a67525cdf1
* docs: organize canonical documentation layout (URGENTE) Group all existing authored guides by domain and ownership, expose complete navigation, and preserve their public routes. Update physical path consumers and release configuration while retaining historical records. Document domain-based specs and ADR slugs without global numbering. Co-Authored-By: Codex <noreply@openai.com> * fix(docs): honor home layout in all-page route verification * style: format reviewed source changes * fix(docs): preserve routes and navigation cache inputs * fix: repair the static-check failures on the default branch (#2895) * fix: repair the static-check failures on the default branch The default branch fails its own required `Static checks` job three ways, so every pull request reports that job as failed regardless of its own change. - `npm run format:check` reports `src/domain/functionComparison.test.ts` and `src/ida/IdaOperationRunner.ts`. - `npm run lint` reports a duplicate `import { join } from "node:path"` in `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17). - `npm run typecheck` reports `format: "devin"` missing from the client format union in `src/application/SupportedClients.ts`, and an unchecked index in `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is inferred as `string[][]`. Apply the pinned formatter, drop the duplicate import, list the `"devin"` format that its own definition already uses, and mark the pair array `as const`. Validation: `npm run check:fast` and `npm run format:check` pass. * fix(setup): keep Devin on the JSON configuration dialect --------- Co-authored-by: 吴佳浩 <wujiahao@supremind.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> * fix(docs): update links after guide relocation * docs: correct verified documentation route counts * fix(docs): update browser capture guide link after move (#2820) Refresh gettext protected-link comments alongside the authored href. Co-authored-by: Codex <noreply@openai.com> * fix(docs): include http3 lab in stable routes * fix(docs): preserve historical release evidence and links * fix(ghidra): restore Windows verifier identity import * docs(wakaru): preserve pinned upstream policy link * docs(index): retain recently added guide links * docs(mcp): preserve parent retention clarification * fix(cli): preserve standalone import guidance * fix(test): preserve translated guide link drift coverage --------- Co-authored-by: Matheus Breguêz <matbrgz@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: morluto <17176810+morluto@users.noreply.github.com> Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com> Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Upstream analysis engines
REA integrates existing tools through provider adapters. Upstream source remains unmodified and retains its own license; it is not copied into REA's domain or application code.
jadx-headless-mcp
- Source: https://github.com/1013503897/jadx-headless-mcp
- Submodule:
third_party/jadx-headless-mcp - Release:
v0.7.1 - Commit:
5844800a486d2248fa949b74c9896285f5b54de2 - License: Apache-2.0; see the submodule's
LICENSE. - Release identity:
src/android/JadxRelease.ts. - REA integration:
src/android/; no upstream patches in this version.
Fetch source for inspection with:
git submodule update --init third_party/jadx-headless-mcp
Normal REA builds and installed npm packages do not require this submodule or a
Gradle build. Supply a separately obtained JAR with REA_JADX_MCP_JAR; REA never
downloads engines during an analysis operation. The audited release JAR is
identified by SHA-256. A caller-supplied build reporting the supported protocol
version retains its actual digest and an unknown source revision unless its
bytes match the audited release.
When updating: review upstream protocol and license changes, update the gitlink and release identity together, exercise the adapter's producer regressions, and run the real APK CLI/MCP lane. Never attribute modified engine bytes to the audited source revision.
Public APK fixture
npm run fixtures:android (scripts/fixtures/android/fetch.mjs) downloads the audited engine and
Appium ApiDemos v6.0.18 into ignored _reference/apk-integration/. Both downloads
are checked against fixed SHA-256 values. Fixture provenance is recorded in
scripts/fixtures/android-apidemos.json; the source uses Apache-2.0. This is a
static analysis fixture: no emulator, device, SDK installation or app execution
is needed. APKs and JARs are neither tracked nor included in npm packages.
Firmware engines
| Engine | Source | Release | Pinned commit | License |
|---|---|---|---|---|
| Binwalk | https://github.com/ReFirmLabs/binwalk | v3.1.0 | 4fdab3d464d97b68e0af9088df3f9e2e1545b21c |
MIT, upstream LICENSE |
| Unblob | https://github.com/onekey-sec/unblob | 26.6.4 | 1fcc7a0a584a70a96c31f5a276c20944d199a089 |
MIT, upstream LICENSE |
Source remains unmodified in third_party/binwalk and third_party/unblob.
Release records live in src/firmware/FirmwareRelease.ts; REA adapters own the
CLI/report interpretation and lifecycle in src/firmware/. Caller-supplied
executables retain their actual launcher digest and unknown source revision;
version output alone does not establish source identity. REA does not bundle
extractors or download/install firmware engines during analysis.
On updates: inspect actual pinned CLI and report producers, preserve licenses, update gitlinks/release records, run report regressions and the real firmware lane. See firmware setup and coverage.