[PR #879] [MERGED] feat(browser): trace captured website module imports #2316

New issue

Closed

opened 2026-10-16 21:17:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/879
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/web-module-imports

📝 Commits (2)

9642f50 feat(browser): trace captured website module imports
e3afdbb fix(browser): preserve module contexts and source bindings

📊 Changes

48 files changed (+2911 additions, -21 deletions)

View changed files

📝 .github/workflows/real-browser.yml (+13 -0)
📝 README.md (+5 -1)
📝 README_ar.md (+1 -1)
📝 README_ja.md (+1 -1)
📝 README_ko.md (+1 -1)
📝 README_zh.md (+1 -1)
📝 docs/architecture.mermaid (+1 -1)
📝 docs/browser-observation.md (+2 -0)
📝 docs/product-catalog.json (+12 -10)
📝 docs/testing.md (+8 -0)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
➕ docs/website-module-trace.md (+85 -0)
📝 package.json (+1 -0)
➕ scripts/fixtures/browser-module-site.mjs (+61 -0)
➕ scripts/lib/browser-module-e2e.mjs (+390 -0)
➕ scripts/verify-browser-modules.mjs (+16 -0)
📝 scripts/verify-real-browser.mjs (+3 -0)
📝 skills/reverse-engineer-anything/SKILL.md (+2 -2)
📝 src/application/CapabilityInventory.test.ts (+29 -0)
📝 src/application/CapabilityInventory.ts (+29 -0)

...and 28 more files

📄 Description

Changes

Refs #851 and #774. Delivers the URL/import-map portion of #851; retained source-map asset pairing remains a follow-up.

Add trace_web_module_imports / trace-web-module-imports for one explicit script in an export_web_scripts manifest. Verify actual UTF-8 bytes, size and SHA; retain capture metadata/completeness and all imports/re-exports with UTF-16 source positions.
Separate artifact acquisition and native resolution ports. Reuse existing Babel syntax and Chromium import.meta.resolve, including scopes, null mappings and prefix backtracking rejection.
Preserve query/fragment identities, every captured candidate and native rejection reasons. Computed imports and execution remain unknown. A selected import map is derived context, not proof it was installed by the website.
Use an owned browser context and trusted REA resolver stub. Fulfill/block page requests locally; no captured application execution or dependency refetch. Preserve diagnostics, cancellation, cleanup failures and unsupported URL reasons.
Extend existing conditional real-Chrome CI triggers and fixtures. Unrelated deterministic CI does not acquire Chrome.

MCP example

{"name":"trace_web_module_imports","arguments":{"manifest_path":"/analysis/export/manifest.json","script_index":0,"import_map":{"path":"/analysis/import-map.json","base_url":"https://example.test/maps/"}}}

Inline Evidence includes exact source/map identities, capture completeness, native engine, each source location and resolution, all candidate captures, and explicit unknown execution.

Verification

Post-rebase focused suite: 8 files, 50 tests passed, including domain/service/producer/filesystem, compiled CLI/MCP parity, actual SDK JSON Schema2020 and Evidence record ownership.
npm run check:fast and npm run docs:check:built: passed on final main895079dd-based code. Test discovery passed before synchronization.
Fresh installed npm tarball: 8 public CLI/MCP traces with real Chrome153.0.8010.12 passed, including non-loopback HTTP importer with optional HTTPS map base. Independent real module-loading oracle verifies scopes, query/fragment module instances and native errors. No implicit refetch and no remaining descendants.
Real adapter extras verify native warnings, cancellation cleanup and escaped HTML BASE identity.
Package includes concrete resolver and excludes _reference/, .codex/ and upstream source trees.

Real Hopper/Ghidra verification was not run; those providers are unchanged. Literal native resolution needs caller-supplied Chromium; sources without literal imports do not. Page routing does not claim OS-wide network containment. Resolution does not establish execution or UI causality.

Hosted final-head verification

All reported CI checks passed on e3afdbbf92, including full real-Chrome/Wakaru, all four test shards/coverage, and Linux/macOS/Windows package lanes. The first Windows native build timed out in apt cross-compiler downloads before compilation; targeted rerun and dependent package lanes passed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/879 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/web-module-imports` --- ### 📝 Commits (2) - [`9642f50`](https://github.com/morluto/rea/commit/9642f50e61a9dde77c1d525a95a4656efa9af246) feat(browser): trace captured website module imports - [`e3afdbb`](https://github.com/morluto/rea/commit/e3afdbbf9297b70c72e1688864699ee864b38f85) fix(browser): preserve module contexts and source bindings ### 📊 Changes **48 files changed** (+2911 additions, -21 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/real-browser.yml` (+13 -0) 📝 `README.md` (+5 -1) 📝 `README_ar.md` (+1 -1) 📝 `README_ja.md` (+1 -1) 📝 `README_ko.md` (+1 -1) 📝 `README_zh.md` (+1 -1) 📝 `docs/architecture.mermaid` (+1 -1) 📝 `docs/browser-observation.md` (+2 -0) 📝 `docs/product-catalog.json` (+12 -10) 📝 `docs/testing.md` (+8 -0) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) ➕ `docs/website-module-trace.md` (+85 -0) 📝 `package.json` (+1 -0) ➕ `scripts/fixtures/browser-module-site.mjs` (+61 -0) ➕ `scripts/lib/browser-module-e2e.mjs` (+390 -0) ➕ `scripts/verify-browser-modules.mjs` (+16 -0) 📝 `scripts/verify-real-browser.mjs` (+3 -0) 📝 `skills/reverse-engineer-anything/SKILL.md` (+2 -2) 📝 `src/application/CapabilityInventory.test.ts` (+29 -0) 📝 `src/application/CapabilityInventory.ts` (+29 -0) _...and 28 more files_ </details> ### 📄 Description ## Changes Refs #851 and #774. Delivers the URL/import-map portion of #851; retained source-map asset pairing remains a follow-up. - Add `trace_web_module_imports` / `trace-web-module-imports` for one explicit script in an `export_web_scripts` manifest. Verify actual UTF-8 bytes, size and SHA; retain capture metadata/completeness and all imports/re-exports with UTF-16 source positions. - Separate artifact acquisition and native resolution ports. Reuse existing Babel syntax and Chromium `import.meta.resolve`, including scopes, null mappings and prefix backtracking rejection. - Preserve query/fragment identities, every captured candidate and native rejection reasons. Computed imports and execution remain unknown. A selected import map is derived context, not proof it was installed by the website. - Use an owned browser context and trusted REA resolver stub. Fulfill/block page requests locally; no captured application execution or dependency refetch. Preserve diagnostics, cancellation, cleanup failures and unsupported URL reasons. - Extend existing conditional real-Chrome CI triggers and fixtures. Unrelated deterministic CI does not acquire Chrome. ## MCP example ```json {"name":"trace_web_module_imports","arguments":{"manifest_path":"/analysis/export/manifest.json","script_index":0,"import_map":{"path":"/analysis/import-map.json","base_url":"https://example.test/maps/"}}} ``` Inline Evidence includes exact source/map identities, capture completeness, native engine, each source location and resolution, all candidate captures, and explicit unknown execution. ## Verification - Post-rebase focused suite: **8 files, 50 tests passed**, including domain/service/producer/filesystem, compiled CLI/MCP parity, actual SDK JSON Schema2020 and Evidence record ownership. - `npm run check:fast` and `npm run docs:check:built`: **passed on final main895079dd-based code**. Test discovery passed before synchronization. - Fresh installed npm tarball: 8 public CLI/MCP traces with real Chrome153.0.8010.12 passed, including non-loopback HTTP importer with optional HTTPS map base. Independent real module-loading oracle verifies scopes, query/fragment module instances and native errors. No implicit refetch and no remaining descendants. - Real adapter extras verify native warnings, cancellation cleanup and escaped HTML BASE identity. - Package includes concrete resolver and excludes `_reference/`, `.codex/` and upstream source trees. Real Hopper/Ghidra verification was not run; those providers are unchanged. Literal native resolution needs caller-supplied Chromium; sources without literal imports do not. Page routing does not claim OS-wide network containment. Resolution does not establish execution or UI causality. ## Hosted final-head verification All reported CI checks passed on e3afdbbf9297b70c72e1688864699ee864b38f85, including full real-Chrome/Wakaru, all four test shards/coverage, and Linux/macOS/Windows package lanes. The first Windows native build timed out in apt cross-compiler downloads before compilation; targeted rerun and dependent package lanes passed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:11 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2316

No description provided.

Rows
Columns