REA hands-on: find an Electron CSV export channel

Tested on 2026-10-17. We wrote a five-file Electron source fixture, analyzed it with the published npm package REA 6.5.0, then traced the notes:export-csv channel. The sample, reproduction scripts and reviewed result excerpts are available below.

This was a static source analysis, not a live button-click test. We did not launch Electron, package an ASAR, connect a native provider or verify that a CSV was written. You can follow along without inspecting someone else's commercial application.

Download the sample and reproduction scripts (ZIP). Read its README first. results-excerpt.json omits host paths and is an excerpt, not a complete REA Evidence record.

What the run actually found

The trace summary contains 26 observed facts and 45 inferred facts. Its unknown_facts: 0 applies to that trace result; it does not mean the program has no unknown behavior.

1. Understand the three layers

The ZIP's app directory contains package.json, main.js, preload.js, renderer.js and index.html. FollowAgents authored this teaching fixture. The archive does not bundle dependencies.

Reading the source gives this intended route:

Export button (index.html)
  → click handler (renderer.js)
  → window.notesApi.exportCsv()
  → ipcRenderer.invoke('notes:export-csv') in preload.js
  → ipcMain.handle('notes:export-csv', ...) in main.js
  → fs.writeFile(...) inside the handler

This diagram is a reading of the fixture's source, not a captured runtime trace. Next, check its bridge and channel against REA's evidence.

The key preload code is:

contextBridge.exposeInMainWorld('notesApi', {
  exportCsv: () => ipcRenderer.invoke('notes:export-csv')
});

The main process handles the same channel, joins fixed teaching rows and calls fs.writeFile. Production sender validation and other concerns are simplified here; this is not a production IPC security template.

2. Pin the version and save the analysis

Our run used macOS arm64, Node.js 24.19.0 and REA 6.5.0. The current REA documentation supports the Node 22 family from 22.19, the 24 family from 24.11, and 26+. An existing Node installation may be too old. This case did not test Windows or Linux.

In the extracted rea-csv-lab directory:

node -v
npm -v
npx -y [email protected] analyze-javascript-application ./app --json > application-evidence.json

-y permits npm to download and execute the fixed official package. This command does not run setup or change an agent's MCP configuration. You do not need to install Electron inside app; direct CLI analysis is separate from connecting an agent.

A successful record has operation: analyze_javascript_application and a normalized_result. Check that the output is not an error before continuing. A JSON file alone is not evidence of success.

3. Trace the actual channel

The supplied make-trace-input.mjs reads your complete Evidence and creates this request:

{
  application,
  seed: { kind: 'channel', value: 'notes:export-csv', match: 'exact' },
  direction: 'both'
}

Run:

node make-trace-input.mjs
npx -y [email protected] trace-application-feature ./trace-input.json --json > trace-evidence.json
node verify-results.mjs

The verifier checks the returned bridge member, IPC handler, static pairing and matched seed. It does not launch the app or require a CSV file to exist.

4. Return to the source locations

Our Evidence records notesApi and exportCsv at lines 3–5 of preload.js, and the channel handler at lines 16–22 of main.js. The paired renderer transmission count is 1.

That supports a narrow conclusion: the bridge and same-channel handler were identified and associated in the static graph. Reading the handler shows an attempt to write rea-notes.csv in Documents. Successful path resolution, file writing and runtime reachability need separate live verification.

Complete Evidence contains the input path on your machine. Review it before sharing. The downloadable excerpt cannot replace full Evidence as trace input.

Two problems we actually encountered

A macOS helper compilation failure. The first run inside a restricted sandbox returned execution_failure, pointing to a failed xcrun build of the process-ownership helper. The same fixture succeeded in an environment that allowed normal local compilation. Not needing Ghidra does not mean this static workflow has no host-toolchain requirements. Inspect the diagnosis and command-line build tools instead of repeatedly reinstalling MCP.

The wrong seed type. Our first trace request used ipc-channel; 6.5.0 returned invalid_request. The accepted request uses kind: 'channel'. This was an input-construction error, not a failure to recognize IPC. The included script uses the corrected request.

Continue without overstating the result

Change the fixture's channel and your trace seed, regenerate the analysis, and inspect pairing and matching again. New source needs new Evidence; do not explain changed files with an old graph.

This run covers a small authored source tree. Obfuscation, dynamic channels, native add-ons and ASAR packages need separate tests. Complete static graph coverage is not complete behavioral coverage.

If your agent cannot see REA, use the setup and connection troubleshooting guide. For analysis routes and tool requirements, visit the REA topic guide or project review.

Official references: REA repository, CLI and Evidence, JavaScript workflows, installation prerequisites. Upstream main may be ahead of the pinned npm release used here.