morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4782] [Bug] Android runtime hints disagree with classified bytecode components #2485

New issue

Closed

opened 2026-10-17 21:05:33 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-17 21:05:33 +00:00

Owner

Originally created by @morluto on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4782

Before submitting

Searched open and closed reports for Android runtime/DEX/class mismatches.
Only authored fixture paths and harmless text appear here.

Area

Evidence, artifacts, or reconstruction

Observed behavior

A ZIP APK containing AndroidManifest.xml, assets/.dex and assets/.class (all harmless regular text files) returns empty components.dex and components.jvm_classes but runtime_families: ["dalvik-art", "java-kotlin"]. The built inspect-artifact and project-android-application-graph CLI commands both succeed.

Reproduction

Executed once before the fix:

Write the three members above with zip.js into dot-names.apk.
Run node scripts/rea.mjs inspect-artifact dot-names.apk --json.
Wrap the returned inspection Evidence as {"inventory_evidence":[<Evidence>]} and pass it to node scripts/rea.mjs project-android-application-graph <input-json> --json.
Observe the empty bytecode component arrays and the two runtime hints above.

The new local regression tests/acceptance/applications/androidRuntimeComponentHints.test.ts checks the component arrays before the failing runtime assertion. Its named-file control and MCP path are proposed checks at report time; the first assertion failure prevented reaching them.

Expected behavior

Runtime hints for these bytecode families should summarize the classified DEX/JVM components. These names do not satisfy the current component owner rule (which requires a name before the suffix). Preserve that rule and derive the summary from its facts rather than reinterpret filenames independently. Named .dex/.class regular-file controls should retain existing path-based hints without requiring bytecode decoding.

Impact and scope

One authored CLI fixture reproduced inconsistent analysis hints. Source inventory remains accessible. Real shipped package frequency and actual VM byte validity are unknown; this report concerns contradictory projection facts, not executed runtimes.

REA version

a425b3e52, a local commit based on main 149a0fc06 with the #3349 directory fix; Android runtime-summary logic is unchanged from main at report time.

Runtime and platform

Node.js 24.18.0, macOS arm64; no deep provider or target execution.

Target and artifact context

Authored APK ZIP with three harmless text files.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

The built CLI regression passes both empty-component assertions, then fails with expected [], received ["dalvik-art", "java-kotlin"] for runtime_families. Source: classify and runtimeFamilies in src/domain/android/androidApplication.ts use different filename rules.

Typed outcome or recovery expected

Empty bytecode lists produce no DEX/JVM runtime hints; named-file controls retain their components/hints. Check equivalent CLI/MCP replies and preserve source Evidence.

Analysis or suspected cause

Source-derived: component regexes require a basename before .dex/.class, while runtime summaries independently use endsWith. Proposed structural fix: consume the classified lists.

Additional context

Found during #3350 (Harmony's classified JavaScript loses its runtime hint). #3349 concerns directory components, while this fixture contains regular files and still fails after the directory fix.

Originally created by @morluto on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4782 ### Before submitting - [x] Searched open and closed reports for Android runtime/DEX/class mismatches. - [x] Only authored fixture paths and harmless text appear here. ### Area Evidence, artifacts, or reconstruction ### Observed behavior A ZIP APK containing `AndroidManifest.xml`, `assets/.dex` and `assets/.class` (all harmless regular text files) returns empty `components.dex` and `components.jvm_classes` but `runtime_families: ["dalvik-art", "java-kotlin"]`. The built `inspect-artifact` and `project-android-application-graph` CLI commands both succeed. ### Reproduction Executed once before the fix: 1. Write the three members above with zip.js into `dot-names.apk`. 2. Run `node scripts/rea.mjs inspect-artifact dot-names.apk --json`. 3. Wrap the returned inspection Evidence as `{"inventory_evidence":[<Evidence>]}` and pass it to `node scripts/rea.mjs project-android-application-graph <input-json> --json`. 4. Observe the empty bytecode component arrays and the two runtime hints above. The new local regression `tests/acceptance/applications/androidRuntimeComponentHints.test.ts` checks the component arrays before the failing runtime assertion. Its named-file control and MCP path are proposed checks at report time; the first assertion failure prevented reaching them. ### Expected behavior Runtime hints for these bytecode families should summarize the classified DEX/JVM components. These names do not satisfy the current component owner rule (which requires a name before the suffix). Preserve that rule and derive the summary from its facts rather than reinterpret filenames independently. Named `.dex`/`.class` regular-file controls should retain existing path-based hints without requiring bytecode decoding. ### Impact and scope One authored CLI fixture reproduced inconsistent analysis hints. Source inventory remains accessible. Real shipped package frequency and actual VM byte validity are unknown; this report concerns contradictory projection facts, not executed runtimes. ### REA version a425b3e52, a local commit based on main 149a0fc06 with the #3349 directory fix; Android runtime-summary logic is unchanged from main at report time. ### Runtime and platform Node.js 24.18.0, macOS arm64; no deep provider or target execution. ### Target and artifact context Authored APK ZIP with three harmless text files. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence The built CLI regression passes both empty-component assertions, then fails with expected `[]`, received `["dalvik-art", "java-kotlin"]` for runtime_families. Source: `classify` and `runtimeFamilies` in `src/domain/android/androidApplication.ts` use different filename rules. ### Typed outcome or recovery expected Empty bytecode lists produce no DEX/JVM runtime hints; named-file controls retain their components/hints. Check equivalent CLI/MCP replies and preserve source Evidence. ### Analysis or suspected cause Source-derived: component regexes require a basename before `.dex`/`.class`, while runtime summaries independently use `endsWith`. Proposed structural fix: consume the classified lists. ### Additional context Found during #3350 (Harmony's classified JavaScript loses its runtime hint). #3349 concerns directory components, while this fixture contains regular files and still fails after the directory fix.

bsakaguchi

2026-10-17 21:05:33 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-17 21:05:36 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed on main by fc935d0df. Adapted @eco-null's proposal and regressions from #3627 and completed the related Android consumer cleanup (#4782). This is not a PR merge/readiness attestation.

Harmony's Ark/JavaScript and Android's DEX/JVM summaries now consume their classified component lists. The independent filename checks and Harmony's copied/lowercased path array were removed. Native byte-format and framework path-convention rules retain their existing semantics.

Before the fix, six Harmony assertions fail (five additional source extensions plus the public journey), and the Android built CLI reports two runtime hints with empty bytecode lists. The fix passes all eight JavaScript-extension controls, unrelated content, Android dot-name and normal-name controls, HAP/HSP/App Pack public session lifecycles, and equivalent CLI/MCP projections. Final combined validation at fc935d0df:91focused checks in9files; build,check:fast/typecheck/lint,docs:check (5README checks) and hooks pass. Two read-only reviews found no blocker.

36 completed actual built public CLI projection tasks compared an isolated baseline at a425b3e52 with the candidate using6 genuine tiny authored inventories. First processes were separated from2alternating repeats. Repeated-process medians:

Task	Full reply tokens	Elapsed ms	CPU ms	OS peak MB
harmony-jsx	1131→1134	365.79→363.27	562.03→559.96	353.88→353.26
harmony-js	1130→1130	362.28→356.24	530.91→548.86	343.72→353.39
harmony-none	1043→1043	365.92→366.22	563.17→555.34	354.05→349.92
harmony-ark	1109→1109	364.47→365.48	554.86→558.29	350.21→353.15
android-dot	891→884	369.94→363.21	562.75→568.81	354.07→353.26
android-named	1077→1077	363.68→360.51	551.37→560.42	349.05→353.09

Four ordinary control replies, including Evidence/projection IDs, are byte-identical. Tokens are full stdout cl100k_base estimates. CPU uses OSwait4; both sampled process-family RSS and OSprocess peak were recorded. These projection workflows launch no target/provider, and no descendants were observed. Sampled peaks can miss brief peaks; no statistical speed improvement or true-cold claim. Whole-agent/catalog/MCP, inventorygeneration, large-input and failure costs remain unmeasured. The owned baseline worktree was removed normally. No heavy profiling or published npm verification.

@morluto commented on GitHub (Oct 17, 2026): Fixed on main by fc935d0df. Adapted @eco-null's proposal and regressions from #3627 and completed the related Android consumer cleanup (#4782). This is not a PR merge/readiness attestation. Harmony's Ark/JavaScript and Android's DEX/JVM summaries now consume their classified component lists. The independent filename checks and Harmony's copied/lowercased path array were removed. Native byte-format and framework path-convention rules retain their existing semantics. Before the fix, six Harmony assertions fail (five additional source extensions plus the public journey), and the Android built CLI reports two runtime hints with empty bytecode lists. The fix passes all eight JavaScript-extension controls, unrelated content, Android dot-name and normal-name controls, HAP/HSP/App Pack public session lifecycles, and equivalent CLI/MCP projections. Final combined validation at fc935d0df:91focused checks in9files; build,check:fast/typecheck/lint,docs:check (5README checks) and hooks pass. Two read-only reviews found no blocker. 36 completed actual built public CLI projection tasks compared an isolated baseline at a425b3e52 with the candidate using6 genuine tiny authored inventories. First processes were separated from2alternating repeats. Repeated-process medians: | Task | Full reply tokens | Elapsed ms | CPU ms | OS peak MB | | --- | --- | --- | --- | --- | | harmony-jsx | 1131→1134 | 365.79→363.27 | 562.03→559.96 | 353.88→353.26 | | harmony-js | 1130→1130 | 362.28→356.24 | 530.91→548.86 | 343.72→353.39 | | harmony-none | 1043→1043 | 365.92→366.22 | 563.17→555.34 | 354.05→349.92 | | harmony-ark | 1109→1109 | 364.47→365.48 | 554.86→558.29 | 350.21→353.15 | | android-dot | 891→884 | 369.94→363.21 | 562.75→568.81 | 354.07→353.26 | | android-named | 1077→1077 | 363.68→360.51 | 551.37→560.42 | 349.05→353.09 | Four ordinary control replies, including Evidence/projection IDs, are byte-identical. Tokens are full stdout cl100k_base estimates. CPU uses OSwait4; both sampled process-family RSS and OSprocess peak were recorded. These projection workflows launch no target/provider, and no descendants were observed. Sampled peaks can miss brief peaks; no statistical speed improvement or true-cold claim. Whole-agent/catalog/MCP, inventorygeneration, large-input and failure costs remain unmeasured. The owned baseline worktree was removed normally. No heavy profiling or published npm verification.

bsakaguchi referenced this issue

2026-10-31 01:05:16 +00:00

[PR #2485] [CLOSED] feat: add local research intake and mobile evidence tools #5264

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2485

No description provided.

Rows
Columns