morluto/rea rea-agents-6.5.0

rea-agents: v6.5.0

on GitHub

6.5.0 (2026-10-13)

Provider prerequisites and recorded verification scope are listed in the testing guide.

Highlights

• Analyze selected JavaScript files and recover cross-bundle relationships without expanding the selected source scope.
• Read compact summaries and page retained Evidence across binary, managed, Android, Dart, WASM and network workflows.
• Inspect SQLite snapshots, packet and signal recordings, WebAssembly, Rust dependency metadata and Electron fuses offline.
• Keep completed Evidence and partial observations available when analysis or cleanup fails.

Changes

• JavaScript source selection: analyze exact application paths without expanding imports into the selected scope. Unselected files retain identity and explicit unknown coverage; summary delivery remains separate from source selection. (#1944, issue morluto/rea#1848). Thanks @kaoru0822-kitauji, @N0zoM1z0.

• Code-split recovery: recover related bundles from multiple selected inputs, retaining per-file provenance and downstream cross-chunk imports. Recorded CLI/MCP coverage is Linux x64 with Wakaru 1.14.0 and source-owned esbuild/webpack fixtures; other hosts, releases and arbitrary application equivalence remain unverified. (#1686, issue morluto/rea#1605). Thanks @JingHao-Leon, @pionxzh.

• Package imports: resolve exact package import aliases using the selected loader and package ancestry, rather than guessing sibling files. (#1862, issue morluto/rea#1838). Thanks @AWUQAQ, @mvanhorn.

• Retained analysis views: opt into compact inventory/WASM, managed metadata, Android manifest, Dart AOT, Mach-O and EVM summaries, then page retained Evidence without rerunning analysis. Summary delivery preserves the complete recorded result and its original coverage. (#2122, #2193, #2413, #2438, #2455, #2634, #2308, 9a18251). Thanks @kaoru0822-kitauji, @N0zoM1z0.

• Managed assemblies: Select declaring types when inspecting members, decode inspected ldstr literals with independent coverage, and page retained member summaries. Call and field targets expose target_declaring_type and field_declaring_type, including supported generic method targets; unresolved metadata remains unknown. (#1706, #2125, issue morluto/rea#2121, #2162, issue morluto/rea#2158, #3061, issue morluto/rea#3010, #2163, issue morluto/rea#2160). Thanks @kaoru0822-kitauji, @N0zoM1z0, @Nelglor, @skoodster.

• Packet captures: inspect saved packets with bounded TShark output, compact capture summaries and retained pages; discover installed protocol/field definitions. Recorded real-engine coverage uses Linux and Wireshark 4.6.6; native Windows/macOS and Bun behavior remain unverified. (#2318, #2340, #2496). Thanks @3QL, @N0zoM1z0, @Olorinm.

• Recorded signals: decode existing recordings and discover installed decoders/options through caller-supplied sigrok-cli 0.7.2. This is Linux-only and requires util-linux prlimit; it acquires no hardware samples. (#2339, #2487). Thanks @N0zoM1z0, @Olorinm.

• Web captures: derive an inferred method/origin/path-template API surface from retained HAR data including observed query-parameter names while retaining unknowns; query values, headers and bodies remain excluded. (#1891, #2982, issue morluto/rea#2913). Thanks @mvanhorn, @wunianze666-netizen, @zhangguiping-xydt.

• QUIC captures: inspect retained aioquic 1.5.0 JSON qlog 0.3 objects and page traces/streams/observations. Other qlog layouts remain unsupported; overlap and loss declarations do not prove retransmission or network loss. (#2277). Thanks @LuisTaffelli, @N0zoM1z0.

• Fiddler captures: inspect native SAZ archives with retained HTTP provenance and bounded decoding. Recorded producer coverage is the pinned public encoding corpus; current Fiddler Everywhere variants and Bun-native execution remain unverified. (#2409). Thanks @N0zoM1z0, @zahhak.

• SQLite snapshots: inspect an explicitly selected offline database with table/column selection and bounded Evidence. This operation requires Node 24.x >=24.15 or 26+ with DatabaseSync.limits; supported Node 22 and earlier 24 runtimes cannot use it. A live database/WAL copy does not establish an atomic snapshot. (#2271). Thanks @N0zoM1z0, @Y0UW1SH.

• WASM artifacts: Inspect local modules with bring-your-own WABT 1.0.42 without executing them. Compare imports/exports from two complete core-module inspection Evidence records without requiring an active WABT installation; unsupported signatures and duplicate identities remain unknown, and comparisons do not establish runtime compatibility. Recorded real-tool inspection coverage is macOS arm64. (#1533, issue morluto/rea#884, #2464, issue morluto/rea#2356). Thanks @matbrgz, @N0zoM1z0, @thangldw.

• Go binaries: inspect embedded build metadata, including file-backed unmapped Mach-O debug segments. (#1363, 7fb097d). Thanks @Y0UW1SH.

• Flutter APKs: identify snapshot/engine builds and inspect AOT structure without an external engine. Recorded real APK coverage uses the documented Flutter Gallery fixture; macOS/Windows and complete pool semantics remain unverified, and pool coverage stays partial. (#1582). Thanks @3QL.

• HarmonyOS packages: inventory HAP/HSP/App Pack structures without executing code. The recorded real workflow covers one pinned HAP through repository-built CLI/MCP; installed-package and real HSP/App Pack coverage remain unverified. (#1447). Thanks @BaaRai.

• Ghidra raw inputs and references: compatible Linux/macOS Ghidra profiles accept caller-selected raw architecture/entry information and expose typed incoming references at exact addresses. Windows Ghidra P0 admits the raw NMOS 6502 profile described below; other raw targets and the incoming-reference facet remain outside Windows P0. (#1868, issue morluto/rea#1836, #1715, issue morluto/rea#1245). Thanks @bugstan, @casesolved-co-uk, @mvanhorn, @N0zoM1z0.

• Ghidra MIPS: Add bounded MIPS32r2/o32 relocatable objects, soft-float integer-register storage, admitted MIPS16 shared ELF, and a narrowly admitted recordless legacy MIPS32 executable profile. The latter pins an endian-matched 32-bit language and records inferred o32 as an analysis assumption. Admission follows each documented ABI/flag/relocation boundary. (#1949, issue morluto/rea#1937, #1950, issue morluto/rea#1938, #1991, issue morluto/rea#1851, #1898, issue morluto/rea#1620). Thanks @AurelioB, @BaaRai, @bqw371, @kaoru0822-kitauji, @N0zoM1z0.

• Ghidra RISC-V: admit little-endian RV32/RV64 ET_EXEC ELF declaring the supported double-float ABI. Relocatable/shared, big-endian and other ABI profiles remain refused; see the profile and recorded lane. (#2151). Thanks @NIU-123370.

• PSP static ELF profile: the Ghidra profile is Linux x64, bounded little-endian ELF32 ET_EXEC with the documented PSP/ABI declarations and a compatible caller-installed Allegrex extension. PRX, shared/relocatable images, PBP/ISO/CSO and runtime emulation are outside scope. Historical extension experiments are separate from public-provider verification; real public Ghidra PSP coverage remains unverified. (#1599). Thanks @jaelliot.

• Ghidra analysis settings: apply validated analyzer overrides before analysis while retaining the selected analysis profile. (#1913). Thanks @akushonkamen, @kaoru0822-kitauji, @N0zoM1z0.

• Attached native IDA MCP: add an optional native bridge alongside existing legacy/headless profiles. Recorded native runs use Linux IDA Free 9.4 with a navigation correction and Windows IDA Pro 9.3 with a loopback-listener change; stock native switching, native macOS and Windows IDA Free remain unverified. Attached databases remain read-only and are never saved or closed. (#1544). Thanks @imissapixel, @N0zoM1z0.

• Frida instrumentation: add explicit local/remote target selection, caller-supplied scripts and retained messages, with script-read/input diagnostics and bounded message eviction. Recorded real coverage is the Linux local Node marker workflow; macOS, Windows and remote devices/servers remain unverified. Instrumentation executes foreign code and is destructive, not read-only. (#1359, #2211, issue morluto/rea#2209, #2217, issue morluto/rea#2213, #2628). Thanks @dandgabr, @kaoru0822-kitauji, @N0zoM1z0.

• Client setup: register Qoder, Trae, ZCode, DeepSeek Harness, Kimi Code, Factory Droid and WorkBuddy through the existing scoped setup flow. DeepSeek is included from 6.5.0; the historical npm 6.4 check did not cover it. Live Trae and DeepSeek API integration remain unverified. (#1564, #1572, #1573, #1929, issue morluto/rea#1839, #2744, #2309, #3041, issue morluto/rea#3040). Thanks @0xRafie, @BaaRai, @cainiao1992, @IvenKooLab, @whoishaha, @ysntony.

• Website: Add maintained language editions, persistent/system-aware themes, keyboard styling and nested Evidence indentation, plus the reverse-engineering models essay. A simpler home page and beginner journey connect platform prerequisites, client/provider setup and a supplied first investigation. (#1779, issue morluto/rea#1022, #1699, #1714, #1894, #2250, #2432, #2732, #3274). Thanks @CassieFox23, @kaoru0822-kitauji, @N0zoM1z0.

• Rust dependency metadata: Inspect embedded cargo-auditable package/dependency records in ELF, PE and thin Mach-O without executing the file. Missing metadata and inferred compiler hashes retain explicit limitations; universal Mach-O requires a selected thin slice. (#2456). Thanks @mvanhorn.

• Electron fuses: Read packaged fuse bytes and per-slice runtime implications without launching or modifying the app. Missing, truncated and unknown wires remain explicit; fuse observations do not prove other Inspector-enablement paths. (#2399). Thanks @kaoru0822-kitauji, @mvanhorn, @N0zoM1z0.

• Ghidra PowerPC: Admit bounded ELF32 big-endian ET_EXEC PowerPC with an explicit language profile on supported Linux/macOS hosts. PPC64, DOL and other variants remain outside this lane; see the profile and verification prerequisites. (#1747). Thanks @arielfikru.

• Reference-source summaries: Use CLI import-reference-source --detail summary for compact manifest, count, state and path-outline output. The complete graph remains available and is still the default; hidden outline entries retain separate coverage counts. (#2768, issue morluto/rea#2442). Thanks @matbrgz, @To3akaRin.

• Recorded AArch64 crashes: Decode 34 ABI register values per thread from supported Linux ELF64 little-endian core notes using the documented caller-provided Python dependencies. These are recorded facts, not proof of current process or library identity. (#2505, issue morluto/rea#2353). Thanks @matbrgz, @NIU-123370.

• Ghidra byte search: Search initialized analyzed memory using wildcards, bit masks, address bounds and paged results. Unloaded, overlay and uninitialized blocks retain skipped coverage; this is not a raw-file search. (#2341). Thanks @mvanhorn.

• Raw NMOS 6502 images: Analyze explicitly selected headerless images with Ghidra, including Windows P0, using a caller-selected entry and source mapping within the 16-bit address space. Cartridge parsing, reset-vector inference and 65C02/65816 are outside this profile. (#2079). Thanks @Zhong-fan.

• Swift String observations: Ghidra function dossiers derive supported AArch64 Swift String literals from constant-register pairs at recognized use sites, retaining instruction/register provenance and explicit omissions. This is a bounded derivation, not a complete string inventory. (#2049, issue morluto/rea#2030). Thanks @thefolahan.

• Headless IDA procedure lookup: Resolve addresses to canonical containing-procedure entries and identify the session’s admitted program document in the modern headless profile. Incomplete surveys remain errors; attached profiles do not advertise this containment capability. (#2374, issue morluto/rea#2335). Thanks @nikolay-dementiev.

• Passive browser attachment: Six existing passive browser tools accept an explicit-port loopback browser WebSocket endpoint when HTTP target discovery is unavailable. Existing consent and target/origin checks remain required; this does not launch a browser or enable runtime instrumentation. (#2346). Thanks @all-black-493.

• Android DEX references: Retain exact method descriptors and individual direct-invoke observations with source method, DEX entry, opcode and code-unit offset. These are static references; unavailable instruction facts remain separate from method-level usage totals. (#2439). Thanks @LcokHcak.

• Offline EVM metadata: Retain bounded, lossless facts from plausible terminal Solidity CBOR root-map candidates. Candidates do not prove Solidity origin or source/compiler identity, and linked metadata is not fetched. (#2790). Thanks @matbrgz.

Fixes

• JavaScript loader and export identity: Respect import/require conditions and unavailable package metadata, keep export links separate from writes, and resolve default identifier exports to the value captured at the export statement. (7e5cffa, 322506d, 81f7638, dae1e55). Thanks @paoValle, @VarunGore36, @xu91102.

• JavaScript traces: Retain nested bridge calls and surviving early-return predicates. Honor node-ID match options, match route seeds against source values, and keep ambiguous runtime candidates unknown. (0351328, 5031099, 44c9d29, 5e79d46). Thanks @jpdefo.

• Browser comparison coverage: Compare only known redirect response fields and retain network-selection recovery guidance alongside independent event changes. Missing response facts do not prove equality or a change. (2b60e09).

• Evidence comparison and ledger input: Report display-only bundle differences as unchanged while retaining digests, and classify noncanonical bundle records as invalid caller input. (030c477, 3a34ad3).

• Capture and admission cleanup: Keep deleted-file observations and original bytes when a parent becomes a file, preserve unrelated I/O failures during cancellation, and require explicit pre-launch proof before releasing an unknown LLDB target owner. LLDB failure controls used simulated boundaries. (e67c364, 2daeff4, 45b6a7f). Thanks @SII-YDD, @xu91102.

• Client configuration: Validate MCP output-schema profiles before setup writes, ignore untrusted Gemini workspace settings before parsing them, and identify installed skills independently of marker-only client roots. (0930e94, aade9bb, ba33c70). Thanks @CmsChase, @paoValle, @sx4im.

• Host tool discovery: Share macOS Hopper launcher discovery across setup and runtime, preserve explicit paths, and report validated ADB and Apktool availability. (7582f0d, e5deb83). Thanks @Chessing234, @kaoru0822-kitauji, @viniciusdsandrade.

• SAZ encoding validation: Reject invalid XML bytes, unsupported encodings and declarations that contradict the archive bytes, including records outside the selected request. (1250aae).

• Managed member matching: Keep malformed TypeDef list ownership unknown, distinguish constants during structural method matching, and accept legacy small exception-section sizes. (3f6b575, ee5cfbe).

• Bounded diagnostics: Bound SDK validation messages and terminal normalization before allocation while retaining diagnostics and explicit unknown final output sizes. (7fb0a0c, 1d826f3). Thanks @CRYPTONIKAV.

• Windows artifact classification: identify .exe, .com, .bat and .cmd artifacts as launchable host executables. (#1823, #1824, issue morluto/rea#1819). Thanks @dollarsmoney, @JasonBuildAI, @kaoru0822-kitauji.

• CLI/MCP delivery: defer command-specific startup work, bundle runtime entries, retain field/input correction details across output formats and preserve shared optional-provider lifetime. MCP selectors, paging continuation and retained partial-error references remain explicit; session liveness/provider-attribution corrections retain their controlled-provider verification limits. (#1691, issue morluto/rea#1685, #1705, issue morluto/rea#1695, #1755, issue morluto/rea#1746, #1773, issue morluto/rea#1771, #1780, #1814, #1910, issue morluto/rea#1849, #1996, #2140, issue morluto/rea#2135, #2205, issue morluto/rea#2195, #2230, issue morluto/rea#2180, #2294, #2482, a82d14e, a4dd4e8, 48c352b, 07b36c1, 570c40c, 8fc2043, 7fc0b5e). Thanks @369Apps, @chqcjq, @cold-atom, @coygeek, @JackOdegard, @kaoru0822-kitauji, @N0zoM1z0, @sx4im.

• Evidence import/replay: import bundles across session transitions while authenticating selected target and file identities, preserve literal keys, metadata/mutation intent and relationship coverage, and honor cancellation before session mutation. Reuse authenticated snapshots and comparisons within their owned lifetime; reject malformed/non-object snapshots and unsupported metadata without disguising uncertainty. (#1694, #1716, issue morluto/rea#1680, #1721, issue morluto/rea#1718, #1733, issue morluto/rea#1723, issue morluto/rea#1724, #1776, #1873, #2001, #2013, issue morluto/rea#2009, #2083, #2303, #2685, issue morluto/rea#2675, c002b89, 9c85114, aada0ca, 4a4d36f, 1c64fe3, 6fb3a34, 3bcc68c, 6bae774, e997085, d1dcebc, b123b2e, 049132a, 042dcaa, acf75e6, 1f7f808, 26bffb9). Thanks @coygeek, @DeryFerd, @jiangjiang248, @kaoru0822-kitauji, @khanukov, @N0zoM1z0, @NIU-123370, @rohitg00, @sx4im.

• Ghidra setup and analysis: preserve launcher/JVM diagnostics, Java-property and extension identity, stale-client recovery, UTF-8 bridge output and pending-startup progress. File-offset decompilation is Ghidra-specific; recorded coverage is Linux x64 with Ghidra 12.1.4. Startup/progress/compiler failure paths that use simulations remain unverified with a real engine. (#1698, #1877, #1931, #2011, issue morluto/rea#1992, #2014, #2101, issue morluto/rea#2078, #2206, issue morluto/rea#2204, 2187e16, b953f96). Thanks @EDMND-SRC, @Ha1baraA11, @kaoru0822-kitauji, @lovecontroing, @lyly-bonbon, @N0zoM1z0, @nosmile99, @Petru101, @sx4im, @Zhong-fan.

• Process and cleanup ownership: retain private runtime/file owners and detailed incomplete-cleanup observations, bound trace cycles/order state, preserve caller paths, and use monotonic time for budgets while retaining wall dates. Windows affinity/admission (#2202, issue morluto/rea#2181) and Bun memory-enforcement paths retain their recorded native-versus-controlled-fixture limits; these fixes are not a general process-ownership guarantee. (#1700, issue morluto/rea#1697, #1730, #1756, issue morluto/rea#1753, #1760, issue morluto/rea#1757, #1826, #1907, issue morluto/rea#1856, #1999, issue morluto/rea#1993, #2232, issue morluto/rea#2170, #2252, issue morluto/rea#2218, #2467, issue morluto/rea#2257, #2468, #2488, 09b6828, 7285e15, b5ededd, d8c76b6, 98d8470, c22111e, cecc6ec, 10935b7, 63e796d, d9e9fb2, 9049dba, ed881c6). Thanks @Ashen00001, @charan-rathore, @coygeek, @EDMND-SRC, @JasonBuildAI, @jimpablo, @kaoru0822-kitauji, @N0zoM1z0, @NIU-123370, @Rinkia, @rudycelekli, @sx4im, @xeropresence, @XiaoBinGan, @xthunder0, @hzh666kevin-hue.

• Native image identity: preserve universal Mach-O containers and selected slice/subtype identity, chained fixup locations and library ordinals, exact signing text, PE resource capacity and ELF/header framing. Mach-O summary selection and independent slice commands avoid unnecessary delivery/work. Controlled routing/parser fixtures do not establish every installed-provider path. (#1703, issue morluto/rea#1702, #1708, #1709, #1713, #1772, issue morluto/rea#1765, #1784, issue morluto/rea#1775, #1982, #1995, issue morluto/rea#1990, #2040, #2107, #2161, issue morluto/rea#2105, #2248, issue morluto/rea#2176, #2281, issue morluto/rea#2274, #2292, #2466, #2506, #2733, issue morluto/rea#2661, f598bab, 108b5f9, f1924cf, 8bd5ba2, b38429c, 8d4d631, ac57c88, dc038d1, 34a4bb6, ebc22d9, c02fb0e). Thanks @1NormalGuy, @Aliciawque, @baron, @coygeek, @dhl84, @hemanthrayuduu, @JasonBuildAI, @kaoru0822-kitauji, @N0zoM1z0, @thangldw, @viniciusdsandrade, @XiaoBinGan, @Zburgers.

• Archive and artifact provenance: keep physical ZIP occurrence identity, exact signatures/names and partial inventory coverage; bound decompression and reject malformed keys/integers. Directory/ASAR/DMG reads retain ownership through cleanup and publication cancellation. Duplicate ZIP names remain explicitly ambiguous where the public projection cannot represent them; synthetic archive/cleanup cases do not prove every real Unblob or DMG failure path. (#1726, issue morluto/rea#1725, #1854, issue morluto/rea#1844, #1865, issue morluto/rea#1860, #2069, #2106, #2144, #2365, #2493, 918713a, eb97da3, 2260887, 74d7da6, ed485a3, 921bb95, d8ceb3f, 9435c7a, bb54082, a73a55f, 3c57e1a, ec0b081, e7882b3, b955b82). Thanks @1052326311, @1NormalGuy, @baron, @Bortlesboat, @Chaoqi31, @DeryFerd, @kaoru0822-kitauji, @N0zoM1z0, @XiaoBinGan.

• Setup/uninstall recovery: preserve unrelated YAML text, caller-selected roots, symlinked data and existing recovery snapshots; explain malformed configuration shapes and retain failed rollback/cleanup owners. Show terminal dry-run plans and each selected skill location. Bunx registration and fault-injected recovery cases remain simulated rather than live-client verification. (#1731, #1754, #1821, issue morluto/rea#1816, #1983, #2118, issue morluto/rea#2111, #2154, issue morluto/rea#2152, #2157, #2182, issue morluto/rea#2159, #2481, bb50813, c240768, dcfc5d4, 21eff3b, 94153f1, 2397137, c339f9e, f6775a3). Thanks @BeqaKs, @Jax367, @kaoru0822-kitauji, @NIU-123370, @shoyann, @viniciusdsandrade, @xeropresence, @zaydiscold.

• Bun updates: locate global installations before changing directories and reuse parsed client activation during maintenance. The update flow is covered with package-manager/filesystem simulations; a real Bun global installation update remains unverified. (#1735, e90acae, b045df1). Thanks @xeropresence.

• JavaScript relationships: preserve loader-specific package/TypeScript/CommonJS boundaries, exact file-URL and source-map identity, Electron intrinsic receivers/IPC guards and chunk metadata. Index repeated lookups and retain completed facts through resource limits and cancellation. Real Electron integration, Bun worker integration and failure-path cleanup remain unverified where the recorded lanes use fixtures. (#1740, #1759, issue morluto/rea#1748, #1762, issue morluto/rea#1761, #1767, #1788, issue morluto/rea#1781, issue morluto/rea#1782, #1789, #1799, issue morluto/rea#1793, #1827, issue morluto/rea#1802, #1833, issue morluto/rea#1831, #1857, issue morluto/rea#1842, #1871, #1874, #1905, #1912, issue morluto/rea#1909, #1915, issue morluto/rea#1911, #1916, #1921, #1934, #1939, issue morluto/rea#1881, issue morluto/rea#1882, issue morluto/rea#1883, #1941, #2062, issue morluto/rea#2058, #2104, #2422, #2475, #2737, issue morluto/rea#2663, d3088c3, 1dfb933, f8513a4, b8fab74, 42b0ed1, c0904b4, 9f67e44, e4532b5, 1c37914, 5ab0cbb, b7169c8, f43fc02, 3ae826c, 1b95302, eaa9616, c923fb0, c7a890d). Thanks @Aurantium-47, @baron, @chqcjq, @coygeek, @cyanseek, @fengdwx, @flitzrrr, @immanuwell, @kaoru0822-kitauji, @N0zoM1z0, @Nelglor, @ranmori, @rudycelekli, @shoyann, @xu91102.

• Browser observations: preserve effective source-map URLs, empty query/fragment identity, response-body provenance, service-worker policies and explicit uncertainty for malformed events. Bound discovery lifetimes and retain cleanup ownership. Interrupt/retry/failure cases validated with controlled CDP/session fixtures do not establish those paths in real Chromium. (#1742, issue morluto/rea#1729, #1829, #2074, #2099, #2239, issue morluto/rea#2169, #2477, 486b567, a82e37c, a8d4984, 966f7cc, 221c856, 951b095, f09bb8a, 6bd2b28). Thanks @1052326311, @chAng-L19, @chqcjq, @coygeek, @evenafterallisaid, @fisforfaheem, @itsF4LCON, @N0zoM1z0, @shayanxcyber.

• Managed metadata/CIL: preserve ExportedType and pointer-table ownership, generic/array/function-pointer/modifier signatures, ReadyToRun host identity, metadata ExtraData and signed zero. Charge retained facts and decoded instruction counts instead of broad decoding bounds; malformed layouts remain caller input errors. (#1743, issue morluto/rea#1736, #1768, #1822, issue morluto/rea#1801, #1828, issue morluto/rea#1812, #1835, issue morluto/rea#1832, #1886, #1893, #1897, issue morluto/rea#1878, #1943, issue morluto/rea#1940, #1985, #2194, issue morluto/rea#2191, #2437, 52e76c5). Thanks @ac1982, @chqcjq, @fisHarly0, @flitzrrr, @JasonBuildAI, @JayOfTheKeyboard, @jhuang-tw, @kaoru0822-kitauji, @N0zoM1z0, @Nelglor.

• Hopper failure ownership: preserve startup/process outcomes, retain cleanup leases across one-shot failures, wait for late bridges, and stop owned Linux demo children when their REA owner exits. Denied/crashed/late-bridge/queued-request failure paths use simulated process or bridge fixtures; they are not fresh installed-Hopper verification. (#1763, issue morluto/rea#1751, #1817, #1866, #1927, #2474, #2499, issue morluto/rea#2459). Thanks @coygeek, @Joshwong1908, @kaoru0822-kitauji, @N0zoM1z0, @rudycelekli.

• IDA session boundaries: retain non-x86 call coverage and unresolved-procedure uncertainty, and bound private universal-Mach-O inputs to the exact selected slice. Transient headless busy recovery was exercised on macOS arm64 IDA Pro 9.1; Linux headless, attached GUI navigation and worker-reaped cleanup paths retain their documented verification gaps. (#1764, issue morluto/rea#1712, #1778, issue morluto/rea#1766, #1785, issue morluto/rea#1769, #1906, issue morluto/rea#1794, #2201, issue morluto/rea#2139, #2291, issue morluto/rea#2285, #2324, 12fa8fd). Thanks @akushonkamen, @coygeek, @kaoru0822-kitauji, @N0zoM1z0, @nikolay-dementiev, @zecaro.

• Input and capability diagnostics: identify invalid paths, format refusals, missing host tools and non-retryable errors without losing caller selections or retryable capability facts. Foreign execution/device mutation annotations remain destructive, analysis-target text is untrusted, and output ordering follows code points rather than host locale. (#1770, #1867, #1869, issue morluto/rea#1855, #1872, #1879, issue morluto/rea#1853, #1899, #1902, #1904, #1908, #1925, #1987, issue morluto/rea#1979, #2004, issue morluto/rea#2002, #2026, #2091, #2133, issue morluto/rea#2129, #2145, issue morluto/rea#2143, #2472, #2478, issue morluto/rea#2454, #2494, #2507, #2509, #2708, 3d83135, c9fed50, 8b18171, 7a2cd1e). Thanks @astralyx0129, @CassieFox23, @DeryFerd, @dollarsmoney, @fisforfaheem, @flitzrrr, @Ha1baraA11, @jimpablo, @kaoru0822-kitauji, @larinyo, @N0zoM1z0, @rudycelekli, @SII-YDD, @viniciusdsandrade, @XiaoBinGan.

• Android analysis: retain decoded values, duplicate-class inventories and executable static initializers, reject malformed JADX UTF-8, and keep inline search provenance. Apktool accepts --no-strings and explains host requirements. Windows batch-launcher selection also resolves PATH/PATHEXT before choosing its launch mode. Recorded Apktool coverage is Linux/OpenJDK, and changed JADX/batch failure paths do not establish native Windows behavior. (#1777, issue morluto/rea#1774, #1876, issue morluto/rea#1846, #1890, issue morluto/rea#1850, #1946, issue morluto/rea#1945, #2707, issue morluto/rea#2672, 0677468, fe8d0bd, #2802). Thanks @akushonkamen, @coygeek, @HeadmasterEggy, @kaoru0822-kitauji, @N0zoM1z0, @psipher.

• ADB acquisition: preserve device paths and directory identity, prevent host destination collisions/overwrites, count UTF-8 logcat bytes and restricted permissions, and evaluate the complete Activity Manager start report. Launch attempts, status, activity and raw failure output remain observations; real-device timeout/mixed-report and Android 8 directory-read paths remain unverified beyond the documented fixtures. (#1962, #2212, issue morluto/rea#2175, #2221, issue morluto/rea#2220, #2359, c42232f, 55b6148, 3bdc873, c89972c, e1cd292). Thanks @coygeek, @dakjdakd, @DeryFerd, @huiq777, @sx4im.

• WASM names and diagnostics: preserve debug/custom-section names including NUL and leading BOM, accept unpadded WABT section rows, and avoid irrelevant tool-remediation advice on unrelated runtime-root failures. (#1963, issue morluto/rea#1956, #1967, #1981, #2084, #2102). Thanks @1052326311, @bugstan, @N0zoM1z0, @sathariels, @STiFLeR7, @viniciusdsandrade.

• Source-map and path handling: retain source-map entries when embedded-content counts differ or an optional sourceMappingURL is used, and keep file: URLs out of operator-relative path resolution. (#2873, #2886, #2882, issue morluto/rea#2821, issue morluto/rea#2883, issue morluto/rea#2577). Thanks @JFSAS, @rileygramlich, @shoyann, @shubhamahuja9999, @coygeek.

• Native metadata: accept declared facts in native dispatch inventories and share native verification input diagnostics. (#2906, #2901, issue morluto/rea#2564, issue morluto/rea#2621). Thanks @ShitK, @coygeek.

⚠ BREAKING CHANGES

• Runtime attachment state: attached may be null in JavaScript, browser and Electron discovery/inspection results. Treat null as unknown; do not coerce it to false. (e55ef72).

• Source maps: original-source and mapping rows preserve a null source name when unavailable. Handle null explicitly instead of expecting an invented unknown-source string; new index fields remain optional when reading older Evidence. (ee50ed1).

• Streamed filtered JSON: --filter-output now emits JSON null instead of {} when the selected value is null; consumers must distinguish a present null from a missing selection. Use --full-output when an object envelope is required. (#2333). Thanks @Jackmeson1.

• Call graphs: get_call_graph.normalized_result is now { graph, limitations }; read traversal-depth groups under graph and retain relationship-specific caveats. Contract/fixture validation does not establish new Ghidra or IDA engine coverage. (5dfb9d0).

• MCP discovery: binary_session no longer repeats server_identity.catalog.tools. Use the connected server tool list, grouped tool_availability and provider capabilities; see MCP contracts. Origin: 6395e8d. (#1988). Thanks @kaoru0822-kitauji, @N0zoM1z0.

• Provider admission: MIPS targets with unresolved GNU ABI attributes are refused. Supply supported ABI declarations. Saved Hopper databases on macOS are unavailable because the launcher cannot run the analysis bridge when opening a database; select an executable target instead. Database support requires a script-capable database launch route. (d4bd65c).

• Segment extents: binary_overview segment length may be null when Hopper coordinates cannot establish a finite extent in one address space. Preserve unknown rather than converting it to zero or a saturated value. (36db19c).

• Invocation identity: server.command_path may be null, and registration/setup statuses or doctor classifications may be unknown. Preserve these states and establish the actual invocation before treating a registration as aligned. (187f113). Thanks @hemv-857, @qorvr.

• ADB installation: the optional replace input is unchanged. Results now require replace_requested to record the requested adb install -r mode; replaced is nullable because prior device package state was not observed. Update result readers to accept null instead of treating reinstall intent as proof of replacement. (864314a).

• Managed/native verification: unresolved P/Invoke results may retain matched_native and candidate facts when module identity is unknown. Interpret status, basis and limitations; module-identity-unknown does not verify correspondence, and unresolved no longer implies empty observations. (3f6b575).

Full contribution record: 893 commits and 529 merged PRs.