morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #39] Add browser and web-application reverse-engineering capabilities #29

New issue

Open

opened 2026-10-15 18:20:12 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-15 18:20:12 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/39

Goal

Support evidence-backed investigation of websites and browser applications through direct observation, shipped JavaScript analysis, tracing, and comparison tools.

Tool direction

Merged #555 removes REA permission grants, scope ceilings, and repeated approval fields. Merged #572 removes browser request replay/interception and the active scenario's duplicate origin allowlist.

Agents select browser targets, URLs, actions, storage seeds, and capture facets. They compose experiments and run local fixture servers themselves when controlled responses are needed. Passive observation tools may still expose origin query filters; those filters select evidence rather than grant authority.

Capability scope

Inspect shipped scripts, modules, chunks, source maps, WebAssembly, workers, service workers, manifests, and extensions. Preserve original and generated source locations. Observe DOM/accessibility state, screenshots, console, storage, cookies, runtime events, and supported network protocols with exact per-provider coverage.

Trace user-visible behavior to handler, code, and protocol evidence, and compare explicitly paired captures or deployments. Report unsupported facets and incomplete observations without treating them as absence.

Runtime boundaries

The selected operation expresses intent; local operations use the current user's OS permissions. Preserve exact target binding, real URL/protocol validation, cancellation, runtime budgets, and cleanup. Disconnect from externally owned browsers and terminate only provider-owned resources.

Preserve ordinary local URLs and selected captured content. Redact transport credentials and values explicitly marked sensitive rather than guessing that all session or query data requires sanitization. Report actual lifecycle effects and limitations.

Remaining work

The active browser capture and comparison foundations tracked by #63 and #65 are delivered. Electron shell/IPC instrumentation remains under #64, including process-lifecycle and shell events in #375.

Browser teardown and WebMCP frame handling remain under #557. Partial-evidence comparison and cross-tool Evidence composition remain broader boundary work under #558 and #551. This tracker stays open while the remaining capability and proof work is unresolved.

Acceptance

A real fixture application must support investigation from an explicit UI action through handler/bundle locations and the observed request/response consumer, with static inference distinguished from runtime observation. Comparisons must expose missing coverage and mismatched inputs.

Verify supported behavior through real browser/Electron lanes and equivalent CLI/MCP workflows. Agent-authored fixture servers and experiment scripts are valid composition; a bespoke replay engine, scope-grant system, or blanket sanitization requirement is not an acceptance gate.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/39 ## Goal Support evidence-backed investigation of websites and browser applications through direct observation, shipped JavaScript analysis, tracing, and comparison tools. ## Tool direction Merged #555 removes REA permission grants, scope ceilings, and repeated approval fields. Merged #572 removes browser request replay/interception and the active scenario's duplicate origin allowlist. Agents select browser targets, URLs, actions, storage seeds, and capture facets. They compose experiments and run local fixture servers themselves when controlled responses are needed. Passive observation tools may still expose origin query filters; those filters select evidence rather than grant authority. ## Capability scope Inspect shipped scripts, modules, chunks, source maps, WebAssembly, workers, service workers, manifests, and extensions. Preserve original and generated source locations. Observe DOM/accessibility state, screenshots, console, storage, cookies, runtime events, and supported network protocols with exact per-provider coverage. Trace user-visible behavior to handler, code, and protocol evidence, and compare explicitly paired captures or deployments. Report unsupported facets and incomplete observations without treating them as absence. ## Runtime boundaries The selected operation expresses intent; local operations use the current user's OS permissions. Preserve exact target binding, real URL/protocol validation, cancellation, runtime budgets, and cleanup. Disconnect from externally owned browsers and terminate only provider-owned resources. Preserve ordinary local URLs and selected captured content. Redact transport credentials and values explicitly marked sensitive rather than guessing that all session or query data requires sanitization. Report actual lifecycle effects and limitations. ## Remaining work The active browser capture and comparison foundations tracked by #63 and #65 are delivered. Electron shell/IPC instrumentation remains under #64, including process-lifecycle and shell events in #375. Browser teardown and WebMCP frame handling remain under #557. Partial-evidence comparison and cross-tool Evidence composition remain broader boundary work under #558 and #551. This tracker stays open while the remaining capability and proof work is unresolved. ## Acceptance A real fixture application must support investigation from an explicit UI action through handler/bundle locations and the observed request/response consumer, with static inference distinguished from runtime observation. Comparisons must expose missing coverage and mismatched inputs. Verify supported behavior through real browser/Electron lanes and equivalent CLI/MCP workflows. Agent-authored fixture servers and experiment scripts are valid composition; a bespoke replay engine, scope-grant system, or blanket sanitization requirement is not an acceptance gate.

bsakaguchi added the

labels

2026-10-15 18:20:12 +00:00

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Current main delivers a broad passive browser foundation through CDP observation, bundle analysis, screenshots, and structural/visual comparison. The remaining umbrella outcome is active reproducible scenario recording and UI-handler-to-request tracing, tracked concretely by #63–#65.

@morluto commented on GitHub (Jul 17, 2026): Current main delivers a broad passive browser foundation through CDP observation, bundle analysis, screenshots, and structural/visual comparison. The remaining umbrella outcome is active reproducible scenario recording and UI-handler-to-request tracing, tracked concretely by #63–#65.

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

The remaining active web-application work is now split into focused children:

#63 Build a Playwright/CDP differential recorder
- #373 Define capture_browser_scenario scenario contract
- #374 Implement Playwright/CDP capture driver and step-indexed output
#64 Add Electron shell and IPC instrumentation
- #375 Capture Electron main/preload/utility process lifecycle and shell events
- #376 Capture Electron IPC channel/direction/sender/receiver with redacted payloads
#65 Add structural and visual browser comparison
- #377 Add accessibility and storage comparison to browser captures
- #378 Add step alignment and recorded normalization for browser comparison

Passive browser inspection is already delivered; this parent can close when the active-observation and comparison children are done.

@morluto commented on GitHub (Jul 20, 2026): The remaining active web-application work is now split into focused children: - [ ] #63 Build a Playwright/CDP differential recorder - [ ] #373 Define capture_browser_scenario scenario contract - [ ] #374 Implement Playwright/CDP capture driver and step-indexed output - [ ] #64 Add Electron shell and IPC instrumentation - [ ] #375 Capture Electron main/preload/utility process lifecycle and shell events - [ ] #376 Capture Electron IPC channel/direction/sender/receiver with redacted payloads - [ ] #65 Add structural and visual browser comparison - [ ] #377 Add accessibility and storage comparison to browser captures - [ ] #378 Add step alignment and recorded normalization for browser comparison Passive browser inspection is already delivered; this parent can close when the active-observation and comparison children are done.

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Oct 9, 2026):

Triage note (2026-10-09): keeping open. Child progress since the split: #63, #373, #374, #65, #377, #378, #376 are closed; remaining open children are #64 and #375 (Electron shell/process-lifecycle instrumentation).

@morluto commented on GitHub (Oct 9, 2026): Triage note (2026-10-09): keeping open. Child progress since the split: #63, #373, #374, #65, #377, #378, #376 are closed; remaining open children are #64 and #375 (Electron shell/process-lifecycle instrumentation).

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:08:52 +00:00

[GH-ISSUE #4249] [Feature] Opt-in summary delivery and retained pages for list_strings, list_procedures, list_names, and their search tools #1674

bsakaguchi referenced this issue

2026-10-16 21:11:25 +00:00

[PR #85] [MERGED] feat(analysis): harden agent workflows and evidence boundaries #1823

bsakaguchi referenced this issue

2026-10-16 21:11:37 +00:00

[PR #105] [MERGED] fix(bridge): bound regex search work #1835