morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[PR #7259] [MERGED] feat(web): page retained bundle endpoint observations and inferences #7754

New issue

Closed

opened 2026-11-03 13:40:10 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:40:10 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7259
Author: @gensokyo-dev
Created: 10/26/2026
Status: ✅ Merged
Merged: 10/26/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/6198-web-bundle-paging

📝 Commits (4)

48d554e feat(browser): page retained web bundle endpoints and inferences
a92e07f fix(web): preserve provenance and bound retained bundle paging
dd853c5 test(web): verify retained bundle workflows with real browser assets
8f3203b test(web): own verifier commands and cover filtered continuation

📊 Changes

13 files changed (+2041 additions, -11 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/javascript-applications.md (+9 -0)
📝 docs/javascript-route-inventory.md (+36 -4)
➕ docs/verification/web-bundle-paging-2026-10-26.md (+138 -0)
➕ experiments/analysis-efficiency/web-bundle-paging.mjs (+382 -0)
📝 src/cli/browserCommands.ts (+2 -2)
📝 src/cli/javascriptRouteDelivery.ts (+7 -0)
📝 src/contracts/analysisViewToolContracts.ts (+17 -1)
📝 src/contracts/browserToolContracts.ts (+12 -3)
📝 src/domain/analysisView/analysisView.ts (+49 -0)
📝 src/domain/analysisView/javascriptRoutesView.ts (+5 -1)
➕ src/domain/analysisView/webBundleView.test.ts (+641 -0)
➕ src/domain/analysisView/webBundleView.ts (+395 -0)
➕ tests/boundary/mcp/webBundleViewsMcp.test.ts (+348 -0)

📄 Description

Summary

Fixes #6198. Completed analyze_web_bundle Evidence can now serve filtered, field-selected endpoint observations, inferences and summary counts through the shared CLI/MCP analysis-view workflow, without recapturing a browser or repeating analysis.

Builds on HarsH's #7213 (6b1d5d42), preserving original authorship. Pages keep parent identity, original collection indices, exact source coordinates/basis, producer partial status and structured script-scoped unknowns. Page exhaustion is independent of producer completeness. Complete Evidence remains exportable; indivisible oversized projections fail explicitly.

Contract and boundary impact

Owner: shared domain projection and existing authenticated Evidence reader; CLI/MCP reuse it. Unfiltered pages allocate only requested rows; filtered scans count all matches without materializing all selected rows. No new cache or provider.
Scope: read-only projection within existing capabilities; new target-execution/protection scope decision is not applicable. Existing analysis input choices and complete delivery remain available.
Additive web-bundle view, selected analysis delivery, exact selectors, original source_index, updated CLI/help and authored skill guidance. Historical omitted origins remain omitted; limitation counts cover the distinct full parent/report union before display bounding.
No package, installer, provider authority, target mutation, or lifecycle changes. Generated catalogs/skills remain ignored outputs.

Evidence and validation

38 distinct targeted domain/SDK tests passed across the focused runs (24 projection, 12 existing route, two SDK tests). The review follow-up reran all 24 projection and both SDK cases. Converted SDK output schemas, retained/inline/file sources, duplicate values at distinct locations, empty/intersected filters, partial versus exhausted coverage and byte limits are covered.
Three corrected regressions fail against the imported upstream production code; explicit-origin/null controls pass.
Real Chromium loaded pinned unmodified Miniflux JS assets: all four scripts analyzed, five low-confidence candidates retained. Public CLI selected analysis exported the complete parent; actual stdio SDK paging and both CLI collections reproduce parent facts. Published Swagger UI preset also preserves a real script-scoped AST unknown and partial status.
check:fast, verify:test-discovery, docs:check, docs:build and format:check passed.
Pinned inputs, reproduction, resource measurements and limitations. Two CPUs / 8 GiB family guard; no OOM. First-candidate selection reduces estimated model input from 20,083 to 16,248 BPE tokens for two equivalent queries including discovery. Small all-row paging costs more than full delivery; cold SDK schema compilation is slower. Estimates are not model billing; no generic speed/memory improvement is claimed.

Remaining coverage: Miniflux assets were served in a static capture harness, not a complete backend deployment; its zero endpoint-observation collection does not verify nonempty real endpoints (covered by the SDK fixture). No successful large real endpoint inventory is claimed; the main Swagger bundle hit its unchanged script deadline and retained partial Evidence. Non-browser OS/provider execution is outside this change.

Initial CI passed 29,174 tests with one unrelated ADB acceptance failure: process names retain trailing spaces/tabs while the existing fixture expects trimmed names. The same assertion fails in an isolated checkout of CI’s exact main parent f6805e29c3c74223660686b5ca979c0508e1b195 (test:focused -- tests/acceptance/applications/adbListingNumbers.test.ts). Initial CI evidence. No ADB code is changed here. Final-head CI reports 34,911 passing tests and the same ADB failure plus an unrelated packageCatalogVerification expectation failure. The latter reproduces on exact final CI main parent 662ec2e4501e975f2d1a28958a1ff560a9e24869. Final static CI also fails formatting of untouched scripts/verify-apk-signature.mjs; its blob is identical in that main and synthetic merge e10845b413179c6ff0625258f49a15d4fbbcbee3, and main alone fails the formatter. check:fast passes on that exact merge. Final CI evidence. Shard 6 was cancelled after emitting its ADB failure/report; dependent native/platform lanes skipped after the unrelated static failure remain unverified. All three actionable Greptile threads are fixed and resolved; final-head Codex review completed with no findings.

Author readiness

Human owner: @gensokyo-dev

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Per explicit user instruction, these human declarations remain unchecked; the user authorized an administrative readiness-check bypass. No human-review attestation is made.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7259 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/26/2026 **Status:** ✅ Merged **Merged:** 10/26/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/6198-web-bundle-paging` --- ### 📝 Commits (4) - [`48d554e`](https://github.com/morluto/rea/commit/48d554ed2a17424b58cb6ad2b7037f9fd622cc26) feat(browser): page retained web bundle endpoints and inferences - [`a92e07f`](https://github.com/morluto/rea/commit/a92e07f484e444755c2ee33f355351a28d79f430) fix(web): preserve provenance and bound retained bundle paging - [`dd853c5`](https://github.com/morluto/rea/commit/dd853c5c7abe04fb91f607a1c1c550d0fc88099f) test(web): verify retained bundle workflows with real browser assets - [`8f3203b`](https://github.com/morluto/rea/commit/8f3203b1c318eaba65bf2d31a53b756b19140124) test(web): own verifier commands and cover filtered continuation ### 📊 Changes **13 files changed** (+2041 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/javascript-applications.md` (+9 -0) 📝 `docs/javascript-route-inventory.md` (+36 -4) ➕ `docs/verification/web-bundle-paging-2026-10-26.md` (+138 -0) ➕ `experiments/analysis-efficiency/web-bundle-paging.mjs` (+382 -0) 📝 `src/cli/browserCommands.ts` (+2 -2) 📝 `src/cli/javascriptRouteDelivery.ts` (+7 -0) 📝 `src/contracts/analysisViewToolContracts.ts` (+17 -1) 📝 `src/contracts/browserToolContracts.ts` (+12 -3) 📝 `src/domain/analysisView/analysisView.ts` (+49 -0) 📝 `src/domain/analysisView/javascriptRoutesView.ts` (+5 -1) ➕ `src/domain/analysisView/webBundleView.test.ts` (+641 -0) ➕ `src/domain/analysisView/webBundleView.ts` (+395 -0) ➕ `tests/boundary/mcp/webBundleViewsMcp.test.ts` (+348 -0) </details> ### 📄 Description ## Summary Fixes #6198. Completed `analyze_web_bundle` Evidence can now serve filtered, field-selected endpoint observations, inferences and summary counts through the shared CLI/MCP analysis-view workflow, without recapturing a browser or repeating analysis. Builds on HarsH's #7213 (`6b1d5d42`), preserving original authorship. Pages keep parent identity, original collection indices, exact source coordinates/basis, producer partial status and structured script-scoped unknowns. Page exhaustion is independent of producer completeness. Complete Evidence remains exportable; indivisible oversized projections fail explicitly. ## Contract and boundary impact - Owner: shared domain projection and existing authenticated Evidence reader; CLI/MCP reuse it. Unfiltered pages allocate only requested rows; filtered scans count all matches without materializing all selected rows. No new cache or provider. - Scope: read-only projection within existing capabilities; new target-execution/protection scope decision is not applicable. Existing analysis input choices and complete delivery remain available. - Additive `web-bundle` view, selected analysis delivery, exact selectors, original `source_index`, updated CLI/help and authored skill guidance. Historical omitted origins remain omitted; limitation counts cover the distinct full parent/report union before display bounding. - No package, installer, provider authority, target mutation, or lifecycle changes. Generated catalogs/skills remain ignored outputs. ## Evidence and validation - 38 distinct targeted domain/SDK tests passed across the focused runs (24 projection, 12 existing route, two SDK tests). The review follow-up reran all 24 projection and both SDK cases. Converted SDK output schemas, retained/inline/file sources, duplicate values at distinct locations, empty/intersected filters, partial versus exhausted coverage and byte limits are covered. - Three corrected regressions fail against the imported upstream production code; explicit-origin/null controls pass. - Real Chromium loaded pinned unmodified Miniflux JS assets: all four scripts analyzed, five low-confidence candidates retained. Public CLI selected analysis exported the complete parent; actual stdio SDK paging and both CLI collections reproduce parent facts. Published Swagger UI preset also preserves a real script-scoped AST unknown and partial status. - `check:fast`, `verify:test-discovery`, `docs:check`, `docs:build` and `format:check` passed. - [Pinned inputs, reproduction, resource measurements and limitations](docs/verification/web-bundle-paging-2026-10-26.md). Two CPUs / 8 GiB family guard; no OOM. First-candidate selection reduces estimated model input from 20,083 to 16,248 BPE tokens for two equivalent queries including discovery. Small all-row paging costs more than full delivery; cold SDK schema compilation is slower. Estimates are not model billing; no generic speed/memory improvement is claimed. Remaining coverage: Miniflux assets were served in a static capture harness, not a complete backend deployment; its zero endpoint-observation collection does not verify nonempty real endpoints (covered by the SDK fixture). No successful large real endpoint inventory is claimed; the main Swagger bundle hit its unchanged script deadline and retained partial Evidence. Non-browser OS/provider execution is outside this change. Initial CI passed 29,174 tests with one unrelated ADB acceptance failure: process names retain trailing spaces/tabs while the existing fixture expects trimmed names. The same assertion fails in an isolated checkout of CI’s exact main parent `f6805e29c3c74223660686b5ca979c0508e1b195` (`test:focused -- tests/acceptance/applications/adbListingNumbers.test.ts`). [Initial CI evidence](https://github.com/morluto/rea/actions/runs/40365052031). No ADB code is changed here. Final-head CI reports 34,911 passing tests and the same ADB failure plus an unrelated packageCatalogVerification expectation failure. The latter reproduces on exact final CI main parent `662ec2e4501e975f2d1a28958a1ff560a9e24869`. Final static CI also fails formatting of untouched `scripts/verify-apk-signature.mjs`; its blob is identical in that main and synthetic merge `e10845b413179c6ff0625258f49a15d4fbbcbee3`, and main alone fails the formatter. `check:fast` passes on that exact merge. [Final CI evidence](https://github.com/morluto/rea/actions/runs/40367734233). Shard 6 was cancelled after emitting its ADB failure/report; dependent native/platform lanes skipped after the unrelated static failure remain unverified. All three actionable Greptile threads are fixed and resolved; final-head Codex review completed with no findings. ## Author readiness Human owner: @gensokyo-dev - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. Per explicit user instruction, these human declarations remain unchecked; the user authorized an administrative readiness-check bypass. No human-review attestation is made. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-03 13:40:10 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7754

No description provided.

Rows
Columns