Workflow #1: Statically Analyze a Web App's JavaScript Bundle

Use case: you own (or are authorized to test) a web app and want to know exactly which scripts it loads, what routes and endpoints they reference, and what the bundler left behind — without executing anything.

Compliance note: this session was run against our own website. Run it only against software you own or are authorized to analyze.

The target

A small browser-games site (static HTML + 9 vanilla JS files, no framework). This is a good first target because you can verify every REA finding by eye.

Step 1 — Launch a debug browser

analyze-web-bundle attaches to a real browser over the Chrome DevTools Protocol. Launch Chrome or Edge with a debug port and a dedicated profile directory (recent Chromium builds refuse the debug port on your default profile):

/Applications/Microsoft\ Edge.app/Contents/MacOS/Microsoft\ Edge \
  --remote-debugging-port=9222 \
  --user-data-dir="$HOME/rea-debug-profile" \
  --remote-allow-origins="*" \
  --no-first-run \
  "https://your-target.example.com/"

Step 2 — List targets and grab the target ID

npx rea-agents@latest list-browser-targets http://127.0.0.1:9222

Note the endpoint must include the scheme (http://) — passing a bare 127.0.0.1:9222 fails with invalid_value on cdp_endpoint. The output includes an evidence_id and the target list; copy the page target's ID.

Step 3 — Run the analysis

npx rea-agents@latest analyze-web-bundle http://127.0.0.1:9222 <TARGET_ID> \
  --allowed-origins https://your-target.example.com \
  --detail complete \
  --evidence_output ./evidence-bundle

--allowed-origins scopes the capture to the origin you're authorized on — REA will not wander off-site.
--detail summary requires an extra --view '{"kind":"javascript-routes","collection":"routes"}' argument; start with complete.

What you get (real numbers from our run)

9 scripts observed, 9 analyzed, 0 parse failures — every script the page loaded was captured with its URL and SHA-256 hash (app.js, extra-games.js, discovery.js, analytics.js, puzzle-models.js, world-games.js, puzzle-games.js, world-models.js, extra-models.js).
40,388 AST nodes visited across ~230 KB of JavaScript.
A route inventory (jsri:… ID) classifying navigation candidates, with an unknowns list: 3 navigation destinations flagged because they're built dynamically at runtime rather than appearing as string literals — exactly the kind of thing a manual grep misses.
Honest limitations, stated in the output itself: REA never executes the captured JavaScript; string-built routes and server-side behavior remain unknown. This is a bounded static observation, not a dynamic trace.

What this is good for

Auditing what third-party/analytics scripts your own site actually loads.
Mapping an SPA's client-side routes before writing integration tests.
Feeding structured Evidence (with stable IDs and hashes) into an AI agent for follow-up questions.

Hiccup we hit (and the fix)

On a sandboxed macOS shell the run ended with cleanup_incomplete and the --evidence_output file was not written, even though the analysis itself completed. Workaround and details: Troubleshooting → cleanup_incomplete.