[PR #7210] feat(javascript): retain source-proven main-to-renderer IPC sends #7720

Open
opened 2026-11-03 13:39:53 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7210
Author: @frabcd
Created: 10/26/2026
Status: 🔄 Open

Base: main ← Head: codex/electron-main-transmissions


📝 Commits (1)

  • eef1244 feat(javascript): retain source-proven main-to-renderer IPC sends

📊 Changes

18 files changed (+897 additions, -101 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+20 -0)
📝 src/application/javascript/ElectronBoundaryAnalysis.ts (+3 -0)
📝 src/application/javascript/ElectronBoundaryGraphIpc.ts (+10 -0)
📝 src/contracts/javascript/javascriptExportShapeComparisonExample.ts (+1 -0)
📝 src/contracts/javascript/javascriptRuntimeReconciliationExample.ts (+1 -0)
📝 src/domain/javascript/electronStaticAnalysisIpc.ts (+30 -21)
📝 src/domain/javascript/electronStaticAnalysisTypes.ts (+7 -0)
📝 src/domain/javascript/electronStaticReceiverAdmission.test.ts (+9 -0)
📝 src/domain/javascript/electronStaticRenderer.ts (+22 -68)
📝 src/domain/javascript/electronWrappedCallPaths.ts (+1 -2)
📝 src/domain/javascript/javascriptApplicationAnalysis.ts (+2 -0)
📝 src/domain/javascript/javascriptSemanticAnalysis.ts (+54 -0)
➕ src/domain/javascript/javascriptSemanticElectronReceiver.ts (+146 -0)
➕ src/domain/javascript/javascriptSemanticElectronReceivers.test.ts (+259 -0)
📝 src/domain/javascript/javascriptSemanticMemberMutations.ts (+54 -8)
📝 src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.test.ts (+24 -0)
📝 src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.ts (+13 -2)
➕ tests/boundary/cli/electronMainTransmissions.test.ts (+241 -0)

📄 Description

Summary

Retain source-proven main-to-renderer Electron IPC sends in static application analysis. BrowserWindow.webContents.send/postMessage and webContents.mainFrame.send/postMessage previously disappeared while corresponding renderer listeners remained visible.

Problem and expected behavior

On base 1173c0a9, a directory containing two main sends and two renderer listeners reports only 2 IPC operations. The change retains all 4, with main_transmissions: 2, source ranges and destination allocation identity. This is a static syntax result, not proof of delivery.

Change and scope

The existing BrowserWindow allocation/mutation resolver admits the four supported receiver/method combinations. Its allocation proof is shared with the mutation producer: proven native messaging and existing loadFile/loadURL operations preserve receiver identity, while argument escapes and invalidated receivers retain conservative effects. Loading checks the delegated WebContents methods too. This prevents a preceding load or send from hiding later sends on the same window. Main sends require receiver provenance in both the domain type and worker transport. Summary and graph consumers use those facts; no second receiver parser or runtime probe is added.

Distinct window allocations retain distinct channel nodes. Same channel text does not pair a main send with an arbitrary renderer listener. Dynamic channels stay unresolved; replaced, shadowed and lookalike receivers are excluded.

Contract and boundary impact

  • Semantic owner: Electron static IPC analysis, using the existing BrowserWindow receiver owner. Consumers: worker transfer, application summary and graph.
  • Contribution scope: existing static JavaScript/Electron boundary; no provider or target-execution authority change. No linked issue: this omission was reproduced while checking existing Electron work; the webview/wrapper work in #2094 is separate.
  • CLI/MCP: existing analyze-javascript-application / analyze_javascript_application gain main send facts and summary.ipc.main_transmissions.
  • Compatibility: the new summary count is optional when reading retained Evidence. Historical absence remains unmeasured, not zero; current analysis emits the count.
  • Evidence: constructor location, receiver kind, call-site range, artifact identity and unknown delivery state survive projection.
  • Installation/package: no dependencies, setup behavior or release metadata changes. Generated catalogs and build outputs are not committed.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process. Existing internal analysis workers only.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Executed baseline: the six new public CLI/MCP cases fail for missing main sends; four existing scoped IPC controls pass. The later repeated-send regression also failed on the intermediate implementation in both transports (11 operations instead of 12). Producer regressions exposed receiver escape after native loading. On the final change, 1,156 tests pass across 24 files, covering the semantic producer, both public transports, application projection, worker schema validation and receiver admission.

Coverage includes load-then-repeated-send, aliases, webContents/mainFrame operations, two same-channel windows, existing renderer-to-main pairing, dynamic channels, fake/shadowed/modified receivers, delegated loading method replacement, mandatory worker provenance and historical count absence. Targets are inert fixtures; no fixture code is executed. Scoped independent review found the loading regression fixed with no remaining actionable issue.

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • Source Vitest run over 20 affected Electron/member-mutation/Map/builtin regression files — 1,125 passed, 46.30s.
  • npm run test:focused -- tests/boundary/cli/electronMainTransmissions.test.ts tests/boundary/cli/electronScopedIpc.test.ts src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.test.ts tests/boundary/filesystem/javascript-applications/electronApplicationAnalysis.test.ts — runtime build succeeded; 31 passed, 45.03s.
  • node scripts/rea.mjs analyze-javascript-application <fixture> --source-path main.cjs --source-path preload.cjs --format json — original two-send/two-listener fixture now reports operations: 4, main_transmissions: 2, renderer_listeners: 2; no speculative pairing.
  • npm run check — exit 0: typecheck, lint, formatting, Knip, metadata, module boundaries, architecture guards, reachability and typed lint. Typed lint reports 0 errors and 3,670 advisory warnings across 5,433 files; this is not a warning-free claim.
  • npm run docs:check — exit 0, including 9 README conformance tests.
  • npm run verify:test-discovery — all 2,498 test files discovered exactly once.
  • git diff --check — passed.

Windows x64, Node24.22.1, npm11.16.0, Vitest5.0.3. The locked Vite8.3.5 Rolldown native binding is blocked by Windows Application Control; its WASM backend cannot resolve the Windows source paths. Tests ran with Vitest's supported Vite7.3.7 peer in ignored local dependencies, using the repository's unchanged config. Manifests/lockfile and security controls were not modified. Exact locked Vite8 test execution remains unverified on this host.

Compatibility, safety, and release

No migration or target authority change. sendToFrame, event.reply, dynamically obtained WebContents and wrapper substitution beyond source-proven receivers remain unsupported by this pass. Receiving renderer identity, listener reachability and runtime delivery remain unverified. No real Electron GUI, Hopper, Ghidra or IDA session was exercised. This is not a performance improvement claim; agent tokens, CPU and process-family peak memory were not benchmarked.

Author readiness

Human owner: @frabcd

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • Human ownership and initial readiness declared.
  • CI and maintainer review completed; material scope questions resolved.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7210 **Author:** [@frabcd](https://github.com/frabcd) **Created:** 10/26/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/electron-main-transmissions` --- ### 📝 Commits (1) - [`eef1244`](https://github.com/morluto/rea/commit/eef1244b70276de074baa3fb1fcaf5acecd6c80b) feat(javascript): retain source-proven main-to-renderer IPC sends ### 📊 Changes **18 files changed** (+897 additions, -101 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+20 -0) 📝 `src/application/javascript/ElectronBoundaryAnalysis.ts` (+3 -0) 📝 `src/application/javascript/ElectronBoundaryGraphIpc.ts` (+10 -0) 📝 `src/contracts/javascript/javascriptExportShapeComparisonExample.ts` (+1 -0) 📝 `src/contracts/javascript/javascriptRuntimeReconciliationExample.ts` (+1 -0) 📝 `src/domain/javascript/electronStaticAnalysisIpc.ts` (+30 -21) 📝 `src/domain/javascript/electronStaticAnalysisTypes.ts` (+7 -0) 📝 `src/domain/javascript/electronStaticReceiverAdmission.test.ts` (+9 -0) 📝 `src/domain/javascript/electronStaticRenderer.ts` (+22 -68) 📝 `src/domain/javascript/electronWrappedCallPaths.ts` (+1 -2) 📝 `src/domain/javascript/javascriptApplicationAnalysis.ts` (+2 -0) 📝 `src/domain/javascript/javascriptSemanticAnalysis.ts` (+54 -0) ➕ `src/domain/javascript/javascriptSemanticElectronReceiver.ts` (+146 -0) ➕ `src/domain/javascript/javascriptSemanticElectronReceivers.test.ts` (+259 -0) 📝 `src/domain/javascript/javascriptSemanticMemberMutations.ts` (+54 -8) 📝 `src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.test.ts` (+24 -0) 📝 `src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.ts` (+13 -2) ➕ `tests/boundary/cli/electronMainTransmissions.test.ts` (+241 -0) </details> ### 📄 Description ## Summary Retain source-proven main-to-renderer Electron IPC sends in static application analysis. `BrowserWindow.webContents.send/postMessage` and `webContents.mainFrame.send/postMessage` previously disappeared while corresponding renderer listeners remained visible. ## Problem and expected behavior On base `1173c0a9`, a directory containing two main sends and two renderer listeners reports only **2 IPC operations**. The change retains all **4**, with `main_transmissions: 2`, source ranges and destination allocation identity. This is a static syntax result, not proof of delivery. ## Change and scope The existing BrowserWindow allocation/mutation resolver admits the four supported receiver/method combinations. Its allocation proof is shared with the mutation producer: proven native messaging and existing `loadFile`/`loadURL` operations preserve receiver identity, while argument escapes and invalidated receivers retain conservative effects. Loading checks the delegated WebContents methods too. This prevents a preceding load or send from hiding later sends on the same window. Main sends require receiver provenance in both the domain type and worker transport. Summary and graph consumers use those facts; no second receiver parser or runtime probe is added. Distinct window allocations retain distinct channel nodes. Same channel text does not pair a main send with an arbitrary renderer listener. Dynamic channels stay unresolved; replaced, shadowed and lookalike receivers are excluded. ## Contract and boundary impact - Semantic owner: Electron static IPC analysis, using the existing BrowserWindow receiver owner. Consumers: worker transfer, application summary and graph. - Contribution scope: existing static JavaScript/Electron boundary; no provider or target-execution authority change. No linked issue: this omission was reproduced while checking existing Electron work; the webview/wrapper work in #2094 is separate. - CLI/MCP: existing `analyze-javascript-application` / `analyze_javascript_application` gain main send facts and `summary.ipc.main_transmissions`. - Compatibility: the new summary count is optional when reading retained Evidence. Historical absence remains unmeasured, not zero; current analysis emits the count. - Evidence: constructor location, receiver kind, call-site range, artifact identity and unknown delivery state survive projection. - Installation/package: no dependencies, setup behavior or release metadata changes. Generated catalogs and build outputs are not committed. Expected effects: - [x] Read existing files or captured data. - [x] Launch or attach to a process. Existing internal analysis workers only. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage Executed baseline: the six new public CLI/MCP cases fail for missing main sends; four existing scoped IPC controls pass. The later repeated-send regression also failed on the intermediate implementation in both transports (11 operations instead of 12). Producer regressions exposed receiver escape after native loading. On the final change, **1,156 tests pass across 24 files**, covering the semantic producer, both public transports, application projection, worker schema validation and receiver admission. Coverage includes load-then-repeated-send, aliases, webContents/mainFrame operations, two same-channel windows, existing renderer-to-main pairing, dynamic channels, fake/shadowed/modified receivers, delegated loading method replacement, mandatory worker provenance and historical count absence. Targets are inert fixtures; no fixture code is executed. Scoped independent review found the loading regression fixed with no remaining actionable issue. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Source Vitest run over 20 affected Electron/member-mutation/Map/builtin regression files — **1,125 passed**, 46.30s. - `npm run test:focused -- tests/boundary/cli/electronMainTransmissions.test.ts tests/boundary/cli/electronScopedIpc.test.ts src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.test.ts tests/boundary/filesystem/javascript-applications/electronApplicationAnalysis.test.ts` — runtime build succeeded; **31 passed**, 45.03s. - `node scripts/rea.mjs analyze-javascript-application <fixture> --source-path main.cjs --source-path preload.cjs --format json` — original two-send/two-listener fixture now reports `operations: 4`, `main_transmissions: 2`, `renderer_listeners: 2`; no speculative pairing. - `npm run check` — exit 0: typecheck, lint, formatting, Knip, metadata, module boundaries, architecture guards, reachability and typed lint. Typed lint reports 0 errors and 3,670 advisory warnings across 5,433 files; this is not a warning-free claim. - `npm run docs:check` — exit 0, including 9 README conformance tests. - `npm run verify:test-discovery` — all 2,498 test files discovered exactly once. - `git diff --check` — passed. Windows x64, Node24.22.1, npm11.16.0, Vitest5.0.3. The locked Vite8.3.5 Rolldown native binding is blocked by Windows Application Control; its WASM backend cannot resolve the Windows source paths. Tests ran with Vitest's supported Vite7.3.7 peer in ignored local dependencies, using the repository's unchanged config. Manifests/lockfile and security controls were not modified. Exact locked Vite8 test execution remains unverified on this host. ## Compatibility, safety, and release No migration or target authority change. `sendToFrame`, `event.reply`, dynamically obtained WebContents and wrapper substitution beyond source-proven receivers remain unsupported by this pass. Receiving renderer identity, listener reachability and runtime delivery remain unverified. No real Electron GUI, Hopper, Ghidra or IDA session was exercised. This is not a performance improvement claim; agent tokens, CPU and process-family peak memory were not benchmarked. ## Author readiness Human owner: @frabcd - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] Human ownership and initial readiness declared. - [x] CI and maintainer review completed; material scope questions resolved. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7720
No description provided.