morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4771] [MERGED] fix(apktool): preserve decoded APK Evidence subject #6402

New issue

Closed

opened 2026-10-31 01:14:12 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:14:12 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4771
Author: @N0zoM1z0
Created: 10/17/2026
Status: ✅ Merged
Merged: 10/17/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/apktool-evidence-subject-4768

📝 Commits (1)

c0116cd fix(apktool): preserve decoded APK Evidence subject

📊 Changes

4 files changed (+37 additions, -4 deletions)

View changed files

📝 docs/apktool-resource-analysis.md (+2 -0)
📝 scripts/verify-apktool.mjs (+10 -0)
📝 src/apktool/ApktoolProvider.test.ts (+24 -4)
📝 src/apktool/ApktoolProvider.ts (+1 -0)

📄 Description

Summary

Fixes #4768. Successful Apktool resource decoding already computes the owned APK snapshot digest, but dropped it before shared CLI/MCP Evidence assembly. Evidence now carries that snapshot's subject instead of reporting unavailable artifact identity.

Change and scope

Set AnalysisExecution.subject at the producing Apktool boundary; shared Evidence assembly remains the single consumer. The regression exercises the real subprocess/snapshot boundary through the shared application service while the decoder changes the original file. The real-provider verifier now checks the subject as well as the normalized target.

Existing static APK decoding scope; separate maintainer capability approval is not applicable. Caller paths, decoded facts, partial coverage, launcher selection and cleanup retain their existing semantics. Launcher-only inspection has no APK subject. Tool names/schemas and the 207-tool catalog are unchanged. The additional subject uses the already computed digest, adding no file read or subprocess.

Evidence and validation

Before the fix, the strengthened snapshot regression failed on subject: null (24 other producer tests passed). After: test:focused passed 36 tests across producer, application, CLI and MCP boundaries; final producer rerun passed all 25 tests.
Real production CLI/MCP: official NewPipe 0.29.1 and Appium ApiDemos 6.0.18 with Apktool 3.0.3, Temurin 21, Linux x86-64. Subject digest/path/format agree with the decoded snapshot; complete normalized results match baseline, including German-string partial coverage. Launcher inspection remains subjectless. Target digests unchanged; cleanup verified.
node scripts/verify-apktool.mjs --apk <NewPipe APK> passed all checks, including default/localized projections and subject identity.
turbo run lint:built format:check knip metadata:check --concurrency=1, npm run docs:check, npm run verify:architecture-guards, and git diff --check passed.
npm run check was attempted but its full-repository typecheck reached the 3.25 GiB early-stop guard (exit 125), so local full typecheck is incomplete. The owned scope is inactive; GitHub Static checks for c0116cd subsequently passed, including the complete tsc --noEmit check (8 static tasks successful).

Real CLI/MCP validation used one CPU and a 4 GiB process-family hard limit: wall 40.43 s, CPU 39.90 s, kernel family peak 1208.7 MiB including file cache, observed at payload exit with verified cleanup and zero OOM events. This is correctness validation, not a speedup claim. Actual agent token usage and real macOS/Windows Apktool behavior were not measured. Baseline APK digests and reproduction are in #4768.

Greptile reviewed c0116cd with confidence 5/5 and no review threads. Codex automatic review could not run because the repository review quota was exhausted; it produced no actionable code findings. All required CI checks passed for c0116cd, including all five test shards, native package baseline, Portable tests and CI required. Merged as e5ee3ac658cd10ba23700e1757c86ce0a4520406.

Author readiness

Human owner: @N0zoM1z0

Declarations are entered by the agent at the human owner's explicit direction. Diff and evidence checks reported here were performed by the agent; this does not assert a separately observed human review.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4771 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/17/2026 **Status:** ✅ Merged **Merged:** 10/17/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/apktool-evidence-subject-4768` --- ### 📝 Commits (1) - [`c0116cd`](https://github.com/morluto/rea/commit/c0116cda49c3fb67dd3055dc2b0f4f6798e84b4e) fix(apktool): preserve decoded APK Evidence subject ### 📊 Changes **4 files changed** (+37 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `docs/apktool-resource-analysis.md` (+2 -0) 📝 `scripts/verify-apktool.mjs` (+10 -0) 📝 `src/apktool/ApktoolProvider.test.ts` (+24 -4) 📝 `src/apktool/ApktoolProvider.ts` (+1 -0) </details> ### 📄 Description ## Summary Fixes #4768. Successful Apktool resource decoding already computes the owned APK snapshot digest, but dropped it before shared CLI/MCP Evidence assembly. Evidence now carries that snapshot's subject instead of reporting unavailable artifact identity. ## Change and scope Set `AnalysisExecution.subject` at the producing Apktool boundary; shared Evidence assembly remains the single consumer. The regression exercises the real subprocess/snapshot boundary through the shared application service while the decoder changes the original file. The real-provider verifier now checks the subject as well as the normalized target. Existing static APK decoding scope; separate maintainer capability approval is not applicable. Caller paths, decoded facts, partial coverage, launcher selection and cleanup retain their existing semantics. Launcher-only inspection has no APK subject. Tool names/schemas and the 207-tool catalog are unchanged. The additional subject uses the already computed digest, adding no file read or subprocess. ## Evidence and validation - Before the fix, the strengthened snapshot regression failed on `subject: null` (24 other producer tests passed). After: `test:focused` passed 36 tests across producer, application, CLI and MCP boundaries; final producer rerun passed all 25 tests. - Real production CLI/MCP: official NewPipe 0.29.1 and Appium ApiDemos 6.0.18 with Apktool 3.0.3, Temurin 21, Linux x86-64. Subject digest/path/format agree with the decoded snapshot; complete normalized results match baseline, including German-string partial coverage. Launcher inspection remains subjectless. Target digests unchanged; cleanup verified. - `node scripts/verify-apktool.mjs --apk <NewPipe APK>` passed all checks, including default/localized projections and subject identity. - `turbo run lint:built format:check knip metadata:check --concurrency=1`, `npm run docs:check`, `npm run verify:architecture-guards`, and `git diff --check` passed. - `npm run check` was attempted but its full-repository typecheck reached the 3.25 GiB early-stop guard (exit 125), so local full typecheck is **incomplete**. The owned scope is inactive; GitHub Static checks for `c0116cd` subsequently passed, including the complete `tsc --noEmit` check (8 static tasks successful). Real CLI/MCP validation used one CPU and a 4 GiB process-family hard limit: wall 40.43 s, CPU 39.90 s, kernel family peak 1208.7 MiB including file cache, observed at payload exit with verified cleanup and zero OOM events. This is correctness validation, not a speedup claim. Actual agent token usage and real macOS/Windows Apktool behavior were not measured. Baseline APK digests and reproduction are in #4768. Greptile reviewed `c0116cd` with confidence 5/5 and no review threads. Codex automatic review could not run because the repository review quota was exhausted; it produced no actionable code findings. All required CI checks passed for `c0116cd`, including all five test shards, native package baseline, Portable tests and CI required. Merged as `e5ee3ac658cd10ba23700e1757c86ce0a4520406`. ## Author readiness Human owner: @N0zoM1z0 Declarations are entered by the agent at the human owner's explicit direction. Diff and evidence checks reported here were performed by the agent; this does not assert a separately observed human review. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:14:12 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:47:10 +00:00

[PR #6402] [MERGED] fix(javascript): associate requested bindings only with resolved native addons #7337

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6402

No description provided.

Rows
Columns