[PR #249] [MERGED] feat(artifact): reconstruct JavaScript application structure #1898

New issue

Closed

opened 2026-10-16 21:12:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/249
Author: @N0zoM1z0
Created: 7/15/2026
Status: ✅ Merged
Merged: 7/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/reconstruct-javascript-artifacts

📝 Commits (1)

17abffa feat(artifact): reconstruct JavaScript application structure

📊 Changes

174 files changed (+11773 additions, -74 deletions)

View changed files

📝 AGENTS.md (+3 -3)
📝 README.md (+3 -2)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
➕ docs/api/classes/application_JavaScriptArtifactGraphAccumulator.JavaScriptArtifactGraphAccumulator.html (+135 -0)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/domain_permissionPolicy.PermissionGrantError.html (+1 -1)
📝 docs/api/classes/ghidra_GhidraLauncher.GhidraLaunchError.html (+1 -1)
📝 docs/api/classes/ghidra_GhidraSessionError.GhidraSessionError.html (+1 -1)
📝 docs/api/classes/ghidra_protocol.GhidraRemoteError.html (+1 -1)
➕ docs/api/functions/application_JavaScriptArtifactAnalysis.analyzeJavaScriptArtifactFiles.html (+46 -0)
➕ docs/api/functions/application_JavaScriptArtifactFiles.readJavaScriptArtifactFiles.html (+47 -0)
➕ docs/api/functions/application_JavaScriptArtifactGraphBuilder.buildJavaScriptArtifactGraph.html (+47 -0)
➕ docs/api/functions/application_JavaScriptArtifactGraphContext.addArtifactContainsEdge.html (+45 -0)
➕ docs/api/functions/application_JavaScriptArtifactGraphContext.addAstContainsEdge.html (+45 -0)
➕ docs/api/functions/application_JavaScriptArtifactGraphContext.addStaticInferenceEdge.html (+45 -0)
➕ docs/api/functions/application_JavaScriptArtifactGraphContext.addUnavailableStaticParseScope.html (+45 -0)

...and 80 more files

📄 Description

Summary

Build the bounded, parse-only JavaScript artifact reconstruction layer that the Electron workflow can compose in the next PR.

inventory directory, ASAR, nested-ASAR, and unpacked-native inputs without executing application code
identify package/main/preload/renderer roles and project deterministic JavaScript Application Graph v1 nodes, edges, evidence, coverage, and explicit unknowns
recover Webpack/Rspack registrations and modules with Babel AST parsing, plus static imports, dynamic imports, CommonJS requires, workers, routes, endpoints, storage, and vendor markers
add digest and AST fingerprints with exact truncation/budget reporting
gate source-map metadata behind separate approval and retain only bounded source names/content digests
normalize malformed ASAR operations into typed format errors while preserving cancellation
document the reconstruction contract and regenerate TypeDoc output

Why

Electron applications concentrate useful reverse-engineering evidence in packaged JavaScript, especially app.asar. This adds a provider-neutral reconstruction boundary that can support the higher-level Electron workflow without coupling it to Hopper, Ghidra, a browser runtime, or application execution.

Contract and compatibility

This is additive application/domain functionality. It does not register a new CLI or MCP tool, change the existing tool inventory, alter configuration, or require migration. The next Electron workflow PR will expose this layer through the existing permission and evidence model.

Observations, static inferences, and unavailable/unknown scopes remain distinct. Results are deterministic and bounded. Symlinks are not followed, traversal is rejected, JavaScript is never evaluated, and source-map contents are not returned.

Validation

nvm use 24.18.0 && npm run check (run against the final commit; 124 files / 881 tests)
npx vitest run tests/javascriptArtifactReconstruction.test.ts --coverage.enabled=false --reporter=dot (12 tests)
npm run knip
npm run jscpd
npm run scan:todos
npm run docs:generate
npm run docs:check

The fixtures are source-owned and include non-execution assertions. Real Hopper, Ghidra, and browser verification were not run because this PR makes no provider- or runtime-specific claim.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/249 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/15/2026 **Status:** ✅ Merged **Merged:** 7/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/reconstruct-javascript-artifacts` --- ### 📝 Commits (1) - [`17abffa`](https://github.com/morluto/rea/commit/17abffab204848d3f7daf568a654d08e1bf5ff06) feat(artifact): reconstruct JavaScript application structure ### 📊 Changes **174 files changed** (+11773 additions, -74 deletions) <details> <summary>View changed files</summary> 📝 `AGENTS.md` (+3 -3) 📝 `README.md` (+3 -2) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) ➕ `docs/api/classes/application_JavaScriptArtifactGraphAccumulator.JavaScriptArtifactGraphAccumulator.html` (+135 -0) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/domain_permissionPolicy.PermissionGrantError.html` (+1 -1) 📝 `docs/api/classes/ghidra_GhidraLauncher.GhidraLaunchError.html` (+1 -1) 📝 `docs/api/classes/ghidra_GhidraSessionError.GhidraSessionError.html` (+1 -1) 📝 `docs/api/classes/ghidra_protocol.GhidraRemoteError.html` (+1 -1) ➕ `docs/api/functions/application_JavaScriptArtifactAnalysis.analyzeJavaScriptArtifactFiles.html` (+46 -0) ➕ `docs/api/functions/application_JavaScriptArtifactFiles.readJavaScriptArtifactFiles.html` (+47 -0) ➕ `docs/api/functions/application_JavaScriptArtifactGraphBuilder.buildJavaScriptArtifactGraph.html` (+47 -0) ➕ `docs/api/functions/application_JavaScriptArtifactGraphContext.addArtifactContainsEdge.html` (+45 -0) ➕ `docs/api/functions/application_JavaScriptArtifactGraphContext.addAstContainsEdge.html` (+45 -0) ➕ `docs/api/functions/application_JavaScriptArtifactGraphContext.addStaticInferenceEdge.html` (+45 -0) ➕ `docs/api/functions/application_JavaScriptArtifactGraphContext.addUnavailableStaticParseScope.html` (+45 -0) _...and 80 more files_ </details> ### 📄 Description ## Summary Build the bounded, parse-only JavaScript artifact reconstruction layer that the Electron workflow can compose in the next PR. - inventory directory, ASAR, nested-ASAR, and unpacked-native inputs without executing application code - identify package/main/preload/renderer roles and project deterministic JavaScript Application Graph v1 nodes, edges, evidence, coverage, and explicit unknowns - recover Webpack/Rspack registrations and modules with Babel AST parsing, plus static imports, dynamic imports, CommonJS requires, workers, routes, endpoints, storage, and vendor markers - add digest and AST fingerprints with exact truncation/budget reporting - gate source-map metadata behind separate approval and retain only bounded source names/content digests - normalize malformed ASAR operations into typed format errors while preserving cancellation - document the reconstruction contract and regenerate TypeDoc output ## Why Electron applications concentrate useful reverse-engineering evidence in packaged JavaScript, especially `app.asar`. This adds a provider-neutral reconstruction boundary that can support the higher-level Electron workflow without coupling it to Hopper, Ghidra, a browser runtime, or application execution. ## Contract and compatibility This is additive application/domain functionality. It does not register a new CLI or MCP tool, change the existing tool inventory, alter configuration, or require migration. The next Electron workflow PR will expose this layer through the existing permission and evidence model. Observations, static inferences, and unavailable/unknown scopes remain distinct. Results are deterministic and bounded. Symlinks are not followed, traversal is rejected, JavaScript is never evaluated, and source-map contents are not returned. ## Validation - `nvm use 24.18.0 && npm run check` (run against the final commit; 124 files / 881 tests) - `npx vitest run tests/javascriptArtifactReconstruction.test.ts --coverage.enabled=false --reporter=dot` (12 tests) - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - `npm run docs:generate` - `npm run docs:check` The fixtures are source-owned and include non-execution assertions. Real Hopper, Ghidra, and browser verification were not run because this PR makes no provider- or runtime-specific claim. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:18 +00:00