[PR #402] [MERGED] fix(cli): route JavaScript applications from analyze #1956

New issue

Closed

opened 2026-10-16 21:12:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:50 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/402
Author: @N0zoM1z0
Created: 7/21/2026
Status: ✅ Merged
Merged: 7/21/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/cli-javascript-analysis-routing

📝 Commits (1)

74965d9 fix(cli): route JavaScript applications from analyze

📊 Changes

17 files changed (+227 additions, -68 deletions)

View changed files

📝 README.md (+8 -1)
📝 docs/api/functions/application_JavaScriptApplicationService.analyzeJavaScriptApplication.html (+1 -1)
📝 docs/api/functions/application_JavaScriptApplicationService.analyzeJavaScriptApplicationValidated.html (+1 -1)
📝 docs/api/functions/domain_javascriptStaticAnalysisHelpers.argumentNode.html (+2 -2)
📝 docs/api/functions/domain_javascriptStaticAnalysisHelpers.endpointArgument.html (+2 -2)
📝 docs/api/functions/domain_javascriptStaticAnalysisHelpers.factoryRequireName.html (+2 -2)
📝 docs/api/functions/domain_javascriptStaticAnalysisHelpers.moduleFactory.html (+3 -3)
📝 docs/api/functions/domain_javascriptStaticAnalysisHelpers.modulePropertyName.html (+2 -2)
📝 docs/api/functions/domain_webBundleAnalyzerAst.endpointArgument.html (+2 -2)
📝 docs/api/functions/domain_webBundleAnalyzerAst.objectValue.html (+2 -2)
📝 docs/javascript-artifact-reconstruction.md (+10 -2)
📝 scripts/verify-package-artifact.mjs (+20 -1)
📝 src/application/JavaScriptApplicationService.ts (+10 -2)
📝 src/cli/coreAnalysisCommands.ts (+52 -7)
➕ src/cli/javascriptApplicationAnalysis.ts (+24 -0)
📝 src/cliElectronCommands.ts (+24 -38)
📝 tests/electronCli.test.ts (+62 -0)

📄 Description

Summary

route generic rea analyze calls for directories and .asar paths to the static JavaScript application provider
keep native files, .app bundles, and explicit --provider / --snapshot requests on the existing deep-analysis path
share the JavaScript CLI execution boundary and return actionable approval validation details
document the generic route and verify it in source and packaged CLI tests

Root cause

The generic analyze command was hard-wired to binary_overview, so JavaScript application directories and ASARs reached native deep-provider discovery even though REA already exposed a static JavaScript application service and dedicated CLI command.

Behavior change

rea analyze PATH --approved now detects directories and .asar files and invokes analyze_javascript_application when no provider or snapshot override is present. The request still requires an administrator-approved investigation root and per-call approval.

Verification

npm run check — 343 test files, 2,296 tests passed
focused Electron/application CLI tests — 13 tests passed
isolated package, install, discovery, dedicated JS CLI, and generic JS routing verification passed
git diff --check

The complete npm run verify:package reached and passed the artifact/JavaScript routing stage, then the existing interactive setup PTY produced no output and hit its 20-second timeout in this environment. The relevant packaged stages were rerun independently and passed.

Real Hopper verification: not performed (provider adapter unchanged).
Real Ghidra verification: not performed (provider adapter unchanged).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/402 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/21/2026 **Status:** ✅ Merged **Merged:** 7/21/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/cli-javascript-analysis-routing` --- ### 📝 Commits (1) - [`74965d9`](https://github.com/morluto/rea/commit/74965d9088cca6e048a62352567b95c63c6621d2) fix(cli): route JavaScript applications from analyze ### 📊 Changes **17 files changed** (+227 additions, -68 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+8 -1) 📝 `docs/api/functions/application_JavaScriptApplicationService.analyzeJavaScriptApplication.html` (+1 -1) 📝 `docs/api/functions/application_JavaScriptApplicationService.analyzeJavaScriptApplicationValidated.html` (+1 -1) 📝 `docs/api/functions/domain_javascriptStaticAnalysisHelpers.argumentNode.html` (+2 -2) 📝 `docs/api/functions/domain_javascriptStaticAnalysisHelpers.endpointArgument.html` (+2 -2) 📝 `docs/api/functions/domain_javascriptStaticAnalysisHelpers.factoryRequireName.html` (+2 -2) 📝 `docs/api/functions/domain_javascriptStaticAnalysisHelpers.moduleFactory.html` (+3 -3) 📝 `docs/api/functions/domain_javascriptStaticAnalysisHelpers.modulePropertyName.html` (+2 -2) 📝 `docs/api/functions/domain_webBundleAnalyzerAst.endpointArgument.html` (+2 -2) 📝 `docs/api/functions/domain_webBundleAnalyzerAst.objectValue.html` (+2 -2) 📝 `docs/javascript-artifact-reconstruction.md` (+10 -2) 📝 `scripts/verify-package-artifact.mjs` (+20 -1) 📝 `src/application/JavaScriptApplicationService.ts` (+10 -2) 📝 `src/cli/coreAnalysisCommands.ts` (+52 -7) ➕ `src/cli/javascriptApplicationAnalysis.ts` (+24 -0) 📝 `src/cliElectronCommands.ts` (+24 -38) 📝 `tests/electronCli.test.ts` (+62 -0) </details> ### 📄 Description ## Summary - route generic `rea analyze` calls for directories and `.asar` paths to the static JavaScript application provider - keep native files, `.app` bundles, and explicit `--provider` / `--snapshot` requests on the existing deep-analysis path - share the JavaScript CLI execution boundary and return actionable approval validation details - document the generic route and verify it in source and packaged CLI tests ## Root cause The generic `analyze` command was hard-wired to `binary_overview`, so JavaScript application directories and ASARs reached native deep-provider discovery even though REA already exposed a static JavaScript application service and dedicated CLI command. ## Behavior change `rea analyze PATH --approved` now detects directories and `.asar` files and invokes `analyze_javascript_application` when no provider or snapshot override is present. The request still requires an administrator-approved investigation root and per-call approval. ## Verification - `npm run check` — 343 test files, 2,296 tests passed - focused Electron/application CLI tests — 13 tests passed - isolated package, install, discovery, dedicated JS CLI, and generic JS routing verification passed - `git diff --check` The complete `npm run verify:package` reached and passed the artifact/JavaScript routing stage, then the existing interactive setup PTY produced no output and hit its 20-second timeout in this environment. The relevant packaged stages were rerun independently and passed. Real Hopper verification: not performed (provider adapter unchanged). Real Ghidra verification: not performed (provider adapter unchanged). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:50 +00:00