starred/rea
1
0 Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-10-18 20:10:13 -05:00
Code Issues Packages Projects Releases 10 Wiki Activity
Files
main
rea/CHANGELOG.md
T
github-actions[bot]andmorluto 27dc42d102 chore(release/6.7.0): release rea-agents 6.7.0 (#4983) 
* chore(release/6.7.0): release rea-agents 6.7.0

* docs(release): finalize frozen 6.7.0 contribution notes

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-18 15:40:45 +08:00

398 KiB
Raw Permalink Blame History

Changelog

6.7.0 (2026-10-18)

Highlights

  • Client configuration edits follow the duplicate-member semantics used by MCP clients.

Changes

Fixes

  • Client configuration: Setup edits the last repeated JSON/JSONC member, matching the value clients actually read. Setup and uninstall refuse a removal that would reactivate a shadowed duplicate, preserving the original configuration. (#4957, morluto/rea#4952). Thanks @kaoru0822-kitauji, @xu91102.

Full contribution record: 4 commits and 1 merged PR.

6.6.0 (2026-10-18)

Highlights

  • Add Kuna as a caller-supplied static-analysis provider.
  • Query selected JavaScript facts and multiple APK locale tables without repeating the underlying analysis.
  • Extend Ghidra analysis to Windows ARM PE targets and explicit raw m68k images.
  • Preserve completed Evidence, cancellation reasons and retryable cleanup across provider and CLI finalization.

Changes

  • Kuna analysis: Use a caller-installed Kuna for procedure listings, pseudocode, assembly, call relationships, exact-address xrefs and cached string searches. Project exports retain source spans and digests; repeated requests reuse completed work. Recorded real-provider coverage uses Kuna 1.833 on Linux; Windows, PE and universal Mach-O are unsupported. See the provider guide. (#3832, #3854, #4071, #4095). Thanks @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0.
  • Retained JavaScript facts: Query exact application paths, selected properties and filtered module references through inspect_analysis_view, with paging and complete row Evidence. These views reuse completed analysis and preserve source selection and unknown coverage. (#4265, morluto/rea#4190, #4097, morluto/rea#4092). Thanks @kaoru0822-kitauji, @N0zoM1z0.
  • APK locale tables: Request several resource locales in one decode with repeatable CLI --locales or MCP locales. Each table reports its status and coverage; existing single-locale fields remain available. (#4804, morluto/rea#4777). Thanks @abhay-2108, @N0zoM1z0.
  • Windows ARM binaries: Ghidra admits ARMNT/Thumb-2 and ARM64 PE applications and DLLs on the Windows x64 host lane. Recorded Ghidra 12.1.4 verification uses WindowsResourceReference disabled and raised startup budgets; default-analyzer completion, ARM64EC/ARM64X and Windows-on-Arm hosts remain unverified or unsupported. See the exact scope. (#3965, morluto/rea#2186). Thanks @N0zoM1z0, @WestLabsAI.
  • Raw m68k images: Analyze explicitly selected big-endian m68k raw binaries using Ghidra’s fixed 68000 profile and a caller-supplied aligned entry. Real CLI/MCP verification used Ghidra 12.1.4 on macOS arm64; Linux is unverified and Windows P0 does not admit m68k. See mapping requirements. (#4018). Thanks @icedac.
  • JADX deadlines: Set REA_JADX_OPERATION_TIMEOUT_MS to extend APK loading and upstream operation deadlines together. Doctor reports the effective value and setup forwards an explicit selection. (#4466, morluto/rea#3918). Thanks @jaychou813, @SandstromPL.
  • Electron window options: Resolve stable local constant BrowserWindow options while retaining source provenance. Relevant writes and escapes keep the result unknown. (#4400, morluto/rea#4366). Thanks @kaoru0822-kitauji, @N0zoM1z0.
  • Language editions: Add the Greek website edition and Malayalam documentation, with Korean typography and translation corrections across the site. (#3520, #4792, #3821, morluto/rea#3820, #3799, morluto/rea#3798, #4344, #3856, #4166). Thanks @gensokyo-dev, @hi2242, @kalayciburak, @kaoru0822-kitauji, @kraken-503, @kukinghan, @N0zoM1z0, @yeseong0412.

Fixes

  • Cancellation and cleanup: Keep completed observations, exact cancellation reasons and the original physical failure through finalization. Failed cleanup retains its process or file owner for retry; recovered resources disappear from pending-cleanup reports without replacing the original error. (#4238, morluto/rea#4232, #4274, morluto/rea#3923, 3e82366, 16924e2, bbfe6ed, 1f23e97, 08fbeb8). Thanks @coygeek.
  • Provider startup: Join prerequisite probes and in-flight readiness work before shutdown, preserve typed timeout and JVM-memory failures, and retain startup diagnostics through cleanup. Ghidra recognizes keg-only Homebrew JDKs and names the setting responsible for a startup timeout. (376eeca, ceeff5a, 3ad1032, 964decd, 3fa972a, #4557, morluto/rea#4556, #4590, morluto/rea#4241). Thanks @DanielCvz1, @J0UH, @Rinkia, @RishTheFish21, @vadlachary2002.
  • Client configuration: Preserve the selected launcher, destination file, caller timeout choices and unresolved configuration evidence. Setup/uninstall recovery stays bound to the exact published file, keeps current verified backups, and transfers failed cleanup ownership for retry. (d0253c9, 7e4eed9, 2fb5e20, 8235210, d818c3d, 19329e4, dadf909, 333e0ab, c15c206). Thanks @Adolanium.
  • Configuration formats: Read signed 64-bit TOML integers without rounding, handle large TOML documents without argument-spread failures, preserve JSONC trivia and Hermes YAML scalar text, and reject NUL bytes in registration environment values. (#4937, morluto/rea#4917, c43bc0b, 4fd28fc, #3568, #4335). Thanks @alfredo1491, @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0, @ShuaixinHuang, @xu91102.
  • Claude Code configuration: Setup, doctor and uninstall now accept only the strict JSON format Claude Code reads, including a leading UTF-8 BOM. Comments and trailing commas are refused before backup or writing; clients that support JSONC retain their existing behavior. (#4944, morluto/rea#4940). Thanks @kaoru0822-kitauji, @xu91102.
  • CLI output and dispatch: Accept --flag=value and spaced global output values, keep array positions in filtered JSON, validate integer tokens before coercion, and exit quietly when the output reader closes. Cancellation remains effective through command finalization; app bundles and static native inspections select the intended workflow. (#3811, #4823, 2ae4e16, 8d82579, #3781, 279c590, #3511, morluto/rea#3321, f31b231). Thanks @arjunprabhulal, @coygeek, @kaoru0822-kitauji, @ShuaixinHuang, @Sriram-PR, @Tapraj-Pathak.
  • Updates: Route --update through the verified updater and bound retained package-manager diagnostics. (4f7b5fb, 01cdbbd).
  • MCP contracts: Advertise self-contained tool inputs while preserving tuple, array, Boolean and nested-JSON constraints across schema profiles. Schema-reference handling no longer rewrites literal metadata; catalog identity includes the output-schema profile. (5e30969, 10aa74d, 204b9f3, b3389a5, a2e3016, ba98130, c5fb86d). Thanks @akushonkamen, @HarsH-1877, @kaoru0822-kitauji, @xingzihai.
  • Session ordering: Keep snapshot admission ahead of later calls on the same connection, retain shutdown signals until cleanup succeeds, and preserve inspection authority through investigation publication. (#3661, morluto/rea#3334, 8873b39, 663d07f). Thanks @coygeek, @rudycelekli, @Swatantra-66.
  • JavaScript exports and resolution: Retain CommonJS exports created with Object.defineProperty and track export receiver lifetimes. Resolve scoped packages, package main, JSON requires and .mts/.cts imports using the owning loader; overwritten require bindings and erased type-only imports no longer create false runtime links. (#4725, morluto/rea#4724, #3567, morluto/rea#3541, #4838, morluto/rea#4632, #3844, morluto/rea#3383, #4164, morluto/rea#3915, #4223, #3801, morluto/rea#3393, #4165, morluto/rea#3932). Thanks @Abishek0070, @coygeek, @JNTMTMTM, @kaoru0822-kitauji, @prasad2512, @rodricksz4h5, @xu91102.
  • JavaScript value flow: Preserve values captured before later assignments, guarded factory fallthrough and nested destructuring. Track exact property keys and setter writes; direct eval, compound assignments and incoming callbacks preserve unresolved effects instead of inventing certainty. (#4196, morluto/rea#3881, #4341, morluto/rea#3963, bfb7ed0, #3480, #3831, morluto/rea#3312, 9ac76d3, #4342, morluto/rea#4206, #4243, morluto/rea#3880). Thanks @coygeek, @kaoru0822-kitauji, @maxazure, @N0zoM1z0, @ShuaixinHuang.
  • JavaScript relationships: Distinguish Map reads from network endpoints, associate response endpoints only with writes that reach the read, and preserve child-process receiver ownership and effective stdio choices. Version comparisons keep relocation and unknown relationships distinct from application changes. (fbfdb6a, #4759, morluto/rea#4606, #3819, morluto/rea#3362, #4336, morluto/rea#3355, 556504e, 4d980d0). Thanks @Abdooo2235, @coygeek, @kaoru0822-kitauji, @Xinglan233.
  • JavaScript source admission: Parse JavaScript with its own grammar, refuse FIFO recovery inputs without blocking, and report oversized or resource-skipped files with their actual capacity and coverage state. Malformed runtime events stay excluded rather than becoming policy-filtered facts. (#3782, morluto/rea#3780, #3788, morluto/rea#3332, #4757, morluto/rea#4629, #3852, morluto/rea#3670, #4755, morluto/rea#4685). Thanks @andresaragon, @coygeek, @kaoru0822-kitauji, @sx4im.
  • Browser capture: Bound CDP handshakes and command responses, preserve malformed inventory uncertainty and partial cleanup diagnostics, and report cancellation after content reads and final cleanup. Accessibility comparisons require observed coverage; attached emulation teardown limits remain explicit. (#3555, morluto/rea#3553, #3901, morluto/rea#3379, 4cc044b, #4406, morluto/rea#4403, #2893, 0123d59, 2ff0867). Thanks @coygeek, @dakjdakd, @kaoru0822-kitauji, @maxazure, @N0zoM1z0, @YunzhouLi-hub.
  • Browser page facts: Preserve URL path bytes when removing credentials, repeated document Link headers and complete COOP/COEP structured items. WebMCP discovery reads the actual schema properties and exact receiver path. (#4731, df2fc25, c360cfc, ebd5a82, 38f92d1). Thanks @Abdooo2235, @geekwolf, @ShuaixinHuang.
  • Electron runtime capture: Keep native IPC listener and one-shot dispatch behavior, block synchronous shell effects during capture, refuse active scenarios when the inspect fuse is disabled, and preserve fuse/transport cleanup ownership. (#4389, morluto/rea#4390, #4605, morluto/rea#4593, #4562, morluto/rea#4393, #3605, morluto/rea#3453, f9de413, e7df00e). Thanks @Adolanium, @gensokyo-dev, @gkobayashi0, @HarsH-1877, @kaoru0822-kitauji, @keeponlight, @N0zoM1z0, @Nitin13-git, @xu91102.
  • APK resource accuracy: Retain completed tables and decode facts after interrupted or failed reads. Derive locale limits from resource configuration fields, disclose unselectable qualified tables, distinguish document failures from omitted entries, and bind Evidence to the decoded snapshot. (34a88d6, f5fcf52, 6385ef4, 98886ad, dc2e811, #4771, morluto/rea#4768). Thanks @abhay-2108, @gensokyo-dev, @Iyanuoluwa007, @kaoru0822-kitauji, @N0zoM1z0.
  • Apktool guidance: Retain the observed version and disclose the matching platform/release advisory windows without treating a version string as proof of decoder safety. Missing prerequisites and decode refusals identify the selected APK or launcher. (d38f099, 63696d2, cc038da). Thanks @GovinduSasanka, @peter-research.
  • Android method bodies: Recover original bytecode bodies when Java source is omitted while preserving genuine native/abstract body absence and primary failures during retryable cleanup. (63c65a2, 742b6f5, 9fa6d2b). Thanks @balkan16, @Chessing234.
  • ADB observations and transfers: Preserve display-scoped focus, distinguish missing declarations from absent focus, retain numeric physical density and mark unknown permission coverage partial. Transfers use consumed snapshot identity and refuse unknown destination existence; uninstall requests explicitly select user zero. (7086768, 3d028db, #4074, morluto/rea#3942, #4663, #4665, 1342127, 61e6880, be0b2d1). Thanks @Copilot, @coygeek, @gongfpp, @Tapraj-Pathak, @yankikucuk.
  • Apple metadata: Preserve exact plist/keyed-archive integers, negative zero, non-finite real identity and dictionary keys. Reject malformed XML before value decoding, retain undecodable dates as unknown and report unsupported OpenStep entries explicitly. (#4324, morluto/rea#4292, 2cf9c28, #4839, morluto/rea#4834, f2b7bbb, 6c98708, 78cf610, c7e9e09, #3793, #4105, morluto/rea#3892). Thanks @coygeek, @kaoru0822-kitauji, @mertkayacs, @pablodiazjorge, @pollychen-lab, @xu91102.
  • Apple application structure: Derive bundle components and launchd domains from their owning directories, retain unavailable components, and select only exact Assets.car names as asset catalogs. Interface Builder keeps unresolved classes and counts hierarchy records beyond the returned object page. (149a0fc, 5d6029e, c192c58, #4094, morluto/rea#3914, #4118, morluto/rea#3958, #4162, morluto/rea#3950). Thanks @coygeek, @kaoru0822-kitauji.
  • Native names and layout: Keep valid Objective-C records beside malformed neighbors, preserve leading U+FEFF and repeated load-command fields, and select exact arm64e.x1 slices. PE resource ownership and NativeAOT reads stay within declared image/header ranges. (#3833, morluto/rea#3336, #4549, morluto/rea#4540, morluto/rea#4541, #4730, #4048, morluto/rea#4008, #3500, morluto/rea#3389, #4463, morluto/rea#4373, morluto/rea#4455, 3fc0075, 4a076f3). Thanks @coygeek, @Iyanuoluwa007, @jayinvers, @kaoru0822-kitauji, @kevinjosh10, @maxazure, @ShuaixinHuang.
  • Native analysis providers: Keep Ghidra byte matches within examined coverage, retain PE PDB/function-boundary limitations and preserve configured MIPS choices. Attached IDA refuses universal Mach-O rather than silently choosing a slice; request timeout identity and captured output survive adapter handling. (#4531, #2933, morluto/rea#2259, 01a1b3f, 50dd9fc, #4765, morluto/rea#3871, c0cfccb). Thanks @BeLit-Development-2, @coygeek, @kaoru0822-kitauji, @N0zoM1z0, @ShuaixinHuang.
  • Recorded crashes: Prevent GDB from discovering an executable named by an untrusted core, reject core mapping paths that escape the isolated sysroot, and preserve pwntools worker ownership across launcher exec. Completed decode facts and cancellation reasons remain available through failed final cleanup. (5bf4fff, b33c0df, #4435, morluto/rea#4011). Thanks @coygeek, @N0zoM1z0.
  • Cutter and Rizin: Read Cutter’s active document from core configuration and attribute its host version correctly. Keep interrupted Rizin frames and output whitespace before completion markers, with exact command and cleanup failure attribution. (#4507, morluto/rea#4497, #4514, morluto/rea#4498, #4459, morluto/rea#4015, d5fc7e6, 199396f). Thanks @coygeek, @N0zoM1z0, @Xander-AJ.
  • Windows cleanup: Retain unpublished runtimes after failed removal, handle read-only attributes and sharing conflicts, preserve primary snapshot failures and honor caller environment overrides. (f78d137, d69acc3, 0679a79, 5f9ac2c, 1bbf4bd). Thanks @DeryFerd.
  • Managed metadata: Compare nominal signatures and declaring identities across builds, preserve empty names without display substitutions, verify ABI-prefixed Mach-O exports exactly, and charge cached metadata once. Metadata errors report artifact file offsets; mixed-mode assemblies retain their actual boundary classification. (#3059, #3079, #3853, morluto/rea#3352, #3974, morluto/rea#3961, #3491, morluto/rea#3449, #4418, morluto/rea#4372, #3516, morluto/rea#3366). Thanks @8rulerstar, @coygeek, @duckhunt113, @Hahaa909, @JayOfTheKeyboard, @kaoru0822-kitauji, @keeponlight, @N0zoM1z0, @tomyrms.
  • Archive and filesystem identity: Reject colliding extraction paths before writing, classify ZIP offsets beyond EOF as malformed, normalize ZIP current-directory prefixes once, and preserve symlink and unreadable-path provenance. A directory named *.map is no longer mistaken for a source-map file. (862a0b2, c209dcb, 6b1c36e, 25c2222, d6e4fe4, #4131, morluto/rea#3909). Thanks @Adkid-Zephyr, @coygeek, @jackie-cqz, @kaoru0822-kitauji, @maxazure, @XY-code1.
  • Evidence and reconstruction: Authenticate all retained inventory substeps, preserve source-attributed caveats in composed workflows, and require comparable cited Evidence before declaring reconstruction coverage or readiness. Missing Evidence and residual replay uncertainty stay explicit. (9ac91e0, c4608a2, #4075, morluto/rea#3357, #3526, morluto/rea#3363, 153017d). Thanks @coygeek, @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0, @rudycelekli.
  • Offline data: Preserve exact UTC packet-capture instants, SQLite column identity and snapshot admission failures, and cooked WASM directive literals. Cleanup cancellation retains completed EVM/WASM observations rather than losing them. (796faa0, 748ac7f, bc51d0e, 4f87f02, d694aef, 321cacb). Thanks @himamaheswarreddy, @mertkayacs, @rollroyces, @viniciusdsandrade.
  • Kuna recovery: Share concurrent single-function requests and cache repeats, validate warm exports once, stream string inventories beyond the former fixed buffer ceiling, and keep unproven processes in their run slots until close confirms release. Failure messages distinguish final buffer refusals from configurable deadlines. (#4045, #4169, #4049, #4318, #4052, #4098, #4343). Thanks @kaoru0822-kitauji.
  • Flutter snapshots: Check symbol-table ranges against loadable segments and retain completed inspection facts when cancellation occurs during snapshot cleanup. (#3859, morluto/rea#3346, #4766, morluto/rea#4717, #4762, morluto/rea#4640). Thanks @coygeek, @kaoru0822-kitauji.
  • Native metadata recovery: Keep unknown Objective-C category classes, empty protocol names, undecoded Swift aliases and unfinished property types explicit instead of discarding neighboring valid records. Preserve unnamed segment identity and exclude a dylib’s own install name from dependencies. (#4093, morluto/rea#4012, #4078, morluto/rea#3873, #4085, morluto/rea#3934, #3825, morluto/rea#3345, #4051, morluto/rea#3875, #4050, morluto/rea#3872). Thanks @coygeek, @kaoru0822-kitauji.
  • Document selection: Preserve explicitly selected plist paths and bundle defaults, and only use document fallback after confirming its applicability. Finalization keeps completed selection facts and cancellation outcomes. (e6c4877, #3774, 9df559b). Thanks @kaoru0822-kitauji.
  • Capture and comparison accuracy: Admit schema-valid HAR numeric values while retaining exact-publication limits, preserve empty URL path segments, and keep unrelated process traces and unnamed reference endpoints distinct or unknown. (#3159, morluto/rea#3145, #3792, morluto/rea#3307, #4178, morluto/rea#3931, #3809, morluto/rea#3388). Thanks @coygeek, @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0, @pablodiazjorge, @xu91102.
  • Evidence publication: Recheck staged output identity after its final write, classify missing review Evidence and duplicate ledger entries as caller input, and preserve the selected freshness requirement in comparison parameters. (#4764, morluto/rea#4613, #4452, morluto/rea#4444, #4065, morluto/rea#4000). Thanks @amyanger, @coygeek, @kaoru0822-kitauji, @Rinkia, @Swatantra-66.

⚠ BREAKING CHANGES

  • Saved Evidence: Evidence and analysis snapshots now require explicit nullable relationship_coverage in their identity commitments. Artifact inventories require scoped coverage and explicit integrity_contradictions; obsolete coverage_status and prose-based coverage inference are removed. Regenerate old Evidence/snapshots and inventory observations with this release: saved files are not migrated and omitted facts are not filled with guessed defaults. (db8128d, 0405c9d, a9588be).
  • Browser capture results: Consumers must retain resolved capture limits, event families and omission facts. Set desired budgets through the supported capture options; omitted caller inputs still select defaults, but stored observations must report the resolved values. Admitted content reads queue behind bounded concurrency. (57a23f0).
  • Android version codes: inspect_adb_package.version_code is a decimal string rather than a JSON number. Read it as a string, or use BigInt for numeric comparison. (#3485, morluto/rea#3368, 7666a48). Thanks @coygeek, @kaoru0822-kitauji.
  • Native UI failures: Failed or cancelled native UI scenarios now return typed errors with the collected report in partial_observation. Handle the error path and read that report instead of expecting a successful result containing failed steps. (d909919).
  • Provider status: binary_session candidate availability can be unknown during owner finalization. Preserve that state rather than treating it as unavailable; internal consumers must await the asynchronous session status API. (150e996).
  • Swift symbol locations: swift_symbols entries may have a null address when the provider supplies no location. Handle unknown addresses; optional evidence.reported_address retains the original provider value. (8116dc0).
  • Linux Hopper admission: Older builds previously admitted by a fixed allowlist need retained publisher-signed package evidence or an approved update to the current public demo. Update explicit HOPPER_LAUNCHER_PATH selections when migrating; the live feed offers only its current release. The official RPM metadata mismatch remains unresolved and is refused. (#3590, morluto/rea#3577, 70cd4cb). Thanks @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0.

Full contribution record: 571 commits and 236 merged PRs.

6.5.0 (2026-10-13)

Provider prerequisites and recorded verification scope are listed in the testing guide.

Highlights

  • Analyze selected JavaScript files and recover cross-bundle relationships without expanding the selected source scope.
  • Read compact summaries and page retained Evidence across binary, managed, Android, Dart, WASM and network workflows.
  • Inspect SQLite snapshots, packet and signal recordings, WebAssembly, Rust dependency metadata and Electron fuses offline.
  • Keep completed Evidence and partial observations available when analysis or cleanup fails.

Changes

  • JavaScript source selection: analyze exact application paths without expanding imports into the selected scope. Unselected files retain identity and explicit unknown coverage; summary delivery remains separate from source selection. (#1944, issue morluto/rea#1848). Thanks @kaoru0822-kitauji, @N0zoM1z0.

  • Code-split recovery: recover related bundles from multiple selected inputs, retaining per-file provenance and downstream cross-chunk imports. Recorded CLI/MCP coverage is Linux x64 with Wakaru 1.14.0 and source-owned esbuild/webpack fixtures; other hosts, releases and arbitrary application equivalence remain unverified. (#1686, issue morluto/rea#1605). Thanks @JingHao-Leon, @pionxzh.

  • Package imports: resolve exact package import aliases using the selected loader and package ancestry, rather than guessing sibling files. (#1862, issue morluto/rea#1838). Thanks @AWUQAQ, @mvanhorn.

  • Retained analysis views: opt into compact inventory/WASM, managed metadata, Android manifest, Dart AOT, Mach-O and EVM summaries, then page retained Evidence without rerunning analysis. Summary delivery preserves the complete recorded result and its original coverage. (#2122, #2193, #2413, #2438, #2455, #2634, #2308, 9a18251). Thanks @kaoru0822-kitauji, @N0zoM1z0.

  • Managed assemblies: Select declaring types when inspecting members, decode inspected ldstr literals with independent coverage, and page retained member summaries. Call and field targets expose target_declaring_type and field_declaring_type, including supported generic method targets; unresolved metadata remains unknown. (#1706, #2125, issue morluto/rea#2121, #2162, issue morluto/rea#2158, #3061, issue morluto/rea#3010, #2163, issue morluto/rea#2160). Thanks @kaoru0822-kitauji, @N0zoM1z0, @Nelglor, @skoodster.

  • Packet captures: inspect saved packets with bounded TShark output, compact capture summaries and retained pages; discover installed protocol/field definitions. Recorded real-engine coverage uses Linux and Wireshark 4.6.6; native Windows/macOS and Bun behavior remain unverified. (#2318, #2340, #2496). Thanks @3QL, @N0zoM1z0, @Olorinm.

  • Recorded signals: decode existing recordings and discover installed decoders/options through caller-supplied sigrok-cli 0.7.2. This is Linux-only and requires util-linux prlimit; it acquires no hardware samples. (#2339, #2487). Thanks @N0zoM1z0, @Olorinm.

  • Web captures: derive an inferred method/origin/path-template API surface from retained HAR data including observed query-parameter names while retaining unknowns; query values, headers and bodies remain excluded. (#1891, #2982, issue morluto/rea#2913). Thanks @mvanhorn, @wunianze666-netizen, @zhangguiping-xydt.

  • QUIC captures: inspect retained aioquic 1.5.0 JSON qlog 0.3 objects and page traces/streams/observations. Other qlog layouts remain unsupported; overlap and loss declarations do not prove retransmission or network loss. (#2277). Thanks @LuisTaffelli, @N0zoM1z0.

  • Fiddler captures: inspect native SAZ archives with retained HTTP provenance and bounded decoding. Recorded producer coverage is the pinned public encoding corpus; current Fiddler Everywhere variants and Bun-native execution remain unverified. (#2409). Thanks @N0zoM1z0, @zahhak.

  • SQLite snapshots: inspect an explicitly selected offline database with table/column selection and bounded Evidence. This operation requires Node 24.x >=24.15 or 26+ with DatabaseSync.limits; supported Node 22 and earlier 24 runtimes cannot use it. A live database/WAL copy does not establish an atomic snapshot. (#2271). Thanks @N0zoM1z0, @Y0UW1SH.

  • WASM artifacts: Inspect local modules with bring-your-own WABT 1.0.42 without executing them. Compare imports/exports from two complete core-module inspection Evidence records without requiring an active WABT installation; unsupported signatures and duplicate identities remain unknown, and comparisons do not establish runtime compatibility. Recorded real-tool inspection coverage is macOS arm64. (#1533, issue morluto/rea#884, #2464, issue morluto/rea#2356). Thanks @matbrgz, @N0zoM1z0, @thangldw.

  • Go binaries: inspect embedded build metadata, including file-backed unmapped Mach-O debug segments. (#1363, 7fb097d). Thanks @Y0UW1SH.

  • Flutter APKs: identify snapshot/engine builds and inspect AOT structure without an external engine. Recorded real APK coverage uses the documented Flutter Gallery fixture; macOS/Windows and complete pool semantics remain unverified, and pool coverage stays partial. (#1582). Thanks @3QL.

  • HarmonyOS packages: inventory HAP/HSP/App Pack structures without executing code. The recorded real workflow covers one pinned HAP through repository-built CLI/MCP; installed-package and real HSP/App Pack coverage remain unverified. (#1447). Thanks @BaaRai.

  • Ghidra raw inputs and references: compatible Linux/macOS Ghidra profiles accept caller-selected raw architecture/entry information and expose typed incoming references at exact addresses. Windows Ghidra P0 admits the raw NMOS 6502 profile described below; other raw targets and the incoming-reference facet remain outside Windows P0. (#1868, issue morluto/rea#1836, #1715, issue morluto/rea#1245). Thanks @bugstan, @casesolved-co-uk, @mvanhorn, @N0zoM1z0.

  • Ghidra MIPS: Add bounded MIPS32r2/o32 relocatable objects, soft-float integer-register storage, admitted MIPS16 shared ELF, and a narrowly admitted recordless legacy MIPS32 executable profile. The latter pins an endian-matched 32-bit language and records inferred o32 as an analysis assumption. Admission follows each documented ABI/flag/relocation boundary. (#1949, issue morluto/rea#1937, #1950, issue morluto/rea#1938, #1991, issue morluto/rea#1851, #1898, issue morluto/rea#1620). Thanks @AurelioB, @BaaRai, @bqw371, @kaoru0822-kitauji, @N0zoM1z0.

  • Ghidra RISC-V: admit little-endian RV32/RV64 ET_EXEC ELF declaring the supported double-float ABI. Relocatable/shared, big-endian and other ABI profiles remain refused; see the profile and recorded lane. (#2151). Thanks @NIU-123370.

  • PSP static ELF profile: the Ghidra profile is Linux x64, bounded little-endian ELF32 ET_EXEC with the documented PSP/ABI declarations and a compatible caller-installed Allegrex extension. PRX, shared/relocatable images, PBP/ISO/CSO and runtime emulation are outside scope. Historical extension experiments are separate from public-provider verification; real public Ghidra PSP coverage remains unverified. (#1599). Thanks @jaelliot.

  • Ghidra analysis settings: apply validated analyzer overrides before analysis while retaining the selected analysis profile. (#1913). Thanks @akushonkamen, @kaoru0822-kitauji, @N0zoM1z0.

  • Attached native IDA MCP: add an optional native bridge alongside existing legacy/headless profiles. Recorded native runs use Linux IDA Free 9.4 with a navigation correction and Windows IDA Pro 9.3 with a loopback-listener change; stock native switching, native macOS and Windows IDA Free remain unverified. Attached databases remain read-only and are never saved or closed. (#1544). Thanks @imissapixel, @N0zoM1z0.

  • Frida instrumentation: add explicit local/remote target selection, caller-supplied scripts and retained messages, with script-read/input diagnostics and bounded message eviction. Recorded real coverage is the Linux local Node marker workflow; macOS, Windows and remote devices/servers remain unverified. Instrumentation executes foreign code and is destructive, not read-only. (#1359, #2211, issue morluto/rea#2209, #2217, issue morluto/rea#2213, #2628). Thanks @dandgabr, @kaoru0822-kitauji, @N0zoM1z0.

  • Client setup: register Qoder, Trae, ZCode, DeepSeek Harness, Kimi Code, Factory Droid and WorkBuddy through the existing scoped setup flow. DeepSeek is included from 6.5.0; the historical npm 6.4 check did not cover it. Live Trae and DeepSeek API integration remain unverified. (#1564, #1572, #1573, #1929, issue morluto/rea#1839, #2744, #2309, #3041, issue morluto/rea#3040). Thanks @0xRafie, @BaaRai, @cainiao1992, @IvenKooLab, @whoishaha, @ysntony.

  • Website: Add maintained language editions, persistent/system-aware themes, keyboard styling and nested Evidence indentation, plus the reverse-engineering models essay. A simpler home page and beginner journey connect platform prerequisites, client/provider setup and a supplied first investigation. (#1779, issue morluto/rea#1022, #1699, #1714, #1894, #2250, #2432, #2732, #3274). Thanks @CassieFox23, @kaoru0822-kitauji, @N0zoM1z0.

  • Rust dependency metadata: Inspect embedded cargo-auditable package/dependency records in ELF, PE and thin Mach-O without executing the file. Missing metadata and inferred compiler hashes retain explicit limitations; universal Mach-O requires a selected thin slice. (#2456). Thanks @mvanhorn.

  • Electron fuses: Read packaged fuse bytes and per-slice runtime implications without launching or modifying the app. Missing, truncated and unknown wires remain explicit; fuse observations do not prove other Inspector-enablement paths. (#2399). Thanks @kaoru0822-kitauji, @mvanhorn, @N0zoM1z0.

  • Ghidra PowerPC: Admit bounded ELF32 big-endian ET_EXEC PowerPC with an explicit language profile on supported Linux/macOS hosts. PPC64, DOL and other variants remain outside this lane; see the profile and verification prerequisites. (#1747). Thanks @arielfikru.

  • Reference-source summaries: Use CLI import-reference-source --detail summary for compact manifest, count, state and path-outline output. The complete graph remains available and is still the default; hidden outline entries retain separate coverage counts. (#2768, issue morluto/rea#2442). Thanks @matbrgz, @To3akaRin.

  • Recorded AArch64 crashes: Decode 34 ABI register values per thread from supported Linux ELF64 little-endian core notes using the documented caller-provided Python dependencies. These are recorded facts, not proof of current process or library identity. (#2505, issue morluto/rea#2353). Thanks @matbrgz, @NIU-123370.

  • Ghidra byte search: Search initialized analyzed memory using wildcards, bit masks, address bounds and paged results. Unloaded, overlay and uninitialized blocks retain skipped coverage; this is not a raw-file search. (#2341). Thanks @mvanhorn.

  • Raw NMOS 6502 images: Analyze explicitly selected headerless images with Ghidra, including Windows P0, using a caller-selected entry and source mapping within the 16-bit address space. Cartridge parsing, reset-vector inference and 65C02/65816 are outside this profile. (#2079). Thanks @Zhong-fan.

  • Swift String observations: Ghidra function dossiers derive supported AArch64 Swift String literals from constant-register pairs at recognized use sites, retaining instruction/register provenance and explicit omissions. This is a bounded derivation, not a complete string inventory. (#2049, issue morluto/rea#2030). Thanks @thefolahan.

  • Headless IDA procedure lookup: Resolve addresses to canonical containing-procedure entries and identify the session’s admitted program document in the modern headless profile. Incomplete surveys remain errors; attached profiles do not advertise this containment capability. (#2374, issue morluto/rea#2335). Thanks @nikolay-dementiev.

  • Passive browser attachment: Six existing passive browser tools accept an explicit-port loopback browser WebSocket endpoint when HTTP target discovery is unavailable. Existing consent and target/origin checks remain required; this does not launch a browser or enable runtime instrumentation. (#2346). Thanks @all-black-493.

  • Android DEX references: Retain exact method descriptors and individual direct-invoke observations with source method, DEX entry, opcode and code-unit offset. These are static references; unavailable instruction facts remain separate from method-level usage totals. (#2439). Thanks @LcokHcak.

  • Offline EVM metadata: Retain bounded, lossless facts from plausible terminal Solidity CBOR root-map candidates. Candidates do not prove Solidity origin or source/compiler identity, and linked metadata is not fetched. (#2790). Thanks @matbrgz.

Fixes

⚠ BREAKING CHANGES

  • Runtime attachment state: attached may be null in JavaScript, browser and Electron discovery/inspection results. Treat null as unknown; do not coerce it to false. (e55ef72).

  • Source maps: original-source and mapping rows preserve a null source name when unavailable. Handle null explicitly instead of expecting an invented unknown-source string; new index fields remain optional when reading older Evidence. (ee50ed1).

  • Streamed filtered JSON: --filter-output now emits JSON null instead of {} when the selected value is null; consumers must distinguish a present null from a missing selection. Use --full-output when an object envelope is required. (#2333). Thanks @Jackmeson1.

  • Call graphs: get_call_graph.normalized_result is now { graph, limitations }; read traversal-depth groups under graph and retain relationship-specific caveats. Contract/fixture validation does not establish new Ghidra or IDA engine coverage. (5dfb9d0).

  • MCP discovery: binary_session no longer repeats server_identity.catalog.tools. Use the connected server tool list, grouped tool_availability and provider capabilities; see MCP contracts. Origin: 6395e8d. (#1988). Thanks @kaoru0822-kitauji, @N0zoM1z0.

  • Provider admission: MIPS targets with unresolved GNU ABI attributes are refused. Supply supported ABI declarations. Saved Hopper databases on macOS are unavailable because the launcher cannot run the analysis bridge when opening a database; select an executable target instead. Database support requires a script-capable database launch route. (d4bd65c).

  • Segment extents: binary_overview segment length may be null when Hopper coordinates cannot establish a finite extent in one address space. Preserve unknown rather than converting it to zero or a saturated value. (36db19c).

  • Invocation identity: server.command_path may be null, and registration/setup statuses or doctor classifications may be unknown. Preserve these states and establish the actual invocation before treating a registration as aligned. (187f113). Thanks @hemv-857, @qorvr.

  • ADB installation: the optional replace input is unchanged. Results now require replace_requested to record the requested adb install -r mode; replaced is nullable because prior device package state was not observed. Update result readers to accept null instead of treating reinstall intent as proof of replacement. (864314a).

  • Managed/native verification: unresolved P/Invoke results may retain matched_native and candidate facts when module identity is unknown. Interpret status, basis and limitations; module-identity-unknown does not verify correspondence, and unresolved no longer implies empty observations. (3f6b575).

Full contribution record: 893 commits and 529 merged PRs.

6.4.0 (2026-10-11)

Highlights

  • Android: added device inspection, split-APK acquisition, logs, screenshots, file transfers and explicit app lifecycle actions through ADB, plus manifest and localized-string decoding with Apktool. (#1552, #1556) Thanks @3QL.
  • JEB: browse project units and decompile selected items through a caller-started local JEB MCP server. (#1536) Thanks @3QL.
  • Large analyses: discover retained Evidence without loading every payload, and inspect JavaScript graphs, binary layouts and function dossiers through summaries and selected views. (#1682, #1568, #1570, #1345, #1507, #1247) Thanks @jhuang-tw, @kaoru0822-kitauji, @N0zoM1z0.
  • JavaScript: isolate source analysis in an owned process with configurable heap and timeout limits; retain completed facts and explicit unknowns when analysis runs out of resources. (#1651, #1563, #1565) Thanks @N0zoM1z0, @peter-research.
  • Ghidra: configure import language/compiler specifications and seed functions, code and labels before auto-analysis. (#1667) Thanks @sqmagellan.
  • RPC discovery: recognize supported tRPC calls, HTTP-link URLs and named GraphQL operations in JavaScript applications and web bundles. (#1670) Thanks @pompiliodonatoapp.

Changes

  • Added Ghidra support for Windows PE DLLs and bounded MIPS ELF analysis, including carved MIPS inputs with incomplete section tables. Windows P0 remains read-only. (#1303, #1362, #1629, #1290, #718, #1619) Thanks @bqw371, @jaelliot, @kvalls, @N0zoM1z0.
  • Enabled set_address_name and set_addresses_names for Ghidra sessions with mutation authority, including namespace-aware data labels and per-address batch results. (#1635, #1634) Thanks @giri256.
  • Recovered additional signed AArch64 relative jump-table patterns. (#1592) Thanks @RishTheFish21.
  • Added PE resource inspection and read-only NativeAOT metadata parsing for supported x64 PE32+/.NET 8 RTR 9.1 inputs. The NativeAOT parser’s Windows-host Ghidra workflow remains unverified on a real Windows host. (#1482, 76d8f68, #1254) Thanks @N0zoM1z0, @thangldw.
  • Added Pi, Hermes and Qwen Code setup, including Hermes active-profile support. (#1376, #1403, #1415, #1409) Thanks @rasatpetabit, @yiliang114, @zaydiscold.
  • Added REA_MCP_INPUT_SCHEMA_PROFILE=compact for size-capped MCP clients such as Kimi/Moonshot, while retaining canonical runtime validation. (#1514, #1580, #1484, #1581) Thanks @haythemsellami, @N0zoM1z0.
  • Added live process-capture progress and optional finalization_ms to capture shutdown output before timeout escalation; cancellation remains immediate. (#1483, #1583, #1252, #1253, modelcontextprotocol/typescript-sdk#2997) Thanks @N0zoM1z0, @nikolay-dementiev, @sathariels.
  • Improved Codex onboarding and recovery from observed client, PATH and provider blockers. (#1613) Thanks @N0zoM1z0.
  • Reduced redirected JSON and terminal output size, and deferred heavy imports until their commands need them. (#1413, #1450, #1439, 21dbcf7) Thanks @kaoru0822-kitauji.

Fixes

  • Electron analysis: follow renamed and default-imported APIs and optional calls, ignore overwritten identities and media preload attributes, and resolve packaged app.asar pages and unpacked companions. (#1391, #1393, #1400, #1664, #1673) Thanks @kaoru0822-kitauji, @marnixpluim, @N0zoM1z0, @suninrain086.
  • JavaScript data flow: preserve returned/yielded reference uncertainty, invalidate property-stored aliases correctly, and retain bundled-module runtime scope. (#1437, #1445, #1471, #1577, #1428, #1442, #1449, #1576) Thanks @CassieFox23, @dakjdakd, @N0zoM1z0.
  • JavaScript packages: resolve exact exports subpaths, preserve trailing-slash directory requests and exact CommonJS keys, and respect shadowed require bindings. (#1424, #1615, 5485483, 8b2f851, f998fcb, 1e51c73, #1365) Thanks @akshitkhokhani, @AWUQAQ, @immanuwell, @rudycelekli.
  • Large JavaScript inputs: handle oversized inline source maps, deep returns and reassignment loops; avoid argument expansion limits and yield during large analysis passes. (#1386, #1368, #1390, #1539, #1525, #1542, #1545, #1557, #1380, #1401, #1538, #1462) Thanks @cold-atom, @KadirJeager, @kaoru0822-kitauji, @marnixpluim, @N0zoM1z0, @rudycelekli.
  • JavaScript receivers: expand escaped methods once, index returned-object targets, and avoid replaying earlier writes or duplicating retained graph allocations. (#1517, #1537, #1444, #1601, #1495) Thanks @CassieFox23, @geekwolf, @kaoru0822-kitauji, @N0zoM1z0, @zeynelacikgoez.
  • Browser captures: retain WebSocket URLs, empty connections and frame order; compare only common known payload coverage and preserve incomplete WebMCP replay coverage. (db4e360, aa257ea, e52c0a7)
  • Browser scenarios: seed storage in the correct partition, normalize loopback attach identities, retain declared-secret redaction and require verified lineage before Windows Electron signals. (#1604, #1590, #1588, 8b4c3de, #1497, #1591, #1589) Thanks @Adolanium, @akushonkamen, @dakjdakd.
  • Added Termux Android browser-scenario support. (#1655) Thanks @tyloryang.
  • Web inputs: accept BOM-prefixed HAR, preserve the first duplicate DOM attribute and resolve SVG/XLink URLs in HTML and XHTML. (#1509, #1516, #1602, #1683, #1496, #1586) Thanks @CassieFox23, @kaoru0822-kitauji, @sathariels, @taljeri.
  • Screenshot comparisons: validate PNG chunks, distinguish corruption from unsupported encodings and bound comparison memory. (4e4b15b, b3e977e) Thanks @rudycelekli.
  • Archives: preserve case-distinct names, report collisions at their diverging segment, detect nested formats from bytes and reject Windows alternate-stream extraction paths. (#1480, #1505, #1553, 573598c, #1470, #1491) Thanks @CassieFox23, @kaoru0822-kitauji.
  • Cleanup: retain failed readers, ASAR handles, output trees and provider workers for retry without discarding completed output or partial observations. (ffe0574, de0d341, 3f8c51e, d1235fa, 026126e)
  • Providers: canonicalize IDA workspace roots before identity checks, respect IDA cancellation, serialize JEB acquisition and correct Ghidra no-return/imported-symbol recovery. (#1481, #1419, 5f30ea6, f88c990, 49e6f00) Thanks @AS9929, @JonahSimon, @Y0UW1SH.
  • Binary metadata: respect PE/.NET section extents, bound binary-plist expansion, scope keyed-archive traversal and decode app Info.plist files without plutil. (#1678, #1515, #1378, #1476, 975dff2, 76296c5) Thanks @jayhemnani9910, @kaoru0822-kitauji, @rudycelekli.
  • Windows runtimes: preserve drive-root paths when creating private provider directories. (ee46323)
  • Compatibility: load Windows native controls under Node-API hosts with renamed executables, preserve dylib directory requirements, support Wakaru 1.x and reject directory-valued Hopper launchers. (#1531, #1623, #1540, #1426) Thanks @evenafterallisaid, @Fazmin, @pionxzh, @xeropresence.
  • Reference imports: normalize internal symlink lookup consistently, preserve exact paths and exclusion provenance, report root access failures and reject FIFO replacements without blocking. (#1535, 2ca3ad2, 6636045, 3967cfa, f1c58cc) Thanks @anujsingh-cse.
  • Setup: honor active configuration and skill roots, preserve configured MCP environments, validate Hermes/OMP profiles before writing, recognize Omarchy and retain recovery backups. (#1504, #1607, #1528, #1562, #1662, a011485, #1606, #1521, #1561) Thanks @Adkid-Zephyr, @CassieFox23, @LuisTaffelli, @N0zoM1z0, @peter-research.
  • Process capture: retain descendant lineage after launcher exit, preserve identity uncertainty before signaling and release terminals after observation failures. (80896a1, c916850) Thanks @Y0UW1SH.
  • CLI/MCP errors: accept JSON files for web comparisons, preserve native option help and union correction details, remove invalid aliases and validate doctor against its discovered output contract. (#1397, #1395, #1425, #1461, 8b4c96e, #1421, #1454) Thanks @Fazmin, @kaoru0822-kitauji, @N0zoM1z0.

⚠ BREAKING CHANGES

  • WebSocket results: use network.websocket_connections instead of network.websocket_events. Connections contain request_id, url and events; allow payload_bytes: null when size is unknown. No legacy alias remains. (db4e360)
  • Direct resource APIs: pass a caller-owned ArtifactResourceScope to inventory/extraction, JavaScript analysis, reference imports and web exports; retain it through cleanup/shutdown. For readJavaScriptArtifactFiles, scope is argument three and abort signal is argument four. Keep each root inventory source’s single cleanup owner. Use OwnedFileHandle owners, injected ASAR fd/read handles instead of createReadStream, VCS Result values, and WebScriptExportError’s options object. CLI/MCP inputs for the scoped operations are unchanged. (ffe0574, 53e7fad, 684199b, be75ed5, be6272f, e0e49e9, 95a77b6)
  • Saved reference graphs: exclusions require their matching pattern and distinguish project-ignored from default-ignored. Re-import graphs missing that provenance. (6585293)
  • Terminal captures: keep initial and resized buffers within 1,000,000 cells using columns × (rows + scrollback); oversized scenarios are rejected before launch. (f9ea9a9)
  • Optional agent-verification reports: accept schema version 4, nullable expectedFirstTool and targetClarificationPassed. Production CLI/MCP contracts are unchanged. (#1613)
  • Capture comparisons: recapture both sides with matching literal-replacements-v1 semantics when custom normalization patterns are used. Legacy unversioned pattern captures remain readable but cannot be compared with new pattern captures; captures without patterns are unaffected. (#1456, 2b6f14f) Thanks @Madhavan006, @N0zoM1z0.
  • Artifact graph edges: read child artifact IDs and paths from the occurrence selected by occurrence_id, not edge fields child_artifact_id/logical_path. Earlier inventory Evidence no longer validates against the new commitment. (#1493) Thanks @kaoru0822-kitauji.
  • Semantic graph schema: nodes and relations no longer include identifier_strategy, and relation IDs no longer hash it. Earlier Evidence no longer validates against this schema. (#1474) Thanks @kaoru0822-kitauji.
  • Semantic identities: select IDs from the parent graph; read exact event names from event_name, endpoints from endpoint and literal values from properties.value. New analyses use digest-based IDs for long/reserved event and endpoint names and value-sha256 literal role keys, with shorter labels; string literal labels now read string literal. Previously stored graphs retain their original IDs and remain valid workflow inputs. (#1427, #1423, #1407) Thanks @N0zoM1z0.

Contributors

  • Thanks also to @BaaRai, @commit-regrets, @coygeek, @Franky100-pig, @inii-sayaa, @jopemachine, @JosephDemarest, @keemsisi, @Totopo27 for contributions included in this release.

Full contribution record: 336 commits and 163 merged PRs.

6.3.0 (2026-10-09)

⚠ BREAKING CHANGES

  • captures: Historical captures without current producer accounting or transaction identity, and web diffs missing accessibility or storage dimensions, are rejected. Preserve original captures and recapture with the current producer; update comparison consumers to include every dimension rather than synthesizing missing observations. See the process capture guide and browser scenario contract. (3283a45)
  • browser: JSON shape paths now contain typed property and array-element segments. WebMCP input_schema_shape is replaced by input_schema and input_schema_sha256, retaining declared examples and defaults.
  • process: Filesystem digest omission entries now require system_code; budget and changed-file omissions use null, and unavailable-file omissions preserve the operating-system error code.
  • contracts: Provider analysis outputs must explicitly supply metadata previously repaired with defaults; unsupported nullable facets must be reported as null.
  • javascript: Semantic graph facts now store evidence context IDs and locations. Graph and semantic trace results require an inline evidence_contexts table.
  • contracts: source-map URLs now live in target observations selected by declared_url_sha256, and doctor skill identity no longer emits installed_catalog_digest. Use the documented observation join and identity.skill.state instead.
  • javascript: remove the never-incremented truncated_scopes statistic from JavaScript application analysis results and schemas.
  • native: Objective-C attribute tokens now contain only name and value. Properties report nullable atomicity and readonly facts; class flags, ivar counts, and method requirement flags are nullable when unobserved.

Features

  • setup: register OMP during setup (#1301) (8b4c359)
  • javascript: record Electron integrity mismatches (7915ee5)

Bug Fixes

  • inspector: retain observations after capture failures (dea3498)
  • artifacts: bind ASAR interpretation to owned snapshots (d79317c)
  • artifacts: infer legacy Mach-O simulator platforms (5aa2002)
  • artifacts: preserve archive facts and Unicode path identity (5751f5c)
  • artifacts: reject incomplete inventoried extraction (5e8fb53)
  • artifacts: retain DMG ownership through uncertain attachment (a27794c)
  • artifacts: validate only active extraction entries (cfb12e4)
  • browser: follow only HTTP redirect statuses for source maps (82bbe74)
  • browser: preserve payload shapes and WebMCP declarations (4951a89)
  • browser: release attached viewport overrides without resizing the external page (f6cfbfc)
  • browser: retain attached scenario emulation until cleanup (a0523b3)
  • browser: retain malformed redirect diagnostics (617cd84)
  • browser: serialize attached scenarios through cleanup settlement (cfce91d)
  • ci: scope verification and reuse native runners (#1344) (d5cb8ae)
  • cli: avoid duplicate primary cleanup diagnostics (37fcea7)
  • cli: classify JSON input permission denials (08daf05)
  • cli: classify oversized JSON inputs (f7cf4c8)
  • cli: stream JSON inputs beyond the whole-document string limit (#1360) (6ce3288), closes #1331
  • cli: stream JSON results at the shared command boundary (810107a)
  • contracts: advertise NUL with a portable hex escape (3f59a84), closes #1329
  • contracts: require observed provider output metadata (a4ba8ae)
  • electron: preserve unrepresentable numeric option evidence (41a228c)
  • evidence: order canonical projections independently of locale (614fb76)
  • files: reject nonregular capture and JSON inputs (5f16124)
  • filesystem: reject unstable artifact targets (7829b1a)
  • ghidra: reject a native decompiler built for another host (#1280) (3728c82), closes #1192
  • ghidra: retain process ownership after failed launch rollback (07675f7)
  • ghidra: verify dense jump tables on an optimized fixture (#1374) (73a664b)
  • hopper: allow restart after verified owned-provider shutdown (1c12349)
  • hopper: probe interior navigation from multi-byte instructions (#1285) (bf934d5)
  • ida: compare admitted document paths consistently (890bb66)
  • javascript: avoid positive-zero evidence for signed zero (9055bd6)
  • javascript: decline source-map UNC references with an unusable host (#1372) (f504c2a)
  • javascript: distinguish prefix-only builtins from packages (2b4abbf)
  • javascript: honor module-sync package exports (#1361) (d0e6069)
  • javascript: parse declaration artifacts in ambient mode (4896adc)
  • javascript: preserve agreeing module provenance (db171be)
  • javascript: preserve capture-time guards and ordering (001851f)
  • javascript: preserve semantic evidence through satisfies (e995b19)
  • javascript: preserve uncertainty after references escape to calls (#1292) (355a292)
  • javascript: reject invalid package exports configurations (7a4f268)
  • javascript: resolve exported callables through lexical bindings (#1351) (a9f5dad)
  • javascript: resolve query-only HTML references to their document (55a46f7)
  • javascript: retain array identity after length mutations (4bcea1a)
  • javascript: retain conditional mutation ordering uncertainty (b8a8190)
  • javascript: retain distinct module provenance path components (2bd7de6)
  • javascript: retain unresolved value frontiers in provenance queries (3e19875)
  • javascript: store source map URLs once (ed8fcae)
  • json: preserve runtime limits across JSON file readers (#1350) (9c4a68b)
  • managed: bind graph facts to their source Evidence (cc7b5af)
  • mcp: admit composed analysis through result bookkeeping (e11f4d3)
  • mcp: advertise object roots for union input schemas (#1373) (39dabd0)
  • mcp: advertise primitive semantic literal seeds (f62b449)
  • mcp: preserve JavaScript workflow identity validation (#1366) (53ed942), closes #1364 #1065
  • mcp: retry failed shutdown resources and retain failure reasons (e64678e)
  • native: distinguish symbol definitions from metadata (70bad53)
  • native: preserve unknown Objective-C metadata (b112d44)
  • native: refuse to list architectures of non-Mach-O targets (#1325) (1b73b5a)
  • native: retain LLDB cleanup ownership through client close (7ad353f)
  • process: keep unobserved file contents unknown (#1358) (f91f279)
  • process: retain per-file digest open failures (415145d)
  • reference: report malformed UTF-8 before import parsing (f166a2a)
  • report malformed application evidence as input errors (218c131)
  • retain completed observations when later analysis steps fail (35f121f)
  • setup: install the skill for Claude Code (b4a1919)
  • setup: recognize supported Nobara hosts (f0dc233)
  • skill: pin packaged commands to the shipping package version (2793672)
  • skill: pin packaged commands to the shipping package version (#1346) (f39e71c)
  • snapshot: preserve complete investigation revision histories (#1354) (1c0cc8a)
  • targets: cancel resolution before provider admission (f3c4a33)
  • update: preserve disabled client registrations (abf5e24)

Performance Improvements

  • javascript: index version relationships once per comparison (#1347) (b1e85ad)
  • javascript: validate the version change graph once (#1370) (037709a)
  • json: encode streamed JSON iteratively (#1322) (56598be)

Code Refactoring

  • use canonical implementations and types directly (765e809)
  • artifacts: remove unused root classifier (5291bca)
  • artifacts: test inventory changes at materialization boundary (750fb65)
  • browser: open scenario sessions without a factory wrapper (d1983a4)
  • catalog: import CLI metadata from its owner (8c96baa)
  • consolidate boundary semantics and prune redundant tests (392f1f3)
  • javascript: normalize erased expression syntax once (b628bba)
  • javascript: parse runtime evidence into one verified owner (006b295)
  • javascript: remove obsolete scope truncation statistic (449d570)
  • javascript: share Babel child traversal (0f10499)
  • javascript: share semantic evidence at fact construction (e3bbb9a)
  • process: remove duplicate observation and trace entry points (070339a)
  • providers: use canonical artifact and managed identities (87f0051)
  • reference: simplify malformed UTF-8 handling (377df71)
  • remove obsolete source exclusions and identity wrapper (44c92f8)
  • remove single-use forwarding helpers (4144e45)

Documentation

  • keep license sections text-only (e10f1f0)
  • align translated README artwork and layout (ccfbe87)
  • add README artwork and refine closing sections (4b8e744)
  • add repository-local REA tool design skill (7738c1f)
  • celebrate 40,000 GitHub stars 🎉 (3edb217)
  • celebrate 40,000 GitHub stars 🎉 (5ecc98a)
  • consolidate agent guidance around ownership and boundaries (ba44222)
  • contracts: explain canonical URL and skill metadata ownership (e36afa1)
  • correct MCP error and capture import guidance (077d6c4)
  • correct README setup and runtime guidance (5b3715e)
  • explain CI scope and native runner reuse (#1348) (6c9161d)
  • prune repeated contributor and tool design instructions (5d79387)
  • remove retired architecture and migration artifacts (7a0c800)

Tests

  • share the client registration command to restore the jscpd gate (#1317) (5d16be2)
  • mcp: remove arbitrary schema inventory thresholds (24673aa)
  • android: allow provider readiness under load (961c3c3)
  • artifacts: verify extraction races with real filesystem changes (1ac8389)
  • browser: avoid duplicating source-map listener setup (9367dc1)
  • browser: report redirect status cases independently (5a61562)
  • cli: remove duplicate malformed JSON assertion (5d32e42)
  • exercise source test selection through Git and Vitest (25711ad)
  • filesystem: bound FIFO regressions at consumers (0bfb6e0)
  • ghidra: allow rollback tests to reach spawned process (d761d73)
  • javascript: share primitive expansion producer fixtures (c867bcd)
  • javascript: share semantic graph test facts (ac356c4)
  • javascript: verify distinct module origins through reconstruction (96b2b24)
  • json: remove assertions covered by CLI output consumers (a959a83)
  • managed: include shared dossier fixture in artifact inputs (66a20a2)
  • native: retain trace diagnostics when observed hits differ (048b798)
  • package: share validated native dossier fixtures (ca90109)
  • process: publish capture readiness atomically (74be526)
  • process: report cleanup details on cancellation failures (79d5b9a)
  • process: use owned CLI and workspace fixtures (4940a86)
  • share snapshot replay and managed graph fixtures (d83cbd2)

Continuous Integration

  • enforce architecture guards with portable checkout paths (ecc67ca)

6.2.0 (2026-10-09)

⚠ BREAKING CHANGES

Read the 6.1 to 6.2 migration guide before upgrading. REA's always-bump-minor policy includes breaking changes; 6.2 is not a backward-compatibility promise. Preserve original saved files and regenerate missing observations rather than fabricating identities or facts.

  • MCP / Evidence / snapshots / artifacts: Success results are direct canonical Evidence; read normalized_result rather than the old result/evidence wrapper. Evidence requires nullable analysis_profile, session provider aliases are removed, snapshots require complete profile-bound query records, and artifact roles/permissions belong to occurrences. Recreate incompatible saved data; adding fields without recomputing their semantic identity is invalid. (63bf914)
  • Process captures: Legacy v3 conversion is removed. Explicit executable identity and event_journal are required; retain old captures and recapture when current comparisons are needed instead of inventing launch identity or event order. (2a77469)
  • Cleanup and evaluation: A one-shot analysis reports cleanup failure while preserving the completed observation or primary diagnostic. Handle cleanup_incomplete and retained observations/resources. Configured agent-evaluation fixtures require Evidence-backed correctness, not routing or answer wording alone. (#1211, 27a9cea)
  • JavaScript: Return-field projections require explicit presence; export-shape changes carry both sides' presence and property inventory coverage. Semantic object operations retain complete property_path segments. Regenerate old analysis and distinguish unknown values from unknown presence. (475a0f8)
  • Function comparisons: Remove the unreachable truncated dimension state and summary.truncated counter; update enum and display consumers while retaining explicit unknown facts. (5510b27)
  • Historical sources: Unreadable/unknown symlink targets require target: null; external targets retain the observed absolute target. Reimport graphs containing display placeholders such as <outside-root> and handle nullable targets. (b7b4333)

Features

  • javascript: report observed export property presence (#1160) (45e3edc)
  • mcp: select views of retained analysis results (#1180) (db675f1)
  • website: add an Aegis APK code-generation showcase (0270dd5)
  • website: add an Android showcase and clearer project prompts (6cc817e)
  • website: add beginner examples and synchronized publishing (0fec65d)
  • website: add beginner examples and synchronized publishing (#1203) (0fec65d)
  • website: add Discord link beside GitHub badge (cc39fc5)
  • website: add homepage navigation and faster reading paths (863674b)
  • website: add homepage navigation and faster reading paths (c94f06d)
  • website: add homepage navigation and faster reading paths (#1213) (863674b)
  • website: add search metadata and automatic sitemap (99f257b)
  • website: add search metadata and automatic sitemap (b8851cb), closes #1283
  • website: clarify reverse engineering and showcase goals (e750c26)
  • website: explain REA through a first investigation (5160d9b)
  • website: explain REA with Calculator and a playable dinosaur lab (11b9f03)
  • website: lead with the playable dinosaur example (19c52f5)
  • website: show manual analysis beside a one-prompt workflow (291bc6f)

Bug Fixes

  • dev: accept formatter-ignored staged documentation without failing the commit hook; malformed JSON remains rejected. (bd2db2f)

  • release: publish reviewed release-PR merges from their exact reviewed source. (c12bad7)

  • android: support owned JADX stdio on Windows (#1276) (636b245), closes #1262

  • android: validate engine archive prerequisites (#1145) (e9ebfb9)

  • apple: report unusable dylib-resolution roots as invalid input (6a1e558)

  • apple: report unusable dylib-resolution roots as invalid input (24a30fd)

  • artifacts: keep cancellation and the caller path in extraction refusals (37025cc)

  • artifacts: keep cancellation and the caller path in extraction refusals (eacf846)

  • artifacts: match lipo arm64e variant names to their FAT slices (de5bfec)

  • artifacts: match lipo arm64e variant names to their FAT slices (0b32577), closes #1168

  • artifacts: name only host-available workflows for non-archive plists (f4c99ab)

  • artifacts: name only host-available workflows for non-archive plists (2295855)

  • artifacts: recheck failed DMG detaches before reporting cleanup failure (#1155) (58a91f0)

  • artifacts: refuse unsupported extraction formats before scanning (8e74c9c)

  • artifacts: report encrypted archive entries as unsupported extraction (de43da7)

  • artifacts: report non-archive keyed-archive selections as unsupported targets (fef38e4)

  • artifacts: report non-archive keyed-archive selections as unsupported targets (8c5088c)

  • artifacts: report wrong target kinds as unsupported targets (b34bdcd)

  • artifacts: report wrong target kinds as unsupported targets (637bcb5)

  • browser: classify export-web-scripts capture selection failures by cause (ddaa183)

  • browser: classify export-web-scripts capture selection failures by cause (8c5e34c)

  • browser: report Windows HAR heap exhaustion (#1147) (1393507)

  • browser: retain scenario observations across failures (614e0c2)

  • browser: retain scenario resources until cleanup succeeds (88640f6)

  • ci: pass selected environment to Windows Ghidra fixture (#1281) (f085589)

  • cli: advertise defaulted inputs as optional in --schema and help (#1175) (b4927a0), closes #1169

  • cli: cancel routed JavaScript analysis in rea analyze (#1156) (089bbf5)

  • cli: complete cleanup after relayed interrupts (#1202) (911152a)

  • cli: list the read failure cause for an unreadable JSON input file (db0afce)

  • cli: list the read failure cause for an unreadable JSON input file (6020df5)

  • cli: resolve xrefs symbol selectors after address validation (#1209) (7e9c911)

  • config: name the rejected setting and its constraint in configuration errors (c3acc34)

  • config: name the rejected setting and its constraint in configuration errors (0a0244d), closes #1184

  • doctor: find the Homebrew Hopper cask without writing Homebrew caches (98b07d0)

  • doctor: find the Homebrew Hopper cask without writing Homebrew caches (a503376), closes #1165

  • domain: report target read-permission denials as access_denied (f36c10f)

  • domain: report target read-permission denials as access_denied (d0ff57a), closes #1188

  • electron: resolve effective preload after option overrides (#1286) (411498d)

  • emit v-mode-compatible patterns for tool schemas (#1220) (f0da05f)

  • errors: report caller-selected evidence path failures as invalid input (d4a598e)

  • errors: report caller-selected evidence path failures as invalid input (db177c9)

  • evidence: cancel exports before atomic publication (16624f1)

  • ghidra: classify modern Swift manglings in swift type analysis (#1208) (6935dc7)

  • ghidra: do not run Java from a relative JAVA_HOME in doctor and setup (04a516b)

  • ghidra: do not run Java from a relative JAVA_HOME in doctor and setup (c3f1698)

  • ghidra: keep and name a runtime directory that close could not remove (5b769d3)

  • ghidra: keep and name a runtime directory that close could not remove (b79d379), closes #1190

  • ghidra: keep the NativeAOT target refusal's own recovery advice (f198993)

  • ghidra: preserve decoded return flow evidence (b189c3c)

  • ghidra: preserve decoded return flow evidence (bcc8a77)

  • ghidra: reject relative installation and Java paths in doctor and setup (8998438)

  • ghidra: reject relative installation and Java paths in doctor and setup (5356856), closes #1183

  • ghidra: report NativeAOT host and target refusals as unsupported, not failures (cfb49eb)

  • ghidra: report NativeAOT host and target refusals as unsupported, not failures (42c276a), closes #1185

  • ghidra: resolve secondary symbols at function entries (#1195) (6fbdbd6)

  • ghidra: stop dereferencing the removed error payload in address verification (b80bd2d)

  • ghidra: stop dereferencing the removed error payload in address verification (59fbaa2)

  • ghidra: use dot-free private session paths (c3fc6c3)

  • hopper: keep the OS error when the FAT64 source cannot be reopened (9f5dc52)

  • hopper: reserve Linux demo application before launch (#1158) (33d5ae0)

  • javascript: allow cancellation during semantic graph commitment (#1218) (9405bd6)

  • javascript: classify application input selection failures by cause (fe5291e)

  • javascript: classify application input selection failures by cause (0a14bbb)

  • javascript: keep Wakaru version stderr out of the refusal message (6489d58)

  • javascript: match source-map originals that name parent directories (#1215) (889fb37)

  • javascript: omit self-referential static references with disclosure (#1157) (b620e2a)

  • javascript: preserve alias and container uncertainty (73e98b2)

  • javascript: preserve graphs with async chunk self-references (#1152) (7220166)

  • javascript: preserve property paths and uncertain slot presence (475a0f8)

  • javascript: reject encoded separators joined by HTML URL whitespace (2ddd945)

  • javascript: reject encoded separators joined by HTML URL whitespace (fb57c86)

  • javascript: report located sources with differing digests as modified (#1216) (01174c4)

  • javascript: resolve HTML script URLs after URL whitespace and percent decoding (d601b80)

  • javascript: resolve HTML script URLs after URL whitespace and percent decoding (502528c), closes #1236

  • javascript: resolve package exports targets only to the exact file (#1181) (2a620c0), closes #1174

  • keep the Ghidra session root free of dot-prefixed path elements (a8b8288)

  • managed: preserve literal library names during native matching (81b70bc)

  • managed: separate metadata and signature completeness (2f02eff)

  • mcp: advertise input patterns without look-around (1f099a6)

  • mcp: advertise input patterns without look-around (a8701ea), closes #1282

  • mcp: deliver tool errors within advertised schema contracts (da606ff), closes #1261

  • mcp: deliver typed errors without invalid structured output (#1277) (7e96f25)

  • mcp: emit portable Unicode NUL patterns (#1230) (aa5750c)

  • mcp: measure tool errors against their text-only delivery (fe34ec2)

  • mcp: measure tool errors against their text-only delivery (7b51121)

  • mcp: only recommend exporting retained evidence (5f749c2)

  • name host and tool requirements in optional adapter refusals (68cb02f)

  • name host and tool requirements in optional adapter refusals (170d0bf)

  • native: distinguish batch selectors from resolved entries (13c3b68)

  • native: distinguish batch selectors from resolved entries (bfaa5a6)

  • native: name the CLI flag that selects another plist (9b69503)

  • native: name the plist selection that works when Info.plist is missing (5612496)

  • native: name the plist selection that works when Info.plist is missing (a6fdf42)

  • native: refuse truncated executable headers at target admission (d39a450)

  • native: refuse truncated executable headers at target admission (0b04d38), closes #1189

  • process: apply one timeout rule to both execFileOutput modes (3d32819)

  • process: await cleanup on CLI and MCP cancellation (f6fe575)

  • process: keep ports before a chunk-final period (184ed97)

  • process: localize capture truncation diagnostics (#1284) (33bf585)

  • process: normalize ports that end a sentence (098d769)

  • process: normalize ports that end a sentence (db98a51)

  • process: preserve numeric output and original PTY evidence (c5c75c3)

  • process: preserve numeric output and original PTY evidence (00d8e44)

  • process: preserve unknown filesystem absence in partial captures (c8544b1)

  • process: refuse malformed timeouts for stoppable commands (136d4aa)

  • process: refuse malformed timeouts for stoppable commands (59c91c8)

  • process: require current captures and preserve cleanup failures (2a77469)

  • process: retain known events from incomplete captures (5eb0049)

  • process: stop cancelled Swift helper builds before removing their files (cf41561)

  • process: stop cancelled Swift helper builds before removing their files (c717204), closes #1173

  • process: stop timed-out commands with the caller's stop signal (4b38d18)

  • process: stop timed-out commands with the caller's stop signal (063de50)

  • process: treat non-ASCII letters as port continuations (ad813e4)

  • process: validate terminal byte totals against retained frames (69833fb)

  • process: validate terminal byte totals against retained frames (39eb058)

  • providers: preserve observations and primary cleanup failures (0696bde)

  • reference: represent unreadable symlink targets explicitly (b7b4333)

  • restore caching, preserve failures, and verify fixture claims (#1211) (27a9cea)

  • server: report 2025-era client identity and features in binary_session (e6abaef)

  • server: report 2025-era client identity and features in binary_session (b8312fa), closes #1167

  • session: require an open target for session-bound native and artifact tools (d8e314c)

  • session: require an open target for session-bound native and artifact tools (cf77d07), closes #1166

  • session: retain failed provider cleanup for lifecycle retries (#1260) (24a3aa0)

  • setup: keep Codex TOML comments when adding or removing REA (f5539cf)

  • setup: keep Codex TOML comments when adding or removing REA (e9c48a6), closes #1163

  • setup: preserve initial backups and Codex comments (#1204) (6051cb2)

  • setup: stop remaining uninstall removals after a client fails (fd975c7)

  • setup: stop uninstall before removals when a client config is unsafe (4fb2f3e)

  • setup: stop uninstall before removals when a client config is unsafe (5cc841d), closes #1164

  • snapshot: report query workflow and Evidence counts separately (04aef6d)

  • snapshot: report query workflow and Evidence counts separately (0e77953)

  • website: clarify Android host and JDK requirements (5691606)

  • website: identify publication verifier requests (e6905c1)

  • windows: retain runtime authority after cleanup failure (af7a439)

  • windows: retain unsettled jobs for cleanup retry (76b214e)

Performance Improvements

  • mcp: share repeated output schema definitions. (441813c)

  • hopper: resolve string search records once per query (#1229) (9426c3f)

  • mcp: reuse input schemas without losing caller guidance (#1162) (e1afbc1)

  • snapshot: avoid redundant result copies and serialization (552634d)

  • snapshot: avoid redundant result copies and serialization (569d2bc)

Code Refactoring

  • domain: remove obsolete comparison representations (5510b27)
  • enforce canonical evidence and provider boundaries (63bf914)
  • remove forwarding exports and redundant aliases (ad59531)
  • schemas: share portable identifier and base64 patterns (#1227) (954badb)

Documentation

  • add French README translation (84094af)
  • add French README translation (9664b2b)
  • celebrate 30,000 GitHub stars 🎉 (6987cb0)
  • celebrate 30,000 GitHub stars 🎉 (beca997)
  • clarify REA has no affiliated cryptocurrency or token (#1214) (c2d8146)
  • explain 6.2 contract and saved-data migration (#1304) (c267e99)
  • ghidra: explain supported heap and CPU controls (#1278) (0c6852b), closes #1255
  • keep the 30k milestone in Star History (#1217) (c399670)
  • require focused brittleness cleanup and executable examples (d6832c3)
  • thank feature request contributors (9db1fd0)
  • website: continue the Calculator example with reconstruction (4578647)
  • website: continue the Calculator example with reconstruction (18a1e8c)
  • website: explain SEO maintenance and indexing follow-up (bb8ff2c)
  • website: introduce the worked homepage examples (f6f5c16)
  • website: invite deeper projects and reader feedback (3fb9ffa)

Tests

  • apple: verify compiled Mach-O root occurrence facts (#1300) (4bb4c6f)
  • artifacts: assert asset-catalog target refusal only on macOS (44d5b4b)
  • artifacts: pin per-occurrence roles for direct Mach-O roots and shared bytes (701d90a)
  • artifacts: pin per-occurrence roles for direct Mach-O roots and shared bytes (b9e29c5), closes #1234 #1235
  • artifacts: read /bin/ls slice layout from its FAT table (#1223) (c89b3a0)
  • artifacts: verify compiled Mach-O roles and permissions (4bb4c6f)
  • consolidate redundant assertions into boundary workflows (b71a591)
  • ghidra: preserve selected verification resource limits (1c3766a)
  • ghidra: size oversized annotations for canonical delivery (1e34197)
  • ghidra: use host-native absolute session root fixtures (1e83d27)
  • javascript: expect the invalid input_path code in the streamed CLI failure test (d186ca7)
  • mcp: read bundle failures from public error content (69c3b32)
  • mcp: read typed errors in canonical Evidence regressions (fd46cff)
  • mcp: validate public error diagnostics in acceptance workflows (09058eb)
  • native: assert batch identity in production registration (933fcb3)
  • native: build the .app fixture executable with a complete Mach-O header (facaae8)
  • process: check malformed capture choices concurrently (6020a0b)
  • process: check malformed capture choices concurrently (48de11c)
  • remove duplicate workflow examples and self assertions (d6d1cd2)

Continuous Integration

  • website: allow explicitly requested Pages-only publication (796b65e)
  • website: allow explicitly requested Pages-only publication (864160d)
  • website: allow explicitly requested Pages-only publication (#1205) (796b65e)
  • website: publish Cloudflare and Pages from one artifact (761881c)

6.1.0 (2026-10-09)

⚠ BREAKING CHANGES

  • hopper: Hopper regex mode uses ECMAScript Unicode syntax instead of Python re. Matching runs in a cancellable worker with a five-second deadline; literal mode keeps Unicode casefold matching.
  • hopper: remove set_current_document. Use open_binary to switch targets; document arguments are scoped to the active target.

Features

  • clients: register Grok Build and Grok Bot during setup (#1134) (08561e0)
  • ghidra: make the startup deadline configurable (#974) (d84bc8f)
  • website: add GitHub link with live star count (2f59287)

Bug Fixes

  • analysis: bind overview document identity to the active target (#1094) (81b5104)
  • analysis: resolve procedure identities and preserve literal queries (d830cb7)
  • android: report actual provider readiness (c715af8)
  • android: report startup and selector failure causes (6c13fc8)
  • apple: account for repeated archive projections (e1df5e8)
  • apple: budget Interface Builder decoding and projection (dbcf8c3)
  • apple: classify empty dyld settings by consumer semantics (#1110) (fe297e5)
  • apple: decode bundle plist bytes before executable lookup (d575a73)
  • apple: decode Interface Builder XML byte encodings (#1095) (f8e143a)
  • apple: derive dispatch coverage from located decode facts (488f448)
  • apple: keep skipped catalog entries from reading as absence (a079af2)
  • apple: report apps without asset catalogs as empty inventories (e2f0378)
  • apple: report apps without asset catalogs as empty inventories (79e5a39)
  • apple: report missing keyed archive hierarchy references (#1104) (3b2ec69)
  • apple: validate dylib candidates and preserve search uncertainty (#1100) (7914e36)
  • apple: validate physical slices and dylib platform compatibility (15f92f2)
  • application: budget bridge candidate projection by bytes (3d450a2)
  • artifacts: preserve keyed archive integer precision (4034883)
  • artifacts: report keyed-archive selection mistakes as invalid input (5a55d5b)
  • artifacts: report keyed-archive selection mistakes as invalid input (25fb6d3)
  • artifacts: retain failed DMG cleanup state and diagnostics (#1103) (4bb056b)
  • browser: advertise zero-based units for runtime source coordinates (#1085) (6218d28)
  • browser: bind correlated replies to their selected session (96d3caf)
  • browser: bound aggregate source-map decoding before expansion (f983c71)
  • browser: bound script metadata and preserve omissions (faf209e)
  • browser: bound source-map fetches and retain predecessor requests (eaf5734)
  • browser: compose nested source-map column offsets (#1109) (8b08ec0)
  • browser: keep initiator callsites out of script coordinate guidance (#1096) (3c157b4)
  • browser: normalize selected script manifest roots on Windows (#1078) (b49beb4)
  • browser: preserve captures when response bodies are unavailable (96af2fa)
  • browser: preserve command failures and reject malformed replies (6b92002)
  • browser: treat module-import initiator positions as script positions (ae0630a)
  • browser: treat module-import initiator positions as script positions (99d31ee)
  • browser: validate and bound source-map evidence (0a0174b)
  • build: exclude the test-only generated catalog from packages (#1116) (d1c904b)
  • build: make catalogs and packaged skills generated outputs (#1086) (e613405)
  • capture: retain Electron observations and HAR resource failures (44fd183)
  • ci: align diagnostic regressions and format merged changes (67756da)
  • ci: restore generated shard inputs and cleanup assertions (5f93b4b)
  • cli: accept exact native names through explicit selectors (c313606)
  • cli: drive mcp doctor help from a single option schema (b7d803d)
  • cli: preserve blank JSON paths for input validation (#1068) (3dcb732)
  • cli: preserve web cancellation exit status (1d9b96a)
  • cli: support MCP doctor help (a69b833)
  • contracts: preserve local inputs and comparison uncertainty (70e8a8f)
  • docs: validate translated links to canonical product facts (34f7c4f)
  • domain: order canonical paths by code point, not UTF-16 unit (#1034) (b5c2954)
  • domain: preserve prototype-named JSON members through Evidence boundaries (#1049) (40e18b2)
  • domain: reject excessive JSON depth with actionable diagnostics (#1029) (bfbfc73)
  • electron: bound hook retention and report dropped coverage (02d0702)
  • evidence: name the failed constraint when a bundle is rejected (82a1a52)
  • evidence: name the failed constraint when a bundle is rejected (cf96ceb)
  • evidence: report missing evidence files instead of permission advice (e8b92a4)
  • evidence: report missing evidence files instead of permission advice (89252f1)
  • evidence: require a complete record before the single-record hint (38bbb65)
  • firmware: reject malformed UTF-8 producer reports (4a45c14)
  • ghidra: admit Linux arm64 with matching native tools (3e598b2)
  • ghidra: harden location resolution and provider lifecycle (1f5be75)
  • ghidra: make qualified function renames idempotent (4458128)
  • ghidra: parse long procedure selectors without recursion (480b16b)
  • ghidra: preserve function references and snapshot boundaries (84a17d5)
  • ghidra: preserve POSIX runtime paths with spaces (80c3d36)
  • ghidra: preserve source failures and snapshot ownership (704fa76)
  • ghidra: preserve Unicode boundaries without breaking sessions (bef234d)
  • ghidra: recover regex stack exhaustion without losing annotations (bc4aa46)
  • ghidra: reject address truncation before reads and edits (dcae3c6)
  • ghidra: resolve exact external function entries (549effa)
  • hopper: bind analysis to the active target and correct boundary contracts (2f71375)
  • hopper: bind file mappings to verified source bytes (82626c4)
  • hopper: diagnose MCP provider failures with stage, state, and request context (#1044) (5a67c7f)
  • hopper: enforce caller-supplied request deadlines (#1119) (e8939ca)
  • hopper: isolate regex matching from the native API thread (f201b04)
  • hopper: load verified FAT64 slices with native Mach-O semantics (0a49d5b)
  • hopper: normalize native block endpoints and retain terminal evidence (2847311)
  • hopper: preserve launcher evidence on readiness timeout (458771c)
  • hopper: preserve native navigation and annotation semantics (f2e22e1)
  • hopper: preserve owned basic-block endpoint instructions (#1118) (329cf20)
  • hopper: preserve partial native call and string evidence (2461702)
  • hopper: preserve typed string values and verify real searches (7d7b3f9)
  • hopper: report launcher failures before bridge timeout (#1105) (cd756b0)
  • hopper: resolve FAT loaders and original file coordinates (35f1ddd)
  • hopper: validate annotation destinations and symbol extents (b2d5bc1)
  • hopper: verify lease cleanup and repair the macOS test lane (#1111) (b743bd2)
  • inspector: bound retained metadata and preserve cancellation (e714fb0)
  • install: guard empty prefix_args expansion on macOS Bash 3.2 under set -u (#1061) (68b9fa4)
  • javascript: bound primitive string growth and repeated evaluation (4a1837d)
  • javascript: bound semantic expansion and resolve lexical receivers (16f4609)
  • javascript: classify direct defaults and argv elements (6495171)
  • javascript: honor cancellation before evidence publication (#1098) (cc0ee2e)
  • javascript: omit self-referential import edges with disclosure (#1130) (1d7115b)
  • javascript: parse plain TypeScript artifact dialects (#1102) (3db4681)
  • javascript: preserve HTML carriage return source ranges (#1092) (23862af)
  • javascript: preserve lexical open and exact template semantics (d6cc9ca)
  • javascript: preserve original BOM source coordinates (#1093) (83defc0)
  • javascript: retain NodeNext artifact source facts (#1087) (c1b370c)
  • javascript: use Node legacy package entry fields (1706005)
  • managed: bind inspection evidence to artifact identity (73b09f4)
  • managed: match exact method bytes without decoded signatures (17809ca)
  • mcp: flatten root union input schemas (#1062) (6a7650e)
  • mcp: preserve retained evidence on oversized delivery (0639a54)
  • mcp: retain complete application results across response limits (a1ed423)
  • mcp: retain oversized errors before transport delivery (b3f1b4e)
  • metadata: stop schema changes churning generated skill evidence (#1075) (d52f66d)
  • native: bind signature observations to registered target versions (#1099) (c789af0)
  • native: bound retained observations and preserve failure evidence (7c32387)
  • native: preserve bridge failure types during cleanup (1d0baa3)
  • native: resample tool identity for each invocation (14b19a0)
  • native: share command supervision and retain failure output (f2e9c49)
  • native: supervise LLDB and preserve bounded capture uncertainty (915855e)
  • process: avoid cold ownership helper deadline exhaustion (#1139) (65a809a)
  • process: derive executable names from the capture host (#1108) (34cc925)
  • process: identify unknown live processes in cleanup diagnostics (eb89a16)
  • process: name the reason two captures cannot be compared (#1080) (eb69763)
  • process: preserve observations after successful cleanup (2af12a1)
  • process: retain ownership after incomplete cleanup (e2fc249)
  • process: stabilize native capture and ownership prerequisites (2b27515)
  • process: stop failing captures on tokens macOS cannot expose (#1057) (5547c1e)
  • providers: validate ELF versions and preserve probe cancellation (8b01e0c)
  • release: always bump minor for releases (be783ef)
  • release: publish prereleases under the next npm tag (bfb7776)
  • release: publish reviewed release PR merges (cdddfdd)
  • release: recognize conventional titles in GitHub merge commits (f5009ed)
  • release: restore automatic release proposals on main (acb3e0f)
  • release: validate frozen checkpoint versions and breaking notes (8a31508)
  • release: validate frozen checkpoint versions and breaking notes (60825fb), closes #1063
  • select Node legacy package entry fields for import and require (#1035) (1706005)
  • session: serialize snapshot lifecycle with admitted requests (e44cb45)
  • setup: launch Windows npx registrations through cmd.exe (#1072) (ef30343)
  • setup: treat empty client config files as new documents (#1117) (9fd65ce)
  • snapshot: retain MCP workflow replay bindings (5e1afe4)
  • target: preserve app bundle filesystem failure reasons (d4c2c3c)
  • update: accept npm 12 release metadata (#1138) (567a82f)
  • verify: close both sides of the browser proxy (f7366a5)
  • verify: isolate package archives and published canary caches (3eb7dbd)
  • verify: remove stale mocked bridge package probe (826583d)
  • verify: report final success only after resource cleanup (ee043e2)
  • workflows: keep caller-input details in workflow input errors (#1089) (289aef6)
  • workflows: retain residual unknowns through CLI and MCP (0136ee8)

Performance Improvements

  • mcp: advertise each tool JSON Schema once per target (#1059) (5ccb924)
  • build: avoid duplicate documentation generation (c701376)
  • javascript: index configuration and module lookups (67252b2)
  • javascript: reuse validated immutable graphs (#1112) (ec6db0f)

Code Refactoring

  • artifacts: centralize stable inventory identities (135d102)
  • browser: charge source-map records before retention (e762e32)
  • config: prune unused format wrappers and launcher export (81ae838)
  • input: share schema issue error construction (65a6288)
  • setup: validate formats through canonical configuration (4b10665)

Documentation

  • add Persian README translation with full language navigation (7a7460f)
  • add ten README translations and expand language navigation (a61491a)
  • align translated READMEs and website links with English (d83f098)
  • celebrate 20,000 GitHub stars 🎉 (#1079) (9455e7c)
  • check surrounding cases when changing boundaries (46d195e)
  • clarify contribution scope and cosmetic suggestions (1f79002)
  • clarify evidence ownership and verification guidance (a9e00b8)
  • move Portuguese toward the end of language navigation (2a4979b)
  • move star milestone into history sections across readmes (6e6ff7b)
  • require partial native facts at provider boundaries (2b86ea9)
  • require surrounding boundary checks for review fixes (9833c94)
  • testing: prioritize real workflows and distinct regressions (9588482)
  • website: add a CTF showcase and FAQ (#1077) (a4d77f0)

Tests

  • acceptance: add application workflow MCP parity harness and scenarios (5ac3dc9)
  • artifacts: retire simulated mounts after detach failures (f591e37)
  • artifacts: verify native directory identity on supported Windows runtimes (#1069) (e94be95)
  • browser: pin DOM and source-map URL policy classifications (#1120) (c1d0002)
  • browser: reject unmodeled CDP commands in protocol fixtures (017297c)
  • classify application scenarios by their actual boundaries (0e0b386)
  • cli: verify self-import parity and cleanup (55c9ce2)
  • consolidate failure guards and trim unused fixture APIs (ffd9611)
  • hopper: cover real boundary failures and CLI parity (64717ad)
  • hopper: verify real boundaries and prune redundant happy paths (7005166)
  • mcp: serialize real process capture and report unavailable authority (8f9da25)
  • process: cover argv rewrites in native ownership inspection (09d7b9b)
  • process: distinguish native startup from producer verification (9a70fb4)
  • process: expose unavailable capture and unexpected teardown failures (90b06db)
  • process: report the cause of terminal capture failures (8a4c4b6)
  • process: retain cancellation checks under unverified host cleanup (9a5b077)
  • process: retire native caches at worker teardown (a0784c0)
  • process: serialize real CLI capture boundaries (82560eb)
  • prune redundant cases and promote configuration lifecycle coverage (5945915)
  • prune resource-recovery wording assertions (ae06dcf)
  • remove duplicate result assertions before throwing guards (a1b7d40)
  • session: preserve live binding after cancelled switches (1136ea8)
  • setup: scope removal regression to its fixture client (fe48e77)
  • workflows: verify residual questions in CLI snapshots (770d2f6)

Continuous Integration

  • run signature target binding regressions on native macOS (#1107) (1e63144)

6.0.0 (2026-10-08)

⚠ BREAKING CHANGES

  • contracts: MCP filesystem inputs now require absolute host paths, including target/snapshot paths, evidence bundle paths, managed and firmware inputs, browser/Electron launch paths and expected server paths. Calls such as open_binary({"path":"./app"}) must send an absolute path such as /home/analyst/app or C:\analysis\app. Optional paths remain optional. CLI operator-relative paths continue to work. See #948 and #1004.

Features

  • artifacts: trace Mach-O dylib resolution in bundles (78d594c)
  • browser: inspect historical web network captures (#992) (2bf3663)
  • evm: inspect offline bytecode interfaces through EVMole (#1051) (7af7bc8)
  • ghidra: support native x86 PE applications on Windows (#1030) (c6dad93)
  • native: inspect offline ELF layout through pwntools (#1037) (4fc6565)
  • native: inspect recorded crashes through pwntools and pwndbg (#1054) (163ee09)
  • native: observe function and Objective-C method calls under LLDB (1d13cef)

Bug Fixes

  • dotnet: validate managed metadata and CIL boundaries (#938) (bda4ada)

  • build: clarify generated-file check hint and drop redundant catalog step (#998) (6f0ef16)

  • release: extend npm propagation window and improve diagnostics (#943) (06b047a)

  • contracts: require absolute local paths for session filesystem inputs (#948) (5b172b1)

  • ci: generate source catalog before shard tests (#1002) (eb8f649)

  • contracts: require absolute local paths for remaining caller-supplied file inputs (#1004) (cbc0dd1)

  • cli: classify ENOTDIR JSON input failures (#1000) (a6132be)

  • browser: preserve authorized redirect hops (#986) (ae0f725)

  • mcp: reject unknown MCP tool inputs (#975) (fe64fd6)

  • release: publish from explicit source checkpoints (#1003) (64c7188)

  • release: publish from explicit source checkpoints (#1006) (b4fc0ec)

  • javascript: bound semantic node projection for resource safety (#966) (96a46ad)

  • ci: avoid slow Azure archive for the native cross compiler (#1016) (51956c1)

  • ci: decouple stdio smoke tests from Linux display probes (#1014) (93731e1)

  • cli: stream large JavaScript JSON results (#1024) (0e25bef)

  • javascript: complete large-ASAR analysis with file-local projection (#1055) (b9fb438)

  • javascript: recognize digits in artifact URI schemes (#1045) (03424ae)

  • javascript: reconstruct HTML script loads accurately (#1042) (1154f2f)

  • javascript: report application analysis progress on the CLI (#1008) (7b18c58)

  • javascript: resolve module URLs and reject invalid exports targets (#1031) (8d5c88f)

  • javascript: resolve root package exports arrays (#1046) (53409ab)

  • mcp: advertise JSON values without recursive schemas (#995) (7425f70), closes #919

  • mcp: bound capture comparison input schema depth (#1005) (6b55de0)

  • process: preserve partial evidence and verify detached cleanup (#1011) (63cf28f)

  • release: support built-in credentials and refresh release boundary (6a278a6)

  • release: support default credentials and record 5.0.0 boundary (#1012) (6a278a6)

  • release: sync 5.0.0 checkpoint back to main (966cca8)

  • snapshot: replay validated workflow evidence (#984) (1d62e54)

  • windows: allow Java to read retained target snapshots (#1027) (28d5c39)

Performance Improvements

  • artifacts: replace quadratic ZIP overlap checks (#1013) (76e7e51)
  • javascript: cache canonical export comparison sort keys (#1028) (63ba742)

Code Refactoring

  • build: generate MCP tool catalog at build time instead of committing it (#997) (35a4e18)

  • process: separate capture implementation from analyst workflows (#988) (6aa9afb)

  • artifacts: move inventory and extraction into provider owners (#1032) (6e4535c)

  • remove abandoned test-only analysis scaffolding (c93422a)

Documentation

  • improve Korean wording and particles (#1047) (c5d165b)
  • simplify the English README and organize guides (#1043) (28f10cf)

Tests

  • process: wait for observable snapshot ctime changes (#999) (161ed91)

  • browser: consolidate CDP workflows and colocate parser coverage (2682904)

  • ci: stabilize browser source identity fixture delivery (#1023) (ed725da)

  • cli: reduce repeated startup and filesystem setup (d88d6c1)

  • consolidate service and process fixtures (f8a53a8)

  • javascript: consolidate source analysis and export regressions (f517a5a)

  • javascript: cover plain long-line loader identities (#1025) (984fc27)

  • mcp: consolidate SDK schema checks and scenario ports (9c3479e)

  • providers: verify framing through client socket boundaries (1fd1989)

  • prune redundant conformance checks and document test priorities (aafdf8a)

5.0.0 (2026-10-07)

⚠ BREAKING CHANGES

  • native: preserve incomplete native UI captures (#991)
  • android: Android analysis now requires a full JDK 17 or newer with its compiler module for the packaged Java source bridge.

Features

  • apple: project macOS bundle anatomy in application graphs (88c940b)
  • apple: project macOS bundle anatomy in application graphs (dd3e7ae)
  • application: wire Android and Apple inventory graph tools (#852) (e0fd820)
  • browser: attribute native execution and listener sources (#917) (b5afa5f)
  • browser: capture correlated network content and lifecycle evidence (#797) (f9eaf05)
  • browser: trace captured website module imports (#879) (01be082)
  • browser: trace captured website source-map locations (#897) (f430c41)
  • javascript: recover readable modules with Wakaru (#848) (166dcd2)
  • native: decode chained fixups, binds, ObjC categories and properties (a657557)
  • native: decode chained fixups, binds, ObjC categories and properties (3e24a72)
  • native: open iOS-style and iOS-on-Mac wrapper app bundles (2ed89e6)
  • native: open iOS-style and iOS-on-Mac wrapper app bundles (aeebba3)
  • web: export captured scripts for JavaScript application analysis (#801) (472b72a)
  • website: add a shared back-to-top link (5047373)
  • website: introduce REA and the DX-Ball reconstruction (#906) (4e3953c)

Bug Fixes

  • address review nits from batch integration follow-ups (#818) (5a0e0ba)
  • android: align runtime suffix inference (#977) (fb3749a)
  • android: bound fragmented JADX MCP frame memory (#937) (9e39795)
  • android: preserve JVM settings and reuse metadata sessions (#908) (eab34a9)
  • apple: attribute only application-root components in macOS inventories (5524970)
  • apple: count only real framework version directories (2e81e86)
  • apple: pair bridge hypotheses within one application root (7acf4e7)
  • apple: pair bridge hypotheses within one application root (9226ade)
  • apple: traverse keyed archive hierarchy collections (#976) (71ac83f)
  • artifacts: accept APFS image disks ejected with their container (d93ebec)
  • artifacts: accept APFS image disks ejected with their container (b72c079)
  • artifacts: accept the bundle subject when extracting an app bundle (#891) (37d2eba)
  • artifacts: decode flat keyed-archive NIBs with data and shared references (b3f013f)
  • artifacts: decode flat keyed-archive NIBs with data and shared references (2a4667b)
  • artifacts: harden reader lifecycle boundaries (#951) (2366bda)
  • artifacts: keep the post-snapshot detach check out of provenance (62634e4)
  • artifacts: preserve reader failure diagnostics (#987) (fc4a9a0)
  • artifacts: project compiled AppKit actions from the control to its target (b08228d)
  • artifacts: project compiled AppKit actions from the control to its target (#905) (900d7c8)
  • artifacts: project UIKit runtime outlet and event connections (aa8082e)
  • artifacts: project UIKit runtime outlet and event connections (8b24387)
  • artifacts: read AppKit connectors from flat keyed-archive NIBs (#900) (27c272b)
  • artifacts: read keyed archive dictionaries keyed UID as dictionaries (cfd2b0c)
  • artifacts: read keyed archive dictionaries keyed UID as dictionaries (35c82b9)
  • artifacts: report which path constraint failed (#847) (3f1a77f)
  • browser: distinguish computed call keys from identifiers (#808) (02beb74)
  • browser: distinguish WebMCP registration frame owners (#813) (b3b44d8)
  • browser: fingerprint cookies at the selected page URL (#763) (78014e3)
  • browser: identify NodeNext TypeScript original source artifacts (#811) (e84ad86)
  • browser: preserve evidence through deep AST analysis (#924) (f826aa8)
  • browser: preserve form destinations and satisfies mutation uncertainty (#825) (6dd719e), closes #820
  • browser: preserve Link header value delimiters (#805) (dd36405)
  • build: validate installed dependencies before cache hits (#982) (a45fe86)
  • capture IndexedDB object-store record fingerprints (#809) (21a8bd0)
  • cli: align structured output guard with native flags (#777) (e9fac56)
  • cli: emit empty structured filter projections (#914) (2db668f)
  • cli: honor the selected native plist path (#773) (0374865)
  • cli: preserve output and comparison input validation (#981) (d5c43d6)
  • cli: preserve unsupported historical-source imports (#795) (911d580)
  • contracts: align CLI/MCP boundary contracts (#946) (4a60738)
  • deps: remediate smol-toml advisories (93091ab)
  • deps: remediate smol-toml advisories (c55ae3b)
  • dotnet: compare members with undecoded signatures by exact identity (28fd49f)
  • dotnet: compare members with undecoded signatures by exact identity (d52af3b)
  • dotnet: inspect native boundaries of non-managed and malformed PEs (d5f28fb)
  • dotnet: inspect native boundaries of non-managed and malformed PEs (d98dcfa)
  • dotnet: keep a decoded member unknown beside an undecoded counterpart (76b7020)
  • dotnet: keep admitted CLI header facts when metadata is unreadable (e5ba693)
  • dotnet: name the shared key in exact-signature ambiguities (7714e76)
  • dotnet: treat ambiguous undecoded members as possible counterparts (73370e1)
  • errors: report union input issues at the union's path (bddeb63)
  • evaluation: canonicalize Unicode argument keys (#980) (0a4caf4)
  • firmware: accept the verified Binwalk and Unblob release lines (#844) (bef4321)
  • firmware: retain multi-file extraction failures (#978) (8aaf9a1)
  • ghidra: admit the 12.1 line and the install's JDK range (#840) (5cbf06c)
  • ghidra: select exact packaged bridge scripts (#800) (894c30e)
  • ida: share concurrent session cleanup (#950) (f14b6a8)
  • installer: validate exact semantic versions (#954) (248972f)
  • integrate 24 reviewed browser/native/semantics corrections (#815) (3af3811)
  • javascript: advertise the exact empty seed rule and match empty API keys (35e5508)
  • javascript: analyze source maps with empty source names (58ef8ac)
  • javascript: analyze sources containing empty string literals (e7cbfe0)
  • javascript: analyze sources containing empty string literals (11fc3b9)
  • javascript: filter keyed-collection receivers only for get/delete (00f707b)
  • javascript: handle deep AST traversal and addition without stack overflow (#915) (62b3711)
  • javascript: handle deep static member paths (#939) (348c65c)
  • javascript: keep bare relative URLs for computed-method XHR (e32028d)
  • javascript: keep computed-method XHR request URLs (602d002)
  • javascript: keep exact empty env keys and method names (522c2d0)
  • javascript: keep exact empty env keys and method names (f7954a8), closes #783
  • javascript: keep exact empty require paths and request fields (ad1f6b5), closes #783
  • javascript: keep exact empty values in graph identities (f608127)
  • javascript: keep exact empty values in graph identities (63012ee)
  • javascript: keep keyed-collection reads out of endpoints (9075ce7)
  • javascript: keep keyed-collection reads out of endpoints (eb68761)
  • javascript: keep literal HTTP methods on storage-named receivers (9f48a76)
  • javascript: keep literal-method and URL-literal requests on aliased receivers (e3e7664)
  • javascript: keep mutated object initializer values unknown (#752) (6caa38a)
  • javascript: keep storage open versions out of XHR endpoints (4f51103)
  • javascript: keep storage open versions out of XHR endpoints (898b0f6)
  • javascript: keep XHR and client endpoints that receiver spellings hid (05f43ed)
  • javascript: leave empty application values unlabeled (527b76e)
  • javascript: match exact empty literal channels and seeds (e20da1f)
  • javascript: never read window or document open as XHR (ae849a7)
  • javascript: preserve computed Electron member uncertainty (3a4a63f)
  • javascript: preserve computed Electron member uncertainty (1260cac)
  • javascript: project decoded file URL paths (#810) (2572e1e)
  • javascript: read open() endpoints only from XHR method/URL pairs (63e0822)
  • javascript: read open() endpoints only from XHR method/URL pairs (1be3705)
  • javascript: read substitution-free templates as exact strings (c371d6e)
  • javascript: read substitution-free templates as exact strings (77cf757)
  • javascript: resolve bare source-map and worker URLs next to the script (#890) (45fcd28)
  • javascript: retain recovered call argument positions (#929) (e6ba9c3)
  • linux: improve Hopper reliability and CachyOS support (#963) (98b2b02)
  • mcp: advertise reserved process environment key (#949) (e0d76ae)
  • mcp: isolate optional observation adapter failures (#838) (be3cfbf)
  • mcp: preserve exact guided prompt context (#761) (66c26f2)
  • native-ui: handle incomplete accessibility child collections (#944) (ac3bae3)
  • native: inspect plists containing data, dates, and non-finite reals (bc2cd8b)
  • native: inspect plists containing data, dates, and non-finite reals (5ead2cf)
  • native: keep echoed codesign paths out of signature fields (#865) (4aa2b60)
  • native: keep echoed Mach-O paths out of load commands and symbols (ab985c6)
  • native: keep echoed Mach-O paths out of load commands and symbols (37fe105)
  • native: keep integral plist reals beyond the JSON range as reals (#860) (3b92a2b)
  • native: keep plist XML element types for large numbers (f85056d)
  • native: keep the resolved bundle plist and permission failures (418a556)
  • native: pass Swift symbols to swift-demangle as operands (dd90965)
  • native: pass Swift symbols to swift-demangle as operands (6c88094)
  • native: preserve incomplete native UI captures (#991) (9f496ef)
  • native: report exact plist integers beyond the JSON number range (c9f49db)
  • native: report exact plist integers beyond the JSON number range (430c297)
  • native: report plist permission denials as access failures (5738a0c)
  • native: report why a selected plist cannot be inspected (14f9b3d)
  • native: report why a selected plist cannot be inspected (0674fac)
  • plist: keep character references beyond Unicode literal (5afd8a8)
  • plist: read XML plists containing a proto key (faaee69)
  • plist: read XML plists containing a proto key (a08be51)
  • plist: report omitted proto entries in signatures and Interface Builder (15ab5db)
  • plist: report omitted proto entries in signatures and Interface Builder (6729ee7)
  • preserve native UI failure reasons and dedupe version literals (#854) (2d4a910)
  • process: clarify Windows capture support and recovery (#798) (50787b2)
  • process: harden filesystem snapshot identity and cancellation (#956) (93aa9eb)
  • process: retain provider output until streams close (#928) (b929251)
  • reference: retain partial imports for unreadable directories (#766) (cffc548)
  • release: drive checkpoint releases from frozen branches (fc58fa1)
  • release: publish from explicit source checkpoints (49887f0)
  • semantics: isolate named function expression bindings (#776) (ae81f64)
  • semantics: preserve direct promise ownership boundaries (#758) (e1ca412)
  • semantics: preserve empty string property keys (#764) (630bdaf)
  • semantics: recognize Node builtin default namespaces (#769) (24a0bf9)
  • semantics: retain trailing rest argument flows (#756) (4bfd803)
  • setup: accept the pinned Hopper RPM launcher (#933) (dda8e6a)
  • setup: read an OpenCode V2 server named type as a table entry (#866) (4e17be5)
  • setup: register OpenCode V2 configurations in mcp.servers (957069d)
  • setup: register OpenCode V2 configurations in mcp.servers (69d8afe)
  • target: decode app Info.plist executables with an XML parser (c57f1b7)
  • target: decode app Info.plist executables with an XML parser (c182f72)
  • test: disconnect Hopper fixture IPC on SIGTERM (b912b11)
  • windows: accept ordinary drive path separators (#791) (b62931f)
  • windows: remove cancelled snapshot outputs (#957) (d76f7d1)

Performance Improvements

  • artifacts: stream ASAR members without full buffering (#962) (abd7a5e)
  • call-path: prune dead ends and enumerate without recursion (#909) (e52fe97)
  • cli: defer catalog digests and use canonical cache scope (9a15525)
  • cli: defer unused catalog work during command startup (#920) (9a15525)
  • comparison: reuse canonical sort keys (#990) (ebb065e)
  • dotnet: index declaring-type ranges once per metadata table (#918) (7a9f587)
  • dotnet: index ordered declaring-type ranges once per table (7a9f587)
  • evidence: scale imports and dependency graphs (#941) (7dc40d3)
  • inspector: bound runtime script location authorization (#945) (58381ee)
  • javascript: analyze member chains without recursive copying (#932) (dcde958)
  • javascript: index Promise return-site ownership (#971) (2cedde9)
  • javascript: index semantic fingerprint relations (#942) (c92a344)
  • javascript: reduce analysis and source-map work (#955) (c7530f9)
  • providers: assemble fragmented responses once per line (#911) (df7151b)
  • reconstruction: index coverage evaluation (#983) (f26c8b5)
  • setup: reuse initial diagnostics during planning (#940) (118d43e)

Code Refactoring

  • add incremental capability migration safeguards (#819) (75f50d8)
  • android: group layered source and verification (#873) (8e8921d)
  • apple: group artifact producers and verification (#952) (ef1a0cc)
  • artifacts: isolate JavaScript file acquisition (#916) (f0a68dc)
  • binary: group session selection and snapshot ownership (#886) (dd114d3)
  • binary: move production composition outside application workflows (#965) (33d4761)
  • browser: align inspector exclusions with canonical vocabulary (#834) (de9593a)
  • cli: split core analysis command registrar (#858) (8b9940a)
  • colocate investigation record implementation (#867) (bb19c94)
  • compose investigation record ownership (#845) (ce73c3f)
  • declare auxiliary capabilities from source (#853) (4a6c17c)
  • domain: consolidate property-key extraction behind semanticStaticPropertyKey (#823) (764ff05)
  • domain: converge comparison mechanics on shared vocabulary (#824) (c13c9d4)
  • domain: extract artifact path syntax helpers (#830) (ef535b8)
  • domain: extract source-map envelope walk and disambiguate stringValue (#828) (64ebdf4)
  • domain: map validation taxonomies and add inventory Result seam (#833) (78f4848)
  • domain: split Interface Builder keyed-archive parse from graph builder (#859) (da09706)
  • firmware: group layered source and verification (#878) (507e8b3)
  • ghidra: extract createClient and load-image attestation (#856) (b7df5b7)
  • give Inspector its own capability directory (#869) (021ba69)
  • javascript: group application workflows and verification (#896) (0804722)
  • javascript: group domain semantics and contracts (#907) (f6a58f1)
  • managed: group capability workflows and verification (#926) (28713f9)
  • native: group analyst semantics workflows and contracts (#973) (ea4db4c)
  • native: split Apple dispatch metadata decode facets (#855) (676959e)
  • provider: declare deep capabilities from source (#892) (b808e2d)
  • share Android and firmware provider factories (#826) (3ed59b2)

Documentation

  • add concise lawful-use disclaimer (#888) (4037c65)
  • add DX-Ball reconstruction showcase (#876) (895079d)
  • add prominent website and showcase links to READMEs (2ccc86c)
  • add README star history chart (#850) (11f27de)
  • add website and showcase links to READMEs (#930) (2ccc86c)
  • apple: describe directory-based framework plist ambiguity (6d74992)
  • audit and improve localized readmes translations and wording (00a6ac3)
  • clarify NativeAOT scope and regenerate conformance ledger (c945931)
  • fix stale IDA roadmap item, mermaid paths, toolchain wording (d2aed17)
  • move quick start up and mark skill install optional (554e9b1)
  • note Cloud Agent Node.js toolchain (#837) (6aa6350)
  • publish VitePress documentation on GitHub Pages (c78fe69)
  • separate ambiguous and unavailable provider recovery (c3f2b8e)
  • show task-scoped readiness and provider preference in the quick start (880cca1)
  • show task-scoped readiness and provider preference in the quick start (5fd0db3), closes #726
  • update release boundary to npm 4.1.0 with Windows native bundle (69be514)
  • website: add Notion case study and improve onboarding (a6ba772)
  • website: add TH04 bullet-ring case study (f8d84da)
  • website: add worked guides and keep Pages publishing manual (#925) (4f25ee3)
  • website: clarify guides and case studies (5065fcd)

Tests

  • artifacts: report compiled connector records when a storyboard route is missing (d421d3f)
  • artifacts: report observed action routes when a compiled route is missing (c60b737)
  • artifacts: write the storyboard fixture's action in Cocoa syntax (53bfa7e)
  • eliminate fixture races and prune redundant scaffolding (#849) (f72931d)

Continuous Integration

  • consolidate macOS native baseline checks (#935) (810fe53)
  • verify native arm64 and Intel macOS workflows (#898) (4801a24)

4.1.0 (2026-10-06)

Features

  • android: integrate static APK analysis with headless JADX (#738) (904d03e)
  • evidence: accept exact retained application references (#734) (d0f3480)
  • firmware: integrate Binwalk and Unblob analysis (5a7c769)
  • ghidra: add atomic function annotation edits (#709) (9bab553)
  • ghidra: admit explicit DOS COM analysis (#702) (5bcb664)
  • ghidra: enable Windows x64 read-only analysis (#699) (26881da)
  • ghidra: integrate optional NativeAOT metadata recovery (#748) (fb679b6)
  • ghidra: verify DOS load images and expose memory evidence (#697) (a6a8f67)
  • ida: add read-only GUI and headless MCP providers (#754) (8238232)
  • setup: support Command Code MCP registration (#645) (7f1ae42)

Bug Fixes

  • android: validate explicit Java runtime (#742) (7390390)
  • artifacts: make extraction output tree work on Windows (#753) (c8e66c7)
  • browser: classify CSP host sources by their own origin (#707) (1d15bcb)
  • browser: keep bare module locations unresolved (#676) (8189081)
  • ci: upload Vitest blob reports from current path (77799e6)
  • cli: disable unmanaged skill synchronization (433ebda)
  • cli: disable unmanaged skill synchronization (2c1bf92)
  • cli: fail when JSON input files cannot be parsed (18c1829)
  • cli: fail when JSON input files cannot be parsed (3201f05)
  • cli: include build step in missing-runtime recovery (6a37346)
  • cli: include build step in missing-runtime recovery (ae72abd)
  • cli: report reference-source import failures (00eb03d)
  • cli: report reference-source import failures (431e8eb)
  • comparison: break function collection collation ties (c3d013b)
  • comparison: break function collection collation ties (3aaf7e2)
  • comparison: break JSON shape collation ties (217e8cf)
  • comparison: break JSON shape collation ties (805c338)
  • comparison: retain container-only export shape paths (a55b5bb)
  • comparison: retain container-only export shape paths (7864d66)
  • dotnet: preserve leading Unicode content in metadata strings (#667) (ddea063)
  • electron: respect computed option keys and overrides (af48fe8)
  • electron: respect computed option keys and overrides (98de338)
  • evidence: admit current process provider identity (ab5a1c6)
  • evidence: admit current process provider identity (d311940)
  • firmware: validate configured executables (#751) (9a4e6da)
  • ghidra: preserve request and shutdown failure diagnostics (#647) (19f8cdd)
  • ghidra: refuse ambiguous universal Mach-O imports (b1b687f)
  • ghidra: refuse ambiguous universal Mach-O imports (6582b24)
  • hopper: retain shutdown request diagnostics (8d7071d)
  • hopper: retain shutdown request diagnostics (7254871)
  • integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) (#705) (cf06115)
  • javascript: count all source line terminators (e60aa11)
  • javascript: count all source line terminators (03bc6d3)
  • javascript: expose result schema failures (6d1f39b)
  • javascript: expose result schema failures (99263a7)
  • javascript: hash graph and evidence JSON incrementally (#646) (9f42495)
  • javascript: preserve path.resolve reset semantics (863ed47)
  • javascript: preserve path.resolve reset semantics (4177377)
  • javascript: preserve primitive addition coercion (#666) (94cc847)
  • javascript: preserve unknown branches in primitive unions (75a75cb)
  • javascript: preserve unknown branches in primitive unions (9a2f395)
  • javascript: read source-map directives only from comments (#672) (7f1fa64)
  • javascript: scope candidate ambiguity to query traversal (6ad62ce)
  • javascript: scope candidate ambiguity to query traversal (f94fc79)
  • mcp: retain shutdown failure diagnostics (09c249d)
  • mcp: retain shutdown failure diagnostics (fd008cd)
  • native: inspect mixed-signature Mach-O slices (1dccd0d)
  • native: inspect mixed-signature Mach-O slices (66f3cfa)
  • native: retain spaced symbols in dyld inventory (#669) (fa02df9)
  • native: select concrete arm64e Mach-O slices (f04445c)
  • native: select concrete arm64e Mach-O slices (fd3282a)
  • process: honor disabled PID normalization in samples (44b3627)
  • process: honor disabled PID normalization in samples (a4e5736)
  • process: scope comparison unknowns to their evidence (#732) (9dd6cef)
  • reconstruction: accept function comparison source parameters (c3bc38b)
  • reconstruction: accept function comparison source parameters (7a96391)
  • reference: bound Dockerfile language detection (132a3a4)
  • reference: bound Dockerfile language detection (53fa559)
  • reference: classify test suffixes before extensions (e828acc)
  • reference: classify test suffixes before extensions (8b228ae)
  • reference: distinguish computed require member names (ba35b55)
  • reference: distinguish computed require member names (df6e476)
  • reference: preserve unresolved absolute module specifiers (#670) (c8aed47)
  • reference: read linked worktree commit provenance (#677) (d565ecd)
  • reference: recognize CMake build manifests (#665) (1a24be5)
  • reference: retain dynamic import relationships (a5d2986)
  • reference: retain dynamic import relationships (b89de8f)
  • reference: retain recovered parser diagnostics (11d0ef2)
  • reference: retain recovered parser diagnostics (ed3a7f0)
  • setup: accept leading BOM in JSON client configs (a5b970c)
  • setup: accept leading BOM in JSON client configs (fe843ec)
  • setup: align Node runtime checks with package engines (5802ef8)
  • setup: align Node runtime checks with package engines (ea0b733)
  • target: explain the JavaScript directory analysis route (#733) (8d44b3e)
  • trace: match typed seeds against member arrays (65c8797)
  • trace: match typed seeds against member arrays (38ebd54)

Code Refactoring

  • app: split Setup and ProcessOwnership modules (#628) (3c84080)
  • cli: collapse duplicate CLI layer into src/cli (#630) (494d4db)
  • contracts: split tool contracts by family (#634) (5295d56)
  • domain: consolidate canonical ordering and digest helpers (#624) (ba3869c)
  • domain: split error taxonomy into thematic modules (#636) (735c100)
  • native: extract FAT header format switch in Mach-O slice selection (#632) (38b2933)
  • runtime: centralize safe JSON parsing and preserve error causes (#629) (e7f54b3)
  • runtime: name all silent catch causes without changing diagnostics (#637) (5f27e02)

Documentation

  • add the official Trendshift badge to README headers (b6c21b1)
  • add the official Trendshift badge to README headers (7d4ed59)
  • align MCP discovery and skill guidance with the stable catalog (#664) (39db9fe)
  • browser: add an interaction example that captures the visible result (#750) (91daaa6)
  • clarify onboarding and align provider guidance (#745) (5af1699)
  • correct CLI examples and documentation checks (#655) (fc80ea8)
  • fix architecture diagram and pretty-print tool catalog (#626) (5e7f35c)
  • ghidra: explain first-query deadlines and recovery (#736) (e2c23f3)
  • hopper: document HopperTargetLease realpath fallback (#711) (d3f498c)
  • installation: pin manual MCP registration to the release version (#658) (8dd1d84)
  • update Trendshift repository badge (3f6d6dc)

Tests

  • extract shared fixtures, drop knip carve-outs (#627) (55e5eb0)
  • hopper: synchronize startup cancellation with launcher readiness (#662) (88a3c3f)

4.0.1 (2026-10-05)

Bug Fixes

  • release: allow npm propagation time (2ef02ce)

4.0.0 (2026-10-05)

⚠ BREAKING CHANGES

  • Managed comparison metadata adds exact-signature matching and its count, and name_matching now reports exact-signature-fallback.
  • setup: unscoped setup refreshes only existing REA-owned registrations. Use --all-detected to configure every detected client. Setup JSON contains a compact doctor summary; use rea doctor for full diagnostics. Cancellation and successful dry runs now exit successfully.
  • Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
  • tools: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.

Features

  • ghidra: add DOS MZ analysis and complete function extents (#556) (4f099a1)
  • native: add inspection primitives, dispatch traces and approved UI observation (#500) (4fbc501)
  • setup: expand agent integrations and verify updates (#577) (6256b68)

Bug Fixes

  • artifacts: break directory child collation ties (#587) (b37e47c)
  • artifacts: exclude removed paths from unchanged counts (#569) (52bf709)
  • artifacts: expand nested ASARs on Windows (#582) (ebb4c45)
  • artifacts: interrupt ZIP extraction under backpressure (#594) (50f7e81)
  • artifacts: preserve archive entry types and host paths (#581) (28e0f4e)
  • artifacts: refresh cached ASAR headers for each inventory (#574) (f5013c5)
  • artifacts: resolve parents after archive enumeration (#578) (8eac290)
  • artifacts: respect XML plist byte-order marks (#514) (23c4eba)
  • artifacts: retain expanded ASAR container parents (#583) (00fa974)
  • artifacts: retain relative paths in directory identities (#580) (348323d)
  • browser: capture popup network and report early event gaps (#614) (f557207)
  • browser: capture selected events in popup pages (#600) (a3bf4a0)
  • browser: derive source-map imports from syntax nodes (#588) (bae87b4)
  • browser: distinguish duplicate screenshot frame events (#612) (1bd641d)
  • browser: ignore duplicate frame navigations and read block-form source map directives (#546) (828395d)
  • browser: keep subresource redirects out of page navigation scope (#524) (9c28f3c)
  • browser: preserve RGB PNG transparent samples (#595) (9997152)
  • browser: release cancelled CDP cleanup without waiting for responses (#517) (488fd5f)
  • browser: release discarded source-map response bodies (#611) (8642055)
  • browser: resolve redirected source map paths from final URL (#518) (056c123)
  • cli: fail commands returning projected analysis errors (#506) (2fd1196)
  • cli: reject invalid UTF-8 JSON file bytes (#613) (22acb0d)
  • comparison: account for unpaired records after explicit bundle pairing (#603) (12a2e37)
  • comparison: match generated names without swallowing symbol prefixes (#596) (5f3ba3e)
  • comparison: normalize CFG identity by numeric addresses (#593) (d1e5c0e)
  • comparison: require decoded signatures for structural method matches (#604) (4a98c3e)
  • conformance: preserve own JSON keys during comparison (#573) (3460eda)
  • correct native inventories and bridge error classification (#503) (405732a)
  • docs: allow README installation wording to vary (92617f9)
  • ghidra: avoid nested quotes in Windows Java options (a574b74)
  • ghidra: recover evidenced switch cases and default targets (#579) (b225b0f)
  • inspector: preserve lossy Node discovery locations (#542) (84e4361), closes #530
  • javascript: avoid invented computed destructuring properties (#507) (80777d9)
  • javascript: bind named class expressions in their class scope (#510) (55f0267)
  • javascript: classify assignment targets and retain compound-assignment reads (#537) (333d118)
  • javascript: correct lexical and dynamic scope analysis (#538) (6fa6f1f)
  • javascript: honor computed keys when naming callables, exports, requests and options (#536) (4c8dc39)
  • javascript: honor package exports condition order (#591) (8289595)
  • javascript: isolate lexical loop bindings (#511) (c30878f)
  • javascript: prefer package entrypoints over directory indexes (#575) (bb91abd)
  • javascript: preserve literal CommonJS path punctuation (#576) (063cd25)
  • javascript: preserve Node exports fallback stop reasons (#606) (adc07f5)
  • javascript: respect HTML base URL components (#589) (ffbde92)
  • javascript: respect lexical shadowing of require (#509) (6a431d8)
  • javascript: retain property reads during updates (#508) (6b7923c)
  • managed: classify truncated signatures as malformed (#598) (1b6f054)
  • managed: distinguish metadata handles from member accesses (#607) (c73742f)
  • managed: recognize PE Thumb and ARMNT machines (#605) (0ce529a)
  • mcp: emit valid schemas for empty arrays (#535) (4007b20), closes #528
  • mcp: return complete inline Evidence records (#585) (ea9c3da), closes #551
  • native: capture Mach-O header metadata alongside load commands (#525) (a8195ba)
  • native: decode little-endian fat headers (bede3e3), closes #592
  • native: decode Mach protection bits in their proper positions (#586) (6aba6ae)
  • native: inspect Apple dispatch metadata in FAT64 binaries (#590) (f3e6582)
  • native: inspect the selected universal Mach-O architecture (#601) (2b7bb3b)
  • native: match compound otool keys exactly and badge unknown thread entrypoints (#534) (d40502a)
  • native: normalize otool line endings and strip plist JSON BOM (#533) (3e4d4d9)
  • native: preserve text-valued load command metadata (#520) (bcfb407)
  • native: reject signal-terminated command captures (#608) (b81d18e)
  • native: reject trailing text in lipo integers and keep multi-word otool keys (#531) (9e30d93)
  • native: retain lazy dylibs, normalize version-min builds, limit thread entrypoints (#532) (0f77ada)
  • native: retain re-exported Mach-O library dependencies (#516) (4a5673e)
  • package: separate agent and Hopper setup support (#584) (205a977)
  • platform: accept absolute paths for any host and stop blaming the ceiling for a missing grant (#552) (e793e12)
  • process: align provider detach with configured platform (3fff74f)
  • repair boundary contracts across CLI and MCP (#597) (9c25dc4)
  • replay: keep proto own properties and reject symbol-keyed results (#540) (05bb630)
  • replay: link the complete ESM graph before evaluating (#515) (4200a42)
  • replay: preserve CommonJS object as ESM default export (#519) (2df6b51)
  • replay: preserve Date call and explicit constructor semantics (#512) (9975bd2)
  • replay: preserve sparse array positions in result projection (#522) (9d1c363)
  • replay: share one seeded generator and present builtins with real identity (#539) (5b51fa0)
  • repo: keep dependency links out of version control (#617) (b3223e3)
  • skill: remove obsolete grants and audit tool effects (2919def)
  • test: improve capture reliability and runner cleanup (#609) (d19686a)
  • tools: simplify direct invocation and harden boundary contracts (#555) (b5e9891)
  • web: retain uncertainty for incomplete capture inventories (#513) (d8c18f6)
  • win32: probe .cmd/.bat runtime shims via cmd.exe to avoid spawn EINVAL (#505) (31ed005)
  • workflows: preserve punctuation in filesystem source paths (#521) (5b28a8b)
  • workflows: retain container presence in export shape comparisons (#523) (3854458)

Code Refactoring

  • config: take the environment as an input at every configuration read (#554) (53fe7d6)
  • domain: consolidate duplicated semantic member and literal helpers (#550) (09830da)
  • domain: own digest and prefixed identifier shapes in one module (#547) (ea58834)
  • host: inject platform and environment instead of reading them ambiently (#549) (5b59b87)
  • simplify runtime tools and remove replay engines (#572) (e07b816)

Documentation

  • add boundary contract guidance (42e6a8a)
  • add Discord community links to README (79bf26f)
  • align roadmap with direct tool use (eba709e)
  • align translated READMEs and clarify support guides (5b383b2)
  • clarify README wording and analysis tool support (97822f2)
  • move README image above Discord community (ad86d39)
  • place community invitation below README navigation (69a45e0)
  • place Discord community below setup command (778e464)
  • place setup command above README image (c6d3bdf)

Tests

  • setup: isolate client fixtures across host platforms (f73bb0f)

3.2.1 (2026-10-03)

Bug Fixes

  • release: tolerate npm registry propagation delay (726b730)

Tests

  • release: accept guarded npm publishing (b7bc855)

3.2.0 (2026-10-03)

Features

Bug Fixes

  • artifacts: stabilize extraction approval (7eb1a95)
  • browser: reject unknown Electron input fields (1860d4f)
  • ci: retain artifacts for delayed reruns (07888ec)
  • cli: remove ignored result limits (f3645aa)
  • consolidate boundary ownership and cleanup failure paths (#477) (2160d4f)
  • contracts: align byte read schema with provider (f580d9d)
  • ghidra: return complete native analysis results (a66e43a)
  • managed: retain every source location (33b2099)
  • process: capture complete host probe output (6c68ff5)
  • runtime: make observed target role optional (593a8e1)
  • runtime: retain complete reconciled graph content (bedd55a)

Code Refactoring

  • analysis: remove caller-selected result caps (a8c58c6)
  • analysis: remove fixed result quotas (20152a9)
  • artifacts: consolidate inventory into inspection (0fe96d9)
  • artifact: simplify extraction and inventory results (07ff8b3)
  • artifacts: remove duplicate inventory wrapper (aa6eee1)
  • artifacts: remove selectors and traversal quotas (8c24272)
  • artifacts: select extraction by logical path (7ba3580)
  • browser: remove arbitrary capture ceilings (5dd3b46)
  • browser: return complete observation evidence (0e2738f)
  • browser: return complete scenario observations (e80fe41)
  • browser: share authorized main-frame polling (eec75ce)
  • browser: share canonical identity digest (a6d9e49)
  • contracts: remove duplicate schema aliases (4593c29)
  • contracts: simplify workflows and drop readiness tool (7acac61)
  • coverage: evaluate inline without workspaces (9e76054)
  • domain: encode comparison and lifecycle states exactly (#473) (d65730c)
  • domain: share AST property name reader (4f4cc59)
  • electron: retain complete active observations (e8c56e0)
  • errors: remove stale workspace failures (f570d40)
  • evidence: remove obsolete ID resolvers (a3920e2)
  • evidence: remove session ledger quotas (dca293a)
  • files: use caller paths for local evidence files (c34efca)
  • ghidra: remove redundant schema markers (c2a6f4b)
  • javascript: remove analysis ceilings (9aec690)
  • managed: derive inspection from PE CLI extents (dfad09e)
  • mcp: simplify evidence and workflows (6740ed5)
  • mcp: simplify tool inputs and inline results (f55c2b9)
  • mcp: simplify workflow and observation scope (34d00fd)
  • observation: internalize capture budgets (7b3c797)
  • observation: retain complete tool results (fa2b6c5)
  • observation: return complete inventories (c523c38)
  • permission: remove unused authorization helpers (1b0ab75)
  • process: remove fixed scenario ceilings (abf7c11)
  • process: remove redundant schema version markers (b3aca52)
  • process: remove request count ceilings (f2dc749)
  • process: remove unused paired experiment (e1d755f)
  • prompts: make tool workflows optional (3fd9650)
  • reference: share graph index projections (6ee87fb)
  • remove cross-version investigation workflow (81996df)
  • replay: share sandbox probe arguments (9fca6c0)
  • replay: simplify runtime value checks (60cb68a)
  • return complete analysis results inline (a2a3243)
  • return complete tool results inline (0d96275)
  • runtime: retain complete reconciliation outputs (79ea571)
  • schema: remove data-only version markers (5457f4a)
  • server: remove registration alias (8097ec4)
  • server: use canonical elicitation type (bb6a58c)
  • test: colocate pure-domain tests and reduce test debt (#471) (e91c8c3)
  • test: keep coverage at behavioral boundaries (#474) (d4dc940)
  • tools: remove arbitrary workflow ceilings (5f73cb0)
  • tools: remove artificial analysis ceilings (2f08c7c)
  • tools: remove redundant limits and acknowledgements (bd0e341)
  • tools: remove remaining arbitrary workflow caps (ecf3ed8)
  • tools: return complete analysis results inline (2a6eb41)
  • workflows: simplify evidence reference inputs (24e1fa9)

Documentation

  • add REA tool design guidance (#485) (36aeec9)
  • clarify aggregate context tools (c7e207c)
  • clarify MCP tool design guidance (36aeec9)
  • correct inline evidence and Hopper behavior (bf9cce1)
  • describe complete application analysis outputs (271b162)
  • generalize reverse-engineering workflow (#488) (4ecc7a7)
  • improve GitHub issue and pull request templates (c490d85)
  • prioritize reusable analysis primitives (#493) (9dd72c4)
  • refresh managed conformance manifest (23e56c5)
  • refresh tool catalog and cleanup audit fixtures (53db3a4)
  • regenerate tool and evidence catalogs (2f604a3)
  • regenerate tool and evidence catalogs (f2bbd59)
  • tools: clarify complete inline results (3b64c81)
  • tools: clarify complete inline workflows (4168174)
  • tools: describe uncapped tool behavior accurately (4cea84d)
  • tools: update inline workflow guidance (4ad937c)

Tests

  • artifacts: exercise argument-free extraction preflight (a6d5b3e)
  • browser: assert strict inputs without legacy fields (9ddf22e)
  • browser: cover complete screenshot output (3f547ea)
  • browser: remove stale input field assertion (60c110d)
  • cli: consolidate duplicate setup journey (9bd7e2c)
  • cli: remove duplicate browser discovery case (dcb0362)
  • conformance: remove fixture generator test option (ea853ce)
  • contracts: remove duplicate tool inventories (0ae3c08)
  • hopper: name regex search assertion accurately (9240bd8)
  • hopper: remove dossier identity assertion (b5c0b5b)
  • mcp: align workflow assertions with current guidance (f8bb113)
  • mcp: consolidate catalog inventory checks (3afcd64)
  • mcp: validate defaults at tool boundary (21241d2)
  • remove duplicate export schema acceptance (b783e7f)
  • remove obsolete schema version assertions (fe342fa)
  • remove stale limits and handoff expectations (acf33d6)
  • remove vacuous and duplicate assertions (56e2bf7)
  • remove Vitest config test exports (d6e545c)
  • replace brittle workflow and readme checks (b3529aa)
  • replace implementation lock-in with behavioural assertions (#498) (7ee3f23)
  • replay: remove duplicate schema coverage (4ec2343)

3.1.0 (2026-08-09)

Features

  • electron: add autonomous Electron runtime analysis (#464) (8f229ed)

Bug Fixes

  • ci: guard Release Please PR branch parsing (84cc819)
  • ci: guard release PR branch parsing (6838b6b)
  • harden evidence lifecycle and MCP contracts (5155924)
  • harden structured configuration comparisons (#467) (6901edc)
  • npm: preserve explicit setup versions (#465) (1783bf6)

Code Refactoring

  • mcp: make analysis states unrepresentable (#468) (b8a9da0)

Documentation

  • clarify agent reverse-engineering promise (ed4a628)
  • clarify the agent reverse-engineering promise (#466) (ed4a628)
  • npm: simplify current setup command (#469) (8b62b1a)

3.0.0 (2026-08-01)

⚠ BREAKING CHANGES

  • export_evidence_bundle now requires a filesystem path and no longer returns an inline bundle.

Features

  • make evidence bundles canonical MCP resources (1712e6d)

Bug Fixes

  • address MCP resource review feedback (f3b3fb0)
  • align aggregate tools with session capabilities (ede91ff)
  • ci: align Vitest project worker budgets (f47ee1a)
  • ci: allow documented public type aliases (97f6a0f)
  • ci: make coverage report merging composable (788f405)
  • ci: stabilize Vitest project routing and shards (f07acde)
  • errors: preserve actionable analysis diagnostics (0f96bf3)
  • mcp: clarify routing and advertise input examples (969519c)
  • mcp: clarify target routing and caller diagnostics (3e1e8cd)
  • test: bound boundary worker pressure (935721d)
  • test: honor boundary ownership and public aliases (92a1c33)
  • test: retain subprocess coverage and cleanup (7f46bb1)
  • test: retain subprocess coverage and cleanup (dae2b9c)
  • test: stabilize boundary timing (f0d8cda)
  • verify: follow dynamic Hopper tool availability (281e41f)

Code Refactoring

  • preserve provider-neutral runtime seams (a8161f0)

Documentation

  • document resource snapshot workflow (2a45d8d)
  • refresh generated SDK metadata (c824db1)
  • refresh managed completion manifest (59d4659)

Tests

  • contracts: cover validation branches (8ccdb33)
  • derive MCP SDK identity expectations (ab4193c)
  • eval: cover navigation and address tool routing (ba098f2)
  • overhaul deterministic suite architecture (48053d1)
  • overhaul deterministic suite architecture (513d9b1)
  • package: verify npx upgrade on published releases (7b6f7be)
  • package: verify npx upgrade on published releases (1f8ad7b)

Continuous Integration

  • document deterministic suite ownership (3c42403)

2.7.0 (2026-07-28)

Features

  • bytecode: add JVM and Python bytecode providers (1a75f8d)
  • bytecode: add JVM and Python bytecode providers (4e0127d), closes #367
  • conformance: add portable conformance export package format (91fb87d)
  • conformance: add portable conformance export package format (4ee30e4)
  • metadata: add deeper ObjC/Swift metadata and database save/licensing (4602efd)
  • metadata: add deeper ObjC/Swift metadata and database save/licensing (d7a0753), closes #353
  • mobile: add Android APK/AAB/DEX and iOS IPA static investigation providers (18624df)
  • mobile: add Android APK/AAB/DEX and iOS IPA static investigation providers (fdeeb27), closes #366
  • package: add MSIX/MSI/AppX package, resource, and signature analysis (0ef1b91)
  • package: add MSIX/MSI/AppX package, resource, and signature analysis (6c03f83), closes #363
  • pe: add broader PE/COFF/PDB static inspection (f942558)
  • pe: add broader PE/COFF/PDB static inspection (94e6600), closes #362
  • process: replace procfs sampling with event-backed process-tree capture (a5e355a)
  • process: replace procfs sampling with event-backed process-tree capture (d5d2e56), closes #332
  • protocol: add custom TCP/UDP/IPC/XPC and auth-flow capture (1fb22b4)
  • protocol: add custom TCP/UDP/IPC/XPC and auth-flow capture (6fa6f9b), closes #365
  • protocol: add gRPC/Protobuf and JSON-RPC/MessagePack capture (54153ed)
  • protocol: add gRPC/Protobuf and JSON-RPC/MessagePack capture (3f336fe), closes #364

Bug Fixes

  • catalog: digest provider projections (645668b)
  • catalog: digest provider projections (c4cd033)

2.6.0 (2026-07-26)

Features

  • complete evidence-backed roadmap workflows (1a0931b)
  • hopper: report bridge progress diagnostics (7a43420)
  • native: inspect API boundaries with evidence (521139d)

Bug Fixes

  • setup: refresh stale local npx bootstrap (6d37efe)
  • setup: refresh stale local npx bootstrap (90bb161)

Performance Improvements

  • mcp: reduce cold-start work (8ec9bb1)
  • mcp: reduce cold-start work (fecddc0)

Tests

  • add critical provider workflow coverage (4716fa2)
  • hopper: remove brittle diagnostic source assertion (40bf55b)
  • investigation: prove multi-version fixture closure (5184816)
  • mcp: stabilize lazy-loading verification (7157ab0)
  • package: prove artifact cleanup and identity (9522adf)

2.5.1 (2026-07-25)

Bug Fixes

  • ci: normalize generated release metadata (d43a461)
  • ci: normalize release pull request metadata (119954c)

Performance Improvements

  • browser: lazy-load Playwright sessions (305e729)
  • dotnet: reuse authenticated artifact snapshots (c5e8871)
  • eliminate repeated work in analysis hot paths (fbe442b)
  • evidence: validate ledger mutations incrementally (809dfbf)
  • javascript: reuse parsed source across analyses (adc4852)
  • server: cache advertised JSON schemas (6743644)

2.5.0 (2026-07-24)

Features

  • add runtime reconstruction roadmap workflows (1dbb157)
  • analysis: add bounded memory and call tracing (8e7709d)
  • artifacts: add provider-neutral inspection (d997728)
  • browser: capture controlled Playwright scenarios (1ac3118)
  • browser: compare scenario and storage evidence (f27dd74)
  • javascript: compare source with shipped bundles (697be94)
  • javascript: recover runtime semantic effects (38c883b)
  • process: support explicit stdin closure (205bf15)
  • reconstruction: add obligation ledgers (9d48ca7)
  • reconstruction: evaluate end-to-end readiness (38ff741)
  • runtime: add passive V8 Inspector observation (8271650)
  • server: advertise available tools dynamically (035e114)

Bug Fixes

  • analysis: report call-edge truncation (6039b92)
  • browser: close scenario containment gaps (1bd65f6)
  • browser: contain scenario pages and preserve inputs (24b3dc4)
  • browser: require storage fingerprint approval (f0069cb)
  • ci: allow slower real browser startup (095c75d)
  • ci: propagate readiness verifier failures (9f9f9c3)
  • ci: repair cross-platform package verification (1c9e508)
  • comparison: preserve uncertainty and v1 inputs (b9217dc)
  • hopper: add bounded analysis recovery (e0bc7fd)
  • javascript: keep digestless bundle matches unknown (5a76aaf)
  • process: expose launcher identity mismatch (62ac73c)
  • process: normalize macOS launcher identity (9c3aec8)
  • process: tolerate exit during ownership revalidation (a0f8b72)
  • reconstruction: authenticate obligation proof boundaries (7b1e3bd)
  • reconstruction: bind proof evidence to claims (83b3368)
  • runtime: preserve deterministic context identity (9bd2ac5)
  • test: use direct Node launcher on macOS (13f3372)

Performance Improvements

  • test: speed up local and CI validation (1546a8d)
  • test: speed up local and CI validation (42fbbb2)

Code Refactoring

  • application: reuse graph evidence resolution (4e8aa98)
  • browser: centralize scenario metadata budgeting (e79e367)
  • browser: clarify inspector capture identifiers (ca035a7)
  • browser: reuse CDP endpoint parsing (00abf45)
  • javascript: centralize source range comparison (c9500d3)
  • javascript: share semantic call-site lookup (94a2c60)
  • reconstruction: isolate ledger coverage (4f62695)
  • server: reuse availability policy type (eeb4349)

Documentation

  • document roadmap analysis workflows (f29f683)
  • refresh generated roadmap metadata (f904668)

Tests

  • browser: use neutral scenario fixture identifiers (fd25a7e)
  • package: stabilize fake Hopper ownership (0b70131)

Continuous Integration

  • verify runtime observation and readiness (9349ff5)

2.4.0 (2026-07-23)

Features

  • artifacts: support MSIX and AppX packages (6e6cce1)
  • expand reactive capture and package analysis (9da1794)
  • process: add reactive capture scenarios (69761e9)

Bug Fixes

  • capabilities: expose typed availability codes (b906def)

2.3.0 (2026-07-23)

Features

  • complete REA remediation program (d25e98c)
  • evidence: generate verifier completion ledgers (c02d33f)
  • evidence: generate verifier completion ledgers (f5b3e22)
  • javascript: add bounded semantic relation graph (b3939ea)
  • javascript: add bounded semantic tracing (56c1a66)
  • javascript: add local semantic call flow (a26a1c7)
  • javascript: expose bounded semantic tracing (508a9cc)
  • process: add bounded reactive scenario domain (42f3b9c)
  • process: add bounded reactive scenario domain (d34463c)
  • process: add direct replay machine runner (3df9a07)
  • process: compare declared concurrent traces (d81745c)
  • process: coordinate reactive capture effects (b874efd)
  • process: coordinate reactive capture effects (db9a831)
  • process: record global capture event order (8bcdb98)
  • process: record provider and verifier run lineage (02b01d4)
  • process: record provider and verifier run lineage (513fa29)
  • process: run finite-state replay during capture (820af60)
  • process: run finite-state replay during capture (34c583a)

Bug Fixes

  • browser: redact transitional target titles (f6095cb)
  • cli: retain bundled skill and bias setup wizard toward apply (5692b3f)
  • cli: retain bundled skill and bias setup wizard toward apply (fec5c3c)
  • cli: route JavaScript applications from analyze (737940c)
  • cli: route JavaScript applications from analyze (74965d9)
  • javascript: preserve candidate trace ambiguity (8678b57)
  • knip: ignore ps binary and in-file schema exports (9960982)
  • mcp: preserve investigation input policy (5a908a0)
  • mcp: preserve investigation input policy (f4156d9)
  • process: bound trace comparison semantics (b4df565)
  • process: normalize resize frame timestamps (74d1c7b)
  • process: normalize resize frame timestamps (77696df)
  • process: preserve nonconforming differences (f1cc485)
  • process: preserve replay event causality (d895e49)
  • process: protect unrelated Hopper during cleanup (81539c4)
  • process: protect unrelated Hopper during cleanup (e4ee4c9)

Code Refactoring

  • process: extract capture journal recorder (a32b988)
  • process: split trace comparison domain logic (75d5a87)
  • process: split trace comparison helpers (6d8ecd2)

Documentation

  • cli: clarify setup consent comment (e869137)
  • refresh Node 24 TypeDoc output (846193c)

Tests

  • browser: stabilize real shape capture (bb2e243)

Continuous Integration

  • remove redundant typecheck, lint, and format compatibility jobs (eb27f01)
  • remove redundant typecheck, lint, and format compatibility jobs (aeb5cb3)
  • shard coverage tests and skip docs-only suites (c736317)
  • shard coverage tests and skip docs-only suites (fa58082)

2.2.0 (2026-07-20)

Features

  • artifacts: project mobile application inventories (c6a1a93)
  • artifacts: project mobile application inventories (d36b385)
  • process: add bounded replay state machines (fea965b)
  • process: add bounded replay state machines (dc0c2e5)
  • process: compare repeatable paired experiments (e9899c0)
  • process: compare repeatable paired experiments (9ab7aa3)
  • streamline agent integration and MCP routing (02cb20b)
  • streamline agent integration and MCP routing (3e3d458)

Bug Fixes

  • align session filters and Hopper verification (d7d6bdf)
  • artifacts: align projection provider targets (560dbda)
  • artifacts: bound mobile projection candidates (0cc9d46)
  • ci: keep tool kind type internal (b9bead2)
  • ci: retry published package verification (0810486)
  • ci: retry published package verification (c379455)

Documentation

  • refresh generated API links (a2089a4)
  • update application projection API (b0cb28a)
  • update paired process experiment API (a222327)
  • update replay machine API (d74f897)

Tests

  • budget CLI output variant subprocesses (8d3587b)
  • cap workers across all hosts (bc80359)
  • inherit root options in Vitest projects (168100e)
  • isolate slow filesystem and CLI suites (c2e134b)
  • stabilize subprocess-heavy integration suites (a556e94)

2.1.0 (2026-07-18)

Features

  • add managed characterization and coverage closure (1943496)
  • add managed characterization and reconstruction coverage (02c913b)
  • cli: add explicit package-runner setup wizard (891a11f)
  • cli: improve setup onboarding (4851449)
  • cli: improve setup onboarding (16002ff)
  • cli: support package-name setup wizard (1b90e7f)
  • doctor: admit the Windows x64 Ghidra boundary (32dda0c)
  • dotnet: add BYO ILSpy oracle diagnostics (aa200ce)
  • ghidra: add authenticated Windows loopback transport (629ffc3)
  • ghidra: bind imports to admitted target bytes (be19c3f)
  • ghidra: define the Windows P0 admission boundary (6b1fd16)
  • ghidra: inspect Windows headless installations (86e44be)
  • ghidra: launch bounded Windows headless sessions (bc0fb45)
  • harden authority and runtime conformance boundaries (b537ebf)
  • javascript: add binding and constant-value semantic IR (3ea8523)
  • javascript: add binding and constant-value semantic IR (3d71bb5)
  • javascript: add webpack and rspack runtime adapters (7bccb7c)
  • javascript: add webpack and rspack runtime adapters (44c7017)
  • javascript: recover commonjs and esm module relationships (9766fc0)
  • javascript: recover commonjs and esm module relationships (6c41791)
  • permissions: add scoped process capture elicitation (e6cfce3)
  • skill: rename skill to reverse-engineer-anything (9356634)
  • target: classify Windows PE admission metadata (24274fe)
  • windows: define native authority boundary (a1a6b42)

Bug Fixes

  • build: preserve native generated-file line endings (00a3078)
  • ci: remove retired native rebuild steps (2d22731)
  • ci: validate packaged Windows CLI commands exactly (43418ee)
  • cli: require explicit setup selections (992ec50)
  • contracts: make agent-facing schemas self-describing (0df11dd)
  • dotnet: admit real CLI GUID and fat CIL bodies (735973b)
  • dotnet: correct CLI pointer and byref signatures (1387be0)
  • dotnet: correct CLI pointer and byref signatures (fb9ff56)
  • dotnet: downgrade truncated CIL identity and coverage (736a4e1)
  • dotnet: downgrade truncated CIL identity and coverage (dae6807)
  • electron: keep missing unpacked ASAR entries unavailable (fb6964a)
  • electron: resolve package and dirname entrypoints by context (4847fc4)
  • electron: resolve package and dirname entrypoints by context (1ac9a09)
  • ghidra: preserve native endpoint diagnostics (5970a71)
  • ghidra: preserve Windows batch invocation semantics (0ac418d)
  • ghidra: validate Windows control characters explicitly (4dccbec)
  • managed: emit valid x64 conformance PE (dcd94f1)
  • managed: emit valid x64 conformance PE (c52a822)
  • managed: preserve page incompleteness in graph and comparison (a6f02a0)
  • managed: preserve page incompleteness in graph and comparison (8ee0f04)
  • mcp: clarify advertised schema fields (1581e40)
  • npm: use latest entry points without install scripts (34252f5)
  • npm: use latest entry points, remove install scripts, and rename skill (bf85ee6)
  • preserve optional unknown filters (db1efef)
  • remove unused boundary exports (49f1ec1)
  • satisfy dead-code and generated-doc checks (b15a9ec)
  • setup: preserve onboarding after refactor (da48033)
  • skill: disclose retired skill cleanup (4c69e61)

Code Refactoring

  • adapters: split oversized provider workflows (1a99a60)
  • app: split session and CLI workflows (c6ee004)
  • domain: split analysis boundaries (e2c868c)
  • finish lint cleanup (2bea405)
  • managed: split metadata analysis (20c88dd)
  • setup: keep planner helpers private (2d1f961)
  • simplify authorization boundaries (2e5b443)
  • simplify doctor and error projections (37f4ac6)
  • skill: keep only the canonical skill identity (a7c1e87)
  • skill: remove legacy skill compatibility (8cf0dd2)
  • split oversized analysis workflows (af2399e)
  • split oversized analysis workflows (3e61a63)
  • windows: keep capability outcomes module-private (585f523)

Documentation

  • cli: describe every command input (d4be3e7)
  • ghidra: define the experimental Windows P0 (8b5ae41)
  • managed: align normalized CIL claims with shipped v1 semantics (9a92a79)
  • managed: align normalized CIL claims with shipped v1 semantics (3f788e9)
  • normalize inherited source paths (d33213a)
  • preserve generated source links (2ea375f)
  • prioritize agent usability in tool design (ad17fe7)
  • refresh Electron path resolution API (734a4ef)
  • refresh generated API reference (f5f653b)
  • regenerate managed coverage API with Node 24 (e47c00e)

Tests

  • add limit monotonicity and partial-evidence regressions (2cce98c)
  • add limit monotonicity and partial-evidence regressions (4afd970)
  • ci: guard Windows Ghidra workflow isolation (81ed68f)
  • ci: guard Windows Ghidra workflow isolation (98540c8)
  • cli: cover package-name binary alias (40e2f94)
  • hopper: add semantic runtime conformance (da1da3b)
  • package: align setup preflight contract (b33ebb1)

Continuous Integration

  • ghidra: add Windows P0 acceptance and real-engine lanes (0b35510)

2.0.0 (2026-07-16)

⚠ BREAKING CHANGES

  • mcp: require Evidence for managed reconstruction
  • mcp: comparison tools now require session-owned Evidence IDs or approved bundle paths, and structured Evidence results use compact references.

Features

  • application: add cross-layer graph workflows (778b995)
  • application: add isolated JavaScript replay (d86231a)
  • dotnet: add managed artifact triage (c251c38)
  • dotnet: add managed member comparison (55794d6)
  • dotnet: add managed member inspection (98cad37)
  • dotnet: add managed native boundary inspection (466b1bb)
  • dotnet: add managed runtime correlation planning (5f66cfd)
  • dotnet: import managed reconstructions (c506664)
  • dotnet: verify managed native boundaries (8cbc125)
  • electron: map static process and IPC boundaries (3fa2304)
  • electron: reconcile static artifacts with passive runtime (8c67dbd)
  • managed: project static evidence into application graph (6194c1a)
  • managed: project static evidence into application graph (77178bb)
  • mcp: harden contracts and evidence references (ee1cd40)
  • mcp: require Evidence for managed reconstruction (d36af5d)
  • setup: verify installed skill catalog identity (b2d1f2a)

Bug Fixes

  • deps: run freshness check from escaped paths (8a1c128)
  • mcp: align runtime unknown argument validation (d1e7220)
  • mcp: hide managed workflows without a session (412bbaf)
  • mcp: integrate managed contracts after rebase (9c4a93d)
  • mcp: normalize inferred field descriptions (a807471)
  • mcp: parse adapter inputs exactly once (37c0f39)
  • mcp: remove arbitrary schema byte gate (fd08025)
  • mcp: remove schema byte compaction (f728295)
  • package: accept expected doctor diagnostics (0f2d013)
  • test: make host fixtures portable (f23f529)

Code Refactoring

  • mcp: remove obsolete managed evidence parser (f7aa191)

Documentation

  • analysis: define managed-code evidence boundary (80faff3)
  • api: refresh managed reconstruction contracts (2b06433)
  • dotnet: refresh managed reconstruction api (cc1e47c)
  • refresh application workflow API links (4a30820)
  • refresh managed native verification api (849c052)
  • refresh managed runtime api docs (798631a)
  • refresh runtime reconciliation API (87b2348)
  • security: define controlled replay authority (461990d)
  • stabilize replay API source links (a8c1057)

Tests

  • dotnet: add managed conformance verifier (2b75fcf)
  • dotnet: verify managed app graph manifests (5be4051)
  • dotnet: verify managed app graph manifests (a5e5c68)
  • dotnet: verify managed app manifests (793a948)
  • hopper: avoid scheduler-sensitive exit timing (6e6827c)
  • mcp: cover strict compact wire contracts (8de25d0)
  • mcp: derive sessionless managed inventory (cab7c4a)
  • replay: use portable seam executables (3183f47)

1.7.0 (2026-07-15)

Features

  • artifact: reconstruct JavaScript application structure (aa46abf)
  • domain: add versioned JavaScript Application Graph (2ca5672)
  • ghidra: add function analysis and conformance (d8321de)
  • ghidra: add private headless provider session (f0e625d)
  • ghidra: implement read-only inventory operations (b1c07dd)
  • session: add explicit provider registry and target binding (941d710)

Bug Fixes

  • address setup, upgrade, and process test regressions (960d759)
  • address setup, upgrade, and process test regressions (02f12b9)
  • cli: make clean source checkouts start reliably (ed17e76)
  • cli: make clean source checkouts start reliably (6ba9765)
  • setup: replace managed Hopper on reinstall (0ca93f9)

Code Refactoring

  • domain: remove provider-specific target and snapshot state (21da71e)
  • process: extract reusable provider lifecycle primitives (70e1a0f)

Documentation

  • api: refresh profile source anchors (bd3cf96)
  • api: refresh provider source anchors (a7621c2)
  • architecture: define provider selection and analysis profiles (75f8696)
  • architecture: define provider selection and analysis profiles (f9f2fbe)
  • reconcile product documentation with shipped behavior (addc208)
  • reconcile product documentation with shipped behavior (54056a9)
  • refresh Ghidra inventory API links (a45de27)
  • regenerate JavaScript graph API with Node 24 (da4817a)

Tests

  • keep package setup verification read-only (acaf030)

1.6.0 (2026-07-14)

Features

  • add web and Electron reverse-engineering workflows (be76f80)

Bug Fixes

  • application: add explicit investigation replay (7112e1e)
  • application: add explicit investigation replay (a6b5ca4)
  • browser: keep page endpoint type internal (3743962)
  • browser: observe direct target disconnects (9be24f8)
  • browser: preserve operation-aware cancellation errors (0aac8aa)
  • browser: support page-scoped CDP transports (c4930f4)
  • browser: support page-scoped CDP transports (bf96192)
  • browser: support relative source map URLs (5231e95)
  • cli: confirm project grant revocation (6397e54)
  • cli: confirm project grant revocation (7a4cfb4)
  • cli: restrict production MCP dispatch (8bd0e5f)
  • cli: restrict production MCP dispatch (190e5d3)
  • doctor: honor explicit Hopper launcher (c69fe2c)
  • doctor: honor explicit Hopper launcher (9208592)
  • evidence: enforce the combined record limit (c791802)
  • evidence: enforce the combined record limit (834c70c)
  • hopper: cancel startup before closing (f471a63)
  • hopper: cancel startup before closing (6cc2fdf)
  • hopper: select verified Linux demo mode explicitly (46e4052)
  • hopper: select verified Linux demo mode explicitly (04c5fd6)
  • native: harden command capture edge cases (c2e64a4)
  • native: harden command capture edge cases (d39f98d)
  • preserve setup diagnostics and clean Knip config (2d1e021)
  • preserve setup diagnostics and clean Knip config (5a7ccef)
  • process: gate sampling on initialized PTY root (57938a8)
  • process: gate sampling on initialized PTY roots (e831a41)
  • process: keep validation detail internal (614a119)
  • process: restrict cleanup to captured group leaders (40c6f60)
  • process: settle exited zombie groups (072ce5a)
  • process: settle exited zombie groups (4828326)
  • process: stabilize and speed up the test suite (a3b7de9)
  • reference: preserve distinct parse failures (e02cb2f)
  • reference: preserve distinct parse failures (543510f)
  • rollup batch of fixes (b348b2c)
  • runtime: apply permission reloads atomically (49e843e)
  • runtime: apply permission reloads atomically (3ae7109)
  • runtime: serialize permission reloads (7e53dd6)
  • runtime: unregister shutdown handlers (71072d8)
  • runtime: unregister shutdown handlers (f9e3c23)
  • session: isolate availability observers (43766fd)
  • session: isolate availability observers (e5a80d4)
  • session: reopen replaced targets (e98413c)
  • session: reopen replaced targets (5c55999)
  • setup: configure every detected client (69744a4)
  • setup: configure every detected client (24f9a1f)
  • setup: omit aligned client configurations from plan (a86da4f)
  • setup: omit aligned skill from plan (d81687f)
  • setup: omit aligned skill from plan (2984fa7)
  • setup: preserve client config symlinks (85285f1)
  • setup: preserve client config symlinks (df87544)
  • test: adapt mainReload shutdown seam to registerShutdown signature (0a430c1)
  • tooling: isolate concurrent repository checks (fb17156)
  • tooling: isolate concurrent repository checks (ab8c5c1)
  • upgrade: prevent version downgrades (a204840)
  • upgrade: prevent version downgrades (1d1d234)
  • verify: reconcile PR-212/215/228 package E2E expectations (cfa110c)

Performance Improvements

  • application: scan version artifacts in parallel (528c05e)
  • application: scan version artifacts in parallel (c00739b)

Tests

  • application: verify packaged MCP replay (6601e0c)
  • browser: harden Chrome startup on CI (74c5121)
  • browser: route discovery sockets through proxy (e363f0e)
  • browser: verify page-scoped Chrome transport (c252536)
  • cli: verify packaged policy revocation (3d71737)
  • hopper: cover verified Linux rejection (db202c2)
  • hopper: retry after cancelled startup (6de726f)
  • hopper: verify alternate Linux launcher path (d93257b)
  • package: cover aligned setup plan (a597639)
  • package: cover config symlink lifecycle (d1ef7a5)
  • package: preserve unrelated symlink config (c50e51e)
  • reduce test suite runtime (2223da1)
  • reference: cover failure normalization (3d5041f)
  • runtime: cover idempotent handler cleanup (1bdb59e)
  • serialize subprocess-heavy integrations (f46fc7f)
  • session: reopen replaced target through MCP (1c32880)
  • setup: cover later clients after failure (8f73112)

1.5.0 (2026-07-14)

Features

  • add passive website reverse engineering (9986971)
  • add passive website reverse engineering (2c1ceab)

Bug Fixes

  • browser: drop disallowed redirect evidence (8481be9)
  • browser: scope CDP events and fail closed (5279d77)
  • browser: scope workers and binary frame sizes (dfc06cf)
  • harden PTY events and configured roots (ae8b1c5)
  • harden PTY events and configured roots (31b40f3)
  • permission: defer cache write grants (6a3fd5b)
  • permission: defer cache write grants (f840e70)
  • resolve triaged correctness issues (2575b30)
  • resolve triaged correctness issues (e8ed307)
  • resolve validation and artifact edge cases (2468682)
  • resolve validation and artifact edge cases (ef7f2f9)

Documentation

  • add Hopper screenshot to README (a699fdd)
  • add Hopper screenshot to README (08981a3)

Tests

  • cli: allow cold-start integration timing (7d5621d)

1.4.0 (2026-07-14)

Features

  • core: add typed policy and integrity contracts (190efca)
  • identity: derive MCP surface metadata (2722722)
  • mcp: expose progress resources and availability (da59299)
  • mcp: land policy, resources, and typed contracts (8f79ee7)

Bug Fixes

  • ci: keep generated error docs with their owner (3e60e38)
  • ci: preserve stacked integration changes (cf8e5cf)
  • cli: return nonzero status for operation failures (#121) (00c187e)
  • cli: return nonzero status for operation failures (#122) (964620a)
  • hopper: complete owned Linux shutdown (#116) (fb51874)
  • mcp: preserve migrated revisions and valid links (4149472)
  • preserve actionable artifact diagnostics (#119) (7385220)
  • workspace: migrate legacy integrity identities (d092d4c)

Tests

  • identity: defer live MCP integration proof (74db3fc)

1.3.0 (2026-07-13)

Features

  • add guided MCP workflow prompts (08d5b91)
  • add guided MCP workflow prompts (24c3adb)
  • add persistent cross-version investigation workspaces (c52eb46)
  • add persistent cross-version investigation workspaces (41366ed)
  • analysis: add provider-neutral persistent snapshots (c439b9e)
  • analysis: persist snapshots and close Hopper reliably (c6407ef)
  • errors: add caller-safe typed error projections (3be439c)
  • mcp: return structured typed tool results (eb38e4c)

Bug Fixes

  • bridge: bound regex search work (733a382)
  • bridge: bound regex search work (65682ee)
  • ci: remove unused setup type export (c5728af)
  • cli: render actionable analysis errors (af8c4ef)
  • copy: use agent terminology (12060f6)
  • errors: improve recovery guidance (77454dc)
  • errors: return actionable caller-safe failures (fb0da03)
  • hopper: cancel analysis and close documents reliably (179870e)
  • hopper: return addresses for procedure relationships (2c707ab)
  • linux: start Hopper demo sessions headlessly (32c5080)
  • linux: start Hopper demo sessions headlessly (75818d1)
  • security: restrict investigation artifact inputs (a2076b4)

Tests

  • linux: verify setup through CLI and MCP (67504d2)
  • package: preserve unsupported host verification (977119f)
  • strengthen MCP prompt acceptance coverage (05fb9b1)

1.2.0 (2026-07-13)

Features

  • artifacts: add approved native DMG traversal (24d000a)
  • process: add deterministic capture v3 (d0e21f9)
  • process: add deterministic capture v3 (5a361a6)
  • process: introduce evidence-safe capture v4 (ee4d284)

Bug Fixes

  • artifacts: diagnose unpacked ASAR integrity failures (a504342)
  • ci: remove redundant process exports (19bb231)
  • process: harden capture validation and cleanup (ac78de0)

Code Refactoring

  • artifacts: simplify inventory traversal (c8d762e)
  • setup: split setup and CLI registration (07e1b5a)

Documentation

  • document capture v4 and native mounts (aca518b)
  • document process capture v3 (50f4a29)
  • process: preserve capture invariants (841990b)
  • skill: document capture v4 and DMG mounts (f0a9a3c)

Tests

  • process: use deterministic hang fixture (ba15d16)

1.1.0 (2026-07-13)

Features

  • setup: make installation explicit and safe (29d92ca)
  • setup: make installation explicit and safe (3793889)

Bug Fixes

  • preserve requested evidence paths on macOS (0c0e2b8)
  • preserve requested evidence paths on macOS (3d0ad79)

Documentation

  • api: regenerate TypeDoc reference (0a66cae)
  • define REA contributor priorities (5df4ef6)
  • explain the installation workflow (1c83263)

1.0.0 (2026-07-13)

⚠ BREAKING CHANGES

  • contracts: batch_decompile, get_call_graph, and find_xrefs_to_name now return structured discriminated output shapes.

Features

  • cli: add self-upgrade command (c004220)
  • cli: add self-upgrade command (0d77a9f)

Bug Fixes

  • contracts: keep error schema internal (ac8cc66)
  • contracts: return structured workflow failures (4c54ff6)
  • native: classify pre-aborted analysis first (dfd598f)

Documentation

  • list upgrade in CLI reference (8a24088)

0.5.0 (2026-07-13)

Features

  • analysis: harden agent workflows and evidence boundaries (883db91)
  • cli: align terminal workflows with MCP (b1912b1)

Bug Fixes

  • analysis: accept valid final dossier pages (7c36f36)
  • bridge: harden bounded Hopper boundaries (f8e8ea3)
  • cli: preserve function provider provenance (c630f41)
  • lifecycle: validate owned Hopper process identity (898d6b0)
  • process: default capture networking to loopback (bce3398)
  • process: keep network approval fail-closed (9526389)

Code Refactoring

  • cli: share direct analysis tool types (329fdf6)

Documentation

  • correct pull request tool inventory (d806480)
  • document CLI safety and provider evaluation (efc9bd2)

Tests

  • docs: keep localized claims and tool counts aligned (a7b84a9)
  • verification: strengthen conformance and real-Hopper checks (0d36976)

0.4.0 (2026-07-12)

Features

  • add cross-platform installation lifecycle (cc6a955)
  • add cross-platform installation lifecycle (e651cb6)

Documentation

  • document installation and Linux support (034563a)
  • simplify REA onboarding (e1dfe86)
  • simplify REA onboarding (d85b661)

Tests

  • add package installation end-to-end coverage (993356b)
  • stabilize artifact pagination coverage (f56bdde)

Continuous Integration

  • enforce conventional pull request titles (07a0b98)
  • enforce conventional pull request titles (3a21f16)
  • verify installed package with Linux Hopper (4f97f69)

0.3.0 (2026-07-12)

Features

  • add evidence-backed process investigations (cc8681a)
  • cli: add guided local onboarding (8ca3db8)
  • evolve REA analysis platform (4f18e26)
  • identity: rename package and CLI to REA (3d70812)
  • mcp: add typed bounded analysis tools (893d2e2)
  • session: add dynamic binary lifecycle (f32e718)

Bug Fixes

  • boundaries: reject unsafe local inputs (15e8cf3)
  • doctor: require an executable Hopper launcher (aee9cb8)
  • hopper: launch analysis without stealing focus (ff321dc)
  • hopper: make loader selection non-interactive (2b7ef86)
  • keep execution options internal (167a824)
  • setup: persist detected Hopper launcher (b2866e4)
  • setup: preserve consent and startup target kind (a67054f)
  • setup: preserve invalid MCP configuration (88f5edc)
  • targets: cancel startup and probe PE offsets (66b8d6e)
  • verify: tolerate exited Hopper helpers (b167bd7)

Code Refactoring

  • cli: share runtime between CLI and MCP (97541d8)

Documentation

  • document frictionless binary workflow (ee6d539)
  • document the 43-tool workflow (1f235cb)
  • record runtime and release constraints (62ede51)
  • redesign and localize README (051b6db)
  • redesign and localize README (910eda6)

Tests

  • add source-built Hopper conformance fixtures (d648bcd)

0.2.1 (2026-07-12)

Documentation

  • redesign and localize README (051b6db)
  • redesign and localize README (910eda6)

0.2.0 (2026-07-12)

Features

  • cli: add guided local onboarding (8ca3db8)
  • identity: rename package and CLI to REA (3d70812)
  • session: add dynamic binary lifecycle (f32e718)

Bug Fixes

  • boundaries: reject unsafe local inputs (15e8cf3)
  • doctor: require an executable Hopper launcher (aee9cb8)
  • hopper: launch analysis without stealing focus (ff321dc)
  • hopper: make loader selection non-interactive (2b7ef86)
  • setup: persist detected Hopper launcher (b2866e4)
  • setup: preserve consent and startup target kind (a67054f)
  • setup: preserve invalid MCP configuration (88f5edc)
  • targets: cancel startup and probe PE offsets (66b8d6e)
  • verify: tolerate exited Hopper helpers (b167bd7)

Code Refactoring

  • cli: share runtime between CLI and MCP (97541d8)

Documentation

  • document frictionless binary workflow (ee6d539)
  • record runtime and release constraints (62ede51)
Reference in new issue View Git Blame Copy Permalink