[PR #5029] [MERGED] feat(cli): accept JavaScript source selections from a JSON array or file #6745

New issue

Closed

opened 2026-11-01 21:42:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:42:46 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5029
Author: @KJLavender
Created: 10/18/2026
Status: ✅ Merged
Merged: 10/24/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/js-source-paths-file

📝 Commits (7)

cc5f6e6 feat(cli): accept JavaScript source selections from a JSON array or file
18d928e fix(cli): cancel --source-paths-json file reads with the command
49f2bbf Merge origin/main into feat/js-source-paths-file
68ab40f chore: integrate JavaScript source selection with current CLI delivery
e886393 test(cli): preserve ASAR identity for JSON file selections
6735a26 chore: integrate main after source-selection measurements
0510cf0 docs(cli): record source-selection task costs and identity verification

📊 Changes

9 files changed (+352 additions, -16 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/javascript-applications.md (+4 -3)
📝 docs/javascript-artifact-reconstruction.md (+14 -2)
➕ docs/verification/javascript-source-paths-json-2026-10-24.md (+86 -0)
📝 src/cli/coreBinaryCommands.ts (+21 -8)
📝 src/cli/electronCommands.ts (+12 -3)
📝 src/cli/javascriptApplicationAnalysis.ts (+40 -0)
📝 src/cliObservationOptions.ts (+7 -0)
📝 tests/acceptance/applications/javascriptSourceSelectionCli.test.ts (+129 -0)
📝 tests/boundary/filesystem/cliJsonInput.test.ts (+39 -0)

📄 Description

Related to #4987.

Adds --source-paths-json to analyze and analyze-javascript-application: one inline JSON array or local JSON file appends exact inventoried paths after repeated --source-path entries. Ordering, duplicate requests, the original ASAR identity and the existing application/MCP source_paths contract are preserved. Folder/glob selection remains separate (#5048).

The adapter reuses the shared JSON reader and domain schema, preserving cancellation and file ownership. Main integration retains delivery validation, summary/view choices, environment selection and JavaScript worker cleanup. The native lane refuses the option before starting an analysis engine; selected application code is not executed.

Validation:

58 checks pass on main cd10ee1f integration: public CLI, actual SDK source selection, JSON-file errors, active cancellation, process status and route/delivery behavior. Full npm run check, npm run docs:check and test discovery pass. The file-input case verifies the original ASAR path/SHA-256; inline input covers a directory, and both retain the requested combined order.
Six completed CLI tasks select the same 210 JavaScript files plus package.json from a generated 75,620-byte ASAR. All complete Evidence objects, IDs, provenance, uncertainty and choices match exactly. Every result retains all 210 expected named functions; the archive digest stays unchanged.
With an existing selection file, displayed invocation length is 17,977 → 201 characters. Whole estimated stdout + invocation tokens are 1,866,487 → 1,861,471; the Evidence output itself remains 1,861,409 tokens. Creating the JSON file first adds about 4,411 payload tokens plus unmeasured write-call costs, so the shorter invocation does not establish a net saving for that workflow.
Elapsed medians 19.149 → 18.389 s, CPU 18.250 → 17.340 s and sampled family RSS 601.4 → 594.1 MiB have overlapping ranges; no general speedup is claimed. Measurements use fresh Linux CLI/worker processes and a shared host. Windows Cmd.exe behavior is inferred from Microsoft's documented 8,191-character limit; Windows execution is unverified.

Verification report pins revisions, the artifact digest, whole-task scope and estimator/sampling limits. Current-head CI is pending; later upstream changes are outside the pinned timings.

Latest CI attribution: the two native metadata failures reproduce identically on exact main/CI trees. A third MCP recovery check reports zero parent-result budget in CI; it passes on both exact trees locally and its entire execution path is unchanged by this CLI-only feature. Portable/required failures repeat or aggregate those results; cancelled coverage is unverified. All 21 focused option/cancellation/MCP-selection checks passed on the actual CI merge. Unrelated failures are bypassed under maintainer authorization; CI is not reported green.

Author readiness

Human owner: @KJLavender

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5029 **Author:** [@KJLavender](https://github.com/KJLavender) **Created:** 10/18/2026 **Status:** ✅ Merged **Merged:** 10/24/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/js-source-paths-file` --- ### 📝 Commits (7) - [`cc5f6e6`](https://github.com/morluto/rea/commit/cc5f6e656c80dccabbd41873053b87f4086b07c7) feat(cli): accept JavaScript source selections from a JSON array or file - [`18d928e`](https://github.com/morluto/rea/commit/18d928e23b46cd8a32d6f5e726682c0346f8d637) fix(cli): cancel --source-paths-json file reads with the command - [`49f2bbf`](https://github.com/morluto/rea/commit/49f2bbff9e1ca1a58d55f4ddf6d6f51269c6a548) Merge origin/main into feat/js-source-paths-file - [`68ab40f`](https://github.com/morluto/rea/commit/68ab40fb65253dee546e363d6323e7582464f00c) chore: integrate JavaScript source selection with current CLI delivery - [`e886393`](https://github.com/morluto/rea/commit/e886393ae698d4ed411179430c8dbb10ce6c5647) test(cli): preserve ASAR identity for JSON file selections - [`6735a26`](https://github.com/morluto/rea/commit/6735a26bb9b9ae1d3ed616f0644cf34ca311946d) chore: integrate main after source-selection measurements - [`0510cf0`](https://github.com/morluto/rea/commit/0510cf0ec6df1dca23addd2453f8171e21882bd3) docs(cli): record source-selection task costs and identity verification ### 📊 Changes **9 files changed** (+352 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/javascript-applications.md` (+4 -3) 📝 `docs/javascript-artifact-reconstruction.md` (+14 -2) ➕ `docs/verification/javascript-source-paths-json-2026-10-24.md` (+86 -0) 📝 `src/cli/coreBinaryCommands.ts` (+21 -8) 📝 `src/cli/electronCommands.ts` (+12 -3) 📝 `src/cli/javascriptApplicationAnalysis.ts` (+40 -0) 📝 `src/cliObservationOptions.ts` (+7 -0) 📝 `tests/acceptance/applications/javascriptSourceSelectionCli.test.ts` (+129 -0) 📝 `tests/boundary/filesystem/cliJsonInput.test.ts` (+39 -0) </details> ### 📄 Description Related to #4987. Adds `--source-paths-json` to `analyze` and `analyze-javascript-application`: one inline JSON array or local JSON file appends exact inventoried paths after repeated `--source-path` entries. Ordering, duplicate requests, the original ASAR identity and the existing application/MCP `source_paths` contract are preserved. Folder/glob selection remains separate (#5048). The adapter reuses the shared JSON reader and domain schema, preserving cancellation and file ownership. Main integration retains delivery validation, summary/view choices, environment selection and JavaScript worker cleanup. The native lane refuses the option before starting an analysis engine; selected application code is not executed. Validation: - **58 checks pass** on main `cd10ee1f` integration: public CLI, actual SDK source selection, JSON-file errors, active cancellation, process status and route/delivery behavior. Full `npm run check`, `npm run docs:check` and test discovery pass. The file-input case verifies the original ASAR path/SHA-256; inline input covers a directory, and both retain the requested combined order. - **Six completed CLI tasks** select the same 210 JavaScript files plus `package.json` from a generated 75,620-byte ASAR. All complete Evidence objects, IDs, provenance, uncertainty and choices match exactly. Every result retains all 210 expected named functions; the archive digest stays unchanged. - With an existing selection file, displayed invocation length is **17,977 → 201 characters**. Whole estimated stdout + invocation tokens are 1,866,487 → 1,861,471; the Evidence output itself remains 1,861,409 tokens. Creating the JSON file first adds about 4,411 payload tokens plus unmeasured write-call costs, so the shorter invocation does not establish a net saving for that workflow. - Elapsed medians 19.149 → 18.389 s, CPU 18.250 → 17.340 s and sampled family RSS 601.4 → 594.1 MiB have overlapping ranges; no general speedup is claimed. Measurements use fresh Linux CLI/worker processes and a shared host. Windows Cmd.exe behavior is inferred from Microsoft's documented 8,191-character limit; Windows execution is unverified. [Verification report](https://github.com/KJLavender/rea/blob/0510cf0ec6df1dca23addd2453f8171e21882bd3/docs/verification/javascript-source-paths-json-2026-10-24.md) pins revisions, the artifact digest, whole-task scope and estimator/sampling limits. Current-head CI is pending; later upstream changes are outside the pinned timings. Latest CI attribution: the two native metadata failures reproduce identically on exact main/CI trees. A third MCP recovery check reports zero parent-result budget in CI; it passes on both exact trees locally and its entire execution path is unchanged by this CLI-only feature. Portable/required failures repeat or aggregate those results; cancelled coverage is unverified. All 21 focused option/cancellation/MCP-selection checks passed on the actual CI merge. Unrelated failures are bypassed under maintainer authorization; CI is not reported green. ## Author readiness Human owner: @KJLavender - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:42:46 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6745

No description provided.

Rows
Columns