fix(android): name the JADX JAR download and checksum in recovery

Doctor and configuration failures for a missing or rejected
REA_JADX_MCP_JAR asked for a "caller-supplied" jadx-headless-mcp 0.7.1
JAR without saying where it comes from. The upstream project has since
renamed its packages, so users concluded the JAR could not be obtained.

The shared JADX JAR remediation now names the audited release URL and
SHA-256 that REA already pins. The two capability-availability texts
point to rea doctor --provider jadx for them instead of repeating the
release data outside its owner.

Fixes #7768

Co-Authored-By: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/android/JadxRelease.ts

@@ -14,7 +14,7 @@ export const JADX_BRIDGE_IDENTITY = Object.freeze({
 });
 
 /** Remediation when `REA_JADX_MCP_JAR` is missing or not an absolute path. */
-export const JADX_JAR_CONFIGURATION_REMEDIATION = `Set REA_JADX_MCP_JAR to the absolute path of a caller-supplied jadx-headless-mcp ${JADX_RELEASE.version} JAR. REA does not download or install it.`;
+export const JADX_JAR_CONFIGURATION_REMEDIATION = `Download the jadx-headless-mcp ${JADX_RELEASE.version} release JAR from ${JADX_RELEASE.url}, verify SHA-256 ${JADX_RELEASE.sha256}, and set REA_JADX_MCP_JAR to its absolute path. REA does not download or install it.`;
 
 /** Remediation when the selected Java runtime cannot satisfy the JADX bridge. */
 export const JADX_JAVA_RUNTIME_REMEDIATION =

src/application/CapabilityInventory.ts

@@ -748,7 +748,7 @@ const workflowAvailabilityFor = (
                 : "provider_missing",
           remediation:
             policy.androidAnalysisAvailability?.remediation ??
-            "Set REA_JADX_MCP_JAR to a caller-supplied jadx-headless-mcp 0.7.1 JAR and provide a full JDK on Linux, macOS, or Windows x64 with its matching bundled native controls.",
+            "Set REA_JADX_MCP_JAR to the jadx-headless-mcp 0.7.1 release JAR (rea doctor --provider jadx names its download URL and SHA-256) and provide a full JDK on Linux, macOS, or Windows x64 with its matching bundled native controls.",
         };
   if (kind === "adb-provider")
     return ownerProbeAvailability(

src/server/registerSessionTools.ts

@@ -520,6 +520,6 @@ const missingAndroidAvailability = async (): Promise<ProviderAvailability> => ({
   code: "not_configured",
   reason: "No Android JADX analysis provider is configured.",
   remediation:
-    "Set REA_JADX_MCP_JAR to a caller-supplied jadx-headless-mcp 0.7.1 JAR and provide a full JDK on Linux, macOS, or Windows x64 with its matching bundled native controls.",
+    "Set REA_JADX_MCP_JAR to the jadx-headless-mcp 0.7.1 release JAR (rea doctor --provider jadx names its download URL and SHA-256) and provide a full JDK on Linux, macOS, or Windows x64 with its matching bundled native controls.",
   diagnostics: { configured: false },
 });

tests/boundary/android/jadxDoctor.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { expect, it as test, onTestFinished } from "vitest";
 
 import { inspectJadxProvider as inspectProvider } from "../../../src/android/JadxDoctor.js";
+import { JADX_RELEASE } from "../../../src/android/JadxRelease.js";
 import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
 import { writeJadxJarInventory } from "../../fixtures/android/jadxJar.js";
 import { writeOrderedZip } from "../../fixtures/artifactEntryOrder.js";
@@ -131,6 +132,9 @@ it("publishes no registration environment when REA_JADX_MCP_JAR is unset", async
       },
     ],
   });
+  // The recovery names where to obtain the exact audited JAR.
+  expect(inspection.checks[0]?.remediation).toContain(JADX_RELEASE.url);
+  expect(inspection.checks[0]?.remediation).toContain(JADX_RELEASE.sha256);
 });
 
 it("reports a relative REA_JADX_MCP_JAR as a rejected selection, not an unset one", async () => {