morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7475] docs(android): link pinned JADX source and verification #7864

New issue

Open

opened 2026-11-05 01:48:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-05 01:48:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7475
Author: @Shubham-Padkonde
Created: 10/27/2026
Status: 🔄 Open

Base: main ← Head: docs/jadx-pinned-source

📝 Commits (1)

1470d33 docs(android): link pinned JADX source and verification

📊 Changes

2 files changed (+14 additions, -0 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/android-applications.md (+7 -0)
📝 third_party/README.md (+7 -0)

📄 Description

Summary

Fixes #7459.

The third-party README and Android skill tell callers to supply a JADX JAR, but do not direct them to the verified download procedure. A matching package or repository name alone does not identify REA's audited engine.

Link the pinned 1013503897/jadx-headless-mcp release and the existing SHA-256 verification instructions from both entry points, before callers set REA_JADX_MCP_JAR. Keep the existing distinction between audited bytes and caller-supplied builds.

Change and scope

Documentation only: 14 added lines in two authored files. The packaged skill is generated from .agents/skills/reverse-engineer-anything/. No runtime, provider, schema, authority, or installation behavior changes; no separate maintainer scope decision is needed for this clarification.

Documentation or usability only; no target interaction.

Validation performed

Node 24.22.1 and npm 11.16.0 with locked dependencies.
Checked the upstream v0.7.1 release asset against src/android/JadxRelease.ts, and checked the existing download guide and #supply-tools link target.
npm run docs:check: all six tasks and nine README consistency tests pass.
Full-check type checking, lint, formatting, and metadata checks pass. npm run check stops at three unused symbols reported by Knip; running Knip with both documentation changes removed produces the same three findings (staticFileUrlPath, AndroidManifestComponentInventory, ObjcClassImportBindingCoverage).
Architecture guards, production reachability, typed lint, pre-commit formatting, and git diff --check pass (lint reports existing advisory warnings).
npm pack --dry-run passes. npm run verify:package completes repository-skill installation/content verification and package-archive checks, then stops in the environment test because Windows denies creation of its test symlink (EPERM). The later package stages were not completed.

No APK analysis or Android device workflow was run for this documentation-only change.

Author readiness

Human owner: @Shubham-Padkonde

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7475 **Author:** [@Shubham-Padkonde](https://github.com/Shubham-Padkonde) **Created:** 10/27/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `docs/jadx-pinned-source` --- ### 📝 Commits (1) - [`1470d33`](https://github.com/morluto/rea/commit/1470d33e9dc28714cbad9a1107421a57055ff07a) docs(android): link pinned JADX source and verification ### 📊 Changes **2 files changed** (+14 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/android-applications.md` (+7 -0) 📝 `third_party/README.md` (+7 -0) </details> ### 📄 Description ## Summary Fixes #7459. The third-party README and Android skill tell callers to supply a JADX JAR, but do not direct them to the verified download procedure. A matching package or repository name alone does not identify REA's audited engine. Link the pinned `1013503897/jadx-headless-mcp` release and the existing SHA-256 verification instructions from both entry points, before callers set `REA_JADX_MCP_JAR`. Keep the existing distinction between audited bytes and caller-supplied builds. ## Change and scope Documentation only: 14 added lines in two authored files. The packaged skill is generated from `.agents/skills/reverse-engineer-anything/`. No runtime, provider, schema, authority, or installation behavior changes; no separate maintainer scope decision is needed for this clarification. - [x] Documentation or usability only; no target interaction. ## Validation performed - Node 24.22.1 and npm 11.16.0 with locked dependencies. - Checked the upstream v0.7.1 release asset against `src/android/JadxRelease.ts`, and checked the existing download guide and `#supply-tools` link target. - `npm run docs:check`: all six tasks and nine README consistency tests pass. - Full-check type checking, lint, formatting, and metadata checks pass. `npm run check` stops at three unused symbols reported by Knip; running Knip with both documentation changes removed produces the same three findings (`staticFileUrlPath`, `AndroidManifestComponentInventory`, `ObjcClassImportBindingCoverage`). - Architecture guards, production reachability, typed lint, pre-commit formatting, and `git diff --check` pass (lint reports existing advisory warnings). - `npm pack --dry-run` passes. `npm run verify:package` completes repository-skill installation/content verification and package-archive checks, then stops in the environment test because Windows denies creation of its test symlink (`EPERM`). The later package stages were not completed. No APK analysis or Android device workflow was run for this documentation-only change. ## Author readiness Human owner: @Shubham-Padkonde - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-11-05 01:48:14 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7864

No description provided.

Rows
Columns