.let`),
+ *  - does not throw when SecurityCheckManager's own call throws (the
+ *    launched coroutine's inner try/catch swallows it).
+ *
+ * Empirically-required setup: initialize() delivers the callback via
+ * `withContext(Dispatchers.Main)`. A JVM unit test has no real Android
+ * main-thread Looper, so Dispatchers.Main is uninitialized by default and
+ * would throw ("Module with the Main dispatcher is missing"). Per
+ * kotlinx-coroutines-test (already a project dependency -- see
+ * SecurityCheckManagerTest's runTest usage), Dispatchers.setMain(...) with
+ * a StandardTestDispatcher is installed in setUp()/torn down with
+ * Dispatchers.resetMain() in tearDown(), so the Main hop has somewhere
+ * real to resolve on instead of throwing.
+ *
+ * Note this test does NOT rely on runTest's virtual-time
+ * advanceUntilIdle() to observe completion: SecurityCheckManager.
+ * performSecurityChecks() internally does `withContext(Dispatchers.Default)`
+ * -- the REAL Default dispatcher, backed by real background threads, which
+ * runTest's virtual scheduler has no visibility into or control over (only
+ * the StandardTestDispatcher installed as Main is virtual-time-controlled
+ * here). So instead of advancing virtual time, these tests block the test
+ * thread on a CountDownLatch that the callback (or a manual completion
+ * signal) counts down, with a real wall-clock timeout -- the same
+ * "observe real async completion from a JVM unit test" shape as
+ * FridaDetectorTest's socket-based tests elsewhere in this suite.
+ *
+ * Context/SharedPreferences mocking mirrors SecurityCheckManagerTest's
+ * setUp() exactly, since initialize() -> performSecurityChecks() ->
+ * saveLatestResults() needs a working getSharedPreferences()/edit() chain
+ * to complete without throwing.
+ */
+@OptIn(ExperimentalCoroutinesApi::class)
+class SecurityCheckSchedulerTest {
+
+    private lateinit var prefsStorage: MutableMap<String, String?>
+    private lateinit var sharedPreferences: SharedPreferences
+    private lateinit var editor: SharedPreferences.Editor
+    private lateinit var context: Context
+
+    @Before
+    fun setUp() {
+        Dispatchers.setMain(StandardTestDispatcher())
+
+        prefsStorage = mutableMapOf()
+
+        editor = mock {
+            on { putString(any(), any()) } doAnswer { invocation ->
+                val key = invocation.getArgument<String>(0)
+                val value = invocation.getArgument<String?>(1)
+                prefsStorage[key] = value
+                editor
+            }
+        }
+        org.mockito.kotlin.doNothing().`when`(editor).apply()
+
+        sharedPreferences = mock {
+            on { getString(any(), org.mockito.kotlin.anyOrNull()) } doAnswer { invocation ->
+                val key = invocation.getArgument<String>(0)
+                val default = invocation.getArgument<String?>(1)
+                prefsStorage[key] ?: default
+            }
+            on { edit() } doReturn editor
+        }
+
+        context = mock {
+            on { getSharedPreferences(any(), any()) } doReturn sharedPreferences
+        }
+    }
+
+    @After
+    fun tearDown() {
+        Dispatchers.resetMain()
+        prefsStorage.clear()
+    }
+
+    @Test
+    fun `initialize invokes the callback with the security check results on the main dispatcher`() {
+        val latch = CountDownLatch(1)
+        var received: org.json.JSONObject? = null
+        val callback = object : SecurityCheckScheduler.SecurityCheckCallback {
+            override fun onSecurityCheckComplete(results: org.json.JSONObject) {
+                received = results
+                latch.countDown()
+            }
+        }
+
+        runTest {
+            SecurityCheckScheduler.initialize(context, this, callback)
+        }
+
+        assertTrue("callback should have been invoked within 5s", latch.await(5, TimeUnit.SECONDS))
+        assertEquals("ALLOW", received!!.getString("recommendation"))
+    }
+
+    @Test
+    fun `initialize with no callback completes without throwing`() = runTest {
+        SecurityCheckScheduler.initialize(context, this, callback = null)
+        // Reaching here without an exception is the assertion -- initialize()
+        // must not require a callback to be supplied. There is no callback
+        // signal to await, so this only proves the synchronous launch path
+        // (the try/catch around scope.launch{}) doesn't throw.
+    }
+
+    @Test
+    fun `initialize does not propagate an exception when the underlying check throws`() {
+        val throwingContext: Context = mock {
+            on { getSharedPreferences(any(), any()) } doAnswer { throw RuntimeException("boom") }
+        }
+        val latch = CountDownLatch(1)
+        val callback = object : SecurityCheckScheduler.SecurityCheckCallback {
+            override fun onSecurityCheckComplete(results: org.json.JSONObject) {
+                latch.countDown()
+            }
+        }
+
+        // SecurityCheckManager.performSecurityChecks itself catches broadly and
+        // returns an error JSONObject rather than throwing (see its own
+        // createErrorResponse fallback) -- but even if it didn't, initialize()'s
+        // own outer try/catch around scope.launch{} plus the inner try/catch
+        // around performSecurityChecks() must keep this call from propagating.
+        runTest {
+            SecurityCheckScheduler.initialize(throwingContext, this, callback)
+        }
+
+        // The call above completing without throwing is the primary
+        // assertion. Whether the callback fires at all depends entirely on
+        // SecurityCheckManager's already-covered internals (it does still
+        // reach ALLOW here since checkRooted/checkEmulator/checkFridaDetected
+        // don't touch getSharedPreferences), so this just confirms
+        // initialize() itself stays exception-safe with a throwing Context.
+        assertTrue(latch.await(5, TimeUnit.SECONDS))
+    }
+}