morluto/rea rea-agents-6.2.0

rea-agents: v6.2.0

on GitHub

6.2.0 (2026-10-09)

⚠ BREAKING CHANGES

Read the 6.1 to 6.2 migration guide before upgrading. REA's always-bump-minor policy includes breaking changes; 6.2 is not a backward-compatibility promise. Preserve original saved files and regenerate missing observations rather than fabricating identities or facts.

• MCP / Evidence / snapshots / artifacts: Success results are direct canonical Evidence; read normalized_result rather than the old result/evidence wrapper. Evidence requires nullable analysis_profile, session provider aliases are removed, snapshots require complete profile-bound query records, and artifact roles/permissions belong to occurrences. Recreate incompatible saved data; adding fields without recomputing their semantic identity is invalid. (63bf914)
• Process captures: Legacy v3 conversion is removed. Explicit executable identity and event_journal are required; retain old captures and recapture when current comparisons are needed instead of inventing launch identity or event order. (2a77469)
• Cleanup and evaluation: A one-shot analysis reports cleanup failure while preserving the completed observation or primary diagnostic. Handle cleanup_incomplete and retained observations/resources. Configured agent-evaluation fixtures require Evidence-backed correctness, not routing or answer wording alone. (#1211, 27a9cea)
• JavaScript: Return-field projections require explicit presence; export-shape changes carry both sides' presence and property inventory coverage. Semantic object operations retain complete property_path segments. Regenerate old analysis and distinguish unknown values from unknown presence. (475a0f8)
• Function comparisons: Remove the unreachable truncated dimension state and summary.truncated counter; update enum and display consumers while retaining explicit unknown facts. (5510b27)
• Historical sources: Unreadable/unknown symlink targets require target: null; external targets retain the observed absolute target. Reimport graphs containing display placeholders such as <outside-root> and handle nullable targets. (b7b4333)

Features

• javascript: report observed export property presence (#1160) (45e3edc)
• mcp: select views of retained analysis results (#1180) (db675f1)
• website: add an Aegis APK code-generation showcase (0270dd5)
• website: add an Android showcase and clearer project prompts (6cc817e)
• website: add beginner examples and synchronized publishing (0fec65d)
• website: add beginner examples and synchronized publishing (#1203) (0fec65d)
• website: add Discord link beside GitHub badge (cc39fc5)
• website: add homepage navigation and faster reading paths (863674b)
• website: add homepage navigation and faster reading paths (c94f06d)
• website: add homepage navigation and faster reading paths (#1213) (863674b)
• website: add search metadata and automatic sitemap (99f257b)
• website: add search metadata and automatic sitemap (b8851cb), closes #1283
• website: clarify reverse engineering and showcase goals (e750c26)
• website: explain REA through a first investigation (5160d9b)
• website: explain REA with Calculator and a playable dinosaur lab (11b9f03)
• website: lead with the playable dinosaur example (19c52f5)
• website: show manual analysis beside a one-prompt workflow (291bc6f)

Bug Fixes

• dev: accept formatter-ignored staged documentation without failing the commit hook; malformed JSON remains rejected. (bd2db2f)

• release: publish reviewed release-PR merges from their exact reviewed source. (c12bad7)

• android: support owned JADX stdio on Windows (#1276) (636b245), closes #1262

• android: validate engine archive prerequisites (#1145) (e9ebfb9)

• apple: report unusable dylib-resolution roots as invalid input (6a1e558)

• apple: report unusable dylib-resolution roots as invalid input (24a30fd)

• artifacts: keep cancellation and the caller path in extraction refusals (37025cc)

• artifacts: keep cancellation and the caller path in extraction refusals (eacf846)

• artifacts: match lipo arm64e variant names to their FAT slices (de5bfec)

• artifacts: match lipo arm64e variant names to their FAT slices (0b32577), closes #1168

• artifacts: name only host-available workflows for non-archive plists (f4c99ab)

• artifacts: name only host-available workflows for non-archive plists (2295855)

• artifacts: recheck failed DMG detaches before reporting cleanup failure (#1155) (58a91f0)

• artifacts: refuse unsupported extraction formats before scanning (8e74c9c)

• artifacts: report encrypted archive entries as unsupported extraction (de43da7)

• artifacts: report non-archive keyed-archive selections as unsupported targets (fef38e4)

• artifacts: report non-archive keyed-archive selections as unsupported targets (8c5088c)

• artifacts: report wrong target kinds as unsupported targets (b34bdcd)

• artifacts: report wrong target kinds as unsupported targets (637bcb5)

• browser: classify export-web-scripts capture selection failures by cause (ddaa183)

• browser: classify export-web-scripts capture selection failures by cause (8c5e34c)

• browser: report Windows HAR heap exhaustion (#1147) (1393507)

• browser: retain scenario observations across failures (614e0c2)

• browser: retain scenario resources until cleanup succeeds (88640f6)

• ci: pass selected environment to Windows Ghidra fixture (#1281) (f085589)

• cli: advertise defaulted inputs as optional in --schema and help (#1175) (b4927a0), closes #1169

• cli: cancel routed JavaScript analysis in rea analyze (#1156) (089bbf5)

• cli: complete cleanup after relayed interrupts (#1202) (911152a)

• cli: list the read failure cause for an unreadable JSON input file (db0afce)

• cli: list the read failure cause for an unreadable JSON input file (6020df5)

• cli: resolve xrefs symbol selectors after address validation (#1209) (7e9c911)

• config: name the rejected setting and its constraint in configuration errors (c3acc34)

• config: name the rejected setting and its constraint in configuration errors (0a0244d), closes #1184

• doctor: find the Homebrew Hopper cask without writing Homebrew caches (98b07d0)

• doctor: find the Homebrew Hopper cask without writing Homebrew caches (a503376), closes #1165

• domain: report target read-permission denials as access_denied (f36c10f)

• domain: report target read-permission denials as access_denied (d0ff57a), closes #1188

• electron: resolve effective preload after option overrides (#1286) (411498d)

• emit v-mode-compatible patterns for tool schemas (#1220) (f0da05f)

• errors: report caller-selected evidence path failures as invalid input (d4a598e)

• errors: report caller-selected evidence path failures as invalid input (db177c9)

• evidence: cancel exports before atomic publication (16624f1)

• ghidra: classify modern Swift manglings in swift type analysis (#1208) (6935dc7)

• ghidra: do not run Java from a relative JAVA_HOME in doctor and setup (04a516b)

• ghidra: do not run Java from a relative JAVA_HOME in doctor and setup (c3f1698)

• ghidra: keep and name a runtime directory that close could not remove (5b769d3)

• ghidra: keep and name a runtime directory that close could not remove (b79d379), closes #1190

• ghidra: keep the NativeAOT target refusal's own recovery advice (f198993)

• ghidra: preserve decoded return flow evidence (b189c3c)

• ghidra: preserve decoded return flow evidence (bcc8a77)

• ghidra: reject relative installation and Java paths in doctor and setup (8998438)

• ghidra: reject relative installation and Java paths in doctor and setup (5356856), closes #1183

• ghidra: report NativeAOT host and target refusals as unsupported, not failures (cfb49eb)

• ghidra: report NativeAOT host and target refusals as unsupported, not failures (42c276a), closes #1185

• ghidra: resolve secondary symbols at function entries (#1195) (6fbdbd6)

• ghidra: stop dereferencing the removed error payload in address verification (b80bd2d)

• ghidra: stop dereferencing the removed error payload in address verification (59fbaa2)

• ghidra: use dot-free private session paths (c3fc6c3)

• hopper: keep the OS error when the FAT64 source cannot be reopened (9f5dc52)

• hopper: reserve Linux demo application before launch (#1158) (33d5ae0)

• javascript: allow cancellation during semantic graph commitment (#1218) (9405bd6)

• javascript: classify application input selection failures by cause (fe5291e)

• javascript: classify application input selection failures by cause (0a14bbb)

• javascript: keep Wakaru version stderr out of the refusal message (6489d58)

• javascript: match source-map originals that name parent directories (#1215) (889fb37)

• javascript: omit self-referential static references with disclosure (#1157) (b620e2a)

• javascript: preserve alias and container uncertainty (73e98b2)

• javascript: preserve graphs with async chunk self-references (#1152) (7220166)

• javascript: preserve property paths and uncertain slot presence (475a0f8)

• javascript: reject encoded separators joined by HTML URL whitespace (2ddd945)

• javascript: reject encoded separators joined by HTML URL whitespace (fb57c86)

• javascript: report located sources with differing digests as modified (#1216) (01174c4)

• javascript: resolve HTML script URLs after URL whitespace and percent decoding (d601b80)

• javascript: resolve HTML script URLs after URL whitespace and percent decoding (502528c), closes #1236

• javascript: resolve package exports targets only to the exact file (#1181) (2a620c0), closes #1174

• keep the Ghidra session root free of dot-prefixed path elements (a8b8288)

• managed: preserve literal library names during native matching (81b70bc)

• managed: separate metadata and signature completeness (2f02eff)

• mcp: advertise input patterns without look-around (1f099a6)

• mcp: advertise input patterns without look-around (a8701ea), closes #1282

• mcp: deliver tool errors within advertised schema contracts (da606ff), closes #1261

• mcp: deliver typed errors without invalid structured output (#1277) (7e96f25)

• mcp: emit portable Unicode NUL patterns (#1230) (aa5750c)

• mcp: measure tool errors against their text-only delivery (fe34ec2)

• mcp: measure tool errors against their text-only delivery (7b51121)

• mcp: only recommend exporting retained evidence (5f749c2)

• name host and tool requirements in optional adapter refusals (68cb02f)

• name host and tool requirements in optional adapter refusals (170d0bf)

• native: distinguish batch selectors from resolved entries (13c3b68)

• native: distinguish batch selectors from resolved entries (bfaa5a6)

• native: name the CLI flag that selects another plist (9b69503)

• native: name the plist selection that works when Info.plist is missing (5612496)

• native: name the plist selection that works when Info.plist is missing (a6fdf42)

• native: refuse truncated executable headers at target admission (d39a450)

• native: refuse truncated executable headers at target admission (0b04d38), closes #1189

• process: apply one timeout rule to both execFileOutput modes (3d32819)

• process: await cleanup on CLI and MCP cancellation (f6fe575)

• process: keep ports before a chunk-final period (184ed97)

• process: localize capture truncation diagnostics (#1284) (33bf585)

• process: normalize ports that end a sentence (098d769)

• process: normalize ports that end a sentence (db98a51)

• process: preserve numeric output and original PTY evidence (c5c75c3)

• process: preserve numeric output and original PTY evidence (00d8e44)

• process: preserve unknown filesystem absence in partial captures (c8544b1)

• process: refuse malformed timeouts for stoppable commands (136d4aa)

• process: refuse malformed timeouts for stoppable commands (59c91c8)

• process: require current captures and preserve cleanup failures (2a77469)

• process: retain known events from incomplete captures (5eb0049)

• process: stop cancelled Swift helper builds before removing their files (cf41561)

• process: stop cancelled Swift helper builds before removing their files (c717204), closes #1173

• process: stop timed-out commands with the caller's stop signal (4b38d18)

• process: stop timed-out commands with the caller's stop signal (063de50)

• process: treat non-ASCII letters as port continuations (ad813e4)

• process: validate terminal byte totals against retained frames (69833fb)

• process: validate terminal byte totals against retained frames (39eb058)

• providers: preserve observations and primary cleanup failures (0696bde)

• reference: represent unreadable symlink targets explicitly (b7b4333)

• restore caching, preserve failures, and verify fixture claims (#1211) (27a9cea)

• server: report 2025-era client identity and features in binary_session (e6abaef)

• server: report 2025-era client identity and features in binary_session (b8312fa), closes #1167

• session: require an open target for session-bound native and artifact tools (d8e314c)

• session: require an open target for session-bound native and artifact tools (cf77d07), closes #1166

• session: retain failed provider cleanup for lifecycle retries (#1260) (24a3aa0)

• setup: keep Codex TOML comments when adding or removing REA (f5539cf)

• setup: keep Codex TOML comments when adding or removing REA (e9c48a6), closes #1163

• setup: preserve initial backups and Codex comments (#1204) (6051cb2)

• setup: stop remaining uninstall removals after a client fails (fd975c7)

• setup: stop uninstall before removals when a client config is unsafe (4fb2f3e)

• setup: stop uninstall before removals when a client config is unsafe (5cc841d), closes #1164

• snapshot: report query workflow and Evidence counts separately (04aef6d)

• snapshot: report query workflow and Evidence counts separately (0e77953)

• website: clarify Android host and JDK requirements (5691606)

• website: identify publication verifier requests (e6905c1)

• windows: retain runtime authority after cleanup failure (af7a439)

• windows: retain unsettled jobs for cleanup retry (76b214e)

Performance Improvements

• mcp: share repeated output schema definitions. (441813c)

• hopper: resolve string search records once per query (#1229) (9426c3f)

• mcp: reuse input schemas without losing caller guidance (#1162) (e1afbc1)

• snapshot: avoid redundant result copies and serialization (552634d)

• snapshot: avoid redundant result copies and serialization (569d2bc)

Code Refactoring

• domain: remove obsolete comparison representations (5510b27)
• enforce canonical evidence and provider boundaries (63bf914)
• remove forwarding exports and redundant aliases (ad59531)
• schemas: share portable identifier and base64 patterns (#1227) (954badb)

Documentation

• add French README translation (84094af)
• add French README translation (9664b2b)
• celebrate 30,000 GitHub stars 🎉 (6987cb0)
• celebrate 30,000 GitHub stars 🎉 (beca997)
• clarify REA has no affiliated cryptocurrency or token (#1214) (c2d8146)
• explain 6.2 contract and saved-data migration (#1304) (c267e99)
• ghidra: explain supported heap and CPU controls (#1278) (0c6852b), closes #1255
• keep the 30k milestone in Star History (#1217) (c399670)
• require focused brittleness cleanup and executable examples (d6832c3)
• thank feature request contributors (9db1fd0)
• website: continue the Calculator example with reconstruction (4578647)
• website: continue the Calculator example with reconstruction (18a1e8c)
• website: explain SEO maintenance and indexing follow-up (bb8ff2c)
• website: introduce the worked homepage examples (f6f5c16)
• website: invite deeper projects and reader feedback (3fb9ffa)

Tests

• apple: verify compiled Mach-O root occurrence facts (#1300) (4bb4c6f)
• artifacts: assert asset-catalog target refusal only on macOS (44d5b4b)
• artifacts: pin per-occurrence roles for direct Mach-O roots and shared bytes (701d90a)
• artifacts: pin per-occurrence roles for direct Mach-O roots and shared bytes (b9e29c5), closes #1234 #1235
• artifacts: read /bin/ls slice layout from its FAT table (#1223) (c89b3a0)
• artifacts: verify compiled Mach-O roles and permissions (4bb4c6f)
• consolidate redundant assertions into boundary workflows (b71a591)
• ghidra: preserve selected verification resource limits (1c3766a)
• ghidra: size oversized annotations for canonical delivery (1e34197)
• ghidra: use host-native absolute session root fixtures (1e83d27)
• javascript: expect the invalid input_path code in the streamed CLI failure test (d186ca7)
• mcp: read bundle failures from public error content (69c3b32)
• mcp: read typed errors in canonical Evidence regressions (fd46cff)
• mcp: validate public error diagnostics in acceptance workflows (09058eb)
• native: assert batch identity in production registration (933fcb3)
• native: build the .app fixture executable with a complete Mach-O header (facaae8)
• process: check malformed capture choices concurrently (6020a0b)
• process: check malformed capture choices concurrently (48de11c)
• remove duplicate workflow examples and self assertions (d6d1cd2)

Continuous Integration

• website: allow explicitly requested Pages-only publication (796b65e)
• website: allow explicitly requested Pages-only publication (864160d)
• website: allow explicitly requested Pages-only publication (#1205) (796b65e)
• website: publish Cloudflare and Pages from one artifact (761881c)