mirror of https://github.com/morluto/rea.git synced 2026-10-12 02:19:24 +00:00

Files

T

github-actions[bot] b33236ec08 chore(release/5.0.0): release rea-agents 5.0.0 (#1007 )

* chore(release/5.0.0): release rea-agents 5.0.0

* chore: normalize release product catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

2026-10-08 01:26:36 +08:00

177 KiB

Raw Blame History

Changelog

5.0.0 (2026-10-07)

⚠ BREAKING CHANGES

native: preserve incomplete native UI captures (#991)
android: Android analysis now requires a full JDK 17 or newer with its compiler module for the packaged Java source bridge.

Features

apple: project macOS bundle anatomy in application graphs (88c940b)
apple: project macOS bundle anatomy in application graphs (dd3e7ae)
application: wire Android and Apple inventory graph tools (#852) (e0fd820)
browser: attribute native execution and listener sources (#917) (b5afa5f)
browser: capture correlated network content and lifecycle evidence (#797) (f9eaf05)
browser: trace captured website module imports (#879) (01be082)
browser: trace captured website source-map locations (#897) (f430c41)
javascript: recover readable modules with Wakaru (#848) (166dcd2)
native: decode chained fixups, binds, ObjC categories and properties (a657557)
native: decode chained fixups, binds, ObjC categories and properties (3e24a72)
native: open iOS-style and iOS-on-Mac wrapper app bundles (2ed89e6)
native: open iOS-style and iOS-on-Mac wrapper app bundles (aeebba3)
web: export captured scripts for JavaScript application analysis (#801) (472b72a)
website: add a shared back-to-top link (5047373)
website: introduce REA and the DX-Ball reconstruction (#906) (4e3953c)

Bug Fixes

address review nits from batch integration follow-ups (#818) (5a0e0ba)
android: align runtime suffix inference (#977) (fb3749a)
android: bound fragmented JADX MCP frame memory (#937) (9e39795)
android: preserve JVM settings and reuse metadata sessions (#908) (eab34a9)
apple: attribute only application-root components in macOS inventories (5524970)
apple: count only real framework version directories (2e81e86)
apple: pair bridge hypotheses within one application root (7acf4e7)
apple: pair bridge hypotheses within one application root (9226ade)
apple: traverse keyed archive hierarchy collections (#976) (71ac83f)
artifacts: accept APFS image disks ejected with their container (d93ebec)
artifacts: accept APFS image disks ejected with their container (b72c079)
artifacts: accept the bundle subject when extracting an app bundle (#891) (37d2eba)
artifacts: decode flat keyed-archive NIBs with data and shared references (b3f013f)
artifacts: decode flat keyed-archive NIBs with data and shared references (2a4667b)
artifacts: harden reader lifecycle boundaries (#951) (2366bda)
artifacts: keep the post-snapshot detach check out of provenance (62634e4)
artifacts: preserve reader failure diagnostics (#987) (fc4a9a0)
artifacts: project compiled AppKit actions from the control to its target (b08228d)
artifacts: project compiled AppKit actions from the control to its target (#905) (900d7c8)
artifacts: project UIKit runtime outlet and event connections (aa8082e)
artifacts: project UIKit runtime outlet and event connections (8b24387)
artifacts: read AppKit connectors from flat keyed-archive NIBs (#900) (27c272b)
artifacts: read keyed archive dictionaries keyed UID as dictionaries (cfd2b0c)
artifacts: read keyed archive dictionaries keyed UID as dictionaries (35c82b9)
artifacts: report which path constraint failed (#847) (3f1a77f)
browser: distinguish computed call keys from identifiers (#808) (02beb74)
browser: distinguish WebMCP registration frame owners (#813) (b3b44d8)
browser: fingerprint cookies at the selected page URL (#763) (78014e3)
browser: identify NodeNext TypeScript original source artifacts (#811) (e84ad86)
browser: preserve evidence through deep AST analysis (#924) (f826aa8)
browser: preserve form destinations and satisfies mutation uncertainty (#825) (6dd719e), closes #820
browser: preserve Link header value delimiters (#805) (dd36405)
build: validate installed dependencies before cache hits (#982) (a45fe86)
capture IndexedDB object-store record fingerprints (#809) (21a8bd0)
cli: align structured output guard with native flags (#777) (e9fac56)
cli: emit empty structured filter projections (#914) (2db668f)
cli: honor the selected native plist path (#773) (0374865)
cli: preserve output and comparison input validation (#981) (d5c43d6)
cli: preserve unsupported historical-source imports (#795) (911d580)
contracts: align CLI/MCP boundary contracts (#946) (4a60738)
deps: remediate smol-toml advisories (93091ab)
deps: remediate smol-toml advisories (c55ae3b)
dotnet: compare members with undecoded signatures by exact identity (28fd49f)
dotnet: compare members with undecoded signatures by exact identity (d52af3b)
dotnet: inspect native boundaries of non-managed and malformed PEs (d5f28fb)
dotnet: inspect native boundaries of non-managed and malformed PEs (d98dcfa)
dotnet: keep a decoded member unknown beside an undecoded counterpart (76b7020)
dotnet: keep admitted CLI header facts when metadata is unreadable (e5ba693)
dotnet: name the shared key in exact-signature ambiguities (7714e76)
dotnet: treat ambiguous undecoded members as possible counterparts (73370e1)
errors: report union input issues at the union's path (bddeb63)
evaluation: canonicalize Unicode argument keys (#980) (0a4caf4)
firmware: accept the verified Binwalk and Unblob release lines (#844) (bef4321)
firmware: retain multi-file extraction failures (#978) (8aaf9a1)
ghidra: admit the 12.1 line and the install's JDK range (#840) (5cbf06c)
ghidra: select exact packaged bridge scripts (#800) (894c30e)
ida: share concurrent session cleanup (#950) (f14b6a8)
installer: validate exact semantic versions (#954) (248972f)
integrate 24 reviewed browser/native/semantics corrections (#815) (3af3811)
javascript: advertise the exact empty seed rule and match empty API keys (35e5508)
javascript: analyze source maps with empty source names (58ef8ac)
javascript: analyze sources containing empty string literals (e7cbfe0)
javascript: analyze sources containing empty string literals (11fc3b9)
javascript: filter keyed-collection receivers only for get/delete (00f707b)
javascript: handle deep AST traversal and addition without stack overflow (#915) (62b3711)
javascript: handle deep static member paths (#939) (348c65c)
javascript: keep bare relative URLs for computed-method XHR (e32028d)
javascript: keep computed-method XHR request URLs (602d002)
javascript: keep exact empty env keys and method names (522c2d0)
javascript: keep exact empty env keys and method names (f7954a8), closes #783
javascript: keep exact empty require paths and request fields (ad1f6b5), closes #783
javascript: keep exact empty values in graph identities (f608127)
javascript: keep exact empty values in graph identities (63012ee)
javascript: keep keyed-collection reads out of endpoints (9075ce7)
javascript: keep keyed-collection reads out of endpoints (eb68761)
javascript: keep literal HTTP methods on storage-named receivers (9f48a76)
javascript: keep literal-method and URL-literal requests on aliased receivers (e3e7664)
javascript: keep mutated object initializer values unknown (#752) (6caa38a)
javascript: keep storage open versions out of XHR endpoints (4f51103)
javascript: keep storage open versions out of XHR endpoints (898b0f6)
javascript: keep XHR and client endpoints that receiver spellings hid (05f43ed)
javascript: leave empty application values unlabeled (527b76e)
javascript: match exact empty literal channels and seeds (e20da1f)
javascript: never read window or document open as XHR (ae849a7)
javascript: preserve computed Electron member uncertainty (3a4a63f)
javascript: preserve computed Electron member uncertainty (1260cac)
javascript: project decoded file URL paths (#810) (2572e1e)
javascript: read open() endpoints only from XHR method/URL pairs (63e0822)
javascript: read open() endpoints only from XHR method/URL pairs (1be3705)
javascript: read substitution-free templates as exact strings (c371d6e)
javascript: read substitution-free templates as exact strings (77cf757)
javascript: resolve bare source-map and worker URLs next to the script (#890) (45fcd28)
javascript: retain recovered call argument positions (#929) (e6ba9c3)
linux: improve Hopper reliability and CachyOS support (#963) (98b2b02)
mcp: advertise reserved process environment key (#949) (e0d76ae)
mcp: isolate optional observation adapter failures (#838) (be3cfbf)
mcp: preserve exact guided prompt context (#761) (66c26f2)
native-ui: handle incomplete accessibility child collections (#944) (ac3bae3)
native: inspect plists containing data, dates, and non-finite reals (bc2cd8b)
native: inspect plists containing data, dates, and non-finite reals (5ead2cf)
native: keep echoed codesign paths out of signature fields (#865) (4aa2b60)
native: keep echoed Mach-O paths out of load commands and symbols (ab985c6)
native: keep echoed Mach-O paths out of load commands and symbols (37fe105)
native: keep integral plist reals beyond the JSON range as reals (#860) (3b92a2b)
native: keep plist XML element types for large numbers (f85056d)
native: keep the resolved bundle plist and permission failures (418a556)
native: pass Swift symbols to swift-demangle as operands (dd90965)
native: pass Swift symbols to swift-demangle as operands (6c88094)
native: preserve incomplete native UI captures (#991) (9f496ef)
native: report exact plist integers beyond the JSON number range (c9f49db)
native: report exact plist integers beyond the JSON number range (430c297)
native: report plist permission denials as access failures (5738a0c)
native: report why a selected plist cannot be inspected (14f9b3d)
native: report why a selected plist cannot be inspected (0674fac)
plist: keep character references beyond Unicode literal (5afd8a8)
plist: read XML plists containing a proto key (faaee69)
plist: read XML plists containing a proto key (a08be51)
plist: report omitted proto entries in signatures and Interface Builder (15ab5db)
plist: report omitted proto entries in signatures and Interface Builder (6729ee7)
preserve native UI failure reasons and dedupe version literals (#854) (2d4a910)
process: clarify Windows capture support and recovery (#798) (50787b2)
process: harden filesystem snapshot identity and cancellation (#956) (93aa9eb)
process: retain provider output until streams close (#928) (b929251)
reference: retain partial imports for unreadable directories (#766) (cffc548)
release: drive checkpoint releases from frozen branches (fc58fa1)
release: publish from explicit source checkpoints (49887f0)
semantics: isolate named function expression bindings (#776) (ae81f64)
semantics: preserve direct promise ownership boundaries (#758) (e1ca412)
semantics: preserve empty string property keys (#764) (630bdaf)
semantics: recognize Node builtin default namespaces (#769) (24a0bf9)
semantics: retain trailing rest argument flows (#756) (4bfd803)
setup: accept the pinned Hopper RPM launcher (#933) (dda8e6a)
setup: read an OpenCode V2 server named type as a table entry (#866) (4e17be5)
setup: register OpenCode V2 configurations in mcp.servers (957069d)
setup: register OpenCode V2 configurations in mcp.servers (69d8afe)
target: decode app Info.plist executables with an XML parser (c57f1b7)
target: decode app Info.plist executables with an XML parser (c182f72)
test: disconnect Hopper fixture IPC on SIGTERM (b912b11)
windows: accept ordinary drive path separators (#791) (b62931f)
windows: remove cancelled snapshot outputs (#957) (d76f7d1)

Performance Improvements

artifacts: stream ASAR members without full buffering (#962) (abd7a5e)
call-path: prune dead ends and enumerate without recursion (#909) (e52fe97)
cli: defer catalog digests and use canonical cache scope (9a15525)
cli: defer unused catalog work during command startup (#920) (9a15525)
comparison: reuse canonical sort keys (#990) (ebb065e)
dotnet: index declaring-type ranges once per metadata table (#918) (7a9f587)
dotnet: index ordered declaring-type ranges once per table (7a9f587)
evidence: scale imports and dependency graphs (#941) (7dc40d3)
inspector: bound runtime script location authorization (#945) (58381ee)
javascript: analyze member chains without recursive copying (#932) (dcde958)
javascript: index Promise return-site ownership (#971) (2cedde9)
javascript: index semantic fingerprint relations (#942) (c92a344)
javascript: reduce analysis and source-map work (#955) (c7530f9)
providers: assemble fragmented responses once per line (#911) (df7151b)
reconstruction: index coverage evaluation (#983) (f26c8b5)
setup: reuse initial diagnostics during planning (#940) (118d43e)

Code Refactoring

add incremental capability migration safeguards (#819) (75f50d8)
android: group layered source and verification (#873) (8e8921d)
apple: group artifact producers and verification (#952) (ef1a0cc)
artifacts: isolate JavaScript file acquisition (#916) (f0a68dc)
binary: group session selection and snapshot ownership (#886) (dd114d3)
binary: move production composition outside application workflows (#965) (33d4761)
browser: align inspector exclusions with canonical vocabulary (#834) (de9593a)
cli: split core analysis command registrar (#858) (8b9940a)
colocate investigation record implementation (#867) (bb19c94)
compose investigation record ownership (#845) (ce73c3f)
declare auxiliary capabilities from source (#853) (4a6c17c)
domain: consolidate property-key extraction behind semanticStaticPropertyKey (#823) (764ff05)
domain: converge comparison mechanics on shared vocabulary (#824) (c13c9d4)
domain: extract artifact path syntax helpers (#830) (ef535b8)
domain: extract source-map envelope walk and disambiguate stringValue (#828) (64ebdf4)
domain: map validation taxonomies and add inventory Result seam (#833) (78f4848)
domain: split Interface Builder keyed-archive parse from graph builder (#859) (da09706)
firmware: group layered source and verification (#878) (507e8b3)
ghidra: extract createClient and load-image attestation (#856) (b7df5b7)
give Inspector its own capability directory (#869) (021ba69)
javascript: group application workflows and verification (#896) (0804722)
javascript: group domain semantics and contracts (#907) (f6a58f1)
managed: group capability workflows and verification (#926) (28713f9)
native: group analyst semantics workflows and contracts (#973) (ea4db4c)
native: split Apple dispatch metadata decode facets (#855) (676959e)
provider: declare deep capabilities from source (#892) (b808e2d)
share Android and firmware provider factories (#826) (3ed59b2)

Documentation

add concise lawful-use disclaimer (#888) (4037c65)
add DX-Ball reconstruction showcase (#876) (895079d)
add prominent website and showcase links to READMEs (2ccc86c)
add README star history chart (#850) (11f27de)
add website and showcase links to READMEs (#930) (2ccc86c)
apple: describe directory-based framework plist ambiguity (6d74992)
audit and improve localized readmes translations and wording (00a6ac3)
clarify NativeAOT scope and regenerate conformance ledger (c945931)
fix stale IDA roadmap item, mermaid paths, toolchain wording (d2aed17)
move quick start up and mark skill install optional (554e9b1)
note Cloud Agent Node.js toolchain (#837) (6aa6350)
publish VitePress documentation on GitHub Pages (c78fe69)
separate ambiguous and unavailable provider recovery (c3f2b8e)
show task-scoped readiness and provider preference in the quick start (880cca1)
show task-scoped readiness and provider preference in the quick start (5fd0db3), closes #726
update release boundary to npm 4.1.0 with Windows native bundle (69be514)
website: add Notion case study and improve onboarding (a6ba772)
website: add TH04 bullet-ring case study (f8d84da)
website: add worked guides and keep Pages publishing manual (#925) (4f25ee3)
website: clarify guides and case studies (5065fcd)

Tests

artifacts: report compiled connector records when a storyboard route is missing (d421d3f)
artifacts: report observed action routes when a compiled route is missing (c60b737)
artifacts: write the storyboard fixture's action in Cocoa syntax (53bfa7e)
eliminate fixture races and prune redundant scaffolding (#849) (f72931d)

Continuous Integration

consolidate macOS native baseline checks (#935) (810fe53)
verify native arm64 and Intel macOS workflows (#898) (4801a24)

4.1.0 (2026-10-06)

Features

android: integrate static APK analysis with headless JADX (#738) (904d03e)
evidence: accept exact retained application references (#734) (d0f3480)
firmware: integrate Binwalk and Unblob analysis (5a7c769)
ghidra: add atomic function annotation edits (#709) (9bab553)
ghidra: admit explicit DOS COM analysis (#702) (5bcb664)
ghidra: enable Windows x64 read-only analysis (#699) (26881da)
ghidra: integrate optional NativeAOT metadata recovery (#748) (fb679b6)
ghidra: verify DOS load images and expose memory evidence (#697) (a6a8f67)
ida: add read-only GUI and headless MCP providers (#754) (8238232)
setup: support Command Code MCP registration (#645) (7f1ae42)

Bug Fixes

android: validate explicit Java runtime (#742) (7390390)
artifacts: make extraction output tree work on Windows (#753) (c8e66c7)
browser: classify CSP host sources by their own origin (#707) (1d15bcb)
browser: keep bare module locations unresolved (#676) (8189081)
ci: upload Vitest blob reports from current path (77799e6)
cli: disable unmanaged skill synchronization (433ebda)
cli: disable unmanaged skill synchronization (2c1bf92)
cli: fail when JSON input files cannot be parsed (18c1829)
cli: fail when JSON input files cannot be parsed (3201f05)
cli: include build step in missing-runtime recovery (6a37346)
cli: include build step in missing-runtime recovery (ae72abd)
cli: report reference-source import failures (00eb03d)
cli: report reference-source import failures (431e8eb)
comparison: break function collection collation ties (c3d013b)
comparison: break function collection collation ties (3aaf7e2)
comparison: break JSON shape collation ties (217e8cf)
comparison: break JSON shape collation ties (805c338)
comparison: retain container-only export shape paths (a55b5bb)
comparison: retain container-only export shape paths (7864d66)
dotnet: preserve leading Unicode content in metadata strings (#667) (ddea063)
electron: respect computed option keys and overrides (af48fe8)
electron: respect computed option keys and overrides (98de338)
evidence: admit current process provider identity (ab5a1c6)
evidence: admit current process provider identity (d311940)
firmware: validate configured executables (#751) (9a4e6da)
ghidra: preserve request and shutdown failure diagnostics (#647) (19f8cdd)
ghidra: refuse ambiguous universal Mach-O imports (b1b687f)
ghidra: refuse ambiguous universal Mach-O imports (6582b24)
hopper: retain shutdown request diagnostics (8d7071d)
hopper: retain shutdown request diagnostics (7254871)
integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) (#705) (cf06115)
javascript: count all source line terminators (e60aa11)
javascript: count all source line terminators (03bc6d3)
javascript: expose result schema failures (6d1f39b)
javascript: expose result schema failures (99263a7)
javascript: hash graph and evidence JSON incrementally (#646) (9f42495)
javascript: preserve path.resolve reset semantics (863ed47)
javascript: preserve path.resolve reset semantics (4177377)
javascript: preserve primitive addition coercion (#666) (94cc847)
javascript: preserve unknown branches in primitive unions (75a75cb)
javascript: preserve unknown branches in primitive unions (9a2f395)
javascript: read source-map directives only from comments (#672) (7f1fa64)
javascript: scope candidate ambiguity to query traversal (6ad62ce)
javascript: scope candidate ambiguity to query traversal (f94fc79)
mcp: retain shutdown failure diagnostics (09c249d)
mcp: retain shutdown failure diagnostics (fd008cd)
native: inspect mixed-signature Mach-O slices (1dccd0d)
native: inspect mixed-signature Mach-O slices (66f3cfa)
native: retain spaced symbols in dyld inventory (#669) (fa02df9)
native: select concrete arm64e Mach-O slices (f04445c)
native: select concrete arm64e Mach-O slices (fd3282a)
process: honor disabled PID normalization in samples (44b3627)
process: honor disabled PID normalization in samples (a4e5736)
process: scope comparison unknowns to their evidence (#732) (9dd6cef)
reconstruction: accept function comparison source parameters (c3bc38b)
reconstruction: accept function comparison source parameters (7a96391)
reference: bound Dockerfile language detection (132a3a4)
reference: bound Dockerfile language detection (53fa559)
reference: classify test suffixes before extensions (e828acc)
reference: classify test suffixes before extensions (8b228ae)
reference: distinguish computed require member names (ba35b55)
reference: distinguish computed require member names (df6e476)
reference: preserve unresolved absolute module specifiers (#670) (c8aed47)
reference: read linked worktree commit provenance (#677) (d565ecd)
reference: recognize CMake build manifests (#665) (1a24be5)
reference: retain dynamic import relationships (a5d2986)
reference: retain dynamic import relationships (b89de8f)
reference: retain recovered parser diagnostics (11d0ef2)
reference: retain recovered parser diagnostics (ed3a7f0)
setup: accept leading BOM in JSON client configs (a5b970c)
setup: accept leading BOM in JSON client configs (fe843ec)
setup: align Node runtime checks with package engines (5802ef8)
setup: align Node runtime checks with package engines (ea0b733)
target: explain the JavaScript directory analysis route (#733) (8d44b3e)
trace: match typed seeds against member arrays (65c8797)
trace: match typed seeds against member arrays (38ebd54)

Code Refactoring

app: split Setup and ProcessOwnership modules (#628) (3c84080)
cli: collapse duplicate CLI layer into src/cli (#630) (494d4db)
contracts: split tool contracts by family (#634) (5295d56)
domain: consolidate canonical ordering and digest helpers (#624) (ba3869c)
domain: split error taxonomy into thematic modules (#636) (735c100)
native: extract FAT header format switch in Mach-O slice selection (#632) (38b2933)
runtime: centralize safe JSON parsing and preserve error causes (#629) (e7f54b3)
runtime: name all silent catch causes without changing diagnostics (#637) (5f27e02)

Documentation

add the official Trendshift badge to README headers (b6c21b1)
add the official Trendshift badge to README headers (7d4ed59)
align MCP discovery and skill guidance with the stable catalog (#664) (39db9fe)
browser: add an interaction example that captures the visible result (#750) (91daaa6)
clarify onboarding and align provider guidance (#745) (5af1699)
correct CLI examples and documentation checks (#655) (fc80ea8)
fix architecture diagram and pretty-print tool catalog (#626) (5e7f35c)
ghidra: explain first-query deadlines and recovery (#736) (e2c23f3)
hopper: document HopperTargetLease realpath fallback (#711) (d3f498c)
installation: pin manual MCP registration to the release version (#658) (8dd1d84)
update Trendshift repository badge (3f6d6dc)

Tests

extract shared fixtures, drop knip carve-outs (#627) (55e5eb0)
hopper: synchronize startup cancellation with launcher readiness (#662) (88a3c3f)

4.0.1 (2026-10-05)

Bug Fixes

release: allow npm propagation time (2ef02ce)

4.0.0 (2026-10-05)

⚠ BREAKING CHANGES

Managed comparison metadata adds exact-signature matching and its count, and name_matching now reports exact-signature-fallback.
setup: unscoped setup refreshes only existing REA-owned registrations. Use --all-detected to configure every detected client. Setup JSON contains a compact doctor summary; use rea doctor for full diagnostics. Cancellation and successful dry runs now exit successfully.
Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
tools: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.

Features

ghidra: add DOS MZ analysis and complete function extents (#556) (4f099a1)
native: add inspection primitives, dispatch traces and approved UI observation (#500) (4fbc501)
setup: expand agent integrations and verify updates (#577) (6256b68)

Bug Fixes

artifacts: break directory child collation ties (#587) (b37e47c)
artifacts: exclude removed paths from unchanged counts (#569) (52bf709)
artifacts: expand nested ASARs on Windows (#582) (ebb4c45)
artifacts: interrupt ZIP extraction under backpressure (#594) (50f7e81)
artifacts: preserve archive entry types and host paths (#581) (28e0f4e)
artifacts: refresh cached ASAR headers for each inventory (#574) (f5013c5)
artifacts: resolve parents after archive enumeration (#578) (8eac290)
artifacts: respect XML plist byte-order marks (#514) (23c4eba)
artifacts: retain expanded ASAR container parents (#583) (00fa974)
artifacts: retain relative paths in directory identities (#580) (348323d)
browser: capture popup network and report early event gaps (#614) (f557207)
browser: capture selected events in popup pages (#600) (a3bf4a0)
browser: derive source-map imports from syntax nodes (#588) (bae87b4)
browser: distinguish duplicate screenshot frame events (#612) (1bd641d)
browser: ignore duplicate frame navigations and read block-form source map directives (#546) (828395d)
browser: keep subresource redirects out of page navigation scope (#524) (9c28f3c)
browser: preserve RGB PNG transparent samples (#595) (9997152)
browser: release cancelled CDP cleanup without waiting for responses (#517) (488fd5f)
browser: release discarded source-map response bodies (#611) (8642055)
browser: resolve redirected source map paths from final URL (#518) (056c123)
cli: fail commands returning projected analysis errors (#506) (2fd1196)
cli: reject invalid UTF-8 JSON file bytes (#613) (22acb0d)
comparison: account for unpaired records after explicit bundle pairing (#603) (12a2e37)
comparison: match generated names without swallowing symbol prefixes (#596) (5f3ba3e)
comparison: normalize CFG identity by numeric addresses (#593) (d1e5c0e)
comparison: require decoded signatures for structural method matches (#604) (4a98c3e)
conformance: preserve own JSON keys during comparison (#573) (3460eda)
correct native inventories and bridge error classification (#503) (405732a)
docs: allow README installation wording to vary (92617f9)
ghidra: avoid nested quotes in Windows Java options (a574b74)
ghidra: recover evidenced switch cases and default targets (#579) (b225b0f)
inspector: preserve lossy Node discovery locations (#542) (84e4361), closes #530
javascript: avoid invented computed destructuring properties (#507) (80777d9)
javascript: bind named class expressions in their class scope (#510) (55f0267)
javascript: classify assignment targets and retain compound-assignment reads (#537) (333d118)
javascript: correct lexical and dynamic scope analysis (#538) (6fa6f1f)
javascript: honor computed keys when naming callables, exports, requests and options (#536) (4c8dc39)
javascript: honor package exports condition order (#591) (8289595)
javascript: isolate lexical loop bindings (#511) (c30878f)
javascript: prefer package entrypoints over directory indexes (#575) (bb91abd)
javascript: preserve literal CommonJS path punctuation (#576) (063cd25)
javascript: preserve Node exports fallback stop reasons (#606) (adc07f5)
javascript: respect HTML base URL components (#589) (ffbde92)
javascript: respect lexical shadowing of require (#509) (6a431d8)
javascript: retain property reads during updates (#508) (6b7923c)
managed: classify truncated signatures as malformed (#598) (1b6f054)
managed: distinguish metadata handles from member accesses (#607) (c73742f)
managed: recognize PE Thumb and ARMNT machines (#605) (0ce529a)
mcp: emit valid schemas for empty arrays (#535) (4007b20), closes #528
mcp: return complete inline Evidence records (#585) (ea9c3da), closes #551
native: capture Mach-O header metadata alongside load commands (#525) (a8195ba)
native: decode little-endian fat headers (bede3e3), closes #592
native: decode Mach protection bits in their proper positions (#586) (6aba6ae)
native: inspect Apple dispatch metadata in FAT64 binaries (#590) (f3e6582)
native: inspect the selected universal Mach-O architecture (#601) (2b7bb3b)
native: match compound otool keys exactly and badge unknown thread entrypoints (#534) (d40502a)
native: normalize otool line endings and strip plist JSON BOM (#533) (3e4d4d9)
native: preserve text-valued load command metadata (#520) (bcfb407)
native: reject signal-terminated command captures (#608) (b81d18e)
native: reject trailing text in lipo integers and keep multi-word otool keys (#531) (9e30d93)
native: retain lazy dylibs, normalize version-min builds, limit thread entrypoints (#532) (0f77ada)
native: retain re-exported Mach-O library dependencies (#516) (4a5673e)
package: separate agent and Hopper setup support (#584) (205a977)
platform: accept absolute paths for any host and stop blaming the ceiling for a missing grant (#552) (e793e12)
process: align provider detach with configured platform (3fff74f)
repair boundary contracts across CLI and MCP (#597) (9c25dc4)
replay: keep proto own properties and reject symbol-keyed results (#540) (05bb630)
replay: link the complete ESM graph before evaluating (#515) (4200a42)
replay: preserve CommonJS object as ESM default export (#519) (2df6b51)
replay: preserve Date call and explicit constructor semantics (#512) (9975bd2)
replay: preserve sparse array positions in result projection (#522) (9d1c363)
replay: share one seeded generator and present builtins with real identity (#539) (5b51fa0)
repo: keep dependency links out of version control (#617) (b3223e3)
skill: remove obsolete grants and audit tool effects (2919def)
test: improve capture reliability and runner cleanup (#609) (d19686a)
tools: simplify direct invocation and harden boundary contracts (#555) (b5e9891)
web: retain uncertainty for incomplete capture inventories (#513) (d8c18f6)
win32: probe .cmd/.bat runtime shims via cmd.exe to avoid spawn EINVAL (#505) (31ed005)
workflows: preserve punctuation in filesystem source paths (#521) (5b28a8b)
workflows: retain container presence in export shape comparisons (#523) (3854458)

Code Refactoring

config: take the environment as an input at every configuration read (#554) (53fe7d6)
domain: consolidate duplicated semantic member and literal helpers (#550) (09830da)
domain: own digest and prefixed identifier shapes in one module (#547) (ea58834)
host: inject platform and environment instead of reading them ambiently (#549) (5b59b87)
simplify runtime tools and remove replay engines (#572) (e07b816)

Documentation

add boundary contract guidance (42e6a8a)
add Discord community links to README (79bf26f)
align roadmap with direct tool use (eba709e)
align translated READMEs and clarify support guides (5b383b2)
clarify README wording and analysis tool support (97822f2)
move README image above Discord community (ad86d39)
place community invitation below README navigation (69a45e0)
place Discord community below setup command (778e464)
place setup command above README image (c6d3bdf)

Tests

setup: isolate client fixtures across host platforms (f73bb0f)

3.2.1 (2026-10-03)

Bug Fixes

release: tolerate npm registry propagation delay (726b730)

Tests

release: accept guarded npm publishing (b7bc855)

3.2.0 (2026-10-03)

Features

native: add investigation features (#486) (ed933d1)

Bug Fixes

artifacts: stabilize extraction approval (7eb1a95)
browser: reject unknown Electron input fields (1860d4f)
ci: retain artifacts for delayed reruns (07888ec)
cli: remove ignored result limits (f3645aa)
consolidate boundary ownership and cleanup failure paths (#477) (2160d4f)
contracts: align byte read schema with provider (f580d9d)
ghidra: return complete native analysis results (a66e43a)
managed: retain every source location (33b2099)
process: capture complete host probe output (6c68ff5)
runtime: make observed target role optional (593a8e1)
runtime: retain complete reconciled graph content (bedd55a)

Code Refactoring

analysis: remove caller-selected result caps (a8c58c6)
analysis: remove fixed result quotas (20152a9)
artifacts: consolidate inventory into inspection (0fe96d9)
artifact: simplify extraction and inventory results (07ff8b3)
artifacts: remove duplicate inventory wrapper (aa6eee1)
artifacts: remove selectors and traversal quotas (8c24272)
artifacts: select extraction by logical path (7ba3580)
browser: remove arbitrary capture ceilings (5dd3b46)
browser: return complete observation evidence (0e2738f)
browser: return complete scenario observations (e80fe41)
browser: share authorized main-frame polling (eec75ce)
browser: share canonical identity digest (a6d9e49)
contracts: remove duplicate schema aliases (4593c29)
contracts: simplify workflows and drop readiness tool (7acac61)
coverage: evaluate inline without workspaces (9e76054)
domain: encode comparison and lifecycle states exactly (#473) (d65730c)
domain: share AST property name reader (4f4cc59)
electron: retain complete active observations (e8c56e0)
errors: remove stale workspace failures (f570d40)
evidence: remove obsolete ID resolvers (a3920e2)
evidence: remove session ledger quotas (dca293a)
files: use caller paths for local evidence files (c34efca)
ghidra: remove redundant schema markers (c2a6f4b)
javascript: remove analysis ceilings (9aec690)
managed: derive inspection from PE CLI extents (dfad09e)
mcp: simplify evidence and workflows (6740ed5)
mcp: simplify tool inputs and inline results (f55c2b9)
mcp: simplify workflow and observation scope (34d00fd)
observation: internalize capture budgets (7b3c797)
observation: retain complete tool results (fa2b6c5)
observation: return complete inventories (c523c38)
permission: remove unused authorization helpers (1b0ab75)
process: remove fixed scenario ceilings (abf7c11)
process: remove redundant schema version markers (b3aca52)
process: remove request count ceilings (f2dc749)
process: remove unused paired experiment (e1d755f)
prompts: make tool workflows optional (3fd9650)
reference: share graph index projections (6ee87fb)
remove cross-version investigation workflow (81996df)
replay: share sandbox probe arguments (9fca6c0)
replay: simplify runtime value checks (60cb68a)
return complete analysis results inline (a2a3243)
return complete tool results inline (0d96275)
runtime: retain complete reconciliation outputs (79ea571)
schema: remove data-only version markers (5457f4a)
server: remove registration alias (8097ec4)
server: use canonical elicitation type (bb6a58c)
test: colocate pure-domain tests and reduce test debt (#471) (e91c8c3)
test: keep coverage at behavioral boundaries (#474) (d4dc940)
tools: remove arbitrary workflow ceilings (5f73cb0)
tools: remove artificial analysis ceilings (2f08c7c)
tools: remove redundant limits and acknowledgements (bd0e341)
tools: remove remaining arbitrary workflow caps (ecf3ed8)
tools: return complete analysis results inline (2a6eb41)
workflows: simplify evidence reference inputs (24e1fa9)

Documentation

add REA tool design guidance (#485) (36aeec9)
clarify aggregate context tools (c7e207c)
clarify MCP tool design guidance (36aeec9)
correct inline evidence and Hopper behavior (bf9cce1)
describe complete application analysis outputs (271b162)
generalize reverse-engineering workflow (#488) (4ecc7a7)
improve GitHub issue and pull request templates (c490d85)
prioritize reusable analysis primitives (#493) (9dd72c4)
refresh managed conformance manifest (23e56c5)
refresh tool catalog and cleanup audit fixtures (53db3a4)
regenerate tool and evidence catalogs (2f604a3)
regenerate tool and evidence catalogs (f2bbd59)
tools: clarify complete inline results (3b64c81)
tools: clarify complete inline workflows (4168174)
tools: describe uncapped tool behavior accurately (4cea84d)
tools: update inline workflow guidance (4ad937c)

Tests

artifacts: exercise argument-free extraction preflight (a6d5b3e)
browser: assert strict inputs without legacy fields (9ddf22e)
browser: cover complete screenshot output (3f547ea)
browser: remove stale input field assertion (60c110d)
cli: consolidate duplicate setup journey (9bd7e2c)
cli: remove duplicate browser discovery case (dcb0362)
conformance: remove fixture generator test option (ea853ce)
contracts: remove duplicate tool inventories (0ae3c08)
hopper: name regex search assertion accurately (9240bd8)
hopper: remove dossier identity assertion (b5c0b5b)
mcp: align workflow assertions with current guidance (f8bb113)
mcp: consolidate catalog inventory checks (3afcd64)
mcp: validate defaults at tool boundary (21241d2)
remove duplicate export schema acceptance (b783e7f)
remove obsolete schema version assertions (fe342fa)
remove stale limits and handoff expectations (acf33d6)
remove vacuous and duplicate assertions (56e2bf7)
remove Vitest config test exports (d6e545c)
replace brittle workflow and readme checks (b3529aa)
replace implementation lock-in with behavioural assertions (#498) (7ee3f23)
replay: remove duplicate schema coverage (4ec2343)

3.1.0 (2026-08-09)

Features

electron: add autonomous Electron runtime analysis (#464) (8f229ed)

Bug Fixes

ci: guard Release Please PR branch parsing (84cc819)
ci: guard release PR branch parsing (6838b6b)
harden evidence lifecycle and MCP contracts (5155924)
harden structured configuration comparisons (#467) (6901edc)
npm: preserve explicit setup versions (#465) (1783bf6)

Code Refactoring

mcp: make analysis states unrepresentable (#468) (b8a9da0)

Documentation

clarify agent reverse-engineering promise (ed4a628)
clarify the agent reverse-engineering promise (#466) (ed4a628)
npm: simplify current setup command (#469) (8b62b1a)

3.0.0 (2026-08-01)

⚠ BREAKING CHANGES

export_evidence_bundle now requires a filesystem path and no longer returns an inline bundle.

Features

make evidence bundles canonical MCP resources (1712e6d)

Bug Fixes

address MCP resource review feedback (f3b3fb0)
align aggregate tools with session capabilities (ede91ff)
ci: align Vitest project worker budgets (f47ee1a)
ci: allow documented public type aliases (97f6a0f)
ci: make coverage report merging composable (788f405)
ci: stabilize Vitest project routing and shards (f07acde)
errors: preserve actionable analysis diagnostics (0f96bf3)
mcp: clarify routing and advertise input examples (969519c)
mcp: clarify target routing and caller diagnostics (3e1e8cd)
test: bound boundary worker pressure (935721d)
test: honor boundary ownership and public aliases (92a1c33)
test: retain subprocess coverage and cleanup (7f46bb1)
test: retain subprocess coverage and cleanup (dae2b9c)
test: stabilize boundary timing (f0d8cda)
verify: follow dynamic Hopper tool availability (281e41f)

Code Refactoring

preserve provider-neutral runtime seams (a8161f0)

Documentation

document resource snapshot workflow (2a45d8d)
refresh generated SDK metadata (c824db1)
refresh managed completion manifest (59d4659)

Tests

contracts: cover validation branches (8ccdb33)
derive MCP SDK identity expectations (ab4193c)
eval: cover navigation and address tool routing (ba098f2)
overhaul deterministic suite architecture (48053d1)
overhaul deterministic suite architecture (513d9b1)
package: verify npx upgrade on published releases (7b6f7be)
package: verify npx upgrade on published releases (1f8ad7b)

Continuous Integration

document deterministic suite ownership (3c42403)

2.7.0 (2026-07-28)

Features

bytecode: add JVM and Python bytecode providers (1a75f8d)
bytecode: add JVM and Python bytecode providers (4e0127d), closes #367
conformance: add portable conformance export package format (91fb87d)
conformance: add portable conformance export package format (4ee30e4)
metadata: add deeper ObjC/Swift metadata and database save/licensing (4602efd)
metadata: add deeper ObjC/Swift metadata and database save/licensing (d7a0753), closes #353
mobile: add Android APK/AAB/DEX and iOS IPA static investigation providers (18624df)
mobile: add Android APK/AAB/DEX and iOS IPA static investigation providers (fdeeb27), closes #366
package: add MSIX/MSI/AppX package, resource, and signature analysis (0ef1b91)
package: add MSIX/MSI/AppX package, resource, and signature analysis (6c03f83), closes #363
pe: add broader PE/COFF/PDB static inspection (f942558)
pe: add broader PE/COFF/PDB static inspection (94e6600), closes #362
process: replace procfs sampling with event-backed process-tree capture (a5e355a)
process: replace procfs sampling with event-backed process-tree capture (d5d2e56), closes #332
protocol: add custom TCP/UDP/IPC/XPC and auth-flow capture (1fb22b4)
protocol: add custom TCP/UDP/IPC/XPC and auth-flow capture (6fa6f9b), closes #365
protocol: add gRPC/Protobuf and JSON-RPC/MessagePack capture (54153ed)
protocol: add gRPC/Protobuf and JSON-RPC/MessagePack capture (3f336fe), closes #364

Bug Fixes

catalog: digest provider projections (645668b)
catalog: digest provider projections (c4cd033)

2.6.0 (2026-07-26)

Features

complete evidence-backed roadmap workflows (1a0931b)
hopper: report bridge progress diagnostics (7a43420)
native: inspect API boundaries with evidence (521139d)

Bug Fixes

setup: refresh stale local npx bootstrap (6d37efe)
setup: refresh stale local npx bootstrap (90bb161)

Performance Improvements

mcp: reduce cold-start work (8ec9bb1)
mcp: reduce cold-start work (fecddc0)

Tests

add critical provider workflow coverage (4716fa2)
hopper: remove brittle diagnostic source assertion (40bf55b)
investigation: prove multi-version fixture closure (5184816)
mcp: stabilize lazy-loading verification (7157ab0)
package: prove artifact cleanup and identity (9522adf)

2.5.1 (2026-07-25)

Bug Fixes

ci: normalize generated release metadata (d43a461)
ci: normalize release pull request metadata (119954c)

Performance Improvements

browser: lazy-load Playwright sessions (305e729)
dotnet: reuse authenticated artifact snapshots (c5e8871)
eliminate repeated work in analysis hot paths (fbe442b)
evidence: validate ledger mutations incrementally (809dfbf)
javascript: reuse parsed source across analyses (adc4852)
server: cache advertised JSON schemas (6743644)

2.5.0 (2026-07-24)

Features

add runtime reconstruction roadmap workflows (1dbb157)
analysis: add bounded memory and call tracing (8e7709d)
artifacts: add provider-neutral inspection (d997728)
browser: capture controlled Playwright scenarios (1ac3118)
browser: compare scenario and storage evidence (f27dd74)
javascript: compare source with shipped bundles (697be94)
javascript: recover runtime semantic effects (38c883b)
process: support explicit stdin closure (205bf15)
reconstruction: add obligation ledgers (9d48ca7)
reconstruction: evaluate end-to-end readiness (38ff741)
runtime: add passive V8 Inspector observation (8271650)
server: advertise available tools dynamically (035e114)

Bug Fixes

analysis: report call-edge truncation (6039b92)
browser: close scenario containment gaps (1bd65f6)
browser: contain scenario pages and preserve inputs (24b3dc4)
browser: require storage fingerprint approval (f0069cb)
ci: allow slower real browser startup (095c75d)
ci: propagate readiness verifier failures (9f9f9c3)
ci: repair cross-platform package verification (1c9e508)
comparison: preserve uncertainty and v1 inputs (b9217dc)
hopper: add bounded analysis recovery (e0bc7fd)
javascript: keep digestless bundle matches unknown (5a76aaf)
process: expose launcher identity mismatch (62ac73c)
process: normalize macOS launcher identity (9c3aec8)
process: tolerate exit during ownership revalidation (a0f8b72)
reconstruction: authenticate obligation proof boundaries (7b1e3bd)
reconstruction: bind proof evidence to claims (83b3368)
runtime: preserve deterministic context identity (9bd2ac5)
test: use direct Node launcher on macOS (13f3372)

Performance Improvements

test: speed up local and CI validation (1546a8d)
test: speed up local and CI validation (42fbbb2)

Code Refactoring

application: reuse graph evidence resolution (4e8aa98)
browser: centralize scenario metadata budgeting (e79e367)
browser: clarify inspector capture identifiers (ca035a7)
browser: reuse CDP endpoint parsing (00abf45)
javascript: centralize source range comparison (c9500d3)
javascript: share semantic call-site lookup (94a2c60)
reconstruction: isolate ledger coverage (4f62695)
server: reuse availability policy type (eeb4349)

Documentation

document roadmap analysis workflows (f29f683)
refresh generated roadmap metadata (f904668)

Tests

browser: use neutral scenario fixture identifiers (fd25a7e)
package: stabilize fake Hopper ownership (0b70131)

Continuous Integration

verify runtime observation and readiness (9349ff5)

2.4.0 (2026-07-23)

Features

artifacts: support MSIX and AppX packages (6e6cce1)
expand reactive capture and package analysis (9da1794)
process: add reactive capture scenarios (69761e9)

Bug Fixes

capabilities: expose typed availability codes (b906def)

2.3.0 (2026-07-23)

Features

complete REA remediation program (d25e98c)
evidence: generate verifier completion ledgers (c02d33f)
evidence: generate verifier completion ledgers (f5b3e22)
javascript: add bounded semantic relation graph (b3939ea)
javascript: add bounded semantic tracing (56c1a66)
javascript: add local semantic call flow (a26a1c7)
javascript: expose bounded semantic tracing (508a9cc)
process: add bounded reactive scenario domain (42f3b9c)
process: add bounded reactive scenario domain (d34463c)
process: add direct replay machine runner (3df9a07)
process: compare declared concurrent traces (d81745c)
process: coordinate reactive capture effects (b874efd)
process: coordinate reactive capture effects (db9a831)
process: record global capture event order (8bcdb98)
process: record provider and verifier run lineage (02b01d4)
process: record provider and verifier run lineage (513fa29)
process: run finite-state replay during capture (820af60)
process: run finite-state replay during capture (34c583a)

Bug Fixes

browser: redact transitional target titles (f6095cb)
cli: retain bundled skill and bias setup wizard toward apply (5692b3f)
cli: retain bundled skill and bias setup wizard toward apply (fec5c3c)
cli: route JavaScript applications from analyze (737940c)
cli: route JavaScript applications from analyze (74965d9)
javascript: preserve candidate trace ambiguity (8678b57)
knip: ignore ps binary and in-file schema exports (9960982)
mcp: preserve investigation input policy (5a908a0)
mcp: preserve investigation input policy (f4156d9)
process: bound trace comparison semantics (b4df565)
process: normalize resize frame timestamps (74d1c7b)
process: normalize resize frame timestamps (77696df)
process: preserve nonconforming differences (f1cc485)
process: preserve replay event causality (d895e49)
process: protect unrelated Hopper during cleanup (81539c4)
process: protect unrelated Hopper during cleanup (e4ee4c9)

Code Refactoring

process: extract capture journal recorder (a32b988)
process: split trace comparison domain logic (75d5a87)
process: split trace comparison helpers (6d8ecd2)

Documentation

cli: clarify setup consent comment (e869137)
refresh Node 24 TypeDoc output (846193c)

Tests

browser: stabilize real shape capture (bb2e243)

Continuous Integration

remove redundant typecheck, lint, and format compatibility jobs (eb27f01)
remove redundant typecheck, lint, and format compatibility jobs (aeb5cb3)
shard coverage tests and skip docs-only suites (c736317)
shard coverage tests and skip docs-only suites (fa58082)

2.2.0 (2026-07-20)

Features

artifacts: project mobile application inventories (c6a1a93)
artifacts: project mobile application inventories (d36b385)
process: add bounded replay state machines (fea965b)
process: add bounded replay state machines (dc0c2e5)
process: compare repeatable paired experiments (e9899c0)
process: compare repeatable paired experiments (9ab7aa3)
streamline agent integration and MCP routing (02cb20b)
streamline agent integration and MCP routing (3e3d458)

Bug Fixes

align session filters and Hopper verification (d7d6bdf)
artifacts: align projection provider targets (560dbda)
artifacts: bound mobile projection candidates (0cc9d46)
ci: keep tool kind type internal (b9bead2)
ci: retry published package verification (0810486)
ci: retry published package verification (c379455)

Documentation

refresh generated API links (a2089a4)
update application projection API (b0cb28a)
update paired process experiment API (a222327)
update replay machine API (d74f897)

Tests

budget CLI output variant subprocesses (8d3587b)
cap workers across all hosts (bc80359)
inherit root options in Vitest projects (168100e)
isolate slow filesystem and CLI suites (c2e134b)
stabilize subprocess-heavy integration suites (a556e94)

2.1.0 (2026-07-18)

Features

add managed characterization and coverage closure (1943496)
add managed characterization and reconstruction coverage (02c913b)
cli: add explicit package-runner setup wizard (891a11f)
cli: improve setup onboarding (4851449)
cli: improve setup onboarding (16002ff)
cli: support package-name setup wizard (1b90e7f)
doctor: admit the Windows x64 Ghidra boundary (32dda0c)
dotnet: add BYO ILSpy oracle diagnostics (aa200ce)
ghidra: add authenticated Windows loopback transport (629ffc3)
ghidra: bind imports to admitted target bytes (be19c3f)
ghidra: define the Windows P0 admission boundary (6b1fd16)
ghidra: inspect Windows headless installations (86e44be)
ghidra: launch bounded Windows headless sessions (bc0fb45)
harden authority and runtime conformance boundaries (b537ebf)
javascript: add binding and constant-value semantic IR (3ea8523)
javascript: add binding and constant-value semantic IR (3d71bb5)
javascript: add webpack and rspack runtime adapters (7bccb7c)
javascript: add webpack and rspack runtime adapters (44c7017)
javascript: recover commonjs and esm module relationships (9766fc0)
javascript: recover commonjs and esm module relationships (6c41791)
permissions: add scoped process capture elicitation (e6cfce3)
skill: rename skill to reverse-engineer-anything (9356634)
target: classify Windows PE admission metadata (24274fe)
windows: define native authority boundary (a1a6b42)

Bug Fixes

build: preserve native generated-file line endings (00a3078)
ci: remove retired native rebuild steps (2d22731)
ci: validate packaged Windows CLI commands exactly (43418ee)
cli: require explicit setup selections (992ec50)
contracts: make agent-facing schemas self-describing (0df11dd)
dotnet: admit real CLI GUID and fat CIL bodies (735973b)
dotnet: correct CLI pointer and byref signatures (1387be0)
dotnet: correct CLI pointer and byref signatures (fb9ff56)
dotnet: downgrade truncated CIL identity and coverage (736a4e1)
dotnet: downgrade truncated CIL identity and coverage (dae6807)
electron: keep missing unpacked ASAR entries unavailable (fb6964a)
electron: resolve package and dirname entrypoints by context (4847fc4)
electron: resolve package and dirname entrypoints by context (1ac9a09)
ghidra: preserve native endpoint diagnostics (5970a71)
ghidra: preserve Windows batch invocation semantics (0ac418d)
ghidra: validate Windows control characters explicitly (4dccbec)
managed: emit valid x64 conformance PE (dcd94f1)
managed: emit valid x64 conformance PE (c52a822)
managed: preserve page incompleteness in graph and comparison (a6f02a0)
managed: preserve page incompleteness in graph and comparison (8ee0f04)
mcp: clarify advertised schema fields (1581e40)
npm: use latest entry points without install scripts (34252f5)
npm: use latest entry points, remove install scripts, and rename skill (bf85ee6)
preserve optional unknown filters (db1efef)
remove unused boundary exports (49f1ec1)
satisfy dead-code and generated-doc checks (b15a9ec)
setup: preserve onboarding after refactor (da48033)
skill: disclose retired skill cleanup (4c69e61)

Code Refactoring

adapters: split oversized provider workflows (1a99a60)
app: split session and CLI workflows (c6ee004)
domain: split analysis boundaries (e2c868c)
finish lint cleanup (2bea405)
managed: split metadata analysis (20c88dd)
setup: keep planner helpers private (2d1f961)
simplify authorization boundaries (2e5b443)
simplify doctor and error projections (37f4ac6)
skill: keep only the canonical skill identity (a7c1e87)
skill: remove legacy skill compatibility (8cf0dd2)
split oversized analysis workflows (af2399e)
split oversized analysis workflows (3e61a63)
windows: keep capability outcomes module-private (585f523)

Documentation

cli: describe every command input (d4be3e7)
ghidra: define the experimental Windows P0 (8b5ae41)
managed: align normalized CIL claims with shipped v1 semantics (9a92a79)
managed: align normalized CIL claims with shipped v1 semantics (3f788e9)
normalize inherited source paths (d33213a)
preserve generated source links (2ea375f)
prioritize agent usability in tool design (ad17fe7)
refresh Electron path resolution API (734a4ef)
refresh generated API reference (f5f653b)
regenerate managed coverage API with Node 24 (e47c00e)

Tests

add limit monotonicity and partial-evidence regressions (2cce98c)
add limit monotonicity and partial-evidence regressions (4afd970)
ci: guard Windows Ghidra workflow isolation (81ed68f)
ci: guard Windows Ghidra workflow isolation (98540c8)
cli: cover package-name binary alias (40e2f94)
hopper: add semantic runtime conformance (da1da3b)
package: align setup preflight contract (b33ebb1)

Continuous Integration

ghidra: add Windows P0 acceptance and real-engine lanes (0b35510)

2.0.0 (2026-07-16)

⚠ BREAKING CHANGES

mcp: require Evidence for managed reconstruction
mcp: comparison tools now require session-owned Evidence IDs or approved bundle paths, and structured Evidence results use compact references.

Features

application: add cross-layer graph workflows (778b995)
application: add isolated JavaScript replay (d86231a)
dotnet: add managed artifact triage (c251c38)
dotnet: add managed member comparison (55794d6)
dotnet: add managed member inspection (98cad37)
dotnet: add managed native boundary inspection (466b1bb)
dotnet: add managed runtime correlation planning (5f66cfd)
dotnet: import managed reconstructions (c506664)
dotnet: verify managed native boundaries (8cbc125)
electron: map static process and IPC boundaries (3fa2304)
electron: reconcile static artifacts with passive runtime (8c67dbd)
managed: project static evidence into application graph (6194c1a)
managed: project static evidence into application graph (77178bb)
mcp: harden contracts and evidence references (ee1cd40)
mcp: require Evidence for managed reconstruction (d36af5d)
setup: verify installed skill catalog identity (b2d1f2a)

Bug Fixes

deps: run freshness check from escaped paths (8a1c128)
mcp: align runtime unknown argument validation (d1e7220)
mcp: hide managed workflows without a session (412bbaf)
mcp: integrate managed contracts after rebase (9c4a93d)
mcp: normalize inferred field descriptions (a807471)
mcp: parse adapter inputs exactly once (37c0f39)
mcp: remove arbitrary schema byte gate (fd08025)
mcp: remove schema byte compaction (f728295)
package: accept expected doctor diagnostics (0f2d013)
test: make host fixtures portable (f23f529)

Code Refactoring

mcp: remove obsolete managed evidence parser (f7aa191)

Documentation

analysis: define managed-code evidence boundary (80faff3)
api: refresh managed reconstruction contracts (2b06433)
dotnet: refresh managed reconstruction api (cc1e47c)
refresh application workflow API links (4a30820)
refresh managed native verification api (849c052)
refresh managed runtime api docs (798631a)
refresh runtime reconciliation API (87b2348)
security: define controlled replay authority (461990d)
stabilize replay API source links (a8c1057)

Tests

dotnet: add managed conformance verifier (2b75fcf)
dotnet: verify managed app graph manifests (5be4051)
dotnet: verify managed app graph manifests (a5e5c68)
dotnet: verify managed app manifests (793a948)
hopper: avoid scheduler-sensitive exit timing (6e6827c)
mcp: cover strict compact wire contracts (8de25d0)
mcp: derive sessionless managed inventory (cab7c4a)
replay: use portable seam executables (3183f47)

1.7.0 (2026-07-15)

Features

artifact: reconstruct JavaScript application structure (aa46abf)
domain: add versioned JavaScript Application Graph (2ca5672)
ghidra: add function analysis and conformance (d8321de)
ghidra: add private headless provider session (f0e625d)
ghidra: implement read-only inventory operations (b1c07dd)
session: add explicit provider registry and target binding (941d710)

Bug Fixes

address setup, upgrade, and process test regressions (960d759)
address setup, upgrade, and process test regressions (02f12b9)
cli: make clean source checkouts start reliably (ed17e76)
cli: make clean source checkouts start reliably (6ba9765)
setup: replace managed Hopper on reinstall (0ca93f9)

Code Refactoring

domain: remove provider-specific target and snapshot state (21da71e)
process: extract reusable provider lifecycle primitives (70e1a0f)

Documentation

api: refresh profile source anchors (bd3cf96)
api: refresh provider source anchors (a7621c2)
architecture: define provider selection and analysis profiles (75f8696)
architecture: define provider selection and analysis profiles (f9f2fbe)
reconcile product documentation with shipped behavior (addc208)
reconcile product documentation with shipped behavior (54056a9)
refresh Ghidra inventory API links (a45de27)
regenerate JavaScript graph API with Node 24 (da4817a)

Tests

keep package setup verification read-only (acaf030)

1.6.0 (2026-07-14)

Features

add web and Electron reverse-engineering workflows (be76f80)

Bug Fixes

application: add explicit investigation replay (7112e1e)
application: add explicit investigation replay (a6b5ca4)
browser: keep page endpoint type internal (3743962)
browser: observe direct target disconnects (9be24f8)
browser: preserve operation-aware cancellation errors (0aac8aa)
browser: support page-scoped CDP transports (c4930f4)
browser: support page-scoped CDP transports (bf96192)
browser: support relative source map URLs (5231e95)
cli: confirm project grant revocation (6397e54)
cli: confirm project grant revocation (7a4cfb4)
cli: restrict production MCP dispatch (8bd0e5f)
cli: restrict production MCP dispatch (190e5d3)
doctor: honor explicit Hopper launcher (c69fe2c)
doctor: honor explicit Hopper launcher (9208592)
evidence: enforce the combined record limit (c791802)
evidence: enforce the combined record limit (834c70c)
hopper: cancel startup before closing (f471a63)
hopper: cancel startup before closing (6cc2fdf)
hopper: select verified Linux demo mode explicitly (46e4052)
hopper: select verified Linux demo mode explicitly (04c5fd6)
native: harden command capture edge cases (c2e64a4)
native: harden command capture edge cases (d39f98d)
preserve setup diagnostics and clean Knip config (2d1e021)
preserve setup diagnostics and clean Knip config (5a7ccef)
process: gate sampling on initialized PTY root (57938a8)
process: gate sampling on initialized PTY roots (e831a41)
process: keep validation detail internal (614a119)
process: restrict cleanup to captured group leaders (40c6f60)
process: settle exited zombie groups (072ce5a)
process: settle exited zombie groups (4828326)
process: stabilize and speed up the test suite (a3b7de9)
reference: preserve distinct parse failures (e02cb2f)
reference: preserve distinct parse failures (543510f)
rollup batch of fixes (b348b2c)
runtime: apply permission reloads atomically (49e843e)
runtime: apply permission reloads atomically (3ae7109)
runtime: serialize permission reloads (7e53dd6)
runtime: unregister shutdown handlers (71072d8)
runtime: unregister shutdown handlers (f9e3c23)
session: isolate availability observers (43766fd)
session: isolate availability observers (e5a80d4)
session: reopen replaced targets (e98413c)
session: reopen replaced targets (5c55999)
setup: configure every detected client (69744a4)
setup: configure every detected client (24f9a1f)
setup: omit aligned client configurations from plan (a86da4f)
setup: omit aligned skill from plan (d81687f)
setup: omit aligned skill from plan (2984fa7)
setup: preserve client config symlinks (85285f1)
setup: preserve client config symlinks (df87544)
test: adapt mainReload shutdown seam to registerShutdown signature (0a430c1)
tooling: isolate concurrent repository checks (fb17156)
tooling: isolate concurrent repository checks (ab8c5c1)
upgrade: prevent version downgrades (a204840)
upgrade: prevent version downgrades (1d1d234)
verify: reconcile PR-212/215/228 package E2E expectations (cfa110c)

Performance Improvements

application: scan version artifacts in parallel (528c05e)
application: scan version artifacts in parallel (c00739b)

Tests

application: verify packaged MCP replay (6601e0c)
browser: harden Chrome startup on CI (74c5121)
browser: route discovery sockets through proxy (e363f0e)
browser: verify page-scoped Chrome transport (c252536)
cli: verify packaged policy revocation (3d71737)
hopper: cover verified Linux rejection (db202c2)
hopper: retry after cancelled startup (6de726f)
hopper: verify alternate Linux launcher path (d93257b)
package: cover aligned setup plan (a597639)
package: cover config symlink lifecycle (d1ef7a5)
package: preserve unrelated symlink config (c50e51e)
reduce test suite runtime (2223da1)
reference: cover failure normalization (3d5041f)
runtime: cover idempotent handler cleanup (1bdb59e)
serialize subprocess-heavy integrations (f46fc7f)
session: reopen replaced target through MCP (1c32880)
setup: cover later clients after failure (8f73112)

1.5.0 (2026-07-14)

Features

add passive website reverse engineering (9986971)
add passive website reverse engineering (2c1ceab)

Bug Fixes

browser: drop disallowed redirect evidence (8481be9)
browser: scope CDP events and fail closed (5279d77)
browser: scope workers and binary frame sizes (dfc06cf)
harden PTY events and configured roots (ae8b1c5)
harden PTY events and configured roots (31b40f3)
permission: defer cache write grants (6a3fd5b)
permission: defer cache write grants (f840e70)
resolve triaged correctness issues (2575b30)
resolve triaged correctness issues (e8ed307)
resolve validation and artifact edge cases (2468682)
resolve validation and artifact edge cases (ef7f2f9)

Documentation

add Hopper screenshot to README (a699fdd)
add Hopper screenshot to README (08981a3)

Tests

cli: allow cold-start integration timing (7d5621d)

1.4.0 (2026-07-14)

Features

core: add typed policy and integrity contracts (190efca)
identity: derive MCP surface metadata (2722722)
mcp: expose progress resources and availability (da59299)
mcp: land policy, resources, and typed contracts (8f79ee7)

Bug Fixes

ci: keep generated error docs with their owner (3e60e38)
ci: preserve stacked integration changes (cf8e5cf)
cli: return nonzero status for operation failures (#121) (00c187e)
cli: return nonzero status for operation failures (#122) (964620a)
hopper: complete owned Linux shutdown (#116) (fb51874)
mcp: preserve migrated revisions and valid links (4149472)
preserve actionable artifact diagnostics (#119) (7385220)
workspace: migrate legacy integrity identities (d092d4c)

Tests

identity: defer live MCP integration proof (74db3fc)

1.3.0 (2026-07-13)

Features

add guided MCP workflow prompts (08d5b91)
add guided MCP workflow prompts (24c3adb)
add persistent cross-version investigation workspaces (c52eb46)
add persistent cross-version investigation workspaces (41366ed)
analysis: add provider-neutral persistent snapshots (c439b9e)
analysis: persist snapshots and close Hopper reliably (c6407ef)
errors: add caller-safe typed error projections (3be439c)
mcp: return structured typed tool results (eb38e4c)

Bug Fixes

bridge: bound regex search work (733a382)
bridge: bound regex search work (65682ee)
ci: remove unused setup type export (c5728af)
cli: render actionable analysis errors (af8c4ef)
copy: use agent terminology (12060f6)
errors: improve recovery guidance (77454dc)
errors: return actionable caller-safe failures (fb0da03)
hopper: cancel analysis and close documents reliably (179870e)
hopper: return addresses for procedure relationships (2c707ab)
linux: start Hopper demo sessions headlessly (32c5080)
linux: start Hopper demo sessions headlessly (75818d1)
security: restrict investigation artifact inputs (a2076b4)

Tests

linux: verify setup through CLI and MCP (67504d2)
package: preserve unsupported host verification (977119f)
strengthen MCP prompt acceptance coverage (05fb9b1)

1.2.0 (2026-07-13)

Features

artifacts: add approved native DMG traversal (24d000a)
process: add deterministic capture v3 (d0e21f9)
process: add deterministic capture v3 (5a361a6)
process: introduce evidence-safe capture v4 (ee4d284)

Bug Fixes

artifacts: diagnose unpacked ASAR integrity failures (a504342)
ci: remove redundant process exports (19bb231)
process: harden capture validation and cleanup (ac78de0)

Code Refactoring

artifacts: simplify inventory traversal (c8d762e)
setup: split setup and CLI registration (07e1b5a)

Documentation

document capture v4 and native mounts (aca518b)
document process capture v3 (50f4a29)
process: preserve capture invariants (841990b)
skill: document capture v4 and DMG mounts (f0a9a3c)

Tests

process: use deterministic hang fixture (ba15d16)

1.1.0 (2026-07-13)

Features

setup: make installation explicit and safe (29d92ca)
setup: make installation explicit and safe (3793889)

Bug Fixes

preserve requested evidence paths on macOS (0c0e2b8)
preserve requested evidence paths on macOS (3d0ad79)

Documentation

api: regenerate TypeDoc reference (0a66cae)
define REA contributor priorities (5df4ef6)
explain the installation workflow (1c83263)

1.0.0 (2026-07-13)

⚠ BREAKING CHANGES

contracts: batch_decompile, get_call_graph, and find_xrefs_to_name now return structured discriminated output shapes.

Features

cli: add self-upgrade command (c004220)
cli: add self-upgrade command (0d77a9f)

Bug Fixes

contracts: keep error schema internal (ac8cc66)
contracts: return structured workflow failures (4c54ff6)
native: classify pre-aborted analysis first (dfd598f)

Documentation

list upgrade in CLI reference (8a24088)

0.5.0 (2026-07-13)

Features

analysis: harden agent workflows and evidence boundaries (883db91)
cli: align terminal workflows with MCP (b1912b1)

Bug Fixes

analysis: accept valid final dossier pages (7c36f36)
bridge: harden bounded Hopper boundaries (f8e8ea3)
cli: preserve function provider provenance (c630f41)
lifecycle: validate owned Hopper process identity (898d6b0)
process: default capture networking to loopback (bce3398)
process: keep network approval fail-closed (9526389)

Code Refactoring

cli: share direct analysis tool types (329fdf6)

Documentation

correct pull request tool inventory (d806480)
document CLI safety and provider evaluation (efc9bd2)

Tests

docs: keep localized claims and tool counts aligned (a7b84a9)
verification: strengthen conformance and real-Hopper checks (0d36976)

0.4.0 (2026-07-12)

Features

add cross-platform installation lifecycle (cc6a955)
add cross-platform installation lifecycle (e651cb6)

Documentation

document installation and Linux support (034563a)
simplify REA onboarding (e1dfe86)
simplify REA onboarding (d85b661)

Tests

add package installation end-to-end coverage (993356b)
stabilize artifact pagination coverage (f56bdde)

Continuous Integration

enforce conventional pull request titles (07a0b98)
enforce conventional pull request titles (3a21f16)
verify installed package with Linux Hopper (4f97f69)

0.3.0 (2026-07-12)

Features

add evidence-backed process investigations (cc8681a)
cli: add guided local onboarding (8ca3db8)
evolve REA analysis platform (4f18e26)
identity: rename package and CLI to REA (3d70812)
mcp: add typed bounded analysis tools (893d2e2)
session: add dynamic binary lifecycle (f32e718)

Bug Fixes

boundaries: reject unsafe local inputs (15e8cf3)
doctor: require an executable Hopper launcher (aee9cb8)
hopper: launch analysis without stealing focus (ff321dc)
hopper: make loader selection non-interactive (2b7ef86)
keep execution options internal (167a824)
setup: persist detected Hopper launcher (b2866e4)
setup: preserve consent and startup target kind (a67054f)
setup: preserve invalid MCP configuration (88f5edc)
targets: cancel startup and probe PE offsets (66b8d6e)
verify: tolerate exited Hopper helpers (b167bd7)

Code Refactoring

cli: share runtime between CLI and MCP (97541d8)

Documentation

document frictionless binary workflow (ee6d539)
document the 43-tool workflow (1f235cb)
record runtime and release constraints (62ede51)
redesign and localize README (051b6db)
redesign and localize README (910eda6)

Tests

add source-built Hopper conformance fixtures (d648bcd)

0.2.1 (2026-07-12)

Documentation

redesign and localize README (051b6db)
redesign and localize README (910eda6)

0.2.0 (2026-07-12)

Features

cli: add guided local onboarding (8ca3db8)
identity: rename package and CLI to REA (3d70812)
session: add dynamic binary lifecycle (f32e718)

Bug Fixes

boundaries: reject unsafe local inputs (15e8cf3)
doctor: require an executable Hopper launcher (aee9cb8)
hopper: launch analysis without stealing focus (ff321dc)
hopper: make loader selection non-interactive (2b7ef86)
setup: persist detected Hopper launcher (b2866e4)
setup: preserve consent and startup target kind (a67054f)
setup: preserve invalid MCP configuration (88f5edc)
targets: cancel startup and probe PE offsets (66b8d6e)
verify: tolerate exited Hopper helpers (b167bd7)

Code Refactoring

cli: share runtime between CLI and MCP (97541d8)

Documentation

document frictionless binary workflow (ee6d539)
record runtime and release constraints (62ede51)

177 KiB Raw Blame History

Changelog

5.0.0 (2026-10-07)

⚠ BREAKING CHANGES

Features

Bug Fixes

Performance Improvements

Code Refactoring

Documentation

Tests

Continuous Integration

4.1.0 (2026-10-06)

Features

Bug Fixes

Code Refactoring

Documentation

Tests

4.0.1 (2026-10-05)

Bug Fixes

4.0.0 (2026-10-05)

⚠ BREAKING CHANGES

Features

Bug Fixes

Code Refactoring

Documentation

Tests

3.2.1 (2026-10-03)

Bug Fixes

Tests

3.2.0 (2026-10-03)

Features

Bug Fixes

Code Refactoring

Documentation

Tests

3.1.0 (2026-08-09)

Features

Bug Fixes

Code Refactoring

Documentation

3.0.0 (2026-08-01)

⚠ BREAKING CHANGES

Features

Bug Fixes

Code Refactoring

Documentation

Tests

Continuous Integration

2.7.0 (2026-07-28)

Features

Bug Fixes

2.6.0 (2026-07-26)

Features

Bug Fixes

Performance Improvements

Tests

2.5.1 (2026-07-25)

Bug Fixes

Performance Improvements

2.5.0 (2026-07-24)

Features

Bug Fixes

Performance Improvements

Code Refactoring

Documentation

Tests

Continuous Integration

2.4.0 (2026-07-23)

Features

Bug Fixes

2.3.0 (2026-07-23)

Features

Bug Fixes

Code Refactoring

Documentation

Tests

Continuous Integration

2.2.0 (2026-07-20)

Features

Bug Fixes

177 KiB

Raw Blame History