morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #252] [MERGED] feat(electron): map static process and IPC boundaries #1902

New issue

Closed

opened 2026-10-16 21:12:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/252
Author: @N0zoM1z0
Created: 7/15/2026
Status: ✅ Merged
Merged: 7/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/map-electron-boundaries

📝 Commits (1)

a64fede feat(electron): map static process and IPC boundaries

📊 Changes

279 files changed (+7485 additions, -779 deletions)

View changed files

📝 .github/pull_request_template.md (+1 -1)
📝 AGENTS.md (+7 -3)
📝 CONTRIBUTING.md (+2 -2)
📝 README.md (+25 -23)
📝 README_ar.md (+13 -13)
📝 README_ja.md (+13 -13)
📝 README_ko.md (+13 -13)
📝 README_zh.md (+13 -13)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_JavaScriptArtifactGraphAccumulator.JavaScriptArtifactGraphAccumulator.html (+8 -8)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisCancelledError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisInputError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisOutputError.html (+1 -1)

...and 80 more files

📄 Description

What changed

add one target-free analyze_javascript_application MCP tool and matching rea analyze-javascript-application CLI command
extend the existing bounded Babel traversal to observe explicit BrowserWindow / webPreferences, preload entrypoints, contextBridge surfaces, Electron IPC, sender-validation candidates, utility processes, and JavaScript-requested .node bindings without executing application code
project those observations into JavaScript Application Graph v1, with only unique exact literal IPC matches represented as inferences
retain dynamic, ambiguous, and unpaired channels as unresolved; retain native member names as requested bindings rather than verified binary exports
enforce absolute approved input paths through investigation_input authority and keep source-map reading separately approved
update the public catalog, skill, package verifier, TypeDoc, localized inventory facts, and tool count from 78 to 79

Why

PR11 reconstructed package and bundle structure but stopped before Electron trust boundaries. This change supplies the static architecture/security map needed to connect renderer, preload, main, utility, and native layers while preserving REA's observation / inference / unknown distinctions.

Contract and compatibility

This is additive. Existing Electron CDP tools remain owned by rea-cdp-electron; the new static workflow is owned by rea-javascript-application. No live browser, Electron, Hopper, or Ghidra process is required.

Example:

{
  "input_path": "/absolute/approved/apps/app.asar",
  "format": "auto",
  "approved": true,
  "source_map_read_approved": false
}

The response is Evidence v2 with predicate rea.javascript-application-analysis/v1, a JAG v1 result, bounded statistics, Electron summary counts, local digests/paths, and explicit limitations.

Verification

npm run typecheck
npm run lint (passes; repository baseline warnings remain)
npm run format:check
npm run docs:check
npx vitest run --maxWorkers=1 --no-file-parallelism --reporter=dot — 125 files, 887 tests passed; 83.60% statements / 72.48% branches / 86.61% functions / 85.93% lines
focused Electron application / MCP / CLI tests — 8 passed
isolated pre-existing timing suites after a high-load parallel run — 32 passed
npm run knip
npm run jscpd
npm run scan:todos
CC=gcc-13 CXX=g++-13 npm run verify:package — packaged CLI, setup transaction, skill, and 79-tool target-free MCP server passed

The default parallel npm run check completed all non-test gates and 884/887 tests, but three pre-existing sub-second / five-second timing assertions flaked under WSL host load. Their two files passed 32/32 in isolation, and the complete single-worker suite passed 887/887.

Real Hopper: not run; no Hopper claim changed.
Real Ghidra: not run; no Ghidra claim changed.
Real Browser: not run; this PR adds static artifact analysis and does not change passive CDP behavior.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/252 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/15/2026 **Status:** ✅ Merged **Merged:** 7/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/map-electron-boundaries` --- ### 📝 Commits (1) - [`a64fede`](https://github.com/morluto/rea/commit/a64fede60a1f11902b8f97b28dcb71f322cec30a) feat(electron): map static process and IPC boundaries ### 📊 Changes **279 files changed** (+7485 additions, -779 deletions) <details> <summary>View changed files</summary> 📝 `.github/pull_request_template.md` (+1 -1) 📝 `AGENTS.md` (+7 -3) 📝 `CONTRIBUTING.md` (+2 -2) 📝 `README.md` (+25 -23) 📝 `README_ar.md` (+13 -13) 📝 `README_ja.md` (+13 -13) 📝 `README_ko.md` (+13 -13) 📝 `README_zh.md` (+13 -13) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_JavaScriptArtifactGraphAccumulator.JavaScriptArtifactGraphAccumulator.html` (+8 -8) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisCancelledError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisInputError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisOutputError.html` (+1 -1) _...and 80 more files_ </details> ### 📄 Description ## What changed - add one target-free `analyze_javascript_application` MCP tool and matching `rea analyze-javascript-application` CLI command - extend the existing bounded Babel traversal to observe explicit `BrowserWindow` / `webPreferences`, preload entrypoints, `contextBridge` surfaces, Electron IPC, sender-validation candidates, utility processes, and JavaScript-requested `.node` bindings without executing application code - project those observations into JavaScript Application Graph v1, with only unique exact literal IPC matches represented as inferences - retain dynamic, ambiguous, and unpaired channels as unresolved; retain native member names as requested bindings rather than verified binary exports - enforce absolute approved input paths through `investigation_input` authority and keep source-map reading separately approved - update the public catalog, skill, package verifier, TypeDoc, localized inventory facts, and tool count from 78 to 79 ## Why PR11 reconstructed package and bundle structure but stopped before Electron trust boundaries. This change supplies the static architecture/security map needed to connect renderer, preload, main, utility, and native layers while preserving REA's observation / inference / unknown distinctions. ## Contract and compatibility This is additive. Existing Electron CDP tools remain owned by `rea-cdp-electron`; the new static workflow is owned by `rea-javascript-application`. No live browser, Electron, Hopper, or Ghidra process is required. Example: ```json { "input_path": "/absolute/approved/apps/app.asar", "format": "auto", "approved": true, "source_map_read_approved": false } ``` The response is Evidence v2 with predicate `rea.javascript-application-analysis/v1`, a JAG v1 result, bounded statistics, Electron summary counts, local digests/paths, and explicit limitations. ## Verification - `npm run typecheck` - `npm run lint` (passes; repository baseline warnings remain) - `npm run format:check` - `npm run docs:check` - `npx vitest run --maxWorkers=1 --no-file-parallelism --reporter=dot` — 125 files, 887 tests passed; 83.60% statements / 72.48% branches / 86.61% functions / 85.93% lines - focused Electron application / MCP / CLI tests — 8 passed - isolated pre-existing timing suites after a high-load parallel run — 32 passed - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - `CC=gcc-13 CXX=g++-13 npm run verify:package` — packaged CLI, setup transaction, skill, and 79-tool target-free MCP server passed The default parallel `npm run check` completed all non-test gates and 884/887 tests, but three pre-existing sub-second / five-second timing assertions flaked under WSL host load. Their two files passed 32/32 in isolation, and the complete single-worker suite passed 887/887. Real Hopper: not run; no Hopper claim changed. Real Ghidra: not run; no Ghidra claim changed. Real Browser: not run; this PR adds static artifact analysis and does not change passive CDP behavior. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:21 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:56:31 +00:00

[PR #1902] [MERGED] fix(install): describe automatic setup and guard truncated downloads #4894

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1902

No description provided.

Rows
Columns