build.gradle

plugins {
    id 'com.android.application' version '8.10.1' apply false
    id 'org.jetbrains.kotlin.android' version '2.2.21' apply false
    id 'org.jetbrains.kotlin.jvm' version '2.2.21' apply false
}

allprojects {
    group = providers.gradleProperty('GROUP').get()
    version = providers.gradleProperty('VERSION_NAME').get()
}

subprojects {
    pluginManager.withPlugin('maven-publish') {
        publishing {
            publications.withType(MavenPublication).configureEach {
                pom {
                    name = "Android Agent Harness ${project.name}"
                    description = 'Provider-neutral bounded Agent runtime and host SDK.'
                    url = 'https://github.com/susyimes/android-agent-harness'
                    licenses {
                        license {
                            name = 'The Apache License, Version 2.0'
                            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
                            distribution = 'repo'
                        }
                    }
                    scm {
                        connection = 'scm:git:https://github.com/susyimes/android-agent-harness.git'
                        developerConnection =
                            'scm:git:ssh://git@github.com/susyimes/android-agent-harness.git'
                        url = 'https://github.com/susyimes/android-agent-harness'
                    }
                }
            }
            repositories {
                maven {
                    name = 'sdkLocal'
                    url = rootProject.layout.buildDirectory.dir('sdk-repository')
                }
            }
        }
    }
}

tasks.register('auditProvenance') {
    group = 'verification'
    description = 'Rejects private configuration, embedded credentials, product namespaces, local machine paths, and binary product assets.'

    doLast {
        def repositoryFiles = fileTree(rootDir) {
            exclude '.git/**'
            exclude '.gradle/**'
            exclude '.gradle-user-home/**'
            exclude '**/build/**'
        }.files.findAll { file -> file.isFile() }

        def forbiddenBaseNames = [
            '.env',
            'credentials.json',
            'local.properties',
            'secrets.properties'
        ] as Set
        def forbiddenSuffixes = ['.jks', '.keystore', '.p12', '.pem']
        def forbiddenNames = repositoryFiles.findAll { file ->
            def name = file.name.toLowerCase(Locale.ROOT)
            forbiddenBaseNames.contains(name) ||
                forbiddenSuffixes.any { suffix -> name.endsWith(suffix) } ||
                name.startsWith('id_rsa')
        }

        def sourceAndBuildFiles = fileTree(rootDir) {
            include 'build.gradle'
            include 'settings.gradle'
            include 'gradle.properties'
            include '**/*.gradle'
            include '*/src/**/*.kt'
            include '*/src/**/*.xml'
            include 'README.md'
            include 'THIRD_PARTY_NOTICES.md'
            include 'docs/**/*.md'
            exclude '**/build/**'
        }.files.findAll { file -> file.isFile() }

        def productNamespaces = ['com' + '.mirror', 'com' + '.truebox']
        def embeddedCredential = ~/(?i)(api[_-]?key|access[_-]?token|client[_-]?secret|password)\s*[:=]\s*["'][^"']+["']/
        def privateLocalPath = ~/(?i)\b[a-z]:\\[^\s`]/
        def contentViolations = []
        sourceAndBuildFiles.each { file ->
            def text = file.getText('UTF-8')
            productNamespaces.each { marker ->
                if (text.toLowerCase(Locale.ROOT).contains(marker)) {
                    contentViolations << "${file}: product namespace '${marker}'"
                }
            }
            if (embeddedCredential.matcher(text).find()) {
                contentViolations << "${file}: embedded credential-like assignment"
            }
            if (privateLocalPath.matcher(text).find()) {
                contentViolations << "${file}: local machine path"
            }
        }

        def binarySampleAssets = fileTree(file('sample/src/main/res')) {
            include '**/*'
            exclude '**/*.xml'
        }.files.findAll { file -> file.isFile() }

        if (!forbiddenNames.isEmpty() || !contentViolations.isEmpty() || !binarySampleAssets.isEmpty()) {
            def findings = []
            findings.addAll(forbiddenNames.collect { file -> "forbidden file: ${file}" })
            findings.addAll(contentViolations)
            findings.addAll(binarySampleAssets.collect { file -> "binary sample asset: ${file}" })
            throw new GradleException("Provenance/privacy audit failed:\n - ${findings.join('\n - ')}")
        }

        logger.lifecycle("Provenance/privacy audit passed (${repositoryFiles.size()} repository files inspected).")
    }
}

tasks.register('checkM0') {
    group = 'verification'
    description = 'Runs the minimal architecture tests, provenance audit, JVM demo build, and Android sample debug build.'
    dependsOn 'auditProvenance'
    dependsOn ':harness-core:test'
    dependsOn ':agent-sdk:test'
    dependsOn ':agent-approval:test'
    dependsOn ':context-engine:test'
    dependsOn ':agent-state:test'
    dependsOn ':agent-permission-android:testDebugUnitTest'
    dependsOn ':agent-data-android:testDebugUnitTest'
    dependsOn ':agent-scheduling:test'
    dependsOn ':agent-scheduling-android:testDebugUnitTest'
    dependsOn ':agent-feedback:test'
    dependsOn ':agent-voice-android:testDebugUnitTest'
    dependsOn ':provider-openai:test'
    dependsOn ':harness-eval:test'
    dependsOn ':device-loop:test'
    dependsOn ':device-loop-android:testDebugUnitTest'
    dependsOn ':web4agent-android:testDebugUnitTest'
    dependsOn ':demo:test'
    dependsOn ':agent-sdk-android:testDebugUnitTest'
    dependsOn ':sdk-consumer-smoke:test'
    dependsOn ':sample:testDebugUnitTest'
    dependsOn ':sample:assembleDebugAndroidTest'
    dependsOn ':sample:lintDebug'
    dependsOn ':sample:assembleDebug'
}

tasks.register('checkConnectedSample') {
    group = 'verification'
    description = 'Runs the sample instrumentation suite on a connected Android device.'
    dependsOn ':sample:connectedDebugAndroidTest'
}

tasks.register('checkSdkAbi') {
    group = 'verification'
    description = 'Checks published JVM SDK modules against committed Kotlin ABI baselines.'
    dependsOn ':harness-core:checkLegacyAbi'
    dependsOn ':agent-sdk:checkLegacyAbi'
    dependsOn ':agent-approval:checkLegacyAbi'
    dependsOn ':context-engine:checkLegacyAbi'
    dependsOn ':agent-state:checkLegacyAbi'
    dependsOn ':agent-scheduling:checkLegacyAbi'
    dependsOn ':agent-feedback:checkLegacyAbi'
    dependsOn ':provider-openai:checkLegacyAbi'
    dependsOn ':harness-eval:checkLegacyAbi'
    dependsOn ':device-loop:checkLegacyAbi'
}

tasks.register('publishJvmSdk') {
    group = 'publishing'
    description = 'Builds and publishes JVM SDK JAR artifacts to build/sdk-repository.'
    dependsOn ':harness-core:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-sdk:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-approval:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':context-engine:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-state:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-scheduling:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-feedback:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':provider-openai:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':harness-eval:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':device-loop:publishSdkPublicationToSdkLocalRepository'
}

tasks.register('publishSdk') {
    group = 'publishing'
    description = 'Builds and publishes all SDK JAR/AAR artifacts to build/sdk-repository.'
    dependsOn 'publishJvmSdk'
    dependsOn ':device-loop-android:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':web4agent-android:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-sdk-android:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-permission-android:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-data-android:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-scheduling-android:publishSdkPublicationToSdkLocalRepository'
    dependsOn ':agent-voice-android:publishSdkPublicationToSdkLocalRepository'
}

tasks.register('checkSdk') {
    group = 'verification'
    description = 'Runs SDK tests, ABI checks, external-consumer tests, and JAR/AAR publication.'
    dependsOn 'auditProvenance'
    dependsOn 'checkSdkAbi'
    dependsOn ':harness-core:test'
    dependsOn ':agent-sdk:test'
    dependsOn ':agent-approval:test'
    dependsOn ':context-engine:test'
    dependsOn ':agent-state:test'
    dependsOn ':agent-permission-android:testDebugUnitTest'
    dependsOn ':agent-data-android:testDebugUnitTest'
    dependsOn ':agent-scheduling:test'
    dependsOn ':agent-scheduling-android:testDebugUnitTest'
    dependsOn ':agent-feedback:test'
    dependsOn ':agent-voice-android:testDebugUnitTest'
    dependsOn ':provider-openai:test'
    dependsOn ':harness-eval:test'
    dependsOn ':device-loop:test'
    dependsOn ':device-loop-android:testDebugUnitTest'
    dependsOn ':web4agent-android:testDebugUnitTest'
    dependsOn ':agent-sdk-android:testDebugUnitTest'
    dependsOn ':device-loop-android:lintRelease'
    dependsOn ':web4agent-android:lintRelease'
    dependsOn ':agent-sdk-android:lintRelease'
    dependsOn ':agent-permission-android:lintRelease'
    dependsOn ':agent-data-android:lintRelease'
    dependsOn ':agent-scheduling-android:lintRelease'
    dependsOn ':agent-voice-android:lintRelease'
    dependsOn ':sdk-consumer-smoke:test'
    dependsOn ':sdk-android-consumer-smoke:testDebugUnitTest'
    dependsOn 'publishSdk'
}

tasks.register('runDemo') {
    group = 'application'
    description = 'Runs the deterministic provider -> tool -> provider demo.'
    dependsOn ':demo:run'
}