[PR #2094] feat(javascript): fold constant values and recover Electron boundaries through wrappers #5023

New issue

Open

opened 2026-10-31 00:58:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:58:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2094
Author: @coleleavitt
Created: 10/12/2026
Status: 🔄 Open

Base: main ← Head: pr/javascript-constant-folding-electron-ipc

📝 Commits (10+)

83a2950 fix(javascript): calibrate parent result retention from measured expansion
6798412 feat(javascript)!: bound semantic facts by serialized Evidence bytes
780465c fix(javascript): bound getter expansion through unknown receiver keys
20266cb test(javascript): exceed the calibrated application forecast at the MCP boundary
670685c feat(analysis-view): page JavaScript semantic coverage and unknown frontiers
428ef76 feat(javascript): fold primitive operators, join, and fromCharCode
aadf79d feat(javascript): report folded constants in Electron, IPC, and endpoint findings
2375e53 feat(javascript): fold semantic request endpoints and configuration defaults
2cf4d02 feat(javascript): report URL, host, and path values present in data
4caa76a docs(javascript): describe folded values and data endpoints

📊 Changes

124 files changed (+10827 additions, -1362 deletions)

View changed files

📝 docs/javascript-application-graph.md (+2 -1)
📝 docs/javascript-artifact-reconstruction.md (+182 -15)
📝 src/application/javascript/ElectronBoundaryAnalysis.ts (+209 -18)
📝 src/application/javascript/ElectronBoundaryGraph.ts (+2 -0)
📝 src/application/javascript/ElectronBoundaryGraphCallPaths.ts (+35 -12)
📝 src/application/javascript/ElectronBoundaryGraphContext.ts (+75 -1)
📝 src/application/javascript/ElectronBoundaryGraphIpc.ts (+62 -17)
📝 src/application/javascript/ElectronBoundaryGraphNative.ts (+22 -6)
➕ src/application/javascript/ElectronBoundaryGraphPolicies.ts (+88 -0)
📝 src/application/javascript/ElectronBoundaryGraphWindows.ts (+115 -22)
➕ src/application/javascript/ElectronNativeAddonResolution.test.ts (+52 -0)
📝 src/application/javascript/JavaScriptApplicationEvidenceGraph.ts (+6 -6)
📝 src/application/javascript/JavaScriptArtifactAnalysis.ts (+102 -22)
📝 src/application/javascript/JavaScriptArtifactAnalysisTypes.ts (+8 -0)
📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+2 -6)
📝 src/application/javascript/JavaScriptArtifactGraphContext.ts (+3 -1)
➕ src/application/javascript/JavaScriptArtifactGraphEndpoints.ts (+96 -0)
📝 src/application/javascript/JavaScriptArtifactGraphFindings.ts (+5 -50)
📝 src/application/javascript/JavaScriptArtifactReconstruction.ts (+2 -1)
➕ src/application/javascript/JavaScriptSemanticFileGraphBudget.ts (+115 -0)

...and 80 more files

📄 Description

Depends on https://github.com/morluto/rea/pull/2092 — this branch is based on it, so its first five commits are that PR's; review the commits listed below.

Branch: pr/javascript-constant-folding-electron-ipc
Base: pr/javascript-semantic-budget (depends on it; see below). Merge that PR first.

Commits (on top of pr/javascript-semantic-budget):

428ef76f6 feat(javascript): fold primitive operators, join, and fromCharCode
aadf79d66 feat(javascript): report folded constants in Electron, IPC, and endpoint findings
2375e53a4 feat(javascript): fold semantic request endpoints and configuration defaults
2cf4d0250 feat(javascript): report URL, host, and path values present in data
4caa76a6e docs(javascript): describe folded values and data endpoints
6c2c5f7b6 fix(javascript): report files whose static values stay literal-only
b300f75d3 feat(electron): infer Electron APIs passed through one wrapper parameter
0ab2a6b43 feat(electron): enumerate contextBridge APIs bound to object literals
a352d0415 feat(electron): report WebContentsView/BrowserView and will-attach-webview hardening
315e06344 feat(electron): infer Electron APIs from local fallback alternatives
26b69f1d9 feat(electron): resolve native add-ons loaded through createRequire, bindings, node-gyp-build and process.dlopen
12df9c6aa feat(electron): report Content-Security-Policy declarations and broad sources
b60f2d80b fix(electron): follow createRequire aliases used as parameter defaults
79dd864ae refactor(javascript): give the constant lattice one leaf-parameterized operator folder
8eed2c4c9 feat(javascript): fold wrapped Electron values with the shared operator folder
2c6bef645 feat(javascript): recover generated IPC channels across wrapper chains and linked sources

Problem

REA's static Electron model misses most of what a minified, wrapper-heavy Electron
app exposes. REA_REPORT.md §2 lists the gaps found by manual reading of Grok Bot 0.68.1
(REA 6.3.0), and they persist on current origin/main b3dec005b:

No constant folding. Minified !0/!1 options were reported as dynamic;
channels and endpoints built with +, templates, join or String.fromCharCode
stayed unresolved.
Electron APIs passed as parameters were invisible. The WebAuthn consent window is
new t({…}) where t is BrowserWindow passed to a wrapper
(main-app.cjs:369:807). The whole app RPC layer (dune-rpc:${edge}:m:${method})
registers handlers through ipcMain passed as a parameter, with template channels.
contextBridge.exposeInMainWorld("desktop", lp) with lp bound to an object
literal reported members: [].
No WebContentsView/BrowserView, no will-attach-webview hardening, no CSP.
Native add-ons loaded through createRequire, bindings or node-gyp-build were
not resolved.
URL/host constants in data tables (API hosts, MCP/OAuth provider tables) were not
reported; the endpoint model only saw call sites.

What changed

Constant lattice: void, typeof, !, ~, arithmetic, comparison, shift and
bitwise operators over exact primitives, templates, Array.prototype.join and
String.fromCharCode fold through one leaf-parameterized operator folder
(foldSemanticOperands) shared by static values and wrapper substitution. Only
JSON-representable results become values. Folded values report status: "derived"
with the source expression; IPC pairing treats derived channels as exact
(unique-exact-derived-channel). A file whose member-write recovery exceeds a
resource limit keeps literal-only values and says so in limitations.
Data endpoints: URL, host and path strings in data (literals, object keys,
template text, folded expressions) are reported as endpoint_kind: "data" with
url_class, host and property_path. Host-only values must be lowercase DNS names
under a two-letter IANA ccTLD or a common gTLD.
Electron API identity: a callee that is a wrapper parameter (or destructured
parameter key) resolves when every same-file call site passes the same proven
Electron export (basis: "wrapper-parameter"); a local ??/||/&&/conditional/
object-literal binding resolves when its proving branches agree
(basis: "local-alternatives"). Relationships that depend on an inferred identity
are inferences with medium/low confidence.
contextBridge APIs bound to one stable object literal list their members
(api_status: "object-binding", conditional_members for known conditional spreads).
BrowserView/WebContentsView constructions, and will-attach-webview writes and
deletions on webPreferences/params plus the last static preload path.
Native loaders: module.createRequire functions, bindings, node-gyp-build and
process.dlopen, directly, through one alias, or through a parameter default.
Content-Security-Policy from <meta http-equiv>, header properties/assignments,
[...].join directive lists and string/template literals, with per-directive
concerns. Runtime parts stay ${…} and are not judged.
Wrapper substitution follows computed IPC channels from the outermost same-file
callers through up to eight wrapper levels, iterates exact arrays in for…of,
links a unique globalThis[Symbol.for(key)] publication in another source of the
artifact, and reports operations reached only under unresolved predicates with
guard_alternatives (counted as guarded_renderer_transmissions, no pairing edge).
New finding keys use compositeKey (no NUL-joined keys).

Why it depends on `pr/javascript-semantic-budget`

Both change the worker protocol and schemas (JavaScriptAnalysisWorker*.ts),
JavaScriptArtifactAnalysis.ts and the semantic projection signature
(projectJavaScriptSemanticFileSteps(file, ir, graphByteBudget, nodeBudget, callPaths)).
Splitting them would need a second, conflicting version of those files.

Breaking changes

None intended. Output additions only: new optional/added fields (electron_identity,
resolution_basis, guard_alternatives, linked_operation, url_class, host,
property_path, web_contents_views, webview_attachments,
content_security_policies, loader fields on native bindings) and summary counters.
One behaviour change consumers may notice: values that were reported as dynamic
(for example !0, "a" + "b") are now derived, with the value and the source
expression.

Verification

On this branch (A + this PR), tree identical to the integration branch minus the
jsbeautify PR:

npm run check — pass.
npm run test:changed -- --base origin/main — 109 files, 2005 passed, 3 skipped.
npm run test:focused on 60 javascript/electron boundary and acceptance files —
453 tests passed.
npx tsc --noEmit passes on every commit.
Real CLI run, Grok Bot app.asar, default heap (3:14 wall, 1.33 GB peak RSS,
579/579 parsed). summary compared with origin/main b3dec005b:

	origin/main	this branch
browser_windows / web_contents_views / webview_attach_handlers	3 / – / –	5 / 1 / 1
explicit_web_preferences	7	13
context_bridge_apis / exposed_api_members	6 / 95	7 / 381
IPC operations / literal channels	15 / 2	673 / 355
main handlers / renderer transmissions	6 / 5	319 / 312
paired / guarded transmissions	0 / –	24 / 279
native bindings (resolved)	2 (2)	4 (4)
inferred API identity findings	–	15
CSP policies / concerns	–	5 / 8

dune-rpc: handlers recovered for every method the report counted by hand —
main 281/281, desktop-mount 10/10, sand-dev 10/10, box-vnc 2/2, plus the
probes (REA 6.3.0 and origin/main: 0). 278/281 renderer main-edge invokes are
recovered as guarded (behind the sand:main-edge-served gate), 20 desktop-mount
invokes pair.
The WebAuthn consent window (main-app.cjs:369:806, basis: wrapper-parameter),
a dialog parent window found through local alternatives, and the avatar
WebContentsView (main-app.cjs:386:27105) are reported; will-attach-webview
is reported with its forced nodeIntegration/contextIsolation/sandbox and
preload writes.
The desktop bridge object lp now lists its members (381 members over 7
bridge APIs, vs 95 on origin/main).
Data endpoints: all 9 hosts the report found only by manual grep (§2.6:
api.x.ai, api.x.com, mcp.money.x.com, connectors-gateway.grok.com,
downloads.cursor.com, prod.authentication.cursor.sh, api2.cursor.sh,
grok.com, cursor.com) are reported; origin/main and the budget PR alone
report 0 of them.
The 5 CSPs include the renderer index.html and panel panel.html meta
policies from §2.7 with their img-src https:/connect-src ws:/
style-src 'unsafe-inline' concerns.

Limitations

Everything is static inference from inert syntax: runtime registration,
reachability and guard outcomes are not proven; inferred identities are marked
as inferences.
Wrapper-parameter identity looks at same-file call sites only; one wrapper level
for identity, eight for channel substitution.
Global-symbol linking assumes the two sources share one realm.
Folding assumes unmodified String.fromCharCode and Array.prototype.join.
Data-endpoint host classification is syntactic; dotted identifiers under a real
TLD can still match.
The REA_REPORT !0/!1 fix is delivered by the constant lattice
(status: "derived", expression !0), not by a literal special case.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2094 **Author:** [@coleleavitt](https://github.com/coleleavitt) **Created:** 10/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `pr/javascript-constant-folding-electron-ipc` --- ### 📝 Commits (10+) - [`83a2950`](https://github.com/morluto/rea/commit/83a2950c4c0c3370fc4e6489da274580328465fd) fix(javascript): calibrate parent result retention from measured expansion - [`6798412`](https://github.com/morluto/rea/commit/6798412a56fb0ffa8c103d9d6df1f3f1c441b7bc) feat(javascript)!: bound semantic facts by serialized Evidence bytes - [`780465c`](https://github.com/morluto/rea/commit/780465c64fdc3f3609193049bf08fbeadce70ae5) fix(javascript): bound getter expansion through unknown receiver keys - [`20266cb`](https://github.com/morluto/rea/commit/20266cb617988c6b91c7db14c88406f126702640) test(javascript): exceed the calibrated application forecast at the MCP boundary - [`670685c`](https://github.com/morluto/rea/commit/670685c475b8f9990b4aa199dcdc7f24274fb198) feat(analysis-view): page JavaScript semantic coverage and unknown frontiers - [`428ef76`](https://github.com/morluto/rea/commit/428ef76f6d6c25e3db4f3e8c8dbdf331ebd94062) feat(javascript): fold primitive operators, join, and fromCharCode - [`aadf79d`](https://github.com/morluto/rea/commit/aadf79d66830e7434ab8f4c3c719371318a5d772) feat(javascript): report folded constants in Electron, IPC, and endpoint findings - [`2375e53`](https://github.com/morluto/rea/commit/2375e53a4d293867967b4aa9f8e71a3de55191bb) feat(javascript): fold semantic request endpoints and configuration defaults - [`2cf4d02`](https://github.com/morluto/rea/commit/2cf4d0250273f4a4df3fc66973605276ea382e75) feat(javascript): report URL, host, and path values present in data - [`4caa76a`](https://github.com/morluto/rea/commit/4caa76a6e4bcdd962ab848a581c3ea2f9346d37c) docs(javascript): describe folded values and data endpoints ### 📊 Changes **124 files changed** (+10827 additions, -1362 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-application-graph.md` (+2 -1) 📝 `docs/javascript-artifact-reconstruction.md` (+182 -15) 📝 `src/application/javascript/ElectronBoundaryAnalysis.ts` (+209 -18) 📝 `src/application/javascript/ElectronBoundaryGraph.ts` (+2 -0) 📝 `src/application/javascript/ElectronBoundaryGraphCallPaths.ts` (+35 -12) 📝 `src/application/javascript/ElectronBoundaryGraphContext.ts` (+75 -1) 📝 `src/application/javascript/ElectronBoundaryGraphIpc.ts` (+62 -17) 📝 `src/application/javascript/ElectronBoundaryGraphNative.ts` (+22 -6) ➕ `src/application/javascript/ElectronBoundaryGraphPolicies.ts` (+88 -0) 📝 `src/application/javascript/ElectronBoundaryGraphWindows.ts` (+115 -22) ➕ `src/application/javascript/ElectronNativeAddonResolution.test.ts` (+52 -0) 📝 `src/application/javascript/JavaScriptApplicationEvidenceGraph.ts` (+6 -6) 📝 `src/application/javascript/JavaScriptArtifactAnalysis.ts` (+102 -22) 📝 `src/application/javascript/JavaScriptArtifactAnalysisTypes.ts` (+8 -0) 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+2 -6) 📝 `src/application/javascript/JavaScriptArtifactGraphContext.ts` (+3 -1) ➕ `src/application/javascript/JavaScriptArtifactGraphEndpoints.ts` (+96 -0) 📝 `src/application/javascript/JavaScriptArtifactGraphFindings.ts` (+5 -50) 📝 `src/application/javascript/JavaScriptArtifactReconstruction.ts` (+2 -1) ➕ `src/application/javascript/JavaScriptSemanticFileGraphBudget.ts` (+115 -0) _...and 80 more files_ </details> ### 📄 Description Depends on https://github.com/morluto/rea/pull/2092 — this branch is based on it, so its first five commits are that PR's; review the commits listed below. Branch: `pr/javascript-constant-folding-electron-ipc` Base: `pr/javascript-semantic-budget` (depends on it; see below). Merge that PR first. Commits (on top of `pr/javascript-semantic-budget`): - 428ef76f6 feat(javascript): fold primitive operators, join, and fromCharCode - aadf79d66 feat(javascript): report folded constants in Electron, IPC, and endpoint findings - 2375e53a4 feat(javascript): fold semantic request endpoints and configuration defaults - 2cf4d0250 feat(javascript): report URL, host, and path values present in data - 4caa76a6e docs(javascript): describe folded values and data endpoints - 6c2c5f7b6 fix(javascript): report files whose static values stay literal-only - b300f75d3 feat(electron): infer Electron APIs passed through one wrapper parameter - 0ab2a6b43 feat(electron): enumerate contextBridge APIs bound to object literals - a352d0415 feat(electron): report WebContentsView/BrowserView and will-attach-webview hardening - 315e06344 feat(electron): infer Electron APIs from local fallback alternatives - 26b69f1d9 feat(electron): resolve native add-ons loaded through createRequire, bindings, node-gyp-build and process.dlopen - 12df9c6aa feat(electron): report Content-Security-Policy declarations and broad sources - b60f2d80b fix(electron): follow createRequire aliases used as parameter defaults - 79dd864ae refactor(javascript): give the constant lattice one leaf-parameterized operator folder - 8eed2c4c9 feat(javascript): fold wrapped Electron values with the shared operator folder - 2c6bef645 feat(javascript): recover generated IPC channels across wrapper chains and linked sources ## Problem REA's static Electron model misses most of what a minified, wrapper-heavy Electron app exposes. REA_REPORT.md §2 lists the gaps found by manual reading of Grok Bot 0.68.1 (REA 6.3.0), and they persist on current `origin/main` b3dec005b: - No constant folding. Minified `!0`/`!1` options were reported as `dynamic`; channels and endpoints built with `+`, templates, `join` or `String.fromCharCode` stayed unresolved. - Electron APIs passed as parameters were invisible. The WebAuthn consent window is `new t({…})` where `t` is `BrowserWindow` passed to a wrapper (`main-app.cjs:369:807`). The whole app RPC layer (`dune-rpc:${edge}:m:${method}`) registers handlers through `ipcMain` passed as a parameter, with template channels. - `contextBridge.exposeInMainWorld("desktop", lp)` with `lp` bound to an object literal reported `members: []`. - No `WebContentsView`/`BrowserView`, no `will-attach-webview` hardening, no CSP. - Native add-ons loaded through `createRequire`, `bindings` or `node-gyp-build` were not resolved. - URL/host constants in data tables (API hosts, MCP/OAuth provider tables) were not reported; the endpoint model only saw call sites. ## What changed - Constant lattice: `void`, `typeof`, `!`, `~`, arithmetic, comparison, shift and bitwise operators over exact primitives, templates, `Array.prototype.join` and `String.fromCharCode` fold through one leaf-parameterized operator folder (`foldSemanticOperands`) shared by static values and wrapper substitution. Only JSON-representable results become values. Folded values report `status: "derived"` with the source expression; IPC pairing treats derived channels as exact (`unique-exact-derived-channel`). A file whose member-write recovery exceeds a resource limit keeps literal-only values and says so in `limitations`. - Data endpoints: URL, host and path strings in data (literals, object keys, template text, folded expressions) are reported as `endpoint_kind: "data"` with `url_class`, `host` and `property_path`. Host-only values must be lowercase DNS names under a two-letter IANA ccTLD or a common gTLD. - Electron API identity: a callee that is a wrapper parameter (or destructured parameter key) resolves when every same-file call site passes the same proven Electron export (`basis: "wrapper-parameter"`); a local `??`/`||`/`&&`/conditional/ object-literal binding resolves when its proving branches agree (`basis: "local-alternatives"`). Relationships that depend on an inferred identity are inferences with medium/low confidence. - contextBridge APIs bound to one stable object literal list their members (`api_status: "object-binding"`, `conditional_members` for known conditional spreads). - `BrowserView`/`WebContentsView` constructions, and `will-attach-webview` writes and deletions on `webPreferences`/`params` plus the last static preload path. - Native loaders: `module.createRequire` functions, `bindings`, `node-gyp-build` and `process.dlopen`, directly, through one alias, or through a parameter default. - Content-Security-Policy from `<meta http-equiv>`, header properties/assignments, `[...].join` directive lists and string/template literals, with per-directive concerns. Runtime parts stay `${…}` and are not judged. - Wrapper substitution follows computed IPC channels from the outermost same-file callers through up to eight wrapper levels, iterates exact arrays in `for…of`, links a unique `globalThis[Symbol.for(key)]` publication in another source of the artifact, and reports operations reached only under unresolved predicates with `guard_alternatives` (counted as `guarded_renderer_transmissions`, no pairing edge). - New finding keys use `compositeKey` (no NUL-joined keys). ## Why it depends on `pr/javascript-semantic-budget` Both change the worker protocol and schemas (`JavaScriptAnalysisWorker*.ts`), `JavaScriptArtifactAnalysis.ts` and the semantic projection signature (`projectJavaScriptSemanticFileSteps(file, ir, graphByteBudget, nodeBudget, callPaths)`). Splitting them would need a second, conflicting version of those files. ## Breaking changes None intended. Output additions only: new optional/added fields (`electron_identity`, `resolution_basis`, `guard_alternatives`, `linked_operation`, `url_class`, `host`, `property_path`, `web_contents_views`, `webview_attachments`, `content_security_policies`, loader fields on native bindings) and summary counters. One behaviour change consumers may notice: values that were reported as `dynamic` (for example `!0`, `"a" + "b"`) are now `derived`, with the value and the source expression. ## Verification On this branch (A + this PR), tree identical to the integration branch minus the jsbeautify PR: - `npm run check` — pass. - `npm run test:changed -- --base origin/main` — 109 files, 2005 passed, 3 skipped. - `npm run test:focused` on 60 javascript/electron boundary and acceptance files — 453 tests passed. - `npx tsc --noEmit` passes on every commit. - Real CLI run, Grok Bot `app.asar`, default heap (3:14 wall, 1.33 GB peak RSS, 579/579 parsed). `summary` compared with `origin/main` b3dec005b: | | origin/main | this branch | |---|---|---| | browser_windows / web_contents_views / webview_attach_handlers | 3 / – / – | 5 / 1 / 1 | | explicit_web_preferences | 7 | 13 | | context_bridge_apis / exposed_api_members | 6 / 95 | 7 / 381 | | IPC operations / literal channels | 15 / 2 | 673 / 355 | | main handlers / renderer transmissions | 6 / 5 | 319 / 312 | | paired / guarded transmissions | 0 / – | 24 / 279 | | native bindings (resolved) | 2 (2) | 4 (4) | | inferred API identity findings | – | 15 | | CSP policies / concerns | – | 5 / 8 | - dune-rpc: handlers recovered for every method the report counted by hand — `main` 281/281, `desktop-mount` 10/10, `sand-dev` 10/10, `box-vnc` 2/2, plus the probes (REA 6.3.0 and origin/main: 0). 278/281 renderer main-edge invokes are recovered as guarded (behind the `sand:main-edge-served` gate), 20 desktop-mount invokes pair. - The WebAuthn consent window (`main-app.cjs:369:806`, `basis: wrapper-parameter`), a dialog parent window found through local alternatives, and the avatar `WebContentsView` (`main-app.cjs:386:27105`) are reported; `will-attach-webview` is reported with its forced `nodeIntegration`/`contextIsolation`/`sandbox` and preload writes. - The `desktop` bridge object `lp` now lists its members (381 members over 7 bridge APIs, vs 95 on origin/main). - Data endpoints: all 9 hosts the report found only by manual grep (§2.6: `api.x.ai`, `api.x.com`, `mcp.money.x.com`, `connectors-gateway.grok.com`, `downloads.cursor.com`, `prod.authentication.cursor.sh`, `api2.cursor.sh`, `grok.com`, `cursor.com`) are reported; origin/main and the budget PR alone report 0 of them. - The 5 CSPs include the renderer `index.html` and panel `panel.html` meta policies from §2.7 with their `img-src https:`/`connect-src ws:`/ `style-src 'unsafe-inline'` concerns. ## Limitations - Everything is static inference from inert syntax: runtime registration, reachability and guard outcomes are not proven; inferred identities are marked as inferences. - Wrapper-parameter identity looks at same-file call sites only; one wrapper level for identity, eight for channel substitution. - Global-symbol linking assumes the two sources share one realm. - Folding assumes unmodified `String.fromCharCode` and `Array.prototype.join`. - Data-endpoint host classification is syntactic; dotted identifiers under a real TLD can still match. - The REA_REPORT `!0`/`!1` fix is delivered by the constant lattice (`status: "derived"`, expression `!0`), not by a literal special case. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 00:58:33 +00:00

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425

bsakaguchi referenced this issue

2026-11-01 21:42:44 +00:00

[PR #5023] feat(kuna): admit Windows PE images through the verified provider lane #6741