84 Commits
Author SHA1 Message Date
balkan16andClaude f889a69fb9 fix(build): resolve rolldown from the npm registry in package-lock.json (#1986)
The rolldown 1.2.12 entry resolved from mirrors.cloud.tencent.com while
every other entry uses registry.npmjs.org, so npm ci failed in
environments that can reach the npm registry but not that mirror.
Version and integrity are unchanged.


Claude-Session: https://claude.ai/code/session_01Q3rXQaLacJ7gNBRkp7DovF

Co-authored-by: Claude <[email protected]>
2026-10-12 08:58:44 +08:00
Ysopwnable 76e4153d34 perf(mcp): reduce Windows startup module resolution (#1814)
perf(mcp): bundle internal modules to reduce Windows startup I/O
2026-10-11 21:01:01 +08:00
Ysopwnable 13e03e9436 perf(evidence): fuse streamed JSON token handling (#1694)
Fuse upstream JSON parsing, scalar packing, heap admission, and value assembly into synchronous token stages while retaining asynchronous file reads and existing capacity, cancellation, decoding, identity, and typed-error semantics. Declare stream-chain 4.2.6 directly.

Validation: 30 focused tests; check:fast, Knip and formatting; actual Flameox paired full-content oracles; real Linux evidence replay and Windows source-built package/Ghidra snapshot recovery; final-head CI 31/31 success.

Refs #1065, #1680.
2026-10-11 12:36:35 +08:00
github-actions[bot]andmorluto a56f7bb668 chore(main): release rea-agents 6.4.0 (#1399)
* chore(main): release rea-agents 6.4.0

* docs(release): write contributor-aware 6.4.0 changelog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: morluto <[email protected]>
2026-10-11 11:57:29 +08:00
sqmagellanandmorluto af88184eee feat(ghidra): configurable import language and analysis seeds (#1667)
* feat(ghidra): configurable import language and analysis seeds

REA_GHIDRA_LANGUAGE_ID and REA_GHIDRA_COMPILER_SPEC_ID set the import
language when the header cannot identify the compiler (for example,
Borland C++ PE images).

REA_GHIDRA_SEED_FILE seeds functions, code and labels before
auto-analysis, for code reached only through computed jumps or data.

Both are validated before launch, recorded in the analysis profile and
verified in the bridge handshake.

* fix(ghidra): parse language XML and preserve seed ordering

* test(ghidra): use explicit platform paths for seed launch checks

* fix(javascript): retain cleanup failure reason in error causes

---------

Co-authored-by: morluto <[email protected]>
2026-10-11 09:57:38 +08:00
87edf14940 fix(browser): support Termux Android scenarios (#1655)
* fix(browser): support Termux Android scenarios

* fix(build): lock Termux artifact generation

* ci(android): add manual Termux browser smoke verification

---------

Co-authored-by: tyloryang <[邮箱]>
Co-authored-by: morluto <[email protected]>
2026-10-11 08:10:06 +08:00
zayd / coldandmorluto f970b886aa feat: add Hermes as a supported MCP client (#1403)
* feat: add Hermes as a supported MCP client

Hermes Agent reads stdio MCP servers from `mcp_servers.<name>` in
`config.yaml`. REA had no Hermes client, so setup could not register it and
Hermes users had to wire the server up by hand.

- SupportedClients: add the `hermes` format and client definition, resolving
  the config path from HERMES_HOME, else the platform default that Hermes's own
  resolver uses (LOCALAPPDATA/hermes on Windows, ~/.hermes elsewhere), including
  HERMES_DATA_DIR_SUFFIX.
- ClientConfigurationDocument: parse and serialize Hermes YAML, upserting the
  rea entry into the parsed document so user comments and unrelated settings are
  preserved; emit `enabled: true` since Hermes connects entries unless disabled.
- ClientRegistrationStatus: forward the Hermes location variables so status
  checks resolve the same path as setup.
- Tests: cover path resolution on both platforms and the register/read/uninstall
  round trip, and clear the Hermes location variables between tests.

- delilah 🌸

* docs: document the Hermes client and its config path

- delilah 🌸

* refactor(setup): resolve skill destinations per client

* fix(setup): install Hermes skills in the active profile

* fix(setup): identify each client skill action uniquely

---------

Co-authored-by: morluto <[email protected]>
2026-10-10 16:03:25 +08:00
github-actions[bot] 08ec2bf82f chore(main): release rea-agents 6.3.0 (#1341)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-10 07:14:55 +08:00
Ysopwnable 6ce3288f3b fix(cli): stream JSON inputs beyond the whole-document string limit (#1360)
Stream large CLI JSON files through a strict UTF-8 decoder and standard JSON parser using the same admitted regular-file handle. Preserve native parsing for small inputs, typed malformed-input/resource/access-denied errors, cancellation, and complete Evidence.

Verified with focused public CLI regressions, a 768 MB whitespace-padded valid request, and the Windows native decoder boundary. Individual strings and the assembled object graph remain subject to native runtime limits. All 27 final-head checks passed.

Refs #1331
2026-10-10 04:53:09 +08:00
github-actions[bot]andN0zoM1z0 a64851f259 chore(release/6.2.0): release rea-agents 6.2.0 (#1305)
* chore(release/6.2.0): release rea-agents 6.2.0

* docs(release): complete 6.2 breaking migration notes

* fix(dev): allow formatter-ignored staged files

* docs(release): include all unreleased mainline entries

* docs(release): note ignored-file hook repair

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <[email protected]>
2026-10-09 16:17:20 +00:00
github-actions[bot]andmorluto 70e5c24718 chore(main): release rea-agents 6.1.0 (#1106)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: morluto <[email protected]>
2026-10-09 08:15:17 +08:00
github-actions[bot]andN0zoM1z0 6fee42689a chore(release/6.0.0): release rea-agents 6.0.0 (#1058)
* chore(release/6.0.0): release rea-agents 5.1.0

* chore: normalize release product catalog

* chore(release): correct 6.0.0 candidate and migration notes

Keep the recorded application checkpoint unchanged. The upstream history walk
stops at the merged side-branch release commit and omits older unreleased main
commits; restore the missing notes and absolute-path migration instructions.
Set all release metadata to the agreed SemVer 6.0.0.

Assisted-by: Sakuya (gensokyo-skills:sakuya-checkpointed-execution)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <[email protected]>
2026-10-08 17:40:01 +08:00
Ysopwnable 7af7bc88ce feat(evm): inspect offline bytecode interfaces through EVMole (#1051)
* feat(evm): inspect offline bytecode interfaces through evmole

* fix(evm): distinguish unsupported bytecode targets

* style(evm): format verifier string-prefix checks
2026-10-08 15:32:05 +08:00
Rudy Mizrahi CelekliandN0zoM1z0 1154f2f03c fix(javascript): reconstruct HTML script loads accurately (#1042)
* fix: parse HTML script references with HTML semantics

Signed-off-by: Rudy Celekli <[email protected]>

* test(javascript): cover exact HTML script resource identity

---------

Signed-off-by: Rudy Celekli <[email protected]>
Co-authored-by: N0zoM1z0 <[email protected]>
2026-10-08 13:24:24 +08:00
2bf3663f65 feat(browser): inspect historical web network captures (#992)
* feat(browser): inspect retained HAR and mitmproxy capture evidence

Add independent offline format adapters, inline CLI/MCP evidence, bounded
owned decoder processes, and real producer verification.

Refs #882

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): preserve capture boundaries during cancellation and decoding

Honor cancellation during owned-command cleanup, retain opaque HAR
extension content, and clean verifier resources on every failure path.

Refs #882

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): exclude sensitive capture fields across representations

Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance.

Refs #882

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): exclude sensitive capture identities and bound diagnostics

* fix(browser): validate excluded HAR subtrees before projection

* fix(browser): distinguish capture input limits from decoder failures

* fix(browser): preserve decoder failure categories

* fix(browser): validate excluded native credential values

* test(browser): report capture verifier assertions directly

* fix(browser): classify native representation failures precisely

* fix(browser): exclude URL userinfo after header whitespace

* fix(browser): preserve capture evidence and failure boundaries

* fix(browser): exclude sensitive literals from capture limitations

* test(browser): check limitation values without JSON syntax

* fix(browser): preserve acquisition integrity and exclude selection diagnostics

* fix(browser): preserve capture acquisition and declaration boundaries

* fix(mcp): project sensitive capture argument validation

* fix: preserve capture bytes and prelaunch cancellation

* fix(browser): exclude sensitive HAR record ancestry

* fix(browser): preserve transport URL and parameter exclusions

* fix(browser): preserve numeric redaction and canonical capture provenance

* fix(browser): cover derived capture values and ownership preparation deadlines

* fix(browser): exclude explicitly sensitive artifact digests

* chore: regenerate generated metadata

* fix(browser): reject lossy HAR member normalization

* test(browser): assert the advertised unsupported-profile outcome

* fix(browser): preserve JSON visitor nesting failure locations

* fix(browser): exclude explicitly sensitive native source ranges

---------

Co-authored-by: Kaoru0822 <[email protected]>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 07:53:41 +08:00
morluto 76e7e510bb perf(artifacts): replace quadratic ZIP overlap checks (#1013) 2026-10-08 02:08:39 +08:00
github-actions[bot] b33236ec08 chore(release/5.0.0): release rea-agents 5.0.0 (#1007)
* chore(release/5.0.0): release rea-agents 5.0.0

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 01:26:36 +08:00
morluto c78fe6990b docs: publish VitePress documentation on GitHub Pages 2026-10-07 16:58:04 +08:00
Kaoru0822 c55ae3b9ec fix(deps): remediate smol-toml advisories 2026-10-06 21:55:36 -07:00
3af3811ab0 fix: integrate 24 reviewed browser/native/semantics corrections (#815)
* fix(reference): resolve emitted extensions to TypeScript source

Signed-off-by: Rudy Celekli <[email protected]>

* test(reference): retain legitimate declaration import counterparts

Signed-off-by: Rudy Celekli <[email protected]>

* fix(mcp): recognize implicit form elicitation capability

Signed-off-by: RudyCelekli <[email protected]>

* fix(ghidra): reject contradictory NativeAOT reports

* fix(native): preserve thin architectures across echoed filename lines

Signed-off-by: Rudy Celekli <[email protected]>

* fix(native): preserve app bundle executable filename whitespace

Signed-off-by: Rudy Celekli <[email protected]>

* fix(doctor): validate Node-wrapped client policy

Signed-off-by: RudyCelekli <[email protected]>

* fix(reference): preserve observed entry failure reasons

Signed-off-by: Rudy Celekli <[email protected]>

* fix(artifacts): verify opaque bytes before reusing inventory identities

Signed-off-by: Rudy Celekli <[email protected]>

* fix(browser): resolve DOM destinations against document base URL

Signed-off-by: Rudy Celekli <[email protected]>

* fix: recover serialized native NIB view hierarchy

Signed-off-by: RudyCelekli <[email protected]>

* ci: exercise native compiled NIB hierarchy regressions

Signed-off-by: RudyCelekli <[email protected]>

* fix(deps): remediate reachable archive-parsing advisories

Two high-severity advisories are reachable from untrusted target content:

- @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed
  app bundles in the keyed-archive reader. Refreshed to 0.9.12.
- brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while
  analyzing untrusted ASAR archives. Refreshed to 5.0.12.

Both are in-range patch updates (plist declares ^0.9.10, minimatch declares
^5.0.5), so no source or API change is required and no direct dependency
declaration moves. Lockfile-only change.

The remaining smol-toml advisory is not included: it parses operator-owned
client configuration rather than untrusted target content, and its fix moves
outside the declared range and changes leading-BOM handling.

* fix(semantics): link wrapped arrow Promise returns

* fix(reconstruction): preserve unknown graph limitations

* fix(native): preserve exact code signing identifiers

Signed-off-by: Rudy Celekli <[email protected]>

* fix(native): recognize only whole otool command headers

Signed-off-by: Rudy Celekli <[email protected]>

* fix(native): retain nm-proven literal export names

Signed-off-by: Rudy Celekli <[email protected]>

* fix(javascript): project decoded file URL paths

Signed-off-by: Rudy Celekli <[email protected]>

* fix: preserve explicit source-relative URL observation spelling

Signed-off-by: Rudy Celekli <[email protected]>

* fix(native): project Mach-O evidence into container file offsets

Signed-off-by: Rudy Celekli <[email protected]>

* fix(browser): normalize referrer policy fallback lists

Signed-off-by: Rudy Celekli <[email protected]>

---------

Signed-off-by: Rudy Celekli <[email protected]>
Signed-off-by: RudyCelekli <[email protected]>
Signed-off-by: Rudy Celekli <[email protected]>
Co-authored-by: Rudy Celekli <[email protected]>
Co-authored-by: RudyCelekli <[email protected]>
Co-authored-by: Kaoru0822 <[email protected]>
Co-authored-by: DeryFerd <[email protected]>
2026-10-07 10:33:10 +08:00
github-actions[bot] 9622b4b4cf chore(main): release rea-agents 4.1.0 (#635)
* chore(main): release rea-agents 4.1.0

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-07 01:57:26 +08:00
Kaoru0822 2c1bf92010 fix(cli): disable unmanaged skill synchronization 2026-10-05 23:27:46 -07:00
morluto 9b392bb2f8 chore(deps): finish toolchain upgrades and drop dead weight (#644)
* chore(deps): finish toolchain upgrades and drop dead weight

pino 9 to 10, @types/node 24 to 26, oxlint 1.73 to 1.87, knip 6.26
to 6.39, turbo 2.10 to 2.11. Narrow engines to supported majors
(22/24/26; vitest 5 refuses Node 25). Scope no-var-requires off for
Electron CJS hooks and fixtures.

Remove TypeDoc: incompatible with TypeScript 7 at install and
runtime, used by nothing in any gate. Drop the dep, docs:api
workflow, typedoc.json, CI artifact step, and related docs.

Replace graphology with a local call-graph adjacency plus BFS: the
only consumer is call-path search, and graphology-types ships no
types entry for TS7 NodeNext resolution. Delete both graphology
dependencies.

Remove dead re-exports newly flagged by knip 6.39.

* chore: drop stale typedoc and replay references

Remove the docs:api release-checklist step, the orphaned docs/api
ignore entry, and the nonexistent replay glob from the adapters
project.
2026-10-06 06:02:02 +08:00
morluto 965d0b35f9 chore(deps): remove incompatible TypeDoc generator 2026-10-06 05:46:44 +08:00
morluto dee8853fde chore(deps): upgrade typescript, vitest, and MCP SDK to latest (#633)
typescript 5.9.3 to 7.0.2, vitest 4.1.10 to 5.0.3 (plus
@vitest/coverage-v8 and @fast-check/vitest 0.5.0 for peer compat),
@Modelcontextprotocol/client and server 2.0.0 to 2.3.1. Migrate the
removed describe.sequential to concurrent:false and regenerate
package metadata and product catalog.

Also restore byte-faithful reads in parseCliJsonInput: the safeJson
migration dropped the fatal UTF-8 check from #613. Vitest 5 requires
Node 22/24/26+, so verify on Node 24 (repo-pinned toolchain).
2026-10-06 05:15:17 +08:00
github-actions[bot] feeb19b8b3 chore(main): release rea-agents 4.0.1 (#622)
* chore(main): release rea-agents 4.0.1

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-06 02:54:44 +08:00
github-actions[bot] 1a936887b2 chore(main): release rea-agents 4.0.0 (#502)
* chore(main): release rea-agents 4.0.0

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-06 02:29:30 +08:00
morluto 5daaa453ff chore: migrate formatting to Oxfmt (#615) 2026-10-06 01:59:19 +08:00
morluto 6256b68666 feat(setup)!: expand agent integrations and verify updates (#577)
* feat(setup)!: expand agent integrations and simplify onboarding

Add native configuration formats for OpenCode, Antigravity, GitHub Copilot
CLI, VS Code, and Devin. Preserve JSONC comments and unrelated settings
while making setup and uninstall ownership-aware and idempotent.

Select agent targets before planning, separate discovery from intent, and
keep agent-only setup independent of optional provider prerequisites.
Cover configuration boundaries and interactive behavior in packaged checks.

BREAKING CHANGE: unscoped setup refreshes only existing REA-owned
registrations. Use --all-detected to configure every detected client.
Setup JSON contains a compact doctor summary; use rea doctor for full
diagnostics. Cancellation and successful dry runs now exit successfully.

* feat(cli)!: replace upgrade with verified updates

Resolve an exact release through npm's configured registry, update only the
identified installation, and verify its new executable before reporting success.
Return a read-only maintenance plan for existing enabled REA integrations.

BREAKING CHANGE: replace rea upgrade with rea update; no alias is retained.
Successful update JSON uses status "updated", reports the verified installed
version, and returns an unapplied maintenance plan instead of opening setup.
2026-10-05 23:06:19 +08:00
N0zoM1z0 4007b20fc2 fix(mcp): emit valid schemas for empty arrays (#535)
Replace empty tuples with a shared empty-array schema. Validate all input
and output schemas against Draft 2020-12 during catalog generation and
packaged MCP verification, with runtime and catalog regression coverage.

Closes #528

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-05 15:32:58 +08:00
github-actions[bot] 0356f7677f chore(main): release rea-agents 3.2.1 (#499)
* chore(main): release rea-agents 3.2.1

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-04 03:58:16 +08:00
github-actions[bot] b7539467a6 chore(main): release rea-agents 3.2.0 (#472)
* chore(main): release rea-agents 3.2.0

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-04 00:43:14 +08:00
morluto b3529aa327 test: replace brittle workflow and readme checks 2026-09-29 08:44:41 +08:00
github-actions[bot] 344b9b6dff chore(main): release rea-agents 3.1.0 (#463)
* chore(main): release rea-agents 3.1.0

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-10 03:47:06 +08:00
github-actions[bot] 71f03a7224 chore(main): release rea-agents 3.0.0 2026-08-01 07:17:25 +00:00
morluto 17d7dbc461 build: upgrade MCP SDK to 2.0.0 2026-07-29 17:42:43 +00:00
github-actions[bot] 8ab40974d3 chore(main): release rea-agents 2.7.0 2026-07-28 06:53:17 +00:00
github-actions[bot] 58c749e831 chore(main): release rea-agents 2.6.0 2026-07-26 15:31:39 +00:00
github-actions[bot] 0190bcbef1 chore(main): release rea-agents 2.5.1 2026-07-25 09:17:41 +00:00
github-actions[bot] ea953e6984 chore(main): release rea-agents 2.5.0 2026-07-24 15:38:39 +00:00
morluto 1ac3118aa2 feat(browser): capture controlled Playwright scenarios 2026-07-24 13:16:01 +00:00
github-actions[bot] 829d9a0933 chore(main): release rea-agents 2.4.0 2026-07-23 07:39:29 +00:00
github-actions[bot] d4c52b3e30 chore(main): release rea-agents 2.3.0 2026-07-23 01:38:53 +00:00
morluto f236b95316 build: separate cached local and PR checks 2026-07-22 15:05:36 +00:00
N0zoM1z0 d25e98c3f9 feat: complete REA remediation program 2026-07-22 22:09:12 +09:00
github-actions[bot] 31f4c3bf0d chore(main): release rea-agents 2.2.0 2026-07-20 13:25:37 +00:00
github-actions[bot] ffab5d2707 chore(main): release rea-agents 2.1.0 2026-07-18 06:19:28 +00:00
morluto 1b90e7f992 feat(cli): support package-name setup wizard 2026-07-18 13:37:19 +08:00
morluto 16002ff3c2 feat(cli): improve setup onboarding 2026-07-18 11:59:16 +08:00
morluto 34252f55e9 fix(npm): use latest entry points without install scripts 2026-07-17 00:16:46 +00:00