[PR #5391] feat(desktop): add Windows investigation app #6918

Open
opened 2026-11-01 21:44:03 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5391
Author: @StrategicDev
Created: 10/20/2026
Status: 🔄 Open

Base: main ← Head: strategicdev-windows-gui


📝 Commits (1)

  • 5d9c741 feat(desktop): add Windows investigation app

📊 Changes

11 files changed (+9522 additions, -3410 deletions)

View changed files

📝 .gitignore (+1 -0)
➕ DESIGN.md (+24 -0)
➕ PRODUCT.md (+45 -0)
📝 README.md (+24 -0)
➕ desktop-app/index.html (+167 -0)
➕ desktop-app/main.cjs (+275 -0)
➕ desktop-app/preload.cjs (+15 -0)
➕ desktop-app/renderer.js (+168 -0)
➕ desktop-app/styles.css (+49 -0)
📝 package-lock.json (+8713 -3410)
📝 package.json (+41 -0)

📄 Description

Summary

Adds a Windows-first Electron desktop workflow so users can select a local reverse-engineering target, run the existing REA analysis routes, inspect progress/evidence, and create a separate clean-room rebuild workspace.

Problem and expected behavior

REA previously had no integrated Windows GUI or packaged desktop workflow. The new app provides target selection, provider readiness, reversal progress and explicit rebuild handoff while preserving the existing CLI/MCP analysis contracts. Windows .cmd launchers are invoked through cmd.exe /d /c call so packaged analysis does not fail with spawn EINVAL.

Change and scope

  • Adds a focused Electron investigation desk under desktop-app/ with secure preload IPC, target selection, progress/error states, provider status, settings, and rebuild actions.
  • Routes JavaScript/Electron targets to analyze-javascript-application and native targets to the existing Ghidra-backed analyze command.
  • Generates an independently authored clean-room rebuild scaffold containing the retained investigation report, README guardrails, package metadata, and source entry point; it does not copy target source, assets, or identifiers.
  • Adds Electron/electron-builder scripts and x64 NSIS packaging configuration.
  • Documents the workflow and configured Ghidra launcher path.
  • Excludes generated release/ binaries from version control.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block
integration. Draft PRs may leave the scope decision pending and the readiness and merge checklists
unchecked. Maintainers can help resolve open questions.

Contract and boundary impact

  • Semantic owner and earliest changed stage: Desktop adapter; existing REA CLI/application workflows remain owners of analysis semantics.
  • Contribution scope fit and linked maintainer decision: Ordinary desktop usability and packaging change within existing provider boundaries; maintainer decision not applicable.
  • CLI and MCP/tool-catalog contract: No CLI or MCP contract changes; the desktop shell invokes existing published CLI commands.
  • Provider, bridge, target-format, or platform compatibility: Adds Windows Electron 39 packaging; uses the configured D:\\Ghirdra\\ghirdra\\ghidraRun.bat launcher and existing Ghidra provider.
  • Evidence, artifact, provenance, or reconstruction contract: Retains the analysis report as evidence and labels the generated project as a clean-room scaffold; no source-identical reconstruction is performed.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): User-selected local targets only; no target upload or mutation; child CLI process is bounded by the existing REA workflow and timeout configuration.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): Adds Electron and electron-builder development dependencies plus desktop packaging metadata; generated installer output is ignored.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: No automated test files added; desktop entry points were syntax-checked and the repository fast checks were run.
  • Base reproduction or other evidence: On Windows, direct spawn('npx.cmd', ...) produced spawn EINVAL; the patched packaged workflow invokes the shim via cmd.exe /d /c call and starts successfully.
  • User-visible CLI/MCP output (if applicable): Not applicable; the desktop adapter consumes existing newline-delimited CLI JSON/progress output.
  • Remaining proof gaps: A full native Ghidra reversal of a large target was not completed; the existing provider timeout remains visible to the user. The packaged app uses npx and therefore requires a Node/npm installation available on the host.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • node --check desktop-app\\main.cjs — passed.
  • npm run check:fast — passed; typecheck and lint completed successfully.
  • npm run desktop:build — passed; generated the x64 NSIS installer release\\REA-Setup-6.7.0.exe.
  • Packaged executable smoke test — passed; release\\win-unpacked\\REA.exe started successfully.
  • JavaScript/Electron reversal fixture — passed in the earlier workflow validation with real REA CLI JSON/progress output.
  • git diff --check — passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: None to existing CLI/MCP interfaces. The desktop preview requires npm run desktop; packaged use requires the generated Windows installer and a usable Node/npm runtime for npx analysis.
  • Real Hopper/Ghidra, browser, or OS coverage: Ghidra launcher configuration is wired and native routing is implemented. Large-target native analysis previously returned the provider's explicit timeout; no claim of complete native reversal is made here.
  • Package or release metadata impact: Adds Electron 39 and electron-builder 26.0.12 development dependencies and NSIS packaging configuration. Installer artifacts remain local/ignored.
  • Security, privacy, process, or containment review: The app is local-only, uses context isolation and a preload bridge, passes only user-selected paths to the existing CLI, and does not upload targets or copy source/assets into rebuilds.

Author readiness

Human owner:

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5391 **Author:** [@StrategicDev](https://github.com/StrategicDev) **Created:** 10/20/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `strategicdev-windows-gui` --- ### 📝 Commits (1) - [`5d9c741`](https://github.com/morluto/rea/commit/5d9c7417d459451797a6c1a2a733ef7b956b7a7e) feat(desktop): add Windows investigation app ### 📊 Changes **11 files changed** (+9522 additions, -3410 deletions) <details> <summary>View changed files</summary> 📝 `.gitignore` (+1 -0) ➕ `DESIGN.md` (+24 -0) ➕ `PRODUCT.md` (+45 -0) 📝 `README.md` (+24 -0) ➕ `desktop-app/index.html` (+167 -0) ➕ `desktop-app/main.cjs` (+275 -0) ➕ `desktop-app/preload.cjs` (+15 -0) ➕ `desktop-app/renderer.js` (+168 -0) ➕ `desktop-app/styles.css` (+49 -0) 📝 `package-lock.json` (+8713 -3410) 📝 `package.json` (+41 -0) </details> ### 📄 Description <!-- PR title: type(optional-scope): imperative outcome The title becomes the squash-merge commit subject and generated changelog entry. --> ## Summary Adds a Windows-first Electron desktop workflow so users can select a local reverse-engineering target, run the existing REA analysis routes, inspect progress/evidence, and create a separate clean-room rebuild workspace. ## Problem and expected behavior REA previously had no integrated Windows GUI or packaged desktop workflow. The new app provides target selection, provider readiness, reversal progress and explicit rebuild handoff while preserving the existing CLI/MCP analysis contracts. Windows `.cmd` launchers are invoked through `cmd.exe /d /c call` so packaged analysis does not fail with `spawn EINVAL`. ## Change and scope - Adds a focused Electron investigation desk under `desktop-app/` with secure preload IPC, target selection, progress/error states, provider status, settings, and rebuild actions. - Routes JavaScript/Electron targets to `analyze-javascript-application` and native targets to the existing Ghidra-backed `analyze` command. - Generates an independently authored clean-room rebuild scaffold containing the retained investigation report, README guardrails, package metadata, and source entry point; it does not copy target source, assets, or identifiers. - Adds Electron/electron-builder scripts and x64 NSIS packaging configuration. - Documents the workflow and configured Ghidra launcher path. - Excludes generated `release/` binaries from version control. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Unresolved scope, authority, side effects, or required verification block integration. Draft PRs may leave the scope decision pending and the readiness and merge checklists unchecked. Maintainers can help resolve open questions. ## Contract and boundary impact - Semantic owner and earliest changed stage: Desktop adapter; existing REA CLI/application workflows remain owners of analysis semantics. - Contribution scope fit and linked maintainer decision: Ordinary desktop usability and packaging change within existing provider boundaries; maintainer decision not applicable. - CLI and MCP/tool-catalog contract: No CLI or MCP contract changes; the desktop shell invokes existing published CLI commands. - Provider, bridge, target-format, or platform compatibility: Adds Windows Electron 39 packaging; uses the configured `D:\\Ghirdra\\ghirdra\\ghidraRun.bat` launcher and existing Ghidra provider. - Evidence, artifact, provenance, or reconstruction contract: Retains the analysis report as evidence and labels the generated project as a clean-room scaffold; no source-identical reconstruction is performed. - Target selection, authority, upstream behavior, and cleanup details (if applicable): User-selected local targets only; no target upload or mutation; child CLI process is bounded by the existing REA workflow and timeout configuration. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): Adds Electron and electron-builder development dependencies plus desktop packaging metadata; generated installer output is ignored. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: No automated test files added; desktop entry points were syntax-checked and the repository fast checks were run. - Base reproduction or other evidence: On Windows, direct `spawn('npx.cmd', ...)` produced `spawn EINVAL`; the patched packaged workflow invokes the shim via `cmd.exe /d /c call` and starts successfully. - User-visible CLI/MCP output (if applicable): Not applicable; the desktop adapter consumes existing newline-delimited CLI JSON/progress output. - Remaining proof gaps: A full native Ghidra reversal of a large target was not completed; the existing provider timeout remains visible to the user. The packaged app uses `npx` and therefore requires a Node/npm installation available on the host. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `node --check desktop-app\\main.cjs` — passed. - `npm run check:fast` — passed; typecheck and lint completed successfully. - `npm run desktop:build` — passed; generated the x64 NSIS installer `release\\REA-Setup-6.7.0.exe`. - Packaged executable smoke test — passed; `release\\win-unpacked\\REA.exe` started successfully. - JavaScript/Electron reversal fixture — passed in the earlier workflow validation with real REA CLI JSON/progress output. - `git diff --check` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: None to existing CLI/MCP interfaces. The desktop preview requires `npm run desktop`; packaged use requires the generated Windows installer and a usable Node/npm runtime for `npx` analysis. - Real Hopper/Ghidra, browser, or OS coverage: Ghidra launcher configuration is wired and native routing is implemented. Large-target native analysis previously returned the provider's explicit timeout; no claim of complete native reversal is made here. - Package or release metadata impact: Adds Electron 39 and electron-builder 26.0.12 development dependencies and NSIS packaging configuration. Installer artifacts remain local/ignored. - Security, privacy, process, or containment review: The app is local-only, uses context isolation and a preload bridge, passes only user-selected paths to the existing CLI, and does not upload targets or copy source/assets into rebuilds. ## Author readiness Human owner: <!-- @GitHub-handle --> - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6918
No description provided.