morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2948] [CLOSED] fix(javascript): follow Electron through Webpack bootstrap externals #5512

New issue

Closed

opened 2026-10-31 01:07:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:07:13 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2948
Author: @UnknownHacker1
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: fix/electron-webpack-externals

📝 Commits (4)

88bfa85 fix(javascript): follow Electron through Webpack bootstrap externals
4b7e2d6 fix(javascript): close remaining bootstrap proof gaps from review
e4e270f fix(javascript): require a dispatched return and resolve constant slot keys
800ac03 Merge remote-tracking branch 'origin/main' into sweep/2948

📄 Description

Summary

Refs #2932. if an electron app's main process is bundled with webpack, electron gets loaded through the bundle's module table (45840: e => { e.exports = require("electron") }) and then n(45840) everywhere, never a direct require("electron"). electron identity only knew the direct require so it just saw nothing. BrowserWindow, webPreferences, ipc handlers on the module, all 0.

this lets a loader call count as the require it re-exports, but only when the bootstrap can be proven intact.

Problem and expected behavior

smallest case (normal webpack 5 target: "electron-main" shape):

(()=>{var m={45840:e=>{"use strict";e.exports=require("electron")},100:(e,t,n)=>{"use strict";const s=n(45840);new s.BrowserWindow({webPreferences:{preload:"./preload.js"}});s.ipcMain.handle("get-connections",async()=>[])}},c={};function n(t){var r=c[t];if(void 0!==r)return r.exports;var o=c[t]={exports:{}};return m[t](o,o.exports,n),o.exports}n(100)})();

main gives browser_windows: []. should be one window with preload_path: "./preload.js" plus the get-connections handler, which is what you get now.

Change and scope

new semanticBundledRequireOrigin reuses javascriptBootstrapAt for the bootstrap shape, and proveJavaScriptBootstrapIntegrity checks the rest. n(KEY) only resolves when all of this holds:

n is the bootstrap loader (never reassigned) or a factory's 3rd param that the bootstrap passes the loader as
the loader's key param is never reassigned and the dispatch runs unconditionally
every return in the loader is the dispatched module's .exports (after the dispatch) or the cache entry the loader made for it
the module object is a plain literal and only reaches the dispatch, .exports reads and writes to other members
the cache starts as {}
the table only has literal keys and is only touched by the dispatch or the runtime's n.m = table exposure. same for the cache with n.c. n.m/n.c can only be assigned or indexed, a literal key write through them drops that slot, and writing into an entry drops the proof
the factory at KEY is a plain function (not generator/async/getter, no duplicate params) whose whole body is module.exports = require("x")

only electron identity uses it (rootExport and bindingOrigin). other semanticRequireOrigin users are unchanged. the member chain walk moved into semanticMemberChain so both resolvers share it.

not in here:

the n.n() default interop getter form (a = n.n(n(45840)); a().ipcMain). separate follow up
dynamic key writes through n.m[k] are left alone. thats chunk install adding its own ids, refusing those would turn this off for pretty much every chunked bundle

Contract and boundary impact

Semantic owner and earliest changed stage: electron identity in indexJavaScriptElectronIdentitySteps. bootstrap shape still owned by javascriptBootstrapAt
Contribution scope fit and linked maintainer decision: not applicable, static analysis fix
CLI and MCP/tool-catalog contract: none, same fields just more findings
Provider, bridge, target-format, or platform compatibility: none
Evidence, artifact, provenance, or reconstruction contract: calls through a proven loader are direct observations now. one existing test that reached electron through load(2) gets no resolution_basis instead of "wrapper-substitution" (same api key, members, world). thats what the same call through require("electron") gives too
Target selection, authority, upstream behavior, and cleanup details: not applicable
Generated metadata, package, or installation impact: none
Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated: electronBundledRequireIdentity.test.ts. 3 positive shapes, 4 real world loader shapes that have to keep working (try/finally cache delete like compass, n.c = cache, chunk install through n.m, module.loaded = !0 before the return), and 24 tampered or wrong shapes that have to stay unresolved (replaced loader, generator/async factory, loader returning something else, table slot replaced directly / through an alias / through n.m, planted cache entry, computed table keys, shadowed require, etc). electronWrappedCallPaths.test.ts has the one updated expectation above
Base reproduction: the positive cases fail on main. the tamper cases fail on the earlier pushes of this PR and pass now

fixture repo with a one command repro: https://github.com/UnknownHacker1/rea-groundtruth (python scripts/run_repro.py <rea>)

variant     windows  handlers  channels  verdict
plain             1         1         1  ok
namespace         1         1         1  ok
webpack           1         1         1  ok      (main: 0 0 0)
interop           0         0         0  MISSED  (n.n form, follow up)

real apps, installed windows builds, --integrity-policy record-and-continue, same base commit with and without this:

main this PR

MongoDB Compass 1.43.4, browser_windows 0 1

MongoDB Compass 1.43.4, ipc.operations 26 31

Compass normalized result size 205.9 MB 206.1 MB
Discord is unresolved on purpose: it ships require-in-the-middle, which reads the whole module cache through __webpack_require__.c and writes into entries with runtime keys, so what n(91288) returns cant be proven
Remaining proof gaps:
- compass still has explicit_web_preferences: 0 because its window options are built before the call (new s.BrowserWindow(u)), separate thing
- the older wrapper-substitution path on main still reports ipc for a lot of the tampered shapes above. thats not from this PR so i didnt touch it, the tests only check that nothing direct comes out of the new path
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

	main	this PR
MongoDB Compass 1.43.4, browser_windows	0	1
MongoDB Compass 1.43.4, ipc.operations	26	31
Compass normalized result size	205.9 MB	206.1 MB

Validation performed

npm run test:local -- <all 57 files in src/domain/javascript/*.test.ts>: 1313 passed
npx tsc --noEmit: pass
npm run lint: 0 errors, no warnings in touched files
npm run verify:test-discovery: all test files discovered once
pre-commit and pre-push hooks pass
npm run build then node scripts/rea.mjs analyze-javascript-application ... on the fixtures, Discord and Compass (numbers above). single cold runs, timing looked the same within noise. didnt measure memory or tokens

Compatibility, safety, and release

Breaking changes or migration steps: none
Real Hopper/Ghidra, browser, or OS coverage: windows 11 x64, node 22.22.3 (in the engines range, not the pinned 24.18.0). source checkout used the published 6.4.0 native/windows/build, not committed. no native provider involved
Package or release metadata impact: none
Security, privacy, process, or containment review: static parsing only, nothing gets executed

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2948 **Author:** [@UnknownHacker1](https://github.com/UnknownHacker1) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/electron-webpack-externals` --- ### 📝 Commits (4) - [`88bfa85`](https://github.com/morluto/rea/commit/88bfa85deb3475fb52b5cc168a2a87064b906d44) fix(javascript): follow Electron through Webpack bootstrap externals - [`4b7e2d6`](https://github.com/morluto/rea/commit/4b7e2d601ab48df91983541b51bfbbfbf99aabf5) fix(javascript): close remaining bootstrap proof gaps from review - [`e4e270f`](https://github.com/morluto/rea/commit/e4e270f0c620c682b6ac414d77ec9c18098d4d6c) fix(javascript): require a dispatched return and resolve constant slot keys - [`800ac03`](https://github.com/morluto/rea/commit/800ac035704c8b8e4f894cf8bfe62e87abdbf515) Merge remote-tracking branch 'origin/main' into sweep/2948 ### 📄 Description ## Summary Refs #2932. if an electron app's main process is bundled with webpack, electron gets loaded through the bundle's module table (`45840: e => { e.exports = require("electron") }`) and then `n(45840)` everywhere, never a direct `require("electron")`. electron identity only knew the direct require so it just saw nothing. BrowserWindow, webPreferences, ipc handlers on the module, all 0. this lets a loader call count as the require it re-exports, but only when the bootstrap can be proven intact. ## Problem and expected behavior smallest case (normal webpack 5 `target: "electron-main"` shape): ```js (()=>{var m={45840:e=>{"use strict";e.exports=require("electron")},100:(e,t,n)=>{"use strict";const s=n(45840);new s.BrowserWindow({webPreferences:{preload:"./preload.js"}});s.ipcMain.handle("get-connections",async()=>[])}},c={};function n(t){var r=c[t];if(void 0!==r)return r.exports;var o=c[t]={exports:{}};return m[t](o,o.exports,n),o.exports}n(100)})(); ``` main gives `browser_windows: []`. should be one window with `preload_path: "./preload.js"` plus the `get-connections` handler, which is what you get now. ## Change and scope new `semanticBundledRequireOrigin` reuses `javascriptBootstrapAt` for the bootstrap shape, and `proveJavaScriptBootstrapIntegrity` checks the rest. `n(KEY)` only resolves when all of this holds: - `n` is the bootstrap loader (never reassigned) or a factory's 3rd param that the bootstrap passes the loader as - the loader's key param is never reassigned and the dispatch runs unconditionally - every `return` in the loader is the dispatched module's `.exports` (after the dispatch) or the cache entry the loader made for it - the module object is a plain literal and only reaches the dispatch, `.exports` reads and writes to other members - the cache starts as `{}` - the table only has literal keys and is only touched by the dispatch or the runtime's `n.m = table` exposure. same for the cache with `n.c`. `n.m`/`n.c` can only be assigned or indexed, a literal key write through them drops that slot, and writing into an entry drops the proof - the factory at `KEY` is a plain function (not generator/async/getter, no duplicate params) whose whole body is `module.exports = require("x")` only electron identity uses it (`rootExport` and `bindingOrigin`). other `semanticRequireOrigin` users are unchanged. the member chain walk moved into `semanticMemberChain` so both resolvers share it. not in here: - the `n.n()` default interop getter form (`a = n.n(n(45840)); a().ipcMain`). separate follow up - dynamic key writes through `n.m[k]` are left alone. thats chunk install adding its own ids, refusing those would turn this off for pretty much every chunked bundle ## Contract and boundary impact - Semantic owner and earliest changed stage: electron identity in `indexJavaScriptElectronIdentitySteps`. bootstrap shape still owned by `javascriptBootstrapAt` - Contribution scope fit and linked maintainer decision: not applicable, static analysis fix - CLI and MCP/tool-catalog contract: none, same fields just more findings - Provider, bridge, target-format, or platform compatibility: none - Evidence, artifact, provenance, or reconstruction contract: calls through a proven loader are direct observations now. one existing test that reached `electron` through `load(2)` gets no `resolution_basis` instead of `"wrapper-substitution"` (same api key, members, world). thats what the same call through `require("electron")` gives too - Target selection, authority, upstream behavior, and cleanup details: not applicable - Generated metadata, package, or installation impact: none - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `electronBundledRequireIdentity.test.ts`. 3 positive shapes, 4 real world loader shapes that have to keep working (try/finally cache delete like compass, `n.c = cache`, chunk install through `n.m`, `module.loaded = !0` before the return), and 24 tampered or wrong shapes that have to stay unresolved (replaced loader, generator/async factory, loader returning something else, table slot replaced directly / through an alias / through `n.m`, planted cache entry, computed table keys, shadowed require, etc). `electronWrappedCallPaths.test.ts` has the one updated expectation above - Base reproduction: the positive cases fail on main. the tamper cases fail on the earlier pushes of this PR and pass now - fixture repo with a one command repro: https://github.com/UnknownHacker1/rea-groundtruth (`python scripts/run_repro.py <rea>`) ``` variant windows handlers channels verdict plain 1 1 1 ok namespace 1 1 1 ok webpack 1 1 1 ok (main: 0 0 0) interop 0 0 0 MISSED (n.n form, follow up) ``` - real apps, installed windows builds, `--integrity-policy record-and-continue`, same base commit with and without this: | | main | this PR | |---|---|---| | MongoDB Compass 1.43.4, browser_windows | 0 | 1 | | MongoDB Compass 1.43.4, ipc.operations | 26 | 31 | | Compass normalized result size | 205.9 MB | 206.1 MB | - Discord is unresolved on purpose: it ships require-in-the-middle, which reads the whole module cache through `__webpack_require__.c` and writes into entries with runtime keys, so what `n(91288)` returns cant be proven - Remaining proof gaps: - compass still has `explicit_web_preferences: 0` because its window options are built before the call (`new s.BrowserWindow(u)`), separate thing - the older wrapper-substitution path on main still reports ipc for a lot of the tampered shapes above. thats not from this PR so i didnt touch it, the tests only check that nothing direct comes out of the new path - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:local -- <all 57 files in src/domain/javascript/*.test.ts>`: 1313 passed - `npx tsc --noEmit`: pass - `npm run lint`: 0 errors, no warnings in touched files - `npm run verify:test-discovery`: all test files discovered once - pre-commit and pre-push hooks pass - `npm run build` then `node scripts/rea.mjs analyze-javascript-application ...` on the fixtures, Discord and Compass (numbers above). single cold runs, timing looked the same within noise. didnt measure memory or tokens ## Compatibility, safety, and release - Breaking changes or migration steps: none - Real Hopper/Ghidra, browser, or OS coverage: windows 11 x64, node 22.22.3 (in the engines range, not the pinned 24.18.0). source checkout used the published 6.4.0 `native/windows/build`, not committed. no native provider involved - Package or release metadata impact: none - Security, privacy, process, or containment review: static parsing only, nothing gets executed ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:07:13 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:11:00 +00:00

[GH-ISSUE #5653] [Tracker] New issue intake by area (October 2026) #3423

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5512

No description provided.

Rows
Columns