[PR #280] [MERGED] fix(electron): keep missing unpacked ASAR entries unavailable #1921

New issue

Closed

opened 2026-10-16 21:12:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:31 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/280
Author: @N0zoM1z0
Created: 7/16/2026
Status: ✅ Merged
Merged: 7/16/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/electron-missing-unpacked-asar

📝 Commits (1)

626d898 fix(electron): keep missing unpacked ASAR entries unavailable

📊 Changes

5 files changed (+109 additions, -13 deletions)

View changed files

📝 README.md (+5 -1)
📝 docs/javascript-artifact-reconstruction.md (+19 -10)
📝 src/application/ArtifactInventory.ts (+21 -1)
📝 src/artifacts/AsarArtifactReader.ts (+20 -0)
📝 tests/javascriptArtifactReconstruction.test.ts (+44 -1)

📄 Description

Summary

Treat missing .asar.unpacked companion bytes as an unavailable ASAR occurrence instead of a fatal format failure.
Preserve the logical ASAR occurrence with hash_status: unavailable, an explicit limitation, and no content-addressed child artifact.
Keep embedded JavaScript/Electron reconstruction usable for real-world ASARs whose native/resource unpacked companions were not supplied.
Document the behavior in the README and JavaScript artifact reconstruction docs.

Root cause

Some real Electron artifacts, including the local Notion 7.6.1 app.asar benchmark, declare unpacked native companion entries in ASAR metadata while the operator-supplied artifact set does not include the matching <archive>.unpacked files. REA previously mapped that missing local file to an ASAR format failure, which stopped otherwise valid embedded JavaScript analysis.

Real artifact check

Local Notion artifact used for verification only; not committed:

path: /home/pentester/coding/codex_ida/notion/artifacts/notion-7.6.1/app.asar
sha256: 97c41bc14fc0ea8c91cd34f502660963dfdf294d5eb35165ccac9d30963069d4
unavailable unpacked occurrences observed: 6 native .node entries
reconstruction result: 446 graph nodes, 551 graph edges, 69 parsed JavaScript files, 0 parse failures

Verification

npx vitest run tests/javascriptArtifactReconstruction.test.ts tests/artifactMcp.test.ts --coverage=false
npm run typecheck
npm run build
real Notion analyze-javascript-application against the local app.asar above
npm run check
npm run knip
npm run jscpd
npm run scan:todos
CC=/usr/bin/gcc-13 CXX=/usr/bin/g++-13 npm run verify:package
GHIDRA_INSTALL_DIR=$HOME/.local/share/rea-tools/ghidra_12.1.2_PUBLIC npm run verify:ghidra
git diff --check

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/280 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/16/2026 **Status:** ✅ Merged **Merged:** 7/16/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/electron-missing-unpacked-asar` --- ### 📝 Commits (1) - [`626d898`](https://github.com/morluto/rea/commit/626d898c36817f9656e661d9d1ef7d76f1131382) fix(electron): keep missing unpacked ASAR entries unavailable ### 📊 Changes **5 files changed** (+109 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+5 -1) 📝 `docs/javascript-artifact-reconstruction.md` (+19 -10) 📝 `src/application/ArtifactInventory.ts` (+21 -1) 📝 `src/artifacts/AsarArtifactReader.ts` (+20 -0) 📝 `tests/javascriptArtifactReconstruction.test.ts` (+44 -1) </details> ### 📄 Description ## Summary - Treat missing `.asar.unpacked` companion bytes as an unavailable ASAR occurrence instead of a fatal format failure. - Preserve the logical ASAR occurrence with `hash_status: unavailable`, an explicit limitation, and no content-addressed child artifact. - Keep embedded JavaScript/Electron reconstruction usable for real-world ASARs whose native/resource unpacked companions were not supplied. - Document the behavior in the README and JavaScript artifact reconstruction docs. ## Root cause Some real Electron artifacts, including the local Notion 7.6.1 `app.asar` benchmark, declare unpacked native companion entries in ASAR metadata while the operator-supplied artifact set does not include the matching `<archive>.unpacked` files. REA previously mapped that missing local file to an ASAR `format` failure, which stopped otherwise valid embedded JavaScript analysis. ## Real artifact check Local Notion artifact used for verification only; not committed: - path: `/home/pentester/coding/codex_ida/notion/artifacts/notion-7.6.1/app.asar` - sha256: `97c41bc14fc0ea8c91cd34f502660963dfdf294d5eb35165ccac9d30963069d4` - unavailable unpacked occurrences observed: 6 native `.node` entries - reconstruction result: 446 graph nodes, 551 graph edges, 69 parsed JavaScript files, 0 parse failures ## Verification - `npx vitest run tests/javascriptArtifactReconstruction.test.ts tests/artifactMcp.test.ts --coverage=false` - `npm run typecheck` - `npm run build` - real Notion `analyze-javascript-application` against the local app.asar above - `npm run check` - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - `CC=/usr/bin/gcc-13 CXX=/usr/bin/g++-13 npm run verify:package` - `GHIDRA_INSTALL_DIR=$HOME/.local/share/rea-tools/ghidra_12.1.2_PUBLIC npm run verify:ghidra` - `git diff --check` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:31 +00:00