Documentation

Static HarmonyOS package inventory

Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. Every claim rests on path presence; manifests, Ark bytecode, resources and signatures are not decoded or verified.

Targets: App
Category: Official REA: investigation guides
Relationship: Official REA documentation
Sources reviewed: 2026-10-18

Requirements & limits

Reviewed on main as rea-agents 6.7.0, which declares Node ^22.19.0, ^24.11.0 or 26+. No HarmonyOS SDK, toolchain or engine is needed: inspect-artifact produces the inventory and project-harmony-application-graph (MCP project_harmony_application_graph) projects it, with CLI and MCP sharing one workflow. .hap, .hsp and ZIP-verified root .app inputs are recognized; .har shared libraries are deferred because the suffix also names HTTP Archive JSON.
Outputs are path-presence claims: Stage is inferred only from module.json and FA only from config.json, App Pack children are listed without recursive inventory, encrypted or unavailable entries make coverage partial, and N-API bridge entries are hypotheses. Manifest semantics, Ark bytecode contents and versions, resource resolution, signing verification and observed native boundaries stay listed as limitations, and inventories that cannot be authenticated fail closed.
The verification lane downloads a SHA-256-pinned harmony-next-pipeline 1.0.1 HAP from an MIT-licensed source repository into an ignored directory and checks inventory authenticity, projection determinism, Stage path hints, exact component sets, complete coverage and CLI/MCP parity. The fixture’s compiler/SDK versions and reproducible build are not established, and the lane does not complete the pinned-toolchain acceptance in roadmap issue #1431.
REA declares MIT. Analysed packages keep their own licenses, and the guide says the fixture’s bundled component licenses were not independently audited; the downloaded artifact is not redistributed. Merged PR #1447 introduced this increment.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

docs/harmony-analysis.md GitHub · morluto/rea · Revision 093ce69
package.json GitHub · morluto/rea · Revision 093ce69
LICENSE GitHub · morluto/rea · Revision 093ce69
https://github.com/morluto/rea/pull/1447

Requirements & limits

About this entry

Primary sources

More in References and learning