mirror of
https://github.com/morluto/rea.git
synced 2026-10-18 20:10:13 -05:00
-
rea-agents: v5.0.0 Stable
dean released this
2026-10-07 12:26:36 -05:00 | 2455 commits to main since this release📅 Originally published on GitHub: Wed, 07 Oct 2026 17:26:47 GMT
🏷️ Git tag created: Wed, 07 Oct 2026 17:26:36 GMT5.0.0 (2026-10-07)
⚠ BREAKING CHANGES
- native: preserve incomplete native UI captures (#991)
- android: Android analysis now requires a full JDK 17 or newer with its compiler module for the packaged Java source bridge.
Features
- apple: project macOS bundle anatomy in application graphs (88c940b)
- apple: project macOS bundle anatomy in application graphs (dd3e7ae)
- application: wire Android and Apple inventory graph tools (#852) (e0fd820)
- browser: attribute native execution and listener sources (#917) (b5afa5f)
- browser: capture correlated network content and lifecycle evidence (#797) (f9eaf05)
- browser: trace captured website module imports (#879) (01be082)
- browser: trace captured website source-map locations (#897) (f430c41)
- javascript: recover readable modules with Wakaru (#848) (166dcd2)
- native: decode chained fixups, binds, ObjC categories and properties (a657557)
- native: decode chained fixups, binds, ObjC categories and properties (3e24a72)
- native: open iOS-style and iOS-on-Mac wrapper app bundles (2ed89e6)
- native: open iOS-style and iOS-on-Mac wrapper app bundles (aeebba3)
- web: export captured scripts for JavaScript application analysis (#801) (472b72a)
- website: add a shared back-to-top link (5047373)
- website: introduce REA and the DX-Ball reconstruction (#906) (4e3953c)
Bug Fixes
- address review nits from batch integration follow-ups (#818) (5a0e0ba)
- android: align runtime suffix inference (#977) (fb3749a)
- android: bound fragmented JADX MCP frame memory (#937) (9e39795)
- android: preserve JVM settings and reuse metadata sessions (#908) (eab34a9)
- apple: attribute only application-root components in macOS inventories (5524970)
- apple: count only real framework version directories (2e81e86)
- apple: pair bridge hypotheses within one application root (7acf4e7)
- apple: pair bridge hypotheses within one application root (9226ade)
- apple: traverse keyed archive hierarchy collections (#976) (71ac83f)
- artifacts: accept APFS image disks ejected with their container (d93ebec)
- artifacts: accept APFS image disks ejected with their container (b72c079)
- artifacts: accept the bundle subject when extracting an app bundle (#891) (37d2eba)
- artifacts: decode flat keyed-archive NIBs with data and shared references (b3f013f)
- artifacts: decode flat keyed-archive NIBs with data and shared references (2a4667b)
- artifacts: harden reader lifecycle boundaries (#951) (2366bda)
- artifacts: keep the post-snapshot detach check out of provenance (62634e4)
- artifacts: preserve reader failure diagnostics (#987) (fc4a9a0)
- artifacts: project compiled AppKit actions from the control to its target (b08228d)
- artifacts: project compiled AppKit actions from the control to its target (#905) (900d7c8)
- artifacts: project UIKit runtime outlet and event connections (aa8082e)
- artifacts: project UIKit runtime outlet and event connections (8b24387)
- artifacts: read AppKit connectors from flat keyed-archive NIBs (#900) (27c272b)
- artifacts: read keyed archive dictionaries keyed UID as dictionaries (cfd2b0c)
- artifacts: read keyed archive dictionaries keyed UID as dictionaries (35c82b9)
- artifacts: report which path constraint failed (#847) (3f1a77f)
- browser: distinguish computed call keys from identifiers (#808) (02beb74)
- browser: distinguish WebMCP registration frame owners (#813) (b3b44d8)
- browser: fingerprint cookies at the selected page URL (#763) (78014e3)
- browser: identify NodeNext TypeScript original source artifacts (#811) (e84ad86)
- browser: preserve evidence through deep AST analysis (#924) (f826aa8)
- browser: preserve form destinations and satisfies mutation uncertainty (#825) (6dd719e), closes #820
- browser: preserve Link header value delimiters (#805) (dd36405)
- build: validate installed dependencies before cache hits (#982) (a45fe86)
- capture IndexedDB object-store record fingerprints (#809) (21a8bd0)
- cli: align structured output guard with native flags (#777) (e9fac56)
- cli: emit empty structured filter projections (#914) (2db668f)
- cli: honor the selected native plist path (#773) (0374865)
- cli: preserve output and comparison input validation (#981) (d5c43d6)
- cli: preserve unsupported historical-source imports (#795) (911d580)
- contracts: align CLI/MCP boundary contracts (#946) (4a60738)
- deps: remediate smol-toml advisories (93091ab)
- deps: remediate smol-toml advisories (c55ae3b)
- dotnet: compare members with undecoded signatures by exact identity (28fd49f)
- dotnet: compare members with undecoded signatures by exact identity (d52af3b)
- dotnet: inspect native boundaries of non-managed and malformed PEs (d5f28fb)
- dotnet: inspect native boundaries of non-managed and malformed PEs (d98dcfa)
- dotnet: keep a decoded member unknown beside an undecoded counterpart (76b7020)
- dotnet: keep admitted CLI header facts when metadata is unreadable (e5ba693)
- dotnet: name the shared key in exact-signature ambiguities (7714e76)
- dotnet: treat ambiguous undecoded members as possible counterparts (73370e1)
- errors: report union input issues at the union's path (bddeb63)
- evaluation: canonicalize Unicode argument keys (#980) (0a4caf4)
- firmware: accept the verified Binwalk and Unblob release lines (#844) (bef4321)
- firmware: retain multi-file extraction failures (#978) (8aaf9a1)
- ghidra: admit the 12.1 line and the install's JDK range (#840) (5cbf06c)
- ghidra: select exact packaged bridge scripts (#800) (894c30e)
- ida: share concurrent session cleanup (#950) (f14b6a8)
- installer: validate exact semantic versions (#954) (248972f)
- integrate 24 reviewed browser/native/semantics corrections (#815) (3af3811)
- javascript: advertise the exact empty seed rule and match empty API keys (35e5508)
- javascript: analyze source maps with empty source names (58ef8ac)
- javascript: analyze sources containing empty string literals (e7cbfe0)
- javascript: analyze sources containing empty string literals (11fc3b9)
- javascript: filter keyed-collection receivers only for get/delete (00f707b)
- javascript: handle deep AST traversal and addition without stack overflow (#915) (62b3711)
- javascript: handle deep static member paths (#939) (348c65c)
- javascript: keep bare relative URLs for computed-method XHR (e32028d)
- javascript: keep computed-method XHR request URLs (602d002)
- javascript: keep exact empty env keys and method names (522c2d0)
- javascript: keep exact empty env keys and method names (f7954a8), closes #783
- javascript: keep exact empty require paths and request fields (ad1f6b5), closes #783
- javascript: keep exact empty values in graph identities (f608127)
- javascript: keep exact empty values in graph identities (63012ee)
- javascript: keep keyed-collection reads out of endpoints (9075ce7)
- javascript: keep keyed-collection reads out of endpoints (eb68761)
- javascript: keep literal HTTP methods on storage-named receivers (9f48a76)
- javascript: keep literal-method and URL-literal requests on aliased receivers (e3e7664)
- javascript: keep mutated object initializer values unknown (#752) (6caa38a)
- javascript: keep storage open versions out of XHR endpoints (4f51103)
- javascript: keep storage open versions out of XHR endpoints (898b0f6)
- javascript: keep XHR and client endpoints that receiver spellings hid (05f43ed)
- javascript: leave empty application values unlabeled (527b76e)
- javascript: match exact empty literal channels and seeds (e20da1f)
- javascript: never read window or document open as XHR (ae849a7)
- javascript: preserve computed Electron member uncertainty (3a4a63f)
- javascript: preserve computed Electron member uncertainty (1260cac)
- javascript: project decoded file URL paths (#810) (2572e1e)
- javascript: read open() endpoints only from XHR method/URL pairs (63e0822)
- javascript: read open() endpoints only from XHR method/URL pairs (1be3705)
- javascript: read substitution-free templates as exact strings (c371d6e)
- javascript: read substitution-free templates as exact strings (77cf757)
- javascript: resolve bare source-map and worker URLs next to the script (#890) (45fcd28)
- javascript: retain recovered call argument positions (#929) (e6ba9c3)
- linux: improve Hopper reliability and CachyOS support (#963) (98b2b02)
- mcp: advertise reserved process environment key (#949) (e0d76ae)
- mcp: isolate optional observation adapter failures (#838) (be3cfbf)
- mcp: preserve exact guided prompt context (#761) (66c26f2)
- native-ui: handle incomplete accessibility child collections (#944) (ac3bae3)
- native: inspect plists containing data, dates, and non-finite reals (bc2cd8b)
- native: inspect plists containing data, dates, and non-finite reals (5ead2cf)
- native: keep echoed codesign paths out of signature fields (#865) (4aa2b60)
- native: keep echoed Mach-O paths out of load commands and symbols (ab985c6)
- native: keep echoed Mach-O paths out of load commands and symbols (37fe105)
- native: keep integral plist reals beyond the JSON range as reals (#860) (3b92a2b)
- native: keep plist XML element types for large numbers (f85056d)
- native: keep the resolved bundle plist and permission failures (418a556)
- native: pass Swift symbols to swift-demangle as operands (dd90965)
- native: pass Swift symbols to swift-demangle as operands (6c88094)
- native: preserve incomplete native UI captures (#991) (9f496ef)
- native: report exact plist integers beyond the JSON number range (c9f49db)
- native: report exact plist integers beyond the JSON number range (430c297)
- native: report plist permission denials as access failures (5738a0c)
- native: report why a selected plist cannot be inspected (14f9b3d)
- native: report why a selected plist cannot be inspected (0674fac)
- plist: keep character references beyond Unicode literal (5afd8a8)
- plist: read XML plists containing a proto key (faaee69)
- plist: read XML plists containing a proto key (a08be51)
- plist: report omitted proto entries in signatures and Interface Builder (15ab5db)
- plist: report omitted proto entries in signatures and Interface Builder (6729ee7)
- preserve native UI failure reasons and dedupe version literals (#854) (2d4a910)
- process: clarify Windows capture support and recovery (#798) (50787b2)
- process: harden filesystem snapshot identity and cancellation (#956) (93aa9eb)
- process: retain provider output until streams close (#928) (b929251)
- reference: retain partial imports for unreadable directories (#766) (cffc548)
- release: drive checkpoint releases from frozen branches (fc58fa1)
- release: publish from explicit source checkpoints (49887f0)
- semantics: isolate named function expression bindings (#776) (ae81f64)
- semantics: preserve direct promise ownership boundaries (#758) (e1ca412)
- semantics: preserve empty string property keys (#764) (630bdaf)
- semantics: recognize Node builtin default namespaces (#769) (24a0bf9)
- semantics: retain trailing rest argument flows (#756) (4bfd803)
- setup: accept the pinned Hopper RPM launcher (#933) (dda8e6a)
- setup: read an OpenCode V2 server named type as a table entry (#866) (4e17be5)
- setup: register OpenCode V2 configurations in mcp.servers (957069d)
- setup: register OpenCode V2 configurations in mcp.servers (69d8afe)
- target: decode app Info.plist executables with an XML parser (c57f1b7)
- target: decode app Info.plist executables with an XML parser (c182f72)
- test: disconnect Hopper fixture IPC on SIGTERM (b912b11)
- windows: accept ordinary drive path separators (#791) (b62931f)
- windows: remove cancelled snapshot outputs (#957) (d76f7d1)
Performance Improvements
- artifacts: stream ASAR members without full buffering (#962) (abd7a5e)
- call-path: prune dead ends and enumerate without recursion (#909) (e52fe97)
- cli: defer catalog digests and use canonical cache scope (9a15525)
- cli: defer unused catalog work during command startup (#920) (9a15525)
- comparison: reuse canonical sort keys (#990) (ebb065e)
- dotnet: index declaring-type ranges once per metadata table (#918) (7a9f587)
- dotnet: index ordered declaring-type ranges once per table (7a9f587)
- evidence: scale imports and dependency graphs (#941) (7dc40d3)
- inspector: bound runtime script location authorization (#945) (58381ee)
- javascript: analyze member chains without recursive copying (#932) (dcde958)
- javascript: index Promise return-site ownership (#971) (2cedde9)
- javascript: index semantic fingerprint relations (#942) (c92a344)
- javascript: reduce analysis and source-map work (#955) (c7530f9)
- providers: assemble fragmented responses once per line (#911) (df7151b)
- reconstruction: index coverage evaluation (#983) (f26c8b5)
- setup: reuse initial diagnostics during planning (#940) (118d43e)
Code Refactoring
- add incremental capability migration safeguards (#819) (75f50d8)
- android: group layered source and verification (#873) (8e8921d)
- apple: group artifact producers and verification (#952) (ef1a0cc)
- artifacts: isolate JavaScript file acquisition (#916) (f0a68dc)
- binary: group session selection and snapshot ownership (#886) (dd114d3)
- binary: move production composition outside application workflows (#965) (33d4761)
- browser: align inspector exclusions with canonical vocabulary (#834) (de9593a)
- cli: split core analysis command registrar (#858) (8b9940a)
- colocate investigation record implementation (#867) (bb19c94)
- compose investigation record ownership (#845) (ce73c3f)
- declare auxiliary capabilities from source (#853) (4a6c17c)
- domain: consolidate property-key extraction behind semanticStaticPropertyKey (#823) (764ff05)
- domain: converge comparison mechanics on shared vocabulary (#824) (c13c9d4)
- domain: extract artifact path syntax helpers (#830) (ef535b8)
- domain: extract source-map envelope walk and disambiguate stringValue (#828) (64ebdf4)
- domain: map validation taxonomies and add inventory Result seam (#833) (78f4848)
- domain: split Interface Builder keyed-archive parse from graph builder (#859) (da09706)
- firmware: group layered source and verification (#878) (507e8b3)
- ghidra: extract createClient and load-image attestation (#856) (b7df5b7)
- give Inspector its own capability directory (#869) (021ba69)
- javascript: group application workflows and verification (#896) (0804722)
- javascript: group domain semantics and contracts (#907) (f6a58f1)
- managed: group capability workflows and verification (#926) (28713f9)
- native: group analyst semantics workflows and contracts (#973) (ea4db4c)
- native: split Apple dispatch metadata decode facets (#855) (676959e)
- provider: declare deep capabilities from source (#892) (b808e2d)
- share Android and firmware provider factories (#826) (3ed59b2)
Documentation
- add concise lawful-use disclaimer (#888) (4037c65)
- add DX-Ball reconstruction showcase (#876) (895079d)
- add prominent website and showcase links to READMEs (2ccc86c)
- add README star history chart (#850) (11f27de)
- add website and showcase links to READMEs (#930) (2ccc86c)
- apple: describe directory-based framework plist ambiguity (6d74992)
- audit and improve localized readmes translations and wording (00a6ac3)
- clarify NativeAOT scope and regenerate conformance ledger (c945931)
- fix stale IDA roadmap item, mermaid paths, toolchain wording (d2aed17)
- move quick start up and mark skill install optional (554e9b1)
- note Cloud Agent Node.js toolchain (#837) (6aa6350)
- publish VitePress documentation on GitHub Pages (c78fe69)
- separate ambiguous and unavailable provider recovery (c3f2b8e)
- show task-scoped readiness and provider preference in the quick start (880cca1)
- show task-scoped readiness and provider preference in the quick start (5fd0db3), closes #726
- update release boundary to npm 4.1.0 with Windows native bundle (69be514)
- website: add Notion case study and improve onboarding (a6ba772)
- website: add TH04 bullet-ring case study (f8d84da)
- website: add worked guides and keep Pages publishing manual (#925) (4f25ee3)
- website: clarify guides and case studies (5065fcd)
Tests
- artifacts: report compiled connector records when a storyboard route is missing (d421d3f)
- artifacts: report observed action routes when a compiled route is missing (c60b737)
- artifacts: write the storyboard fixture's action in Cocoa syntax (53bfa7e)
- eliminate fixture races and prune redundant scaffolding (#849) (f72931d)
Continuous Integration
Downloads
-
rea-agents: v4.1.0 Stable
2026-10-06 12:57:26 -05:00 | 2691 commits to main since this release📅 Originally published on GitHub: Tue, 06 Oct 2026 17:57:41 GMT
🏷️ Git tag created: Tue, 06 Oct 2026 17:57:26 GMT4.1.0 (2026-10-06)
Features
- android: integrate static APK analysis with headless JADX (#738) (904d03e)
- evidence: accept exact retained application references (#734) (d0f3480)
- firmware: integrate Binwalk and Unblob analysis (5a7c769)
- ghidra: add atomic function annotation edits (#709) (9bab553)
- ghidra: admit explicit DOS COM analysis (#702) (5bcb664)
- ghidra: enable Windows x64 read-only analysis (#699) (26881da)
- ghidra: integrate optional NativeAOT metadata recovery (#748) (fb679b6)
- ghidra: verify DOS load images and expose memory evidence (#697) (a6a8f67)
- ida: add read-only GUI and headless MCP providers (#754) (8238232)
- setup: support Command Code MCP registration (#645) (7f1ae42)
Bug Fixes
- android: validate explicit Java runtime (#742) (7390390)
- artifacts: make extraction output tree work on Windows (#753) (c8e66c7)
- browser: classify CSP host sources by their own origin (#707) (1d15bcb)
- browser: keep bare module locations unresolved (#676) (8189081)
- ci: upload Vitest blob reports from current path (77799e6)
- cli: disable unmanaged skill synchronization (433ebda)
- cli: disable unmanaged skill synchronization (2c1bf92)
- cli: fail when JSON input files cannot be parsed (18c1829)
- cli: fail when JSON input files cannot be parsed (3201f05)
- cli: include build step in missing-runtime recovery (6a37346)
- cli: include build step in missing-runtime recovery (ae72abd)
- cli: report reference-source import failures (00eb03d)
- cli: report reference-source import failures (431e8eb)
- comparison: break function collection collation ties (c3d013b)
- comparison: break function collection collation ties (3aaf7e2)
- comparison: break JSON shape collation ties (217e8cf)
- comparison: break JSON shape collation ties (805c338)
- comparison: retain container-only export shape paths (a55b5bb)
- comparison: retain container-only export shape paths (7864d66)
- dotnet: preserve leading Unicode content in metadata strings (#667) (ddea063)
- electron: respect computed option keys and overrides (af48fe8)
- electron: respect computed option keys and overrides (98de338)
- evidence: admit current process provider identity (ab5a1c6)
- evidence: admit current process provider identity (d311940)
- firmware: validate configured executables (#751) (9a4e6da)
- ghidra: preserve request and shutdown failure diagnostics (#647) (19f8cdd)
- ghidra: refuse ambiguous universal Mach-O imports (b1b687f)
- ghidra: refuse ambiguous universal Mach-O imports (6582b24)
- hopper: retain shutdown request diagnostics (8d7071d)
- hopper: retain shutdown request diagnostics (7254871)
- integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) (#705) (cf06115)
- javascript: count all source line terminators (e60aa11)
- javascript: count all source line terminators (03bc6d3)
- javascript: expose result schema failures (6d1f39b)
- javascript: expose result schema failures (99263a7)
- javascript: hash graph and evidence JSON incrementally (#646) (9f42495)
- javascript: preserve path.resolve reset semantics (863ed47)
- javascript: preserve path.resolve reset semantics (4177377)
- javascript: preserve primitive addition coercion (#666) (94cc847)
- javascript: preserve unknown branches in primitive unions (75a75cb)
- javascript: preserve unknown branches in primitive unions (9a2f395)
- javascript: read source-map directives only from comments (#672) (7f1fa64)
- javascript: scope candidate ambiguity to query traversal (6ad62ce)
- javascript: scope candidate ambiguity to query traversal (f94fc79)
- mcp: retain shutdown failure diagnostics (09c249d)
- mcp: retain shutdown failure diagnostics (fd008cd)
- native: inspect mixed-signature Mach-O slices (1dccd0d)
- native: inspect mixed-signature Mach-O slices (66f3cfa)
- native: retain spaced symbols in dyld inventory (#669) (fa02df9)
- native: select concrete arm64e Mach-O slices (f04445c)
- native: select concrete arm64e Mach-O slices (fd3282a)
- process: honor disabled PID normalization in samples (44b3627)
- process: honor disabled PID normalization in samples (a4e5736)
- process: scope comparison unknowns to their evidence (#732) (9dd6cef)
- reconstruction: accept function comparison source parameters (c3bc38b)
- reconstruction: accept function comparison source parameters (7a96391)
- reference: bound Dockerfile language detection (132a3a4)
- reference: bound Dockerfile language detection (53fa559)
- reference: classify test suffixes before extensions (e828acc)
- reference: classify test suffixes before extensions (8b228ae)
- reference: distinguish computed require member names (ba35b55)
- reference: distinguish computed require member names (df6e476)
- reference: preserve unresolved absolute module specifiers (#670) (c8aed47)
- reference: read linked worktree commit provenance (#677) (d565ecd)
- reference: recognize CMake build manifests (#665) (1a24be5)
- reference: retain dynamic import relationships (a5d2986)
- reference: retain dynamic import relationships (b89de8f)
- reference: retain recovered parser diagnostics (11d0ef2)
- reference: retain recovered parser diagnostics (ed3a7f0)
- setup: accept leading BOM in JSON client configs (a5b970c)
- setup: accept leading BOM in JSON client configs (fe843ec)
- setup: align Node runtime checks with package engines (5802ef8)
- setup: align Node runtime checks with package engines (ea0b733)
- target: explain the JavaScript directory analysis route (#733) (8d44b3e)
- trace: match typed seeds against member arrays (65c8797)
- trace: match typed seeds against member arrays (38ebd54)
Code Refactoring
- app: split Setup and ProcessOwnership modules (#628) (3c84080)
- cli: collapse duplicate CLI layer into src/cli (#630) (494d4db)
- contracts: split tool contracts by family (#634) (5295d56)
- domain: consolidate canonical ordering and digest helpers (#624) (ba3869c)
- domain: split error taxonomy into thematic modules (#636) (735c100)
- native: extract FAT header format switch in Mach-O slice selection (#632) (38b2933)
- runtime: centralize safe JSON parsing and preserve error causes (#629) (e7f54b3)
- runtime: name all silent catch causes without changing diagnostics (#637) (5f27e02)
Documentation
- add the official Trendshift badge to README headers (b6c21b1)
- add the official Trendshift badge to README headers (7d4ed59)
- align MCP discovery and skill guidance with the stable catalog (#664) (39db9fe)
- browser: add an interaction example that captures the visible result (#750) (91daaa6)
- clarify onboarding and align provider guidance (#745) (5af1699)
- correct CLI examples and documentation checks (#655) (fc80ea8)
- fix architecture diagram and pretty-print tool catalog (#626) (5e7f35c)
- ghidra: explain first-query deadlines and recovery (#736) (e2c23f3)
- hopper: document HopperTargetLease realpath fallback (#711) (d3f498c)
- installation: pin manual MCP registration to the release version (#658) (8dd1d84)
- update Trendshift repository badge (3f6d6dc)
Tests
Downloads
-
rea-agents: v4.0.1 Stable
2026-10-05 13:54:44 -05:00 | 2803 commits to main since this release📅 Originally published on GitHub: Mon, 05 Oct 2026 18:54:59 GMT
🏷️ Git tag created: Mon, 05 Oct 2026 18:54:44 GMT4.0.1 (2026-10-05)
Bug Fixes
- release: allow npm propagation time (2ef02ce)
Downloads
-
rea-agents: v4.0.0 Stable
2026-10-05 13:29:30 -05:00 | 2805 commits to main since this release📅 Originally published on GitHub: Mon, 05 Oct 2026 18:29:43 GMT
🏷️ Git tag created: Mon, 05 Oct 2026 18:29:30 GMT4.0.0 (2026-10-05)
⚠ BREAKING CHANGES
- Managed comparison metadata adds exact-signature matching and its count, and name_matching now reports exact-signature-fallback.
- setup: unscoped setup refreshes only existing REA-owned registrations. Use --all-detected to configure every detected client. Setup JSON contains a compact doctor summary; use rea doctor for full diagnostics. Cancellation and successful dry runs now exit successfully.
- Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
- tools: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
Features
- ghidra: add DOS MZ analysis and complete function extents (#556) (4f099a1)
- native: add inspection primitives, dispatch traces and approved UI observation (#500) (4fbc501)
- setup: expand agent integrations and verify updates (#577) (6256b68)
Bug Fixes
- artifacts: break directory child collation ties (#587) (b37e47c)
- artifacts: exclude removed paths from unchanged counts (#569) (52bf709)
- artifacts: expand nested ASARs on Windows (#582) (ebb4c45)
- artifacts: interrupt ZIP extraction under backpressure (#594) (50f7e81)
- artifacts: preserve archive entry types and host paths (#581) (28e0f4e)
- artifacts: refresh cached ASAR headers for each inventory (#574) (f5013c5)
- artifacts: resolve parents after archive enumeration (#578) (8eac290)
- artifacts: respect XML plist byte-order marks (#514) (23c4eba)
- artifacts: retain expanded ASAR container parents (#583) (00fa974)
- artifacts: retain relative paths in directory identities (#580) (348323d)
- browser: capture popup network and report early event gaps (#614) (f557207)
- browser: capture selected events in popup pages (#600) (a3bf4a0)
- browser: derive source-map imports from syntax nodes (#588) (bae87b4)
- browser: distinguish duplicate screenshot frame events (#612) (1bd641d)
- browser: ignore duplicate frame navigations and read block-form source map directives (#546) (828395d)
- browser: keep subresource redirects out of page navigation scope (#524) (9c28f3c)
- browser: preserve RGB PNG transparent samples (#595) (9997152)
- browser: release cancelled CDP cleanup without waiting for responses (#517) (488fd5f)
- browser: release discarded source-map response bodies (#611) (8642055)
- browser: resolve redirected source map paths from final URL (#518) (056c123)
- cli: fail commands returning projected analysis errors (#506) (2fd1196)
- cli: reject invalid UTF-8 JSON file bytes (#613) (22acb0d)
- comparison: account for unpaired records after explicit bundle pairing (#603) (12a2e37)
- comparison: match generated names without swallowing symbol prefixes (#596) (5f3ba3e)
- comparison: normalize CFG identity by numeric addresses (#593) (d1e5c0e)
- comparison: require decoded signatures for structural method matches (#604) (4a98c3e)
- conformance: preserve own JSON keys during comparison (#573) (3460eda)
- correct native inventories and bridge error classification (#503) (405732a)
- docs: allow README installation wording to vary (92617f9)
- ghidra: avoid nested quotes in Windows Java options (a574b74)
- ghidra: recover evidenced switch cases and default targets (#579) (b225b0f)
- inspector: preserve lossy Node discovery locations (#542) (84e4361), closes #530
- javascript: avoid invented computed destructuring properties (#507) (80777d9)
- javascript: bind named class expressions in their class scope (#510) (55f0267)
- javascript: classify assignment targets and retain compound-assignment reads (#537) (333d118)
- javascript: correct lexical and dynamic scope analysis (#538) (6fa6f1f)
- javascript: honor computed keys when naming callables, exports, requests and options (#536) (4c8dc39)
- javascript: honor package exports condition order (#591) (8289595)
- javascript: isolate lexical loop bindings (#511) (c30878f)
- javascript: prefer package entrypoints over directory indexes (#575) (bb91abd)
- javascript: preserve literal CommonJS path punctuation (#576) (063cd25)
- javascript: preserve Node exports fallback stop reasons (#606) (adc07f5)
- javascript: respect HTML base URL components (#589) (ffbde92)
- javascript: respect lexical shadowing of require (#509) (6a431d8)
- javascript: retain property reads during updates (#508) (6b7923c)
- managed: classify truncated signatures as malformed (#598) (1b6f054)
- managed: distinguish metadata handles from member accesses (#607) (c73742f)
- managed: recognize PE Thumb and ARMNT machines (#605) (0ce529a)
- mcp: emit valid schemas for empty arrays (#535) (4007b20), closes #528
- mcp: return complete inline Evidence records (#585) (ea9c3da), closes #551
- native: capture Mach-O header metadata alongside load commands (#525) (a8195ba)
- native: decode little-endian fat headers (bede3e3), closes #592
- native: decode Mach protection bits in their proper positions (#586) (6aba6ae)
- native: inspect Apple dispatch metadata in FAT64 binaries (#590) (f3e6582)
- native: inspect the selected universal Mach-O architecture (#601) (2b7bb3b)
- native: match compound otool keys exactly and badge unknown thread entrypoints (#534) (d40502a)
- native: normalize otool line endings and strip plist JSON BOM (#533) (3e4d4d9)
- native: preserve text-valued load command metadata (#520) (bcfb407)
- native: reject signal-terminated command captures (#608) (b81d18e)
- native: reject trailing text in lipo integers and keep multi-word otool keys (#531) (9e30d93)
- native: retain lazy dylibs, normalize version-min builds, limit thread entrypoints (#532) (0f77ada)
- native: retain re-exported Mach-O library dependencies (#516) (4a5673e)
- package: separate agent and Hopper setup support (#584) (205a977)
- platform: accept absolute paths for any host and stop blaming the ceiling for a missing grant (#552) (e793e12)
- process: align provider detach with configured platform (3fff74f)
- repair boundary contracts across CLI and MCP (#597) (9c25dc4)
- replay: keep proto own properties and reject symbol-keyed results (#540) (05bb630)
- replay: link the complete ESM graph before evaluating (#515) (4200a42)
- replay: preserve CommonJS object as ESM default export (#519) (2df6b51)
- replay: preserve Date call and explicit constructor semantics (#512) (9975bd2)
- replay: preserve sparse array positions in result projection (#522) (9d1c363)
- replay: share one seeded generator and present builtins with real identity (#539) (5b51fa0)
- repo: keep dependency links out of version control (#617) (b3223e3)
- skill: remove obsolete grants and audit tool effects (2919def)
- test: improve capture reliability and runner cleanup (#609) (d19686a)
- tools: simplify direct invocation and harden boundary contracts (#555) (b5e9891)
- web: retain uncertainty for incomplete capture inventories (#513) (d8c18f6)
- win32: probe .cmd/.bat runtime shims via cmd.exe to avoid spawn EINVAL (#505) (31ed005)
- workflows: preserve punctuation in filesystem source paths (#521) (5b28a8b)
- workflows: retain container presence in export shape comparisons (#523) (3854458)
Code Refactoring
- config: take the environment as an input at every configuration read (#554) (53fe7d6)
- domain: consolidate duplicated semantic member and literal helpers (#550) (09830da)
- domain: own digest and prefixed identifier shapes in one module (#547) (ea58834)
- host: inject platform and environment instead of reading them ambiently (#549) (5b59b87)
- simplify runtime tools and remove replay engines (#572) (e07b816)
Documentation
- add boundary contract guidance (42e6a8a)
- add Discord community links to README (79bf26f)
- align roadmap with direct tool use (eba709e)
- align translated READMEs and clarify support guides (5b383b2)
- clarify README wording and analysis tool support (97822f2)
- move README image above Discord community (ad86d39)
- place community invitation below README navigation (69a45e0)
- place Discord community below setup command (778e464)
- place setup command above README image (c6d3bdf)
Tests
- setup: isolate client fixtures across host platforms (f73bb0f)
Downloads
-
rea-agents: v3.2.1 Stable
2026-10-03 14:58:16 -05:00 | 2907 commits to main since this release📅 Originally published on GitHub: Sat, 03 Oct 2026 19:58:27 GMT
🏷️ Git tag created: Sat, 03 Oct 2026 19:58:16 GMT3.2.1 (2026-10-03)
Bug Fixes
- release: tolerate npm registry propagation delay (726b730)
Tests
- release: accept guarded npm publishing (b7bc855)
Downloads
-
rea-agents: v3.2.0 Stable
2026-10-03 11:43:14 -05:00 | 2910 commits to main since this release📅 Originally published on GitHub: Sat, 03 Oct 2026 16:43:27 GMT
🏷️ Git tag created: Sat, 03 Oct 2026 16:43:14 GMT3.2.0 (2026-10-03)
Features
Bug Fixes
- artifacts: stabilize extraction approval (7eb1a95)
- browser: reject unknown Electron input fields (1860d4f)
- ci: retain artifacts for delayed reruns (07888ec)
- cli: remove ignored result limits (f3645aa)
- consolidate boundary ownership and cleanup failure paths (#477) (2160d4f)
- contracts: align byte read schema with provider (f580d9d)
- ghidra: return complete native analysis results (a66e43a)
- managed: retain every source location (33b2099)
- process: capture complete host probe output (6c68ff5)
- runtime: make observed target role optional (593a8e1)
- runtime: retain complete reconciled graph content (bedd55a)
Code Refactoring
- analysis: remove caller-selected result caps (a8c58c6)
- analysis: remove fixed result quotas (20152a9)
- artifacts: consolidate inventory into inspection (0fe96d9)
- artifact: simplify extraction and inventory results (07ff8b3)
- artifacts: remove duplicate inventory wrapper (aa6eee1)
- artifacts: remove selectors and traversal quotas (8c24272)
- artifacts: select extraction by logical path (7ba3580)
- browser: remove arbitrary capture ceilings (5dd3b46)
- browser: return complete observation evidence (0e2738f)
- browser: return complete scenario observations (e80fe41)
- browser: share authorized main-frame polling (eec75ce)
- browser: share canonical identity digest (a6d9e49)
- contracts: remove duplicate schema aliases (4593c29)
- contracts: simplify workflows and drop readiness tool (7acac61)
- coverage: evaluate inline without workspaces (9e76054)
- domain: encode comparison and lifecycle states exactly (#473) (d65730c)
- domain: share AST property name reader (4f4cc59)
- electron: retain complete active observations (e8c56e0)
- errors: remove stale workspace failures (f570d40)
- evidence: remove obsolete ID resolvers (a3920e2)
- evidence: remove session ledger quotas (dca293a)
- files: use caller paths for local evidence files (c34efca)
- ghidra: remove redundant schema markers (c2a6f4b)
- javascript: remove analysis ceilings (9aec690)
- managed: derive inspection from PE CLI extents (dfad09e)
- mcp: simplify evidence and workflows (6740ed5)
- mcp: simplify tool inputs and inline results (f55c2b9)
- mcp: simplify workflow and observation scope (34d00fd)
- observation: internalize capture budgets (7b3c797)
- observation: retain complete tool results (fa2b6c5)
- observation: return complete inventories (c523c38)
- permission: remove unused authorization helpers (1b0ab75)
- process: remove fixed scenario ceilings (abf7c11)
- process: remove redundant schema version markers (b3aca52)
- process: remove request count ceilings (f2dc749)
- process: remove unused paired experiment (e1d755f)
- prompts: make tool workflows optional (3fd9650)
- reference: share graph index projections (6ee87fb)
- remove cross-version investigation workflow (81996df)
- replay: share sandbox probe arguments (9fca6c0)
- replay: simplify runtime value checks (60cb68a)
- return complete analysis results inline (a2a3243)
- return complete tool results inline (0d96275)
- runtime: retain complete reconciliation outputs (79ea571)
- schema: remove data-only version markers (5457f4a)
- server: remove registration alias (8097ec4)
- server: use canonical elicitation type (bb6a58c)
- test: colocate pure-domain tests and reduce test debt (#471) (e91c8c3)
- test: keep coverage at behavioral boundaries (#474) (d4dc940)
- tools: remove arbitrary workflow ceilings (5f73cb0)
- tools: remove artificial analysis ceilings (2f08c7c)
- tools: remove redundant limits and acknowledgements (bd0e341)
- tools: remove remaining arbitrary workflow caps (ecf3ed8)
- tools: return complete analysis results inline (2a6eb41)
- workflows: simplify evidence reference inputs (24e1fa9)
Documentation
- add REA tool design guidance (#485) (36aeec9)
- clarify aggregate context tools (c7e207c)
- clarify MCP tool design guidance (36aeec9)
- correct inline evidence and Hopper behavior (bf9cce1)
- describe complete application analysis outputs (271b162)
- generalize reverse-engineering workflow (#488) (4ecc7a7)
- improve GitHub issue and pull request templates (c490d85)
- prioritize reusable analysis primitives (#493) (9dd72c4)
- refresh managed conformance manifest (23e56c5)
- refresh tool catalog and cleanup audit fixtures (53db3a4)
- regenerate tool and evidence catalogs (2f604a3)
- regenerate tool and evidence catalogs (f2bbd59)
- tools: clarify complete inline results (3b64c81)
- tools: clarify complete inline workflows (4168174)
- tools: describe uncapped tool behavior accurately (4cea84d)
- tools: update inline workflow guidance (4ad937c)
Tests
- artifacts: exercise argument-free extraction preflight (a6d5b3e)
- browser: assert strict inputs without legacy fields (9ddf22e)
- browser: cover complete screenshot output (3f547ea)
- browser: remove stale input field assertion (60c110d)
- cli: consolidate duplicate setup journey (9bd7e2c)
- cli: remove duplicate browser discovery case (dcb0362)
- conformance: remove fixture generator test option (ea853ce)
- contracts: remove duplicate tool inventories (0ae3c08)
- hopper: name regex search assertion accurately (9240bd8)
- hopper: remove dossier identity assertion (b5c0b5b)
- mcp: align workflow assertions with current guidance (f8bb113)
- mcp: consolidate catalog inventory checks (3afcd64)
- mcp: validate defaults at tool boundary (21241d2)
- remove duplicate export schema acceptance (b783e7f)
- remove obsolete schema version assertions (fe342fa)
- remove stale limits and handoff expectations (acf33d6)
- remove vacuous and duplicate assertions (56e2bf7)
- remove Vitest config test exports (d6e545c)
- replace brittle workflow and readme checks (b3529aa)
- replace implementation lock-in with behavioural assertions (#498) (7ee3f23)
- replay: remove duplicate schema coverage (4ec2343)
Downloads
-
rea-agents: v3.1.0 Stable
2026-08-09 14:47:06 -05:00 | 3018 commits to main since this release📅 Originally published on GitHub: Sun, 09 Aug 2026 19:47:26 GMT
🏷️ Git tag created: Sun, 09 Aug 2026 19:47:06 GMT3.1.0 (2026-08-09)
Features
Bug Fixes
- ci: guard Release Please PR branch parsing (84cc819)
- ci: guard release PR branch parsing (6838b6b)
- harden evidence lifecycle and MCP contracts (5155924)
- harden structured configuration comparisons (#467) (6901edc)
- npm: preserve explicit setup versions (#465) (1783bf6)
Code Refactoring
Documentation
Downloads
-
rea-agents: v3.0.0 Stable
2026-08-02 11:23:01 -05:00 | 3029 commits to main since this release📅 Originally published on GitHub: Sun, 02 Aug 2026 16:23:15 GMT
🏷️ Git tag created: Sun, 02 Aug 2026 16:23:01 GMT3.0.0 (2026-08-01)
⚠ BREAKING CHANGES
- export_evidence_bundle now requires a filesystem path and no longer returns an inline bundle.
Features
- make evidence bundles canonical MCP resources (1712e6d)
Bug Fixes
- address MCP resource review feedback (f3b3fb0)
- align aggregate tools with session capabilities (ede91ff)
- ci: align Vitest project worker budgets (f47ee1a)
- ci: allow documented public type aliases (97f6a0f)
- ci: make coverage report merging composable (788f405)
- ci: stabilize Vitest project routing and shards (f07acde)
- errors: preserve actionable analysis diagnostics (0f96bf3)
- mcp: clarify routing and advertise input examples (969519c)
- mcp: clarify target routing and caller diagnostics (3e1e8cd)
- test: bound boundary worker pressure (935721d)
- test: honor boundary ownership and public aliases (92a1c33)
- test: retain subprocess coverage and cleanup (7f46bb1)
- test: retain subprocess coverage and cleanup (dae2b9c)
- test: stabilize boundary timing (f0d8cda)
- verify: follow dynamic Hopper tool availability (281e41f)
Code Refactoring
- preserve provider-neutral runtime seams (a8161f0)
Documentation
- document resource snapshot workflow (2a45d8d)
- refresh generated SDK metadata (c824db1)
- refresh managed completion manifest (59d4659)
Tests
- contracts: cover validation branches (8ccdb33)
- derive MCP SDK identity expectations (ab4193c)
- eval: cover navigation and address tool routing (ba098f2)
- overhaul deterministic suite architecture (48053d1)
- overhaul deterministic suite architecture (513d9b1)
- package: verify npx upgrade on published releases (7b6f7be)
- package: verify npx upgrade on published releases (1f8ad7b)
Continuous Integration
- document deterministic suite ownership (3c42403)
Downloads
-
rea-agents: v2.7.0 Stable
2026-07-28 02:02:26 -05:00 | 3062 commits to main since this release📅 Originally published on GitHub: Tue, 28 Jul 2026 07:02:39 GMT
🏷️ Git tag created: Tue, 28 Jul 2026 07:02:26 GMT2.7.0 (2026-07-28)
Features
- bytecode: add JVM and Python bytecode providers (1a75f8d)
- bytecode: add JVM and Python bytecode providers (4e0127d), closes #367
- conformance: add portable conformance export package format (91fb87d)
- conformance: add portable conformance export package format (4ee30e4)
- metadata: add deeper ObjC/Swift metadata and database save/licensing (4602efd)
- metadata: add deeper ObjC/Swift metadata and database save/licensing (d7a0753), closes #353
- mobile: add Android APK/AAB/DEX and iOS IPA static investigation providers (18624df)
- mobile: add Android APK/AAB/DEX and iOS IPA static investigation providers (fdeeb27), closes #366
- package: add MSIX/MSI/AppX package, resource, and signature analysis (0ef1b91)
- package: add MSIX/MSI/AppX package, resource, and signature analysis (6c03f83), closes #363
- pe: add broader PE/COFF/PDB static inspection (f942558)
- pe: add broader PE/COFF/PDB static inspection (94e6600), closes #362
- process: replace procfs sampling with event-backed process-tree capture (a5e355a)
- process: replace procfs sampling with event-backed process-tree capture (d5d2e56), closes #332
- protocol: add custom TCP/UDP/IPC/XPC and auth-flow capture (1fb22b4)
- protocol: add custom TCP/UDP/IPC/XPC and auth-flow capture (6fa6f9b), closes #365
- protocol: add gRPC/Protobuf and JSON-RPC/MessagePack capture (54153ed)
- protocol: add gRPC/Protobuf and JSON-RPC/MessagePack capture (3f336fe), closes #364
Bug Fixes
Downloads
-
rea-agents: v2.6.0 Stable
2026-07-26 11:00:35 -05:00 | 3088 commits to main since this release📅 Originally published on GitHub: Sun, 26 Jul 2026 16:00:45 GMT
🏷️ Git tag created: Sun, 26 Jul 2026 16:00:35 GMT2.6.0 (2026-07-26)
Features
- complete evidence-backed roadmap workflows (1a0931b)
- hopper: report bridge progress diagnostics (7a43420)
- native: inspect API boundaries with evidence (521139d)
Bug Fixes
- setup: refresh stale local npx bootstrap (6d37efe)
- setup: refresh stale local npx bootstrap (90bb161)
Performance Improvements
Tests
Downloads