morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #908] [MERGED] fix(android)!: preserve JVM settings and reuse metadata sessions #2336

New issue

Closed

opened 2026-10-16 21:17:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/908
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: codex/android-performance-893

📝 Commits (2)

5eea313 perf(graph): avoid repeated traversal edge scans and copies
98f8e29 fix(android)!: preserve JVM settings and reuse metadata sessions

📊 Changes

36 files changed (+1165 additions, -138 deletions)

View changed files

📝 README.md (+2 -2)
➕ bridge/android/ReaJadxBridge.java (+247 -0)
📝 docs/android-analysis.md (+41 -10)
📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 package.json (+1 -0)
📝 scripts/verify/android/analysis.mjs (+11 -0)
📝 scripts/verify/android/cli-cancellation.mjs (+1 -1)
➕ scripts/verify/android/metadata.mjs (+64 -0)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/android/AndroidTargetSnapshot.ts (+13 -2)
📝 src/android/JadxAnalysis.ts (+5 -4)
📝 src/android/JadxConfiguration.ts (+23 -2)
📝 src/android/JadxMcpTransport.ts (+11 -5)
📝 src/android/JadxProtocol.ts (+8 -0)
📝 src/android/JadxProvider.ts (+157 -41)
📝 src/android/JadxRelease.ts (+6 -5)
📝 src/android/JadxSession.ts (+42 -17)
📝 src/application/android/AndroidAnalysisPort.ts (+2 -0)
📝 src/cli/androidCommands.ts (+10 -3)

...and 16 more files

📄 Description

Summary

Android inspection now preserves caller JVM settings, reuses an owned session, and reads class metadata without decompiling application source. Graph traversal avoids repeated edge scans and adjacency copies.

Fixes #901. Refs #893. The reproduced upstream metadata defect is tracked in jadx-headless-mcp#39.

Problem and expected behavior

REA forced a 512 MiB heap and one visible CPU, overriding caller settings and constraining JVM ergonomics. Each operation started another JVM. A class metadata request also reached upstream getters that trigger source generation. Metadata inspection should preserve the caller's configuration and leave class bodies unloaded; related requests should safely reuse the admitted APK.

Change and scope

Launch with standard JVM environment precedence; add heap/processor flags only for explicit REA configuration. Keep the single JADX worker independent of JVM CPU visibility.
Serialize requests through one immutable, digest-verified session. Retire it on target/configuration changes, idle expiry, failure, cancellation, disconnect, or shutdown, and join owned cleanup.
Package a REA-owned Java source bridge around the unchanged upstream JAR. Read parsed metadata directly, freeze member identities, retain generic types, select overloads by exact identity, and paginate indexed class names.
Reset retained captures between operations while preserving per-operation output bounds and request-local Evidence.
Append JavaScript adjacency entries and index native edges once per traversal direction.

The OpenJDK investigation found expected option precedence and GC ergonomics; it did not establish a JVM defect warranting an OpenJDK patch.

Contract and boundary impact

Semantic owner and earliest changed stage: Android launch configuration and provider admission; graph adjacency construction remains in the domain.
CLI and MCP/tool-catalog contract: existing Android tools share the same implementation; descriptions disclose parsed-member coverage and lifecycle. Effective runtime settings appear in evidence.
Provider, bridge, target-format, or platform compatibility: audited JADX MCP 0.7.1 JAR stays unchanged. The packaged bridge requires a full JDK 17+ with its compiler module.
Evidence, artifact, provenance, or reconstruction contract: APK, engine, and bridge identities are verified; aliases and overload identities remain stable; incomplete or ambiguous results retain explicit limitations.
Process execution, authorization, cleanup, or containment impact: one owned serialized JVM, bounded operation output, joined cancellation/shutdown; uncertain cleanup blocks replacement and preserves its workspace.
Generated metadata, package, or installation impact: canonical descriptions and generated catalogs are updated; package includes bridge source. No dependency or toolchain installation is added.

Evidence and regression coverage

Tests cover configuration precedence, session reuse/retirement, immutable request evidence, queued and active cancellation, cleanup failures, output bounds, malformed protocol, overload selection, and graph semantics.
Real-JAR regression proves all 5,700 public-fixture classes remain NOT_LOADED after metadata inspection; generic types and three real overload bodies remain correct after generation.
On macOS arm64/JDK 21, public ApiDemos cold class inspection median fell from 9,683 to 1,587 ms (three samples). Warm operations took approximately 30–39 ms, and 15 related operations used one JVM. Baseline forced 512 MiB/one CPU; new defaults used normal JVM ergonomics, so this measures the combined change.
Synthetic function benchmarks: 16,000-edge JavaScript star, 189.22 → 4.67 ms; native 50,000 edges/1,500 reachable nodes, 414.04 → 5.38 ms. These are internal traversal measurements. Results matched the base in 360 JavaScript and 720 native randomized comparisons.
Representative real CLI evidence excerpt with caller JAVA_TOOL_OPTIONS=-Xmx8g:

{"engine":{"name":"jadx-headless-mcp","version":"0.7.1","worker_count":1,"heap_limit_mib":8192}}

Remaining proof gaps: the reporter's private 133 MB/11-DEX APK, Linux, and JDK 25 remain unverified. Public-fixture success does not prove its load-time OOM is resolved.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run check:fast — typecheck and lint passed after rebasing onto current main.
npm run test:focused -- <11 affected test files> — 75 passed; one host-dependent firmware test skipped.
npm run docs:generate and npm run docs:check — generated metadata aligned with current main and passed.
git diff --check origin/main...HEAD — passed.
npm run verify:android with OpenJDK 21, audited JAR, and public ApiDemos APK — real CLI/MCP, metadata, and cancellation checks passed after rebase.
Before rebase, npm pack artifact ran all five Android CLI/MCP operations, metadata regression, and SIGTERM cleanup successfully, with repository-installed dependencies linked into the extracted package.

Compatibility, safety, and release

Breaking change: configure a full JDK 17+ rather than a runtime-only Java installation. The PR title marks this release impact.
Real provider/OS coverage: macOS arm64 and OpenJDK 21; no real Hopper, Ghidra, IDA, or browser verification was performed for this change.
Package impact: Java bridge source is shipped; APKs, JARs, generated binaries, and local profiling artifacts are excluded.
Review: repeated independent lifecycle and Java metadata reviews finished without actionable findings. Caller evidence is retained, transport credentials remain protected, and the ambient environment is not persisted.

Review checklist

The PR has one focused outcome and a Conventional Commit title.
Related issues are linked.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated.
User-visible CLI/MCP changes include representative output.
Final diff checked for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/908 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/android-performance-893` --- ### 📝 Commits (2) - [`5eea313`](https://github.com/morluto/rea/commit/5eea313a36782eef68455d21e06b0f3e0fd51b8e) perf(graph): avoid repeated traversal edge scans and copies - [`98f8e29`](https://github.com/morluto/rea/commit/98f8e29177bf69e44a2bd303226bb6345ce0ad6a) fix(android)!: preserve JVM settings and reuse metadata sessions ### 📊 Changes **36 files changed** (+1165 additions, -138 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+2 -2) ➕ `bridge/android/ReaJadxBridge.java` (+247 -0) 📝 `docs/android-analysis.md` (+41 -10) 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `package.json` (+1 -0) 📝 `scripts/verify/android/analysis.mjs` (+11 -0) 📝 `scripts/verify/android/cli-cancellation.mjs` (+1 -1) ➕ `scripts/verify/android/metadata.mjs` (+64 -0) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/android/AndroidTargetSnapshot.ts` (+13 -2) 📝 `src/android/JadxAnalysis.ts` (+5 -4) 📝 `src/android/JadxConfiguration.ts` (+23 -2) 📝 `src/android/JadxMcpTransport.ts` (+11 -5) 📝 `src/android/JadxProtocol.ts` (+8 -0) 📝 `src/android/JadxProvider.ts` (+157 -41) 📝 `src/android/JadxRelease.ts` (+6 -5) 📝 `src/android/JadxSession.ts` (+42 -17) 📝 `src/application/android/AndroidAnalysisPort.ts` (+2 -0) 📝 `src/cli/androidCommands.ts` (+10 -3) _...and 16 more files_ </details> ### 📄 Description ## Summary Android inspection now preserves caller JVM settings, reuses an owned session, and reads class metadata without decompiling application source. Graph traversal avoids repeated edge scans and adjacency copies. Fixes #901. Refs #893. The reproduced upstream metadata defect is tracked in [jadx-headless-mcp#39](https://github.com/1013503897/jadx-headless-mcp/issues/39). ## Problem and expected behavior REA forced a 512 MiB heap and one visible CPU, overriding caller settings and constraining JVM ergonomics. Each operation started another JVM. A class metadata request also reached upstream getters that trigger source generation. Metadata inspection should preserve the caller's configuration and leave class bodies unloaded; related requests should safely reuse the admitted APK. ## Change and scope - Launch with standard JVM environment precedence; add heap/processor flags only for explicit REA configuration. Keep the single JADX worker independent of JVM CPU visibility. - Serialize requests through one immutable, digest-verified session. Retire it on target/configuration changes, idle expiry, failure, cancellation, disconnect, or shutdown, and join owned cleanup. - Package a REA-owned Java source bridge around the unchanged upstream JAR. Read parsed metadata directly, freeze member identities, retain generic types, select overloads by exact identity, and paginate indexed class names. - Reset retained captures between operations while preserving per-operation output bounds and request-local Evidence. - Append JavaScript adjacency entries and index native edges once per traversal direction. The OpenJDK investigation found expected option precedence and GC ergonomics; it did not establish a JVM defect warranting an OpenJDK patch. ## Contract and boundary impact - Semantic owner and earliest changed stage: Android launch configuration and provider admission; graph adjacency construction remains in the domain. - CLI and MCP/tool-catalog contract: existing Android tools share the same implementation; descriptions disclose parsed-member coverage and lifecycle. Effective runtime settings appear in evidence. - Provider, bridge, target-format, or platform compatibility: audited JADX MCP 0.7.1 JAR stays unchanged. The packaged bridge requires a full JDK 17+ with its compiler module. - Evidence, artifact, provenance, or reconstruction contract: APK, engine, and bridge identities are verified; aliases and overload identities remain stable; incomplete or ambiguous results retain explicit limitations. - Process execution, authorization, cleanup, or containment impact: one owned serialized JVM, bounded operation output, joined cancellation/shutdown; uncertain cleanup blocks replacement and preserves its workspace. - Generated metadata, package, or installation impact: canonical descriptions and generated catalogs are updated; package includes bridge source. No dependency or toolchain installation is added. ## Evidence and regression coverage - Tests cover configuration precedence, session reuse/retirement, immutable request evidence, queued and active cancellation, cleanup failures, output bounds, malformed protocol, overload selection, and graph semantics. - Real-JAR regression proves all 5,700 public-fixture classes remain `NOT_LOADED` after metadata inspection; generic types and three real overload bodies remain correct after generation. - On macOS arm64/JDK 21, public ApiDemos cold class inspection median fell from 9,683 to 1,587 ms (three samples). Warm operations took approximately 30–39 ms, and 15 related operations used one JVM. Baseline forced 512 MiB/one CPU; new defaults used normal JVM ergonomics, so this measures the combined change. - Synthetic function benchmarks: 16,000-edge JavaScript star, 189.22 → 4.67 ms; native 50,000 edges/1,500 reachable nodes, 414.04 → 5.38 ms. These are internal traversal measurements. Results matched the base in 360 JavaScript and 720 native randomized comparisons. - Representative real CLI evidence excerpt with caller `JAVA_TOOL_OPTIONS=-Xmx8g`: ```json {"engine":{"name":"jadx-headless-mcp","version":"0.7.1","worker_count":1,"heap_limit_mib":8192}} ``` - Remaining proof gaps: the reporter's private 133 MB/11-DEX APK, Linux, and JDK 25 remain unverified. Public-fixture success does not prove its load-time OOM is resolved. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:fast` — typecheck and lint passed after rebasing onto current main. - `npm run test:focused -- <11 affected test files>` — 75 passed; one host-dependent firmware test skipped. - `npm run docs:generate` and `npm run docs:check` — generated metadata aligned with current main and passed. - `git diff --check origin/main...HEAD` — passed. - `npm run verify:android` with OpenJDK 21, audited JAR, and public ApiDemos APK — real CLI/MCP, metadata, and cancellation checks passed after rebase. - Before rebase, `npm pack` artifact ran all five Android CLI/MCP operations, metadata regression, and SIGTERM cleanup successfully, with repository-installed dependencies linked into the extracted package. ## Compatibility, safety, and release - Breaking change: configure a full JDK 17+ rather than a runtime-only Java installation. The PR title marks this release impact. - Real provider/OS coverage: macOS arm64 and OpenJDK 21; no real Hopper, Ghidra, IDA, or browser verification was performed for this change. - Package impact: Java bridge source is shipped; APKs, JARs, generated binaries, and local profiling artifacts are excluded. - Review: repeated independent lifecycle and Java metadata reviews finished without actionable findings. Caller evidence is retained, transport credentials remain protected, and the ambient environment is not persisted. ## Review checklist - [x] The PR has one focused outcome and a Conventional Commit title. - [x] Related issues are linked. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated. - [x] User-visible CLI/MCP changes include representative output. - [x] Final diff checked for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:28 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:04:32 +00:00

[PR #2336] [MERGED] fix(ci): run the Windows native lane with its process boundary fixture #5171

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2336

No description provided.

Rows
Columns