Own Android TV ops with ADB + REA: clear shell, speed UI, sideload OSS
A practical own-device loop for Android TV / Google TV boxes you already own: put the PC and the set on the same network, turn on developer options yourself, approve the debugging prompt on the TV screen, then let a coding agent drive public ADB commands to disable preinstall ad/bloat shells, tidy the launcher surface, and sideload open-source clients you pick. REA is optional for understanding those APKs — the main path is agent + ADB ops. This is not the greco remote/mirror story; it is a clear-shell + sideload ops checklist.
What this case is (and is not)
Is: authorized lab ops on your Android TV-class device. Human enables developer mode and taps Allow on the TV. Agent uses stock adb against that approved session. “Clear ads” means pm disable-user (or equivalent public package disable) on preinstalled ad/bloat packages — not cracking ad networks.
Is not: DRM or paid-streaming cracks; piracy APK markets; auth bypass; controlling a neighbor’s or store-floor set; a universal remote UI (see /showcase/greco-dev-tv/ for an own-TV remote/mirror narrative).
Step checklist
| Step | Do this | Stop if… |
|---|---|---|
| 1. Same network | PC and TV on the same LAN / Wi-Fi | You cannot reach the TV without VPN tricks aimed at someone else’s gear |
| 2. Developer options | On the TV: Settings → About → build number (or vendor equivalent) until developer mode unlocks | The UI never offers developer / USB or network debugging |
| 3. Debugging | Enable USB debugging and/or network debugging / wireless debugging as your firmware exposes | You would need a vendor unlock exploit |
| 4. Approve on TV | From the PC run adb connect <tv-ip>:5555 (or USB); on the TV tap Allow / approve the RSA fingerprint | No prompt appears and you consider bypassing pairing |
| 5. Verify session | adb devices shows device (authorized), not unauthorized | Status stays unauthorized |
| 6. Inventory | adb shell pm list packages (optionally -3 for third-party) | You plan to scrape accounts or DRM keys |
| 7. Disable bloat | For packages you identify as preinstall ad/bloat: adb shell pm disable-user --user 0 <package> (re-enable with pm enable) | The package is a paid app, DRM stack, or not yours to alter |
| 8. Sideload OSS | adb install -r ./chosen-open-source.apk from a release you trust | The APK is a gray film aggregator or unpaid stream crack |
| 9. Verify | Launch the app from the TV launcher; confirm adb shell pm path <package> | Behavior depends on a pirated backend |
| 10. Optional REA | inspect_android_package on the APK file before install | You skip Evidence and ask for “make Netflix free” |
REA roles (optional but useful)
Main path = coding agent + platform-tools ADB. REA deepens understanding of packages you already chose:
| Role | Tool / pin | When |
|---|---|---|
| Setup | npx -y [email protected] setup then restart the MCP host | First time, or after Node upgrades |
| Doctor | Upstream Android / ADB doctor checks | Before mutating a device |
| Static APK map | inspect_android_package on an APK path you downloaded | Permissions, SDK level, exported components, referenced domains |
| Device lane | REA 6.4+ ADB helpers on your authorized session | Logs, screenshots, lifecycle — see /docs/android-adb/ |
| Evidence habit | Ask for Evidence + unknowns, not vibes | Every mutating step |
| Studio context | /blog/rea-reverse-engineering-studio/ Android lane | When you want the wider lab map |
npx -y [email protected] setup
# After MCP restart, optional static pass on an APK you already chose:
REA_JADX_MCP_JAR="$PWD/jadx-headless-mcp-0.7.1-all.jar" \
npx -y [email protected] inspect-android-package \
./jellyfin-androidtv-release.apk --format json --full-output
Pin [email protected] for this page so tool names stay stable. Prefer @6.5.0 over floating @latest when you need a reproducible checklist.
Public ADB snippets (authorized session only)
# After the TV shows Allow / RSA approve:
adb devices
adb shell pm list packages | head
# Example shape only — replace with packages YOU identified as preinstall ad/bloat:
# adb shell pm disable-user --user 0 com.example.preinstall.adshell
# Sideload an open-source client you downloaded from its official release:
# adb install -r ./jellyfin-androidtv-release.apk
adb shell pm path <package.name>
Reversibility matters: prefer pm disable-user over uninstall when you may want the package back. Record package names before you change them.
Sideload policy (open-source, user-chosen)
| Allowed example | Why |
|---|---|
| Jellyfin Android TV official client | GPL-2.0, you run your media server |
| Documented open-source Android TV launcher | Clear license + release artifacts |
| Optional community YouTube-style clients (e.g. SmartTube-class) | Only if you accept ToS/copyright risk; not endorsed here as a piracy path |
| Gray “free film aggregator” APKs | Forbidden on this page |
| DRM / paid-stream patches | Forbidden |
Vs greco own-TV remote
| This page (ADB ops) | /showcase/greco-dev-tv/ | |
|---|---|---|
| Shape | Clear preinstall shells + sideload OSS via ADB | Personal remote / input / Mac-mirror control panel |
| Primary tools | adb + optional REA APK inspect | Author’s REA-assisted remote UI (community credit) |
| Human gate | Developer mode + on-TV approve | Own set; no DRM recipe |
| Deliverable | Checklist + package hygiene | Demo of a control surface |
Compliance links
- /compliance/ — site standard
- /faq/legal-boundary/ — what REA is for
- /docs/android-adb/ — device lane hygiene
- /blog/rea-reverse-engineering-studio/ — Android lab persona
Demo media
The clip above is self-hosted (~23 seconds): an authorized approve-and-ops style loop. It is teaching media for this checklist — not a license to touch devices you do not own.
Next step
Similar browser session records can become AgentEnv replay environments
This case is not a claim that it is a specific Hugging Face environment. When REA records an authorized browser session, Scale AgentEnv can expose replay as MCP tools. rea.run mirrors the catalog only — we do not host the RL runtime.
Environments catalog → What is AgentEnv + REA? HF collection ↗ Introducing AgentEnv
Compliance
Own or explicitly authorized Android TV / Google TV / set-top box only. The human must enable developer options and approve the ADB or network-debugging prompt on the TV. “Ads” here means disabling preinstalled ad/bloat packages on that device (public ADB pm disable-user / similar). It does not mean cracking ad SDKs, DRM, or paid streaming clients. Sideload only clearly open-source, user-chosen APKs (for example an official Jellyfin Android TV client or a well-documented open-source launcher). Community clients such as SmartTube-style YouTube front-ends remain optional and ToS/copyright risk stays with the operator. Forbidden: DRM/paid-stream cracks, piracy sources, auth bypass, and unauthorized third-party devices. Differentiates from the greco own-TV remote/mirror case: this page is a one-prompt-style clear-shell + sideload ops loop, not a custom remote UI.
Takeaways
- Same network + human developer mode + on-TV approve before any ADB mutators.
- “Ads” = disable preinstall ad/bloat packages on your set — not ad-SDK or DRM cracks.
- Sideload clearly open-source, user-chosen APKs; skip gray aggregators.
- Optional REA inspect_android_package; pin [email protected]; Evidence over vibes.
Related on rea.run
More on-site cases