morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[GH-ISSUE #5653] [Tracker] New issue intake by area (October 2026) #3423

New issue
Open
opened 2026-10-31 00:40:12 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-31 00:40:12 +00:00
Owner
Copy link

Originally created by @CassieFox23 on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5653

Type: Tracker Status: Active Ecosystem: REA

TL;DR: This lists 458 open issues opened since 18 October, sorted into six areas. 22 of them came in the last day. Maintainers can sort them faster. Duplicates are tracked in #4330 (matbrgz). This list only points at it.

What's here

New issues are arriving fast. Many came in the last day. That makes the queue hard to scan. This list gathers them in one place, by area. The list is built from what is open on GitHub. The maintainers' labels win. Bugs by subsystem live in #3537. Duplicates in clusters live in #4330.

Last refreshed: 10:29 PM UTC on 2 November 2026.

New issues by area

Each box below is an open issue opened since 18 October 2026. Tick a box when it is done, closed, or answered. Nothing here asks for speed.

The six areas are the ones used in #3537. An assistant sorted each title into one area, so a few may sit in the wrong one.

A tag after a line means one of three things. (in #4330, canonical #N) says matbrgz's list already holds the issue and names the report it keeps. (possible dup of #N, not yet in #4330) says a check found a similar issue that list lacks. It may be wrong. (Refs on main SHA) says a commit on main names this issue with Refs. That does not always mean the issue is fixed. Closing anything is your call or morluto's.

Evidence, Artifacts, Firmware & Reconstruction (71)
  • #4948 recover_javascript_sources is Linux-x64-gated even though Wakaru ships a native darwin-arm64 build
  • #4972 [Feature] Add semantic-equivalence verification for reconstructed native code
  • #4987 [Feature] Let analyze-javascript-application select sources by folder or glob
  • #5117 [Design] Provider-neutral batch export for native machine evidence
  • #5150 [Feature] Expose Constant-table default values for literal fields and parameters in inspect_managed_members
  • #5168 [Bug] e_lfanew inside the DOS header (Tiny PE) is refused before provider admission
  • #5185 Feature Request: Support Analysis of MQL5 .ex5 Expert Advisors Loaded by terminal64.exe (in #4330, canonical #3569)
  • #5229 [Bug] One unreadable entry fails directory analysis, and inventory omissions leave the application graph complete
  • #5489 [Feature] Add a dry-run plan for artifact extraction (in #4330, canonical #5481)
  • #5900 fix(firmware): reclassify output-directory admission failures as invalid_request
  • #6166 [Bug] capture_browser_scenario reports cleanup_incomplete and drops Evidence after all actions completed
  • #6211 [Design] Add read-only PostgreSQL inspection
  • #6328 [Feature] C28x/C2000 support
  • #6337 [Feature] Add a verifiable manifest for exported analysis bundles
  • #6338 [Feature] Add a focused comparison report for two compatible analysis runs
  • #6408 [Feature] Inspect MFC CRuntimeClass metadata in PE binaries and link each serializable class to its Serialize(CArchive&) function
  • #7189 [Feature] Static library-function identification (FLIRT-like) for native targets
  • #7198 [Bug] Library identification enforces resource budgets after parsing oversized input
  • #7226 [Bug] identify_flutter_build reports dart_version null on release engines
  • #7235 [Feature] Decode FDO packaging and dlopen metadata in inspect-elf-notes
  • #7244 [Feature] Project expected JNI/JNA symbol names and structural attack-surface facts from Android declarations
  • #7265 [Feature] Accept original Xbox XBE executables and route them to provider loaders
  • #7303 [Bug] compare_wasm_interfaces does not say which Evidence argument it rejected
  • #7304 [Bug] Artifact reconstruction can pass when comparison rows record a change
  • #7362 [Bug] Opening a directory .app bundle whose executable is a name-classified artifact fails since c27560e43
  • #7371 [Bug] Process comparison accepts conflicting final filesystem snapshots and reports unchanged
  • #7377 [Bug] inspect-keyed-archive accepts an empty target and reads the working-directory bundle
  • #7383 [Bug] find_changed_behavior reports an imported process contradiction as observed unchanged
  • #7384 [Bug] find_changed_behavior reports observed equality for a comparison with unknown divergence
  • #7389 [Bug] inspect-native-exports accepts a populated ELF .dynsym without its null symbol
  • #7397 [Bug] binary_session misclassifies unsupported navigation targets as missing providers
  • #7399 [Bug] binary_session advertises default address context queries for unsupported artifact targets
  • #7400 [Bug] TLS template ranges in section zero padding abort PE load-config inspection
  • #7403 [Bug] PE resources and certificates classify a DOS MZ target as an invalid request
  • #7406 [Bug] extract-artifact and three artifact inspections select the working directory for an empty target
  • #7424 [Bug] Desktop inspection succeeds for a path whose intermediate component is a regular file
  • #7461 [Feature] Evidence-backed firmware update comparison with component-level change attribution
  • #7565 [Bug] Built verification summaries return 404 for their JSON evidence links
  • #7566 [Bug] Verification page's worker link still returns 404 after its fix was claimed
  • #7612 [Bug] Devicetree retained-reference example spells the Evidence prefix as ev:
  • #7689 [Bug] Apple IPS inspection omits unknown key names inside thread, frame and image rows
  • #7874 [Feature] Inspect Python wheel distributions as structured, read-only Evidence
  • #7955 [Roadmap] Embedded firmware: make REA work on the devices around us
  • #8097 [Feature] Inspect ONNX Runtime .ort models (ORTM FlatBuffers) in inspect_model_artifact
  • #8116 [Bug] Legacy Mach-O rebase decoder does not wrap its cursor at 64 bits, losing slots after a backward ULEB step
  • #8143 [Feature] Import Linux perf.data recordings as read-only profiling Evidence
  • #8144 [Feature] Inspect NuGet .nupkg packages and dependency metadata as read-only Evidence
  • #8173 [Design] Use independent symbol evidence to match functions when a provider omits origins
  • #8206 [Feature] Support Python 3.14 and 3.15 bytecode in inspect_python_pyc
  • #8234 [Feature] Deterministic row paging for inspect_sqlite_database selected tables
  • #8292 [Feature] Consider moving from binwalk to binwalk-ng
  • #8302 [Bug] Compact Mach-O catalog omits slice-relative offset semantics
  • #8375 [Design] Make Unknown history direction explicit in bundle comparisons
  • #8407 [Bug] decode-interface-builder omits a nib with an empty DOCTYPE internal subset as aggregate decode budget exhaustion
  • #8409 [Bug] Unsupported Evidence view suggests changing target format
  • #8410 [Bug] extract-artifact takes 40-49 s for the Node.js release zip on Windows (plain extraction: 1.7 s)
  • #8425 [Bug] Evidence retention refusal discards a completed direct observation
  • #8427 [Design] Recover inline unretained Evidence into a new investigation
  • #8455 [Bug] Large retained Evidence link sets overflow closure traversal
  • #8507 [Bug] Firmware capability recovery recommends the wrong alternative engine
  • #8545 [Bug] Large inventories overflow bulk appends in verification and directory traversal
  • #8546 [Design] Make residual-unknown target scope explicit for Evidence handoffs
  • #8551 [Bug] Virtual directory identities overwrite matching raw file nodes
  • #8590 [Design] Make one-shot trace source availability discoverable
  • #8623 [Bug] Valid Zstandard ZIP window-limit refusal is reported as corrupt input
  • #8655 [Design] Recover historical Evidence from an incompatible analysis snapshot
  • #8661 [Bug] OpenStep quoted escapes make existing app executables appear missing
  • #8665 [Feature] IL2CPP binary_path: Unity WebGL wasm32 CodeGenModule → function index
  • #8685 [Bug] iNES change-detection test failed with truncated-payload refusal in Linux CI
  • #8702 [Feature] Reconstruct GraphQL schemas and operation contracts from retained artifacts
  • #8709 [Bug] inspect-binary-layout rejects ARM64 (EM_AARCH64) ELF targets, pwntools-elf provider appears x64-only
Ghidra, Hopper, IDA & Native Decompilation (170)
  • #4943 [Enhancement] Add XEX support (possible dup of #3118, not yet in #4330)
  • #5032 procedure_pseudo_code output for one large function is too big to return
  • #5038 [Feature] IDA provider: declare read_bytes with faithful loaded-byte semantics
  • #5198 Would you accept borer as a native analysis provider?
  • #5225 [Windows x64] rea inspect --provider ghidra fails snapshot admission with Win32 5 (EACCES) in an AppContainer process; succeeds from an ordinary shell (in #4330, canonical #289)
  • #5243 Windows Ghidra P0: no path for ELF/arm64 targets (e.g. Android libapp.so) (in #4330, canonical #2338)
  • #5245 [Bug] 6.7.0 flags previously working extracted Hopper demo as unsupported_hopper_build (in #4330, canonical)
  • #5271 feat(ghidra): run long analyses as background jobs with bounded waits
  • #5315 inspect_macho analysis of a 151 MB single-slice binary does not complete
  • #5339 [Feature] Change how an address is listed in a Ghidra session: code, function, data, string, or undefined
  • #5344 [Feature] Resolve Objective-C __cfstring literals to the code that uses them
  • #5400 [Feature] Avoid repeated Ghidra startup logs in input-error replies
  • #5424 [Bug] Dispatch-metadata symbol fallback turns Ghidra pointer/string labels into fake Objective-C classes and misses every class the binary defines (in #4330, canonical #4368)
  • #5523 [Feature] inspect_native_api: report whether a function is variadic
  • #5657 [Design] Classic console ROM targets on Windows (raw image with an installed Ghidra language, or a named Ghidra loader)
  • #5709 [Feature] Nintendo 3DS static analysis through Ghidra and a reusable verification workflow
  • #5744 [Feature] Analyze Thumb-only Cortex-M firmware in the raw-binary lane instead of refusing its entry point and decoding it as ARM state
  • #5820 [Feature] Provider-neutral V-CPU interpreter structure analysis
  • #5829 [Bug] Attached IDA analysis omits UI effects from tool discovery
  • #5930 [Bug] batch_decompile accepts unbounded address arrays
  • #6197 Ghidra provider ignores adjacent PDB companions for Windows PE targets (no symbol names without manual workaround)
  • #6305 Add Motorola 6809 raw-binary support to the Ghidra provider
  • #6404 [Feature] Ghidra: admit comment / inline_comment / set_comment / set_inline_comment at any mapped address
  • #6405 [Feature] Ghidra: export analyst names and comments from a session and re-apply them when the target is reopened
  • #6407 [Design] Ranked, non-binding counterpart candidates for unmatched functions in match_native_functions
  • #6746 [Feature] Ghidra profile for PS2 Emotion Engine (R5900) executables
  • #7018 [Docs] macOS needs Ghidra buildNatives; doctor remediation should say so
  • #7075 Windows: Ghidra provider fails to start - LaunchSupport cannot write java_home.save (access denied)
  • #7077 Linux Hopper setup fails for current vendor release: fixed 120 s download deadline exceeded and feed main_exe_hash does not match the published launcher
  • #7121 [Bug] Windows Ghidra lane refuses DOS MZ (16-bit real mode) targets and cannot open an existing Ghidra project
  • #7142 [Feature] Unicorn-backed function-level emulation provider (building block for #4972)
  • #7374 [Bug] External functions prevent decompile_all from stopping after repeated output I/O failures
  • #7381 [Feature] Ghidra provider: support universal (fat) Mach-O by selecting a slice instead of refusing
  • #7477 [Design] Admit RISC-V ilp32 and ilp32f ELF in the Ghidra lane with a per-ABI calling-convention policy
  • #7590 [Design] Admit Intel MCS-96 (80C196) raw-binary targets in the Ghidra lane
  • #7954 [Bug] Investigate Hopper bootstrap Python script execution failure
  • #7957 [Feature] Look-up of similar endavours before commencing decomp
  • #7993 [Feature] add MIPS support
  • #8023 [Bug] A GDB console command whose output is one MI line over 16 MiB ends the session with no way to detach, kill or close it
  • #8024 [Bug] After a Rizin debug session is stopped by its frame limit, later commands return a generic invalid-input error and status gives no reason
  • #8067 [Bug] verify-real-hopper asserts complete relationship coverage that the Hopper provider always reports as unknown
  • #8068 [Design] Make Ghidra decompile coordinate intent explicit for unresolved canonical hex selectors
  • #8085 [Bug] A repeated rea decompile with the same --snapshot runs Ghidra again instead of replaying
  • #8138 [Bug] Hopper 6.6.1 Fedora RPM launcher still mismatches the feed main_exe_hash; deb launcher matches (REA 6.8.0)
  • #8139 [Feature] Consider IDASQL as an additional IDA backend
  • #8165 [Design] Preserve and reopen owned Ghidra analysis with a packed-program checkpoint
  • #8166 [Design] Allow analyst assertions in Kuna decompilation with explicit provenance
  • #8167 [Feature] Recover individual Kuna decompiles that fail in a completed project export
  • #8169 [Bug] Ghidra project digest mismatch is hidden behind generic provider startup failure
  • #8170 [Feature] Investigate verified byte reads for Kuna-backed investigations
  • #8171 [Bug] Ghidra verifier drops the discovered JDK when JAVA_HOME is unset
  • #8172 [Bug] Ghidra verification sends function Evidence beyond the default MCP input allowance
  • #8175 [Design] Consider Kuna support for caller-described raw binaries
  • #8176 [Design] Report verified Kuna export progress when supported
  • #8177 [Design] Investigate Kuna decompilation inside a Ghidra analysis session
  • #8178 [Design] Disambiguate analysis addresses from file offsets in decompilation
  • #8181 [Design] Distinguish a missing batch decompilation selection from an empty batch
  • #8183 [Design] Recover function references when the provider lacks a general name inventory
  • #8184 [Design] Make feature-trace reference coverage explicit for agents
  • #8185 [Design] Make native metadata recovery discoverable when class-label inventory is unavailable
  • #8186 [Design] Make decoded Swift declarations discoverable when procedure categories are unknown
  • #8190 [Design] Investigate partial outgoing data-reference evidence for Kuna functions
  • #8191 [Bug] Bulk export labels Rust-like Kuna pseudocode as C and omits representation metadata
  • #8192 [Design] Analyze analyst-selected function entries absent from provider inventories
  • #8193 [Design] Analyze an explicitly selected universal Mach-O slice with Kuna
  • #8194 [Design] Investigate evidence-backed algorithm-constant discovery and references
  • #8195 [Design] Evaluate a bounded RISC-V ELF investigation lane for Kuna
  • #8197 [Design] Trace UI actions through separately evidenced tail transfers and thunks
  • #8198 [Bug] UI trace pairs Objective-C handler addresses with method-record file offsets
  • #8200 [Design] Preserve call-site and indirect-call context in call-path workflows
  • #8203 [Bug] open_binary with automatic provider selection succeeds, but later calls return target_unavailable
  • #8208 [Design] Make missing-function recovery aware of selected Ghidra projects
  • #8209 [Design] Export a bounded explicit or graph-derived set of native functions
  • #8210 [Design] Clarify ARM-state raw entry errors when Thumb may be intended
  • #8212 [Design] Define Kuna cache publication when a session is cancelled
  • #8215 [Design] Surface relevant analysis-profile differences in function comparisons
  • #8217 [Bug] Changed Ghidra project loses its actionable error during provider launch
  • #8218 [Design] Find short or encoded markers outside provider string inventories
  • #8219 [Design] Link native API boundary types to inspectable type identities
  • #8221 [Design] Connect imported calls to explicitly selected library evidence
  • #8223 [Design] Make lost Ghidra session edits visible after cancellation
  • #8224 [Bug] Bit-field type IDs cannot be inspected or linked to their base type
  • #8225 [Bug] Existing MIPS Ghidra projects fail with a misleading profile mismatch
  • #8232 [Design] Compare selected Ghidra project memory with bounded original bytes
  • #8233 [Bug] Byte-search coverage labels loaded overlays as not loaded
  • #8235 [Bug] Paged native call graphs order depth 10 before depth 2
  • #8236 [Design] Allow caller-bounded native call graph investigation
  • #8239 [Design] Explain individual failures in compact batch naming
  • #8240 [Design] Find the defined data object containing an address
  • #8241 [Design] Resolve a byte-search hit to its containing instruction
  • #8242 [Docs] Explain Ghidra CLI annotation lifetime in command help
  • #8243 [Design] Reuse the refreshed annotation dossier as a function observation
  • #8245 [Design] Expose loaded and metadata provenance for string matches
  • #8257 [Bug] Ghidra loader-created ELF entry labels are treated as exact source symbols
  • #8260 [Design] Preserve per-function producer provenance across decompile export resume
  • #8276 [Bug] Unavailable load-image collections report zero-total empty page coverage
  • #8277 [Bug] Resolved Ghidra indirect reference can yield a definite negative call path
  • #8282 [Bug] Cached native value traces cite source Evidence absent from exported bundles
  • #8284 [Bug] Native value trace reports missing parameter bindings for a known zero-argument function
  • #8288 [Design] Preserve feature-trace evidence when reference ownership is unavailable
  • #8289 [Design] Surface ephemeral annotation loss when switching analysis providers
  • #8314 [Design] Preserve local-variable source and identity in Ghidra function observations
  • #8315 [Bug] Ghidra project edit refusal hides read-only mode behind generic target advice
  • #8316 [Design] Isolate invalid Ghidra project configuration from unrelated MCP tools
  • #8317 [Design] Make unverified Kuna release guidance discoverable to MCP callers
  • #8319 [Design] Define Kuna cache identity for caller-configured launchers
  • #8328 [Design] Recover procedure lookup using independent export evidence
  • #8333 [Design] Preserve IFUNC resolver semantics when investigating exported APIs
  • #8336 [Design] Clarify or represent direct memory varnodes in native value-flow effects
  • #8344 [Design] Discover candidates before selecting an existing Ghidra program
  • #8348 [Design] Make incoming reference evidence actionable with Kuna
  • #8350 [Bug] Successful batch decompiles lose per-item provider provenance
  • #8351 [Bug] Decompile resume drops the top-level unknown-body limitation
  • #8352 [Bug] Kuna rejects a reported call destination as definite Mach-O data
  • #8355 [Bug] Decompile directory omits source inventory limitations
  • #8358 [Bug] Native value trace does not locate recovered call arguments without bindings
  • #8360 [Design] Investigate explicit non-mutating decode of an alternate instruction stream
  • #8362 [Bug] Kuna call paths can report complete negative despite omitted direct calls
  • #8363 [Bug] Ghidra address context hides available function comments and suggests unsupported calls
  • #8364 [Design] Preserve contributing evidence for address-context handoffs
  • #8365 [Design] Clarify live metadata across Ghidra byte-search pages
  • #8366 [Bug] Byte-search cursor mismatch hides project profile and suggests schema repair
  • #8367 [Bug] Comparing the same Kuna function Evidence reports ambiguous identity
  • #8370 [Design] Expose active provider command cleanup in session status
  • #8372 [Design] Correlate native addresses across provider coordinate contexts
  • #8373 [Design] Bound delivery of large native feature traces and their unknowns
  • #8374 [Bug] Ghidra searches drop provider facts from string and procedure inventory rows
  • #8378 [Bug] Ghidra startup fails at the macOS Unix socket path boundary
  • #8380 [Bug] Ghidra snapshot verifier expects retained Evidence to disappear
  • #8383 [Bug] Ghidra backward call paths can overstate caller completeness
  • #8390 [Bug] Incomplete selected Ghidra project can produce complete call-path negatives
  • #8393 [Design] Compare function observations within one selected Ghidra project
  • #8396 [Bug] Kuna xref name errors direct data lookups to procedure search
  • #8405 [Design] Report omitted caller targets in the real Kuna verifier
  • #8408 [Design] Connect indirect call investigations to Mach-O slot bindings
  • #8415 [Bug] Address context hides rejected address and document details
  • #8421 [Bug] Address context gives misleading recovery when Evidence capacity is exhausted
  • #8428 [Bug] Unavailable address navigation hides usable instruction alternatives
  • #8435 [Bug] Crash prompt overlooks retained dossier handoff for call paths
  • #8449 [Bug] Native Evidence views accept incompatible predicates
  • #8452 [Design] Clarify authority of native matching Evidence views
  • #8459 [Design] Recognize repeated Kuna observations without discarding graph provenance
  • #8460 [Design] Distinguish function correspondence from analysis metadata changes
  • #8461 [Bug] Ghidra RISC-V lanes lose DWARF and no-return facts for ESP-IDF flash code
  • #8463 [Design] Admit ESP32-P4 ELF that declares Espressif vendor extensions, and report what Ghidra cannot decode
  • #8471 [Design] Distinguish local value flow from call-resolution availability
  • #8472 [Feature] Gadget search over analyzed instruction inventories (ROPgadget-shaped, evidence-carrying)
  • #8476 [Bug] Native value trace omits an external thunk target and its unknown flow
  • #8478 [Bug] Kuna ambiguous procedure names suggest schema repair
  • #8510 [Bug] Kuna 1.988 stored-pointer references disappear from xrefs and feature traces
  • #8534 [Bug] Ghidra snapshot verifier expects obsolete profile-mismatch wording
  • #8549 [Bug] Evidence summary suggests unsupported analysis view for xrefs
  • #8554 [Bug] Socket resource analysis misclassifies unary arguments
  • #8556 [Design] Preserve byte-observation limitations in function matching
  • #8560 [Design] Bound Ghidra byte-read allocation before response construction
  • #8563 [Feature] Investigate byte signatures across adjacent Ghidra blocks
  • #8569 [Design] Find references to a selected data range
  • #8577 test(ghidra): correct regex failure guidance verifier
  • #8579 fix(ghidra): preserve nested project selection in failure recovery
  • #8580 fix(ghidra): explain read-only project annotation refusal
  • #8583 fix(ghidra): clarify interior selectors before function annotation
  • #8587 [Design] Page retained native procedure-reference observations
  • #8593 [Design] Page retained native instruction references
  • #8595 [Bug] Frida verifier cleanup fixture copies its dependency to the wrong path
  • #8607 [Bug] Byte search labels loaded overlays as not loaded
  • #8642 [Bug] Rizin debug session close fails when the target reads stdin, because it inherits the command stream
  • #8683 [Design] Make Kuna automatic analysis mode and its limits visible
  • #8686 [Bug] Kuna timeout recovery suggests changing jobs without a relevant phase or quality tradeoff
  • #8690 [Bug] Kuna verification updates reject snapshots from the same executable
  • #8696 [Design] Inspect explicitly selected code outside provider inventory
CLI, MCP Protocol & Agent Integration (129)
  • #5062 [Feature] Ship REA as a Claude Code plugin (one-step MCP + skill install)
  • #5244 [Bug] Bundled skill v42 documents MCP tools absent from npm 6.7.0 server
  • #5272 feat(mcp): hold several Ghidra targets open concurrently in one server
  • #5273 [Bug] MCP tool calls backgrounded by the client after 120 s fail with "missing required resultType" (protocol 2026-07-28) (Refs on main 4eaf3a117, merge of #5371)
  • #5306 [Bug] observe_native_ui treats a wrong PID or window as provider unavailability and withdraws the tool in binary_session
  • #5476 [Feature] Support authenticated access for non-loopback MCP HTTP deployments
  • #5490 [Feature] Add manifest-driven batch mode for independent offline artifact inspections (in #4330, canonical #5481)
  • #5512 [Bug] Pinned mcp__claude__ prefix in a Claude Code fork hides REA from the model while doctor stays green
  • #5808 [Design] Audit recovery controls for remaining provider timeouts and limits
  • #5861 [Bug] Default tools/list schema profile is ~813 KB (~259K tokens); compact cuts it to ~196 KB but is off by default and still ~29% of a 227K context
  • #6176 [Enhancement] Make hard-coded admission ceilings configurable with documented defaults
  • #6332 [Feature] Export supported analysis findings as SARIF 2.1.0
  • #6333 [Feature] Add auditable suppression rules for reviewed analysis findings
  • #6334 [Feature] Add opt-in redaction profiles for shareable analysis reports
  • #6336 [Feature] Define stable identities for correlating compatible findings across runs
  • #6339 [Testing] Add contract tests for public machine-readable analysis outputs
  • #6344 [Bug] analyze-web-bundle fatally exhausts the CLI heap (4 GiB and 12 GiB) on a 173 KB react-dom chunk instead of returning a typed resource_constraint
  • #6870 Advertise a stable family for each tool in tools/list metadata, and document that DeepSeek Harness does not lazy-load
  • #6919 [Feature] Include existing static artifact routes in feature-investigation guidance
  • #7093 [Bug] environment-serve accepts an empty or non-decimal --port and serves on another port
  • #7123 [Bug] Advertised input schema normalization and literal constraint checks skip contentSchema and array-valued tuple items
  • #7138 [Docs] CLI JSON request arguments do not document reading standard input with -
  • #7143 Linux process-ownership cleanup fails when /proc//environ is unreadable across user namespaces (EACCES)
  • #7155 MCP tools/list is 3.16 MB - outputSchema is 74.5% of it`
  • #7181 [Feature] Discover project-scoped MCP registrations in doctor and uninstall (pi, OpenCode)
  • #7193 [Feature] Investigation-loop construct for agent-driven deep dives (loop engineering)
  • #7271 [Bug] evidence-import --token-count --full-output undercounts TOON and YAML
  • #7276 [Bug] inspect-native-data-type reports target_unavailable for an invalid selector
  • #7279 [Bug] inspect-byte-entropy cleanup names provider rea-byte-entropy
  • #7280 [Bug] decompile-all accepts an empty target and exports the working directory
  • #7281 [Bug] capture-process final snapshot fails when its scratch directory is removed
  • #7286 [Bug] DSH configuration edits silently discard later YAML documents
  • #7306 [Bug] Several CLI option help lines print the same default twice
  • #7310 [Bug] binary_session advertises inspect_address_context before a target is open
  • #7312 [Bug] GGUF accepts 33 nested array frames while advertising a maximum of 32
  • #7315 [Bug] Empty strings block at the reservation boundary rejects a valid DTB
  • #7316 [Bug] Closed-session discovery falsely requires a target for inspect_apk_signature
  • #7323 [Bug] Application analysis resolves an unbound require as CommonJS inside a type-module package
  • #7324 [Bug] Kernel-module guide describes the 28-byte trailer magic as 27 bytes
  • #7327 [Bug] MCP provenance documentation lists two exceptions although both settings tools are also exempt
  • #7330 [Bug] Record-order validation incorrectly reports noncanonical manifests
  • #7344 [Bug] Purge deletes a nested caller-selected Kuna cache after reporting it retained
  • #7346 [Bug] MCP HTTP startup recommends changing the port for a host lookup failure
  • #7347 [Bug] ASAR inspection limit errors omit the parsed required header size
  • #7352 [Bug] Rust inspection describes the inflate ratio using stored section size
  • #7369 [Bug] Owned commands return success when their deadline expires during final cleanup
  • #7372 [Bug] MCP doctor writes non-JSON stdout for tool-family scopes without prompts
  • #7375 [Bug] mcp add writes client configuration despite an unexpected positional argument
  • #7376 [Bug] Byte-entropy CLI accepts empty and non-decimal window options
  • #7388 [Bug] prefix-variance input guidance omits its 32-segment comparison limit
  • #7405 [Bug] docs/index.md repeats the native-inspection task with inconsistent guide lists
  • #7415 [Bug] compare-web-captures classifies an ambiguous retained step ID as absent
  • #7420 [Bug] Runtime-settings guide incorrectly says setup omits the response-byte budget
  • #7437 [Bug] Five MCP tools advertise relative paths that their handlers reject
  • #7438 [Bug] MCP doctor labels a skipped identity probe as a missing package and catalog
  • #7440 [Bug] search --format md hides allowed enum values in rendered argument errors
  • #7441 [Bug] demangle-swift --json indents argument errors on piped and redirected stdout
  • #7442 [Bug] analyze --snapshot replaces specific schema diagnostics with a constant failure reason
  • #7445 [Bug] Retroactive Swift conformance flag suppresses a readable static witness slot
  • #7448 [Bug] observe-native-calls launches the working app when its target is empty
  • #7459 [Docs] jadx-headless-mcp dependency name collides with an unrelated public npm/GitHub project
  • #7467 [Docs] Clarify coordination for overlapping fixes while a PR awaits review
  • #7478 [Design] One owner each for target-format and architecture vocabularies
  • #7501 [Bug] analyze_swift_types files members of private nested types under the enclosing type's category
  • #7503 [Bug] Exclusive input bounds are reported as the inclusive minimum or maximum
  • #7510 [Bug] analyze-javascript-application never completes on a 20 MB Expo Router web bundle, even with semantic limits at 1
  • #7522 [Bug] Automatic setup selects Grok Bot even though its connector requires manual registration
  • #7534 [Bug] Package inspection reports a digit prefix as the exact version for an attached-letter token
  • #7535 [Bug] Amp registration writes global settings despite --no-global
  • #7537 [Bug] inspect_byte_entropy omits its absolute-path requirement from the MCP request schema
  • #7540 [Bug] Invalid dry-run values let approved setup write client configuration
  • #7541 [Bug] Native call observation reports complete coverage after omitting the 65th breakpoint location
  • #7551 [Bug] Linked-worktree imports hash Git administration files into source identities
  • #7559 [Bug] A later scalar property assignment makes an earlier destructuring dependency ambiguous
  • #7561 [Bug] doctor accepts an empty --target and passes target readiness for cwd
  • #7569 [Bug] Relative Wireshark tool refusals drop the supplied path value
  • #7570 [Bug] Native UI commands hide the reason both capture sources are refused
  • #7571 [Bug] Environment bundle commands create directories before refusing a trailing ..
  • #7595 [Bug] WABT relative-directory error omits the supplied selection
  • #7601 [Bug] Root and command help omit the documented global --json switch
  • #7608 [Bug] mcp add ignores undeclared flags and applies registration
  • #7609 [Bug] MCP registration ignores missing values for --agent and --command
  • #7610 [Bug] MCP registration mixes human messages into --json stdout
  • #7616 [Bug] Testing guide undercounts Linux lanes consuming the shared build artifact
  • #7617 [Bug] SQLite guide describes a Node 24.15.0 CI lane absent from the workflow
  • #7621 [Bug] environment-compare does not disclose when a step's difference list is truncated
  • #7628 [Bug] Native export byte-limit recovery describes the limit as a count
  • #7634 [Bug] Marker-only filenames become empty ordered list items in rendered Markdown
  • #7636 [Bug] Overlong historical capture paths receive provider-failure classification
  • #7650 [Bug] Client configuration reference omits Cursor, Windsurf, and Command Code MCP entries
  • #7651 [Bug] Dispatch metadata loses the unsupported-width reason when its symbol fallback fails
  • #7654 [Bug] Translated setup guides omit the MCP output-profile option
  • #7669 [Bug] Kernel-module guide omits the unsupported status for compressed this_module sections
  • #7670 [Bug] Kernel-module guide lists a trailer-truncation reason no admitted ELF can produce
  • #7680 [Docs] 6.8.0 release notes advertise MMIO attribution that was removed before release
  • #7687 [Bug] Target listing claims all HTTP(S) pages are listed while reporting a transport exclusion
  • #7688 [Bug] Environment bundle CLI classifies a regular-file parent as a host write failure
  • #7691 [Bug] Unknown MCP subcommands emit TOON after selecting JSON or Markdown
  • #7692 [Bug] Grok Bot setup reveals its required manual connector step only after interactive approval
  • #7693 [Bug] Setup announces cache preparation without resolving a direct-launcher skip
  • #7695 [Bug] Retained analysis-view guidance omits working view families and selectors
  • #8032 [Bug] Process capture reports cleanup_outcome "not_required" after its cleanup killed a detached descendant
  • #8049 [Bug] CLI dispatcher exits with status 0 on cleanup failure when exit callback receives undefined code
  • #8084 [Design] Skill: keep per-target guidance out of SKILL.md, in condition-named reference pages
  • #8141 [Bug] CLI observe-web-session emits no armed progress, so a caller cannot tell when to perform the action
  • #8162 [Design] Raw raster rendering to PNG through CLI and MCP
  • #8204 [Bug] compare-process-captures reports changed when comparing two captures of the same deterministic run
  • #8205 [Docs] trace_application_feature seed kinds are not described in the MCP tool schema
  • #8254 docs: REA_MCP_TOOL_FAMILIES is documented as current behaviour, but published 6.8.0 does not contain it
  • #8285 [Bug] trace-native-values CLI cannot save the source Evidence it cites
  • #8304 [Bug] Validating MCP clients reject search_guidance and read_guidance_section results over stdio
  • #8321 [Design] Make static call-path investigation available to CLI users
  • #8388 [Design] Make scoped MCP native workflows discoverable without the full catalog
  • #8398 [Design] Give capture_process_scenario a prepare-only mode so the preparation prompt can suggest a non-executing call
  • #8399 [Design] Let non-idempotent tools take a caller-supplied idempotency key so a dropped-connection retry cannot run the target twice
  • #8402 [Design] Connect unbound tool recovery to provider selection reasons
  • #8403 [Bug] Unbound session reports stale provider readiness after repair
  • #8433 [Design] Clarify inline analysis view parent ownership and session handoff
  • #8448 [Design] Clarify CLI Evidence import versus MCP session retention
  • #8453 [Bug] File validation diagnostics can overflow the MCP response
  • #8508 [Bug] EVM limiter configuration failures expose internal codes as recovery guidance
  • #8555 [Bug] Go verifier can remove its fixture root before MCP ownership completes
  • #8559 [Bug] Native UI verifier can lose fixture ownership before the ready handshake
  • #8561 [Bug] Signal verifier can release its fixture root before MCP cleanup completes
  • #8562 [Bug] Recorded-crash verifier can release fixtures after cleanup failures
  • #8564 [Bug] WABT artifact verifier releases both roots after MCP cleanup fails
  • #8565 [Design] Guide recovery from unsupported provider operations
  • #8657 [Bug] Scoped direct tools suggest disabled open_binary for a missing target
  • #8682 [Design] Preserve investigation records in scoped MCP connections
Browser, Electron & Web Captures (43)
  • #4973 [Bug] compare_web_captures / compare_web_screenshots fail in Claude ("problem with that connector")
  • #5266 [Bug] Browser scenario start waits for load with no deadline when the page navigates away before load
  • #5300 [Feature] Model webContents.ipc and the non-BrowserWindow window constructors in Electron static analysis
  • #5360 [Feature] Wake or classify discarded CDP page targets so restored sessions stay inspectable
  • #5421 [Bug] Popup startup misses declared storage seeds while capture reports complete (in #4330, canonical #5420)
  • #6127 analyze-javascript-application exhausts a 6 GiB worker heap on a 233 KB file
  • #6168 [Feature] Declared permission grants and synthetic camera/microphone for capture_browser_scenario
  • #6191 [Feature] Resolve this property accesses in constructors, prototype methods and class methods
  • #6192 [Feature] Model objects assigned to properties after declaration
  • #6311 analyze_javascript_application hangs at parse_javascript_source on 664KB single-line ESM UMD (@castleio/castle-js)
  • #7038 [Feature] Read Hermes bytecode bundles: header, integrity, function and string tables
  • #7132 [Bug] trace_web_source_location reports an out-of-range generated_position as invalid_format without bounds
  • #7167 capture_browser_scenario fails with browser.mode="connect"; same scenario with mode="launch" works
  • #7170 analyze-javascript-application: semantic phase never completes on a 6.5 MB minified Electron main.js (3 timeouts, incl. reduced semantic limits)
  • #7212 Explain ASAR integrity mismatches caused by signing unpacked addons after packing
  • #7227 [Bug] Module-level webPreferences constants are reported as dynamic when the window is created inside a function
  • #7251 [Docs] Agent skill: passive SPA capture defaults to the page origin; route agents to allowed_origins and completeness.excluded
  • #7253 [Bug] 6.8.0 regression: the 512-reference alias bound in canonicalWebpackInteropBindings drops Electron windows and IPC handlers in a real Webpack app (Bitwarden)
  • #7410 [Bug] Redirected request steps omit the promised Location from network evidence
  • #7740 [Feature] Keep literal call arguments on call sites, such as the name in client.rpc("name")
  • #7742 [Feature] recover_javascript_sources on Windows x64
  • #7763 [Bug] capture_browser_scenario: a response with HTTP status above 599 throws a ZodError in a Playwright event handler and ends the MCP server
  • #7774 [Design] Bound per-binding member-write records in JavaScript semantic analysis
  • #7787 [Bug] analyze-javascript-application does not write --evidence_output when a source reaches its deadline; partial Evidence goes inline to stdout
  • #7873 [Feature] Import saved Playwright trace.zip recordings as offline Evidence
  • #8033 analyze-javascript-application: deterministic hang on ~490-byte ESM input (parse phase); --analysis-timeout-ms inconsistently enforced
  • #8078 [Feature] Accept mitmproxy 12.3.x in the native mitmproxy capture adapter
  • #8126 [Bug] Reconciliation reports every V8 Inspector Node target as unmatched although its entry file is in the static layer
  • #8201 [Bug] Electron graph reports 0 IPC channels and 0 BrowserWindows on a real Rolldown bundle (Signal Desktop 8.33.0)
  • #8207 [Feature] Flag custom credential headers in network capture inspection, and export a HAR from browser scenarios
  • #8294 analyze_javascript_application exhausts its 1 GiB worker heap on react-dom 18.3.1 production build (132 KB) while three.module.js (1.3 MB) completes in 14 s
  • #8298 analyze-javascript-application stalls at javascript_worker_static on a 222 KB Vite + React 19 production bundle (Windows)
  • #8312 [Bug] Windows Chrome CDP: inspect-web-page times out at Page.enable after successful target discovery
  • #8334 [Docs] Put WASM interface comparison under the WASM guidance section
  • #8411 [Bug] analyze-javascript-application on GitHub Desktop 3.6.5 fails at the final Evidence checkpoint and keeps nothing
  • #8422 [Feature] Inventory browser Cache Storage entries as read-only web Evidence
  • #8423 [Feature] Capture WebAuthn/passkey ceremony metadata without retaining credential secrets
  • #8543 [Feature] Format-native inspector for V8 code cache (.jsc / bytenode artifacts)
  • #8544 [Bug] Module tracing applies captured-source integrity to its replacement resolver script
  • #8618 [Bug] Direct inspector observation fails without diagnostic in CI
  • #8658 Windows: JavaScript analysis fails during parent source-transfer with EPERM
  • #8674 [Bug] observe-web-execution fails on WordPress 7.1 editor pages because Chrome reports negative script columns
  • #8701 [Feature] Capture WebRTC peer-connection and data-channel metadata as read-only Evidence
Setup, Doctor & Environment Configuration (23)
  • #5485 [Feature] Generate a redacted diagnostic report for support requests (in #4330, canonical #5481)
  • #5811 [Bug] rea mcp add fails on Windows with spawn npx ENOENT
  • #6038 test(package): retain registry proxy failures and stop updater helpers
  • #6480 Track supply-chain audit follow-up: runtime, dependency and release hardening
  • #6708 [Feature] Require dependency security evidence for source and fresh release consumers
  • #6914 [Feature] Clarify rea doctor health when optional components are unconfigured
  • #6953 [Design] First-class Bun runtime autonomy and avoiding single-runtime ecosystem lock-in
  • #7199 [Bug] FreeBuff setup guide describes published support as unreleased
  • #7224 [Feature] Gemini Desktop
  • #7275 [Bug] rea setup completion prints Ida and Jadx instead of IDA and JADX
  • #7567 [Bug] Antigravity setup creates the evidence that makes broad setup select Gemini CLI
  • #7640 [Bug] Skill recovery step again omits supported setup client IDs
  • #7653 [Bug] Malayalam README celebrates a different star milestone from the other editions
  • #7655 [Bug] Fifteen README translations omit the packet-summary verification caveat
  • #7674 [Bug] Public 6.6.0 release notes still thank Copilot as a human contributor
  • #8122 [Bug] Doctor reports a single Windows installation as multiple because where rea lists its launcher shims
  • #8337 [Bug] macOS package verifier intermittently fails cleanup on malformed_procargs_path_padding
  • #8500 [Feature] Explain skipped Hopper setup and verify container recovery on Bazzite
  • #8504 [Feature] Discover compatible versioned Homebrew JDKs for Ghidra
  • #8505 [Design] Detect publisher package drift across Hopper release formats
  • #8597 [Bug] Build fails on Node 26.12.1: verifier source loader passes mode 'transform' to stripTypeScriptTypes
  • #8616 [Bug] Virus Detected when attempted download on Windows | Nov 1st 2026
  • #8700 [Bug] Windows non-AppContainer (Medium integrity) token: native self-test fails with "Create private object relative to its admitted parent failed" (Win32 5)
Android, ADB & Mobile Runtimes (12)
  • #5033 [Feature] Read-only Android view hierarchy capture over adb
  • #5237 [Windows native] Private DACL contains unexpected trustees (Win32 5) blocks Android inspection before JADX (in #4330, canonical #289)
  • #7409 [Bug] inspect-adb-package treats an ID with attached letters as a valid declaration
  • #7433 [Bug] APK signing inspection ignores classic ZIP disk metadata
  • #7677 [Bug] Android and browser CLI schemas omit enforced selector constraints
  • #7768 [Bug] JADX provider: the required jadx-headless-mcp 0.7.1 JAR cannot be obtained - the upstream package was renamed in v1.x
  • #7769 [Bug] JADX provider: the required jadx-headless-mcp 0.7.1 JAR cannot be obtained - the upstream package was renamed in v1.x
  • #8052 Document workflow for inspecting a user-provided Spotify APK
  • #8121 [Feature] Read WeChat mini-program wxapkg containers
  • #8473 [Feature] iOS device acquisition lane mirroring the ADB suite (BYO libimobiledevice)
  • #8499 Windows x64: JADX bridge JVM stalls opening engine.jar, MCP connect times out (6.8.0)
  • #8552 [Bug] ADB verifier cannot prove ownership of the APK lifecycle target
new, unsorted (10)
  • #6013 [Design] Upstream issue
  • #7243 [Workflow] Pending reviews block queued contributions (#7062, #7063, #7065)
  • #7488 [Docs] Clarify coordination for overlapping fixes while a PR awaits review
  • #7627 [Workflow] Multi-day review delays and repeated upstream conflicts are creating substantial maintenance costs
  • #7717 Deep static (knip) on main reports unused exported type HexRecordRegionMetadata since #7136
  • #8274 [Design] Make real Ghidra and Kuna workflow regressions a visible CI gate
  • #8434 [Design] Should more fixed allowances get a capped, opt-in override?
  • #8474 [RFC] Structured protocol traffic generation/replay — scope decision needed (loopback fixture servers first?)
  • #8475 [RFC] Benchmark oracle adapter: expose rea_verify_reconstruction for AgentRE-Bench / SRE-Bench task packs
  • #8676 [Docs]
Closed since opening (893)

893 issues on this list have closed since it went up. They are among the closed issues opened since 18 October on GitHub. That search covers all of morluto/rea, so it can show more than this list does.

Possible duplicates for #4330 (1)

None of these pairs is in #4330 yet. A check flagged each one, and it may be wrong. This list takes no side. The pairs are here so matbrgz can take them.

  • #4943 and #3118. The check said: both ask for XEX support in Ghidra.
How it's built
  • Snapshot. I took a snapshot of the open issues at about 4:13 PM UTC on 20 October 2026. It held 248 open issues created since 18 October 00:00 UTC. I then re-read each one live. Five had closed and are left out: #5094, #5557, #5586, #5590 and #5598. That leaves 243. Since the snapshot, 893 have closed and moved to the Closed since opening fold. 1108 new issues are added. That makes 458.
  • Last day. 22 of the 458 were created in the 24 hours before the refresh.
  • Areas. An assistant read each title and picked one of the six areas from #3537. It did not read the bodies.
  • Possible duplicates. An embedding model compared the title and the first 600 characters of each body. For each issue I kept the five nearest neighbours, once among all issues and once among this list. That gave 296 pairs. Then an assistant, Claude Haiku, read each pair and said dup, related or no. It said dup for 11 pairs. Four of them sit inside one #4330 cluster, so those lines carry the #4330 tag instead. The other seven are in the fold above. Some older issues are not in this list. A possible duplicate is never a certain one.
  • Refs commits. 14 issues are named by a Refs line in a commit on main. I checked that each commit is on main in a fresh mirror of the repo. Main was at 5b676ba9f. Refs means the commit relates to the issue. I did not check that it fixes it.
  • Duplicates. Duplicates are tracked in #4330 (matbrgz). This list only points at it. 10 of the 458 issues appear in #4330, going by its body as I read it on 20 October 2026. I read it again at the refresh. Only the new lines took a tag from that second read. Each carries an in #4330 tag. I did not judge those again.
  • Closing. This list closes and labels nothing. Closing is your call or morluto's.

If something's wrong

Comment on this issue and name the line. I will fix the list.

Related trackers

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates
  • #3537: Open bugs, by subsystem (matbrgz)
  • #4330: Duplicate issues, in clusters (matbrgz)
  • #5653: New issues by area, pointing at #4330 for duplicates (this one, CassieFox23)
Features and roadmap
  • #3796: Feature requests, by area (CassieFox23)
  • #2383: Support for the top 100 languages (matbrgz)
  • #2357: Static file and crash report work (matbrgz)
  • #3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
  • #4027: Browser, Electron and JS work (N0zoM1z0)
  • #32: The main roadmap (morluto)
  • #48: The Evidence v2 epic (morluto)
  • #2039: The roadmap in plain words, a discussion (CassieFox23)
Docs
  • #3795: Open docs issues and PRs (CassieFox23)
Pull requests
  • #3582: Ready to close or merge, issues and PRs (CassieFox23)
  • #5654: Open PRs with conflicts or red CI (CassieFox23)
Show and tell
  • #1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5653 [![Type: Tracker](https://img.shields.io/badge/type-tracker-purple.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Active](https://img.shields.io/badge/status-active-brightgreen.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) **TL;DR:** This lists 458 open issues opened since 18 October, sorted into six areas. 22 of them came in the last day. Maintainers can sort them faster. Duplicates are tracked in #4330 (matbrgz). This list only points at it. ### What's here New issues are arriving fast. Many came in the last day. That makes the queue hard to scan. This list gathers them in one place, by area. The list is built from what is open on GitHub. The maintainers' labels win. Bugs by subsystem live in #3537. Duplicates in clusters live in #4330. Last refreshed: 10:29 PM UTC on 2 November 2026. ### New issues by area Each box below is an open issue opened since 18 October 2026. Tick a box when it is done, closed, or answered. Nothing here asks for speed. The six areas are the ones used in #3537. An assistant sorted each title into one area, so a few may sit in the wrong one. A tag after a line means one of three things. (in #4330, canonical #N) says matbrgz's list already holds the issue and names the report it keeps. (possible dup of #N, not yet in #4330) says a check found a similar issue that list lacks. It may be wrong. (Refs on main SHA) says a commit on main names this issue with Refs. That does not always mean the issue is fixed. Closing anything is your call or morluto's. <details> <summary>Evidence, Artifacts, Firmware & Reconstruction (71)</summary> - [ ] #4948 `recover_javascript_sources` is Linux-x64-gated even though Wakaru ships a native darwin-arm64 build - [ ] #4972 [Feature] Add semantic-equivalence verification for reconstructed native code - [ ] #4987 [Feature] Let analyze-javascript-application select sources by folder or glob - [ ] #5117 [Design] Provider-neutral batch export for native machine evidence - [ ] #5150 [Feature] Expose Constant-table default values for literal fields and parameters in inspect_managed_members - [ ] #5168 [Bug] e_lfanew inside the DOS header (Tiny PE) is refused before provider admission - [ ] #5185 Feature Request: Support Analysis of MQL5 `.ex5` Expert Advisors Loaded by `terminal64.exe` (in #4330, canonical #3569) - [ ] #5229 [Bug] One unreadable entry fails directory analysis, and inventory omissions leave the application graph complete - [ ] #5489 [Feature] Add a dry-run plan for artifact extraction (in #4330, canonical #5481) - [ ] #5900 fix(firmware): reclassify output-directory admission failures as invalid_request - [ ] #6166 [Bug] capture_browser_scenario reports cleanup_incomplete and drops Evidence after all actions completed - [ ] #6211 [Design] Add read-only PostgreSQL inspection - [ ] #6328 [Feature] C28x/C2000 support - [ ] #6337 [Feature] Add a verifiable manifest for exported analysis bundles - [ ] #6338 [Feature] Add a focused comparison report for two compatible analysis runs - [ ] #6408 [Feature] Inspect MFC CRuntimeClass metadata in PE binaries and link each serializable class to its Serialize(CArchive&) function - [ ] #7189 [Feature] Static library-function identification (FLIRT-like) for native targets - [ ] #7198 [Bug] Library identification enforces resource budgets after parsing oversized input - [ ] #7226 [Bug] identify_flutter_build reports dart_version null on release engines - [ ] #7235 [Feature] Decode FDO packaging and dlopen metadata in inspect-elf-notes - [ ] #7244 [Feature] Project expected JNI/JNA symbol names and structural attack-surface facts from Android declarations - [ ] #7265 [Feature] Accept original Xbox XBE executables and route them to provider loaders - [ ] #7303 [Bug] compare_wasm_interfaces does not say which Evidence argument it rejected - [ ] #7304 [Bug] Artifact reconstruction can pass when comparison rows record a change - [ ] #7362 [Bug] Opening a directory `.app` bundle whose executable is a name-classified artifact fails since c27560e43 - [ ] #7371 [Bug] Process comparison accepts conflicting final filesystem snapshots and reports unchanged - [ ] #7377 [Bug] inspect-keyed-archive accepts an empty target and reads the working-directory bundle - [ ] #7383 [Bug] find_changed_behavior reports an imported process contradiction as observed unchanged - [ ] #7384 [Bug] find_changed_behavior reports observed equality for a comparison with unknown divergence - [ ] #7389 [Bug] inspect-native-exports accepts a populated ELF .dynsym without its null symbol - [ ] #7397 [Bug] binary_session misclassifies unsupported navigation targets as missing providers - [ ] #7399 [Bug] binary_session advertises default address context queries for unsupported artifact targets - [ ] #7400 [Bug] TLS template ranges in section zero padding abort PE load-config inspection - [ ] #7403 [Bug] PE resources and certificates classify a DOS MZ target as an invalid request - [ ] #7406 [Bug] extract-artifact and three artifact inspections select the working directory for an empty target - [ ] #7424 [Bug] Desktop inspection succeeds for a path whose intermediate component is a regular file - [ ] #7461 [Feature] Evidence-backed firmware update comparison with component-level change attribution - [ ] #7565 [Bug] Built verification summaries return 404 for their JSON evidence links - [ ] #7566 [Bug] Verification page's worker link still returns 404 after its fix was claimed - [ ] #7612 [Bug] Devicetree retained-reference example spells the Evidence prefix as ev: - [ ] #7689 [Bug] Apple IPS inspection omits unknown key names inside thread, frame and image rows - [ ] #7874 [Feature] Inspect Python wheel distributions as structured, read-only Evidence - [ ] #7955 [Roadmap] Embedded firmware: make REA work on the devices around us - [ ] #8097 [Feature] Inspect ONNX Runtime .ort models (ORTM FlatBuffers) in inspect_model_artifact - [ ] #8116 [Bug] Legacy Mach-O rebase decoder does not wrap its cursor at 64 bits, losing slots after a backward ULEB step - [ ] #8143 [Feature] Import Linux `perf.data` recordings as read-only profiling Evidence - [ ] #8144 [Feature] Inspect NuGet `.nupkg` packages and dependency metadata as read-only Evidence - [ ] #8173 [Design] Use independent symbol evidence to match functions when a provider omits origins - [ ] #8206 [Feature] Support Python 3.14 and 3.15 bytecode in `inspect_python_pyc` - [ ] #8234 [Feature] Deterministic row paging for inspect_sqlite_database selected tables - [ ] #8292 [Feature] Consider moving from `binwalk` to `binwalk-ng` - [ ] #8302 [Bug] Compact Mach-O catalog omits slice-relative offset semantics - [ ] #8375 [Design] Make Unknown history direction explicit in bundle comparisons - [ ] #8407 [Bug] decode-interface-builder omits a nib with an empty DOCTYPE internal subset as aggregate decode budget exhaustion - [ ] #8409 [Bug] Unsupported Evidence view suggests changing target format - [ ] #8410 [Bug] extract-artifact takes 40-49 s for the Node.js release zip on Windows (plain extraction: 1.7 s) - [ ] #8425 [Bug] Evidence retention refusal discards a completed direct observation - [ ] #8427 [Design] Recover inline unretained Evidence into a new investigation - [ ] #8455 [Bug] Large retained Evidence link sets overflow closure traversal - [ ] #8507 [Bug] Firmware capability recovery recommends the wrong alternative engine - [ ] #8545 [Bug] Large inventories overflow bulk appends in verification and directory traversal - [ ] #8546 [Design] Make residual-unknown target scope explicit for Evidence handoffs - [ ] #8551 [Bug] Virtual directory identities overwrite matching raw file nodes - [ ] #8590 [Design] Make one-shot trace source availability discoverable - [ ] #8623 [Bug] Valid Zstandard ZIP window-limit refusal is reported as corrupt input - [ ] #8655 [Design] Recover historical Evidence from an incompatible analysis snapshot - [ ] #8661 [Bug] OpenStep quoted escapes make existing app executables appear missing - [ ] #8665 [Feature] IL2CPP binary_path: Unity WebGL wasm32 CodeGenModule → function index - [ ] #8685 [Bug] iNES change-detection test failed with truncated-payload refusal in Linux CI - [ ] #8702 [Feature] Reconstruct GraphQL schemas and operation contracts from retained artifacts - [ ] #8709 [Bug] inspect-binary-layout rejects ARM64 (EM_AARCH64) ELF targets, pwntools-elf provider appears x64-only </details> <details> <summary>Ghidra, Hopper, IDA & Native Decompilation (170)</summary> - [ ] #4943 [Enhancement] Add XEX support (possible dup of #3118, not yet in #4330) - [ ] #5032 procedure_pseudo_code output for one large function is too big to return - [ ] #5038 [Feature] IDA provider: declare read_bytes with faithful loaded-byte semantics - [ ] #5198 Would you accept borer as a native analysis provider? - [ ] #5225 [Windows x64] rea inspect --provider ghidra fails snapshot admission with Win32 5 (EACCES) in an AppContainer process; succeeds from an ordinary shell (in #4330, canonical #289) - [ ] #5243 Windows Ghidra P0: no path for ELF/arm64 targets (e.g. Android libapp.so) (in #4330, canonical #2338) - [ ] #5245 [Bug] 6.7.0 flags previously working extracted Hopper demo as unsupported_hopper_build (in #4330, canonical) - [ ] #5271 feat(ghidra): run long analyses as background jobs with bounded waits - [ ] #5315 inspect_macho analysis of a 151 MB single-slice binary does not complete - [ ] #5339 [Feature] Change how an address is listed in a Ghidra session: code, function, data, string, or undefined - [ ] #5344 [Feature] Resolve Objective-C `__cfstring` literals to the code that uses them - [ ] #5400 [Feature] Avoid repeated Ghidra startup logs in input-error replies - [ ] #5424 [Bug] Dispatch-metadata symbol fallback turns Ghidra pointer/string labels into fake Objective-C classes and misses every class the binary defines (in #4330, canonical #4368) - [ ] #5523 [Feature] `inspect_native_api`: report whether a function is variadic - [ ] #5657 [Design] Classic console ROM targets on Windows (raw image with an installed Ghidra language, or a named Ghidra loader) - [ ] #5709 [Feature] Nintendo 3DS static analysis through Ghidra and a reusable verification workflow - [ ] #5744 [Feature] Analyze Thumb-only Cortex-M firmware in the raw-binary lane instead of refusing its entry point and decoding it as ARM state - [ ] #5820 [Feature] Provider-neutral V-CPU interpreter structure analysis - [ ] #5829 [Bug] Attached IDA analysis omits UI effects from tool discovery - [ ] #5930 [Bug] batch_decompile accepts unbounded address arrays - [ ] #6197 Ghidra provider ignores adjacent PDB companions for Windows PE targets (no symbol names without manual workaround) - [ ] #6305 Add Motorola 6809 raw-binary support to the Ghidra provider - [ ] #6404 [Feature] Ghidra: admit comment / inline_comment / set_comment / set_inline_comment at any mapped address - [ ] #6405 [Feature] Ghidra: export analyst names and comments from a session and re-apply them when the target is reopened - [ ] #6407 [Design] Ranked, non-binding counterpart candidates for unmatched functions in match_native_functions - [ ] #6746 [Feature] Ghidra profile for PS2 Emotion Engine (R5900) executables - [ ] #7018 [Docs] macOS needs Ghidra buildNatives; doctor remediation should say so - [ ] #7075 Windows: Ghidra provider fails to start - LaunchSupport cannot write java_home.save (access denied) - [ ] #7077 Linux Hopper setup fails for current vendor release: fixed 120 s download deadline exceeded and feed main_exe_hash does not match the published launcher - [ ] #7121 [Bug] Windows Ghidra lane refuses DOS MZ (16-bit real mode) targets and cannot open an existing Ghidra project - [ ] #7142 [Feature] Unicorn-backed function-level emulation provider (building block for #4972) - [ ] #7374 [Bug] External functions prevent decompile_all from stopping after repeated output I/O failures - [ ] #7381 [Feature] Ghidra provider: support universal (fat) Mach-O by selecting a slice instead of refusing - [ ] #7477 [Design] Admit RISC-V ilp32 and ilp32f ELF in the Ghidra lane with a per-ABI calling-convention policy - [ ] #7590 [Design] Admit Intel MCS-96 (80C196) raw-binary targets in the Ghidra lane - [ ] #7954 [Bug] Investigate Hopper bootstrap Python script execution failure - [ ] #7957 [Feature] Look-up of similar endavours before commencing decomp - [ ] #7993 [Feature] add MIPS support - [ ] #8023 [Bug] A GDB console command whose output is one MI line over 16 MiB ends the session with no way to detach, kill or close it - [ ] #8024 [Bug] After a Rizin debug session is stopped by its frame limit, later commands return a generic invalid-input error and status gives no reason - [ ] #8067 [Bug] verify-real-hopper asserts complete relationship coverage that the Hopper provider always reports as unknown - [ ] #8068 [Design] Make Ghidra decompile coordinate intent explicit for unresolved canonical hex selectors - [ ] #8085 [Bug] A repeated `rea decompile` with the same `--snapshot` runs Ghidra again instead of replaying - [ ] #8138 [Bug] Hopper 6.6.1 Fedora RPM launcher still mismatches the feed main_exe_hash; deb launcher matches (REA 6.8.0) - [ ] #8139 [Feature] Consider IDASQL as an additional IDA backend - [ ] #8165 [Design] Preserve and reopen owned Ghidra analysis with a packed-program checkpoint - [ ] #8166 [Design] Allow analyst assertions in Kuna decompilation with explicit provenance - [ ] #8167 [Feature] Recover individual Kuna decompiles that fail in a completed project export - [ ] #8169 [Bug] Ghidra project digest mismatch is hidden behind generic provider startup failure - [ ] #8170 [Feature] Investigate verified byte reads for Kuna-backed investigations - [ ] #8171 [Bug] Ghidra verifier drops the discovered JDK when JAVA_HOME is unset - [ ] #8172 [Bug] Ghidra verification sends function Evidence beyond the default MCP input allowance - [ ] #8175 [Design] Consider Kuna support for caller-described raw binaries - [ ] #8176 [Design] Report verified Kuna export progress when supported - [ ] #8177 [Design] Investigate Kuna decompilation inside a Ghidra analysis session - [ ] #8178 [Design] Disambiguate analysis addresses from file offsets in decompilation - [ ] #8181 [Design] Distinguish a missing batch decompilation selection from an empty batch - [ ] #8183 [Design] Recover function references when the provider lacks a general name inventory - [ ] #8184 [Design] Make feature-trace reference coverage explicit for agents - [ ] #8185 [Design] Make native metadata recovery discoverable when class-label inventory is unavailable - [ ] #8186 [Design] Make decoded Swift declarations discoverable when procedure categories are unknown - [ ] #8190 [Design] Investigate partial outgoing data-reference evidence for Kuna functions - [ ] #8191 [Bug] Bulk export labels Rust-like Kuna pseudocode as C and omits representation metadata - [ ] #8192 [Design] Analyze analyst-selected function entries absent from provider inventories - [ ] #8193 [Design] Analyze an explicitly selected universal Mach-O slice with Kuna - [ ] #8194 [Design] Investigate evidence-backed algorithm-constant discovery and references - [ ] #8195 [Design] Evaluate a bounded RISC-V ELF investigation lane for Kuna - [ ] #8197 [Design] Trace UI actions through separately evidenced tail transfers and thunks - [ ] #8198 [Bug] UI trace pairs Objective-C handler addresses with method-record file offsets - [ ] #8200 [Design] Preserve call-site and indirect-call context in call-path workflows - [ ] #8203 [Bug] `open_binary` with automatic provider selection succeeds, but later calls return `target_unavailable` - [ ] #8208 [Design] Make missing-function recovery aware of selected Ghidra projects - [ ] #8209 [Design] Export a bounded explicit or graph-derived set of native functions - [ ] #8210 [Design] Clarify ARM-state raw entry errors when Thumb may be intended - [ ] #8212 [Design] Define Kuna cache publication when a session is cancelled - [ ] #8215 [Design] Surface relevant analysis-profile differences in function comparisons - [ ] #8217 [Bug] Changed Ghidra project loses its actionable error during provider launch - [ ] #8218 [Design] Find short or encoded markers outside provider string inventories - [ ] #8219 [Design] Link native API boundary types to inspectable type identities - [ ] #8221 [Design] Connect imported calls to explicitly selected library evidence - [ ] #8223 [Design] Make lost Ghidra session edits visible after cancellation - [ ] #8224 [Bug] Bit-field type IDs cannot be inspected or linked to their base type - [ ] #8225 [Bug] Existing MIPS Ghidra projects fail with a misleading profile mismatch - [ ] #8232 [Design] Compare selected Ghidra project memory with bounded original bytes - [ ] #8233 [Bug] Byte-search coverage labels loaded overlays as not loaded - [ ] #8235 [Bug] Paged native call graphs order depth 10 before depth 2 - [ ] #8236 [Design] Allow caller-bounded native call graph investigation - [ ] #8239 [Design] Explain individual failures in compact batch naming - [ ] #8240 [Design] Find the defined data object containing an address - [ ] #8241 [Design] Resolve a byte-search hit to its containing instruction - [ ] #8242 [Docs] Explain Ghidra CLI annotation lifetime in command help - [ ] #8243 [Design] Reuse the refreshed annotation dossier as a function observation - [ ] #8245 [Design] Expose loaded and metadata provenance for string matches - [ ] #8257 [Bug] Ghidra loader-created ELF entry labels are treated as exact source symbols - [ ] #8260 [Design] Preserve per-function producer provenance across decompile export resume - [ ] #8276 [Bug] Unavailable load-image collections report zero-total empty page coverage - [ ] #8277 [Bug] Resolved Ghidra indirect reference can yield a definite negative call path - [ ] #8282 [Bug] Cached native value traces cite source Evidence absent from exported bundles - [ ] #8284 [Bug] Native value trace reports missing parameter bindings for a known zero-argument function - [ ] #8288 [Design] Preserve feature-trace evidence when reference ownership is unavailable - [ ] #8289 [Design] Surface ephemeral annotation loss when switching analysis providers - [ ] #8314 [Design] Preserve local-variable source and identity in Ghidra function observations - [ ] #8315 [Bug] Ghidra project edit refusal hides read-only mode behind generic target advice - [ ] #8316 [Design] Isolate invalid Ghidra project configuration from unrelated MCP tools - [ ] #8317 [Design] Make unverified Kuna release guidance discoverable to MCP callers - [ ] #8319 [Design] Define Kuna cache identity for caller-configured launchers - [ ] #8328 [Design] Recover procedure lookup using independent export evidence - [ ] #8333 [Design] Preserve IFUNC resolver semantics when investigating exported APIs - [ ] #8336 [Design] Clarify or represent direct memory varnodes in native value-flow effects - [ ] #8344 [Design] Discover candidates before selecting an existing Ghidra program - [ ] #8348 [Design] Make incoming reference evidence actionable with Kuna - [ ] #8350 [Bug] Successful batch decompiles lose per-item provider provenance - [ ] #8351 [Bug] Decompile resume drops the top-level unknown-body limitation - [ ] #8352 [Bug] Kuna rejects a reported call destination as definite Mach-O data - [ ] #8355 [Bug] Decompile directory omits source inventory limitations - [ ] #8358 [Bug] Native value trace does not locate recovered call arguments without bindings - [ ] #8360 [Design] Investigate explicit non-mutating decode of an alternate instruction stream - [ ] #8362 [Bug] Kuna call paths can report complete negative despite omitted direct calls - [ ] #8363 [Bug] Ghidra address context hides available function comments and suggests unsupported calls - [ ] #8364 [Design] Preserve contributing evidence for address-context handoffs - [ ] #8365 [Design] Clarify live metadata across Ghidra byte-search pages - [ ] #8366 [Bug] Byte-search cursor mismatch hides project profile and suggests schema repair - [ ] #8367 [Bug] Comparing the same Kuna function Evidence reports ambiguous identity - [ ] #8370 [Design] Expose active provider command cleanup in session status - [ ] #8372 [Design] Correlate native addresses across provider coordinate contexts - [ ] #8373 [Design] Bound delivery of large native feature traces and their unknowns - [ ] #8374 [Bug] Ghidra searches drop provider facts from string and procedure inventory rows - [ ] #8378 [Bug] Ghidra startup fails at the macOS Unix socket path boundary - [ ] #8380 [Bug] Ghidra snapshot verifier expects retained Evidence to disappear - [ ] #8383 [Bug] Ghidra backward call paths can overstate caller completeness - [ ] #8390 [Bug] Incomplete selected Ghidra project can produce complete call-path negatives - [ ] #8393 [Design] Compare function observations within one selected Ghidra project - [ ] #8396 [Bug] Kuna xref name errors direct data lookups to procedure search - [ ] #8405 [Design] Report omitted caller targets in the real Kuna verifier - [ ] #8408 [Design] Connect indirect call investigations to Mach-O slot bindings - [ ] #8415 [Bug] Address context hides rejected address and document details - [ ] #8421 [Bug] Address context gives misleading recovery when Evidence capacity is exhausted - [ ] #8428 [Bug] Unavailable address navigation hides usable instruction alternatives - [ ] #8435 [Bug] Crash prompt overlooks retained dossier handoff for call paths - [ ] #8449 [Bug] Native Evidence views accept incompatible predicates - [ ] #8452 [Design] Clarify authority of native matching Evidence views - [ ] #8459 [Design] Recognize repeated Kuna observations without discarding graph provenance - [ ] #8460 [Design] Distinguish function correspondence from analysis metadata changes - [ ] #8461 [Bug] Ghidra RISC-V lanes lose DWARF and no-return facts for ESP-IDF flash code - [ ] #8463 [Design] Admit ESP32-P4 ELF that declares Espressif vendor extensions, and report what Ghidra cannot decode - [ ] #8471 [Design] Distinguish local value flow from call-resolution availability - [ ] #8472 [Feature] Gadget search over analyzed instruction inventories (ROPgadget-shaped, evidence-carrying) - [ ] #8476 [Bug] Native value trace omits an external thunk target and its unknown flow - [ ] #8478 [Bug] Kuna ambiguous procedure names suggest schema repair - [ ] #8510 [Bug] Kuna 1.988 stored-pointer references disappear from xrefs and feature traces - [ ] #8534 [Bug] Ghidra snapshot verifier expects obsolete profile-mismatch wording - [ ] #8549 [Bug] Evidence summary suggests unsupported analysis view for xrefs - [ ] #8554 [Bug] Socket resource analysis misclassifies unary arguments - [ ] #8556 [Design] Preserve byte-observation limitations in function matching - [ ] #8560 [Design] Bound Ghidra byte-read allocation before response construction - [ ] #8563 [Feature] Investigate byte signatures across adjacent Ghidra blocks - [ ] #8569 [Design] Find references to a selected data range - [ ] #8577 test(ghidra): correct regex failure guidance verifier - [ ] #8579 fix(ghidra): preserve nested project selection in failure recovery - [ ] #8580 fix(ghidra): explain read-only project annotation refusal - [ ] #8583 fix(ghidra): clarify interior selectors before function annotation - [ ] #8587 [Design] Page retained native procedure-reference observations - [ ] #8593 [Design] Page retained native instruction references - [ ] #8595 [Bug] Frida verifier cleanup fixture copies its dependency to the wrong path - [ ] #8607 [Bug] Byte search labels loaded overlays as not loaded - [ ] #8642 [Bug] Rizin debug session close fails when the target reads stdin, because it inherits the command stream - [ ] #8683 [Design] Make Kuna automatic analysis mode and its limits visible - [ ] #8686 [Bug] Kuna timeout recovery suggests changing jobs without a relevant phase or quality tradeoff - [ ] #8690 [Bug] Kuna verification updates reject snapshots from the same executable - [ ] #8696 [Design] Inspect explicitly selected code outside provider inventory </details> <details> <summary>CLI, MCP Protocol & Agent Integration (129)</summary> - [ ] #5062 [Feature] Ship REA as a Claude Code plugin (one-step MCP + skill install) - [ ] #5244 [Bug] Bundled skill v42 documents MCP tools absent from npm 6.7.0 server - [ ] #5272 feat(mcp): hold several Ghidra targets open concurrently in one server - [ ] #5273 [Bug] MCP tool calls backgrounded by the client after 120 s fail with "missing required resultType" (protocol 2026-07-28) (Refs on main 4eaf3a117, merge of #5371) - [ ] #5306 [Bug] observe_native_ui treats a wrong PID or window as provider unavailability and withdraws the tool in binary_session - [ ] #5476 [Feature] Support authenticated access for non-loopback MCP HTTP deployments - [ ] #5490 [Feature] Add manifest-driven batch mode for independent offline artifact inspections (in #4330, canonical #5481) - [ ] #5512 [Bug] Pinned mcp__claude__ prefix in a Claude Code fork hides REA from the model while doctor stays green - [ ] #5808 [Design] Audit recovery controls for remaining provider timeouts and limits - [ ] #5861 [Bug] Default tools/list schema profile is ~813 KB (~259K tokens); compact cuts it to ~196 KB but is off by default and still ~29% of a 227K context - [ ] #6176 [Enhancement] Make hard-coded admission ceilings configurable with documented defaults - [ ] #6332 [Feature] Export supported analysis findings as SARIF 2.1.0 - [ ] #6333 [Feature] Add auditable suppression rules for reviewed analysis findings - [ ] #6334 [Feature] Add opt-in redaction profiles for shareable analysis reports - [ ] #6336 [Feature] Define stable identities for correlating compatible findings across runs - [ ] #6339 [Testing] Add contract tests for public machine-readable analysis outputs - [ ] #6344 [Bug] analyze-web-bundle fatally exhausts the CLI heap (4 GiB and 12 GiB) on a 173 KB react-dom chunk instead of returning a typed resource_constraint - [ ] #6870 Advertise a stable family for each tool in `tools/list` metadata, and document that DeepSeek Harness does not lazy-load - [ ] #6919 [Feature] Include existing static artifact routes in feature-investigation guidance - [ ] #7093 [Bug] environment-serve accepts an empty or non-decimal --port and serves on another port - [ ] #7123 [Bug] Advertised input schema normalization and literal constraint checks skip contentSchema and array-valued tuple items - [ ] #7138 [Docs] CLI JSON request arguments do not document reading standard input with `-` - [ ] #7143 Linux process-ownership cleanup fails when /proc/<pid>/environ is unreadable across user namespaces (EACCES) - [ ] #7155 MCP tools/list is 3.16 MB - outputSchema is 74.5% of it` - [ ] #7181 [Feature] Discover project-scoped MCP registrations in doctor and uninstall (pi, OpenCode) - [ ] #7193 [Feature] Investigation-loop construct for agent-driven deep dives (loop engineering) - [ ] #7271 [Bug] evidence-import --token-count --full-output undercounts TOON and YAML - [ ] #7276 [Bug] inspect-native-data-type reports target_unavailable for an invalid selector - [ ] #7279 [Bug] inspect-byte-entropy cleanup names provider rea-byte-entropy - [ ] #7280 [Bug] decompile-all accepts an empty target and exports the working directory - [ ] #7281 [Bug] capture-process final snapshot fails when its scratch directory is removed - [ ] #7286 [Bug] DSH configuration edits silently discard later YAML documents - [ ] #7306 [Bug] Several CLI option help lines print the same default twice - [ ] #7310 [Bug] binary_session advertises inspect_address_context before a target is open - [ ] #7312 [Bug] GGUF accepts 33 nested array frames while advertising a maximum of 32 - [ ] #7315 [Bug] Empty strings block at the reservation boundary rejects a valid DTB - [ ] #7316 [Bug] Closed-session discovery falsely requires a target for inspect_apk_signature - [ ] #7323 [Bug] Application analysis resolves an unbound require as CommonJS inside a type-module package - [ ] #7324 [Bug] Kernel-module guide describes the 28-byte trailer magic as 27 bytes - [ ] #7327 [Bug] MCP provenance documentation lists two exceptions although both settings tools are also exempt - [ ] #7330 [Bug] Record-order validation incorrectly reports noncanonical manifests - [ ] #7344 [Bug] Purge deletes a nested caller-selected Kuna cache after reporting it retained - [ ] #7346 [Bug] MCP HTTP startup recommends changing the port for a host lookup failure - [ ] #7347 [Bug] ASAR inspection limit errors omit the parsed required header size - [ ] #7352 [Bug] Rust inspection describes the inflate ratio using stored section size - [ ] #7369 [Bug] Owned commands return success when their deadline expires during final cleanup - [ ] #7372 [Bug] MCP doctor writes non-JSON stdout for tool-family scopes without prompts - [ ] #7375 [Bug] mcp add writes client configuration despite an unexpected positional argument - [ ] #7376 [Bug] Byte-entropy CLI accepts empty and non-decimal window options - [ ] #7388 [Bug] prefix-variance input guidance omits its 32-segment comparison limit - [ ] #7405 [Bug] docs/index.md repeats the native-inspection task with inconsistent guide lists - [ ] #7415 [Bug] compare-web-captures classifies an ambiguous retained step ID as absent - [ ] #7420 [Bug] Runtime-settings guide incorrectly says setup omits the response-byte budget - [ ] #7437 [Bug] Five MCP tools advertise relative paths that their handlers reject - [ ] #7438 [Bug] MCP doctor labels a skipped identity probe as a missing package and catalog - [ ] #7440 [Bug] search --format md hides allowed enum values in rendered argument errors - [ ] #7441 [Bug] demangle-swift --json indents argument errors on piped and redirected stdout - [ ] #7442 [Bug] analyze --snapshot replaces specific schema diagnostics with a constant failure reason - [ ] #7445 [Bug] Retroactive Swift conformance flag suppresses a readable static witness slot - [ ] #7448 [Bug] observe-native-calls launches the working app when its target is empty - [ ] #7459 [Docs] jadx-headless-mcp dependency name collides with an unrelated public npm/GitHub project - [ ] #7467 [Docs] Clarify coordination for overlapping fixes while a PR awaits review - [ ] #7478 [Design] One owner each for target-format and architecture vocabularies - [ ] #7501 [Bug] `analyze_swift_types` files members of private nested types under the enclosing type's category - [ ] #7503 [Bug] Exclusive input bounds are reported as the inclusive minimum or maximum - [ ] #7510 [Bug] analyze-javascript-application never completes on a 20 MB Expo Router web bundle, even with semantic limits at 1 - [ ] #7522 [Bug] Automatic setup selects Grok Bot even though its connector requires manual registration - [ ] #7534 [Bug] Package inspection reports a digit prefix as the exact version for an attached-letter token - [ ] #7535 [Bug] Amp registration writes global settings despite --no-global - [ ] #7537 [Bug] inspect_byte_entropy omits its absolute-path requirement from the MCP request schema - [ ] #7540 [Bug] Invalid dry-run values let approved setup write client configuration - [ ] #7541 [Bug] Native call observation reports complete coverage after omitting the 65th breakpoint location - [ ] #7551 [Bug] Linked-worktree imports hash Git administration files into source identities - [ ] #7559 [Bug] A later scalar property assignment makes an earlier destructuring dependency ambiguous - [ ] #7561 [Bug] doctor accepts an empty --target and passes target readiness for cwd - [ ] #7569 [Bug] Relative Wireshark tool refusals drop the supplied path value - [ ] #7570 [Bug] Native UI commands hide the reason both capture sources are refused - [ ] #7571 [Bug] Environment bundle commands create directories before refusing a trailing `..` - [ ] #7595 [Bug] WABT relative-directory error omits the supplied selection - [ ] #7601 [Bug] Root and command help omit the documented global --json switch - [ ] #7608 [Bug] mcp add ignores undeclared flags and applies registration - [ ] #7609 [Bug] MCP registration ignores missing values for --agent and --command - [ ] #7610 [Bug] MCP registration mixes human messages into --json stdout - [ ] #7616 [Bug] Testing guide undercounts Linux lanes consuming the shared build artifact - [ ] #7617 [Bug] SQLite guide describes a Node 24.15.0 CI lane absent from the workflow - [ ] #7621 [Bug] environment-compare does not disclose when a step's difference list is truncated - [ ] #7628 [Bug] Native export byte-limit recovery describes the limit as a count - [ ] #7634 [Bug] Marker-only filenames become empty ordered list items in rendered Markdown - [ ] #7636 [Bug] Overlong historical capture paths receive provider-failure classification - [ ] #7650 [Bug] Client configuration reference omits Cursor, Windsurf, and Command Code MCP entries - [ ] #7651 [Bug] Dispatch metadata loses the unsupported-width reason when its symbol fallback fails - [ ] #7654 [Bug] Translated setup guides omit the MCP output-profile option - [ ] #7669 [Bug] Kernel-module guide omits the unsupported status for compressed this_module sections - [ ] #7670 [Bug] Kernel-module guide lists a trailer-truncation reason no admitted ELF can produce - [ ] #7680 [Docs] 6.8.0 release notes advertise MMIO attribution that was removed before release - [ ] #7687 [Bug] Target listing claims all HTTP(S) pages are listed while reporting a transport exclusion - [ ] #7688 [Bug] Environment bundle CLI classifies a regular-file parent as a host write failure - [ ] #7691 [Bug] Unknown MCP subcommands emit TOON after selecting JSON or Markdown - [ ] #7692 [Bug] Grok Bot setup reveals its required manual connector step only after interactive approval - [ ] #7693 [Bug] Setup announces cache preparation without resolving a direct-launcher skip - [ ] #7695 [Bug] Retained analysis-view guidance omits working view families and selectors - [ ] #8032 [Bug] Process capture reports cleanup_outcome "not_required" after its cleanup killed a detached descendant - [ ] #8049 [Bug] CLI dispatcher exits with status 0 on cleanup failure when exit callback receives undefined code - [ ] #8084 [Design] Skill: keep per-target guidance out of SKILL.md, in condition-named reference pages - [ ] #8141 [Bug] CLI observe-web-session emits no armed progress, so a caller cannot tell when to perform the action - [ ] #8162 [Design] Raw raster rendering to PNG through CLI and MCP - [ ] #8204 [Bug] `compare-process-captures` reports `changed` when comparing two captures of the same deterministic run - [ ] #8205 [Docs] `trace_application_feature` seed kinds are not described in the MCP tool schema - [ ] #8254 docs: REA_MCP_TOOL_FAMILIES is documented as current behaviour, but published 6.8.0 does not contain it - [ ] #8285 [Bug] trace-native-values CLI cannot save the source Evidence it cites - [ ] #8304 [Bug] Validating MCP clients reject search_guidance and read_guidance_section results over stdio - [ ] #8321 [Design] Make static call-path investigation available to CLI users - [ ] #8388 [Design] Make scoped MCP native workflows discoverable without the full catalog - [ ] #8398 [Design] Give `capture_process_scenario` a prepare-only mode so the preparation prompt can suggest a non-executing call - [ ] #8399 [Design] Let non-idempotent tools take a caller-supplied idempotency key so a dropped-connection retry cannot run the target twice - [ ] #8402 [Design] Connect unbound tool recovery to provider selection reasons - [ ] #8403 [Bug] Unbound session reports stale provider readiness after repair - [ ] #8433 [Design] Clarify inline analysis view parent ownership and session handoff - [ ] #8448 [Design] Clarify CLI Evidence import versus MCP session retention - [ ] #8453 [Bug] File validation diagnostics can overflow the MCP response - [ ] #8508 [Bug] EVM limiter configuration failures expose internal codes as recovery guidance - [ ] #8555 [Bug] Go verifier can remove its fixture root before MCP ownership completes - [ ] #8559 [Bug] Native UI verifier can lose fixture ownership before the ready handshake - [ ] #8561 [Bug] Signal verifier can release its fixture root before MCP cleanup completes - [ ] #8562 [Bug] Recorded-crash verifier can release fixtures after cleanup failures - [ ] #8564 [Bug] WABT artifact verifier releases both roots after MCP cleanup fails - [ ] #8565 [Design] Guide recovery from unsupported provider operations - [ ] #8657 [Bug] Scoped direct tools suggest disabled open_binary for a missing target - [ ] #8682 [Design] Preserve investigation records in scoped MCP connections </details> <details> <summary>Browser, Electron & Web Captures (43)</summary> - [ ] #4973 [Bug] compare_web_captures / compare_web_screenshots fail in Claude ("problem with that connector") - [ ] #5266 [Bug] Browser scenario start waits for load with no deadline when the page navigates away before load - [ ] #5300 [Feature] Model webContents.ipc and the non-BrowserWindow window constructors in Electron static analysis - [ ] #5360 [Feature] Wake or classify discarded CDP page targets so restored sessions stay inspectable - [ ] #5421 [Bug] Popup startup misses declared storage seeds while capture reports complete (in #4330, canonical #5420) - [ ] #6127 `analyze-javascript-application` exhausts a 6 GiB worker heap on a 233 KB file - [ ] #6168 [Feature] Declared permission grants and synthetic camera/microphone for capture_browser_scenario - [ ] #6191 [Feature] Resolve this property accesses in constructors, prototype methods and class methods - [ ] #6192 [Feature] Model objects assigned to properties after declaration - [ ] #6311 analyze_javascript_application hangs at parse_javascript_source on 664KB single-line ESM UMD (`@castleio/castle-js`) - [ ] #7038 [Feature] Read Hermes bytecode bundles: header, integrity, function and string tables - [ ] #7132 [Bug] trace_web_source_location reports an out-of-range generated_position as invalid_format without bounds - [ ] #7167 capture_browser_scenario fails with browser.mode="connect"; same scenario with mode="launch" works - [ ] #7170 analyze-javascript-application: semantic phase never completes on a 6.5 MB minified Electron main.js (3 timeouts, incl. reduced semantic limits) - [ ] #7212 Explain ASAR integrity mismatches caused by signing unpacked addons after packing - [ ] #7227 [Bug] Module-level webPreferences constants are reported as dynamic when the window is created inside a function - [ ] #7251 [Docs] Agent skill: passive SPA capture defaults to the page origin; route agents to allowed_origins and completeness.excluded - [ ] #7253 [Bug] 6.8.0 regression: the 512-reference alias bound in `canonicalWebpackInteropBindings` drops Electron windows and IPC handlers in a real Webpack app (Bitwarden) - [ ] #7410 [Bug] Redirected request steps omit the promised Location from network evidence - [ ] #7740 [Feature] Keep literal call arguments on call sites, such as the name in `client.rpc("name")` - [ ] #7742 [Feature] recover_javascript_sources on Windows x64 - [ ] #7763 [Bug] capture_browser_scenario: a response with HTTP status above 599 throws a ZodError in a Playwright event handler and ends the MCP server - [ ] #7774 [Design] Bound per-binding member-write records in JavaScript semantic analysis - [ ] #7787 [Bug] analyze-javascript-application does not write --evidence_output when a source reaches its deadline; partial Evidence goes inline to stdout - [ ] #7873 [Feature] Import saved Playwright `trace.zip` recordings as offline Evidence - [ ] #8033 analyze-javascript-application: deterministic hang on ~490-byte ESM input (parse phase); --analysis-timeout-ms inconsistently enforced - [ ] #8078 [Feature] Accept mitmproxy 12.3.x in the native mitmproxy capture adapter - [ ] #8126 [Bug] Reconciliation reports every V8 Inspector Node target as unmatched although its entry file is in the static layer - [ ] #8201 [Bug] Electron graph reports 0 IPC channels and 0 BrowserWindows on a real Rolldown bundle (Signal Desktop 8.33.0) - [ ] #8207 [Feature] Flag custom credential headers in network capture inspection, and export a HAR from browser scenarios - [ ] #8294 analyze_javascript_application exhausts its 1 GiB worker heap on react-dom 18.3.1 production build (132 KB) while three.module.js (1.3 MB) completes in 14 s - [ ] #8298 analyze-javascript-application stalls at javascript_worker_static on a 222 KB Vite + React 19 production bundle (Windows) - [ ] #8312 [Bug] Windows Chrome CDP: `inspect-web-page` times out at `Page.enable` after successful target discovery - [ ] #8334 [Docs] Put WASM interface comparison under the WASM guidance section - [ ] #8411 [Bug] analyze-javascript-application on GitHub Desktop 3.6.5 fails at the final Evidence checkpoint and keeps nothing - [ ] #8422 [Feature] Inventory browser Cache Storage entries as read-only web Evidence - [ ] #8423 [Feature] Capture WebAuthn/passkey ceremony metadata without retaining credential secrets - [ ] #8543 [Feature] Format-native inspector for V8 code cache (.jsc / bytenode artifacts) - [ ] #8544 [Bug] Module tracing applies captured-source integrity to its replacement resolver script - [ ] #8618 [Bug] Direct inspector observation fails without diagnostic in CI - [ ] #8658 Windows: JavaScript analysis fails during parent source-transfer with EPERM - [ ] #8674 [Bug] observe-web-execution fails on WordPress 7.1 editor pages because Chrome reports negative script columns - [ ] #8701 [Feature] Capture WebRTC peer-connection and data-channel metadata as read-only Evidence </details> <details> <summary>Setup, Doctor & Environment Configuration (23)</summary> - [ ] #5485 [Feature] Generate a redacted diagnostic report for support requests (in #4330, canonical #5481) - [ ] #5811 [Bug] `rea mcp add` fails on Windows with `spawn npx ENOENT` - [ ] #6038 test(package): retain registry proxy failures and stop updater helpers - [ ] #6480 Track supply-chain audit follow-up: runtime, dependency and release hardening - [ ] #6708 [Feature] Require dependency security evidence for source and fresh release consumers - [ ] #6914 [Feature] Clarify rea doctor health when optional components are unconfigured - [ ] #6953 [Design] First-class Bun runtime autonomy and avoiding single-runtime ecosystem lock-in - [ ] #7199 [Bug] FreeBuff setup guide describes published support as unreleased - [ ] #7224 [Feature] Gemini Desktop - [ ] #7275 [Bug] rea setup completion prints Ida and Jadx instead of IDA and JADX - [ ] #7567 [Bug] Antigravity setup creates the evidence that makes broad setup select Gemini CLI - [ ] #7640 [Bug] Skill recovery step again omits supported setup client IDs - [ ] #7653 [Bug] Malayalam README celebrates a different star milestone from the other editions - [ ] #7655 [Bug] Fifteen README translations omit the packet-summary verification caveat - [ ] #7674 [Bug] Public 6.6.0 release notes still thank Copilot as a human contributor - [ ] #8122 [Bug] Doctor reports a single Windows installation as multiple because where rea lists its launcher shims - [ ] #8337 [Bug] macOS package verifier intermittently fails cleanup on malformed_procargs_path_padding - [ ] #8500 [Feature] Explain skipped Hopper setup and verify container recovery on Bazzite - [ ] #8504 [Feature] Discover compatible versioned Homebrew JDKs for Ghidra - [ ] #8505 [Design] Detect publisher package drift across Hopper release formats - [ ] #8597 [Bug] Build fails on Node 26.12.1: verifier source loader passes mode 'transform' to stripTypeScriptTypes - [ ] #8616 [Bug] Virus Detected when attempted download on Windows | Nov 1st 2026 - [ ] #8700 [Bug] Windows non-AppContainer (Medium integrity) token: native self-test fails with "Create private object relative to its admitted parent failed" (Win32 5) </details> <details> <summary>Android, ADB & Mobile Runtimes (12)</summary> - [ ] #5033 [Feature] Read-only Android view hierarchy capture over adb - [ ] #5237 [Windows native] Private DACL contains unexpected trustees (Win32 5) blocks Android inspection before JADX (in #4330, canonical #289) - [ ] #7409 [Bug] inspect-adb-package treats an ID with attached letters as a valid declaration - [ ] #7433 [Bug] APK signing inspection ignores classic ZIP disk metadata - [ ] #7677 [Bug] Android and browser CLI schemas omit enforced selector constraints - [ ] #7768 [Bug] JADX provider: the required jadx-headless-mcp 0.7.1 JAR cannot be obtained - the upstream package was renamed in v1.x - [ ] #7769 [Bug] JADX provider: the required jadx-headless-mcp 0.7.1 JAR cannot be obtained - the upstream package was renamed in v1.x - [ ] #8052 Document workflow for inspecting a user-provided Spotify APK - [ ] #8121 [Feature] Read WeChat mini-program wxapkg containers - [ ] #8473 [Feature] iOS device acquisition lane mirroring the ADB suite (BYO libimobiledevice) - [ ] #8499 Windows x64: JADX bridge JVM stalls opening `engine.jar`, MCP connect times out (6.8.0) - [ ] #8552 [Bug] ADB verifier cannot prove ownership of the APK lifecycle target </details> <details> <summary>new, unsorted (10)</summary> - [ ] #6013 [Design] Upstream issue - [ ] #7243 [Workflow] Pending reviews block queued contributions (#7062, #7063, #7065) - [ ] #7488 [Docs] Clarify coordination for overlapping fixes while a PR awaits review - [ ] #7627 [Workflow] Multi-day review delays and repeated upstream conflicts are creating substantial maintenance costs - [ ] #7717 Deep static (knip) on main reports unused exported type HexRecordRegionMetadata since #7136 - [ ] #8274 [Design] Make real Ghidra and Kuna workflow regressions a visible CI gate - [ ] #8434 [Design] Should more fixed allowances get a capped, opt-in override? - [ ] #8474 [RFC] Structured protocol traffic generation/replay — scope decision needed (loopback fixture servers first?) - [ ] #8475 [RFC] Benchmark oracle adapter: expose rea_verify_reconstruction for AgentRE-Bench / SRE-Bench task packs - [ ] #8676 [Docs] </details> <details> <summary>Closed since opening (893)</summary> 893 issues on this list have closed since it went up. They are among the [closed issues opened since 18 October](https://github.com/morluto/rea/issues?q=is%3Aissue+is%3Aclosed+created%3A%3E%3D2026-10-18) on GitHub. That search covers all of morluto/rea, so it can show more than this list does. </details> <details> <summary>Possible duplicates for #4330 (1)</summary> None of these pairs is in #4330 yet. A check flagged each one, and it may be wrong. This list takes no side. The pairs are here so matbrgz can take them. - #4943 and #3118. The check said: both ask for XEX support in Ghidra. </details> <details> <summary>How it's built</summary> - **Snapshot.** I took a snapshot of the open issues at about 4:13 PM UTC on 20 October 2026. It held 248 open issues created since 18 October 00:00 UTC. I then re-read each one live. Five had closed and are left out: #5094, #5557, #5586, #5590 and #5598. That leaves 243. Since the snapshot, 893 have closed and moved to the Closed since opening fold. 1108 new issues are added. That makes 458. - **Last day.** 22 of the 458 were created in the 24 hours before the refresh. - **Areas.** An assistant read each title and picked one of the six areas from #3537. It did not read the bodies. - **Possible duplicates.** An embedding model compared the title and the first 600 characters of each body. For each issue I kept the five nearest neighbours, once among all issues and once among this list. That gave 296 pairs. Then an assistant, Claude Haiku, read each pair and said dup, related or no. It said dup for 11 pairs. Four of them sit inside one #4330 cluster, so those lines carry the #4330 tag instead. The other seven are in the fold above. Some older issues are not in this list. A possible duplicate is never a certain one. - **Refs commits.** 14 issues are named by a Refs line in a commit on main. I checked that each commit is on main in a fresh mirror of the repo. Main was at 5b676ba9f. Refs means the commit relates to the issue. I did not check that it fixes it. - **Duplicates.** Duplicates are tracked in #4330 (matbrgz). This list only points at it. 10 of the 458 issues appear in #4330, going by its body as I read it on 20 October 2026. I read it again at the refresh. Only the new lines took a tag from that second read. Each carries an in #4330 tag. I did not judge those again. - **Closing.** This list closes and labels nothing. Closing is your call or morluto's. </details> ### If something's wrong Comment on this issue and name the line. I will fix the list. ### Related trackers Every open tracker in the repo, so you can get to any of them from here. <details> <summary>Bugs and duplicates</summary> - #3537: Open bugs, by subsystem (matbrgz) - #4330: Duplicate issues, in clusters (matbrgz) - #5653: New issues by area, pointing at #4330 for duplicates (this one, CassieFox23) </details> <details> <summary>Features and roadmap</summary> - #3796: Feature requests, by area (CassieFox23) - #2383: Support for the top 100 languages (matbrgz) - #2357: Static file and crash report work (matbrgz) - #3714 to #3719: six RFC epics on formats and bytecode (matbrgz) - #4027: Browser, Electron and JS work (N0zoM1z0) - #32: The main roadmap (morluto) - #48: The Evidence v2 epic (morluto) - #2039: The roadmap in plain words, a discussion (CassieFox23) </details> <details> <summary>Docs</summary> - #3795: Open docs issues and PRs (CassieFox23) </details> <details> <summary>Pull requests</summary> - #3582: Ready to close or merge, issues and PRs (CassieFox23) - #5654: Open PRs with conflicts or red CI (CassieFox23) </details> <details> <summary>Show and tell</summary> - #1435: Linux setup notes and test queue, a discussion (CassieFox23) </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#3423
No description provided.