[PR #1447] [MERGED] feat(harmony): project HarmonyOS package inventory evidence #2893

New issue

Closed

opened 2026-10-17 21:11:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:11:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1447
Author: @BaaRai
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: feat/harmony-package-inventory

📝 Commits (4)

7e26002 feat(harmony): project HarmonyOS package inventory evidence
b1f70d8 refactor(domain): share application graph projection scaffolding
e5dbdeb fix(harmony): address review, stable app-pack roots, and rotated fixture
85a32e4 fix(harmony): preserve inventory coverage and resolve main conflicts

📊 Changes

30 files changed (+1288 additions, -109 deletions)

View changed files

➕ docs/harmony-analysis.md (+79 -0)
📝 docs/testing.md (+12 -0)
📝 package.json (+2 -0)
➕ scripts/fixtures/harmony/fetch.mjs (+71 -0)
➕ scripts/fixtures/harmony/pipeline.json (+16 -0)
➕ scripts/verify/harmony/analysis.mjs (+179 -0)
📝 src/application/BinaryTargetResolver.ts (+5 -1)
📝 src/application/InvestigationProviders.ts (+7 -0)
➕ src/application/harmony/HarmonyApplicationService.ts (+28 -0)
📝 src/artifacts/inventory/ArtifactGraphConstruction.ts (+3 -3)
📝 src/artifacts/inventory/classify.ts (+11 -9)
📝 src/artifacts/inventory/reader.ts (+7 -12)
📝 src/cli/applicationCommands.ts (+17 -0)
📝 src/cliCommandNames.ts (+1 -0)
📝 src/contracts/applicationToolContracts.ts (+24 -0)
📝 src/contracts/mobileApplicationGraphExamples.ts (+21 -1)
📝 src/contracts/toolEffects.ts (+1 -0)
📝 src/domain/analysisSnapshot.ts (+3 -0)
📝 src/domain/android/androidApplication.ts (+29 -68)
📝 src/domain/apple/appleApplication.ts (+7 -11)

...and 10 more files

📄 Description

Implements the package-identification and inventory increment of #1431. This is static, provider-free inspection; manifest semantics, Ark decoding, resource resolution, signature verification, and runtime analysis remain deferred.

Behavior

Recognize HAP, HSP, and App Pack roots through the hardened ZIP reader. App Pack .app classification requires ZIP magic and applies only to root inputs; nested .app ZIP members retain their existing format. HTTP Archive .har handling is unchanged.
Expose project_harmony_application_graph through CLI and MCP. Authenticated inventory Evidence produces deterministic component paths, IDs and hashes, packaging-model path hints, App Pack children, runtime hints, and explicitly hypothetical native bridge candidates.
Include Stage and FA resource layouts. Preserve encrypted or otherwise unavailable occurrence paths with null content identities in unavailable_components, and mark projection coverage partial instead of claiming absence.
Share ZIP-family classification across archive target identity, root occurrence roles, admitted descriptor ownership, reader routing, and non-entry-byte limitations.
Preserve existing Android/Apple projection semantics while sharing their projection scaffolding. Integrate current main's inventory ownership and lazy CLI imports.

Verification

Verified on macOS arm64 with Node 24.18.0 and npm 11.16.0:

67 focused tests passed across Harmony, Android/Apple, ZIP integrity and archive safety, advertised schemas, MCP projection and Evidence retention.
npm run check:fast, npm run docs:check, and architecture guards passed.
The real HAP lane passed against the repository build and a freshly packed and temporarily installed REA package: compiled CLI inspection, deterministic projection, and actual SDK-connected stdio MCP parity.
Verifier workspace cleanup was checked after a command failure before MCP connection.

The fixture is the SHA-256-pinned harmony-next-pipeline 1.0.1 release, from an MIT-licensed source repository. Its pin records source revision, asset ID, byte size and digest; downloaded bytes are not committed or redistributed. This replaces the repeatedly rotated VHome asset. The fixture's compiler/SDK versions and reproducible source-to-artifact build have not been independently established, so the full pinned-toolchain acceptance in #1431 remains open. Bundled component licenses, Ark contents, and signature validity were not independently audited.

The guide now supplies the required inventory_evidence wrapper and documents unavailable coverage and verification boundaries. The verifier removes its workspace on success and failure and bounds downloads to the pinned size.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1447 **Author:** [@BaaRai](https://github.com/BaaRai) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `feat/harmony-package-inventory` --- ### 📝 Commits (4) - [`7e26002`](https://github.com/morluto/rea/commit/7e2600292a0479260218bd6b3998a20f816ea021) feat(harmony): project HarmonyOS package inventory evidence - [`b1f70d8`](https://github.com/morluto/rea/commit/b1f70d8a85798e908a119389d405ebecb1a485af) refactor(domain): share application graph projection scaffolding - [`e5dbdeb`](https://github.com/morluto/rea/commit/e5dbdeb87d4a0f94c8df59cb4c0449ce3403bb3c) fix(harmony): address review, stable app-pack roots, and rotated fixture - [`85a32e4`](https://github.com/morluto/rea/commit/85a32e43a87d4510cf7ee229839fb7b9bf9f76c8) fix(harmony): preserve inventory coverage and resolve main conflicts ### 📊 Changes **30 files changed** (+1288 additions, -109 deletions) <details> <summary>View changed files</summary> ➕ `docs/harmony-analysis.md` (+79 -0) 📝 `docs/testing.md` (+12 -0) 📝 `package.json` (+2 -0) ➕ `scripts/fixtures/harmony/fetch.mjs` (+71 -0) ➕ `scripts/fixtures/harmony/pipeline.json` (+16 -0) ➕ `scripts/verify/harmony/analysis.mjs` (+179 -0) 📝 `src/application/BinaryTargetResolver.ts` (+5 -1) 📝 `src/application/InvestigationProviders.ts` (+7 -0) ➕ `src/application/harmony/HarmonyApplicationService.ts` (+28 -0) 📝 `src/artifacts/inventory/ArtifactGraphConstruction.ts` (+3 -3) 📝 `src/artifacts/inventory/classify.ts` (+11 -9) 📝 `src/artifacts/inventory/reader.ts` (+7 -12) 📝 `src/cli/applicationCommands.ts` (+17 -0) 📝 `src/cliCommandNames.ts` (+1 -0) 📝 `src/contracts/applicationToolContracts.ts` (+24 -0) 📝 `src/contracts/mobileApplicationGraphExamples.ts` (+21 -1) 📝 `src/contracts/toolEffects.ts` (+1 -0) 📝 `src/domain/analysisSnapshot.ts` (+3 -0) 📝 `src/domain/android/androidApplication.ts` (+29 -68) 📝 `src/domain/apple/appleApplication.ts` (+7 -11) _...and 10 more files_ </details> ### 📄 Description Implements the package-identification and inventory increment of #1431. This is static, provider-free inspection; manifest semantics, Ark decoding, resource resolution, signature verification, and runtime analysis remain deferred. ## Behavior - Recognize HAP, HSP, and App Pack roots through the hardened ZIP reader. App Pack `.app` classification requires ZIP magic and applies only to root inputs; nested `.app` ZIP members retain their existing format. HTTP Archive `.har` handling is unchanged. - Expose `project_harmony_application_graph` through CLI and MCP. Authenticated inventory Evidence produces deterministic component paths, IDs and hashes, packaging-model path hints, App Pack children, runtime hints, and explicitly hypothetical native bridge candidates. - Include Stage and FA resource layouts. Preserve encrypted or otherwise unavailable occurrence paths with null content identities in `unavailable_components`, and mark projection coverage partial instead of claiming absence. - Share ZIP-family classification across archive target identity, root occurrence roles, admitted descriptor ownership, reader routing, and non-entry-byte limitations. - Preserve existing Android/Apple projection semantics while sharing their projection scaffolding. Integrate current main's inventory ownership and lazy CLI imports. ## Verification Verified on macOS arm64 with Node 24.18.0 and npm 11.16.0: - 67 focused tests passed across Harmony, Android/Apple, ZIP integrity and archive safety, advertised schemas, MCP projection and Evidence retention. - `npm run check:fast`, `npm run docs:check`, and architecture guards passed. - The real HAP lane passed against the repository build and a freshly packed and temporarily installed REA package: compiled CLI inspection, deterministic projection, and actual SDK-connected stdio MCP parity. - Verifier workspace cleanup was checked after a command failure before MCP connection. The fixture is the SHA-256-pinned harmony-next-pipeline 1.0.1 release, from an MIT-licensed source repository. Its pin records source revision, asset ID, byte size and digest; downloaded bytes are not committed or redistributed. This replaces the repeatedly rotated VHome asset. The fixture's compiler/SDK versions and reproducible source-to-artifact build have not been independently established, so the full pinned-toolchain acceptance in #1431 remains open. Bundled component licenses, Ark contents, and signature validity were not independently audited. The guide now supplies the required `inventory_evidence` wrapper and documents unavailable coverage and verification boundaries. The verifier removes its workspace on success and failure and bounds downloads to the pinned size. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:11:29 +00:00