Android 17's Local Network Permission: Inventory Every LAN Call Site Before You Hand the Fix to an Agent

#!/usr/bin/env python3
"""lan_scan.py — find every call site that needs local network permission."""
import json
import re
import sys
from pathlib import Path
 
PRIVATE_V4 = (
    r"(?:10\.(?:\d{1,3}\.){2}\d{1,3}"
    r"|192\.168\.\d{1,3}\.\d{1,3}"
    r"|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}"
    r"|169\.254\.\d{1,3}\.\d{1,3})"
)
 
# (confidence, rule name, pattern, why it leaves for the LAN)
RULES = [
    ("certain", "private-ipv4-literal", rf"(?<![\d.]){PRIVATE_V4}(?![\d.])",
     "private or link-local IPv4 literal"),
    ("certain", "mdns-local-host", r"[A-Za-z0-9_-]+\.local(?![A-Za-z0-9_-])",
     "mDNS .local hostname"),
    ("certain", "broadcast-address", r"255\.255\.255\.255", "UDP broadcast"),
    ("certain", "nsd-discovery",
     r"\bNsdManager\b|\bdiscoverServices\s*\(|\bresolveService\s*\(",
     "service discovery over NSD/mDNS"),
    ("certain", "multicast-lock",
     r"\bcreateMulticastLock\s*\(|CHANGE_WIFI_MULTICAST_STATE",
     "multicast reception"),
    ("certain", "media-router-scan",
     r"\bCastContext\b|CALLBACK_FLAG_PERFORM_ACTIVE_SCAN"
     r"|\bMediaRouter\b\s*\.\s*addCallback",
     "active Cast/MediaRouter scan"),
    ("likely", "raw-socket",
     r"\b(?:Socket|DatagramSocket|ServerSocket|MulticastSocket)\s*\(",
     "raw socket whose host is decided at runtime"),
    ("likely", "inet-resolve",
     r"InetAddress\s*\.\s*(?:getByName|getAllByName)\s*\(",
     "runtime resolution that may land on a private address"),
    ("likely", "configurable-base-url",
     r"\b(?:baseUrl|BASE_URL|host|HOST|endpoint|ENDPOINT|serverUrl|SERVER_URL)\b\s*[:=]",
     "host swappable via settings or remote config"),
    ("likely", "emulator-host", r"(?<![\d.])10\.0\.2\.2(?![\d.])",
     "emulator host loopback"),
    ("likely", "webview-load", r"\bloadUrl\s*\(|\bloadDataWithBaseURL\s*\(",
     "WebView may load a LAN URL"),
    ("review", "cleartext-domain-config",
     r"cleartextTrafficPermitted\s*=\s*[\"']true[\"']",
     "cleartext allowance, usually a leftover from LAN traffic"),
]
 
SKIP_DIRS = {"build", ".git", ".gradle", "node_modules"}
EXTS = {".kt", ".java", ".xml", ".json", ".properties"}
 
# Naive comment stripping eats the // in URLs, so never treat a slash pair
# that directly follows a scheme as the start of a comment.
_LINE_COMMENT = re.compile(r"(?<![:/])//.*$|<!--.*?(?:-->|$)|(?<!\S)#.*$")
 
def strip_comment(line: str) -> str:
    return _LINE_COMMENT.sub("", line)
 
def is_import(line: str) -> bool:
    return bool(re.match(r"\s*import\s", line))
 
def scan(root: Path):
    hits = {}  # (file, line) -> finding
    for path in sorted(root.rglob("*")):
        if not path.is_file() or path.suffix not in EXTS:
            continue
        if SKIP_DIRS & set(path.parts):
            continue
        rel = str(path.relative_to(root))
        for lineno, raw in enumerate(path.read_text(errors="replace").splitlines(), 1):
            if is_import(raw):
                continue
            line = strip_comment(raw)
            if not line.strip():
                continue
            matched = [(c, n, w) for c, n, pat, w in RULES if re.search(pat, line)]
            if not matched:
                continue
            # Several rules can hit one line. Keep the strongest confidence.
            order = {"certain": 0, "likely": 1, "review": 2}
            matched.sort(key=lambda m: order[m[0]])
            hits[(rel, lineno)] = {
                "file": rel,
                "line": lineno,
                "confidence": matched[0][0],
                "rules": [m[1] for m in matched],
                "why": matched[0][2],
                "text": raw.strip()[:100],
            }
    return [hits[k] for k in sorted(hits)]
 
def manifest_has_permission(root: Path) -> bool:
    return any(
        "android.permission.LOCAL_NETWORK_ACCESS" in m.read_text(errors="replace")
        for m in root.rglob("AndroidManifest.xml")
    )
 
def main():
    root = Path(sys.argv[1] if len(sys.argv) > 1 else ".").resolve()
    findings = scan(root)
    counts = {"certain": 0, "likely": 0, "review": 0}
    for f in findings:
        counts[f["confidence"]] += 1
    report = {
        "root": str(root),
        "declared_permission": manifest_has_permission(root),
        "counts": counts,
        "total": len(findings),
        "files_touched": len({f["file"] for f in findings}),
        "findings": findings,
    }
    print(json.dumps(report, ensure_ascii=False, indent=2))
    # Certain hits with no declaration means silence in the field.
    if counts["certain"] and not report["declared_permission"]:
        print(f"\nFAIL: {counts['certain']} certain hits, "
              "LOCAL_NETWORK_ACCESS not declared", file=sys.stderr)
        return 1
    return 0
 
if __name__ == "__main__":
    sys.exit(main())

def strip_comment(line: str) -> str:  # first version — this is broken
    for marker in ("//", "<!--", "#"):
        i = line.find(marker)
        if i >= 0:
            line = line[:i]
    return line

const val OLLAMA_FALLBACK = "http://192.168.11.8:11434"

_LINE_COMMENT = re.compile(r"(?<![:/])//.*$|<!--.*?(?:-->|$)|(?<!\S)#.*$")

#!/usr/bin/env python3
"""lan_tasks.py — fold lan_scan.py output into units an agent can work through."""
import json
import sys
 
QUESTION = {
    "private-ipv4-literal": "Is this destination on the same LAN? Loopback/emulator needs no permission",
    "emulator-host": "Debug builds only? If it ships, confirm the production destination",
    "mdns-local-host": "If the name resolves via mDNS, discovery itself needs the grant",
    "broadcast-address": "Broadcast goes silent without permission. Add a degraded state",
    "nsd-discovery": "Discovery returns zero. Can the user see why?",
    "multicast-lock": "The lock acquires but nothing arrives. Check the timeout handling",
    "media-router-scan": "Cast devices never list. Write the empty-list copy",
    "raw-socket": "Can this reach a LAN host? If so, is the failure being swallowed?",
    "inet-resolve": "Can the resolved address be private?",
    "configurable-base-url": "Is there a path for the user to enter a LAN host?",
    "webview-load": "Can the loaded URL point at the LAN? Can it show an error page?",
    "cleartext-domain-config": "Is the cleartext allowance for LAN traffic? Drop it if not",
}
RANK = {"certain": 0, "likely": 1, "review": 2}
 
def main():
    report = json.load(open(sys.argv[1]))
    per_file = {}
    for f in report["findings"]:
        e = per_file.setdefault(
            f["file"], {"lines": [], "rules": set(), "confidence": "review"}
        )
        e["lines"].append(f["line"])
        e["rules"].update(f["rules"])
        if RANK[f["confidence"]] < RANK[e["confidence"]]:
            e["confidence"] = f["confidence"]
 
    tasks = []
    for path in sorted(per_file, key=lambda p: (RANK[per_file[p]["confidence"]], p)):
        e = per_file[path]
        tasks.append({
            "file": path,
            "lines": sorted(set(e["lines"])),
            "confidence": e["confidence"],
            "checks": sorted({QUESTION[r] for r in e["rules"] if r in QUESTION}),
            "status": "todo",
        })
 
    print(json.dumps(
        {"permission_declared": report["declared_permission"], "tasks": tasks},
        ensure_ascii=False, indent=2,
    ))
    # Human-readable form goes to stderr so it never pollutes the pipe.
    for t in tasks:
        marks = ",".join(str(x) for x in t["lines"])
        print(f"\n[{t['confidence']}] {t['file']}  (L{marks})", file=sys.stderr)
        for q in t["checks"]:
            print(f"    - [ ] {q}", file=sys.stderr)
 
if __name__ == "__main__":
    main()

sealed interface DiscoveryOutcome {
    data class Found(val services: List<NsdServiceInfo>) : DiscoveryOutcome
    /** Permission is missing, so discovery never really ran. */
    data object BlockedByPermission : DiscoveryOutcome
    /** Permission is granted and there is genuinely nothing out there. */
    data object EmptyNetwork : DiscoveryOutcome
}
 
class DiscoveryReporter(private val context: Context) {
 
    private fun hasLocalNetworkAccess(): Boolean =
        ContextCompat.checkSelfPermission(context, LOCAL_NETWORK_ACCESS) ==
            PackageManager.PERMISSION_GRANTED
 
    /**
     * Zero results means both "nothing found" and "could not look".
     * Without this branch, the user keeps suspecting the wrong thing.
     */
    fun classify(services: List<NsdServiceInfo>): DiscoveryOutcome = when {
        services.isNotEmpty() -> DiscoveryOutcome.Found(services)
        !hasLocalNetworkAccess() -> DiscoveryOutcome.BlockedByPermission
        else -> DiscoveryOutcome.EmptyNetwork
    }
 
    companion object {
        // The string can move between platform generations. Keep one reference.
        const val LOCAL_NETWORK_ACCESS = "android.permission.LOCAL_NETWORK_ACCESS"
    }
}