[GH-ISSUE #883] [Feature] Attribute website worker and service-worker sources and runtime ownership #363

New issue

Open

opened 2026-10-15 18:24:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:17 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 7, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/883

Parent: #774. Extends existing worker inventory with evidence useful for reverse engineering.

Scope

Typed modular worker/service-worker capture adapter reusing current browser target transports.
Preserve worker target, parent/document/origin, execution context, script/source identity, lifecycle transitions, and unknown ownership when producer data is insufficient.
Retain selected worker sources and appropriate execution/network evidence. Shared URLs or absence from a root page cannot establish owner identity.
Distinguish service-worker/cache indicators from actual response/cache execution evidence. Do not infer cached execution merely from registration.
Shared CLI/MCP contract with lifecycle effects, provenance and unsupported facets explicit; do not introduce arbitrary script evaluation.

Acceptance

Real Chrome fixture with dedicated/shared/service workers and worker termination, identical source URLs with distinct owners, network requests and controlled cached responses. Actual producer representations, source bytes/digests, origin/target boundaries, cancellation/cleanup and schema/parity checks; conditional Chrome CI.

Originally created by @N0zoM1z0 on GitHub (Oct 7, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/883 Parent: #774. Extends existing worker inventory with evidence useful for reverse engineering. ## Scope - Typed modular worker/service-worker capture adapter reusing current browser target transports. - Preserve worker target, parent/document/origin, execution context, script/source identity, lifecycle transitions, and unknown ownership when producer data is insufficient. - Retain selected worker sources and appropriate execution/network evidence. Shared URLs or absence from a root page cannot establish owner identity. - Distinguish service-worker/cache indicators from actual response/cache execution evidence. Do not infer cached execution merely from registration. - Shared CLI/MCP contract with lifecycle effects, provenance and unsupported facets explicit; do not introduce arbitrary script evaluation. ## Acceptance Real Chrome fixture with dedicated/shared/service workers and worker termination, identical source URLs with distinct owners, network requests and controlled cached responses. Actual producer representations, source bytes/digests, origin/target boundaries, cancellation/cleanup and schema/parity checks; conditional Chrome CI.

bsakaguchi added the

labels

2026-10-15 18:24:17 +00:00

bsakaguchi referenced this issue

2026-10-15 18:31:03 +00:00

[GH-ISSUE #3153] [Feature] Inventory Windows Installer (.msi / OLE CFB) packages read-only: streams, embedded cabinets and File-table names #1099

bsakaguchi referenced this issue

2026-10-16 21:13:12 +00:00