[GH-ISSUE #35] Model applications as artifact graphs and add safe decomposition #22

New issue

Closed

opened 2026-10-15 18:20:04 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:20:04 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/35

Goal

Treat an application or package as a graph of related artifacts instead of resolving it only to one executable.

Scope

Add inventory_artifact and extract_artifact capabilities for DMG, ZIP, package, ASAR, JavaScript bundles, source maps, universal slices, IPA, APK, plists, entitlements, resources, native addons, and embedded frameworks.

Safety and provenance

Default to inventory-only behavior.
Require explicit output roots for extraction.
Prevent path traversal, symlink escape, overwrite, and decompression-bomb behavior.
Hash every discovered or derived artifact and record parent-child derivation.
Record producing commands and deterministic manifests.
Clearly label operations that mount media, write files, or invoke external tools.

Acceptance criteria

A bundle can be traversed from container to executable, frameworks, resources, JavaScript, source maps, and native addons.
Repeated inventory produces stable artifact identities.
Extraction is contained and cleanup is verified.
Large artifacts are paginated or exported to files instead of exceeding protocol limits.

Roadmap expansion

Historical-source and bundle children

Historical source is a structural donor, not current behavioral authority. Record immutable manifests and provenance, then classify mappings using strings, constants, call shapes, AST structure, and observed behavior. Preserve generated/original locations and derivation edges.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/35 ## Goal Treat an application or package as a graph of related artifacts instead of resolving it only to one executable. ## Scope Add inventory_artifact and extract_artifact capabilities for DMG, ZIP, package, ASAR, JavaScript bundles, source maps, universal slices, IPA, APK, plists, entitlements, resources, native addons, and embedded frameworks. ## Safety and provenance - Default to inventory-only behavior. - Require explicit output roots for extraction. - Prevent path traversal, symlink escape, overwrite, and decompression-bomb behavior. - Hash every discovered or derived artifact and record parent-child derivation. - Record producing commands and deterministic manifests. - Clearly label operations that mount media, write files, or invoke external tools. ## Acceptance criteria - A bundle can be traversed from container to executable, frameworks, resources, JavaScript, source maps, and native addons. - Repeated inventory produces stable artifact identities. - Extraction is contained and cleanup is verified. - Large artifacts are paginated or exported to files instead of exceeding protocol limits. ## Roadmap expansion ### Historical-source and bundle children - [x] #66 - [x] #67 - [x] #68 Historical source is a structural donor, not current behavioral authority. Record immutable manifests and provenance, then classify mappings using strings, constants, call shapes, AST structure, and observed behavior. Preserve generated/original locations and derivation edges.

bsakaguchi

2026-10-15 18:20:04 +00:00

closed this issue
added the
area: cli

P1: high

area: domain

roadmap

enhancement
labels

bsakaguchi commented

2026-10-15 18:20:05 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Current main delivers artifact graphs and safe readers for directories, ASAR, ZIP, DMG, and Mach-O slices, with containment-safe extraction, JavaScript reconstruction, and historical import. Remaining scope is unsupported container/resource families, live packaged-artifact cleanup proof, and the focused semantic mapping/index work in #67/#68.

@morluto commented on GitHub (Jul 17, 2026): Current main delivers artifact graphs and safe readers for directories, ASAR, ZIP, DMG, and Mach-O slices, with containment-safe extraction, JavaScript reconstruction, and historical import. Remaining scope is unsupported container/resource families, live packaged-artifact cleanup proof, and the focused semantic mapping/index work in #67/#68.

bsakaguchi commented

2026-10-15 18:20:06 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#356
#357

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #356 - [ ] #357 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:22:20 +00:00

[GH-ISSUE #353] Add deeper Objective-C/Swift metadata and database save/licensing support #199

bsakaguchi referenced this issue

2026-10-15 18:22:20 +00:00

[GH-ISSUE #352] Add bounded byte reads and file-offset mapping to Hopper #200

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-15 18:28:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794