Repo brief: Tencent/Shadow

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T16:44:30.080Z · commit 4e9f70a660cc

Verdict

Mixed — Slowing — last commit 5mo ago

• Last commit 5mo ago
• 11 active contributors
• BSD-3-Clause licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Shadow is a full-dynamic Android plugin framework developed by Tencent that enables loading multiple APKs as plugins into a host app without reflection or system hacks. It allows plugin APKs to reuse their original source code (they run normally when installed standalone) and requires only ~15KB and 160 methods injected into the host, with all framework code distributed dynamically as part of each plugin. Three-directory monorepo structure under projects/: sdk/ contains framework code (core loaders, transformers, code generators in Kotlin), test/ holds automated test suites with AGP compatibility checks, sample/ provides sample-app (standalone) and sample-host (plugin variant) for…

Start here

Open these first:

• projects/sdk/core/activity-container/src/main/java/com/tencent/shadow/core/runtime/contai… — Core delegation pattern that bridges plugin Activities to host container Activities; fundamental to Shadow's…
• projects/sdk/coding/code-generator/src/main/kotlin/com/tencent/shadow/coding/code_generat… — Generates boilerplate code for Activity delegation; critical to understanding Shadow's code generation strategy.
• build.gradle — Top-level build configuration and dependency management; entry point for build system setup.
• buildScripts/gradle/versions.properties — Centralized version management for all dependencies and SDKs across the multi-module project.
• projects/sdk/core/common/src/main/java/com/tencent/shadow/core/common/Logger.java — Logging abstraction used throughout the framework; needed to understand logging patterns.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone: git clone https://github.com/Tencent/Shadow.git. No package.json present—this is a Gradle project. Use Android Studio (Arctic Fox 2020.3.1+). Verify Gradle wrapper: ./gradlew --version. Open in IDE and select…

Daily commands:

Open projects/sample/README.md for detailed steps. Expected flow: build sample-app separately (mimics standalone APK), then run sample-host in IDE to see plugin-loaded version. Use ./gradlew wrapper for builds; veri…

…shortened for this brief.

Key cautions & unknowns

• Slowing — last commit 5mo ago
• Single-maintainer risk — top contributor 83% of recent commits
• Scorecard: default branch unprotected (0/10)
• Three specific gotchas: (1) Environment variable DISABLE_TENCENT_MAVEN_MIRROR affects Maven repository selection—if builds fail, ensure Tencent mirror is reachable or set this variable to force google() /…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.