When the Target Is an Application Graph

A native trace follows procedures and instructions, but many modern targets are better understood as graphs of modules, routes, IPC channels, resources, and runtime surfaces. REA’s JavaScript and Electron workflows build that graph without executing recovered code, while its browser and Inspector providers observe selected live targets under different authorities. This chapter explains how those views fit together, how a literal feature seed becomes a reachable graph, and why a statically resolved relationship still does not prove that the application executed it.

From files to relationships

A directory or ASAR is not yet an explanation of an application. It is a collection of artifacts whose relationships may include imports, exports, routes, storage operations, IPC boundaries, native add-ons, and configuration. REA’s JavaScript application provider turns an authenticated input into a structural Application Graph and a separate semantic relation graph. Keeping those graphs distinct matters: structure describes what the analyzer recovered about the application’s shape, while semantic relations describe selected definitions, reads, calls, flows, and boundaries.

Feature tracing starts from a literal seed rather than a vague request for “the relevant code.” A seed can be a node, route, string, API, IPC channel, module, or native export. The trace returns the matching basis, the reachable subgraph in the requested direction, terminal paths, authority summaries, and native handoffs. The result is useful because it returns relationships rather than a file list. A module that contains a search label is less informative than a graph showing where the label is defined, which local function consumes it, which request or storage boundary follows, and where the static route becomes unresolved.

The graph is authenticated to the input artifact and its structural identity. That commitment prevents a later follow-up from silently rereading changed files and calling the new result a continuation of the old one. In an MCP session, a retained Evidence reference can identify the compatible graph already produced. In a separate CLI process, the complete Evidence record can be supplied from a file. Either way, the graph’s identity and authority travel with the trace.

flowchart LR A["Authenticated application artifact"] --> S["Structural graph"] S --> L["Literal seed"] L --> R["Reachable feature trace"] S --> M["Semantic relation graph"] M --> R R --> H["Native handoff or terminal path"] R -.-> U["Dynamic or unresolved channel"] B["Passive browser or Inspector observation"] -.-> X["Runtime/static boundary"] R -.-> X

The structural graph supplies the map, the semantic graph supplies more detailed relationships, and the seed chooses the region to inspect. A native handoff is a relationship to investigate further, not an implicit request to start a deep provider. An unresolved channel is part of the trace, not a missing edge that the analyzer is entitled to invent.

What static semantic tracing can recover

REA’s semantic extractor covers more than imports and names.