morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1850] [Bug] Focused Android class searches embed the complete provider inventory #626

New issue

Closed

opened 2026-10-15 18:26:44 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-15 18:26:44 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1850

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction.

Observed behavior

search_android_classes can return one normalized match while embedding all 7,096 examined class names in the raw call evidence. Focused and zero-match results consequently retain large inline inventories.

Reproduction

Open an APK with several thousand classes through REA's Android workflow.
Search for a unique class-name fragment, then a fragment with no matches.
Compare normalized match count with the complete inline raw inventory and serialized response size.

Expected behavior

Return bounded useful matches and truthful examined-coverage metadata inline while retaining accessible local provenance for the original complete inventory.

Impact and scope

The observed one-match Evidence text is 382,435 UTF-8 bytes; later focused responses have about 0.79 MB of serialized result. Match correctness and complete examined coverage are not disputed.

REA version

Observed at source revision 97c0348e6bef62bb7183d52bcebea8299c5b3afe; current-main reproduction is part of the investigation.

Runtime and platform

Linux x86_64, Node.js 24.18.0. Heavy operations used a one-CPU, 3-GiB process-tree limit.

Interface

MCP; the shared CLI workflow should be verified where applicable.

Earliest failure stage

Transport or result projection.

Relevant output or evidence

total_classes=7096, one normalized match, and unfiltered list_classes pages retained inline. Actual client billing/context consumption is not inferred from serialized bytes.

Analysis or suspected cause

Inspect ownership of provider raw calls and Evidence projection. Do not fix this by discarding provenance or marking an unexamined inventory complete.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1850 ### Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction. ### Observed behavior `search_android_classes` can return one normalized match while embedding all 7,096 examined class names in the raw call evidence. Focused and zero-match results consequently retain large inline inventories. ### Reproduction 1. Open an APK with several thousand classes through REA's Android workflow. 2. Search for a unique class-name fragment, then a fragment with no matches. 3. Compare normalized match count with the complete inline raw inventory and serialized response size. ### Expected behavior Return bounded useful matches and truthful examined-coverage metadata inline while retaining accessible local provenance for the original complete inventory. ### Impact and scope The observed one-match Evidence text is 382,435 UTF-8 bytes; later focused responses have about 0.79 MB of serialized result. Match correctness and complete examined coverage are not disputed. ### REA version Observed at source revision `97c0348e6bef62bb7183d52bcebea8299c5b3afe`; current-main reproduction is part of the investigation. ### Runtime and platform Linux x86_64, Node.js 24.18.0. Heavy operations used a one-CPU, 3-GiB process-tree limit. ### Interface MCP; the shared CLI workflow should be verified where applicable. ### Earliest failure stage Transport or result projection. ### Relevant output or evidence `total_classes=7096`, one normalized match, and unfiltered `list_classes` pages retained inline. Actual client billing/context consumption is not inferred from serialized bytes. ### Analysis or suspected cause Inspect ownership of provider raw calls and Evidence projection. Do not fix this by discarding provenance or marking an unexamined inventory complete.

bsakaguchi

2026-10-15 18:26:44 +00:00

closed this issue
added the
area: providers

performance

area: evidence

triage

bug

P2: medium
labels

bsakaguchi commented

2026-10-15 18:26:46 +00:00

Author

Owner

@akushonkamen commented on GitHub (Oct 11, 2026):

Confirmed the cause: src/android/JadxAnalysis.ts searchClasses pages through list_classes with pageSize = 4096 and the bounded normalized result is fine — the unbounded part is that the raw provider call records (full list_classes pages) get retained inline as call Evidence on the tool registration path (src/server/registerAndroidTools.ts), so a one-match or zero-match response carries the whole 7,096-class inventory. I'm working on a fix that keeps the bounded inline result plus truthful coverage metadata and moves the complete inventory to a bounded summary + locally retrievable provenance (no provenance discarded, no unexamined inventory marked complete). will follow up with a PR. 🤖 AI-assisted contribution (disclosure voluntary per repo policy).

@akushonkamen commented on GitHub (Oct 11, 2026): Confirmed the cause: `src/android/JadxAnalysis.ts` `searchClasses` pages through `list_classes` with `pageSize = 4096` and the bounded normalized result is fine — the unbounded part is that the raw provider call records (full `list_classes` pages) get retained inline as call Evidence on the tool registration path (`src/server/registerAndroidTools.ts`), so a one-match or zero-match response carries the whole 7,096-class inventory. I'm working on a fix that keeps the bounded inline result plus truthful coverage metadata and moves the complete inventory to a bounded summary + locally retrievable provenance (no provenance discarded, no unexamined inventory marked complete). will follow up with a PR. 🤖 AI-assisted contribution (disclosure voluntary per repo policy).

bsakaguchi commented

2026-10-15 18:26:46 +00:00

Author

Owner

@akushonkamen commented on GitHub (Oct 11, 2026):

PR submitted: https://github.com/morluto/rea/pull/1890 — complete raw-call Evidence is retained and the inline search Evidence is replaced by a bounded summary (pagination audit + items_omitted, inventory_elided, unchanged normalized matches/coverage, evidence_links back to the complete record). Retention-free sessions keep the complete inline CLI output.

@akushonkamen commented on GitHub (Oct 11, 2026): PR submitted: https://github.com/morluto/rea/pull/1890 — complete raw-call Evidence is retained and the inline search Evidence is replaced by a bounded summary (pagination audit + `items_omitted`, `inventory_elided`, unchanged normalized matches/coverage, `evidence_links` back to the complete record). Retention-free sessions keep the complete inline CLI output.

bsakaguchi commented

2026-10-15 18:26:46 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 11, 2026):

Verified the merged fix through a fresh real JADX 0.7.1 stdio MCP session against an unchanged released APK containing 7,096 classes.

An exact-name search returned one match in a 7,636-byte tool response; an absent-name search returned zero matches in 6,450 bytes. Both reported complete inventory coverage.
Inline raw pages retained pagination and omitted-item counts. The linked canonical Evidence remained retrievable through get_evidence_bundle(detail="complete"), with all 7,096 original class names and identical normalized search results.
Session ping passed afterward, and the APK SHA-256 remained unchanged.

The provider was constrained to one active processor and a 768-MiB configured heap. This verifies the actual provider workflow in addition to the source-owned regression fixture.

@N0zoM1z0 commented on GitHub (Oct 11, 2026): Verified the merged fix through a fresh real JADX 0.7.1 stdio MCP session against an unchanged released APK containing 7,096 classes. - An exact-name search returned one match in a 7,636-byte tool response; an absent-name search returned zero matches in 6,450 bytes. Both reported complete inventory coverage. - Inline raw pages retained pagination and omitted-item counts. The linked canonical Evidence remained retrievable through `get_evidence_bundle(detail="complete")`, with all 7,096 original class names and identical normalized search results. - Session ping passed afterward, and the APK SHA-256 remained unchanged. The provider was constrained to one active processor and a 768-MiB configured heap. This verifies the actual provider workflow in addition to the source-owned regression fixture.

bsakaguchi referenced this issue

2026-10-16 21:14:36 +00:00

[PR #626] [MERGED] docs: fix architecture diagram and pretty-print tool catalog #2124

bsakaguchi referenced this issue

2026-10-31 00:47:55 +00:00

[GH-ISSUE #6901] [Docs] docs/architecture.mermaid leaves out 21 of the 51 src/ directories #4232