[PR #1651] [MERGED] fix(javascript): isolate source analysis and retain bounded partial evidence #4728

New issue

Closed

opened 2026-10-31 00:54:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1651
Author: @N0zoM1z0
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @morluto

Base: main ← Head: fix/javascript-analysis-worker-1563

📝 Commits (4)

78f9da9 refactor(javascript): validate transferable file projections
e5d8179 test(javascript): consume decoded module and static facts
8a13d92 fix(javascript): isolate source analysis and retain bounded partial evidence
32b56f1 test(javascript): verify cleanup retention and repeated source paths

📊 Changes

41 files changed (+3748 additions, -176 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/javascript-applications.md (+16 -0)
📝 docs/javascript-artifact-reconstruction.md (+43 -3)
📝 knip.json (+1 -0)
📝 package.json (+3 -0)
📝 src/application/javascript/JavaScriptApplicationService.ts (+10 -14)
📝 src/application/javascript/JavaScriptArtifactAnalysis.ts (+185 -21)
📝 src/application/javascript/JavaScriptArtifactAnalysisTypes.ts (+15 -9)
📝 src/application/javascript/JavaScriptArtifactGraphAccumulator.ts (+16 -23)
📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+45 -10)
📝 src/application/javascript/JavaScriptArtifactGraphContext.ts (+7 -1)
📝 src/application/javascript/JavaScriptArtifactGraphStructure.ts (+80 -1)
📝 src/application/javascript/JavaScriptArtifactReconstruction.ts (+157 -72)
📝 src/application/javascript/JavaScriptArtifactReconstructionInput.ts (+2 -0)
📝 src/application/javascript/JavaScriptSemanticGraphBuilder.ts (+152 -8)
📝 src/artifacts/ArtifactResourceScope.test.ts (+46 -0)
📝 src/artifacts/ArtifactResourceScope.ts (+9 -0)
➕ src/artifacts/javascript/JavaScriptSourceAnalysis.ts (+12 -0)
📝 src/cli/electronCommands.ts (+6 -0)
📝 src/cliObservationOptions.ts (+4 -0)
➕ src/composition/javascriptAnalysisWorkerProcess.ts (+82 -0)

...and 21 more files

📄 Description

Fix JavaScript application analysis that exhausts the CLI/MCP heap on a real public Bun module (#1563). Parse and project each inert source in a reusable owned Node worker with an independent heap limit and deadline. Negotiate parent admission after validated static checkpoints, retain observed facts when deeper projection does not fit, and keep cancellation, timeout, cleanup failures and unexamined relationships explicit.

Preserve the default complete-result contract. Oversized MCP responses use existing retained Evidence delivery; interrupted analyses return a directly usable partial Evidence reference after successful recording. CLI JSON retains the complete partial observation. Fix duplicate-content node merges retaining historical observation arrays and reuse privately immutable JSON properties during graph validation.

MCP controls are optional and leave omitted values out of Evidence parameters:

{"input_path":"/absolute/path/to/application","max_heap_mb":512,"analysis_timeout_ms":300000}

A recorded timeout/cancellation partial result exposes the original analysis directly:

{"partial_observation":{"kind":"retained-evidence","evidence_id":"ev_..."}}

Verification:

Integrated latest affected main changes, including caller-owned artifact cleanup scopes and indexed structured observations.
154 focused tests passed: real worker reuse/startup deadline, SDK cancellation and subsequent work, 1500 identical-content paths, raw findings through public module views, nested reader cleanup, large literal CLI/MCP, schema dialect validity and module boundaries.
Complete feedback directory, 768 MiB parent and worker: 2346 parsed JavaScript files, all 2589 input digests unchanged, no parent fatal heap or leftover owned roots. Partial graph coverage remains explicit. Selected summary/page/item/trace, close/stale and subsequent analysis all passed; sampled process-family peak 1.70 GiB.
Actual semantic worker heap failure on a 1.6 MB dense source with a 512 MiB worker: completed static facts survived, the MCP parent remained usable, and subsequent work passed.
Real Notion ASAR at the same heap limits: 69 JavaScript files parsed across 121 relevant files, partial coverage explicit, unchanged input digest; 98 control pings, maximum 13.31 ms. Summary/page/item/trace and close passed.
Actual CLI SIGINT while analyzing the second dense source: exit 130, complete JSON partial Evidence retained the first source, no syntax-failure inflation or leftover owned roots.
npm run check:ci, npm run docs:check, npm run mcp-catalog:check, and discovery of all 794 test files passed.
npm run verify:package passed on a production-only installation, including JavaScript dedicated/generic CLI, 170 MCP tools, setup/update, evidence and cleanup workflows.

Remaining verification before merge: native Windows installation/workflow and exact-head CI. No real Hopper/Ghidra/IDA authority was exercised by this JavaScript change.

Fixes #1563. Fixes #1565. Follow-up to #1065; #1065 remains open.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1651 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/javascript-analysis-worker-1563` --- ### 📝 Commits (4) - [`78f9da9`](https://github.com/morluto/rea/commit/78f9da9a6ac8581d9996a72cbf9131c8a60d56ea) refactor(javascript): validate transferable file projections - [`e5d8179`](https://github.com/morluto/rea/commit/e5d8179c2938fe84106bc2aceaaf7ae89a067a4b) test(javascript): consume decoded module and static facts - [`8a13d92`](https://github.com/morluto/rea/commit/8a13d920bb69b4c8f3536aa8c152e3fdb2205537) fix(javascript): isolate source analysis and retain bounded partial evidence - [`32b56f1`](https://github.com/morluto/rea/commit/32b56f188e2c624a67d60421295c9b41dbdc7355) test(javascript): verify cleanup retention and repeated source paths ### 📊 Changes **41 files changed** (+3748 additions, -176 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/javascript-applications.md` (+16 -0) 📝 `docs/javascript-artifact-reconstruction.md` (+43 -3) 📝 `knip.json` (+1 -0) 📝 `package.json` (+3 -0) 📝 `src/application/javascript/JavaScriptApplicationService.ts` (+10 -14) 📝 `src/application/javascript/JavaScriptArtifactAnalysis.ts` (+185 -21) 📝 `src/application/javascript/JavaScriptArtifactAnalysisTypes.ts` (+15 -9) 📝 `src/application/javascript/JavaScriptArtifactGraphAccumulator.ts` (+16 -23) 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+45 -10) 📝 `src/application/javascript/JavaScriptArtifactGraphContext.ts` (+7 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphStructure.ts` (+80 -1) 📝 `src/application/javascript/JavaScriptArtifactReconstruction.ts` (+157 -72) 📝 `src/application/javascript/JavaScriptArtifactReconstructionInput.ts` (+2 -0) 📝 `src/application/javascript/JavaScriptSemanticGraphBuilder.ts` (+152 -8) 📝 `src/artifacts/ArtifactResourceScope.test.ts` (+46 -0) 📝 `src/artifacts/ArtifactResourceScope.ts` (+9 -0) ➕ `src/artifacts/javascript/JavaScriptSourceAnalysis.ts` (+12 -0) 📝 `src/cli/electronCommands.ts` (+6 -0) 📝 `src/cliObservationOptions.ts` (+4 -0) ➕ `src/composition/javascriptAnalysisWorkerProcess.ts` (+82 -0) _...and 21 more files_ </details> ### 📄 Description Fix JavaScript application analysis that exhausts the CLI/MCP heap on a real public Bun module (#1563). Parse and project each inert source in a reusable owned Node worker with an independent heap limit and deadline. Negotiate parent admission after validated static checkpoints, retain observed facts when deeper projection does not fit, and keep cancellation, timeout, cleanup failures and unexamined relationships explicit. Preserve the default complete-result contract. Oversized MCP responses use existing retained Evidence delivery; interrupted analyses return a directly usable partial Evidence reference after successful recording. CLI JSON retains the complete partial observation. Fix duplicate-content node merges retaining historical observation arrays and reuse privately immutable JSON properties during graph validation. MCP controls are optional and leave omitted values out of Evidence parameters: ```json {"input_path":"/absolute/path/to/application","max_heap_mb":512,"analysis_timeout_ms":300000} ``` A recorded timeout/cancellation partial result exposes the original analysis directly: ```json {"partial_observation":{"kind":"retained-evidence","evidence_id":"ev_..."}} ``` Verification: - Integrated latest affected main changes, including caller-owned artifact cleanup scopes and indexed structured observations. - 154 focused tests passed: real worker reuse/startup deadline, SDK cancellation and subsequent work, 1500 identical-content paths, raw findings through public module views, nested reader cleanup, large literal CLI/MCP, schema dialect validity and module boundaries. - Complete feedback directory, 768 MiB parent and worker: 2346 parsed JavaScript files, all 2589 input digests unchanged, no parent fatal heap or leftover owned roots. Partial graph coverage remains explicit. Selected summary/page/item/trace, close/stale and subsequent analysis all passed; sampled process-family peak 1.70 GiB. - Actual semantic worker heap failure on a 1.6 MB dense source with a 512 MiB worker: completed static facts survived, the MCP parent remained usable, and subsequent work passed. - Real Notion ASAR at the same heap limits: 69 JavaScript files parsed across 121 relevant files, partial coverage explicit, unchanged input digest; 98 control pings, maximum 13.31 ms. Summary/page/item/trace and close passed. - Actual CLI SIGINT while analyzing the second dense source: exit 130, complete JSON partial Evidence retained the first source, no syntax-failure inflation or leftover owned roots. - `npm run check:ci`, `npm run docs:check`, `npm run mcp-catalog:check`, and discovery of all 794 test files passed. - `npm run verify:package` passed on a production-only installation, including JavaScript dedicated/generic CLI, 170 MCP tools, setup/update, evidence and cleanup workflows. Remaining verification before merge: native Windows installation/workflow and exact-head CI. No real Hopper/Ghidra/IDA authority was exercised by this JavaScript change. Fixes #1563. Fixes #1565. Follow-up to #1065; #1065 remains open. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:26 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4728

No description provided.

Rows
Columns