morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4768] [Bug] Apktool resource Evidence loses the decoded APK subject identity #2479

New issue

Closed

opened 2026-10-17 21:05:26 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-17 21:05:26 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4768

Before submitting

Searched open and closed issues for related Apktool/subject/identity reports.
Included only public target data and portable paths; no credentials.

Area / interface / earliest failure stage

Evidence, artifacts, or reconstruction / MCP (CLI shares the same application workflow) / artifact or evidence registration.

Observed behavior

Real decode_android_resources MCP calls return a valid normalized_result.target.sha256, but subject: null and the limitation Artifact identity is unavailable for this observation. This drops an already established snapshot identity at the provider-to-Evidence boundary. Observed on both public APKs below, with and without strings and with locale: "de".

Reproduction

Supply a full JDK and an Apktool launcher through REA_APKTOOL_COMMAND.
Start the production stdio MCP server (node scripts/rea.mjs --mcp).
Call decode_android_resources with { "path": "/path/NewPipe_v0.29.1.apk", "include_strings": false }.
Observe subject: null while the normalized target digest is 18447bfb1e06d113edc88df93f471827280de06f6f3d4dc42f56f28b9c1bab79.

Expected behavior

The producer should supply the identity it computed from its owned immutable APK snapshot to shared Evidence assembly. subject.digest.sha256 should agree with normalized_result.target.sha256; launcher inspection has no APK subject. Do not re-read the mutable caller path to reconstruct identity after decoding.

Impact and scope

Generic Evidence consumers cannot bind successful resource observations to the APK subject. The target digest itself remains present in the normalized result. Runtime verification here is Linux MCP; Windows and macOS are unverified. Last known good revision: NOT_ENOUGH_INFO.

REA version / runtime / target context

Source 9c56d09c05356c74a7000e4c558ac293639ea33f, Node 24.18.0, npm 11.16.0, Linux x86-64, Temurin 21.0.12.1+1, official Apktool 3.0.3 (512 MiB heap, one JVM processor).

NewPipe v0.29.1: 11,507,122 bytes, SHA-256 above.
Appium ApiDemos v6.0.18: 6,521,217 bytes, SHA-256 a9eecf37b26cd084855c530db81c2bb1b91f4c1b095a04f47aa7c20e2791f686.

Both downloaded/existing artifact digests were checked; APKs were never installed or executed. Bounded process-family runs completed and cleaned up with zero OOM events.

Analysis (source-derived)

ApktoolProvider.decodeResources constructs target but omits AnalysisExecution.subject. executeProviderOperation correctly honors the provider subject. Fix the producing boundary rather than teaching CLI/MCP to reinterpret normalized JSON. Repeated resource decoding is a separate performance investigation.

Originally created by @N0zoM1z0 on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4768 ### Before submitting - [x] Searched open and closed issues for related Apktool/subject/identity reports. - [x] Included only public target data and portable paths; no credentials. ### Area / interface / earliest failure stage Evidence, artifacts, or reconstruction / MCP (CLI shares the same application workflow) / artifact or evidence registration. ### Observed behavior Real `decode_android_resources` MCP calls return a valid `normalized_result.target.sha256`, but `subject: null` and the limitation `Artifact identity is unavailable for this observation.` This drops an already established snapshot identity at the provider-to-Evidence boundary. Observed on both public APKs below, with and without strings and with `locale: "de"`. ### Reproduction 1. Supply a full JDK and an Apktool launcher through `REA_APKTOOL_COMMAND`. 2. Start the production stdio MCP server (`node scripts/rea.mjs --mcp`). 3. Call `decode_android_resources` with `{ "path": "/path/NewPipe_v0.29.1.apk", "include_strings": false }`. 4. Observe `subject: null` while the normalized target digest is `18447bfb1e06d113edc88df93f471827280de06f6f3d4dc42f56f28b9c1bab79`. ### Expected behavior The producer should supply the identity it computed from its owned immutable APK snapshot to shared Evidence assembly. `subject.digest.sha256` should agree with `normalized_result.target.sha256`; launcher inspection has no APK subject. Do not re-read the mutable caller path to reconstruct identity after decoding. ### Impact and scope Generic Evidence consumers cannot bind successful resource observations to the APK subject. The target digest itself remains present in the normalized result. Runtime verification here is Linux MCP; Windows and macOS are unverified. Last known good revision: NOT_ENOUGH_INFO. ### REA version / runtime / target context Source `9c56d09c05356c74a7000e4c558ac293639ea33f`, Node 24.18.0, npm 11.16.0, Linux x86-64, Temurin 21.0.12.1+1, official Apktool 3.0.3 (512 MiB heap, one JVM processor). - [NewPipe v0.29.1](https://github.com/TeamNewPipe/NewPipe/releases/tag/v0.29.1): 11,507,122 bytes, SHA-256 above. - [Appium ApiDemos v6.0.18](https://github.com/appium/android-apidemos/releases/tag/v6.0.18): 6,521,217 bytes, SHA-256 `a9eecf37b26cd084855c530db81c2bb1b91f4c1b095a04f47aa7c20e2791f686`. Both downloaded/existing artifact digests were checked; APKs were never installed or executed. Bounded process-family runs completed and cleaned up with zero OOM events. ### Analysis (source-derived) [`ApktoolProvider.decodeResources`](https://github.com/morluto/rea/blob/9c56d09c05356c74a7000e4c558ac293639ea33f/src/apktool/ApktoolProvider.ts#L784) constructs `target` but omits `AnalysisExecution.subject`. [`executeProviderOperation`](https://github.com/morluto/rea/blob/9c56d09c05356c74a7000e4c558ac293639ea33f/src/application/ProviderOperationExecution.ts#L61) correctly honors the provider subject. Fix the producing boundary rather than teaching CLI/MCP to reinterpret normalized JSON. Repeated resource decoding is a separate performance investigation.

bsakaguchi

2026-10-17 21:05:26 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-17 21:05:28 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 17, 2026):

Fixed and merged in #4771 (e5ee3ac658cd10ba23700e1757c86ce0a4520406). The producer now passes its owned snapshot identity to shared CLI/MCP Evidence assembly; the mutation regression verifies that identity does not switch to the changed original file.

All required CI checks passed; Greptile 5/5 with no review threads. Codex automatic review was unavailable because of the repository quota. After merge, rebuilt the actual merged revision and reran all 36 focused tests plus real CLI/MCP NewPipe/ApiDemos decoding (including German partial coverage): all passed, normalized facts unchanged, cleanup verified. Real Windows/macOS Apktool verification remains unavailable. Both requested co-author trailers are present in the squash commit.

@N0zoM1z0 commented on GitHub (Oct 17, 2026): Fixed and merged in #4771 (`e5ee3ac658cd10ba23700e1757c86ce0a4520406`). The producer now passes its owned snapshot identity to shared CLI/MCP Evidence assembly; the mutation regression verifies that identity does not switch to the changed original file. All required CI checks passed; Greptile 5/5 with no review threads. Codex automatic review was unavailable because of the repository quota. After merge, rebuilt the actual merged revision and reran all 36 focused tests plus real CLI/MCP NewPipe/ApiDemos decoding (including German partial coverage): all passed, normalized facts unchanged, cleanup verified. Real Windows/macOS Apktool verification remains unavailable. Both requested co-author trailers are present in the squash commit.

bsakaguchi referenced this issue

2026-10-31 01:05:14 +00:00

[PR #2480] [MERGED] fix(browser): distinguish SVG links from HTML XLink attributes #5260

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2479

No description provided.

Rows
Columns