morluto/rea rea-agents-6.4.0

rea-agents: v6.4.0

on GitHub

6.4.0 (2026-10-11)

Highlights

• Android: added device inspection, split-APK acquisition, logs, screenshots, file transfers and explicit app lifecycle actions through ADB, plus manifest and localized-string decoding with Apktool. (#1552, #1556) Thanks @3QL.
• JEB: browse project units and decompile selected items through a caller-started local JEB MCP server. (#1536) Thanks @3QL.
• Large analyses: discover retained Evidence without loading every payload, and inspect JavaScript graphs, binary layouts and function dossiers through summaries and selected views. (#1682, #1568, #1570, #1345, #1507, #1247) Thanks @jhuang-tw, @kaoru0822-kitauji, @N0zoM1z0.
• JavaScript: isolate source analysis in an owned process with configurable heap and timeout limits; retain completed facts and explicit unknowns when analysis runs out of resources. (#1651, #1563, #1565) Thanks @N0zoM1z0, @peter-research.
• Ghidra: configure import language/compiler specifications and seed functions, code and labels before auto-analysis. (#1667) Thanks @sqmagellan.
• RPC discovery: recognize supported tRPC calls, HTTP-link URLs and named GraphQL operations in JavaScript applications and web bundles. (#1670) Thanks @pompiliodonatoapp.

Changes

• Added Ghidra support for Windows PE DLLs and bounded MIPS ELF analysis, including carved MIPS inputs with incomplete section tables. Windows P0 remains read-only. (#1303, #1362, #1629, #1290, #718, #1619) Thanks @bqw371, @jaelliot, @kvalls, @N0zoM1z0.
• Enabled set_address_name and set_addresses_names for Ghidra sessions with mutation authority, including namespace-aware data labels and per-address batch results. (#1635, #1634) Thanks @giri256.
• Recovered additional signed AArch64 relative jump-table patterns. (#1592) Thanks @RishTheFish21.
• Added PE resource inspection and read-only NativeAOT metadata parsing for supported x64 PE32+/.NET 8 RTR 9.1 inputs. The NativeAOT parser’s Windows-host Ghidra workflow remains unverified on a real Windows host. (#1482, 76d8f68, #1254) Thanks @N0zoM1z0, @thangldw.
• Added Pi, Hermes and Qwen Code setup, including Hermes active-profile support. (#1376, #1403, #1415, #1409) Thanks @rasatpetabit, @yiliang114, @zaydiscold.
• Added REA_MCP_INPUT_SCHEMA_PROFILE=compact for size-capped MCP clients such as Kimi/Moonshot, while retaining canonical runtime validation. (#1514, #1580, #1484, #1581) Thanks @haythemsellami, @N0zoM1z0.
• Added live process-capture progress and optional finalization_ms to capture shutdown output before timeout escalation; cancellation remains immediate. (#1483, #1583, #1252, #1253, modelcontextprotocol/typescript-sdk#2997) Thanks @N0zoM1z0, @nikolay-dementiev, @sathariels.
• Improved Codex onboarding and recovery from observed client, PATH and provider blockers. (#1613) Thanks @N0zoM1z0.
• Reduced redirected JSON and terminal output size, and deferred heavy imports until their commands need them. (#1413, #1450, #1439, 21dbcf7) Thanks @kaoru0822-kitauji.

Fixes

• Electron analysis: follow renamed and default-imported APIs and optional calls, ignore overwritten identities and media preload attributes, and resolve packaged app.asar pages and unpacked companions. (#1391, #1393, #1400, #1664, #1673) Thanks @kaoru0822-kitauji, @marnixpluim, @N0zoM1z0, @suninrain086.
• JavaScript data flow: preserve returned/yielded reference uncertainty, invalidate property-stored aliases correctly, and retain bundled-module runtime scope. (#1437, #1445, #1471, #1577, #1428, #1442, #1449, #1576) Thanks @CassieFox23, @dakjdakd, @N0zoM1z0.
• JavaScript packages: resolve exact exports subpaths, preserve trailing-slash directory requests and exact CommonJS keys, and respect shadowed require bindings. (#1424, #1615, 5485483, 8b2f851, f998fcb, 1e51c73, #1365) Thanks @akshitkhokhani, @AWUQAQ, @immanuwell, @rudycelekli.
• Large JavaScript inputs: handle oversized inline source maps, deep returns and reassignment loops; avoid argument expansion limits and yield during large analysis passes. (#1386, #1368, #1390, #1539, #1525, #1542, #1545, #1557, #1380, #1401, #1538, #1462) Thanks @cold-atom, @KadirJeager, @kaoru0822-kitauji, @marnixpluim, @N0zoM1z0, @rudycelekli.
• JavaScript receivers: expand escaped methods once, index returned-object targets, and avoid replaying earlier writes or duplicating retained graph allocations. (#1517, #1537, #1444, #1601, #1495) Thanks @CassieFox23, @geekwolf, @kaoru0822-kitauji, @N0zoM1z0, @zeynelacikgoez.
• Browser captures: retain WebSocket URLs, empty connections and frame order; compare only common known payload coverage and preserve incomplete WebMCP replay coverage. (db4e360, aa257ea, e52c0a7)
• Browser scenarios: seed storage in the correct partition, normalize loopback attach identities, retain declared-secret redaction and require verified lineage before Windows Electron signals. (#1604, #1590, #1588, 8b4c3de, #1497, #1591, #1589) Thanks @Adolanium, @akushonkamen, @dakjdakd.
• Added Termux Android browser-scenario support. (#1655) Thanks @tyloryang.
• Web inputs: accept BOM-prefixed HAR, preserve the first duplicate DOM attribute and resolve SVG/XLink URLs in HTML and XHTML. (#1509, #1516, #1602, #1683, #1496, #1586) Thanks @CassieFox23, @kaoru0822-kitauji, @sathariels, @taljeri.
• Screenshot comparisons: validate PNG chunks, distinguish corruption from unsupported encodings and bound comparison memory. (4e4b15b, b3e977e) Thanks @rudycelekli.
• Archives: preserve case-distinct names, report collisions at their diverging segment, detect nested formats from bytes and reject Windows alternate-stream extraction paths. (#1480, #1505, #1553, 573598c, #1470, #1491) Thanks @CassieFox23, @kaoru0822-kitauji.
• Cleanup: retain failed readers, ASAR handles, output trees and provider workers for retry without discarding completed output or partial observations. (ffe0574, de0d341, 3f8c51e, d1235fa, 026126e)
• Providers: canonicalize IDA workspace roots before identity checks, respect IDA cancellation, serialize JEB acquisition and correct Ghidra no-return/imported-symbol recovery. (#1481, #1419, 5f30ea6, f88c990, 49e6f00) Thanks @AS9929, @JonahSimon, @Y0UW1SH.
• Binary metadata: respect PE/.NET section extents, bound binary-plist expansion, scope keyed-archive traversal and decode app Info.plist files without plutil. (#1678, #1515, #1378, #1476, 975dff2, 76296c5) Thanks @jayhemnani9910, @kaoru0822-kitauji, @rudycelekli.
• Windows runtimes: preserve drive-root paths when creating private provider directories. (ee46323)
• Compatibility: load Windows native controls under Node-API hosts with renamed executables, preserve dylib directory requirements, support Wakaru 1.x and reject directory-valued Hopper launchers. (#1531, #1623, #1540, #1426) Thanks @evenafterallisaid, @Fazmin, @pionxzh, @xeropresence.
• Reference imports: normalize internal symlink lookup consistently, preserve exact paths and exclusion provenance, report root access failures and reject FIFO replacements without blocking. (#1535, 2ca3ad2, 6636045, 3967cfa, f1c58cc) Thanks @anujsingh-cse.
• Setup: honor active configuration and skill roots, preserve configured MCP environments, validate Hermes/OMP profiles before writing, recognize Omarchy and retain recovery backups. (#1504, #1607, #1528, #1562, #1662, a011485, #1606, #1521, #1561) Thanks @Adkid-Zephyr, @CassieFox23, @LuisTaffelli, @N0zoM1z0, @peter-research.
• Process capture: retain descendant lineage after launcher exit, preserve identity uncertainty before signaling and release terminals after observation failures. (80896a1, c916850) Thanks @Y0UW1SH.
• CLI/MCP errors: accept JSON files for web comparisons, preserve native option help and union correction details, remove invalid aliases and validate doctor against its discovered output contract. (#1397, #1395, #1425, #1461, 8b4c96e, #1421, #1454) Thanks @Fazmin, @kaoru0822-kitauji, @N0zoM1z0.

⚠ BREAKING CHANGES

• WebSocket results: use network.websocket_connections instead of network.websocket_events. Connections contain request_id, url and events; allow payload_bytes: null when size is unknown. No legacy alias remains. (db4e360)
• Direct resource APIs: pass a caller-owned ArtifactResourceScope to inventory/extraction, JavaScript analysis, reference imports and web exports; retain it through cleanup/shutdown. For readJavaScriptArtifactFiles, scope is argument three and abort signal is argument four. Keep each root inventory source’s single cleanup owner. Use OwnedFileHandle owners, injected ASAR fd/read handles instead of createReadStream, VCS Result values, and WebScriptExportError’s options object. CLI/MCP inputs for the scoped operations are unchanged. (ffe0574, 53e7fad, 684199b, be75ed5, be6272f, e0e49e9, 95a77b6)
• Saved reference graphs: exclusions require their matching pattern and distinguish project-ignored from default-ignored. Re-import graphs missing that provenance. (6585293)
• Terminal captures: keep initial and resized buffers within 1,000,000 cells using columns × (rows + scrollback); oversized scenarios are rejected before launch. (f9ea9a9)
• Optional agent-verification reports: accept schema version 4, nullable expectedFirstTool and targetClarificationPassed. Production CLI/MCP contracts are unchanged. (#1613)
• Capture comparisons: recapture both sides with matching literal-replacements-v1 semantics when custom normalization patterns are used. Legacy unversioned pattern captures remain readable but cannot be compared with new pattern captures; captures without patterns are unaffected. (#1456, 2b6f14f) Thanks @Madhavan006, @N0zoM1z0.
• Artifact graph edges: read child artifact IDs and paths from the occurrence selected by occurrence_id, not edge fields child_artifact_id/logical_path. Earlier inventory Evidence no longer validates against the new commitment. (#1493) Thanks @kaoru0822-kitauji.
• Semantic graph schema: nodes and relations no longer include identifier_strategy, and relation IDs no longer hash it. Earlier Evidence no longer validates against this schema. (#1474) Thanks @kaoru0822-kitauji.
• Semantic identities: select IDs from the parent graph; read exact event names from event_name, endpoints from endpoint and literal values from properties.value. New analyses use digest-based IDs for long/reserved event and endpoint names and value-sha256 literal role keys, with shorter labels; string literal labels now read string literal. Previously stored graphs retain their original IDs and remain valid workflow inputs. (#1427, #1423, #1407) Thanks @N0zoM1z0.

Contributors

• Thanks also to @BaaRai, @commit-regrets, @coygeek, @Franky100-pig, @inii-sayaa, @jopemachine, @JosephDemarest, @keemsisi, @Totopo27 for contributions included in this release.

Full contribution record: 336 commits and 163 merged PRs.