[PR #464] [MERGED] feat(electron): add autonomous Electron runtime analysis #2012

New issue

Closed

opened 2026-10-16 21:13:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/464
Author: @morluto
Created: 8/5/2026
Status: ✅ Merged
Merged: 8/5/2026
Merged by: @morluto

Base: main ← Head: codex/electron-agent-runtime-autonomy

📝 Commits (10+)

fd0549b feat: add autonomous Electron runtime analysis
90bea6e feat(electron): add lifecycle and boundary telemetry
3874b4b feat(electron): capture runtime boundary evidence
3a56b78 fix(electron): package boundary hook helper
c579f04 feat(electron): report active capture coverage
13b8f4a fix(electron): account for bring-your-own runtime
be97a50 feat(electron): expand agent-owned runtime scenarios
227e384 fix(ghidra): keep fixture credentials out of argv
7ec73ff perf(test): serialize local test and docs workloads
a4476e9 fix(electron): harden active runtime capture

📊 Changes

104 files changed (+5055 additions, -196 deletions)

View changed files

📝 .github/workflows/ci.yml (+13 -3)
📝 .github/workflows/release.yml (+38 -0)
📝 AGENTS.md (+9 -0)
📝 README.md (+3 -3)
📝 README_ar.md (+1 -1)
📝 README_ja.md (+1 -1)
📝 README_ko.md (+1 -1)
📝 README_zh.md (+1 -1)
📝 docs/electron-observation.md (+52 -0)
📝 docs/installation.md (+27 -0)
📝 docs/process-capture.md (+5 -3)
📝 docs/product-catalog.json (+16 -8)
📝 docs/testing.md (+10 -0)
📝 docs/verification/managed-conformance-manifest.json (+5 -5)
📝 knip.json (+1 -1)
📝 package.json (+13 -6)
📝 release-please-config.json (+10 -0)
➕ scripts/electron-active-hook-boundaries.cjs (+394 -0)
➕ scripts/electron-active-hook.cjs (+501 -0)
📝 scripts/generate-completion-ledger.mjs (+15 -4)

...and 80 more files

📄 Description

Summary

This PR makes REA substantially more autonomous for Electron and JavaScript runtime investigations. It adds bounded, provider-owned Electron actions through Playwright, correlates window/WebContents/process/IPC/timeline events, and makes the resulting Evidence usable by runtime reconciliation.

Root causes resolved

Bare file:// Inspector targets have no source identity, so they are now excluded instead of being authorized as the first configured root.
Active Electron paths are realpath-canonicalized before containment and permission checks.
IPC channels, argument-shape arrays, runtime events, action errors, and scenario evidence are bounded and secret-safe.
Popup creation is denied at setWindowOpenHandler; custom Electron sessions are patched as they are created; uncaught exceptions still terminate the target normally.
Provider-owned Electron launches carry a run token, verify process lineage, and clean the root plus verified descendant process groups after Playwright closes the app.
Coverage now reports preload/renderer boundaries as unavailable unless a renderer-context hook actually ran.
Runtime provenance uses process.versions.electron, not the packaged app version.
Managed conformance commitments normalize host metadata to portable values so Linux and macOS freshness checks agree.

Validation

Full Vitest suite: 326 test files and 1,663 tests passed.
npm run check:fast, npm run lint, npm run format:check, and npm run docs:check passed.
Real Chrome verifier passed, including browser scenario parity, attach disconnect cleanup, launched-process cleanup, and temporary-profile cleanup.
Electron hook/action, passive Inspector, reconciliation, MCP, lifecycle, and permission-policy tests passed.
npm run verify:electron built successfully but could not launch because this host has no approved Electron executable and no local Electron package; it requires REA_ELECTRON_EXECUTABLE on a host-provided Electron installation.
Playwright lifecycle behavior was checked against the current official Playwright SDK documentation through Context7.

Scope note

The Windows Ghidra review finding is an existing, intentional fail-closed boundary: verified Job Object ownership, private DACL enforcement, and reparse-safe path admission are not implemented, so enabling that provider would overclaim authority. This Electron PR does not weaken that boundary.

Issues

Closes #460
Closes #62
Closes #337
Closes #338
Closes #376

Related broader Electron follow-up work: #64 and #375.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/464 **Author:** [@morluto](https://github.com/morluto) **Created:** 8/5/2026 **Status:** ✅ Merged **Merged:** 8/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/electron-agent-runtime-autonomy` --- ### 📝 Commits (10+) - [`fd0549b`](https://github.com/morluto/rea/commit/fd0549bd0d68a057de66a05d6d05d0a673097364) feat: add autonomous Electron runtime analysis - [`90bea6e`](https://github.com/morluto/rea/commit/90bea6e79632094d936d6f200036f4951d0b9d7f) feat(electron): add lifecycle and boundary telemetry - [`3874b4b`](https://github.com/morluto/rea/commit/3874b4bec409d2ef4b01c4521fb2352f216b4613) feat(electron): capture runtime boundary evidence - [`3a56b78`](https://github.com/morluto/rea/commit/3a56b787a7931bccdb76183ac8bdcd53e17f6264) fix(electron): package boundary hook helper - [`c579f04`](https://github.com/morluto/rea/commit/c579f04fe3d9f3d0346ae6a7a50d33c6c21ec3b6) feat(electron): report active capture coverage - [`13b8f4a`](https://github.com/morluto/rea/commit/13b8f4a39f99573eff77d94e21e7dde3d06827e9) fix(electron): account for bring-your-own runtime - [`be97a50`](https://github.com/morluto/rea/commit/be97a5094cfeeeed2125ab10e7404dec9607bc0c) feat(electron): expand agent-owned runtime scenarios - [`227e384`](https://github.com/morluto/rea/commit/227e38444d98569512a734f6b691eb12fffbb360) fix(ghidra): keep fixture credentials out of argv - [`7ec73ff`](https://github.com/morluto/rea/commit/7ec73ffcd00ce49a512fb2c905c181c0dc303c23) perf(test): serialize local test and docs workloads - [`a4476e9`](https://github.com/morluto/rea/commit/a4476e9b1f42ccb68806ea3ab91acabf7f8a818e) fix(electron): harden active runtime capture ### 📊 Changes **104 files changed** (+5055 additions, -196 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+13 -3) 📝 `.github/workflows/release.yml` (+38 -0) 📝 `AGENTS.md` (+9 -0) 📝 `README.md` (+3 -3) 📝 `README_ar.md` (+1 -1) 📝 `README_ja.md` (+1 -1) 📝 `README_ko.md` (+1 -1) 📝 `README_zh.md` (+1 -1) 📝 `docs/electron-observation.md` (+52 -0) 📝 `docs/installation.md` (+27 -0) 📝 `docs/process-capture.md` (+5 -3) 📝 `docs/product-catalog.json` (+16 -8) 📝 `docs/testing.md` (+10 -0) 📝 `docs/verification/managed-conformance-manifest.json` (+5 -5) 📝 `knip.json` (+1 -1) 📝 `package.json` (+13 -6) 📝 `release-please-config.json` (+10 -0) ➕ `scripts/electron-active-hook-boundaries.cjs` (+394 -0) ➕ `scripts/electron-active-hook.cjs` (+501 -0) 📝 `scripts/generate-completion-ledger.mjs` (+15 -4) _...and 80 more files_ </details> ### 📄 Description ## Summary This PR makes REA substantially more autonomous for Electron and JavaScript runtime investigations. It adds bounded, provider-owned Electron actions through Playwright, correlates window/WebContents/process/IPC/timeline events, and makes the resulting Evidence usable by runtime reconciliation. ## Root causes resolved - Bare file:// Inspector targets have no source identity, so they are now excluded instead of being authorized as the first configured root. - Active Electron paths are realpath-canonicalized before containment and permission checks. - IPC channels, argument-shape arrays, runtime events, action errors, and scenario evidence are bounded and secret-safe. - Popup creation is denied at setWindowOpenHandler; custom Electron sessions are patched as they are created; uncaught exceptions still terminate the target normally. - Provider-owned Electron launches carry a run token, verify process lineage, and clean the root plus verified descendant process groups after Playwright closes the app. - Coverage now reports preload/renderer boundaries as unavailable unless a renderer-context hook actually ran. - Runtime provenance uses process.versions.electron, not the packaged app version. - Managed conformance commitments normalize host metadata to portable values so Linux and macOS freshness checks agree. ## Validation - Full Vitest suite: 326 test files and 1,663 tests passed. - npm run check:fast, npm run lint, npm run format:check, and npm run docs:check passed. - Real Chrome verifier passed, including browser scenario parity, attach disconnect cleanup, launched-process cleanup, and temporary-profile cleanup. - Electron hook/action, passive Inspector, reconciliation, MCP, lifecycle, and permission-policy tests passed. - npm run verify:electron built successfully but could not launch because this host has no approved Electron executable and no local Electron package; it requires REA_ELECTRON_EXECUTABLE on a host-provided Electron installation. - Playwright lifecycle behavior was checked against the current official Playwright SDK documentation through Context7. ## Scope note The Windows Ghidra review finding is an existing, intentional fail-closed boundary: verified Job Object ownership, private DACL enforcement, and reparse-safe path admission are not implemented, so enabling that provider would overclaim authority. This Electron PR does not weaken that boundary. ## Issues Closes #460 Closes #62 Closes #337 Closes #338 Closes #376 Related broader Electron follow-up work: #64 and #375. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:22 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2012

No description provided.

Rows
Columns