From 3620074b318a3b2182237d39b52d5d4aee832317 Mon Sep 17 00:00:00 2001 From: wseelly <93262000+Seelly@users.noreply.github.com> Date: Wed, 14 Oct 2026 05:25:39 +0800 Subject: [PATCH] docs(android): link the JADX provider download Document the pinned JADX release download and digest verification for npm users and repository checkouts. Keep caller-selected local paths; identify the fixture helper as checkout-only. Include shell and PowerShell examples, with the POSIX path set only after successful download and verification. Validation: actual pinned JAR/APK fetch verification; real curl download and SHA-256 checks using sha256sum and the shasum fallback; controlled corrupt-file and failed-download cases; POSIX syntax; docs:check (5 conformance tests), typecheck/lint, formatting and diff checks. Provider execution and native macOS/Windows command runs were not repeated. Co-authored-by: Seelly <93262000+Seelly@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> --- docs/android-analysis.md | 38 ++++++++++++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 4 deletions(-) diff --git a/docs/android-analysis.md b/docs/android-analysis.md index 50087f464..668bcbffb 100644 --- a/docs/android-analysis.md +++ b/docs/android-analysis.md @@ -33,10 +33,40 @@ unverified. ## Supply tools Use a **full JDK 17 or newer** (including its compiler module) and -**jadx-headless-mcp 0.7.1**. REA runs its packaged Java metadata bridge in -source-file mode against the unmodified engine JAR. REA does not install Java, -an Android SDK, JADX, a device service or an emulator. Set the path in the shell -or MCP server environment: +[**jadx-headless-mcp 0.7.1**](https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar). +Verify the downloaded JAR's SHA-256 against +[REA's pinned release metadata](https://github.com/morluto/rea/blob/main/src/android/JadxRelease.ts) +before using it. The following download and verification commands work for npm +package consumers as well as repository checkouts; the repository-only +`npm run fixtures:android` helper is not included in the npm package. + +On macOS or Linux, choose a destination and verify the pinned digest: + +```sh +mkdir -p "$HOME/.local/share/rea/android" && +cd "$HOME/.local/share/rea/android" && +curl -fL -o jadx-headless-mcp-0.7.1-all.jar https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar && +if command -v sha256sum >/dev/null; then + echo '6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75 jadx-headless-mcp-0.7.1-all.jar' | sha256sum -c - +else + echo '6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75 jadx-headless-mcp-0.7.1-all.jar' | shasum -a 256 -c - +fi && +export REA_JADX_MCP_JAR="$PWD/jadx-headless-mcp-0.7.1-all.jar" +``` + +On Windows, run the equivalent in PowerShell: + +```powershell +$jar = Join-Path $HOME '.local\share\rea\android\jadx-headless-mcp-0.7.1-all.jar' +New-Item -ItemType Directory -Force (Split-Path $jar) | Out-Null +Invoke-WebRequest -Uri 'https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar' -OutFile $jar +if ((Get-FileHash -Algorithm SHA256 $jar).Hash.ToLowerInvariant() -ne '6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75') { throw 'JADX JAR SHA-256 does not match REA pinned metadata' } +$env:REA_JADX_MCP_JAR = $jar +``` + +REA runs its packaged Java metadata bridge in source-file mode against the +unmodified engine JAR. REA does not install Java, an Android SDK, JADX, a device +service or an emulator. Set the path in the shell or MCP server environment: ```sh export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar