[PR #255] [MERGED] feat(electron): reconcile static artifacts with passive runtime #1903

New issue

Closed

opened 2026-10-16 21:12:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/255
Author: @N0zoM1z0
Created: 7/16/2026
Status: ✅ Merged
Merged: 7/16/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/reconcile-electron-runtime

📝 Commits (2)

78317c5 feat(electron): reconcile static artifacts with passive runtime
4b6ecc4 docs: refresh runtime reconciliation API

📊 Changes

258 files changed (+7613 additions, -654 deletions)

View changed files

📝 .github/pull_request_template.md (+1 -1)
📝 AGENTS.md (+3 -3)
📝 CONTRIBUTING.md (+2 -2)
📝 README.md (+15 -15)
📝 README_ar.md (+13 -13)
📝 README_ja.md (+13 -13)
📝 README_ko.md (+13 -13)
📝 README_zh.md (+13 -13)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_JavaScriptArtifactGraphAccumulator.JavaScriptArtifactGraphAccumulator.html (+8 -8)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/browser_CdpBrowserProvider.CdpBrowserProvider.html (+4 -4)
📝 docs/api/classes/browser_CdpCaptureEvents.CdpCaptureEvents.html (+43 -20)
📝 docs/api/classes/browser_CdpElectronProvider.CdpElectronProvider.html (+3 -3)
📝 docs/api/classes/domain_errors.AnalysisCancelledError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html (+1 -1)

...and 80 more files

📄 Description

Summary

add reconcile_javascript_runtime with matching between passive browser/Electron Evidence and operator-approved JavaScript application, cache, and asset graphs
preserve target, frame, script, worker, and service-worker observations; report loaded, resident, not-observed, unknown, ambiguous, digest-mismatch, and unmatched states with explicit basis
retain exact-origin/root and independent source-map authority, add a bounded local verifier, and keep the provider passive (no evaluate, navigation, click, or invoke methods)
expose equivalent MCP and CLI behavior, update the catalog to 80 MCP tools / 40 CLI commands, documentation, generated API reference, and the shipped analysis skill

Security and behavior

Runtime/static mappings only narrow correspondence candidates and do not grant filesystem, origin, source-text, or source-map authority. Reconciliation outputs IDs, paths, digests, counts, coverage, and reasons; captured source text is never copied into derived output. Browser source Evidence is accepted only from an approved source capture, and Electron additionally requires explicit source-capture approval.

Validation

npm run check (126 files, 898 tests)
npm run knip
npm run jscpd
npm run scan:todos
npm run docs:generate
npm run verify:browser with Google Chrome 150
CC=gcc-13 CXX=g++-13 npm run verify:package (80 MCP tools, 6 prompts)
python /home/pentester/.codex/skills/.system/skill-creator/scripts/quick_validate.py skills/rea-analysis
local operator-provided Notion app/cache static benchmark (artifacts not committed): app graph 362 nodes / 467 edges; cache graph 5,984 nodes / 12,455 edges with partial/truncated status as expected

Real Hopper and Ghidra verification were not run because their behavior is unchanged. No live Notion CDP Evidence was available, so this PR does not claim a real Notion runtime correspondence; synthetic reconciliation and real passive Chrome capture paths are covered.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/255 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/16/2026 **Status:** ✅ Merged **Merged:** 7/16/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/reconcile-electron-runtime` --- ### 📝 Commits (2) - [`78317c5`](https://github.com/morluto/rea/commit/78317c5beb168c01530c682135410436d2adc7bd) feat(electron): reconcile static artifacts with passive runtime - [`4b6ecc4`](https://github.com/morluto/rea/commit/4b6ecc421cb964b80a7550115ddaf5c15d8900d3) docs: refresh runtime reconciliation API ### 📊 Changes **258 files changed** (+7613 additions, -654 deletions) <details> <summary>View changed files</summary> 📝 `.github/pull_request_template.md` (+1 -1) 📝 `AGENTS.md` (+3 -3) 📝 `CONTRIBUTING.md` (+2 -2) 📝 `README.md` (+15 -15) 📝 `README_ar.md` (+13 -13) 📝 `README_ja.md` (+13 -13) 📝 `README_ko.md` (+13 -13) 📝 `README_zh.md` (+13 -13) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_JavaScriptArtifactGraphAccumulator.JavaScriptArtifactGraphAccumulator.html` (+8 -8) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/browser_CdpBrowserProvider.CdpBrowserProvider.html` (+4 -4) 📝 `docs/api/classes/browser_CdpCaptureEvents.CdpCaptureEvents.html` (+43 -20) 📝 `docs/api/classes/browser_CdpElectronProvider.CdpElectronProvider.html` (+3 -3) 📝 `docs/api/classes/domain_errors.AnalysisCancelledError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html` (+1 -1) _...and 80 more files_ </details> ### 📄 Description ## Summary - add `reconcile_javascript_runtime` with matching between passive browser/Electron Evidence and operator-approved JavaScript application, cache, and asset graphs - preserve target, frame, script, worker, and service-worker observations; report loaded, resident, not-observed, unknown, ambiguous, digest-mismatch, and unmatched states with explicit basis - retain exact-origin/root and independent source-map authority, add a bounded local verifier, and keep the provider passive (no evaluate, navigation, click, or invoke methods) - expose equivalent MCP and CLI behavior, update the catalog to 80 MCP tools / 40 CLI commands, documentation, generated API reference, and the shipped analysis skill ## Security and behavior Runtime/static mappings only narrow correspondence candidates and do not grant filesystem, origin, source-text, or source-map authority. Reconciliation outputs IDs, paths, digests, counts, coverage, and reasons; captured source text is never copied into derived output. Browser source Evidence is accepted only from an approved source capture, and Electron additionally requires explicit source-capture approval. ## Validation - `npm run check` (126 files, 898 tests) - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - `npm run docs:generate` - `npm run verify:browser` with Google Chrome 150 - `CC=gcc-13 CXX=g++-13 npm run verify:package` (80 MCP tools, 6 prompts) - `python /home/pentester/.codex/skills/.system/skill-creator/scripts/quick_validate.py skills/rea-analysis` - local operator-provided Notion app/cache static benchmark (artifacts not committed): app graph 362 nodes / 467 edges; cache graph 5,984 nodes / 12,455 edges with partial/truncated status as expected Real Hopper and Ghidra verification were not run because their behavior is unchanged. No live Notion CDP Evidence was available, so this PR does not claim a real Notion runtime correspondence; synthetic reconciliation and real passive Chrome capture paths are covered. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:21 +00:00