[PR #1393] [MERGED] fix(javascript): stop reading media preload attributes as Electron preloads #2850

New issue

Closed

opened 2026-10-17 21:11:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:11:01 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1393
Author: @marnixpluim
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/media-preload-attribute

📝 Commits (10+)

be6863e feat(ghidra): support native PE DLLs on Windows
e10c934 fix(ghidra): keep the cross-format branch callee multi-block
40f632a ci: re-run the suite after the main-branch shard flake
e17290c ci: re-run the suite on the corrected main checkpoint
e4a8e0b fix(javascript): recognize Electron APIs through renamed bindings
5fd9f4a fix(javascript): stop reading media preload attributes as Electron preloads
5fc4d79 fix(javascript): handle oversized inline source maps (#1386)
498cec0 fix(cli): stop advertising multi-letter single-dash option aliases (#1395)
2b6e9ec fix(browser): classify selected web trace file failures by cause (#1396)
6875d4a fix(cli): accept JSON files for web capture and screenshot comparisons (#1397)

📊 Changes

382 files changed (+24394 additions, -2845 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+14 -7)
📝 .agents/skills/reverse-engineer-anything/references/android-applications.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/evidence-workflows.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/javascript-applications.md (+0 -0)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+9 -0)
📝 .agents/skills/reverse-engineer-anything/references/runtime-observation.md (+0 -0)
📝 .github/pull_request_template.md (+1 -1)
📝 .github/workflows/real-ghidra-windows.yml (+20 -0)
📝 .github/workflows/website-check.yml (+2 -6)
📝 .github/workflows/website-pages.yml (+2 -4)
📝 AGENTS.md (+1 -1)
📝 CONTRIBUTING.md (+10 -5)
📝 README.md (+4 -4)
📝 README_ar.md (+5 -5)
📝 README_de.md (+5 -5)
📝 README_es.md (+5 -5)
📝 README_fa.md (+5 -5)
📝 README_fr.md (+5 -5)
➕ README_id.md (+307 -0)
➕ README_it.md (+286 -0)

...and 80 more files

📄 Description

Audio/video loading hints were reported as Electron preload scripts. For example, jsx("audio", {preload: "metadata"}) created an unresolved electron-preload node for metadata. This change excludes preload properties in the inline props object of a call with the static first argument audio or video; webview and independent preload options retain their evidence.

The callee is deliberately unrestricted to cover minified element factories. This remains a syntax heuristic: separately bound props and dynamic tag expressions are outside this change. CLI/MCP schemas and the default Evidence representation are unchanged.

Validation against current main 2d426c92 and integrated head 19a770a7:

An actual 327-byte fixture through the compiled public CLI and SDK stdio MCP reproduces four false preload nodes/edges on main and removes exactly those four after the fix. Computed property keys, template tags, a sequence-expression callee and arbitrary factory names are covered. The webview, BrowserWindow and independent options preload nodes, observations and provenance are exactly preserved.
The complete normalized result differs only by those four nodes/edges, derived graph IDs and the findings count. All other content is equal. CLI/MCP normalized results and Evidence IDs agree within each revision, text/structured content agree, a following ping succeeds, and the target digest is unchanged.
This fixture's full CLI reply changes from 69,582 to 57,910 bytes; the full MCP reply changes from 145,962 to 121,490 bytes. These are output-byte measurements for this fixture, not billed-token or throughput estimates.
65 tests across eight relevant domain/composition/public acceptance files pass without skips, including large literals without finding caps, effective preload overrides via actual CLI/MCP, source locations and blank-path admission.
Full serial typecheck, lint/module boundaries, formatting, Knip, duplication, documentation/metadata and architecture checks pass under the bounded-resource runner.

Independent maintainer verification uses Linux and Node 24.18.0; no native Electron runtime, macOS or Windows claim is made. The contributor's original packaged-app report and the other reviewer's compiler/app checks remain separately documented in this PR's history. Related maintenance/output work: #1065 and #723. No separate duplicate issue is needed for this existing contribution.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1393 **Author:** [@marnixpluim](https://github.com/marnixpluim) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/media-preload-attribute` --- ### 📝 Commits (10+) - [`be6863e`](https://github.com/morluto/rea/commit/be6863e9a16bcc3a09d87c50981e69292795a512) feat(ghidra): support native PE DLLs on Windows - [`e10c934`](https://github.com/morluto/rea/commit/e10c934d5a756c1a4c7b547ebd02c403ddfde7b8) fix(ghidra): keep the cross-format branch callee multi-block - [`40f632a`](https://github.com/morluto/rea/commit/40f632a155bff2defdea09e467229c703bc0b0e9) ci: re-run the suite after the main-branch shard flake - [`e17290c`](https://github.com/morluto/rea/commit/e17290cd2a17931d7a2af70f74b76b94276bd788) ci: re-run the suite on the corrected main checkpoint - [`e4a8e0b`](https://github.com/morluto/rea/commit/e4a8e0b728154fe0bf181684ccd0d73df45cf4bf) fix(javascript): recognize Electron APIs through renamed bindings - [`5fd9f4a`](https://github.com/morluto/rea/commit/5fd9f4ad604c979d871584a5e01216fa2455647f) fix(javascript): stop reading media preload attributes as Electron preloads - [`5fc4d79`](https://github.com/morluto/rea/commit/5fc4d792caeb3cd81c2021e45a158c5127906c56) fix(javascript): handle oversized inline source maps (#1386) - [`498cec0`](https://github.com/morluto/rea/commit/498cec042a5f05557ae9c2ef9663d41dd03901c3) fix(cli): stop advertising multi-letter single-dash option aliases (#1395) - [`2b6e9ec`](https://github.com/morluto/rea/commit/2b6e9ec03f88abb0799a4d154e48544ff4685a41) fix(browser): classify selected web trace file failures by cause (#1396) - [`6875d4a`](https://github.com/morluto/rea/commit/6875d4a64c0d77c4f90ebbec36705f191eb7cdc6) fix(cli): accept JSON files for web capture and screenshot comparisons (#1397) ### 📊 Changes **382 files changed** (+24394 additions, -2845 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+14 -7) 📝 `.agents/skills/reverse-engineer-anything/references/android-applications.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/evidence-workflows.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/javascript-applications.md` (+0 -0) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+9 -0) 📝 `.agents/skills/reverse-engineer-anything/references/runtime-observation.md` (+0 -0) 📝 `.github/pull_request_template.md` (+1 -1) 📝 `.github/workflows/real-ghidra-windows.yml` (+20 -0) 📝 `.github/workflows/website-check.yml` (+2 -6) 📝 `.github/workflows/website-pages.yml` (+2 -4) 📝 `AGENTS.md` (+1 -1) 📝 `CONTRIBUTING.md` (+10 -5) 📝 `README.md` (+4 -4) 📝 `README_ar.md` (+5 -5) 📝 `README_de.md` (+5 -5) 📝 `README_es.md` (+5 -5) 📝 `README_fa.md` (+5 -5) 📝 `README_fr.md` (+5 -5) ➕ `README_id.md` (+307 -0) ➕ `README_it.md` (+286 -0) _...and 80 more files_ </details> ### 📄 Description Audio/video loading hints were reported as Electron preload scripts. For example, `jsx("audio", {preload: "metadata"})` created an unresolved `electron-preload` node for `metadata`. This change excludes preload properties in the inline props object of a call with the static first argument `audio` or `video`; webview and independent preload options retain their evidence. The callee is deliberately unrestricted to cover minified element factories. This remains a syntax heuristic: separately bound props and dynamic tag expressions are outside this change. CLI/MCP schemas and the default Evidence representation are unchanged. Validation against current main `2d426c92` and integrated head `19a770a7`: - An actual 327-byte fixture through the compiled public CLI and SDK stdio MCP reproduces four false preload nodes/edges on main and removes exactly those four after the fix. Computed property keys, template tags, a sequence-expression callee and arbitrary factory names are covered. The webview, BrowserWindow and independent options preload nodes, observations and provenance are exactly preserved. - The complete normalized result differs only by those four nodes/edges, derived graph IDs and the findings count. All other content is equal. CLI/MCP normalized results and Evidence IDs agree within each revision, text/structured content agree, a following ping succeeds, and the target digest is unchanged. - This fixture's full CLI reply changes from 69,582 to 57,910 bytes; the full MCP reply changes from 145,962 to 121,490 bytes. These are output-byte measurements for this fixture, not billed-token or throughput estimates. - 65 tests across eight relevant domain/composition/public acceptance files pass without skips, including large literals without finding caps, effective preload overrides via actual CLI/MCP, source locations and blank-path admission. - Full serial typecheck, lint/module boundaries, formatting, Knip, duplication, documentation/metadata and architecture checks pass under the bounded-resource runner. Independent maintainer verification uses Linux and Node 24.18.0; no native Electron runtime, macOS or Windows claim is made. The contributor's original packaged-app report and the other reviewer's compiler/app checks remain separately documented in this PR's history. Related maintenance/output work: #1065 and #723. No separate duplicate issue is needed for this existing contribution. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:11:01 +00:00