fix: harden android snapshot helper packaging

Author: thymikee

.fallowrc.json

@@ -9,6 +9,7 @@
     "src/remote-config.ts",
     "src/install-source.ts",
     "src/android-apps.ts",
+    "src/android-snapshot-helper.ts",
     "src/contracts.ts",
     "src/selectors.ts",
     "src/finders.ts",

.github/workflows/ci.yml

@@ -103,8 +103,17 @@ jobs:
 
       - name: Install Android SDK packages
         run: |
-          yes | sdkmanager --licenses >/dev/null
-          sdkmanager "platforms;android-36" "build-tools;36.0.0"
+          SDK_ROOT="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-/usr/local/lib/android/sdk}}"
+          SDKMANAGER="$SDK_ROOT/cmdline-tools/latest/bin/sdkmanager"
+          if [ ! -x "$SDKMANAGER" ]; then
+            SDKMANAGER="$SDK_ROOT/cmdline-tools/bin/sdkmanager"
+          fi
+          if [ ! -x "$SDKMANAGER" ]; then
+            echo "sdkmanager not found under $SDK_ROOT" >&2
+            exit 1
+          fi
+          yes | "$SDKMANAGER" --licenses >/dev/null
+          "$SDKMANAGER" "platforms;android-36" "build-tools;36.0.0"
 
       - name: Check Java toolchain
         run: |

.github/workflows/release-android-snapshot-helper.yml

@@ -36,8 +36,17 @@ jobs:
 
       - name: Install Android SDK packages
         run: |
-          yes | sdkmanager --licenses >/dev/null
-          sdkmanager "platforms;android-36" "build-tools;36.0.0"
+          SDK_ROOT="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-/usr/local/lib/android/sdk}}"
+          SDKMANAGER="$SDK_ROOT/cmdline-tools/latest/bin/sdkmanager"
+          if [ ! -x "$SDKMANAGER" ]; then
+            SDKMANAGER="$SDK_ROOT/cmdline-tools/bin/sdkmanager"
+          fi
+          if [ ! -x "$SDKMANAGER" ]; then
+            echo "sdkmanager not found under $SDK_ROOT" >&2
+            exit 1
+          fi
+          yes | "$SDKMANAGER" --licenses >/dev/null
+          "$SDKMANAGER" "platforms;android-36" "build-tools;36.0.0"
 
       - name: Check Java toolchain
         run: |

android-snapshot-helper/debug.keystore

@@ -208,6 +208,15 @@ private static void appendEscaped(StringBuilder xml, String value) {
         case '\'':
           xml.append("'");
           break;
+        case '\n':
+          xml.append("
");
+          break;
+        case '\r':
+          xml.append("
");
+          break;
+        case '\t':
+          xml.append("	");
+          break;
         default:
           xml.append(character);
           break;

android-snapshot-helper/src/main/java/com/callstack/agentdevice/snapshothelper/SnapshotInstrumentation.java

@@ -48,7 +48,7 @@ VERSION_CODE="$(
 BUILD_DIR="$HELPER_DIR/build"
 CLASSES_DIR="$BUILD_DIR/classes"
 DEX_DIR="$BUILD_DIR/dex"
-KEYSTORE="$BUILD_DIR/debug.keystore"
+KEYSTORE="$HELPER_DIR/debug.keystore"
 UNSIGNED_APK="$BUILD_DIR/helper-unsigned.apk"
 ALIGNED_APK="$BUILD_DIR/helper-aligned.apk"
 APK_PATH="$OUTPUT_DIR/$APK_BASENAME"
@@ -81,15 +81,10 @@ zip -q -j "$UNSIGNED_APK" "$DEX_DIR/classes.dex"
 
 "$BUILD_TOOLS_DIR/zipalign" -f 4 "$UNSIGNED_APK" "$ALIGNED_APK"
 
-keytool -genkeypair \
-  -keystore "$KEYSTORE" \
-  -storepass android \
-  -keypass android \
-  -alias androiddebugkey \
-  -keyalg RSA \
-  -keysize 2048 \
-  -validity 10000 \
-  -dname "CN=Android Debug,O=Android,C=US" >/dev/null 2>&1
+if [ ! -f "$KEYSTORE" ]; then
+  echo "Missing Android snapshot helper signing keystore: $KEYSTORE" >&2
+  exit 1
+fi
 
 "$BUILD_TOOLS_DIR/apksigner" sign \
   --ks "$KEYSTORE" \

scripts/build-android-snapshot-helper.sh

@@ -92,96 +92,53 @@ test('screenshotAndroid waits for transient UI to settle before capture', async
 });
 
 test('screenshotAndroid writes a valid PNG when output is clean', async () => {
-  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'screenshot-clean-'));
-  try {
-    const outPath = path.join(tmpDir, 'out.png');
+  await withTempScreenshot('screenshot-clean-', async (outPath) => {
     await screenshotAndroid(device, outPath);
     const written = await fs.readFile(outPath);
     assert.deepEqual(written, VALID_PNG);
-  } finally {
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  }
+  });
 });
 
 test('screenshotAndroid strips warning text before PNG signature', async () => {
   const warning =
     '[Warning] Multiple displays were found, but no display id was specified! Defaulting to the first display found.';
-  const payload = Buffer.concat([Buffer.from(warning), VALID_PNG]);
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: '', stderr: '', stdoutBuffer: payload };
-    }
-    return { exitCode: 0, stdout: '', stderr: '' };
-  });
+  mockScreenshotPayload(Buffer.concat([Buffer.from(warning), VALID_PNG]));
 
-  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'screenshot-warning-'));
-  try {
-    const outPath = path.join(tmpDir, 'out.png');
+  await withTempScreenshot('screenshot-warning-', async (outPath) => {
     await screenshotAndroid(device, outPath);
     const written = await fs.readFile(outPath);
     assert.deepEqual(written, VALID_PNG);
-  } finally {
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  }
+  });
 });
 
 test('screenshotAndroid strips trailing garbage after PNG payload', async () => {
-  const payload = Buffer.concat([VALID_PNG, Buffer.from('\ntrailing-warning\n')]);
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: '', stderr: '', stdoutBuffer: payload };
-    }
-    return { exitCode: 0, stdout: '', stderr: '' };
-  });
+  mockScreenshotPayload(Buffer.concat([VALID_PNG, Buffer.from('\ntrailing-warning\n')]));
 
-  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'screenshot-trailing-'));
-  try {
-    const outPath = path.join(tmpDir, 'out.png');
+  await withTempScreenshot('screenshot-trailing-', async (outPath) => {
     await screenshotAndroid(device, outPath);
     const written = await fs.readFile(outPath);
     assert.deepEqual(written, VALID_PNG);
-  } finally {
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  }
+  });
 });
 
 test('screenshotAndroid throws when output contains no PNG signature', async () => {
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: '', stderr: '', stdoutBuffer: Buffer.from('not a png') };
-    }
-    return { exitCode: 0, stdout: '', stderr: '' };
-  });
+  mockScreenshotPayload(Buffer.from('not a png'));
 
-  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'screenshot-nopng-'));
-  try {
-    const outPath = path.join(tmpDir, 'out.png');
+  await withTempScreenshot('screenshot-nopng-', async (outPath) => {
     await assert.rejects(() => screenshotAndroid(device, outPath), {
       message: 'Screenshot data does not contain a valid PNG header',
     });
-  } finally {
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  }
+  });
 });
 
 test('screenshotAndroid throws when PNG payload is truncated', async () => {
-  const payload = VALID_PNG.subarray(0, VALID_PNG.length - 3);
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: '', stderr: '', stdoutBuffer: payload };
-    }
-    return { exitCode: 0, stdout: '', stderr: '' };
-  });
+  mockScreenshotPayload(VALID_PNG.subarray(0, VALID_PNG.length - 3));
 
-  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'screenshot-truncated-'));
-  try {
-    const outPath = path.join(tmpDir, 'out.png');
+  await withTempScreenshot('screenshot-truncated-', async (outPath) => {
     await assert.rejects(() => screenshotAndroid(device, outPath), {
       message: 'Screenshot data does not contain a complete PNG payload',
     });
-  } finally {
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  }
+  });
 });
 
 function helperOutput(xml: string): string {
@@ -209,6 +166,39 @@ function helperOutput(xml: string): string {
   ].join('\n');
 }
 
+function mockScreenshotPayload(payload: Buffer): void {
+  mockRunCmd.mockImplementation(async (_cmd, args) => {
+    if (args.includes('exec-out')) {
+      return { exitCode: 0, stdout: '', stderr: '', stdoutBuffer: payload };
+    }
+    return { exitCode: 0, stdout: '', stderr: '' };
+  });
+}
+
+async function withTempScreenshot(
+  name: string,
+  callback: (outPath: string) => Promise<void>,
+): Promise<void> {
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), name));
+  try {
+    await callback(path.join(tmpDir, 'out.png'));
+  } finally {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  }
+}
+
+function mockAndroidSnapshotXml(xml: string, activityDump = ''): void {
+  mockRunCmd.mockImplementation(async (_cmd, args) => {
+    if (args.includes('exec-out')) {
+      return { exitCode: 0, stdout: xml, stderr: '' };
+    }
+    if (args.includes('dumpsys') && args.includes('activity') && args.includes('top')) {
+      return { exitCode: 0, stdout: activityDump, stderr: '' };
+    }
+    throw new Error(`unexpected args: ${args.join(' ')}`);
+  });
+}
+
 test('dumpUiHierarchy returns streamed XML even when exec-out exits non-zero', async () => {
   const xml =
     '<?xml version="1.0" encoding="UTF-8"?><hierarchy><node text="streamed"/></hierarchy>';
@@ -456,15 +446,7 @@ test('snapshotAndroid preserves hidden scroll content hints in interactive snaps
     '        com.facebook.react.views.view.ReactViewGroup{c V.E...... ........ 0,636-390,804 #3}',
   ].join('\n');
 
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: xml, stderr: '' };
-    }
-    if (args.includes('dumpsys') && args.includes('activity') && args.includes('top')) {
-      return { exitCode: 0, stdout: dump, stderr: '' };
-    }
-    throw new Error(`unexpected args: ${args.join(' ')}`);
-  });
+  mockAndroidSnapshotXml(xml, dump);
 
   const result = await snapshotAndroid(device, { interactiveOnly: true });
   const scrollArea = result.nodes.find((node) => node.type === 'android.widget.ScrollView');
@@ -487,15 +469,7 @@ test('snapshotAndroid keeps generic-id scroll containers in interactive snapshot
   </node>
 </hierarchy>`;
 
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: xml, stderr: '' };
-    }
-    if (args.includes('dumpsys') && args.includes('activity') && args.includes('top')) {
-      return { exitCode: 0, stdout: '', stderr: '' };
-    }
-    throw new Error(`unexpected args: ${args.join(' ')}`);
-  });
+  mockAndroidSnapshotXml(xml);
 
   const result = await snapshotAndroid(device, { interactiveOnly: true });
   const scrollArea = result.nodes.find(
@@ -544,15 +518,7 @@ test('snapshotAndroid derives hidden content hints for interactive snapshots fro
   </node>
 </hierarchy>`;
 
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: xml, stderr: '' };
-    }
-    if (args.includes('dumpsys') && args.includes('activity') && args.includes('top')) {
-      return { exitCode: 0, stdout: '', stderr: '' };
-    }
-    throw new Error(`unexpected args: ${args.join(' ')}`);
-  });
+  mockAndroidSnapshotXml(xml);
 
   const result = await snapshotAndroid(device, { interactiveOnly: true });
   const scrollArea = result.nodes.find((node) => node.type === 'android.widget.ScrollView');
@@ -587,15 +553,7 @@ test('snapshotAndroid preserves bottomed-out hidden-above hints in interactive s
     '        com.facebook.react.views.view.ReactViewGroup{c V.E...... ........ 0,636-390,804 #3}',
   ].join('\n');
 
-  mockRunCmd.mockImplementation(async (_cmd, args) => {
-    if (args.includes('exec-out')) {
-      return { exitCode: 0, stdout: xml, stderr: '' };
-    }
-    if (args.includes('dumpsys') && args.includes('activity') && args.includes('top')) {
-      return { exitCode: 0, stdout: dump, stderr: '' };
-    }
-    throw new Error(`unexpected args: ${args.join(' ')}`);
-  });
+  mockAndroidSnapshotXml(xml, dump);
 
   const result = await snapshotAndroid(device, { interactiveOnly: true });
   const scrollArea = result.nodes.find(