[GH-ISSUE #5498] [Docs] Android skill reference incorrectly excludes JADX from doctor #3347

New issue

Closed

opened 2026-10-31 00:39:24 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:39:24 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5498

Before submitting

I searched the existing issues for a related documentation report.
I removed credentials, tokens, private paths, and sensitive target data.

Documentation location

.agents/skills/reverse-engineer-anything/references/android-applications.md:16-20, reached through the Android guide link in the skill's SKILL.md:357-358. The generated skills/reverse-engineer-anything/references/android-applications.md:16-20 has the same passage.

Problem

The prerequisite paragraph says doctor provider scopes cover Hopper/Ghidra rather than JADX. However, rea doctor --provider jadx --json accepts the provider and returns a scoped JADX configuration check with actionable remediation. The reference can misdirect Android users or agents recovering from missing prerequisites. The documentation contradiction was independently reproduced; an actual abandoned or blocked Android task was not observed.

Expected content

Proposed replacement for the doctor guidance: “Use rea doctor --provider jadx --json to check the JADX configuration and obtain remediation for missing prerequisites. Java and the headless JADX MCP JAR remain caller-supplied; REA does not install them. Configuration readiness does not establish successful analysis of a particular APK.”

This matches the provider-scoped diagnostic documented in docs/cli.md:191-194 and the observed missing-JAR result. Correct the authored reference and regenerate its bundled copy.

Supporting evidence

An independent verifier ran the following source-checkout command with no inherited JADX configuration and isolated HOME, XDG and temporary roots. The missing-JAR path produced the same result twice; the shell block was also replayed successfully.

repro_root="$(mktemp -d)"
mkdir -p "$repro_root/home" "$repro_root/config" "$repro_root/data" "$repro_root/cache" "$repro_root/state" "$repro_root/temp"
env -i PATH="$PATH" NO_COLOR=1 \
  HOME="$repro_root/home" \
  XDG_CONFIG_HOME="$repro_root/config" \
  XDG_DATA_HOME="$repro_root/data" \
  XDG_CACHE_HOME="$repro_root/cache" \
  XDG_STATE_HOME="$repro_root/state" \
  TMPDIR="$repro_root/temp" \
  node scripts/rea.mjs doctor --provider jadx --json > "$repro_root/doctor.json"
doctor_exit=$?
printf 'exit status: %s\n' "$doctor_exit"
cat "$repro_root/doctor.json"

Selected output, with exit status 1 and empty stderr:

{
  "scope": {
    "mode": "explicit",
    "providers": ["jadx"]
  },
  "scope_checks": [
    {
      "name": "node",
      "ok": true,
      "classification": "healthy"
    },
    {
      "name": "jadx",
      "ok": false,
      "classification": "missing_analysis_engine",
      "remediation": "Set REA_JADX_MCP_JAR to the absolute path of a caller-supplied jadx-headless-mcp 0.7.1 JAR. REA does not download or install it."
    }
  ]
}

The failed readiness check is expected with REA_JADX_MCP_JAR unset; the defect is the reference's exclusion of the available diagnostic. The verifier confirmed the authored and generated references were byte-identical.

Tested REA 6.7.0, source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8, Node v26.12.0 on macOS arm64. REA_JADX_MCP_JAR and JAVA_HOME were absent from the isolated environment. No real JADX engine, passing configuration check or APK analysis was executed.

Submission-time source comparison against main at ee12d517a25d34853d40e31fc039c7d1576c60e1 confirms the misleading passage remains unchanged. This latest-main check was source-only; runtime observations above belong to the tested baseline.

Additional context

Prepared with AI assistance and independently reproduced. The verified workaround is to run the existing scoped doctor command. Related issue #3374 requests the diagnostic capability, while PR #4767 addresses the installation guide's provider list; neither reports this packaged skill passage.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5498 ### Before submitting - [x] I searched the existing issues for a related documentation report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Documentation location `.agents/skills/reverse-engineer-anything/references/android-applications.md:16-20`, reached through the Android guide link in the skill's `SKILL.md:357-358`. The generated `skills/reverse-engineer-anything/references/android-applications.md:16-20` has the same passage. ### Problem The prerequisite paragraph says doctor provider scopes cover Hopper/Ghidra rather than JADX. However, `rea doctor --provider jadx --json` accepts the provider and returns a scoped JADX configuration check with actionable remediation. The reference can misdirect Android users or agents recovering from missing prerequisites. The documentation contradiction was independently reproduced; an actual abandoned or blocked Android task was not observed. ### Expected content Proposed replacement for the doctor guidance: “Use `rea doctor --provider jadx --json` to check the JADX configuration and obtain remediation for missing prerequisites. Java and the headless JADX MCP JAR remain caller-supplied; REA does not install them. Configuration readiness does not establish successful analysis of a particular APK.” This matches the provider-scoped diagnostic documented in `docs/cli.md:191-194` and the observed missing-JAR result. Correct the authored reference and regenerate its bundled copy. ### Supporting evidence An independent verifier ran the following source-checkout command with no inherited JADX configuration and isolated HOME, XDG and temporary roots. The missing-JAR path produced the same result twice; the shell block was also replayed successfully. ```sh repro_root="$(mktemp -d)" mkdir -p "$repro_root/home" "$repro_root/config" "$repro_root/data" "$repro_root/cache" "$repro_root/state" "$repro_root/temp" env -i PATH="$PATH" NO_COLOR=1 \ HOME="$repro_root/home" \ XDG_CONFIG_HOME="$repro_root/config" \ XDG_DATA_HOME="$repro_root/data" \ XDG_CACHE_HOME="$repro_root/cache" \ XDG_STATE_HOME="$repro_root/state" \ TMPDIR="$repro_root/temp" \ node scripts/rea.mjs doctor --provider jadx --json > "$repro_root/doctor.json" doctor_exit=$? printf 'exit status: %s\n' "$doctor_exit" cat "$repro_root/doctor.json" ``` Selected output, with exit status 1 and empty stderr: ```json { "scope": { "mode": "explicit", "providers": ["jadx"] }, "scope_checks": [ { "name": "node", "ok": true, "classification": "healthy" }, { "name": "jadx", "ok": false, "classification": "missing_analysis_engine", "remediation": "Set REA_JADX_MCP_JAR to the absolute path of a caller-supplied jadx-headless-mcp 0.7.1 JAR. REA does not download or install it." } ] } ``` The failed readiness check is expected with `REA_JADX_MCP_JAR` unset; the defect is the reference's exclusion of the available diagnostic. The verifier confirmed the authored and generated references were byte-identical. Tested REA 6.7.0, source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`, Node v26.12.0 on macOS arm64. `REA_JADX_MCP_JAR` and `JAVA_HOME` were absent from the isolated environment. No real JADX engine, passing configuration check or APK analysis was executed. Submission-time source comparison against `main` at `ee12d517a25d34853d40e31fc039c7d1576c60e1` confirms the misleading passage remains unchanged. This latest-main check was source-only; runtime observations above belong to the tested baseline. ### Additional context Prepared with AI assistance and independently reproduced. The verified workaround is to run the existing scoped doctor command. Related issue #3374 requests the diagnostic capability, while PR #4767 addresses the installation guide's provider list; neither reports this packaged skill passage.

bsakaguchi closed this issue

2026-10-31 00:39:24 +00:00

bsakaguchi commented

2026-10-31 00:39:25 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Verified resolved on main at d87e73f2db.

The authored Android reference now explicitly recommends rea doctor --provider jadx --json, explains that Java and the headless JADX MCP JAR remain caller-supplied, and distinguishes configuration readiness from successful APK analysis.

I built this revision and confirmed that the generated reference is byte-identical to the authored reference. I also ran the documented command in an isolated environment without JADX configuration: it selects the explicit jadx scope and returns the expected missing-engine check and REA_JADX_MCP_JAR remediation. No APK analysis or real JADX engine was needed for this documentation check. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Verified resolved on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. The [authored Android reference](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/.agents/skills/reverse-engineer-anything/references/android-applications.md#L16-L22) now explicitly recommends `rea doctor --provider jadx --json`, explains that Java and the headless JADX MCP JAR remain caller-supplied, and distinguishes configuration readiness from successful APK analysis. I built this revision and confirmed that the generated reference is byte-identical to the authored reference. I also ran the documented command in an isolated environment without JADX configuration: it selects the explicit `jadx` scope and returns the expected missing-engine check and `REA_JADX_MCP_JAR` remediation. No APK analysis or real JADX engine was needed for this documentation check. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 00:40:30 +00:00

[GH-ISSUE #5690] [Bug] Apktool version-output overflow is reported as an unusable launcher #3440

bsakaguchi referenced this issue

2026-10-31 00:40:30 +00:00

[GH-ISSUE #5689] [Bug] inspect-adb-client hides execution failures behind a version diagnostic #3441

bsakaguchi referenced this issue

2026-10-31 00:40:32 +00:00

[GH-ISSUE #5691] [Bug] Objdump launch failures recommend changing the target or fixing read access #3444

bsakaguchi referenced this issue

2026-10-31 00:42:41 +00:00

[GH-ISSUE #5978] [Bug] Apktool classifies an APK changed during snapshot copying as invalid_request #3646