morluto/rea rea-agents-6.3.0

rea-agents: v6.3.0

on GitHub

6.3.0 (2026-10-09)

⚠ BREAKING CHANGES

• captures: Historical captures without current producer accounting or transaction identity, and web diffs missing accessibility or storage dimensions, are rejected. Preserve original captures and recapture with the current producer; update comparison consumers to include every dimension rather than synthesizing missing observations. See the process capture guide and browser scenario contract. (3283a45)
• browser: JSON shape paths now contain typed property and array-element segments. WebMCP input_schema_shape is replaced by input_schema and input_schema_sha256, retaining declared examples and defaults.
• process: Filesystem digest omission entries now require system_code; budget and changed-file omissions use null, and unavailable-file omissions preserve the operating-system error code.
• contracts: Provider analysis outputs must explicitly supply metadata previously repaired with defaults; unsupported nullable facets must be reported as null.
• javascript: Semantic graph facts now store evidence context IDs and locations. Graph and semantic trace results require an inline evidence_contexts table.
• contracts: source-map URLs now live in target observations selected by declared_url_sha256, and doctor skill identity no longer emits installed_catalog_digest. Use the documented observation join and identity.skill.state instead.
• javascript: remove the never-incremented truncated_scopes statistic from JavaScript application analysis results and schemas.
• native: Objective-C attribute tokens now contain only name and value. Properties report nullable atomicity and readonly facts; class flags, ivar counts, and method requirement flags are nullable when unobserved.

Features

• setup: register OMP during setup (#1301) (8b4c359)
• javascript: record Electron integrity mismatches (7915ee5)

Bug Fixes

• inspector: retain observations after capture failures (dea3498)
• artifacts: bind ASAR interpretation to owned snapshots (d79317c)
• artifacts: infer legacy Mach-O simulator platforms (5aa2002)
• artifacts: preserve archive facts and Unicode path identity (5751f5c)
• artifacts: reject incomplete inventoried extraction (5e8fb53)
• artifacts: retain DMG ownership through uncertain attachment (a27794c)
• artifacts: validate only active extraction entries (cfb12e4)
• browser: follow only HTTP redirect statuses for source maps (82bbe74)
• browser: preserve payload shapes and WebMCP declarations (4951a89)
• browser: release attached viewport overrides without resizing the external page (f6cfbfc)
• browser: retain attached scenario emulation until cleanup (a0523b3)
• browser: retain malformed redirect diagnostics (617cd84)
• browser: serialize attached scenarios through cleanup settlement (cfce91d)
• ci: scope verification and reuse native runners (#1344) (d5cb8ae)
• cli: avoid duplicate primary cleanup diagnostics (37fcea7)
• cli: classify JSON input permission denials (08daf05)
• cli: classify oversized JSON inputs (f7cf4c8)
• cli: stream JSON inputs beyond the whole-document string limit (#1360) (6ce3288), closes #1331
• cli: stream JSON results at the shared command boundary (810107a)
• contracts: advertise NUL with a portable hex escape (3f59a84), closes #1329
• contracts: require observed provider output metadata (a4ba8ae)
• electron: preserve unrepresentable numeric option evidence (41a228c)
• evidence: order canonical projections independently of locale (614fb76)
• files: reject nonregular capture and JSON inputs (5f16124)
• filesystem: reject unstable artifact targets (7829b1a)
• ghidra: reject a native decompiler built for another host (#1280) (3728c82), closes #1192
• ghidra: retain process ownership after failed launch rollback (07675f7)
• ghidra: verify dense jump tables on an optimized fixture (#1374) (73a664b)
• hopper: allow restart after verified owned-provider shutdown (1c12349)
• hopper: probe interior navigation from multi-byte instructions (#1285) (bf934d5)
• ida: compare admitted document paths consistently (890bb66)
• javascript: avoid positive-zero evidence for signed zero (9055bd6)
• javascript: decline source-map UNC references with an unusable host (#1372) (f504c2a)
• javascript: distinguish prefix-only builtins from packages (2b4abbf)
• javascript: honor module-sync package exports (#1361) (d0e6069)
• javascript: parse declaration artifacts in ambient mode (4896adc)
• javascript: preserve agreeing module provenance (db171be)
• javascript: preserve capture-time guards and ordering (001851f)
• javascript: preserve semantic evidence through satisfies (e995b19)
• javascript: preserve uncertainty after references escape to calls (#1292) (355a292)
• javascript: reject invalid package exports configurations (7a4f268)
• javascript: resolve exported callables through lexical bindings (#1351) (a9f5dad)
• javascript: resolve query-only HTML references to their document (55a46f7)
• javascript: retain array identity after length mutations (4bcea1a)
• javascript: retain conditional mutation ordering uncertainty (b8a8190)
• javascript: retain distinct module provenance path components (2bd7de6)
• javascript: retain unresolved value frontiers in provenance queries (3e19875)
• javascript: store source map URLs once (ed8fcae)
• json: preserve runtime limits across JSON file readers (#1350) (9c4a68b)
• managed: bind graph facts to their source Evidence (cc7b5af)
• mcp: admit composed analysis through result bookkeeping (e11f4d3)
• mcp: advertise object roots for union input schemas (#1373) (39dabd0)
• mcp: advertise primitive semantic literal seeds (f62b449)
• mcp: preserve JavaScript workflow identity validation (#1366) (53ed942), closes #1364 #1065
• mcp: retry failed shutdown resources and retain failure reasons (e64678e)
• native: distinguish symbol definitions from metadata (70bad53)
• native: preserve unknown Objective-C metadata (b112d44)
• native: refuse to list architectures of non-Mach-O targets (#1325) (1b73b5a)
• native: retain LLDB cleanup ownership through client close (7ad353f)
• process: keep unobserved file contents unknown (#1358) (f91f279)
• process: retain per-file digest open failures (415145d)
• reference: report malformed UTF-8 before import parsing (f166a2a)
• report malformed application evidence as input errors (218c131)
• retain completed observations when later analysis steps fail (35f121f)
• setup: install the skill for Claude Code (b4a1919)
• setup: recognize supported Nobara hosts (f0dc233)
• skill: pin packaged commands to the shipping package version (2793672)
• skill: pin packaged commands to the shipping package version (#1346) (f39e71c)
• snapshot: preserve complete investigation revision histories (#1354) (1c0cc8a)
• targets: cancel resolution before provider admission (f3c4a33)
• update: preserve disabled client registrations (abf5e24)

Performance Improvements

• javascript: index version relationships once per comparison (#1347) (b1e85ad)
• javascript: validate the version change graph once (#1370) (037709a)
• json: encode streamed JSON iteratively (#1322) (56598be)

Code Refactoring

• use canonical implementations and types directly (765e809)
• artifacts: remove unused root classifier (5291bca)
• artifacts: test inventory changes at materialization boundary (750fb65)
• browser: open scenario sessions without a factory wrapper (d1983a4)
• catalog: import CLI metadata from its owner (8c96baa)
• consolidate boundary semantics and prune redundant tests (392f1f3)
• javascript: normalize erased expression syntax once (b628bba)
• javascript: parse runtime evidence into one verified owner (006b295)
• javascript: remove obsolete scope truncation statistic (449d570)
• javascript: share Babel child traversal (0f10499)
• javascript: share semantic evidence at fact construction (e3bbb9a)
• process: remove duplicate observation and trace entry points (070339a)
• providers: use canonical artifact and managed identities (87f0051)
• reference: simplify malformed UTF-8 handling (377df71)
• remove obsolete source exclusions and identity wrapper (44c92f8)
• remove single-use forwarding helpers (4144e45)

Documentation

• keep license sections text-only (e10f1f0)
• align translated README artwork and layout (ccfbe87)
• add README artwork and refine closing sections (4b8e744)
• add repository-local REA tool design skill (7738c1f)
• celebrate 40,000 GitHub stars 🎉 (3edb217)
• celebrate 40,000 GitHub stars 🎉 (5ecc98a)
• consolidate agent guidance around ownership and boundaries (ba44222)
• contracts: explain canonical URL and skill metadata ownership (e36afa1)
• correct MCP error and capture import guidance (077d6c4)
• correct README setup and runtime guidance (5b3715e)
• explain CI scope and native runner reuse (#1348) (6c9161d)
• prune repeated contributor and tool design instructions (5d79387)
• remove retired architecture and migration artifacts (7a0c800)

Tests

• share the client registration command to restore the jscpd gate (#1317) (5d16be2)
• mcp: remove arbitrary schema inventory thresholds (24673aa)
• android: allow provider readiness under load (961c3c3)
• artifacts: verify extraction races with real filesystem changes (1ac8389)
• browser: avoid duplicating source-map listener setup (9367dc1)
• browser: report redirect status cases independently (5a61562)
• cli: remove duplicate malformed JSON assertion (5d32e42)
• exercise source test selection through Git and Vitest (25711ad)
• filesystem: bound FIFO regressions at consumers (0bfb6e0)
• ghidra: allow rollback tests to reach spawned process (d761d73)
• javascript: share primitive expansion producer fixtures (c867bcd)
• javascript: share semantic graph test facts (ac356c4)
• javascript: verify distinct module origins through reconstruction (96b2b24)
• json: remove assertions covered by CLI output consumers (a959a83)
• managed: include shared dossier fixture in artifact inputs (66a20a2)
• native: retain trace diagnostics when observed hits differ (048b798)
• package: share validated native dossier fixtures (ca90109)
• process: publish capture readiness atomically (74be526)
• process: report cleanup details on cancellation failures (79d5b9a)
• process: use owned CLI and workspace fixtures (4940a86)
• share snapshot replay and managed graph fixtures (d83cbd2)

Continuous Integration

• enforce architecture guards with portable checkout paths (ecc67ca)