[github-actions]

🤖 I have created a release beep boop

6.4.0 (2026-10-11)

Highlights

• Android: added device inspection, split-APK acquisition, logs, screenshots, file transfers and explicit app lifecycle actions through ADB, plus manifest and localized-string decoding with Apktool. (#1552, #1556) Thanks @3QL.
• JEB: browse project units and decompile selected items through a caller-started local JEB MCP server. (#1536) Thanks @3QL.
• Large analyses: discover retained Evidence without loading every payload, and inspect JavaScript graphs, binary layouts and function dossiers through summaries and selected views. (#1682, #1568, #1570, #1345, #1507, #1247) Thanks @jhuang-tw, @kaoru0822-kitauji, @N0zoM1z0.
• JavaScript: isolate source analysis in an owned process with configurable heap and timeout limits; retain completed facts and explicit unknowns when analysis runs out of resources. (#1651, #1563, #1565) Thanks @N0zoM1z0, @peter-research.
• Ghidra: configure import language/compiler specifications and seed functions, code and labels before auto-analysis. (#1667) Thanks @sqmagellan.
• RPC discovery: recognize supported tRPC calls, HTTP-link URLs and named GraphQL operations in JavaScript applications and web bundles. (#1670) Thanks @pompiliodonatoapp.

Changes

• Added Ghidra support for Windows PE DLLs and bounded MIPS ELF analysis, including carved MIPS inputs with incomplete section tables. Windows P0 remains read-only. (#1303, #1362, #1629, #1290, #718, #1619) Thanks @bqw371, @jaelliot, @kvalls, @N0zoM1z0.
• Enabled set_address_name and set_addresses_names for Ghidra sessions with mutation authority, including namespace-aware data labels and per-address batch results. (#1635, #1634) Thanks @giri256.
• Recovered additional signed AArch64 relative jump-table patterns. (#1592) Thanks @RishTheFish21.
• Added PE resource inspection and read-only NativeAOT metadata parsing for supported x64 PE32+/.NET 8 RTR 9.1 inputs. The NativeAOT parser’s Windows-host Ghidra workflow remains unverified on a real Windows host. (#1482, 76d8f68, #1254) Thanks @N0zoM1z0, @thangldw.
• Added Pi, Hermes and Qwen Code setup, including Hermes active-profile support. (#1376, #1403, #1415, #1409) Thanks @rasatpetabit, @yiliang114, @zaydiscold.
• Added REA_MCP_INPUT_SCHEMA_PROFILE=compact for size-capped MCP clients such as Kimi/Moonshot, while retaining canonical runtime validation. (#1514, #1580, #1484, #1581) Thanks @haythemsellami, @N0zoM1z0.
• Added live process-capture progress and optional finalization_ms to capture shutdown output before timeout escalation; cancellation remains immediate. (#1483, #1583, #1252, #1253, modelcontextprotocol/typescript-sdk#2997) Thanks @N0zoM1z0, @nikolay-dementiev, @sathariels.
• Improved Codex onboarding and recovery from observed client, PATH and provider blockers. (#1613) Thanks @N0zoM1z0.
• Reduced redirected JSON and terminal output size, and deferred heavy imports until their commands need them. (#1413, #1450, #1439, 21dbcf7) Thanks @kaoru0822-kitauji.

Fixes

• Electron analysis: follow renamed and default-imported APIs and optional calls, ignore overwritten identities and media preload attributes, and resolve packaged app.asar pages and unpacked companions. (#1391, #1393, #1400, #1664, #1673) Thanks @kaoru0822-kitauji, @marnixpluim, @N0zoM1z0, @suninrain086.
• JavaScript data flow: preserve returned/yielded reference uncertainty, invalidate property-stored aliases correctly, and retain bundled-module runtime scope. (#1437, #1445, #1471, #1577, #1428, #1442, #1449, #1576) Thanks @CassieFox23, @dakjdakd, @N0zoM1z0.
• JavaScript packages: resolve exact exports subpaths, preserve trailing-slash directory requests and exact CommonJS keys, and respect shadowed require bindings. (#1424, #1615, 5485483, 8b2f851, f998fcb, 1e51c73, #1365) Thanks @akshitkhokhani, @AWUQAQ, @immanuwell, @rudycelekli.
• Large JavaScript inputs: handle oversized inline source maps, deep returns and reassignment loops; avoid argument expansion limits and yield during large analysis passes. (#1386, #1368, #1390, #1539, #1525, #1542, #1545, #1557, #1380, #1401, #1538, #1462) Thanks @cold-atom, @KadirJeager, @kaoru0822-kitauji, @marnixpluim, @N0zoM1z0, @rudycelekli.
• JavaScript receivers: expand escaped methods once, index returned-object targets, and avoid replaying earlier writes or duplicating retained graph allocations. (#1517, #1537, #1444, #1601, #1495) Thanks @CassieFox23, @geekwolf, @kaoru0822-kitauji, @N0zoM1z0, @zeynelacikgoez.
• Browser captures: retain WebSocket URLs, empty connections and frame order; compare only common known payload coverage and preserve incomplete WebMCP replay coverage. (db4e360, aa257ea, e52c0a7)
• Browser scenarios: seed storage in the correct partition, normalize loopback attach identities, retain declared-secret redaction and require verified lineage before Windows Electron signals. (#1604, #1590, #1588, 8b4c3de, #1497, #1591, #1589) Thanks @Adolanium, @akushonkamen, @dakjdakd.
• Added Termux Android browser-scenario support. (#1655) Thanks @tyloryang.
• Web inputs: accept BOM-prefixed HAR, preserve the first duplicate DOM attribute and resolve SVG/XLink URLs in HTML and XHTML. (#1509, #1516, #1602, #1683, #1496, #1586) Thanks @CassieFox23, @kaoru0822-kitauji, @sathariels, @taljeri.
• Screenshot comparisons: validate PNG chunks, distinguish corruption from unsupported encodings and bound comparison memory. (4e4b15b, b3e977e) Thanks @rudycelekli.
• Archives: preserve case-distinct names, report collisions at their diverging segment, detect nested formats from bytes and reject Windows alternate-stream extraction paths. (#1480, #1505, #1553, 573598c, #1470, #1491) Thanks @CassieFox23, @kaoru0822-kitauji.
• Cleanup: retain failed readers, ASAR handles, output trees and provider workers for retry without discarding completed output or partial observations. (ffe0574, de0d341, 3f8c51e, d1235fa, 026126e)
• Providers: canonicalize IDA workspace roots before identity checks, respect IDA cancellation, serialize JEB acquisition and correct Ghidra no-return/imported-symbol recovery. (#1481, #1419, 5f30ea6, f88c990, 49e6f00) Thanks @AS9929, @JonahSimon, @Y0UW1SH.
• Binary metadata: respect PE/.NET section extents, bound binary-plist expansion, scope keyed-archive traversal and decode app Info.plist files without plutil. (#1678, #1515, #1378, #1476, 975dff2, 76296c5) Thanks @jayhemnani9910, @kaoru0822-kitauji, @rudycelekli.
• Windows runtimes: preserve drive-root paths when creating private provider directories. (ee46323)
• Compatibility: load Windows native controls under Node-API hosts with renamed executables, preserve dylib directory requirements, support Wakaru 1.x and reject directory-valued Hopper launchers. (#1531, #1623, #1540, #1426) Thanks @evenafterallisaid, @Fazmin, @pionxzh, @xeropresence.
• Reference imports: normalize internal symlink lookup consistently, preserve exact paths and exclusion provenance, report root access failures and reject FIFO replacements without blocking. (#1535, 2ca3ad2, 6636045, 3967cfa, f1c58cc) Thanks @anujsingh-cse.
• Setup: honor active configuration and skill roots, preserve configured MCP environments, validate Hermes/OMP profiles before writing, recognize Omarchy and retain recovery backups. (#1504, #1607, #1528, #1562, #1662, a011485, #1606, #1521, #1561) Thanks @Adkid-Zephyr, @CassieFox23, @LuisTaffelli, @N0zoM1z0, @peter-research.
• Process capture: retain descendant lineage after launcher exit, preserve identity uncertainty before signaling and release terminals after observation failures. (80896a1, c916850) Thanks @Y0UW1SH.
• CLI/MCP errors: accept JSON files for web comparisons, preserve native option help and union correction details, remove invalid aliases and validate doctor against its discovered output contract. (#1397, #1395, #1425, #1461, 8b4c96e, #1421, #1454) Thanks @Fazmin, @kaoru0822-kitauji, @N0zoM1z0.

⚠ BREAKING CHANGES

• WebSocket results: use network.websocket_connections instead of network.websocket_events. Connections contain request_id, url and events; allow payload_bytes: null when size is unknown. No legacy alias remains. (db4e360)
• Direct resource APIs: pass a caller-owned ArtifactResourceScope to inventory/extraction, JavaScript analysis, reference imports and web exports; retain it through cleanup/shutdown. For readJavaScriptArtifactFiles, scope is argument three and abort signal is argument four. Keep each root inventory source’s single cleanup owner. Use OwnedFileHandle owners, injected ASAR fd/read handles instead of createReadStream, VCS Result values, and WebScriptExportError’s options object. CLI/MCP inputs for the scoped operations are unchanged. (ffe0574, 53e7fad, 684199b, be75ed5, be6272f, e0e49e9, 95a77b6)
• Saved reference graphs: exclusions require their matching pattern and distinguish project-ignored from default-ignored. Re-import graphs missing that provenance. (6585293)
• Terminal captures: keep initial and resized buffers within 1,000,000 cells using columns × (rows + scrollback); oversized scenarios are rejected before launch. (f9ea9a9)
• Optional agent-verification reports: accept schema version 4, nullable expectedFirstTool and targetClarificationPassed. Production CLI/MCP contracts are unchanged. (#1613)
• Capture comparisons: recapture both sides with matching literal-replacements-v1 semantics when custom normalization patterns are used. Legacy unversioned pattern captures remain readable but cannot be compared with new pattern captures; captures without patterns are unaffected. (#1456, 2b6f14f) Thanks @Madhavan006, @N0zoM1z0.
• Artifact graph edges: read child artifact IDs and paths from the occurrence selected by occurrence_id, not edge fields child_artifact_id/logical_path. Earlier inventory Evidence no longer validates against the new commitment. (#1493) Thanks @kaoru0822-kitauji.
• Semantic graph schema: nodes and relations no longer include identifier_strategy, and relation IDs no longer hash it. Earlier Evidence no longer validates against this schema. (#1474) Thanks @kaoru0822-kitauji.
• Semantic identities: select IDs from the parent graph; read exact event names from event_name, endpoints from endpoint and literal values from properties.value. New analyses use digest-based IDs for long/reserved event and endpoint names and value-sha256 literal role keys, with shorter labels; string literal labels now read string literal. Previously stored graphs retain their original IDs and remain valid workflow inputs. (#1427, #1423, #1407) Thanks @N0zoM1z0.

Contributors

• Thanks also to @BaaRai, @commit-regrets, @coygeek, @Franky100-pig, @inii-sayaa, @jopemachine, @JosephDemarest, @keemsisi, @Totopo27 for contributions included in this release.

Full contribution record: 336 commits and 163 merged PRs.

This PR was generated with Release Please. See documentation.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[github-actions]

🤖 Created releases:

• rea-agents-6.4.0

🌻

[m5moshbk]

أضفه