# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [2.0.0] - 2026-06-11

### Added

- `audit --fail-on=<critical|high|medium|low|info>` — opt-in exit gate for
  CI: exit code `1` (newly reserved) when any emitted finding is at or
  above the threshold; stdout still carries the normal audit output. The
  exit-code table is published as consts in `droidsaw-cli-contract`
  (`EXIT_SUCCESS` / `EXIT_FINDINGS` / `EXIT_ERROR`).
- `audit --format sarif` — SARIF 2.1.0 report on stdout for code scanning.
- Version provenance: `--version`, `_meta.tool_version` in every JSON
  payload, MSRV pin, `--locked` install guidance, and the `cargo auditable
  install` fleet/CI variant (binary embeds its `.dep-v0` dependency
  inventory, auditable via `cargo audit bin`).
- Audit envelope surfaces new layers' findings: AXML parse findings,
  DEX spec-invariant findings (pool/topo order, reserved bits), and
  LFH/central-directory ZIP anomalies translated to findings; `disasm`
  renders an `Unrecognized` marker for broken HBC function regions.
- Cross-layer taint: substantiated `FileRead`→`FileWrite` path traversal
  (CWE-22) via a path-arg gate, severity-tiered by source-trust + first-
  party locality.
- README rewritten as the complete user guide; `CLAUDE.md` added as the
  lean AI/operator driver.

### Fixed

- Every failure now emits the typed JSON error envelope on stdout: argv
  errors (mistyped flag / bad subcommand) route through `USER_INPUT`
  instead of exiting `2` with empty stdout (`--help`/`--version` keep their
  plain-text exit-0 convention); the `--permissive-recovery` and
  `--single-thread` rayon-conflict paths emit `CONFIGURATION` envelopes;
  unknown `--format`/`--mode` values classify as `CONFIGURATION`, not
  `INTERNAL`.
- `dex methods --implementations` counts `class_data_item` membership, not
  `code_off != 0` (includes abstract/native/miranda methods).
- Containment: optional Hermes bundle parse failure contained to the hbc
  layer; forged-leading-magic ZIPs routed to the APK parser; `class_defs`
  perimeter gated against shadow-row attribution.

## [1.0.0] - 2026-05-25

### Added

- `audit` — security audit (`--mode=basic|full|semgrep|trufflehog`); findings land in `findings` SQLite table
- `decompile` — DEX classes to Java, Hermes functions to JavaScript
- `taint` — cross-layer taint paths: HBC pass seeds JS user-controlled inputs, DEX pass follows interprocedural call chains (depth 4, CHA), bridge pass seeds `@ReactMethod` params from HBC-identified taint positions; results in `taint_flows` table
- `xrefs` — bidirectional cross-reference index across string pool, DEX methods, and Hermes functions
- `manifest` — AndroidManifest.xml analysis: permissions, components, exported risk profile, deep links
- `signing` — v1/v2/v3/v4 signing block analysis with ROCA (CVE-2017-15361), Fermat, Wiener, batch-GCD (pairwise + quasilinear)
- `apk-info` — container report: manifest + signing + ELF + entropy
- `info` / `hbc` / `dex` — per-layer bytecode summaries and subcommands
- MCP server (`droidsaw-mcp`): 13 tools over stdio or streamable-HTTP — `load`, `audit`, `query`, `decompile`, `taint`, `xrefs`, `signing`, `manifest`, `info`, `strings`, `frida`, `triage`, `investigate`, `diff`; large outputs stream to tempfile rather than context window
- SQLite export: `findings` + `taint_flows` schemas at rev 6; `query` MCP tool executes read-only `SELECT` against the audit DB
- Semgrep integration: decompiled DEX source extracted to disk and fed to Semgrep; custom rules via `--rules` or `DROIDSAW_SEMGREP_RULES`
- TruffleHog integration: extracted strings from every layer piped to TruffleHog; verified hits land in `credentials` view
- YARA-X integration: bundled credential/packer/crypto/anti-analysis rule packs; provenance-aware suppression; custom rules accepted
- STIX 2.1 bundle loading for IOC matching against parsed APK content (file path; no network I/O)
- Frida hook-stub generation against functions touching matched strings
- SBOM generation (CycloneDX 1.5)
- `CrossLayerContext` built once per invocation from a single APK path; `HbcOwned` self-cell holds byte buffer and parsed view together — no `Box::leak` across MCP sessions
- JSON output: stdout is one JSON object, JSON array, or NDJSON stream; typed error envelope on failure (`code`, `operation`, `message`, `hint`); exit 2 on error
- Deterministic output: bit-identical across repeated runs on the same input

[1.0.0]: https://github.com/droidsaw/droidsaw/releases/tag/v1.0.0
