[GH-ISSUE #799] [Feature] Export captured website scripts into existing JavaScript analysis #347

New issue

Closed

opened 2026-10-15 18:24:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:09 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 6, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/799

Analyst outcome

Export the JavaScript bytes already retained in a local website capture into a verified local artifact directory, so agents can use REA’s existing analyze_javascript_application, semantic tracing, and source comparison tools without downloading the scripts again.

Part of #774, following network lifecycle/content evidence in #797.

Scope

Support inspect_web_page captures with included Debugger sources and capture_browser_scenario captures with selected script response bytes. Accept saved Evidence envelopes or normalized capture JSON.
Separate capture adapters, a provider-neutral source/path projection, filesystem publication, and the shared application workflow. CLI and MCP use the same workflow and named contract.
Return complete source-to-file mappings, capture/source digests, observed URLs, frame or transaction/event references, redaction and unavailable-source states inline; persist the same manifest.
Reuse safe exclusive artifact output and the existing JavaScript analyzer. No script execution or implicit refetch.
Preserve unambiguous safe URL directory layouts; retain colliding versions/query variants/inline sources under explicit isolated paths. Do not guess import-map, root-relative, cross-origin, or missing dependency resolution.

Acceptance

Exact exported byte/digest checks for passive UTF-8 sources and active binary response representations.
Relative module imports resolve when an unambiguous captured URL layout permits it; competing content versions and query variants are retained without overwriting or claiming one canonical version.
Malformed captures, unavailable content, invalid digests, path/prefix/case collisions, unsafe URLs, existing output roots, cancellation, and rollback are exercised.
Real localhost browser → capture → export → existing static JS analysis through CLI/MCP, including manifest readback and source location linkage.
Advertised JSON Schemas, effects metadata, canonical inventory, generated docs, and installed artifact behavior remain aligned.

Limits to report

Captured sources describe browser-retained content at the observation window. They do not prove execution, original transfer encoding, a complete website, or recovered source maps. Redacted bytes are exported exactly as retained. Existing local artifact analysis does not implement browser import maps, remote URL loading, or browser runtime behavior.

Originally created by @N0zoM1z0 on GitHub (Oct 6, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/799 ## Analyst outcome Export the JavaScript bytes already retained in a local website capture into a verified local artifact directory, so agents can use REA’s existing `analyze_javascript_application`, semantic tracing, and source comparison tools without downloading the scripts again. Part of #774, following network lifecycle/content evidence in #797. ## Scope - Support `inspect_web_page` captures with included Debugger sources and `capture_browser_scenario` captures with selected script response bytes. Accept saved Evidence envelopes or normalized capture JSON. - Separate capture adapters, a provider-neutral source/path projection, filesystem publication, and the shared application workflow. CLI and MCP use the same workflow and named contract. - Return complete source-to-file mappings, capture/source digests, observed URLs, frame or transaction/event references, redaction and unavailable-source states inline; persist the same manifest. - Reuse safe exclusive artifact output and the existing JavaScript analyzer. No script execution or implicit refetch. - Preserve unambiguous safe URL directory layouts; retain colliding versions/query variants/inline sources under explicit isolated paths. Do not guess import-map, root-relative, cross-origin, or missing dependency resolution. ## Acceptance - Exact exported byte/digest checks for passive UTF-8 sources and active binary response representations. - Relative module imports resolve when an unambiguous captured URL layout permits it; competing content versions and query variants are retained without overwriting or claiming one canonical version. - Malformed captures, unavailable content, invalid digests, path/prefix/case collisions, unsafe URLs, existing output roots, cancellation, and rollback are exercised. - Real localhost browser → capture → export → existing static JS analysis through CLI/MCP, including manifest readback and source location linkage. - Advertised JSON Schemas, effects metadata, canonical inventory, generated docs, and installed artifact behavior remain aligned. ## Limits to report Captured sources describe browser-retained content at the observation window. They do not prove execution, original transfer encoding, a complete website, or recovered source maps. Redacted bytes are exported exactly as retained. Existing local artifact analysis does not implement browser import maps, remote URL loading, or browser runtime behavior.

bsakaguchi

2026-10-15 18:24:09 +00:00