[GH-ISSUE #1848] [Feature] Prioritize caller-selected JavaScript sources before unrelated application analysis #623

New issue

Closed

opened 2026-10-15 18:26:43 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:26:43 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1848

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction.

Current limitation

Whole-application analysis of a 27,477,966-byte ASAR can reach the 300,000-ms provider timeout before the main-process source relevant to the selected question becomes useful. Requesting summary output does not by itself bound the underlying analysis workload.

Use cases

An analyst asks about one entry module or source subtree in a packaged application containing large unrelated vendor libraries.

Desired outcome and success criteria

Respect a caller-selected source/entry scope at the producing analysis boundary.
Obtain useful evidence for that scope before unrelated whole-application work.
Preserve target identity and distinguish selected-scope coverage from application completeness.
Verify progress, completion/cancellation, and time to useful evidence through the public CLI/MCP workflows.

Authority boundaries and non-goals

Static source analysis only; no application execution, implicit fetching, target modification, silent result truncation or arbitrary concurrency increase.

Alternatives considered

Summary output reduces delivered representation but may still compute the full application. Increasing timeouts alone does not establish improved evidence access.

Possible direction

Inspect existing source-selection/recovery contracts first; reuse a bounded selection mechanism rather than introducing a parallel analysis representation. Related: #1065.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1848 ### Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction. ### Current limitation Whole-application analysis of a 27,477,966-byte ASAR can reach the 300,000-ms provider timeout before the main-process source relevant to the selected question becomes useful. Requesting summary output does not by itself bound the underlying analysis workload. ### Use cases An analyst asks about one entry module or source subtree in a packaged application containing large unrelated vendor libraries. ### Desired outcome and success criteria - Respect a caller-selected source/entry scope at the producing analysis boundary. - Obtain useful evidence for that scope before unrelated whole-application work. - Preserve target identity and distinguish selected-scope coverage from application completeness. - Verify progress, completion/cancellation, and time to useful evidence through the public CLI/MCP workflows. ### Authority boundaries and non-goals Static source analysis only; no application execution, implicit fetching, target modification, silent result truncation or arbitrary concurrency increase. ### Alternatives considered Summary output reduces delivered representation but may still compute the full application. Increasing timeouts alone does not establish improved evidence access. ### Possible direction Inspect existing source-selection/recovery contracts first; reuse a bounded selection mechanism rather than introducing a parallel analysis representation. Related: #1065.

bsakaguchi

2026-10-15 18:26:43 +00:00

closed this issue
added the
performance

P1: high

area: evidence

triage

enhancement
labels

bsakaguchi commented

2026-10-15 18:26:44 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 11, 2026):

Root cause confirmed at 12ee785e5: the public request only exposes format, integrity and analyzer resource controls; JavaScriptArtifactReconstruction acquires every relevant file text before the shared worker loop. Summary delivery happens after that producing work.

The prepared fix accepts exact inventory source_paths before text acquisition, stream-verifies omitted bytes, prioritizes selected sources in first-request order, and preserves caller scope in canonical Evidence and summaries. Unselected sources remain explicit unknowns with partial application coverage. Known unavailable bytes and invalid paths retain separate typed diagnostics.

120 focused tests, full static checks, documentation checks and 866-file discovery passed. Real released-ASAR CLI/MCP verification preserves full target identity, selected-source evidence and complete normalized parity. Application code was not executed, and source selection does not claim whole-application completeness.

@N0zoM1z0 commented on GitHub (Oct 11, 2026): Root cause confirmed at `12ee785e5`: the public request only exposes format, integrity and analyzer resource controls; `JavaScriptArtifactReconstruction` acquires every relevant file text before the shared worker loop. Summary delivery happens after that producing work. The prepared fix accepts exact inventory `source_paths` before text acquisition, stream-verifies omitted bytes, prioritizes selected sources in first-request order, and preserves caller scope in canonical Evidence and summaries. Unselected sources remain explicit unknowns with partial application coverage. Known unavailable bytes and invalid paths retain separate typed diagnostics. 120 focused tests, full static checks, documentation checks and 866-file discovery passed. Real released-ASAR CLI/MCP verification preserves full target identity, selected-source evidence and complete normalized parity. Application code was not executed, and source selection does not claim whole-application completeness.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:14:46 +00:00

[PR #646] [MERGED] fix(javascript): hash graph and evidence JSON incrementally #2137

bsakaguchi referenced this issue

2026-10-17 21:07:37 +00:00

[PR #994] [MERGED] perf(domain): batch canonical digest writes with bounded buffer #2563

bsakaguchi referenced this issue

2026-10-17 21:07:47 +00:00

[PR #1008] [MERGED] fix(javascript): report application analysis progress on the CLI #2575