morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[PR #1533] [MERGED] feat(wasm): inspect local artifacts with WABT #2951

New issue
Closed
opened 2026-10-17 21:12:11 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-17 21:12:11 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1533
Author: @thangldw
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: codex/inspect-wasm-wabt

📝 Commits (3)

  • c3f5766 feat(wasm): inspect local artifacts with WABT
  • f34747b fix(wasm): preserve custom names and failed cleanup ownership
  • 25520cf chore: merge main into WABT artifact inspection

📊 Changes

46 files changed (+2309 additions, -7 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+6 -1)
📝 README.md (+1 -0)
📝 docs/testing.md (+22 -0)
➕ docs/wasm-artifacts.md (+71 -0)
📝 package.json (+3 -0)
📝 scripts/lib/catalog-builders.mjs (+5 -0)
📝 scripts/lib/catalog-core.mjs (+2 -0)
📝 scripts/lib/module-boundaries.mjs (+1 -0)
➕ scripts/verify-packaged-wasm-artifact.mjs (+57 -0)
➕ scripts/verify-wasm-artifact.mjs (+313 -0)
📝 src/application/CapabilityInventory.ts (+9 -0)
➕ src/application/wasm/WasmArtifactPort.ts (+17 -0)
➕ src/application/wasm/WasmArtifactService.test.ts (+79 -0)
➕ src/application/wasm/WasmArtifactService.ts (+100 -0)
📝 src/artifacts/MachOSliceArtifactReader.ts (+1 -1)
📝 src/cli.ts (+2 -0)
➕ src/cli/wasmCommands.ts (+60 -0)
📝 src/cliCommandNames.ts (+1 -0)
➕ src/composition/wasm.ts (+7 -0)
📝 src/contracts/toolContracts.ts (+2 -0)

...and 26 more files

📄 Description

Summary

Fixes #884.

Add inspect-wasm-artifact / inspect_wasm_artifact for explicitly selected local WebAssembly files using caller-supplied WABT 1.0.42. CLI and MCP return identical Evidence with selected artifact and executable digests, validation, section ranges, exact upstream import/export WAT forms, decoded WAT and optional JavaScript glue candidate associations.

Problem and expected behavior

REA previously had no target-free WABT workflow for inspecting a saved website's WASM artifact. Operators should be able to inspect selected bytes, correlate static glue literals with explicit local candidates and read the same Evidence back through MCP, while preserving URL/path ambiguity and the distinction between decoded WAT, original source and runtime behavior.

Change and scope

  • Add a narrow WasmArtifactPort, shared input/output validation service and composition for the optional WABT adapter.
  • Admit the exact 1.0.42 upstream profile, retaining release/source commit, resolved executable paths, SHA-256, version banners and arguments. Use maintained wasm-validate, wasm-objdump and wasm2wat; no WASM binary parser or target interpreter is introduced.
  • Inspect stable selected bytes in a private read-only snapshot; recheck its digest before and after commands. Reuse owned subprocess cancellation, deadlines, output bounds and cleanup. Invalid/truncated modules retain upstream diagnostics and partial Evidence identifying the failed selected bytes.
  • Preserve full objdump output and extract exact top-level WABT WAT import/export forms. This avoids guessing identities from unescaped human-readable objdump names containing dots or newlines.
  • Reuse the existing Babel parser/traversal for selected glue literals. Preserve exact source coordinates, file identity, local path candidates, ambiguous URL/basename matches and unresolved references.
  • Add separate conditional real-tool and packaged-artifact verification lanes, public text fixtures, provenance and operator documentation.

Contract and boundary impact

  • Semantic owner and earliest changed stage: WABT producer admission/output adapters own tool protocol parsing; the application service owns caller validation and CLI/MCP Evidence construction.
  • CLI and MCP/tool-catalog contract: additive command/tool, strict input/output schemas, effect metadata, optional capability availability and provider/catalog registration. No active binary target is required.
  • Provider, bridge, target-format, or platform compatibility: caller-supplied WABT 1.0.42 tools selected by absolute REA_WABT_BIN_DIRECTORY; unsupported/missing profiles return actionable unavailable outcomes. Other providers are unchanged.
  • Evidence, artifact, provenance, or reconstruction contract: selected byte/tool identities, complete producer text/WAT and failure diagnostics are retained; static candidate associations do not prove runtime loading or URL-to-file identity.
  • Process execution, authorization, cleanup, or containment impact: trusted caller-supplied tool execution through existing owned-process supervision; 30-second per-command deadlines and 32 MiB combined output budgets. Cleanup uncertainty is an error. No target execution, implicit fetch, tool installation or OS memory sandbox claim.
  • Generated metadata, package, or installation impact: authored skill version 36, generated package metadata, catalog source registration and packaged WABT provenance README. Ignored catalogs/build outputs and binaries are not committed; no runtime dependency is added.

Evidence and regression coverage

  • Tests added or updated: producer framing and escaped WAT names; glue ambiguity; provider cancellation/deadline propagation, malformed output, snapshot mutation and cleanup uncertainty; application identity validation; actual MCP SDK schemas and session recording. Register the new adapter tests in the existing Vitest project.

  • Base reproduction or other evidence: #884 describes the missing integration; real WABT generates and validates the source-owned fixtures before inspection.

  • User-visible CLI/MCP output: the custom-section fixture reports 76 selected bytes, SHA-256 fc147439b4861e92c2f3f203818dd7a05a0b3c31c76c4096c85fe8dc2b5743c8, a test custom section, decoded @custom "test" "payload", and exact escaped import/export forms. Invalid/truncated inputs return typed errors with captured upstream diagnostics and partial Evidence.

  • Remaining proof gaps: real-tool execution was verified on macOS arm64 with the official release archive digest checked. Linux/Windows need their own real-tool verification; dynamic/computed JS data flow and runtime behavior remain unproven.

  • Observed, derived, and inferred claims remain distinguishable.

  • Artifact identity, source provenance, and failed attempts remain preserved.

  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run check — passed typecheck, lint, formatting, knip, metadata and architecture guards; lint has warnings and no errors.
  • npm run docs:check — passed generated catalog/skill/error metadata and documentation checks.
  • Focused contract, capability, WASM service/adapter, MCP SDK and owned-command tests — 83 passed, 3 existing platform-dependent skips across 11 files.
  • npm run verify:test-discovery — all 729 test files discovered exactly once.
  • REA_WABT_BIN_DIRECTORY=... npm run verify:wasm:artifact -- --require-tools — 18 real CLI/MCP cases passed, including exact output, Evidence IDs/readback, invalid/truncated bytes, custom sections and escaped names; verified empty remaining verifier descendants.
  • REA_WABT_BIN_DIRECTORY=... npm run verify:wasm:package — the same 18 real cases passed against a freshly packed package installed into an isolated temporary prefix with lifecycle scripts disabled.
  • npm run verify:package — general packaging, installed CLI/MCP, schemas/catalog, Evidence, skill and startup checks passed.
  • npm run jscpd, npm run scan:todos, git diff --check — passed.
  • Conditional real-tool invocation without configuration — explicit skip; the required-tools mode refuses missing configuration.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; this is an additive optional capability.
  • Real Hopper/Ghidra, browser, or OS coverage: those providers are not involved; real WABT verified on macOS arm64.
  • Package or release metadata impact: skill metadata increments; package release version remains unchanged. No WABT executables are bundled.
  • Security, privacy, process, or containment review: only caller-selected local files are inspected. Fixture binaries, temporary workspaces, downloaded verification tools and private data remain untracked. Caller-supplied executable hashes identify bytes, not publisher authenticity; there is no OS sandbox guarantee.

Review checklist

  • This PR addresses a concrete problem or an agreed enhancement.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1533 **Author:** [@thangldw](https://github.com/thangldw) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/inspect-wasm-wabt` --- ### 📝 Commits (3) - [`c3f5766`](https://github.com/morluto/rea/commit/c3f5766a89fb45f86a876375ae1c62b90fb04113) feat(wasm): inspect local artifacts with WABT - [`f34747b`](https://github.com/morluto/rea/commit/f34747be2e9c56d079484fb131f9d67471cc542f) fix(wasm): preserve custom names and failed cleanup ownership - [`25520cf`](https://github.com/morluto/rea/commit/25520cfda839445e959fd9ef400da2a335f6fedc) chore: merge main into WABT artifact inspection ### 📊 Changes **46 files changed** (+2309 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+6 -1) 📝 `README.md` (+1 -0) 📝 `docs/testing.md` (+22 -0) ➕ `docs/wasm-artifacts.md` (+71 -0) 📝 `package.json` (+3 -0) 📝 `scripts/lib/catalog-builders.mjs` (+5 -0) 📝 `scripts/lib/catalog-core.mjs` (+2 -0) 📝 `scripts/lib/module-boundaries.mjs` (+1 -0) ➕ `scripts/verify-packaged-wasm-artifact.mjs` (+57 -0) ➕ `scripts/verify-wasm-artifact.mjs` (+313 -0) 📝 `src/application/CapabilityInventory.ts` (+9 -0) ➕ `src/application/wasm/WasmArtifactPort.ts` (+17 -0) ➕ `src/application/wasm/WasmArtifactService.test.ts` (+79 -0) ➕ `src/application/wasm/WasmArtifactService.ts` (+100 -0) 📝 `src/artifacts/MachOSliceArtifactReader.ts` (+1 -1) 📝 `src/cli.ts` (+2 -0) ➕ `src/cli/wasmCommands.ts` (+60 -0) 📝 `src/cliCommandNames.ts` (+1 -0) ➕ `src/composition/wasm.ts` (+7 -0) 📝 `src/contracts/toolContracts.ts` (+2 -0) _...and 26 more files_ </details> ### 📄 Description ## Summary Fixes #884. Add `inspect-wasm-artifact` / `inspect_wasm_artifact` for explicitly selected local WebAssembly files using caller-supplied WABT 1.0.42. CLI and MCP return identical Evidence with selected artifact and executable digests, validation, section ranges, exact upstream import/export WAT forms, decoded WAT and optional JavaScript glue candidate associations. ## Problem and expected behavior REA previously had no target-free WABT workflow for inspecting a saved website's WASM artifact. Operators should be able to inspect selected bytes, correlate static glue literals with explicit local candidates and read the same Evidence back through MCP, while preserving URL/path ambiguity and the distinction between decoded WAT, original source and runtime behavior. ## Change and scope - Add a narrow `WasmArtifactPort`, shared input/output validation service and composition for the optional WABT adapter. - Admit the exact 1.0.42 upstream profile, retaining release/source commit, resolved executable paths, SHA-256, version banners and arguments. Use maintained `wasm-validate`, `wasm-objdump` and `wasm2wat`; no WASM binary parser or target interpreter is introduced. - Inspect stable selected bytes in a private read-only snapshot; recheck its digest before and after commands. Reuse owned subprocess cancellation, deadlines, output bounds and cleanup. Invalid/truncated modules retain upstream diagnostics and partial Evidence identifying the failed selected bytes. - Preserve full objdump output and extract exact top-level WABT WAT import/export forms. This avoids guessing identities from unescaped human-readable objdump names containing dots or newlines. - Reuse the existing Babel parser/traversal for selected glue literals. Preserve exact source coordinates, file identity, local path candidates, ambiguous URL/basename matches and unresolved references. - Add separate conditional real-tool and packaged-artifact verification lanes, public text fixtures, provenance and operator documentation. ## Contract and boundary impact - Semantic owner and earliest changed stage: WABT producer admission/output adapters own tool protocol parsing; the application service owns caller validation and CLI/MCP Evidence construction. - CLI and MCP/tool-catalog contract: additive command/tool, strict input/output schemas, effect metadata, optional capability availability and provider/catalog registration. No active binary target is required. - Provider, bridge, target-format, or platform compatibility: caller-supplied WABT 1.0.42 tools selected by absolute `REA_WABT_BIN_DIRECTORY`; unsupported/missing profiles return actionable unavailable outcomes. Other providers are unchanged. - Evidence, artifact, provenance, or reconstruction contract: selected byte/tool identities, complete producer text/WAT and failure diagnostics are retained; static candidate associations do not prove runtime loading or URL-to-file identity. - Process execution, authorization, cleanup, or containment impact: trusted caller-supplied tool execution through existing owned-process supervision; 30-second per-command deadlines and 32 MiB combined output budgets. Cleanup uncertainty is an error. No target execution, implicit fetch, tool installation or OS memory sandbox claim. - Generated metadata, package, or installation impact: authored skill version 36, generated package metadata, catalog source registration and packaged WABT provenance README. Ignored catalogs/build outputs and binaries are not committed; no runtime dependency is added. ## Evidence and regression coverage - Tests added or updated: producer framing and escaped WAT names; glue ambiguity; provider cancellation/deadline propagation, malformed output, snapshot mutation and cleanup uncertainty; application identity validation; actual MCP SDK schemas and session recording. Register the new adapter tests in the existing Vitest project. - Base reproduction or other evidence: #884 describes the missing integration; real WABT generates and validates the source-owned fixtures before inspection. - User-visible CLI/MCP output: the custom-section fixture reports 76 selected bytes, SHA-256 `fc147439b4861e92c2f3f203818dd7a05a0b3c31c76c4096c85fe8dc2b5743c8`, a `test` custom section, decoded `@custom "test" "payload"`, and exact escaped import/export forms. Invalid/truncated inputs return typed errors with captured upstream diagnostics and partial Evidence. - Remaining proof gaps: real-tool execution was verified on macOS arm64 with the official release archive digest checked. Linux/Windows need their own real-tool verification; dynamic/computed JS data flow and runtime behavior remain unproven. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check` — passed typecheck, lint, formatting, knip, metadata and architecture guards; lint has warnings and no errors. - `npm run docs:check` — passed generated catalog/skill/error metadata and documentation checks. - Focused contract, capability, WASM service/adapter, MCP SDK and owned-command tests — 83 passed, 3 existing platform-dependent skips across 11 files. - `npm run verify:test-discovery` — all 729 test files discovered exactly once. - `REA_WABT_BIN_DIRECTORY=... npm run verify:wasm:artifact -- --require-tools` — 18 real CLI/MCP cases passed, including exact output, Evidence IDs/readback, invalid/truncated bytes, custom sections and escaped names; verified empty remaining verifier descendants. - `REA_WABT_BIN_DIRECTORY=... npm run verify:wasm:package` — the same 18 real cases passed against a freshly packed package installed into an isolated temporary prefix with lifecycle scripts disabled. - `npm run verify:package` — general packaging, installed CLI/MCP, schemas/catalog, Evidence, skill and startup checks passed. - `npm run jscpd`, `npm run scan:todos`, `git diff --check` — passed. - Conditional real-tool invocation without configuration — explicit skip; the required-tools mode refuses missing configuration. ## Compatibility, safety, and release - Breaking changes or migration steps: none; this is an additive optional capability. - Real Hopper/Ghidra, browser, or OS coverage: those providers are not involved; real WABT verified on macOS arm64. - Package or release metadata impact: skill metadata increments; package release version remains unchanged. No WABT executables are bundled. - Security, privacy, process, or containment review: only caller-selected local files are inspected. Fixture binaries, temporary workspaces, downloaded verification tools and private data remain untracked. Caller-supplied executable hashes identify bytes, not publisher authenticity; there is no OS sandbox guarantee. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-17 21:12:11 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#2951
No description provided.