[GH-ISSUE #827] [Feature] Recover readable JavaScript sources through a pluggable upstream adapter #353

New issue

Closed

opened 2026-10-15 18:24:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:13 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 7, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/827

Analyst outcome

Recover readable JavaScript modules from explicitly selected local production scripts/bundles and feed the derived artifacts into REA's existing JavaScript analysis. Website roadmap #774; follows network evidence #797, script export #801 and correctness fixes #825.

Existing boundary and missing capability

Current analyze_web_bundle identifies some bundle structures and source maps; export_web_scripts preserves captured bytes. Neither provides a pluggable upstream syntax/module recovery adapter with published derived files, extraction provenance, warnings and source mappings.

Delivery design

Add a provider-neutral recovery contract and shared CLI/MCP workflow behind a typed recovery port; keep Wakaru process/protocol code in its adapter.
Retain unchanged upstream source as a submodule pinned to Wakaru v1.13.0 revision6070266d24b32951fa2fe1d2dad5b4313bd5c81b; require a caller-supplied executable, fingerprint executed bytes/version, and preserve target-free startup. Do not install globally or build upstream on ordinary REA startup.
Snapshot caller-selected inputs, preserve their identity, run recovery in an owned temporary workspace, validate the actual JSON/provenance/files, then safely publish to a new output directory.
Preserve original/derived digests, extraction byte ranges (not rewritten line mapping), emitted source maps, transform choices, warnings, partial results and unknown runtime equivalence. Return the existing analyzer input inline.
Preserve cancellation, owned-process cleanup, rollback and actionable diagnostics. Treat source rewriting as derivation; never execute input/recovered application code as part of the operation.

Acceptance

Source-owned minified and actual compiler-produced webpack/esbuild fixtures with recorded toolchain versions.
Actual pinned Wakaru through CLI and stdio MCP; output digests/readback, mapping ranges and reuse by existing JS analysis.
Malformed report/provenance, source mismatch, escaping/symlink output, missing/duplicate modules, failed or partial recovery, existing output, cancellation and cleanup regressions at stable seams.
Generated contracts/catalog and advertised SDK JSON Schemas remain aligned; optional missing engine leaves other REA capabilities available.

Linux x64 real verification first; other host support claims require corresponding proof. No global tool/config installation. CPU and memory bounded during local work.

Originally created by @N0zoM1z0 on GitHub (Oct 7, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/827 ## Analyst outcome Recover readable JavaScript modules from explicitly selected local production scripts/bundles and feed the derived artifacts into REA's existing JavaScript analysis. Website roadmap #774; follows network evidence #797, script export #801 and correctness fixes #825. ## Existing boundary and missing capability Current analyze_web_bundle identifies some bundle structures and source maps; export_web_scripts preserves captured bytes. Neither provides a pluggable upstream syntax/module recovery adapter with published derived files, extraction provenance, warnings and source mappings. ## Delivery design - Add a provider-neutral recovery contract and shared CLI/MCP workflow behind a typed recovery port; keep Wakaru process/protocol code in its adapter. - Retain unchanged upstream source as a submodule pinned to Wakaru v1.13.0 revision6070266d24b32951fa2fe1d2dad5b4313bd5c81b; require a caller-supplied executable, fingerprint executed bytes/version, and preserve target-free startup. Do not install globally or build upstream on ordinary REA startup. - Snapshot caller-selected inputs, preserve their identity, run recovery in an owned temporary workspace, validate the actual JSON/provenance/files, then safely publish to a new output directory. - Preserve original/derived digests, extraction byte ranges (not rewritten line mapping), emitted source maps, transform choices, warnings, partial results and unknown runtime equivalence. Return the existing analyzer input inline. - Preserve cancellation, owned-process cleanup, rollback and actionable diagnostics. Treat source rewriting as derivation; never execute input/recovered application code as part of the operation. ## Acceptance - Source-owned minified and actual compiler-produced webpack/esbuild fixtures with recorded toolchain versions. - Actual pinned Wakaru through CLI and stdio MCP; output digests/readback, mapping ranges and reuse by existing JS analysis. - Malformed report/provenance, source mismatch, escaping/symlink output, missing/duplicate modules, failed or partial recovery, existing output, cancellation and cleanup regressions at stable seams. - Generated contracts/catalog and advertised SDK JSON Schemas remain aligned; optional missing engine leaves other REA capabilities available. Linux x64 real verification first; other host support claims require corresponding proof. No global tool/config installation. CPU and memory bounded during local work.

bsakaguchi

2026-10-15 18:24:13 +00:00