Analyze an Electron app with REA

Understand the process boundary

An Electron feature can span several processes. The renderer presents the interface, a preload script may expose a limited API, and the main process can handle privileged operations such as clipboard or filesystem access.

Reading only the renderer can miss the implementation. A useful investigation follows the public method, its wrapper, an IPC channel, the registered receiver and the final operation.

Inspect an authorized local package

Provide an extracted application directory or an ASAR archive to REA's JavaScript application analysis. Preserve the original package and note its version. Begin with the returned module and boundary information rather than executing unfamiliar extracted code.

npx -y rea-agents@latest analyze-javascript-application \
  /absolute/path/to/app.asar --json

Follow one chain, end to end

Ask the agent to locate a named behavior and follow the relationships across the process boundary. Channel names are useful search anchors, but a shared name alone does not establish the complete argument flow or runtime behavior.

• Locate the renderer-facing API or feature entry point.
• Read the preload wrapper and identify the IPC operation.
• Find the matching receiver in the main process.
• Inspect the handler, sender checks and downstream calls.
• Keep source locations and unresolved dynamic expressions in the report.

Learn from a concrete example

REA's published Notion case study traces a clipboard API through preload, an IPC invocation and a main-process handler to Electron's clipboard writer. It distinguishes packaged-code findings from separately saved web-asset probes.

Use the investigation pattern, not the application's names or implementation, as your starting point. Your target may use different wrappers, channels or message ports.

Validate your own implementation

Once you understand a behavior, write a small implementation with explicit input and output examples. Compare its observable behavior in a controlled test. Static analysis findings should not be presented as a successful desktop UI test.

Do not equate an inspected feature with a recovered application. Backend services, authentication, platform integrations and unrelated workflows may remain outside the evidence.