morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2485] [CLOSED] feat: add local research intake and mobile evidence tools #5264

New issue

Closed

opened 2026-10-31 01:05:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2485
Author: @naresh-tech-backend
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: codex/rea-research-intake-mobile

📝 Commits (1)

b1a9842 feat: add local research intake and mobile evidence tools

📊 Changes

56 files changed (+4048 additions, -34 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+6 -0)
📝 README.md (+4 -0)
📝 bridge/android/ReaJadxBridge.java (+163 -0)
📝 docs/.vitepress/config.ts (+8 -0)
📝 docs/android-analysis.md (+29 -8)
📝 docs/apple-application-analysis.md (+31 -0)
📝 docs/architecture.mermaid (+7 -0)
➕ docs/authorized-security-research-case.md (+66 -0)
➕ docs/authorized-security-research.md (+85 -0)
📝 docs/cli.md (+11 -0)
📝 docs/testing.md (+9 -0)
📝 package-lock.json (+2 -1)
📝 package.json (+11 -1)
➕ research-ui/README.md (+30 -0)
➕ research-ui/app.js (+259 -0)
➕ research-ui/case.js (+287 -0)
➕ research-ui/index.html (+404 -0)
➕ research-ui/styles.css (+636 -0)
➕ scripts/fixtures/ios/DisplayFixture.swift (+37 -0)
➕ scripts/fixtures/ios/Info.plist (+26 -0)

...and 36 more files

📄 Description

Summary

Add a loopback-only research case UI and packaged rea-research-ui command. It records exact program policy, scope, artifact identity, and candidate Evidence; exports JSON, Markdown, and policy text without fetching URLs or running targets.
Extend inspect_android_package with bounded, source-bound structured manifest declarations from the bring-your-own JADX adapter. Declared component attributes are observations; effective exposure remains unknown.
Add capture_ios_simulator_screen through shared CLI/MCP Evidence. It selects one booted simulator by exact UDID, checks identity around capture, and returns a bounded PNG with digest. Foreground app attribution stays unknown.
Correct Mach-O/lipo numeric CPU-label matching on the current macOS toolchain and update the app bundle acceptance fixture; document the added boundaries and verification lanes.

MCP request examples

Sanitized request shapes (replace the placeholder target values with caller-owned local targets):

{"name":"inspect_android_package","arguments":{"path":"/absolute/path/to/sample.apk"}}
{"name":"capture_ios_simulator_screen","arguments":{"simulator_udid":"AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"}}

The Android Evidence now includes normalized_result.manifest_declarations, with source digest and declared component fields. The simulator Evidence includes normalized_result.screenshot.base64, SHA-256, dimensions, and foreground_application: null; the text summary points to the complete structured PNG.

Verification

npm run build:cached, npm run check:fast, npm run format:check, npm run knip, npm run docs:check, npm run verify:research-ui, npm run verify:package — passed on the rebased branch.
Focused iOS/JADX integration: 41 tests passed. Real npm run verify:ios-simulator passed on a source-owned iOS 26 fixture with CLI/MCP PNG bytes, Evidence, pixels, and missing-target behavior.
Real npm run verify:android passed with pinned JADX 0.7.1 and ApiDemos APK, including CLI/MCP parity, manifest declarations, unchanged APK, and cancellation cleanup.
npm run test:python, npm run jscpd, and npm run scan:todos passed.

The local full npm run check:pr did not complete: Vitest exited after 126 test files without a retained assertion failure, and its top-level redirected log was removed during the run. The targeted and real lanes above passed; this draft awaits CI's complete suite.

Real Hopper, Ghidra, and IDA verification was not performed because those providers are not configured on this host. The new iOS operation is simulator-only. No issue link was supplied for this request.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2485 **Author:** [@naresh-tech-backend](https://github.com/naresh-tech-backend) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/rea-research-intake-mobile` --- ### 📝 Commits (1) - [`b1a9842`](https://github.com/morluto/rea/commit/b1a9842fcd6b0fbac8308c1f5a55d41da47f34a6) feat: add local research intake and mobile evidence tools ### 📊 Changes **56 files changed** (+4048 additions, -34 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+6 -0) 📝 `README.md` (+4 -0) 📝 `bridge/android/ReaJadxBridge.java` (+163 -0) 📝 `docs/.vitepress/config.ts` (+8 -0) 📝 `docs/android-analysis.md` (+29 -8) 📝 `docs/apple-application-analysis.md` (+31 -0) 📝 `docs/architecture.mermaid` (+7 -0) ➕ `docs/authorized-security-research-case.md` (+66 -0) ➕ `docs/authorized-security-research.md` (+85 -0) 📝 `docs/cli.md` (+11 -0) 📝 `docs/testing.md` (+9 -0) 📝 `package-lock.json` (+2 -1) 📝 `package.json` (+11 -1) ➕ `research-ui/README.md` (+30 -0) ➕ `research-ui/app.js` (+259 -0) ➕ `research-ui/case.js` (+287 -0) ➕ `research-ui/index.html` (+404 -0) ➕ `research-ui/styles.css` (+636 -0) ➕ `scripts/fixtures/ios/DisplayFixture.swift` (+37 -0) ➕ `scripts/fixtures/ios/Info.plist` (+26 -0) _...and 36 more files_ </details> ### 📄 Description ## Summary - Add a loopback-only research case UI and packaged `rea-research-ui` command. It records exact program policy, scope, artifact identity, and candidate Evidence; exports JSON, Markdown, and policy text without fetching URLs or running targets. - Extend `inspect_android_package` with bounded, source-bound structured manifest declarations from the bring-your-own JADX adapter. Declared component attributes are observations; effective exposure remains `unknown`. - Add `capture_ios_simulator_screen` through shared CLI/MCP Evidence. It selects one booted simulator by exact UDID, checks identity around capture, and returns a bounded PNG with digest. Foreground app attribution stays unknown. - Correct Mach-O/lipo numeric CPU-label matching on the current macOS toolchain and update the app bundle acceptance fixture; document the added boundaries and verification lanes. ## MCP request examples Sanitized request shapes (replace the placeholder target values with caller-owned local targets): ```json {"name":"inspect_android_package","arguments":{"path":"/absolute/path/to/sample.apk"}} {"name":"capture_ios_simulator_screen","arguments":{"simulator_udid":"AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"}} ``` The Android Evidence now includes `normalized_result.manifest_declarations`, with source digest and declared component fields. The simulator Evidence includes `normalized_result.screenshot.base64`, SHA-256, dimensions, and `foreground_application: null`; the text summary points to the complete structured PNG. ## Verification - `npm run build:cached`, `npm run check:fast`, `npm run format:check`, `npm run knip`, `npm run docs:check`, `npm run verify:research-ui`, `npm run verify:package` — passed on the rebased branch. - Focused iOS/JADX integration: 41 tests passed. Real `npm run verify:ios-simulator` passed on a source-owned iOS 26 fixture with CLI/MCP PNG bytes, Evidence, pixels, and missing-target behavior. - Real `npm run verify:android` passed with pinned JADX 0.7.1 and ApiDemos APK, including CLI/MCP parity, manifest declarations, unchanged APK, and cancellation cleanup. - `npm run test:python`, `npm run jscpd`, and `npm run scan:todos` passed. The local full `npm run check:pr` did not complete: Vitest exited after 126 test files without a retained assertion failure, and its top-level redirected log was removed during the run. The targeted and real lanes above passed; this draft awaits CI's complete suite. Real Hopper, Ghidra, and IDA verification was not performed because those providers are not configured on this host. The new iOS operation is simulator-only. No issue link was supplied for this request. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:16 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:43:42 +00:00

[PR #5308] [CLOSED] fix(ghidra): keep a stable JAVA_HOME spelling for clients #6872

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5264

No description provided.

Rows
Columns