[PR #5025] [MERGED] feat(android): project a structured manifest component inventory #6742

New issue

Closed

opened 2026-11-01 21:42:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:42:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5025
Author: @BaaRai
Created: 10/18/2026
Status: ✅ Merged
Merged: 10/24/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/android-manifest-components

📝 Commits (10+)

608f180 feat(android): project a structured manifest component inventory
0af369f fix(android): derive provider export defaults from the target SDK and match namespaced attributes
fd60316 fix(android): bound resolved names and authorities in the component inventory
d169674 chore: merge main before review continuation
bf8106c fix(android): separate nonliteral exported values from omission
fcc44d8 fix(android): bound manifest component projection
d889239 fix(android): preserve permission override semantics
10e9f09 fix(android): retain unresolved package identities
8d85a45 test(android): cover multibyte manifest name budget
8fd7d32 fix(android): measure inherited permission once

📊 Changes

8 files changed (+2307 additions, -1 deletions)

View changed files

📝 docs/android-analysis.md (+47 -0)
➕ docs/verification/android-manifest-components-2026-10-24.md (+359 -0)
➕ src/android/AndroidManifestComponents.ts (+701 -0)
📝 src/android/JadxAnalysis.ts (+7 -0)
📝 src/contracts/android/androidToolContracts.ts (+1 -1)
📝 src/domain/android/androidAnalysis.ts (+43 -0)
📝 tests/boundary/android/JadxAnalysis.test.ts (+82 -0)
➕ tests/boundary/android/androidManifestComponents.test.ts (+1067 -0)

📄 Description

Adds bounded Android manifest component inventory to inspect_android_package, retaining ordered declarations, names, export defaults, permission provenance, filters and provider authorities through CLI/MCP and retained Evidence. It reads declarations without executing an app or asserting runtime exposure. Related #4448 remains open for broader runtime/metadata requirements.

The decoded-XML owner enforces namespace identity, distinguishes omitted SDK values from present-empty/unknown declarations, and interprets decimal/hex signed-int SDK levels once. Package qualification now uses Android application-ID rules and the platform android exception, separately from DEX component/alias-name syntax. Unsupported package values preserve raw declarations and uncertainty. DEX component and alias identities now use exact raw spelling, including valid boundary spaces; the display trim and redundant representations are removed. Five such controls fail before correction, and forbidden-tab/empty-name coverage remains. Existing copy-budget checks now exercise valid packages with huge component names, and huge invalid packages preserve unresolved aliases without expansion.

Validation: all 141 selected component/JADX/protocol/MCP-summary checks pass after integrating merged main/IL2CPP 3ce311757dd8ac444c8297b2871464536f93816d, plus check:fast, complete format:check and docs:check. Earlier local runs include a 30-second retained-manifest MCP timeout; the deadline was not raised. Five package negatives fail before the correction, and an old huge-package oracle was corrected. Pinned real JADX/ApiDemos CLI/MCP workflows establish all 355 projections against a decoded-XML oracle; they do not qualify malformed package, hex-typed APK or numeric-led DEX behavior on a device.

Earlier alternating real-provider tasks preserve normalized facts/provenance and the 141,958-token estimate, with overlapping elapsed/CPU/memory ranges; no general performance improvement is claimed. Those measurements retain their earlier pins and are not measurements of the package correction. Executed checks, attempted runs, primary rules, costs and limitations: verification report. Current CI is audited independently, and skipped/cancelled lanes are not counted as passing. Existing human-readiness declarations are preserved below.

The final review fixes preserve raw foreground-service type attributes (including empty and padded declarations), remove the obsolete trim helper and correct the DEX-space guide. All 141 selected checks pass, including three fail-before value-preservation controls. Performance and runtime limitations remain recorded in the verification report.

Author readiness

Human owner: @BaaRai

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5025 **Author:** [@BaaRai](https://github.com/BaaRai) **Created:** 10/18/2026 **Status:** ✅ Merged **Merged:** 10/24/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/android-manifest-components` --- ### 📝 Commits (10+) - [`608f180`](https://github.com/morluto/rea/commit/608f180e5f669993023a4a6216bd448670cb7345) feat(android): project a structured manifest component inventory - [`0af369f`](https://github.com/morluto/rea/commit/0af369f9e2c2c44f66098f0cdd08dbf0cbccad53) fix(android): derive provider export defaults from the target SDK and match namespaced attributes - [`fd60316`](https://github.com/morluto/rea/commit/fd60316d9f00d164c89ef352a639811adf15f673) fix(android): bound resolved names and authorities in the component inventory - [`d169674`](https://github.com/morluto/rea/commit/d169674964e4be52182a1ee18101fdfedf199dce) chore: merge main before review continuation - [`bf8106c`](https://github.com/morluto/rea/commit/bf8106cd1c29866a5c357bc7a4f7db7615cc52b0) fix(android): separate nonliteral exported values from omission - [`fcc44d8`](https://github.com/morluto/rea/commit/fcc44d8fa3e582c40386cc7baafafca4dfc26dc5) fix(android): bound manifest component projection - [`d889239`](https://github.com/morluto/rea/commit/d889239b64615e3e8bcfd82e24a24cf4c0d11a16) fix(android): preserve permission override semantics - [`10e9f09`](https://github.com/morluto/rea/commit/10e9f09ba1b3349e049ceb948a6e6c13b35b556e) fix(android): retain unresolved package identities - [`8d85a45`](https://github.com/morluto/rea/commit/8d85a45adee805ea4740dd9bf70f18092a1fa79a) test(android): cover multibyte manifest name budget - [`8fd7d32`](https://github.com/morluto/rea/commit/8fd7d32a3dc439ae77df5b7f85dce95072307c6f) fix(android): measure inherited permission once ### 📊 Changes **8 files changed** (+2307 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `docs/android-analysis.md` (+47 -0) ➕ `docs/verification/android-manifest-components-2026-10-24.md` (+359 -0) ➕ `src/android/AndroidManifestComponents.ts` (+701 -0) 📝 `src/android/JadxAnalysis.ts` (+7 -0) 📝 `src/contracts/android/androidToolContracts.ts` (+1 -1) 📝 `src/domain/android/androidAnalysis.ts` (+43 -0) 📝 `tests/boundary/android/JadxAnalysis.test.ts` (+82 -0) ➕ `tests/boundary/android/androidManifestComponents.test.ts` (+1067 -0) </details> ### 📄 Description Adds bounded Android manifest component inventory to `inspect_android_package`, retaining ordered declarations, names, export defaults, permission provenance, filters and provider authorities through CLI/MCP and retained Evidence. It reads declarations without executing an app or asserting runtime exposure. Related #4448 remains open for broader runtime/metadata requirements. The decoded-XML owner enforces namespace identity, distinguishes omitted SDK values from present-empty/unknown declarations, and interprets decimal/hex signed-int SDK levels once. Package qualification now uses Android application-ID rules and the platform `android` exception, separately from DEX component/alias-name syntax. Unsupported package values preserve raw declarations and uncertainty. DEX component and alias identities now use exact raw spelling, including valid boundary spaces; the display trim and redundant representations are removed. Five such controls fail before correction, and forbidden-tab/empty-name coverage remains. Existing copy-budget checks now exercise valid packages with huge component names, and huge invalid packages preserve unresolved aliases without expansion. Validation: all 141 selected component/JADX/protocol/MCP-summary checks pass after integrating merged main/IL2CPP `3ce311757dd8ac444c8297b2871464536f93816d`, plus check:fast, complete format:check and docs:check. Earlier local runs include a 30-second retained-manifest MCP timeout; the deadline was not raised. Five package negatives fail before the correction, and an old huge-package oracle was corrected. Pinned real JADX/ApiDemos CLI/MCP workflows establish all 355 projections against a decoded-XML oracle; they do not qualify malformed package, hex-typed APK or numeric-led DEX behavior on a device. Earlier alternating real-provider tasks preserve normalized facts/provenance and the 141,958-token estimate, with overlapping elapsed/CPU/memory ranges; no general performance improvement is claimed. Those measurements retain their earlier pins and are not measurements of the package correction. Executed checks, attempted runs, primary rules, costs and limitations: [verification report](docs/verification/android-manifest-components-2026-10-24.md). Current CI is audited independently, and skipped/cancelled lanes are not counted as passing. Existing human-readiness declarations are preserved below. The final review fixes preserve raw foreground-service type attributes (including empty and padded declarations), remove the obsolete trim helper and correct the DEX-space guide. All 141 selected checks pass, including three fail-before value-preservation controls. Performance and runtime limitations remain recorded in the verification report. ## Author readiness Human owner: @BaaRai - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:42:44 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:47:36 +00:00

[PR #6742] [CLOSED] fix(signals): retain Unicode literal matches across sigma word positions (#6714) #7403

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6742

No description provided.

Rows
Columns