morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2932] [Bug] Electron APIs reached through the webpack module registry are invisible (0 windows / 0 IPC on bundled main processes) #1033

New issue

Closed

opened 2026-10-15 18:30:31 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:30:31 +00:00

Owner

Originally created by @UnknownHacker1 on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2932

Summary

analyze_javascript_application reports 0 BrowserWindows, 0 webPreferences and 0 IPC operations for Electron main processes bundled by webpack. Electron APIs reached through the webpack module registry (n(<id>), or the n.n() default-interop helper) are not resolved, and the result carries no unknown pointing at the unresolved lookup, only the generic "missing findings do not establish absence" limitation.

This is distinct from #1802 (namespace form, fixed) and #1656 (lexical aliases, fixed). Both of those forms pass in 6.4.0.

Environment

rea-agents 6.4.0, Windows 11 x64, Node 22.22.3

Minimal reproduction

Same app written four ways: one BrowserWindow with explicit webPreferences, one ipcMain.handle("get-connections"). Fixtures and a runner script: https://github.com/UnknownHacker1/rea-groundtruth (python scripts/run_repro.py).

The failing shape, in full:

(()=>{var __webpack_modules__={45840:e=>{"use strict";e.exports=require("electron")},100:(e,t,n)=>{"use strict";const s=n(45840);s.app.whenReady().then(()=>{const w=new s.BrowserWindow({webPreferences:{contextIsolation:!1,nodeIntegration:!0}});w.loadFile("index.html")});s.ipcMain.handle("get-connections",async()=>[])}},__webpack_module_cache__={};function n(t){var r=__webpack_module_cache__[t];if(void 0!==r)return r.exports;var o=__webpack_module_cache__[t]={exports:{}};return __webpack_modules__[t](o,o.exports,n),o.exports}n(100)})();

variant     windows  handlers  channels  verdict
plain             1         1         1  ok
namespace         1         1         1  ok
webpack           0         0         0  MISSED
interop           0         0         0  MISSED

Real-world impact

On MongoDB Compass 1.43.4 (installed Windows build, --integrity-policy record-and-continue), the summary reports browser_windows: 0, explicit_web_preferences: 0 and all IPC counters 0. The shipped webpack 5 build/main.js contains new s.BrowserWindow(...), 8 ipcMain references, and a window created with contextIsolation:false / enableRemoteModule:true, where s comes from the registry entry 45840:e=>{e.exports=require("electron")}.

So an agent asking "are any windows created without context isolation?" gets a confident-looking zero on a real app where the answer is yes.

Expected

Either resolve registry entries whose factory body is exactly e.exports=require("<builtin>") (the common webpack 4/5 externals shape, including through n.n), or record an unknown at the use site saying an Electron identity could flow through an unresolved bundler registry lookup, so the zero is not read as absence.

Happy to test a fix against these fixtures and Compass.

Originally created by @UnknownHacker1 on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2932 ### Summary `analyze_javascript_application` reports 0 BrowserWindows, 0 webPreferences and 0 IPC operations for Electron main processes bundled by webpack. Electron APIs reached through the webpack module registry (`n(<id>)`, or the `n.n()` default-interop helper) are not resolved, and the result carries no unknown pointing at the unresolved lookup, only the generic "missing findings do not establish absence" limitation. This is distinct from #1802 (namespace form, fixed) and #1656 (lexical aliases, fixed). Both of those forms pass in 6.4.0. ### Environment rea-agents 6.4.0, Windows 11 x64, Node 22.22.3 ### Minimal reproduction Same app written four ways: one `BrowserWindow` with explicit `webPreferences`, one `ipcMain.handle("get-connections")`. Fixtures and a runner script: https://github.com/UnknownHacker1/rea-groundtruth (`python scripts/run_repro.py`). The failing shape, in full: ```js (()=>{var __webpack_modules__={45840:e=>{"use strict";e.exports=require("electron")},100:(e,t,n)=>{"use strict";const s=n(45840);s.app.whenReady().then(()=>{const w=new s.BrowserWindow({webPreferences:{contextIsolation:!1,nodeIntegration:!0}});w.loadFile("index.html")});s.ipcMain.handle("get-connections",async()=>[])}},__webpack_module_cache__={};function n(t){var r=__webpack_module_cache__[t];if(void 0!==r)return r.exports;var o=__webpack_module_cache__[t]={exports:{}};return __webpack_modules__[t](o,o.exports,n),o.exports}n(100)})(); ``` ``` variant windows handlers channels verdict plain 1 1 1 ok namespace 1 1 1 ok webpack 0 0 0 MISSED interop 0 0 0 MISSED ``` ### Real-world impact On MongoDB Compass 1.43.4 (installed Windows build, `--integrity-policy record-and-continue`), the summary reports `browser_windows: 0`, `explicit_web_preferences: 0` and all IPC counters 0. The shipped webpack 5 `build/main.js` contains `new s.BrowserWindow(...)`, 8 `ipcMain` references, and a window created with `contextIsolation:false` / `enableRemoteModule:true`, where `s` comes from the registry entry `45840:e=>{e.exports=require("electron")}`. So an agent asking "are any windows created without context isolation?" gets a confident-looking zero on a real app where the answer is yes. ### Expected Either resolve registry entries whose factory body is exactly `e.exports=require("<builtin>")` (the common webpack 4/5 externals shape, including through `n.n`), or record an unknown at the use site saying an Electron identity could flow through an unresolved bundler registry lookup, so the zero is not read as absence. Happy to test a fix against these fixtures and Compass.

bsakaguchi

2026-10-15 18:30:31 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:30:32 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in 6e344302cb1c7fa36570afe6ec5e1c9994fa9034.

Canonical source-proven Webpack CommonJS registry/getter identities resolve Electron imports. Getter proof is computed with the bootstrap owner; fake helpers and visible replacement writes are refused.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [6e344302cb1c7fa36570afe6ec5e1c9994fa9034](https://github.com/morluto/rea/commit/6e344302cb1c7fa36570afe6ec5e1c9994fa9034). Canonical source-proven Webpack CommonJS registry/getter identities resolve Electron imports. Getter proof is computed with the bootstrap owner; fake helpers and visible replacement writes are refused. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-17 21:08:02 +00:00

[PR #1033] [CLOSED] test(mcp): ratchet advertised schemas against client limits #2597

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1033

No description provided.

Rows
Columns