{
  "added_at": "2026-10-20",
  "additional_evidence_urls": [
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/docs/VALIDATION.md",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/docs/SOURCES.md",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/AGENTS.md",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/.mcp.json",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/.codex/config.toml",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/.claude/settings.json",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/scripts/workspace.py",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/scripts/sanitize_har.py",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/prompts/02-reconstruct-api.md",
    "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/prompts/04-native.md"
  ],
  "category": "community-integrations",
  "description_en": "A clone-first Chinese workspace template for analyzing one target per workspace with REA from Claude Code or Codex. It ships project-level REA MCP settings, agent rules that require CONFIRMED/GUESS labels with evidence locations, seven task prompts and standard-library scripts that hash imported originals, stage writable copies and strip values from HAR captures. It organizes analysis rather than performing it, and its acceptance run used only synthetic samples.",
  "description_zh": "一个可直接克隆的中文工作区模板，用于在 Claude Code 或 Codex 中借助 REA，按“一个目标一个工作区”开展分析。它提供项目级 REA MCP 配置、要求结论标注 CONFIRMED／GUESS 并附证据位置的智能体规则、七套任务提示词，以及仅依赖标准库的脚本：为导入的原件生成哈希基线、创建可写分析副本，并去除 HAR 抓包中的取值。它负责组织分析而非完成分析，其验收只使用了合成样本。",
  "entry_url": "https://awesomerea.org/resources/rea-workspace-template/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rea-workspace-template/",
  "evidence_url": "https://github.com/dobest1024/rea-workspace-template/blob/fc15b9a4ba2a8b40510d19a2dd80209f665711c5/README.md",
  "group": "rea",
  "id": "rea-workspace-template",
  "json_url": "https://awesomerea.org/resources/rea-workspace-template/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/rea-workspace-template/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rea-workspace-template/index.md",
  "name": "REA Workspace Template",
  "name_zh": "REA 工作区模板",
  "record_type": "resource",
  "relationship": "community-integration",
  "requirements": [
    "The reviewed pin is the repository’s only commit, dated 2026-10-17. It needs Git, Python 3.11+, Node.js with npm, and Claude Code or Codex; README installs rea-agents 6.4.0, the version it was validated with, and the bundled .mcp.json and .codex/config.toml both start a locally installed rea --mcp. The template supplies no REA program, decompiler or model configuration, and it adapts workflow ideas from a third-party post.",
    "Engines are separate: APK DEX work needs JADX and a full JDK, native targets need a Ghidra, Hopper or IDA provider configured through REA’s installation guide, and commercial engines need their own licenses; source, JS/Electron and saved-HAR workflows need no native decompiler. The prompts cover source mapping, API reconstruction from a sanitized HAR to OpenAPI 3.1 and a TypeScript client, JavaScript, native binaries (at most 30 functions per round), APKs, unknown file formats and session handoff.",
    "scripts/workspace.py copies one target into a Git-ignored target/ directory without running it, records SHA-256 baselines, sets files to 0444, rejects symlinks and special files, and creates a writable work/ copy; verify reports changed, added or missing files. sanitize_har.py rebuilds a structural HAR copy, removing header values, cookies, URL credentials and query strings and replacing JSON values with placeholders. README warns that hosts, paths and field names can still identify users and need manual review.",
    "docs/VALIDATION.md (2026-10-17) reports 12 passing standard-library tests, a healthy rea mcp doctor run listing 170 tools, and REA static analysis of a synthetic JavaScript app and a synthetic HAR with Node 24.18.0 and Python 3.12.7. It lists client MCP connection after restart, real APK and native targets, real-HAR anonymization and runtime work as unverified, and its smoke-test outputs are not committed.",
    "README states that the Claude Code permission rules, read-only file modes and SHA-256 baselines are not an isolation boundary, and recommends read-only mounts and controlled networking where strong isolation is needed. AGENTS.md defaults to static analysis and reserves running samples, connecting devices and contacting target services for authorized tasks. The repository has no license file, so reuse terms are unstated; REA, analysis engines, clients and targets keep their own terms."
  ],
  "requirements_zh": [
    "所审阅的固定版本是该仓库唯一的提交，日期为 2026-10-17。使用前需安装 Git、Python 3.11+、Node.js 与 npm，以及 Claude Code 或 Codex；README 安装其验证过的 rea-agents 6.4.0，随附的 .mcp.json 与 .codex/config.toml 均启动本机已安装的 rea --mcp。模板不提供 REA 程序、反编译器或模型配置；它借鉴了一篇第三方帖子的工作思路。",
    "分析引擎需另行准备：APK 的 DEX 分析需要 JADX 与完整 JDK，原生目标需要按 REA 安装文档配置 Ghidra、Hopper 或 IDA 等 provider，商业引擎需自备许可证；源码、JS／Electron 与已保存 HAR 的流程无需原生反编译器。提示词涵盖源码地图、从已脱敏 HAR 重建 OpenAPI 3.1 与 TypeScript 客户端、JavaScript、原生二进制（每轮最多深入 30 个函数）、APK、未知文件格式及会话交接。",
    "scripts/workspace.py 将单个目标复制到被 Git 忽略的 target/ 目录且不运行它，记录 SHA-256 基线、把文件设为 0444、拒绝软链接和特殊文件，并创建可写的 work/ 副本；verify 会报告被修改、新增或缺失的文件。sanitize_har.py 重新生成只保留结构的 HAR 副本，去除 header 取值、cookie、URL 凭据与查询参数，并把 JSON 取值替换为占位值。README 提醒主机名、路径和字段名仍可能识别用户，需要人工复查。",
    "docs/VALIDATION.md（2026-10-17）报告：12 项标准库测试通过，rea mcp doctor 运行健康并列出 170 个工具，并在 Node 24.18.0 与 Python 3.12.7 下用 REA 静态分析了一个合成 JavaScript 应用和一个合成 HAR。文档将客户端重启后的 MCP 接入、真实 APK 与原生目标、真实 HAR 的匿名化以及运行时工作列为未验证，冒烟测试输出也未提交。",
    "README 说明 Claude Code 权限规则、只读文件权限和 SHA-256 基线都不构成隔离边界，需要强隔离时建议使用只读挂载和受控网络。AGENTS.md 默认只做静态分析，仅在任务获得授权时才运行样本、连接设备或访问目标服务。仓库没有许可证文件，复用条款未作说明；REA、分析引擎、客户端与分析目标各有其条款。"
  ],
  "targets": [
    "app",
    "binary",
    "website"
  ],
  "url": "https://github.com/dobest1024/rea-workspace-template",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}