Cross-platform App Hardening (DexGuard-class), Enterprise-gated - #5527

Open

shai-almog wants to merge 111 commits into

Commits on Aug 6, 2026

Add cross-platform App Hardening (DexGuard-class), Enterprise-gated

shai-almog
and
claude
committed
ae40837
CI: complete copyright headers, /// docs, and force engine build order

shai-almog
and
claude
committed
010fe08
cn1-hardening: guard ProGuard against JDK 21+ class files

shai-almog
and
claude
committed
fc8822a
Address Codex P1 review: frame hierarchy, FQ main class, reactor dep

shai-almog
and
claude
committed
efa163b
Address Codex round-2 review + fix core/CI build breaks

shai-almog
and
claude
committed
605f722
Address Codex round-3 review (verifier hierarchy, service descriptors, Select delimiters)

shai-almog
and
claude
committed
0fffb4c
docs: satisfy the developer-guide prose gate (Vale + xref + LanguageTool)

shai-almog
and
claude
committed
8899127
Address Codex round-4 + Copilot review

shai-almog
and
claude
committed
d2ebbef
Address Codex round-5 review

shai-almog
and
claude
committed
5009358
Address Codex round-6 review (interface literals, empty-config)

shai-almog
and
claude
committed
fdc77f2
Address Codex round-7 review

shai-almog
and
claude
committed
6efa3ef
Address Codex round-8 review

shai-almog
and
claude
committed
d354db3
Address Codex round-9 review

shai-almog
and
claude
committed
71b9c68
CI: fix illegal '--' inside an XML comment in the plugin POM

shai-almog
and
claude
committed
95a7fdb
Address Codex round-10 review

shai-almog
and
claude
committed
495a599
Address Codex round-11 review

shai-almog
and
claude
committed
c94e6dd
Address Codex round-12 review

shai-almog
and
claude
committed
b625567
Address Codex round-13 review + fix developer-guide LanguageTool gate

shai-almog
and
claude
committed
df007c4
Fix JS launcher compile: import Display for the hardening stamp

shai-almog
and
claude
committed
9fa7384

Commits on Aug 7, 2026

Address Codex review round 14 (unresolved #5527 threads)

shai-almog
and
claude
committed
23e52cd
Fix Vale gate in App-Hardening doc: drop adverb, use contraction

shai-almog
and
claude
committed
107abbb
Fix SpotBugs DM_DEFAULT_ENCODING in CrashProtection.safeRawStack

shai-almog
and
claude
committed
f7c4e26
Address Codex review round 15 (#5527)

shai-almog
and
claude
committed
30e4d61
Address Codex review round 16 (#5527)

shai-almog
and
claude
committed
ba739f5
Address Codex review round 18 (#5527)

shai-almog
and
claude
committed
5435b58
Narrow keep rules and rewrite hardening docs per project-owner review

shai-almog
and
claude
committed
245c14c
Address Codex review round 19: fix the real ones, push back on one

shai-almog
and
claude
committed
c5404f2
Address Codex round 20: fix two real hoisting bugs

shai-almog
and
claude
committed
9c54748
Address Codex round 21 (mapping-id + idempotence)

shai-almog
and
claude
committed
9c12bc2
Address Codex round 22 (docs): correct engine-secrecy claim, note annotation exclusion

shai-almog
and
claude
committed
f47cffb
Security: never trust client-supplied cn1.hardened / hardenLevel / mappingId

shai-almog
and
claude
committed
e195c21
Address Codex round 26 (#5527): preserve metadata on idempotent path + Android SourceFile

shai-almog
and
claude
committed
2867390
Doc: qualify SourceFile stripping for the unminified Android case

shai-almog
and
claude
committed
78c0e90

Commits on Aug 8, 2026

Address Codex round 27 (#5527): gate SourceFile on verified hardening, retrace ambiguity, control-flow guard collision

shai-almog
and
claude
committed
e6aebfc
Keep the generated SVGRegistry under its fixed name

shai-almog
and
claude
committed
7ba3a56
Address Codex round 29: gate R8 keep rules on verified hardening

shai-almog
and
claude
committed
35e2ae2
Derive crash trace format from platform so JVM traces are not mislabeled js-error

shai-almog
and
claude
committed
7532a4c
Preserve JS stack coordinates when scrubbing; report unencryptable concat literals

shai-almog
and
claude
committed
bcd9de1
Tighten JS frame detection; print replacement frames after setStackTrace on ParparVM

shai-almog
and
claude
committed
c31273c
Serialize hardening warnings in the report; correct PARANOID profile javadoc

shai-almog
and
claude
committed
2c09704
Route raw-stack messages through scrubMessage; base preflight on the effective transform set

shai-almog
and
claude
committed
84fab7a
Require a real location for 'at' frame lines; keep invalid harden.level failing fast

shai-almog
and
claude
committed
35b0969
Split oversized hoist <clinit>; report legacy-interface constants; normalize ParparVM init frames

shai-almog
and
claude
committed
fb92dc1
Validate parenthesized frame locations; reject every enableProguard value that leaves R8 off

shai-almog
and
claude
committed
0982015
Keep the distinct watch entry class; require a release variant for Android rename hardening

shai-almog
and
claude
committed
76917eb
Report string literals left plaintext because they are too large to encrypt

shai-almog
and
claude
committed
40a71a5
Report constant-dynamic string exclusions; account for the existing <clinit> when splitting

shai-almog
and
claude
committed
00114d0
Measure encoded bytecode before growing a method; skip and report when a transform will not fit

shai-almog
and
claude
committed
13ec40d
Require a whitespace-free frame identity; size-check the guard-field clinit setup

shai-almog
and
claude
committed
2461ea0
Keep R8 source-file metadata; size-check interface method-body string rewrites

shai-almog
and
claude
committed
1353f18
Bound raw-stack capture; count annotation-value strings excluded from strings:all

shai-almog
and
claude
committed
5446ef9
Require a dotted/URL frame identity; recurse into nested constant-dynamic arguments

shai-almog
and
claude
committed
ab3d013
Scrub frame URL/query data; keep name-bound background callbacks; cap hoisting by pool budget

shai-almog
and
claude
committed
63f050a
Keep BackgroundWorker; fall back to per-access encryption instead of leaving literals plaintext

shai-almog
and
claude
committed
ebb8ef8
Scrub coordinate-free frame mimics; exclude un-encryptable literals jar-wide for == consistency

shai-almog
and
claude
committed
9de216b
Preserve only the terminal two coordinate groups in a frame line

shai-almog
and
claude
committed
773b977
Size-check hoist LDC->GETSTATIC replacements; count type-use and record-component annotation strings

shai-almog
and
claude
committed
75b9446
Budget the constant pool for static-final fields and control-flow guards

shai-almog
and
claude
committed
4478857
Keep Login subclasses; run the hardening preflight against library-merged settings

shai-almog
and
claude
committed
16cf907
Document why carrying .java/.kt sources through the demuxer is rename-safe

shai-almog
and
claude
committed
6549725
Validate @-frame source shape before preserving coordinates; skip OFF profile in the entitlement gate

shai-almog
and
claude
committed
6b81363
Budget per-access ciphertext growth; use inlinee's own sourceFile in retrace

shai-almog
and
claude
committed
52ed531
Preserve literal identity across the library boundary; charge widened conditional jumps

shai-almog
and
claude
committed
a4ce422
Apply the engine's platform-safety rules in the hardening preflight

shai-almog
and
claude
committed
9cf83ca
Disclose non-concat invokedynamic string args and short literals in the coverage report

shai-almog
and
claude
committed
9edd05b
Preserve static-final ConstantValues a bundled Android source references as a constant

shai-almog
and
claude
committed
16a5c8f
Honor jar-wide and library exclusions in the static-final string path

shai-almog
and
claude
committed
4f1e274
Exclude the ParparVM runtime jar's literals and jar-wide-exclude budget-skipped constants

shai-almog
and
claude
committed
60132cf
Skip Android R8-rename enforcement when hardening was forced off

shai-almog
and
claude
committed
d606187
Require indentation before treating an 'at ...' line as a stack frame

shai-almog
and
claude
committed
0d51b7c
Record real source filenames in the engine's own mapping

shai-almog
and
claude
committed
0db5a6d

Commits on Aug 9, 2026

Require a URL path separator in an @-frame source, not just a dot

shai-almog
and
claude
committed
862d10b
Exclude a pre-Java-8 interface's un-encryptable constant jar-wide

shai-almog
and
claude
committed
2020215
Accept multi-word V8 frame identities in the at-paren form

shai-almog
and
claude
committed
fa59896
Reject conflicting per-slice hardening opt-outs in a combined iOS+Mac build

shai-almog
and
claude
committed
7cd8411
Combine per-slice hardening opt-outs instead of consulting one slice, matching the daemon

shai-almog
and
claude
committed
07e05bb
Restrict at-paren multi-word identities to genuine V8 label shapes

shai-almog
and
claude
committed
b3ae16c
Validate the V8 accessor alias content before accepting an at-paren frame

shai-almog
and
claude
committed
49034a3
Apply scrubFrame to raw stack, combine Apple opt-outs in preflight, quote-safe ProGuard paths

shai-almog
and
claude
committed
e83f164
Size the obfuscation dictionary for the biggest class's member count too

shai-almog
and
claude
committed
b4ed029
Stop preserving coordinates from the ambiguous Firefox/Safari @-frame form

shai-almog
and
claude
committed
2844caf
Scrub the whole raw stack uniformly; stop preserving frame coordinates

shai-almog
and
claude
committed
875477d
Honor a null scrubFrame redaction in the raw stack; size the dictionary for inherited member scopes

shai-almog
and
claude
committed
fcbaf7f
Resolve a common supertype from class bytes when a shared base can't be loaded

shai-almog
and
claude
committed
5c3ae44
Include interfaces in byte-based common-supertype resolution

shai-almog
and
claude
committed
f4f35e8
Fall back to structural verification when the output verifier can't resolve a type

shai-almog
and
claude
committed
34cb401
Decode JSON escapes when reading sourceFile metadata

shai-almog
and
claude
committed
20ef9be
Harden ParparVM-JS runtime literals; document array-frame contract

shai-almog
and
claude
committed
be80678
Count short static-final constants in the string-coverage disclosure

shai-almog
and
claude
committed
5e4833c
Merge remote-tracking branch 'origin/master' into app-hardening
shai-almog
committed
8cd67a8
Carry the hardening force-off/library-jars decision per build, not JVM-wide

shai-almog
and
claude
committed
8c9e103
Ship a class unhardened when its frame hierarchy is incomplete

shai-almog
and
claude
committed
63a4fe7
Zero applied counts when a class is discarded as unresolvable

shai-almog
and
claude
committed
474a723
Escape JSON control characters in sourceFile mapping metadata

shai-almog
and
claude
committed
799372c
Preserve whitespace in retraced source filenames

shai-almog
and
claude
committed
374c216
Keep HealthBackgroundListener implementors so their names stay stable

shai-almog
and
claude
committed
364d110

Commits on Aug 10, 2026

Propagate the hardening force-off decision into every local request

shai-almog
and
claude
committed
a93fc64
Preserve ConstantValue for constants read by a non-inlined GETSTATIC

shai-almog
and
claude
committed
42e9d45
Document interface-merge soundness and the package-relative-resource limit

shai-almog
and
claude
committed
9757e15
docs: drop the adverb the Vale prose gate flagged

shai-almog
and
claude
committed
5fb8161
Close two gaps in the incomplete-hierarchy and GETSTATIC-owner handling

shai-almog
and
claude
committed
54e0528
Gate parparvm-text trace classification on a ParparVM-C platform

shai-almog
and
claude
committed
1bf1604
Distinguish native ParparVM-C from JavaSE by runtime, not platform name

shai-almog
and
claude
committed
d4cc154
Accept a verifier report whose TEXT names only a missing type

shai-almog
and
claude
committed
fba9418
Read retrace mapping files as UTF-8, not the platform default

shai-almog
and
claude
committed
4124a5e
docs: correct scrubRawStack javadoc to match uniform masking

shai-almog
and
claude
committed
ffe1519
Run hardening preflight before the Android up-to-date cache short-circuit

shai-almog
and
claude
committed
df5a3b6
Verify data flow per method so a real error survives a missing-type peer

shai-almog
and
claude
committed
8b6485f
Bypass the Android up-to-date cache when hardening will actually run

shai-almog
and
claude
committed
7608043
Invalidate the Android APK cache on any hardening-outcome change

shai-almog
and
claude
committed
4684e09
Fingerprint all effective harden.* settings in the APK cache key

shai-almog
and
claude
committed
bf5ea64