[PR #1664] [MERGED] fix(javascript): exclude overwritten Electron API identities #4735

New issue

Closed

opened 2026-10-31 00:54:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:30 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1664
Author: @N0zoM1z0
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: fix/electron-overwritten-namespace-1656

📝 Commits (5)

28f2b3d fix(javascript): exclude overwritten Electron API identities
34a2f73 test(javascript): bind Electron in file-base path fixture
ea9b74f test(electron): bind BrowserWindow in preload override fixtures
d42d2bc test(mcp): allow cold catalog validation in runtime probe
372ad95 test(electron): bind APIs in option reconstruction fixtures

📊 Changes

14 files changed (+436 additions, -63 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+8 -0)
📝 scripts/verify/electron/tool-contracts.mjs (+2 -1)
📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+6 -0)
📝 src/application/javascript/JavaScriptArtifactPathResolution.test.ts (+1 -0)
📝 src/domain/javascript/javascriptAstValues.ts (+25 -0)
➕ src/domain/javascript/javascriptElectronMemberWrites.ts (+61 -0)
📝 src/domain/javascript/javascriptSemanticAnalysis.ts (+30 -26)
📝 src/domain/javascript/javascriptSemanticMemberMutations.ts (+4 -15)
📝 src/domain/javascript/javascriptSemanticPropertyPaths.ts (+23 -17)
📝 src/domain/javascript/javascriptStaticAnalysis.ts (+10 -0)
📝 tests/acceptance/applications/applicationWorkflowCli.test.ts (+250 -0)
📝 tests/acceptance/applications/electronPreloadOverridesCli.test.ts (+4 -1)
📝 tests/acceptance/applications/runtime.test.ts (+4 -1)
📝 tests/composition/javascript-applications/electronOptionKeys.test.ts (+8 -2)

📄 Description

Visible writes through Electron namespace aliases can leave an ordinary replacement object reported as a real IPC handler. Index direct/destructuring assignment, loop, update and delete targets with the existing property-path coverage trie and exclude affected call identities, including direct require("electron") writes and unknown write keys. Preserve unrelated members and literal key boundaries.

Forward an explicit static identity limitation into public application results, including empty findings. Add compiled CLI/stdio MCP controls for valid aliases and unavailable identities, preserving source-range Evidence and IPC pairing. This inspects inert source; it does not execute Electron or establish runtime side effects. Follow-up to #1656.

Also format the existing real-Electron verifier to clear an inherited format gate failure. Fix existing Electron fixtures to import their API while retaining range assertions. Give only the full-catalog runtime probe a 30-second test budget: two parallel-CI runs exhausted 15 seconds; actual single-CPU runs take about 8–9 seconds. Its complete-catalog, lifecycle and fatal-record assertions remain intact.

Validation (349 focused tests across nine files passed):

npm run test:focused -- tests/acceptance/applications/applicationWorkflowCli.test.ts src/domain/javascript/javascriptSemanticAnalysisSteps.test.ts src/domain/javascript/electronStaticAnalysisOptions.test.ts src/domain/javascript/javascriptStaticPathResolution.test.ts src/domain/javascript/javascriptSemanticAnalysis.member_mutations.test.ts
npm run test:focused -- src/application/javascript/JavaScriptArtifactPathResolution.test.ts (59 passed after fixing its missing Electron import; assertions retained)
npm run test:focused -- tests/acceptance/applications/electronPreloadOverridesCli.test.ts tests/acceptance/applications/runtime.test.ts (CLI/MCP preload assertions retained; runtime catalog passed twice locally; two macOS-only local skips)
npm run test:focused -- tests/composition/javascript-applications/electronOptionKeys.test.ts (15 passed; API imports corrected, assertions retained)
npm run check:ci
npm run docs:check
Native Qwen0.25.0, Pi1.1.0, Hermes ordinary/sticky-profile runs at28f2b3d5: all170 tools, actual stdio MCP analysis, skill loading, full Evidence, Qwen result-artifact read, verified empty owned process lineages. Deterministic loopback model endpoint; no live model-provider claim.

Host: Linux x64, Node 24.18.0. No real Electron, Hopper, Ghidra, or GUI verification claimed by this follow-up.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1664 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/electron-overwritten-namespace-1656` --- ### 📝 Commits (5) - [`28f2b3d`](https://github.com/morluto/rea/commit/28f2b3d5fb7f83b6140dfb75a56524e521a68175) fix(javascript): exclude overwritten Electron API identities - [`34a2f73`](https://github.com/morluto/rea/commit/34a2f73cebd9fd16a7277f546e335e65fcdf9ce6) test(javascript): bind Electron in file-base path fixture - [`ea9b74f`](https://github.com/morluto/rea/commit/ea9b74f34ecef036498350ecbbd97702c6f39829) test(electron): bind BrowserWindow in preload override fixtures - [`d42d2bc`](https://github.com/morluto/rea/commit/d42d2bc712ae93f05bed4539efe5e68818c09c44) test(mcp): allow cold catalog validation in runtime probe - [`372ad95`](https://github.com/morluto/rea/commit/372ad95c141b5dfc67bc78cb5d9346e2bba716eb) test(electron): bind APIs in option reconstruction fixtures ### 📊 Changes **14 files changed** (+436 additions, -63 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+8 -0) 📝 `scripts/verify/electron/tool-contracts.mjs` (+2 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+6 -0) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.test.ts` (+1 -0) 📝 `src/domain/javascript/javascriptAstValues.ts` (+25 -0) ➕ `src/domain/javascript/javascriptElectronMemberWrites.ts` (+61 -0) 📝 `src/domain/javascript/javascriptSemanticAnalysis.ts` (+30 -26) 📝 `src/domain/javascript/javascriptSemanticMemberMutations.ts` (+4 -15) 📝 `src/domain/javascript/javascriptSemanticPropertyPaths.ts` (+23 -17) 📝 `src/domain/javascript/javascriptStaticAnalysis.ts` (+10 -0) 📝 `tests/acceptance/applications/applicationWorkflowCli.test.ts` (+250 -0) 📝 `tests/acceptance/applications/electronPreloadOverridesCli.test.ts` (+4 -1) 📝 `tests/acceptance/applications/runtime.test.ts` (+4 -1) 📝 `tests/composition/javascript-applications/electronOptionKeys.test.ts` (+8 -2) </details> ### 📄 Description Visible writes through Electron namespace aliases can leave an ordinary replacement object reported as a real IPC handler. Index direct/destructuring assignment, loop, update and delete targets with the existing property-path coverage trie and exclude affected call identities, including direct `require("electron")` writes and unknown write keys. Preserve unrelated members and literal key boundaries. Forward an explicit static identity limitation into public application results, including empty findings. Add compiled CLI/stdio MCP controls for valid aliases and unavailable identities, preserving source-range Evidence and IPC pairing. This inspects inert source; it does not execute Electron or establish runtime side effects. Follow-up to #1656. Also format the existing real-Electron verifier to clear an inherited format gate failure. Fix existing Electron fixtures to import their API while retaining range assertions. Give only the full-catalog runtime probe a 30-second test budget: two parallel-CI runs exhausted 15 seconds; actual single-CPU runs take about 8–9 seconds. Its complete-catalog, lifecycle and fatal-record assertions remain intact. Validation (349 focused tests across nine files passed): - `npm run test:focused -- tests/acceptance/applications/applicationWorkflowCli.test.ts src/domain/javascript/javascriptSemanticAnalysisSteps.test.ts src/domain/javascript/electronStaticAnalysisOptions.test.ts src/domain/javascript/javascriptStaticPathResolution.test.ts src/domain/javascript/javascriptSemanticAnalysis.member_mutations.test.ts` - `npm run test:focused -- src/application/javascript/JavaScriptArtifactPathResolution.test.ts` (59 passed after fixing its missing Electron import; assertions retained) - `npm run test:focused -- tests/acceptance/applications/electronPreloadOverridesCli.test.ts tests/acceptance/applications/runtime.test.ts` (CLI/MCP preload assertions retained; runtime catalog passed twice locally; two macOS-only local skips) - `npm run test:focused -- tests/composition/javascript-applications/electronOptionKeys.test.ts` (15 passed; API imports corrected, assertions retained) - `npm run check:ci` - `npm run docs:check` - Native Qwen0.25.0, Pi1.1.0, Hermes ordinary/sticky-profile runs at28f2b3d5: all170 tools, actual stdio MCP analysis, skill loading, full Evidence, Qwen result-artifact read, verified empty owned process lineages. Deterministic loopback model endpoint; no live model-provider claim. Host: Linux x64, Node 24.18.0. No real Electron, Hopper, Ghidra, or GUI verification claimed by this follow-up. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:30 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:03 +00:00

[PR #4739] [CLOSED] [Bug] Signature inspection returns success after cancellation during final cleanup #6381

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4735

No description provided.

Rows
Columns