ruDevolution adds witnesses to the decompiler that reads shipped bundles

What ruDevolution is

Shipped JavaScript is a single minified file. ruDevolution reconstructs modules, names and structure from it, which is how you find out what an interface really does when there is no source to read.

What changed

Pull request #6 secures the validation path, adds witnesses to the output, restores standalone builds and optimises the renaming pass. It follows earlier security work on a torch.load pickle execution issue, command injection and path traversal.

Get started

Node.js, or Rust if you prefer the crate. No install needed with npx:

npx ruvector decompile express

Expected result: reconstructed modules written out for the named package.

It also registers as an MCP tool:

claude mcp add ruvector -- npx ruvector mcp

Decompiling a package tells you what it does, not what you may do with it. Respect the licence of whatever you inspect.

Use it today

Practical case: a dependency whose published behaviour does not match its README. Input is the package name; the workflow is decompile and read the module graph; the output is an answer you can act on in a review.

Acceptance test: decompile a package you already know well and check whether the reconstructed structure matches its real source layout.

Push it further

Experimental commentary. The interesting direction is interoperability: understanding a tool's real interface well enough to build an extension against it. The limitation is that reconstruction is inference, not ground truth.

Falsifiable test: decompile two consecutive versions of the same bundle and diff. The diff should be about the size of the changelog. If it is enormous, your reconstruction is unstable.