[GH-ISSUE #397] Add Node/Electron V8 inspector runtime observation provider #246

New issue

Closed

opened 2026-10-15 18:22:56 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:22:56 +00:00

Owner

Originally created by @morluto on GitHub (Jul 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/397

Add a focused Node/Electron runtime observation provider using the V8 inspector protocol (Node --inspect, Electron --remote-debugging-port with the Inspector domain, or an equivalent loopback transport).

Scope:

Launch or attach to an approved Node/Electron process with the V8 inspector enabled and an explicit administrator/policy approval.
Capture runtime module load/unload, require/import graph, event names, and IPC calls without evaluating arbitrary expressions or mutating the target.
Correlate runtime observations with the static JavaScript Application Graph and Electron boundary graph.
Bound the session by time, event count, memory, and depth; fail closed on disapproved origins/processes.
Distinguish observations from inferences and residual unknowns.

Acceptance:

A new MCP/CLI provider or tool mode returns deterministic Evidence v2 for Node/Electron runtime context.
Works without Playwright or full CDP browser capture.
Does not overlap with passive inspect_electron_page or shell/IPC capture in #64.
Tests cover Node and Electron main/preload/renderer contexts.

This is a focused replacement for the broader #36 / #358 / #359 with one concrete first provider.

Originally created by @morluto on GitHub (Jul 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/397 Add a focused Node/Electron runtime observation provider using the V8 inspector protocol (Node `--inspect`, Electron `--remote-debugging-port` with the Inspector domain, or an equivalent loopback transport). Scope: - Launch or attach to an approved Node/Electron process with the V8 inspector enabled and an explicit administrator/policy approval. - Capture runtime module load/unload, require/import graph, event names, and IPC calls without evaluating arbitrary expressions or mutating the target. - Correlate runtime observations with the static JavaScript Application Graph and Electron boundary graph. - Bound the session by time, event count, memory, and depth; fail closed on disapproved origins/processes. - Distinguish observations from inferences and residual unknowns. Acceptance: - A new MCP/CLI provider or tool mode returns deterministic Evidence v2 for Node/Electron runtime context. - Works without Playwright or full CDP browser capture. - Does not overlap with passive `inspect_electron_page` or shell/IPC capture in #64. - Tests cover Node and Electron main/preload/renderer contexts. This is a focused replacement for the broader #36 / #358 / #359 with one concrete first provider.

bsakaguchi

2026-10-15 18:22:56 +00:00