morluto/rea rea-agents-6.6.0

rea-agents: v6.6.0

on GitHub

6.6.0 (2026-10-18)

Highlights

• Add Kuna as a caller-supplied static-analysis provider.
• Query selected JavaScript facts and multiple APK locale tables without repeating the underlying analysis.
• Extend Ghidra analysis to Windows ARM PE targets and explicit raw m68k images.
• Preserve completed Evidence, cancellation reasons and retryable cleanup across provider and CLI finalization.

Changes

• Kuna analysis: Use a caller-installed Kuna for procedure listings, pseudocode, assembly, call relationships, exact-address xrefs and cached string searches. Project exports retain source spans and digests; repeated requests reuse completed work. Recorded real-provider coverage uses Kuna 1.833 on Linux; Windows, PE and universal Mach-O are unsupported. See the provider guide. (#3832, #3854, #4071, #4095). Thanks @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0.
• Retained JavaScript facts: Query exact application paths, selected properties and filtered module references through inspect_analysis_view, with paging and complete row Evidence. These views reuse completed analysis and preserve source selection and unknown coverage. (#4265, morluto/rea#4190, #4097, morluto/rea#4092). Thanks @kaoru0822-kitauji, @N0zoM1z0.
• APK locale tables: Request several resource locales in one decode with repeatable CLI --locales or MCP locales. Each table reports its status and coverage; existing single-locale fields remain available. (#4804, morluto/rea#4777). Thanks @abhay-2108, @N0zoM1z0.
• Windows ARM binaries: Ghidra admits ARMNT/Thumb-2 and ARM64 PE applications and DLLs on the Windows x64 host lane. Recorded Ghidra 12.1.4 verification uses WindowsResourceReference disabled and raised startup budgets; default-analyzer completion, ARM64EC/ARM64X and Windows-on-Arm hosts remain unverified or unsupported. See the exact scope. (#3965, morluto/rea#2186). Thanks @N0zoM1z0, @WestLabsAI.
• Raw m68k images: Analyze explicitly selected big-endian m68k raw binaries using Ghidra’s fixed 68000 profile and a caller-supplied aligned entry. Real CLI/MCP verification used Ghidra 12.1.4 on macOS arm64; Linux is unverified and Windows P0 does not admit m68k. See mapping requirements. (#4018). Thanks @icedac.
• JADX deadlines: Set REA_JADX_OPERATION_TIMEOUT_MS to extend APK loading and upstream operation deadlines together. Doctor reports the effective value and setup forwards an explicit selection. (#4466, morluto/rea#3918). Thanks @jaychou813, @SandstromPL.
• Electron window options: Resolve stable local constant BrowserWindow options while retaining source provenance. Relevant writes and escapes keep the result unknown. (#4400, morluto/rea#4366). Thanks @kaoru0822-kitauji, @N0zoM1z0.
• Language editions: Add the Greek website edition and Malayalam documentation, with Korean typography and translation corrections across the site. (#3520, #4792, #3821, morluto/rea#3820, #3799, morluto/rea#3798, #4344, #3856, #4166). Thanks @gensokyo-dev, @hi2242, @kalayciburak, @kaoru0822-kitauji, @kraken-503, @kukinghan, @N0zoM1z0, @yeseong0412.

Fixes

• Cancellation and cleanup: Keep completed observations, exact cancellation reasons and the original physical failure through finalization. Failed cleanup retains its process or file owner for retry; recovered resources disappear from pending-cleanup reports without replacing the original error. (#4238, morluto/rea#4232, #4274, morluto/rea#3923, 3e82366, 16924e2, bbfe6ed, 1f23e97, 08fbeb8). Thanks @coygeek.
• Provider startup: Join prerequisite probes and in-flight readiness work before shutdown, preserve typed timeout and JVM-memory failures, and retain startup diagnostics through cleanup. Ghidra recognizes keg-only Homebrew JDKs and names the setting responsible for a startup timeout. (376eeca, ceeff5a, 3ad1032, 964decd, 3fa972a, #4557, morluto/rea#4556, #4590, morluto/rea#4241). Thanks @DanielCvz1, @J0UH, @Rinkia, @RishTheFish21, @vadlachary2002.
• Client configuration: Preserve the selected launcher, destination file, caller timeout choices and unresolved configuration evidence. Setup/uninstall recovery stays bound to the exact published file, keeps current verified backups, and transfers failed cleanup ownership for retry. (d0253c9, 7e4eed9, 2fb5e20, 8235210, d818c3d, 19329e4, dadf909, 333e0ab, c15c206). Thanks @Adolanium.
• Configuration formats: Read signed 64-bit TOML integers without rounding, handle large TOML documents without argument-spread failures, preserve JSONC trivia and Hermes YAML scalar text, and reject NUL bytes in registration environment values. (#4937, morluto/rea#4917, c43bc0b, 4fd28fc, #3568, #4335). Thanks @alfredo1491, @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0, @ShuaixinHuang, @xu91102.
• Claude Code configuration: Setup, doctor and uninstall now accept only the strict JSON format Claude Code reads, including a leading UTF-8 BOM. Comments and trailing commas are refused before backup or writing; clients that support JSONC retain their existing behavior. (#4944, morluto/rea#4940). Thanks @kaoru0822-kitauji, @xu91102.
• CLI output and dispatch: Accept --flag=value and spaced global output values, keep array positions in filtered JSON, validate integer tokens before coercion, and exit quietly when the output reader closes. Cancellation remains effective through command finalization; app bundles and static native inspections select the intended workflow. (#3811, #4823, 2ae4e16, 8d82579, #3781, 279c590, #3511, morluto/rea#3321, f31b231). Thanks @arjunprabhulal, @coygeek, @kaoru0822-kitauji, @ShuaixinHuang, @Sriram-PR, @Tapraj-Pathak.
• Updates: Route --update through the verified updater and bound retained package-manager diagnostics. (4f7b5fb, 01cdbbd).
• MCP contracts: Advertise self-contained tool inputs while preserving tuple, array, Boolean and nested-JSON constraints across schema profiles. Schema-reference handling no longer rewrites literal metadata; catalog identity includes the output-schema profile. (5e30969, 10aa74d, 204b9f3, b3389a5, a2e3016, ba98130, c5fb86d). Thanks @akushonkamen, @HarsH-1877, @kaoru0822-kitauji, @xingzihai.
• Session ordering: Keep snapshot admission ahead of later calls on the same connection, retain shutdown signals until cleanup succeeds, and preserve inspection authority through investigation publication. (#3661, morluto/rea#3334, 8873b39, 663d07f). Thanks @coygeek, @rudycelekli, @Swatantra-66.
• JavaScript exports and resolution: Retain CommonJS exports created with Object.defineProperty and track export receiver lifetimes. Resolve scoped packages, package main, JSON requires and .mts/.cts imports using the owning loader; overwritten require bindings and erased type-only imports no longer create false runtime links. (#4725, morluto/rea#4724, #3567, morluto/rea#3541, #4838, morluto/rea#4632, #3844, morluto/rea#3383, #4164, morluto/rea#3915, #4223, #3801, morluto/rea#3393, #4165, morluto/rea#3932). Thanks @Abishek0070, @coygeek, @JNTMTMTM, @kaoru0822-kitauji, @prasad2512, @rodricksz4h5, @xu91102.
• JavaScript value flow: Preserve values captured before later assignments, guarded factory fallthrough and nested destructuring. Track exact property keys and setter writes; direct eval, compound assignments and incoming callbacks preserve unresolved effects instead of inventing certainty. (#4196, morluto/rea#3881, #4341, morluto/rea#3963, bfb7ed0, #3480, #3831, morluto/rea#3312, 9ac76d3, #4342, morluto/rea#4206, #4243, morluto/rea#3880). Thanks @coygeek, @kaoru0822-kitauji, @maxazure, @N0zoM1z0, @ShuaixinHuang.
• JavaScript relationships: Distinguish Map reads from network endpoints, associate response endpoints only with writes that reach the read, and preserve child-process receiver ownership and effective stdio choices. Version comparisons keep relocation and unknown relationships distinct from application changes. (fbfdb6a, #4759, morluto/rea#4606, #3819, morluto/rea#3362, #4336, morluto/rea#3355, 556504e, 4d980d0). Thanks @Abdooo2235, @coygeek, @kaoru0822-kitauji, @Xinglan233.
• JavaScript source admission: Parse JavaScript with its own grammar, refuse FIFO recovery inputs without blocking, and report oversized or resource-skipped files with their actual capacity and coverage state. Malformed runtime events stay excluded rather than becoming policy-filtered facts. (#3782, morluto/rea#3780, #3788, morluto/rea#3332, #4757, morluto/rea#4629, #3852, morluto/rea#3670, #4755, morluto/rea#4685). Thanks @andresaragon, @coygeek, @kaoru0822-kitauji, @sx4im.
• Browser capture: Bound CDP handshakes and command responses, preserve malformed inventory uncertainty and partial cleanup diagnostics, and report cancellation after content reads and final cleanup. Accessibility comparisons require observed coverage; attached emulation teardown limits remain explicit. (#3555, morluto/rea#3553, #3901, morluto/rea#3379, 4cc044b, #4406, morluto/rea#4403, #2893, 0123d59, 2ff0867). Thanks @coygeek, @dakjdakd, @kaoru0822-kitauji, @maxazure, @N0zoM1z0, @YunzhouLi-hub.
• Browser page facts: Preserve URL path bytes when removing credentials, repeated document Link headers and complete COOP/COEP structured items. WebMCP discovery reads the actual schema properties and exact receiver path. (#4731, df2fc25, c360cfc, ebd5a82, 38f92d1). Thanks @Abdooo2235, @geekwolf, @ShuaixinHuang.
• Electron runtime capture: Keep native IPC listener and one-shot dispatch behavior, block synchronous shell effects during capture, refuse active scenarios when the inspect fuse is disabled, and preserve fuse/transport cleanup ownership. (#4389, morluto/rea#4390, #4605, morluto/rea#4593, #4562, morluto/rea#4393, #3605, morluto/rea#3453, f9de413, e7df00e). Thanks @Adolanium, @gensokyo-dev, @gkobayashi0, @HarsH-1877, @kaoru0822-kitauji, @keeponlight, @N0zoM1z0, @Nitin13-git, @xu91102.
• APK resource accuracy: Retain completed tables and decode facts after interrupted or failed reads. Derive locale limits from resource configuration fields, disclose unselectable qualified tables, distinguish document failures from omitted entries, and bind Evidence to the decoded snapshot. (34a88d6, f5fcf52, 6385ef4, 98886ad, dc2e811, #4771, morluto/rea#4768). Thanks @abhay-2108, @gensokyo-dev, @Iyanuoluwa007, @kaoru0822-kitauji, @N0zoM1z0.
• Apktool guidance: Retain the observed version and disclose the matching platform/release advisory windows without treating a version string as proof of decoder safety. Missing prerequisites and decode refusals identify the selected APK or launcher. (d38f099, 63696d2, cc038da). Thanks @GovinduSasanka, @peter-research.
• Android method bodies: Recover original bytecode bodies when Java source is omitted while preserving genuine native/abstract body absence and primary failures during retryable cleanup. (63c65a2, 742b6f5, 9fa6d2b). Thanks @balkan16, @Chessing234.
• ADB observations and transfers: Preserve display-scoped focus, distinguish missing declarations from absent focus, retain numeric physical density and mark unknown permission coverage partial. Transfers use consumed snapshot identity and refuse unknown destination existence; uninstall requests explicitly select user zero. (7086768, 3d028db, #4074, morluto/rea#3942, #4663, #4665, 1342127, 61e6880, be0b2d1). Thanks @Copilot, @coygeek, @gongfpp, @Tapraj-Pathak, @yankikucuk.
• Apple metadata: Preserve exact plist/keyed-archive integers, negative zero, non-finite real identity and dictionary keys. Reject malformed XML before value decoding, retain undecodable dates as unknown and report unsupported OpenStep entries explicitly. (#4324, morluto/rea#4292, 2cf9c28, #4839, morluto/rea#4834, f2b7bbb, 6c98708, 78cf610, c7e9e09, #3793, #4105, morluto/rea#3892). Thanks @coygeek, @kaoru0822-kitauji, @mertkayacs, @pablodiazjorge, @pollychen-lab, @xu91102.
• Apple application structure: Derive bundle components and launchd domains from their owning directories, retain unavailable components, and select only exact Assets.car names as asset catalogs. Interface Builder keeps unresolved classes and counts hierarchy records beyond the returned object page. (149a0fc, 5d6029e, c192c58, #4094, morluto/rea#3914, #4118, morluto/rea#3958, #4162, morluto/rea#3950). Thanks @coygeek, @kaoru0822-kitauji.
• Native names and layout: Keep valid Objective-C records beside malformed neighbors, preserve leading U+FEFF and repeated load-command fields, and select exact arm64e.x1 slices. PE resource ownership and NativeAOT reads stay within declared image/header ranges. (#3833, morluto/rea#3336, #4549, morluto/rea#4540, morluto/rea#4541, #4730, #4048, morluto/rea#4008, #3500, morluto/rea#3389, #4463, morluto/rea#4373, morluto/rea#4455, 3fc0075, 4a076f3). Thanks @coygeek, @Iyanuoluwa007, @jayinvers, @kaoru0822-kitauji, @kevinjosh10, @maxazure, @ShuaixinHuang.
• Native analysis providers: Keep Ghidra byte matches within examined coverage, retain PE PDB/function-boundary limitations and preserve configured MIPS choices. Attached IDA refuses universal Mach-O rather than silently choosing a slice; request timeout identity and captured output survive adapter handling. (#4531, #2933, morluto/rea#2259, 01a1b3f, 50dd9fc, #4765, morluto/rea#3871, c0cfccb). Thanks @BeLit-Development-2, @coygeek, @kaoru0822-kitauji, @N0zoM1z0, @ShuaixinHuang.
• Recorded crashes: Prevent GDB from discovering an executable named by an untrusted core, reject core mapping paths that escape the isolated sysroot, and preserve pwntools worker ownership across launcher exec. Completed decode facts and cancellation reasons remain available through failed final cleanup. (5bf4fff, b33c0df, #4435, morluto/rea#4011). Thanks @coygeek, @N0zoM1z0.
• Cutter and Rizin: Read Cutter’s active document from core configuration and attribute its host version correctly. Keep interrupted Rizin frames and output whitespace before completion markers, with exact command and cleanup failure attribution. (#4507, morluto/rea#4497, #4514, morluto/rea#4498, #4459, morluto/rea#4015, d5fc7e6, 199396f). Thanks @coygeek, @N0zoM1z0, @Xander-AJ.
• Windows cleanup: Retain unpublished runtimes after failed removal, handle read-only attributes and sharing conflicts, preserve primary snapshot failures and honor caller environment overrides. (f78d137, d69acc3, 0679a79, 5f9ac2c, 1bbf4bd). Thanks @DeryFerd.
• Managed metadata: Compare nominal signatures and declaring identities across builds, preserve empty names without display substitutions, verify ABI-prefixed Mach-O exports exactly, and charge cached metadata once. Metadata errors report artifact file offsets; mixed-mode assemblies retain their actual boundary classification. (#3059, #3079, #3853, morluto/rea#3352, #3974, morluto/rea#3961, #3491, morluto/rea#3449, #4418, morluto/rea#4372, #3516, morluto/rea#3366). Thanks @8rulerstar, @coygeek, @duckhunt113, @Hahaa909, @JayOfTheKeyboard, @kaoru0822-kitauji, @keeponlight, @N0zoM1z0, @tomyrms.
• Archive and filesystem identity: Reject colliding extraction paths before writing, classify ZIP offsets beyond EOF as malformed, normalize ZIP current-directory prefixes once, and preserve symlink and unreadable-path provenance. A directory named *.map is no longer mistaken for a source-map file. (862a0b2, c209dcb, 6b1c36e, 25c2222, d6e4fe4, #4131, morluto/rea#3909). Thanks @Adkid-Zephyr, @coygeek, @jackie-cqz, @kaoru0822-kitauji, @maxazure, @XY-code1.
• Evidence and reconstruction: Authenticate all retained inventory substeps, preserve source-attributed caveats in composed workflows, and require comparable cited Evidence before declaring reconstruction coverage or readiness. Missing Evidence and residual replay uncertainty stay explicit. (9ac91e0, c4608a2, #4075, morluto/rea#3357, #3526, morluto/rea#3363, 153017d). Thanks @coygeek, @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0, @rudycelekli.
• Offline data: Preserve exact UTC packet-capture instants, SQLite column identity and snapshot admission failures, and cooked WASM directive literals. Cleanup cancellation retains completed EVM/WASM observations rather than losing them. (796faa0, 748ac7f, bc51d0e, 4f87f02, d694aef, 321cacb). Thanks @himamaheswarreddy, @mertkayacs, @rollroyces, @viniciusdsandrade.
• Kuna recovery: Share concurrent single-function requests and cache repeats, validate warm exports once, stream string inventories beyond the former fixed buffer ceiling, and keep unproven processes in their run slots until close confirms release. Failure messages distinguish final buffer refusals from configurable deadlines. (#4045, #4169, #4049, #4318, #4052, #4098, #4343). Thanks @kaoru0822-kitauji.
• Flutter snapshots: Check symbol-table ranges against loadable segments and retain completed inspection facts when cancellation occurs during snapshot cleanup. (#3859, morluto/rea#3346, #4766, morluto/rea#4717, #4762, morluto/rea#4640). Thanks @coygeek, @kaoru0822-kitauji.
• Native metadata recovery: Keep unknown Objective-C category classes, empty protocol names, undecoded Swift aliases and unfinished property types explicit instead of discarding neighboring valid records. Preserve unnamed segment identity and exclude a dylib’s own install name from dependencies. (#4093, morluto/rea#4012, #4078, morluto/rea#3873, #4085, morluto/rea#3934, #3825, morluto/rea#3345, #4051, morluto/rea#3875, #4050, morluto/rea#3872). Thanks @coygeek, @kaoru0822-kitauji.
• Document selection: Preserve explicitly selected plist paths and bundle defaults, and only use document fallback after confirming its applicability. Finalization keeps completed selection facts and cancellation outcomes. (e6c4877, #3774, 9df559b). Thanks @kaoru0822-kitauji.
• Capture and comparison accuracy: Admit schema-valid HAR numeric values while retaining exact-publication limits, preserve empty URL path segments, and keep unrelated process traces and unnamed reference endpoints distinct or unknown. (#3159, morluto/rea#3145, #3792, morluto/rea#3307, #4178, morluto/rea#3931, #3809, morluto/rea#3388). Thanks @coygeek, @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0, @pablodiazjorge, @xu91102.
• Evidence publication: Recheck staged output identity after its final write, classify missing review Evidence and duplicate ledger entries as caller input, and preserve the selected freshness requirement in comparison parameters. (#4764, morluto/rea#4613, #4452, morluto/rea#4444, #4065, morluto/rea#4000). Thanks @amyanger, @coygeek, @kaoru0822-kitauji, @Rinkia, @Swatantra-66.

⚠ BREAKING CHANGES

• Saved Evidence: Evidence and analysis snapshots now require explicit nullable relationship_coverage in their identity commitments. Artifact inventories require scoped coverage and explicit integrity_contradictions; obsolete coverage_status and prose-based coverage inference are removed. Regenerate old Evidence/snapshots and inventory observations with this release: saved files are not migrated and omitted facts are not filled with guessed defaults. (db8128d, 0405c9d, a9588be).
• Browser capture results: Consumers must retain resolved capture limits, event families and omission facts. Set desired budgets through the supported capture options; omitted caller inputs still select defaults, but stored observations must report the resolved values. Admitted content reads queue behind bounded concurrency. (57a23f0).
• Android version codes: inspect_adb_package.version_code is a decimal string rather than a JSON number. Read it as a string, or use BigInt for numeric comparison. (#3485, morluto/rea#3368, 7666a48). Thanks @coygeek, @kaoru0822-kitauji.
• Native UI failures: Failed or cancelled native UI scenarios now return typed errors with the collected report in partial_observation. Handle the error path and read that report instead of expecting a successful result containing failed steps. (d909919).
• Provider status: binary_session candidate availability can be unknown during owner finalization. Preserve that state rather than treating it as unavailable; internal consumers must await the asynchronous session status API. (150e996).
• Swift symbol locations: swift_symbols entries may have a null address when the provider supplies no location. Handle unknown addresses; optional evidence.reported_address retains the original provider value. (8116dc0).
• Linux Hopper admission: Older builds previously admitted by a fixed allowlist need retained publisher-signed package evidence or an approved update to the current public demo. Update explicit HOPPER_LAUNCHER_PATH selections when migrating; the live feed offers only its current release. The official RPM metadata mismatch remains unresolved and is refused. (#3590, morluto/rea#3577, 70cd4cb). Thanks @gensokyo-dev, @kaoru0822-kitauji, @N0zoM1z0.

Full contribution record: 571 commits and 236 merged PRs.