morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #1336] [Feature] Let REA analyze Flathub Electron apps that fail the integrity check #469

New issue

Closed

opened 2026-10-15 18:25:19 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:25:19 +00:00

Owner

Originally created by @CassieFox23 on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1336

TL;DR: Flathub's Electron builds strip their native .node addons, so the hashes no longer match the ASAR header and analysis stops. There's no way to note the mismatch and keep going.

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Current limitation

Running rea analyze-javascript-application <flatpak>/files/resources/app.asar on a closed-source Electron app from Flathub fails with exit 1 and artifact_integrity_mismatch on node_modules/btime/binding.node (unpacked: true). There's no option to record the mismatch and continue, and the remediation, "Get a fresh copy and try again", can't help for an installed app.

Use cases

Static analysis of Electron apps installed from Flathub on Linux. The .node addons in these builds are stripped: they're smaller than upstream's, the upstream tarball's copies match the ASAR header hashes, and app.asar itself is byte-identical to upstream. So the mismatch is expected and harmless.

Desired outcome and success criteria

analyze_javascript_application (MCP and CLI) takes the same integrity_policy (fail by default, or record-and-continue), with contradicted files reported as findings rather than stopping the analysis.

Authority boundaries and non-goals

No change to the default (fail); the contradiction stays visible in the Evidence either way.

Alternatives considered

Pointing at the app's other, main ASAR works as a workaround today. In 6.1.0, integrity_policy exists only on the artifact inventory input.

Possible direction

#902 proposed --integrity-policy record-and-continue for this tool and a better remediation, but it was closed without merging.

References

#902

🤖 Generated with Claude Code (Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1336 **TL;DR:** Flathub's Electron builds strip their native `.node` addons, so the hashes no longer match the ASAR header and analysis stops. There's no way to note the mismatch and keep going. ### Before submitting - [X] I searched the open and closed issues and pull requests for a related proposal. - [X] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Current limitation Running `rea analyze-javascript-application <flatpak>/files/resources/app.asar` on a closed-source Electron app from Flathub fails with exit 1 and `artifact_integrity_mismatch` on `node_modules/btime/binding.node` (`unpacked: true`). There's no option to record the mismatch and continue, and the remediation, "Get a fresh copy and try again", can't help for an installed app. ### Use cases Static analysis of Electron apps installed from Flathub on Linux. The `.node` addons in these builds are stripped: they're smaller than upstream's, the upstream tarball's copies match the ASAR header hashes, and `app.asar` itself is byte-identical to upstream. So the mismatch is expected and harmless. ### Desired outcome and success criteria `analyze_javascript_application` (MCP and CLI) takes the same `integrity_policy` (`fail` by default, or `record-and-continue`), with contradicted files reported as findings rather than stopping the analysis. ### Authority boundaries and non-goals No change to the default (`fail`); the contradiction stays visible in the Evidence either way. ### Alternatives considered Pointing at the app's other, main ASAR works as a workaround today. In 6.1.0, `integrity_policy` exists only on the artifact inventory input. ### Possible direction #902 proposed `--integrity-policy record-and-continue` for this tool and a better remediation, but it was closed without merging. ### References #902 🤖 Generated with Claude Code (Opus 5.5) 🦊

bsakaguchi

2026-10-15 18:25:19 +00:00

closed this issue
added the
area: evidence

bug
labels

bsakaguchi commented

2026-10-15 18:25:20 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 10, 2026):

TL;DR: This shipped in 6.3.0, and it works on my Flathub app. The default still stops, as it should. The new option records the bad hashes and keeps going. Thanks, morluto!

The fix is commit 7915ee51:
github.com/morluto/rea@7915ee5178

It is part of the 6.3.0 release:
https://github.com/morluto/rea/releases/tag/rea-agents-6.3.0

What I ran

A closed-source Electron app from Flathub. I left its name out.
A copy of resources/app.asar and app.asar.unpacked.
rea-agents 6.2.0 and 6.3.0 from npm.

Version	Policy	Exit	Result
6.2.0	default	1	`artifact_integrity_mismatch`
6.3.0	default (`fail`)	1	`artifact_integrity_mismatch`
6.3.0	`--integrity-policy record-and-continue`	0	full analysis

The 6.3.0 error now names the way out. It points to integrity_policy=record-and-continue. The 6.2.0 error only said "Get a fresh copy and try again".

With the option on, the run finished. The graph has 141 nodes and 190 edges. Both stripped addons show up in integrity_contradictions:

node_modules/btime/binding.node
node_modules/get-fonts/binding.node

Each entry keeps the declared and observed hashes. The bytes are marked observed-untrusted. My first report only named btime, since 6.2.0 stopped at the first one.

I did not test the MCP side. I did not try a nested ASAR either.

Test setup

Box: Nobara 44, Linux x86-64
Node: 22.23.1

🤖 Generated with Claude Code (Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 10, 2026): **TL;DR:** This shipped in 6.3.0, and it works on my Flathub app. The default still stops, as it should. The new option records the bad hashes and keeps going. Thanks, morluto! The fix is commit 7915ee51: https://github.com/morluto/rea/commit/7915ee51781878ed67e094259924b6e6f3093b3f It is part of the 6.3.0 release: https://github.com/morluto/rea/releases/tag/rea-agents-6.3.0 ### What I ran - A closed-source Electron app from Flathub. I left its name out. - A copy of `resources/app.asar` and `app.asar.unpacked`. - `rea-agents` 6.2.0 and 6.3.0 from npm. | Version | Policy | Exit | Result | |---|---|---|---| | 6.2.0 | default | 1 | `artifact_integrity_mismatch` | | 6.3.0 | default (`fail`) | 1 | `artifact_integrity_mismatch` | | 6.3.0 | `--integrity-policy record-and-continue` | 0 | full analysis | The 6.3.0 error now names the way out. It points to `integrity_policy=record-and-continue`. The 6.2.0 error only said "Get a fresh copy and try again". With the option on, the run finished. The graph has 141 nodes and 190 edges. Both stripped addons show up in `integrity_contradictions`: - `node_modules/btime/binding.node` - `node_modules/get-fonts/binding.node` Each entry keeps the declared and observed hashes. The bytes are marked `observed-untrusted`. My first report only named `btime`, since 6.2.0 stopped at the first one. I did not test the MCP side. I did not try a nested ASAR either. <details> <summary>Test setup</summary> - Box: Nobara 44, Linux x86-64 - Node: 22.23.1 </details> 🤖 Generated with Claude Code (Opus 5.5) 🦊

bsakaguchi referenced this issue

2026-10-16 21:13:24 +00:00

[PR #469] [MERGED] docs(npm): simplify current setup command #2015

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#469

No description provided.

Rows
Columns