morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7252] [MERGED] docs(skill): route SPA passive capture through allowed_origins #7749

New issue

Closed

opened 2026-11-03 13:40:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:40:07 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7252
Author: @BeqaKs
Created: 10/26/2026
Status: ✅ Merged
Merged: 11/4/2026
Merged by: @morluto

Base: main ← Head: fix/docs-skill-spa-passive-capture-origins

📝 Commits (1)

2180da3 docs(skill): route SPA passive capture through allowed_origins

📊 Changes

2 files changed (+11 additions, -2 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+10 -1)
📝 src/generatedPackageMetadata.ts (+1 -1)

📄 Description

Summary

Teach the agent skill that passive SPA capture defaults to the page origin, so cross-origin data APIs need allowed_origins (page origin plus API origins) and a completeness.excluded check before claiming absence.
Discover API origins from absolute URLs in loaded bundles or script text via JavaScript analysis tools; do not rely on another passive capture without those origins.
Bump the packaged skill metadata to version 50.

Fixes #7251

Problem and expected behavior

Agents following the skill for SPA traffic mapping can treat a default-scope capture as complete and miss backend APIs on other origins.

Change and scope

Skill routing docs only; no runtime change. Maintainer scope decision not applicable.

Contract and boundary impact

Generated metadata: src/generatedPackageMetadata.ts skillVersion 50
CLI/MCP: none

Expected effects:

Documentation or usability only; no target interaction.

Evidence and regression coverage

Aligns with docs/browser-observation.md page-origin default.
Issue #7251 recorded a 339-request disallowed_origin exclusion on a SaaS dashboard capture.

Validation performed

Reviewed the routing bullet against the existing browser routing list and Greptile review notes (probe cannot reveal origins; API-only allowed_origins refuses capture).
npm run metadata:generate (version 50 bump commit)
npm run check:fast after the wording clarification (typecheck + lint)

Author readiness

Human owner: @BeqaKs

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7252 **Author:** [@BeqaKs](https://github.com/BeqaKs) **Created:** 10/26/2026 **Status:** ✅ Merged **Merged:** 11/4/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/docs-skill-spa-passive-capture-origins` --- ### 📝 Commits (1) - [`2180da3`](https://github.com/morluto/rea/commit/2180da37e83cde59b744f30ed17f6077a9c87da6) docs(skill): route SPA passive capture through allowed_origins ### 📊 Changes **2 files changed** (+11 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+10 -1) 📝 `src/generatedPackageMetadata.ts` (+1 -1) </details> ### 📄 Description ## Summary - Teach the agent skill that passive SPA capture defaults to the page origin, so cross-origin data APIs need `allowed_origins` (page origin plus API origins) and a `completeness.excluded` check before claiming absence. - Discover API origins from absolute URLs in loaded bundles or script text via JavaScript analysis tools; do not rely on another passive capture without those origins. - Bump the packaged skill metadata to version 50. Fixes #7251 ## Problem and expected behavior Agents following the skill for SPA traffic mapping can treat a default-scope capture as complete and miss backend APIs on other origins. ## Change and scope Skill routing docs only; no runtime change. Maintainer scope decision not applicable. ## Contract and boundary impact - Generated metadata: `src/generatedPackageMetadata.ts` skillVersion `50` - CLI/MCP: none Expected effects: - [x] Documentation or usability only; no target interaction. ## Evidence and regression coverage - Aligns with `docs/browser-observation.md` page-origin default. - Issue #7251 recorded a 339-request `disallowed_origin` exclusion on a SaaS dashboard capture. ## Validation performed - Reviewed the routing bullet against the existing browser routing list and Greptile review notes (probe cannot reveal origins; API-only `allowed_origins` refuses capture). - `npm run metadata:generate` (version 50 bump commit) - `npm run check:fast` after the wording clarification (typecheck + lint) ## Author readiness Human owner: @BeqaKs - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-11-03 13:40:07 +00:00

bsakaguchi changed title from ~~[PR #7252] docs(skill): route SPA passive capture through allowed_origins~~ to [PR #7252] [MERGED] docs(skill): route SPA passive capture through allowed_origins

2026-11-05 01:47:38 +00:00

bsakaguchi closed this issue

2026-11-05 01:47:38 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7749

No description provided.

Rows
Columns