mirror of
https://github.com/morluto/rea.git
synced 2026-10-18 20:10:13 -05:00
-
rea-agents: v5.0.0 Stable
dean released this
2026-10-07 12:26:36 -05:00 | 2455 commits to main since this release📅 Originally published on GitHub: Wed, 07 Oct 2026 17:26:47 GMT
🏷️ Git tag created: Wed, 07 Oct 2026 17:26:36 GMT5.0.0 (2026-10-07)
⚠ BREAKING CHANGES
- native: preserve incomplete native UI captures (#991)
- android: Android analysis now requires a full JDK 17 or newer with its compiler module for the packaged Java source bridge.
Features
- apple: project macOS bundle anatomy in application graphs (88c940b)
- apple: project macOS bundle anatomy in application graphs (dd3e7ae)
- application: wire Android and Apple inventory graph tools (#852) (e0fd820)
- browser: attribute native execution and listener sources (#917) (b5afa5f)
- browser: capture correlated network content and lifecycle evidence (#797) (f9eaf05)
- browser: trace captured website module imports (#879) (01be082)
- browser: trace captured website source-map locations (#897) (f430c41)
- javascript: recover readable modules with Wakaru (#848) (166dcd2)
- native: decode chained fixups, binds, ObjC categories and properties (a657557)
- native: decode chained fixups, binds, ObjC categories and properties (3e24a72)
- native: open iOS-style and iOS-on-Mac wrapper app bundles (2ed89e6)
- native: open iOS-style and iOS-on-Mac wrapper app bundles (aeebba3)
- web: export captured scripts for JavaScript application analysis (#801) (472b72a)
- website: add a shared back-to-top link (5047373)
- website: introduce REA and the DX-Ball reconstruction (#906) (4e3953c)
Bug Fixes
- address review nits from batch integration follow-ups (#818) (5a0e0ba)
- android: align runtime suffix inference (#977) (fb3749a)
- android: bound fragmented JADX MCP frame memory (#937) (9e39795)
- android: preserve JVM settings and reuse metadata sessions (#908) (eab34a9)
- apple: attribute only application-root components in macOS inventories (5524970)
- apple: count only real framework version directories (2e81e86)
- apple: pair bridge hypotheses within one application root (7acf4e7)
- apple: pair bridge hypotheses within one application root (9226ade)
- apple: traverse keyed archive hierarchy collections (#976) (71ac83f)
- artifacts: accept APFS image disks ejected with their container (d93ebec)
- artifacts: accept APFS image disks ejected with their container (b72c079)
- artifacts: accept the bundle subject when extracting an app bundle (#891) (37d2eba)
- artifacts: decode flat keyed-archive NIBs with data and shared references (b3f013f)
- artifacts: decode flat keyed-archive NIBs with data and shared references (2a4667b)
- artifacts: harden reader lifecycle boundaries (#951) (2366bda)
- artifacts: keep the post-snapshot detach check out of provenance (62634e4)
- artifacts: preserve reader failure diagnostics (#987) (fc4a9a0)
- artifacts: project compiled AppKit actions from the control to its target (b08228d)
- artifacts: project compiled AppKit actions from the control to its target (#905) (900d7c8)
- artifacts: project UIKit runtime outlet and event connections (aa8082e)
- artifacts: project UIKit runtime outlet and event connections (8b24387)
- artifacts: read AppKit connectors from flat keyed-archive NIBs (#900) (27c272b)
- artifacts: read keyed archive dictionaries keyed UID as dictionaries (cfd2b0c)
- artifacts: read keyed archive dictionaries keyed UID as dictionaries (35c82b9)
- artifacts: report which path constraint failed (#847) (3f1a77f)
- browser: distinguish computed call keys from identifiers (#808) (02beb74)
- browser: distinguish WebMCP registration frame owners (#813) (b3b44d8)
- browser: fingerprint cookies at the selected page URL (#763) (78014e3)
- browser: identify NodeNext TypeScript original source artifacts (#811) (e84ad86)
- browser: preserve evidence through deep AST analysis (#924) (f826aa8)
- browser: preserve form destinations and satisfies mutation uncertainty (#825) (6dd719e), closes #820
- browser: preserve Link header value delimiters (#805) (dd36405)
- build: validate installed dependencies before cache hits (#982) (a45fe86)
- capture IndexedDB object-store record fingerprints (#809) (21a8bd0)
- cli: align structured output guard with native flags (#777) (e9fac56)
- cli: emit empty structured filter projections (#914) (2db668f)
- cli: honor the selected native plist path (#773) (0374865)
- cli: preserve output and comparison input validation (#981) (d5c43d6)
- cli: preserve unsupported historical-source imports (#795) (911d580)
- contracts: align CLI/MCP boundary contracts (#946) (4a60738)
- deps: remediate smol-toml advisories (93091ab)
- deps: remediate smol-toml advisories (c55ae3b)
- dotnet: compare members with undecoded signatures by exact identity (28fd49f)
- dotnet: compare members with undecoded signatures by exact identity (d52af3b)
- dotnet: inspect native boundaries of non-managed and malformed PEs (d5f28fb)
- dotnet: inspect native boundaries of non-managed and malformed PEs (d98dcfa)
- dotnet: keep a decoded member unknown beside an undecoded counterpart (76b7020)
- dotnet: keep admitted CLI header facts when metadata is unreadable (e5ba693)
- dotnet: name the shared key in exact-signature ambiguities (7714e76)
- dotnet: treat ambiguous undecoded members as possible counterparts (73370e1)
- errors: report union input issues at the union's path (bddeb63)
- evaluation: canonicalize Unicode argument keys (#980) (0a4caf4)
- firmware: accept the verified Binwalk and Unblob release lines (#844) (bef4321)
- firmware: retain multi-file extraction failures (#978) (8aaf9a1)
- ghidra: admit the 12.1 line and the install's JDK range (#840) (5cbf06c)
- ghidra: select exact packaged bridge scripts (#800) (894c30e)
- ida: share concurrent session cleanup (#950) (f14b6a8)
- installer: validate exact semantic versions (#954) (248972f)
- integrate 24 reviewed browser/native/semantics corrections (#815) (3af3811)
- javascript: advertise the exact empty seed rule and match empty API keys (35e5508)
- javascript: analyze source maps with empty source names (58ef8ac)
- javascript: analyze sources containing empty string literals (e7cbfe0)
- javascript: analyze sources containing empty string literals (11fc3b9)
- javascript: filter keyed-collection receivers only for get/delete (00f707b)
- javascript: handle deep AST traversal and addition without stack overflow (#915) (62b3711)
- javascript: handle deep static member paths (#939) (348c65c)
- javascript: keep bare relative URLs for computed-method XHR (e32028d)
- javascript: keep computed-method XHR request URLs (602d002)
- javascript: keep exact empty env keys and method names (522c2d0)
- javascript: keep exact empty env keys and method names (f7954a8), closes #783
- javascript: keep exact empty require paths and request fields (ad1f6b5), closes #783
- javascript: keep exact empty values in graph identities (f608127)
- javascript: keep exact empty values in graph identities (63012ee)
- javascript: keep keyed-collection reads out of endpoints (9075ce7)
- javascript: keep keyed-collection reads out of endpoints (eb68761)
- javascript: keep literal HTTP methods on storage-named receivers (9f48a76)
- javascript: keep literal-method and URL-literal requests on aliased receivers (e3e7664)
- javascript: keep mutated object initializer values unknown (#752) (6caa38a)
- javascript: keep storage open versions out of XHR endpoints (4f51103)
- javascript: keep storage open versions out of XHR endpoints (898b0f6)
- javascript: keep XHR and client endpoints that receiver spellings hid (05f43ed)
- javascript: leave empty application values unlabeled (527b76e)
- javascript: match exact empty literal channels and seeds (e20da1f)
- javascript: never read window or document open as XHR (ae849a7)
- javascript: preserve computed Electron member uncertainty (3a4a63f)
- javascript: preserve computed Electron member uncertainty (1260cac)
- javascript: project decoded file URL paths (#810) (2572e1e)
- javascript: read open() endpoints only from XHR method/URL pairs (63e0822)
- javascript: read open() endpoints only from XHR method/URL pairs (1be3705)
- javascript: read substitution-free templates as exact strings (c371d6e)
- javascript: read substitution-free templates as exact strings (77cf757)
- javascript: resolve bare source-map and worker URLs next to the script (#890) (45fcd28)
- javascript: retain recovered call argument positions (#929) (e6ba9c3)
- linux: improve Hopper reliability and CachyOS support (#963) (98b2b02)
- mcp: advertise reserved process environment key (#949) (e0d76ae)
- mcp: isolate optional observation adapter failures (#838) (be3cfbf)
- mcp: preserve exact guided prompt context (#761) (66c26f2)
- native-ui: handle incomplete accessibility child collections (#944) (ac3bae3)
- native: inspect plists containing data, dates, and non-finite reals (bc2cd8b)
- native: inspect plists containing data, dates, and non-finite reals (5ead2cf)
- native: keep echoed codesign paths out of signature fields (#865) (4aa2b60)
- native: keep echoed Mach-O paths out of load commands and symbols (ab985c6)
- native: keep echoed Mach-O paths out of load commands and symbols (37fe105)
- native: keep integral plist reals beyond the JSON range as reals (#860) (3b92a2b)
- native: keep plist XML element types for large numbers (f85056d)
- native: keep the resolved bundle plist and permission failures (418a556)
- native: pass Swift symbols to swift-demangle as operands (dd90965)
- native: pass Swift symbols to swift-demangle as operands (6c88094)
- native: preserve incomplete native UI captures (#991) (9f496ef)
- native: report exact plist integers beyond the JSON number range (c9f49db)
- native: report exact plist integers beyond the JSON number range (430c297)
- native: report plist permission denials as access failures (5738a0c)
- native: report why a selected plist cannot be inspected (14f9b3d)
- native: report why a selected plist cannot be inspected (0674fac)
- plist: keep character references beyond Unicode literal (5afd8a8)
- plist: read XML plists containing a proto key (faaee69)
- plist: read XML plists containing a proto key (a08be51)
- plist: report omitted proto entries in signatures and Interface Builder (15ab5db)
- plist: report omitted proto entries in signatures and Interface Builder (6729ee7)
- preserve native UI failure reasons and dedupe version literals (#854) (2d4a910)
- process: clarify Windows capture support and recovery (#798) (50787b2)
- process: harden filesystem snapshot identity and cancellation (#956) (93aa9eb)
- process: retain provider output until streams close (#928) (b929251)
- reference: retain partial imports for unreadable directories (#766) (cffc548)
- release: drive checkpoint releases from frozen branches (fc58fa1)
- release: publish from explicit source checkpoints (49887f0)
- semantics: isolate named function expression bindings (#776) (ae81f64)
- semantics: preserve direct promise ownership boundaries (#758) (e1ca412)
- semantics: preserve empty string property keys (#764) (630bdaf)
- semantics: recognize Node builtin default namespaces (#769) (24a0bf9)
- semantics: retain trailing rest argument flows (#756) (4bfd803)
- setup: accept the pinned Hopper RPM launcher (#933) (dda8e6a)
- setup: read an OpenCode V2 server named type as a table entry (#866) (4e17be5)
- setup: register OpenCode V2 configurations in mcp.servers (957069d)
- setup: register OpenCode V2 configurations in mcp.servers (69d8afe)
- target: decode app Info.plist executables with an XML parser (c57f1b7)
- target: decode app Info.plist executables with an XML parser (c182f72)
- test: disconnect Hopper fixture IPC on SIGTERM (b912b11)
- windows: accept ordinary drive path separators (#791) (b62931f)
- windows: remove cancelled snapshot outputs (#957) (d76f7d1)
Performance Improvements
- artifacts: stream ASAR members without full buffering (#962) (abd7a5e)
- call-path: prune dead ends and enumerate without recursion (#909) (e52fe97)
- cli: defer catalog digests and use canonical cache scope (9a15525)
- cli: defer unused catalog work during command startup (#920) (9a15525)
- comparison: reuse canonical sort keys (#990) (ebb065e)
- dotnet: index declaring-type ranges once per metadata table (#918) (7a9f587)
- dotnet: index ordered declaring-type ranges once per table (7a9f587)
- evidence: scale imports and dependency graphs (#941) (7dc40d3)
- inspector: bound runtime script location authorization (#945) (58381ee)
- javascript: analyze member chains without recursive copying (#932) (dcde958)
- javascript: index Promise return-site ownership (#971) (2cedde9)
- javascript: index semantic fingerprint relations (#942) (c92a344)
- javascript: reduce analysis and source-map work (#955) (c7530f9)
- providers: assemble fragmented responses once per line (#911) (df7151b)
- reconstruction: index coverage evaluation (#983) (f26c8b5)
- setup: reuse initial diagnostics during planning (#940) (118d43e)
Code Refactoring
- add incremental capability migration safeguards (#819) (75f50d8)
- android: group layered source and verification (#873) (8e8921d)
- apple: group artifact producers and verification (#952) (ef1a0cc)
- artifacts: isolate JavaScript file acquisition (#916) (f0a68dc)
- binary: group session selection and snapshot ownership (#886) (dd114d3)
- binary: move production composition outside application workflows (#965) (33d4761)
- browser: align inspector exclusions with canonical vocabulary (#834) (de9593a)
- cli: split core analysis command registrar (#858) (8b9940a)
- colocate investigation record implementation (#867) (bb19c94)
- compose investigation record ownership (#845) (ce73c3f)
- declare auxiliary capabilities from source (#853) (4a6c17c)
- domain: consolidate property-key extraction behind semanticStaticPropertyKey (#823) (764ff05)
- domain: converge comparison mechanics on shared vocabulary (#824) (c13c9d4)
- domain: extract artifact path syntax helpers (#830) (ef535b8)
- domain: extract source-map envelope walk and disambiguate stringValue (#828) (64ebdf4)
- domain: map validation taxonomies and add inventory Result seam (#833) (78f4848)
- domain: split Interface Builder keyed-archive parse from graph builder (#859) (da09706)
- firmware: group layered source and verification (#878) (507e8b3)
- ghidra: extract createClient and load-image attestation (#856) (b7df5b7)
- give Inspector its own capability directory (#869) (021ba69)
- javascript: group application workflows and verification (#896) (0804722)
- javascript: group domain semantics and contracts (#907) (f6a58f1)
- managed: group capability workflows and verification (#926) (28713f9)
- native: group analyst semantics workflows and contracts (#973) (ea4db4c)
- native: split Apple dispatch metadata decode facets (#855) (676959e)
- provider: declare deep capabilities from source (#892) (b808e2d)
- share Android and firmware provider factories (#826) (3ed59b2)
Documentation
- add concise lawful-use disclaimer (#888) (4037c65)
- add DX-Ball reconstruction showcase (#876) (895079d)
- add prominent website and showcase links to READMEs (2ccc86c)
- add README star history chart (#850) (11f27de)
- add website and showcase links to READMEs (#930) (2ccc86c)
- apple: describe directory-based framework plist ambiguity (6d74992)
- audit and improve localized readmes translations and wording (00a6ac3)
- clarify NativeAOT scope and regenerate conformance ledger (c945931)
- fix stale IDA roadmap item, mermaid paths, toolchain wording (d2aed17)
- move quick start up and mark skill install optional (554e9b1)
- note Cloud Agent Node.js toolchain (#837) (6aa6350)
- publish VitePress documentation on GitHub Pages (c78fe69)
- separate ambiguous and unavailable provider recovery (c3f2b8e)
- show task-scoped readiness and provider preference in the quick start (880cca1)
- show task-scoped readiness and provider preference in the quick start (5fd0db3), closes #726
- update release boundary to npm 4.1.0 with Windows native bundle (69be514)
- website: add Notion case study and improve onboarding (a6ba772)
- website: add TH04 bullet-ring case study (f8d84da)
- website: add worked guides and keep Pages publishing manual (#925) (4f25ee3)
- website: clarify guides and case studies (5065fcd)
Tests
- artifacts: report compiled connector records when a storyboard route is missing (d421d3f)
- artifacts: report observed action routes when a compiled route is missing (c60b737)
- artifacts: write the storyboard fixture's action in Cocoa syntax (53bfa7e)
- eliminate fixture races and prune redundant scaffolding (#849) (f72931d)
Continuous Integration
Downloads