morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425

New issue
Open
opened 2026-10-31 00:40:15 +00:00 by bsakaguchi · 10 comments
bsakaguchi commented 2026-10-31 00:40:15 +00:00
Owner
Copy link

Originally created by @CassieFox23 on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5654

Type: Tracker Status: Active Ecosystem: REA

TL;DR: 349 open pull requests can't merge yet. Each has a conflict, a failing check, or both. Their authors may already be working on them.

What's here

Many open pull requests have a merge conflict or a failing check. In a long queue they are easy to miss. This list gathers them in one place. It is meant to help maintainers and contributors see the whole picture. The list is built from what is open on GitHub.

Last refreshed: 10:29 PM UTC on 2 November 2026.

Pull requests that can't merge yet

Each line below is an open pull request, not a draft, that has a merge conflict, a failing check, or both. Lines are grouped by days since the last activity, then by what blocks the merge. Authors may already be working on these. Nothing here asks for speed, and nothing here is a request to anyone.

A tag after a line says what blocks the merge. (conflicts) means the branch conflicts with main. (CI) means at least one check is failing. (both) means it has both.

0 to 2 days since the last activity (213)

Merge conflict only (64)

  • #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts)
  • #2043 docs(readme): add Hinglish translation (conflicts)
  • #2418 feat(angr): add angr MCP analysis provider (conflicts)
  • #2694 fix(wasm): raise the WABT output budget to 128 MiB (conflicts)
  • #3090 feat(providers): enable agent-aware deep provider selection (conflicts)
  • #3521 feat(reverse): add radare2 one-shot commands and analysis sessions (conflicts)
  • #3531 feat(ghidra): persistent project cache with cross-session identity (conflicts)
  • #3573 fix(android): classify a pre-handshake JADX heap shortage as a resource limit (conflicts)
  • #3585 feat(android)!: expose method access flags and absent body reasons (conflicts)
  • #3586 feat(jvm): inspect JVM source-line & local-variable debug metadata (#2377) (conflicts)
  • #3840 feat(android): add boot wait and resource-id to code tracing (conflicts)
  • #4043 fix(setup): write the recommended tool call timeout into dsh registrations (conflicts)
  • #4163 feat(analysis-view): page retained browser scenario steps and text (conflicts)
  • #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts)
  • #4417 feat(call-path): trace multiple goals and report backward roots (conflicts)
  • #4554 feat(browser-extension): inspect declared CRX and XPI manifest surfaces (conflicts)
  • #4618 feat(clients): register Kiro during setup (conflicts)
  • #4811 feat(ghidra): admit RISC-V position-independent executables (#4487) (conflicts)
  • #4813 feat(ida): support the official Hex-Rays IDA MCP headlessly (conflicts)
  • #4984 fix(call-path): bound inline shortest-path enumeration (conflicts)
  • #4991 feat(reconstruction)!: require failing verifier controls (conflicts)
  • #4995 fix(browser): reclaim scenario profiles whose owner is gone (conflicts)
  • #5046 fix(mcp): support retained pseudocode summaries and paging (conflicts)
  • #5197 docs: add REA guide and architecture patterns aligned to 6.7.0 (conflicts)
  • #5211 Fix #4856: Prevent call stack overflow on large TOML files (conflicts)
  • #5216 fix: allow Tiny PE e_lfanew inside DOS header (conflicts)
  • #5263 test(ghidra): strengthen raw-binary, firmware, and instruction flow verification (conflicts)
  • #5303 fix(javascript): keep var reads before their declarator unknown (conflicts)
  • #5361 feat(firmware): map STM32, GD32, and ESP32 SoC peripherals and auto-detect target platform (conflicts)
  • #5380 feat(android): add optional DroidASC class discovery backend (conflicts)
  • #5558 fix(process): reschedule poll on failure and bound stream buffer (conflicts)
  • #5560 fix(browser): ensure cancellation deadline and teardown on hanging CDP calls (conflicts)
  • #5902 fix(firmware): reclassify output-directory admission failures as invalid_request (conflicts)
  • #6142 fix(ghidra): add structured startup-timeout diagnostics (conflicts)
  • #6146 fix(javascript): bound member-mutation traversal and add max-heap-mb to compare-application-versions (#6127) (conflicts)
  • #6147 feat: extended artifact formats, Gzip reader, Python/PyInstaller, PE inspector, JVM reader, Minidump parser, and platform portability (conflicts)
  • #6177 fix(ghidra): name procedure-listing commands when name resolution fails (conflicts)
  • #6190 fix(javascript): include slotless accesses in property traces (conflicts)
  • #6288 feat(harmony): add xpanda-backed Ark bytecode analysis (conflicts)
  • #6294 test(javascript): order the caller abort by frame, not wall clock (conflicts)
  • #6347 fix(cli): delegate rea mcp add to setup --client on Windows (#5811) (conflicts)
  • #6350 fix(contracts): advertise the Frida remote address character set (conflicts)
  • #6367 fix(reconstruction)!: require distinct contents for fixture controls (conflicts)
  • #6699 fix(app-bundle): apply the Info.plist decode budget to XML plists (conflicts)
  • #6856 fix(comparison): reject blank function names (conflicts)
  • #7041 feat(binary-ninja-headless): add owned headless Binary Ninja provider (conflicts)
  • #7144 feat(ghidra): admit DOS MZ targets on Windows P0 (conflicts)
  • #7154 feat(mcp): advertise each tool's family in tools/list _meta (conflicts)
  • #7239 feat(ghidra): accept Ghidra 12.2.x as a compatible, unverified release line (conflicts)
  • #7245 feat(android): project expected JNI/JNA symbol names and structural attack-surface facts (conflicts)
  • #7340 fix(mcp): report session tool target requirements accurately (conflicts)
  • #7766 fix(cli): accumulate repeated allowed-hosts occurrences (conflicts)
  • #7778 fix(android): point JADX setup errors at the pinned public JAR (conflicts)
  • #8025 fix(rizin): preserve stopped session diagnostics (conflicts)
  • #8048 feat(ghidra,domain): add cortex-m raw binary support, relax ghidra ve… (conflicts)
  • #8157 fix(mcp): ensure resultType on tools/call wire results (conflicts)
  • #8161 feat(native): surface inferred prototype instruction conflicts (conflicts)
  • #8291 fix(analysis-view)!: distinguish unavailable native collections (conflicts)
  • #8326 fix(mcp): deliver guidance results under their advertised result object (conflicts)
  • #8340 fix(providers): mark callee coverage partial at computed call sites (conflicts)
  • #8343 fix(native): keep fixed zero-parameter calls out of missing-binding unknowns (conflicts)
  • #8537 fix(navigation): name instruction alternatives in navigation refusals (conflicts)
  • #8568 fix(analysis): append large inventories without exceeding call-argument limits (conflicts)
  • #8653 fix(session): guide retained cleanup before opening another target (#8353) (conflicts)

Failing CI only (90)

  • #2977 feat(ghidra): report computed branches without a recovered jump table (CI)
  • #3662 fix(flutter): inspect the renamed Dart AOT snapshot layout (CI)
  • #4038 fix(cli): preserve command status after complete pipe reads (CI)
  • #4355 fix(javascript): preserve loader getters across inactive defaults (CI)
  • #4741 test(adb): bind snapshot cleanup fixtures to runtime ownership (CI)
  • #5024 feat(experiments): add MCP tool-selection eval harness (CI)
  • #5129 fix(cli): load Evidence record pairs from JSON files (CI)
  • #5172 fix(adb): reuse shared PNG header validation (CI)
  • #5213 test(mcp): normalize server identity fixture paths on Windows (CI)
  • #5317 fix: correct cmd.exe /s /c argument quoting for Windows batch launchers (CI)
  • #5325 fix(ghidra): raise decompiler max payload cap for very large functions (CI)
  • #5936 test(setup): cover skill aliases and independent cleanup retries (CI)
  • #6381 fix(browser): return completed scenario capture when cleanup is unconfirmed (CI)
  • #6396 feat(cli): add provider-free 'profile' command with per-fact confidence (CI)
  • #6477 feat(mcp): add opt-in release notifications (CI)
  • #6940 REA ENGINEER (CI)
  • #6992 ci(real-go-binary): pin Go 1.26.10 (CI)
  • #7017 fix(discovery): advertise attached IDA navigation effects (CI)
  • #7056 test(inspector): keep the target cancellation fixture path exactly reported (CI)
  • #7160 fix(pe): admit Authenticode nesting depth of signed Windows binaries (CI)
  • #7161 fix(environment): map id-list elements when a scalar set also changed (CI)
  • #7174 feat(process): support FreeBSD hosts (CI)
  • #7197 feat: add investigation-loop domain module (Phase 1, #7193) (CI)
  • #7229 fix(electron): resolve module constant window options read inside functions (CI)
  • #7231 chore(bridge): remove unused imports and a shadowed loop variable (CI)
  • #7237 feat(elf): decode FDO packaging and dlopen note metadata (CI)
  • #7278 fix(cli): count the full-output envelope for TOON/YAML token counts (CI)
  • #7449 fix(mcp): advertise absolute filesystem paths (CI)
  • #7463 Initial commit (CI)
  • #7486 feat(ghidra): admit Xtensa ELF through a pinned lane (CI)
  • #7502 fix(validation): stop reporting an exclusive bound as an inclusive minimum (CI)
  • #7528 fix(native): reject nonzero reserved ELF dynamic symbols (CI)
  • #7530 fix(pe): classify valid DOS targets as unsupported (CI)
  • #7591 Feat/studio (CI)
  • #7619 feat(setup): prefer client plugins with opt-in Cursor installation (CI)
  • #7776 fix(browser): preserve nonstandard response status codes (CI)
  • #7870 fix(cli): reject malformed dry-run values (CI)
  • #7878 docs(i18n): mention bun add --global in translated FAQ update answers (CI)
  • #7951 feat(ghidra): open M-profile raw images at a separate load base (CI)
  • #8094 fix(ida): surface actionable error when headless decompile lacks pagination (CI)
  • #8111 fix(native): wrap the legacy rebase cursor at 64 bits like dyld (CI)
  • #8128 chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.1 (CI)
  • #8129 build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 (CI)
  • #8130 chore(deps-dev): bump @toon-format/toon from 2.3.1 to 4.4.0 (CI)
  • #8131 chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 (CI)
  • #8132 chore(deps): bump canonicalize from 3.0.0 to 5.1.0 (CI)
  • #8133 chore(deps): bump actions/setup-node from 4.4.0 to 7.1.0 (CI)
  • #8134 chore(deps): bump write-file-atomic from 7.0.0 to 8.0.0 (CI)
  • #8135 chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.2 (CI)
  • #8136 chore(deps-dev): bump lint-staged from 16.4.0 to 17.6.0 (CI)
  • #8151 fix(cli): exit with code 1 on cleanup failure when exit code is undef… (CI)
  • #8220 docs(mcp): name the accepted seed kinds on trace_application_feature (CI)
  • #8265 Revise README for usage and community engagement (CI)
  • #8268 fix(analysis): order graph depths numerically (CI)
  • #8269 Revise README for REA project introduction (CI)
  • #8280 chore(deps): bump the npm-minor-and-patch group across 2 directories with 34 updates (CI)
  • #8379 fix(ghidra): report selected project identity failures (CI)
  • #8381 test(ghidra): check retained historical snapshot evidence (CI)
  • #8382 fix(ghidra): respect Java Unix socket path limits (CI)
  • #8384 fix(native): retain value trace source evidence (CI)
  • #8389 docs(mcp): document native function analysis scope (CI)
  • #8401 feat(ghidra): admit RISC-V ilp32f ELF with a derived calling convention (CI)
  • #8412 fix(evidence): clarify unsupported view recovery (CI)
  • #8414 fix: guide address-context comment recovery (CI)
  • #8437 fix(mcp): clarify retained dossier handoff in crash prompt (CI)
  • #8439 docs(tool-design): audit agent workflow guidance (CI)
  • #8440 fix(verification): use inspected Ghidra JDK (CI)
  • #8442 fix(native)!: recognize identical function evidence (CI)
  • #8443 fix!: qualify call paths by provider discovery (CI)
  • #8447 feat(go): add capped build-info admission overrides (CI)
  • #8457 fix(evidence): traverse large source link sets safely (CI)
  • #8458 perf(artifacts): skip re-creating owned extraction directories (CI)
  • #8481 fix(mcp): surface pageable pseudocode workflow (CI)
  • #8484 docs(mcp): clarify Ghidra edit lifetime on switches (CI)
  • #8487 feat(mcp): refresh provider candidates without switching (CI)
  • #8514 fix(cli): guide analysts to typed incoming references (CI)
  • #8527 feat(artifacts): inventory and extract Deno compile executables (CI)
  • #8536 test(ghidra): check structured snapshot profile mismatch (CI)
  • #8547 docs(mcp): clarify residual unknown target scope (CI)
  • #8558 fix(native): show function match limitations by default (CI)
  • #8567 fix(session): guide unsupported provider recovery (CI)
  • #8575 fix(trace): disclose address-only reference scope (CI)
  • #8578 test(ghidra): check regex recovery at its owning boundary (CI)
  • #8581 fix(ghidra): explain read-only project recovery (CI)
  • #8584 fix(ghidra): clarify function annotation selectors (CI)
  • #8625 fix(artifacts): report oversized Zstandard ZIP windows as a resource limit (CI)
  • #8647 fix(rizin): keep debug targets off the debugger command stream (CI)
  • #8650 fix(verifiers): retain the Go fixture root until MCP ownership completes (CI)
  • #8670 fix(javascript): reconcile Node targets with entry assets (CI)
  • #8687 fix(kuna): keep timeout recovery from changing workers (CI)

Merge conflict and failing CI (59)

  • #1815 feat(javascript): add proof-gated js-redox deobfuscation (both)
  • #1840 fix(javascript)!: preserve Vite dependency values and uncertainty (both)
  • #2018 feat(javascript): resolve package exports and imports wildcard patterns (both)
  • #2068 feat(browser): retain worker source and runtime evidence (both)
  • #2406 feat(wasm): decode WebAssembly components offline (both)
  • #2791 docs: organize canonical documentation layout and verify new pages (both)
  • #2884 feat(browser): derive API surfaces from retained SAZ captures (both)
  • #3004 feat(adb): add UI Automator discovery, waits and actions (both)
  • #3772 fix(android): disable JVM perf data for JADX Java launches (both)
  • #3967 feat(procmon): read saved Process Monitor XML and CSV exports as Evidence (both)
  • #4362 feat(unreal): inspect Unreal pak footers and indexes (both)
  • #4532 fix(ghidra): admit recordless legacy MIPS32 carves missing section tables (both)
  • #4719 fix(setup): bound Hopper downloads by idle time instead of total duration (both)
  • #4720 fix(adb): attribute pull file refusals to the device path (both)
  • #4857 fix: clean up quality gate findings (both)
  • #4871 fix: ELF multi-architecture support and quality fixes (both)
  • #4887 Improve reverse engineering reliability, Android analysis, and binary diagnostics (both)
  • #4963 test(adb): cover push device-state refusal attribution (both)
  • #4971 docs(i18n): add Azerbaijani README and sync Turkish edition (both)
  • #5061 fix(update): refuse unverified Bun ancestor ownership (both)
  • #5230 fix(artifacts): keep readable entries of a directory with unreadable entries (both)
  • #5254 fix(macho): exact arm64e.x1 slice names and mach-o-universal format (both)
  • #5276 docs: add Urdu README translation (both)
  • #5296 fix(process): preserve observed command failures before cancellation (both)
  • #5544 fix(cli): reject invalid token-window bounds (both)
  • #5597 fix(evidence): stop offering overwrite for outputs that never overwrite (both)
  • #6124 fix(ghidra): point Windows ELF rejection to WSL2 fallback (both)
  • #6165 fix(domain): reject ELF files whose program header table runs past the end (both)
  • #6326 feat(windows): admit live SQLite, process, and window tools (both)
  • #6728 feat(ci): require live dependency security evidence for releases (both)
  • #6930 test(gpu): retain unsupported PE layout delivery regression (both)
  • #6983 fix(process): settle exits during Linux credential observation (both)
  • #6993 fix(javascript): follow Electron through aliases of Webpack externals (both)
  • #7030 feat(browser): add passive CSS variables and design token extraction (both)
  • #7096 perf(javascript): reuse semantic coverage projections (both)
  • #7186 feat(unity): inventory Addressables content catalogs (both)
  • #7216 fix(update): report Frida native module readiness (both)
  • #7248 feat(scripts): add repository integrity check (both)
  • #7264 feat(android): project declared component process and access flags (both)
  • #7339 feat(solana): add Solana sBPF program analysis domain (both)
  • #7454 test(windows): declare the native loader fixture optional header (both)
  • #7466 feat(desktop): add installable REA desktop app (both)
  • #7489 fix(native): admit retroactive flag when decoding Swift static witness tables (both)
  • #7529 fix(pe): preserve TLS templates in virtual zero padding (both)
  • #7867 fix(pcap): exclude HTTP credentials from failed command observations (both)
  • #7868 feat(elf): inspect dynamic dependencies and required symbol versions (both)
  • #8012 feat(ghidra): analyze Game Boy SM83 cartridge ROMs (both)
  • #8262 fix(mcp): name the missing closure for inline investigation Evidence (both)
  • #8376 fix(ghidra)!: preserve facts in inventory searches (both)
  • #8377 fix(mcp): qualify retained Evidence view guidance (both)
  • #8391 fix(ghidra): qualify selected project call coverage (both)
  • #8397 fix(kuna): guide inventory selector recovery (both)
  • #8406 fix(test): report caller target selection coverage (both)
  • #8413 fix(ghidra): explain read-only project edit refusals (both)
  • #8424 fix!: preserve address context resource recovery (both)
  • #8464 fix(ghidra)!: load ESP-IDF flash code in Ghidra's default address space (both)
  • #8480 docs(mcp): clarify retained evidence view support (both)
  • #8485 feat(mcp): report provider release verification in session (both)
  • #8519 fix(elf): preserve dynamic export visibility (both)
3 to 5 days since the last activity (83)

Merge conflict only (37)

  • #2136 feat(packaging): prepare a Windows portable runtime (conflicts)
  • #2362 feat(ghidra): admit plain MIPS32 PIC shared images (conflicts)
  • #2987 feat(jeb): detect JEB endpoint in setup and doctor (conflicts)
  • #2988 feat(browser): add screenshot bounds and region comparisons (conflicts)
  • #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts)
  • #3753 feat(jvm): export Vineflower sources with explicit dependencies (conflicts)
  • #3770 feat(native): inspect Windows minidump streams offline (conflicts)
  • #3773 feat(bridge): discover BYO x64dbg without launching a session (conflicts)
  • #3775 feat(native): static packer identification for PE and ELF (conflicts)
  • #3903 feat(website): polish interactions and remove em dashes (conflicts)
  • #3905 feat(cli): report MCP catalog size in doctor (conflicts)
  • #3966 feat(evidence): add literal text query to retained Evidence summaries (conflicts)
  • #4031 feat(artifacts): select extraction entries and output destination (conflicts)
  • #4133 feat(evidence): cluster inspected artifacts into families by root digest (conflicts)
  • #4139 docs(ar): synchronize README_ar.md with upstream English documentation (conflicts)
  • #4143 feat(windows): capture selected windows through owned helpers (conflicts)
  • #4172 feat(i18n): add Albanian README and website translations (conflicts)
  • #4209 docs(i18n): add Gujarati translations (conflicts)
  • #4334 test(ghidra): align fixtures with Windows host boundaries (conflicts)
  • #4367 feat(setup): add IBM Bob client registration (conflicts)
  • #4482 feat(evidence): add evidence bundle audit command and MCP tool (conflicts)
  • #4516 fix(managed): compare member bodies by nominal identity across builds (conflicts)
  • #4585 fix(browser): record dedicated worker requests through attached sessions (conflicts)
  • #4589 feat(evidence): cluster artifacts from retained Evidence references and summaries (conflicts)
  • #4591 feat(ghidra): select the loopback bridge transport on POSIX hosts (conflicts)
  • #4843 fix(domain): admit SPARC V9 (EM_SPARCV9, 43) ELF binaries (conflicts)
  • #5248 chore(android): update jadx-headless-mcp provider to 0.8.0 (conflicts)
  • #5755 fix(native): keep ELF layout independent of pwntools kernel probes (conflicts)
  • #7046 fix(capture): run without a PTY where the native preload cannot fork (conflicts)
  • #7147 fix(process): identify inaccessible Linux namespace peers (conflicts)
  • #7283 feat(setup): discover project-scoped MCP registrations in doctor and … (conflicts)
  • #7753 fix(wasm): retain rejected REA_WABT_BIN_DIRECTORY value in refusal (conflicts)
  • #7756 docs(ci): match SQLite and build-cache lane descriptions to workflows (conflicts)
  • #7772 feat(android): pin jadx-headless-mcp 0.8.0 (conflicts)
  • #7783 feat(native): inspect Linux BTF types and BTF.ext records (conflicts)
  • #7797 fix(cli): publish partial Evidence to --evidence_output on failure (conflicts)
  • #8077 fix(cli): publish partial Evidence bundle on failure when evidence_output is set (conflicts)

Failing CI only (9)

  • #3356 test(cli): cover Frida argument admission and spawn ordering (CI)
  • #3496 feat(artifacts): read compiled AndroidManifest.xml attributes (CI)
  • #3750 Lunz Research Group Apresents: REA-LUNZ-CAUSAL-ENGINE (CI)
  • #3810 docs: add a static VB6 native OCX investigation workflow (CI)
  • #4083 perf(cli): skip command schemas for standalone version queries (CI)
  • #4536 fix(javascript): treat exact location-only moves as unchanged (CI)
  • #4611 docs: add a .NET static-analysis walkthrough (CI)
  • #4675 feat(js): resolve class instance method calls in semantic graphs (CI)
  • #4807 fix(cli): stream default TOON results past the string limit (CI)

Merge conflict and failing CI (37)

  • #1704 docs(website): add reproducible starter demos (both)
  • #1732 fix(setup): preserve user fields on an existing REA client entry (both)
  • #2185 fix(setup): show non-interactive setup results in a terminal (both)
  • #2264 feat(ios): Add iOS app support - add jailbroken runtime debugging lanes (both)
  • #2414 feat(setup): support private Claude Code project registrations (both)
  • #2465 fix(javascript): preserve intrinsic invocation read identity (both)
  • #2701 docs(skills): add source attribution and evidence handoff guidance (both)
  • #2862 docs: add Hindi (हिन्दी) translation of README (both)
  • #2878 fix(browser): preserve explicit URL references and endpoint evidence (both)
  • #2904 feat(ghidra)!: preserve paged warnings and require observed comparison coverage (both)
  • #2919 test(ghidra): verify MIPS declaration and cleanup boundaries (both)
  • #2986 fix(javascript): global augmentation kind and additional web/browser inspections (both)
  • #3030 Fix/android runtime fallback (both)
  • #3317 feat(managed): decode signature-owned custom attribute arguments (both)
  • #3404 feat(artifacts): recognize CFB containers with explicit coverage limits (both)
  • #3433 feat(javascript): recover synchronous child-process creation (both)
  • #3486 fix(setup): default Claude Desktop to compact MCP schemas (both)
  • #3558 fix(hopper): normalize cross-platform launcher paths (both)
  • #3589 Feat/pri resources (both)
  • #3659 fix(security): harden archive and Hopper probes (both)
  • #3817 feat(ghidra): select an existing-project program inside a project folder (both)
  • #3837 test(browser): cover invalid WebMCP annotation payloads (both)
  • #3968 feat(setup): add MiniMax Code client (both)
  • #3976 feat(go)!: inspect compiler-declared function entries (both)
  • #4061 feat(windows): support Windows ARM64 native controls and provider boundaries (both)
  • #4161 feat(mcp): support real-time operation progress and ETA notifications (both)
  • #4224 fix(browser): preserve uncertainty for omitted initiator URLs (#4211) (both)
  • #4317 fix(apple): retain keyed archive scalar object kinds (both)
  • #4345 fix(cleanup): restore shared ownership across browser, capture, and adb boundaries (both)
  • #4456 fix(browser): record dedicated worker requests in page inspection (both)
  • #4491 docs: add Urdu (اردو) README translation (both)
  • #4523 fix(setup): preserve exact Windows AppData roots (both)
  • #4559 fix(native): scale NativeAOT work budget and resolve base types by index (both)
  • #4656 fix(javascript): scope candidate this event receivers (both)
  • #4716 fix(javascript): bound alias-cycle call-target and returned-reference expansion (both)
  • #5368 feat(browser): wake or classify discarded CDP page targets before inspection (both)
  • #5712 docs(skill): unify reverse-engineering and UI/UX workflows (both)
6 or more days since the last activity (53)

Merge conflict only (17)

  • #2693 fix(cli): preserve mcp doctor output choices on argument errors (conflicts)
  • #2845 test(browser): cover DOM relation whitespace and empty values (conflicts)
  • #3124 docs(skill): flag hidden-window throttling in passive browser observation (conflicts)
  • #3429 feat(binary): recognize XEX2 and PowerPC PE basefiles (conflicts)
  • #3513 fix(browser): keep an undecodable Electron worker target uncertain (conflicts)
  • #3529 feat(reconstruction): verify visual screenshot claims (conflicts)
  • #3697 Feat/claude code codex plugin (conflicts)
  • #3742 feat(experiments): prototype Electron IPC effect attribution (conflicts)
  • #3762 Feat/lucas profile roadmap (conflicts)
  • #3769 Fix/review feedback 3762 (conflicts)
  • #3818 feat(ghidra): apply a caller-selected PDB that matches the target (conflicts)
  • #3835 feat(managed)!: expose file-backed field initialization data (conflicts)
  • #4198 fix(ghidra): prevent loader relocations from constant folding (conflicts)
  • #4911 Feat/snes rom 65816 (conflicts)
  • #4924 test(http3): verify reset and partial-response capture semantics (conflicts)
  • #6089 fix(adb): preserve filesystem meaning of host paths (conflicts)
  • #7004 feat(doctor): report the configured workflow beside an audit-wide result (conflicts)

Failing CI only (9)

  • #2830 fix(javascript): resolve spread and constant kill-signal arguments (CI)
  • #2870 perf(ghidra): resolve Swift select provenance once per function (CI)
  • #2969 fix(hopper): support WSLg socket symlinks for private displays (CI)
  • #3043 Configure the Cursor Cloud Agent environment (CI)
  • #3074 docs: clarify automated agent development setup (CI)
  • #3258 Improve page template UI: responsive layout, dark mode, reading progress (CI)
  • #3339 test(javascript): cover missing package-manifest companions staying unknown (CI)
  • #3411 docs(skills): add REA repository analysis workflow (CI)
  • #3495 feat(android): check split APK set consistency from manifest facts (CI)

Merge conflict and failing CI (27)

  • #1903 fix(adb): project actionable pm path refusal details (both)
  • #1948 feat(ghidra): add bounded PS-X EXE static analysis (both)
  • #1971 feat(evaluation): run agent evaluation against Claude Code and Gemini CLI (both)
  • #2025 feat(ghidra): admit caller-selected matching dSYM companions (both)
  • #2052 docs(skill): pin the package runner and treat target content as untrusted (both)
  • #2092 feat(javascript)!: bound semantic graphs by serialized Evidence bytes (both)
  • #2093 feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine (both)
  • #2094 feat(javascript): fold constant values and recover Electron boundaries through wrappers (both)
  • #2097 fix(javascript): admit measured transfer retention in parent result budget (both)
  • #2407 feat(website): add Central Kurdish (Sorani) locale (both)
  • #2435 feat(managed): bind Portable PDB sequence points to selected methods (both)
  • #2717 feat(java): inspect archives and decompile selected classes (both)
  • #2771 fix(ghidra): keep unreported Java bitness unknown (both)
  • #2819 feat(windows): add REA desktop GUI (both)
  • #2850 fix(android): require explicit invoke coverage state (both)
  • #2887 feat(native): decode RT_STRING and RT_VERSION payloads in PE resources (both)
  • #2922 fix(filesystem): PRoot compatibility for sameRegularFileState (both)
  • #2923 feat(ghidra): admit bounded m68k ELF analysis through Ghidra (both)
  • #3028 feat(cli): run ordered tool batches in one provider session (both)
  • #3029 fix(ghidra): recover registered Borland SEH handler gaps (both)
  • #3037 docs(skill): add optional public-source research guidance (both)
  • #3048 fix(android): decode guardian readiness across UTF-8 chunks (both)
  • #3100 feat(setup): support OpenClaw native MCP and active profiles (both)
  • #3129 feat(ghidra): admit ELF and thin Mach-O targets on Windows (both)
  • #3492 fix(application): surface web resource cleanup errors via tagged error algebra (both)
  • #3547 docs(i18n): add Devanagari CSS, Hindi README base, and initial website translations (both)
  • #5622 Rama (both)
Pull requests where a maintainer asked for changes (6)

A maintainer asked for changes on these 6 at some point. They are also in the groups above. I did not check whether the author has updated them since.

  • #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts)
  • #3513 fix(browser): keep an undecodable Electron worker target uncertain (conflicts)
  • #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts)
  • #4143 feat(windows): capture selected windows through owned helpers (conflicts)
  • #4172 feat(i18n): add Albanian README and website translations (conflicts)
  • #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts)
Moved on since opening (475)
  • #1804 feat(setup): register Kimi Code client with compact schema profile; closed 25 Oct without a merge
  • #1959 feat(process): add owned debugger shutdown lifecycle; no conflict now and checks passing
  • #1960 fix(reverse)!: retain cleanup and session ownership for local inspection; closed 25 Oct without a merge
  • #1961 fix(gdb)!: preserve interrupt and provider cleanup ownership; no conflict now and checks passing
  • #2041 fix(javascript): preserve builtin effects at their read sites; no conflict now and checks passing
  • #2124 feat(domain): add opt-in address-normalized function text views; closed 26 Oct without a merge
  • #2142 docs(i18n): add Bangla (bn) README and website translation; no conflict now and checks passing
  • #2148 feat(mcp): accept common argument-name aliases for procedure and search tools; no conflict now and checks passing
  • #2150 feat(ghidra): open pre-imported projects with -process instead of re-importing; closed 26 Oct without a merge
  • #2243 docs(readme): add Georgian (ka) translation; closed 26 Oct without a merge
  • #2268 docs: add Central Kurdish (Sorani) README translation; closed 26 Oct without a merge
  • #2314 test(artifacts): exercise ASAR header admission boundaries; closed 25 Oct without a merge
  • #2331 feat(diagnostics): report a byte entropy profile for one local file; merged 22 Oct
  • #2358 feat(ghidra): select a pre-imported project with -process; closed 26 Oct without a merge
  • #2433 feat(artifacts): inventory and extract PyInstaller archives; merged 21 Oct
  • #2492 feat(setup): support CodeBuddy as a setup client; no conflict now and checks passing
  • #2630 feat(cli): expose caller-selected reference-source path exclusions; no conflict now and checks passing
  • #2636 feat(harness): add a build-free REA bundle and guarded distribution; closed 24 Oct without a merge
  • #2676 fix(native): support configurable REA_PWNTOOLS_MAX_INPUT_BYTES for large artifacts; closed 25 Oct without a merge
  • #2702 fix(javascript): preserve Node package lookup and artifact path identity; closed 29 Oct without a merge
  • #2731 docs(go): clarify cumulative build-info search budget; merged 21 Oct
  • #2736 feat: add FreeBuff agent support for REA setup; merged 25 Oct
  • #2800 feat(native): retain LLDB source coordinates and verify Pascal calls; no conflict now and checks passing
  • #2801 test(agent): grade Notes export facts and track fixture changes; closed 25 Oct without a merge
  • #2815 feat(plugins): ship release-pinned Claude Code and Codex plugins; closed 27 Oct without a merge
  • #2816 feat(artifacts): inspect classic iNES container regions; merged 31 Oct
  • #2817 test(docs): refresh README link drift mutations; closed 26 Oct without a merge
  • #2839 fix(browser): classify malformed screenshot payloads as protocol errors; closed 26 Oct without a merge
  • #2866 docs: add Greek (Ελληνικά) translation of README; closed 23 Oct without a merge
  • #2868 fix(adb): drop the remaining exclusivity claim from push guidance; no conflict now and checks passing
  • #2872 fix(captures): redact normalized HAR numeric values; closed 23 Oct without a merge
  • #2876 fix(web-capture): bound the mitmproxy headline facet index; no conflict now and checks passing
  • #2891 perf(javascript): cut redundant key encoding in semantic member-mutation traversal; closed 23 Oct without a merge
  • #2905 feat(mcp): keep compact input schemas within ten nesting levels; closed 25 Oct without a merge
  • #2961 fix(security): bound scenario retention and loopback admission; closed 21 Oct without a merge
  • #2963 fix(javascript): recover RPC link URLs declared with template literals; no conflict now and checks passing
  • #2978 feat(electron): report custom URL protocol registrations; merged 30 Oct
  • #3003 feat(plugin): bundle Cursor with REA runtime and skill; no conflict now and checks passing
  • #3011 fix(hopper): release a Spotlight not-found launch from the signed helper; closed 26 Oct without a merge
  • #3023 feat(config): persist provider settings in a user config file; no conflict now and checks passing
  • #3024 feat(evm): inspect exact Solidity compiler artifacts; no conflict now and checks passing
  • #3026 feat(mcp): scope advertised tools by family through REA_MCP_TOOL_FAMILIES; closed 26 Oct without a merge
  • #3045 fix(evaluation): require explicit REA server identity for routing credit; closed 26 Oct without a merge
  • #3071 Build; closed 25 Oct without a merge
  • #3225 fix(managed): report InitLocals comparison changes; closed 23 Oct without a merge
  • #3263 test(process): cover cancellation during obstructed root lookup; closed 30 Oct without a merge
  • #3288 fix(ledger): map non-canonical bundle TypeError to AnalysisInputError; closed 26 Oct without a merge
  • #3290 fix(artifacts): classify localized DMG verification failures; closed 25 Oct without a merge
  • #3293 feat(analysis-view): select HAR MIME types in capture previews; closed 29 Oct without a merge
  • #3407 refactor(pcap): give TShark selection and version admission one owner; merged 22 Oct
  • #3425 feat(analysis-view): locate unavailable response facts by record; closed 28 Oct without a merge
  • #3440 fix(security): pin CI actions, protect Hopper xauth and downloads, flag old apktool; closed 25 Oct without a merge
  • #3444 fix(process): bound bridge response framing; no conflict now and checks passing
  • #3455 fix(wasm): preserve local matches for dotted selected paths; closed 23 Oct without a merge
  • #3458 fix(adb): verify pushes to long device paths; closed 29 Oct without a merge
  • #3463 test(artifact): cover multiple inspection inventory substeps; closed 26 Oct without a merge
  • #3468 fix(target): report targets held open by another process as retryable; no conflict now and checks passing
  • #3493 fix(browser): reserve the initial scenario step id from action inputs; merged 21 Oct
  • #3498 fix(reference): preserve root permission failures; closed 26 Oct without a merge
  • #3525 fix(mcp): recover structured tool arguments clients serialize as JSON text; no conflict now and checks passing
  • #3544 fix(electron): forward selected XAUTHORITY to owned capture environment; closed 25 Oct without a merge
  • #3550 fix(javascript): keep parent budget exhaustion from advising more memory; closed 30 Oct without a merge
  • #3559 fix(electron): block and record shell.trashItem; closed 25 Oct without a merge
  • #3562 fix(reference): preserve physical symlink targets; closed 27 Oct without a merge
  • #3583 fix(native): check every slice of a signed universal Mach-O; closed 25 Oct without a merge
  • #3600 fix(contracts): reject NUL bytes in objdump and rizin local path inputs; merged 24 Oct
  • #3602 feat(windows): admit arm64 hosts for the bundled native controls; no conflict now and checks passing
  • #3604 refactor(go): parse module records once at the build-info owner; closed 25 Oct without a merge
  • #3657 docs: add Bangla (বাংলা) README translation; closed 28 Oct without a merge
  • #3658 fix(artifacts): recognize leading JSON whitespace in ASAR headers; closed 25 Oct without a merge
  • #3660 fix(managed): keep native-boundary inspection alive for very large issue inventories; closed 24 Oct without a merge
  • #3754 fix(jeb): reconnect after stale MCP sessions; no conflict now and checks passing
  • #3760 fix(windows): name the missing native artifact and its recovery path on source checkouts; no conflict now and checks passing
  • #3761 docs(firmware): disclose procps ps prerequisite; closed 26 Oct without a merge
  • #3787 feat(artifacts): inspect and extract .NET single-file bundles; merged 29 Oct
  • #3802 fix(reconstruction): evaluate declared dependency closure and risks; closed 26 Oct without a merge
  • #3806 fix(mcp): normalize compact schemas for strict gateways; merged 25 Oct
  • #3828 fix(native): trace UI actions for all receiver kinds; closed 23 Oct without a merge
  • #3834 fix(process): reject the proto environment name the PTY backend drops; closed 24 Oct without a merge
  • #3841 fix(javascript): attribute service workers only to the navigator global; closed 21 Oct without a merge
  • #3899 feat(doctor): diagnose firmware integration readiness; no conflict now and checks passing
  • #3940 fix(javascript): preserve proven WebSocket endpoint identities; closed 31 Oct without a merge
  • #3969 feat(website): new REA identity and a calculator teardown redesign; no conflict now and checks passing
  • #3994 fix: exclude credential header values from header allocation budget preflight; closed 25 Oct without a merge
  • #3995 fix(mcp): advertise a screenshot example with a valid PNG checksum; closed 25 Oct without a merge
  • #3996 fix(js): ignore unrelated join/resolve for Electron preload paths; closed 24 Oct without a merge
  • #4004 fix(managed): reject runtime locations on managed static evidence; closed 24 Oct without a merge
  • #4014 fix(browser): compare retained script source identities; closed 25 Oct without a merge
  • #4020 fix(javascript): preserve structural fingerprint semantics; closed 21 Oct without a merge
  • #4021 fix(sqlite): normalize index table identifiers using ASCII folding; no conflict now and checks passing
  • #4028 docs(mcp): narrow WorkBuddy/CodeBuddy 11133 guidance to full override; no conflict now and checks passing
  • #4036 test(process): cover endpoint-only port normalization; closed 26 Oct without a merge
  • #4037 fix(contracts): restore canonical mobile graph examples; closed 24 Oct without a merge
  • #4039 feat(clients): register ggcode during setup; no conflict now and checks passing
  • #4040 fix(browser): preserve frame identity across captures; merged 23 Oct
  • #4047 fix(plist): preserve real character data; closed 27 Oct without a merge
  • #4053 fix(reference): preserve imports with symlinks into unreadable subtrees; closed 21 Oct without a merge
  • #4060 fix(reference-source): keep a partial graph for symlinks into unenumerated directories; closed 21 Oct without a merge
  • #4073 fix(adb): normalize absent installer package sentinels; merged 21 Oct
  • #4103 fix(providers): report provider-selection diagnostics when the selected provider refuses its profile; merged 22 Oct
  • #4144 fix(managed): match Windows module paths independently of the host; closed 24 Oct without a merge
  • #4145 docs(hermes): explain nested-home routing and preview limits; merged 27 Oct
  • #4148 feat(radare2): prototype transports and analyst capabilities; no conflict now and checks passing
  • #4173 fix(javascript): prune unreachable constant return branches; closed 25 Oct without a merge
  • #4200 feat(ida): verify headless caller relationships with call graphs; no conflict now and checks passing
  • #4214 fix(artifacts): reject directory targets for source maps (#4212); closed 24 Oct without a merge
  • #4220 fix(native): map Go and Rust ppc reports to the powerpc subject; closed 25 Oct without a merge
  • #4221 fix(reference): select a package main for trailing-slash requires; closed 24 Oct without a merge
  • #4222 fix(website): translate coding agent as an AI assistant in Russian and Ukrainian; closed 26 Oct without a merge
  • #4259 fix(javascript): preserve optional native-addon bindings; closed 25 Oct without a merge
  • #4283 feat(mcp): add native vulnerability review prompt; closed 23 Oct without a merge
  • #4285 feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources; no conflict now and checks passing
  • #4286 fix(ida): keep omitted callee truncation markers unknown; merged 21 Oct
  • #4319 fix(swift): retain uncertainty for substituted extension contexts; closed 25 Oct without a merge
  • #4323 fix(javascript): resolve relative ESM backslash paths; merged 28 Oct
  • #4333 fix(artifact): accept POSIX names beginning with letter-colon on non-Windows hosts; closed 26 Oct without a merge
  • #4351 fix(captures): scope HAR HTTP interpretation to entries; merged 22 Oct
  • #4352 fix(artifacts): reconcile ARM32 Mach-O slice names by subtype; merged 22 Oct
  • #4359 fix(native): report every slice of a signed universal Mach-O signature; closed 24 Oct without a merge
  • #4360 perf(schema): reduce retained integer validator allocations; merged 22 Oct
  • #4363 fix(javascript): grow a binding's returned-reference projection once per chain; closed 24 Oct without a merge
  • #4386 refactor(ghidra): share native AOT entry class constant; closed 26 Oct without a merge
  • #4391 fix(browser): bound observe_web_session windows to the Node.js timer limit; closed 21 Oct without a merge
  • #4401 fix(reference): retain static template require dependencies; closed 22 Oct without a merge
  • #4408 fix(enhanced): validate get_objc_protocols direct-call input; closed 24 Oct without a merge
  • #4409 fix(reference): retain exact CommonJS template require specifiers; closed 24 Oct without a merge
  • #4410 fix(inspector): count unresolved locations after script deduplication; closed 25 Oct without a merge
  • #4413 fix(browser): retain bundle default origin scope; merged 22 Oct
  • #4420 fix(managed): authorize signature kind against its metadata row kind; closed 26 Oct without a merge
  • #4422 fix(artifacts): preserve binary keyed archive integers above Int64.max; closed 24 Oct without a merge
  • #4424 perf(mcp): defer analysis runtime after catalog discovery; merged 22 Oct
  • #4430 fix(firmware): reject staged files cut off at the per-file limit; no conflict now and checks passing
  • #4442 fix(evidence): accept legacy null coverage identity; closed 24 Oct without a merge
  • #4464 fix(rizin): bound recent frame history by UTF-8 bytes; closed 22 Oct without a merge
  • #4472 fix(native): reject empty Swift protocol or type names in conformance descriptors; closed 26 Oct without a merge
  • #4480 docs(i18n): correct Korean Aegis analysis guidance; closed 23 Oct without a merge
  • #4493 fix: resolve critical lifecycle, admission, and analysis defects (#4475, #4483, #4490, #4494, #4495, #4509); closed 24 Oct without a merge
  • #4503 fix(ownership): retain failed artifact and native handles; closed 25 Oct without a merge
  • #4510 fix(javascript): preserve raw ESM path classification; closed 21 Oct without a merge
  • #4519 fix(browser): keep Termux Chromium profiles on a writable temp directory; no conflict now and checks passing
  • #4529 fix(electron): exclude scripts from unauthorized frames; closed 25 Oct without a merge
  • #4548 fix(native): reject empty Objective-C ivar names in class metadata; closed 25 Oct without a merge
  • #4566 docs(i18n): add the Linux procps prerequisite to translated READMEs; closed 25 Oct without a merge
  • #4570 docs(i18n): sync Go, SQLite and Bun update facts in translated READMEs; closed 26 Oct without a merge
  • #4572 fix(reference): keep the raw query and fragment on unresolved ESM paths; no conflict now and checks passing
  • #4576 fix(mcp): require an absolute input_path for JavaScript application analysis; closed 24 Oct without a merge
  • #4579 fix(adb): refuse push on ambiguous existence probe failure (#4574); closed 25 Oct without a merge
  • #4583 fix(ghidra): discover Homebrew keg-only openjdk candidates on macOS (#4556); closed 24 Oct without a merge
  • #4645 fix(ida): retain analysis profile in partial operation evidence; merged 21 Oct
  • #4646 fix(javascript): keep directory-form HTML URL references distinct from files; merged 22 Oct
  • #4651 docs(cli): list Kuna as a doctor provider; closed 25 Oct without a merge
  • #4655 fix(adb): preserve device and file error identity; closed 21 Oct without a merge
  • #4696 fix(apktool): fall back to packageInfo when manifest package is omitted; no conflict now and checks passing
  • #4739 [Bug] Signature inspection returns success after cancellation during final cleanup; closed 21 Oct without a merge
  • #4751 fix(lldb): retain journal descriptor cleanup ownership; closed 25 Oct without a merge
  • #4769 docs: repair out-of-tree links so the documentation build passes; closed 23 Oct without a merge
  • #4773 docs: add open-source decompiler selection guide; now a draft
  • #4784 fix(javascript): preserve CommonJS exports through TypeScript wrappers; no conflict now and checks passing
  • #4790 fix: prevent source maps targeting directories; closed 25 Oct without a merge
  • #4826 feat(python): inspect CPython pyc headers and marshal code objects; merged 22 Oct
  • #4829 fix(errors): separate recovery actions from failure messages; no conflict now and checks passing
  • #4830 feat(pe): inspect Authenticode certificate tables; merged 22 Oct
  • #4831 feat(skill): add opt-in Coordo evidence handoffs; closed 1 Nov without a merge
  • #4833 feat(erlang): inspect BEAM IFF chunks and tables; merged 22 Oct
  • #4837 feat(elf): inspect PT_NOTE and SHT_NOTE tables; merged 22 Oct
  • #4884 fix(mcp): close the session when a signal interrupts startup; closed 24 Oct without a merge
  • #4897 fix(update): bound update subprocess output collection (#4888); no conflict now and checks passing
  • #4903 fix(setup): tell MSIX Claude Desktop's process view from any private roaming file; merged 22 Oct
  • #4915 fix(javascript): attribute call-path unknowns only where the walk can reach Electron; no conflict now and checks passing
  • #4969 Fix typo in README and add repository description; closed 26 Oct without a merge
  • #4970 docs(companions): propose opt-in integration contract; no conflict now and checks passing
  • #4979 fix(native): preserve Mach-O install-name whitespace; merged 22 Oct
  • #4988 ci(windows): run the caller path separator regression in the Windows lane; no conflict now and checks passing
  • #4997 fix(javascript): name the exhausted heap and max_heap_mb in heap failures; closed 21 Oct without a merge
  • #5000 feat(skill): coordinate evidence-led REA investigations; closed 1 Nov without a merge
  • #5009 docs: clarify JEB Linux CE MCP launch; closed 25 Oct without a merge
  • #5019 test(update): isolate CLI subprocess deadlines; merged 21 Oct
  • #5020 fix(jeb): preserve artifact path in project-open refusals; closed 25 Oct without a merge
  • #5023 feat(kuna): admit Windows PE images through the verified provider lane; no conflict now and checks passing
  • #5025 feat(android): project a structured manifest component inventory; merged 24 Oct
  • #5029 feat(cli): accept JavaScript source selections from a JSON array or file; merged 24 Oct
  • #5044 feat(docs): add VitePress dead-link verification to CI workflow (#5030); closed 25 Oct without a merge
  • #5053 fix(setup): treat empty COPILOT_HOME as unset; closed 25 Oct without a merge
  • #5054 fix(setup): admit only syntax Gemini CLI loads in settings.json; closed 29 Oct without a merge
  • #5064 feat(plugin): ship a Claude Code plugin for the MCP server; closed 22 Oct without a merge
  • #5065 test(process): reduce macOS wall-clock capture test flakiness; closed 26 Oct without a merge
  • #5066 Fix README.md filename typo; closed 26 Oct without a merge
  • #5067 docs(gemini): diagnose model schema rejection separately from MCP setup; closed 31 Oct without a merge
  • #5069 feat(rust): read cargo-auditable dependencies from WebAssembly modules; no conflict now and checks passing
  • #5115 fix(setup): accept and preserve Codex per-tool settings (#3862, #3863); closed 25 Oct without a merge
  • #5116 test(electron): isolate active provider lifecycle tests; no conflict now and checks passing
  • #5119 fix(cli): clamp exhausted failure token-window start to the token total; closed 25 Oct without a merge
  • #5120 fix(setup): keep client and skill setup when the Hopper install fails; merged 22 Oct
  • #5123 fix(apple): report empty asset inventory as complete at any offset; closed 21 Oct without a merge
  • #5125 fix(artifacts): keep a member's own name when its logical path is NFC; closed 26 Oct without a merge
  • #5127 fix(artifacts): preserve original Unicode spelling when NFC normalization changes a logical path; closed 26 Oct without a merge
  • #5133 fix(managed): distinguish truncated compressed signature integers; closed 25 Oct without a merge
  • #5139 perf(javascript): prune typed-array element reference escapes; merged 22 Oct
  • #5143 docs:增加文本中部分文字(fixes #1); closed 26 Oct without a merge
  • #5145 feat(clients): support Antigravity CLI with shared-registration lifecycle coverage; no conflict now and checks passing
  • #5152 fix(hermes): preserve external YAML anchor consumers; merged 27 Oct
  • #5156 fix(analysis): preserve execution analysis profile in composed Evidence; closed 24 Oct without a merge
  • #5157 fix(evm): preserve advertised detail schema metadata; closed 24 Oct without a merge
  • #5167 feat(cli): summarize managed members with durable Evidence paging; merged 22 Oct
  • #5203 fix(mcp): advertise empty-string literals as typed strings; closed 25 Oct without a merge
  • #5204 fix(android): select Windows JADX java.exe from PATH, not the working directory; closed 24 Oct without a merge
  • #5210 fix(objdump): scope debug-link warnings to DWARF inspections; closed 21 Oct without a merge
  • #5226 docs: describe AOT image buffer as declared size plus one byte; closed 25 Oct without a merge
  • #5227 fix(mcp): omit empty-string schema literals; closed 25 Oct without a merge
  • #5228 fix(apple): classify keyed-archive objects by declared superclasses; merged 22 Oct
  • #5231 fix(cli): clamp exhausted failure token windows; closed 25 Oct without a merge
  • #5233 fix(verify): clean up ADB transfer probe; closed 26 Oct without a merge
  • #5235 fix(windows): align path handling across Hopper, Electron, and ADB; merged 22 Oct
  • #5239 fix(evm): clarify worker address space as profile ceiling in limitations; closed 25 Oct without a merge
  • #5247 fix(cli): keep debug-with-rizin success status after confirmed fallback cleanup; closed 25 Oct without a merge
  • #5260 fix(apple): avoid truncation flag for empty catalogs; closed 21 Oct without a merge
  • #5262 fix(hopper): bound bridge request frames like the Cutter bridge; merged 22 Oct
  • #5275 fix(hopper): clarify version-mismatched unsupported builds; no conflict now and checks passing
  • #5278 docs(errors): include Omarchy and current host-support messages in error catalogue (#5078); merged 21 Oct
  • #5285 fix(browser): bound initial navigation when command_timeout_ms is omitted; closed 29 Oct without a merge
  • #5301 fix(sqlite): bind returned cleanup errors to their exact root and worker owners; closed 25 Oct without a merge
  • #5304 ci: publish OpenSSF Scorecard results; closed 26 Oct without a merge
  • #5307 fix(native): report unresolved native UI PID and window selections as invalid input; closed 25 Oct without a merge
  • #5309 feat(managed)!: show readable type names in member signatures; merged 29 Oct
  • #5312 fix(managed): retain type discovery after member limits; merged 22 Oct
  • #5348 feat(firmware): attribute hardware MMIO peripheral memory regions in native disassembly; merged 22 Oct
  • #5351 feat(environment)!: serve the environment state by default; merged 21 Oct
  • #5352 feat(environment): render more read tools from the state and describe responses; merged 21 Oct
  • #5359 feat(macho): report per-slice encryption status in inspect_macho; merged 29 Oct
  • #5365 test(sqlite): keep incomplete cleanup primary over late cancellation; merged 21 Oct
  • #5366 docs(cli): complete the cancellation-routing command list; closed 26 Oct without a merge
  • #5374 fix(gdb): preserve the caller's abort reason when startup is cancelled; closed 21 Oct without a merge
  • #5375 fix(gdb): keep a failed startup retained for cleanup out of ready state; closed 21 Oct without a merge
  • #5382 fix(gdb): keep the caller's abort reason when startup cancels; closed 21 Oct without a merge
  • #5387 fix(javascript): resolve preceding exported variable initializers and computed method keys; merged 27 Oct
  • #5389 Revise tagline in README for emphasis; closed 26 Oct without a merge
  • #5392 fix(ghidra): publish the stable launcher root when it proves the install; closed 21 Oct without a merge
  • #5410 fix(objdump): scope debug-link caveat to DWARF; closed 24 Oct without a merge
  • #5425 fix(ghidra): treat format-specific disabled analyzers as not applicable; merged 22 Oct
  • #5427 fix(adb): read the package id from appId on Android 16; closed 25 Oct without a merge
  • #5428 Fix/javascript source selection limitations; closed 26 Oct without a merge
  • #5430 fix(native): declare filesystem write effect for inspect_signature; closed 25 Oct without a merge
  • #5432 fix(mcp): report duplicate unknowns accurately; closed 21 Oct without a merge
  • #5471 fix(cli): restore documented guidance for argument validation errors; closed 24 Oct without a merge
  • #5478 test(managed): retain repeated member-site coverage; closed 30 Oct without a merge
  • #5491 fix(mcp): refuse a one-element initialize batch without evicting the session; closed 25 Oct without a merge
  • #5495 fix(artifacts): distinguish non-directory output paths from identity changes; closed 25 Oct without a merge
  • #5508 fix(setup): preserve explicit clients with all-detected selection; merged 22 Oct
  • #5509 fix(ghidra): keep the session transcript out of bridge failure replies; closed 29 Oct without a merge
  • #5514 fix(cli): print compact mcp doctor JSON when stdout is redirected; merged 22 Oct
  • #5518 docs(web-bundle): describe objectValue as a named-property lookup; closed 21 Oct without a merge
  • #5519 docs(errors): record the implemented process-input read diagnostic; closed 23 Oct without a merge
  • #5539 fix(gdb): keep inferior-tty verification for read-only queries; no conflict now and checks passing
  • #5545 feat(native-api): add varargs field to inspect_native_api boundary; no conflict now and checks passing
  • #5548 fix(native): remove completed signing capture limitation; merged 21 Oct
  • #5555 docs(artifacts): clarify unsupported DMG extraction; merged 21 Oct
  • #5563 fix(apple): attribute object-budget omissions to the object budget; closed 21 Oct without a merge
  • #5564 fix(sqlite): name the selected path in malformed-database errors; merged 21 Oct
  • #5565 fix(kuna): reject a dangling cache root link in doctor; closed 21 Oct without a merge
  • #5566 fix(native): keep per-input demangle outcomes when swift-demangle skips _; closed 21 Oct without a merge
  • #5567 fix(electron): report fixed fuse reader bounds as non-retryable; closed 21 Oct without a merge
  • #5569 fix(apple): decode NIBArchive boolean value types with the correct polarity; closed 21 Oct without a merge
  • #5570 fix(signals): report rejected sigrok selectors as invalid input; merged 21 Oct
  • #5571 fix(artifacts): report a stable symlink loop as a path resolution failure; merged 21 Oct
  • #5572 fix(artifacts): keep DMG root observations when the image is already attached; closed 21 Oct without a merge
  • #5577 fix(desktop): classify rejected desktop roots as target failures; merged 21 Oct
  • #5578 fix(cli): reject negative and fractional token window values; closed 25 Oct without a merge
  • #5579 fix(browser): keep cancellation for scenario captures cancelled during startup; closed 21 Oct without a merge
  • #5581 fix(environment): report later bundle write failures as host failures; merged 21 Oct
  • #5582 fix(apple): trace LC_LAZY_LOAD_DYLIB_INFO lazy dylib dependencies; closed 20 Oct without a merge
  • #5583 fix(swift): match legacy runtime names by format, not a _Tt substring; closed 21 Oct without a merge
  • #5587 fix(process): bound output draining after a stoppable command's grace; closed 20 Oct without a merge
  • #5588 fix(diagnostics): name fixed inspection budgets in refusal recovery; closed 21 Oct without a merge
  • #5591 fix(ida): fail doctor readiness for FIFO registrations and unusable workspace roots; closed 20 Oct without a merge
  • #5592 fix(artifacts): stop offering integrity-policy retries for checksum-invalid DMGs; closed 21 Oct without a merge
  • #5594 fix(javascript): carry a directly returned value's literal to its return site; closed 21 Oct without a merge
  • #5596 fix(cli): report malformed output values in the selected structured format; closed 25 Oct without a merge
  • #5599 fix(mcp): align trace feature description with result; closed 25 Oct without a merge
  • #5600 feat(environment): apply evidence-gated write effects to the served state; merged 22 Oct
  • #5602 fix(cli): route analyze based on bundle layout, not directory name suffix; closed 24 Oct without a merge
  • #5612 fix(native): keep .. after directory symlinks in selected plist paths; closed 24 Oct without a merge
  • #5618 fix(kuna): reject version/digest mismatch from replaced executable; closed 25 Oct without a merge
  • #5629 feat(cli)!: export row-oriented results as JSON Lines; merged 23 Oct
  • #5639 fix(browser): exclude replayed lifecycle milestones from session activity; closed 20 Oct without a merge
  • #5644 fix(observation): keep incomplete cancellation observations; merged 20 Oct
  • #5645 fix(process): retain compiler roots after bounded output drain; closed 21 Oct without a merge
  • #5660 feat(analysis)!: default function MCP output to retained summaries; merged 24 Oct
  • #5662 feat(ghidra): bound one procedure's decompile without closing the session; merged 23 Oct
  • #5664 feat(analysis-view): share templated positions across manifest tools; merged 21 Oct
  • #5672 fix(artifacts): handle ASAR cancellation before output consumption; no conflict now and checks passing
  • #5699 feat(environment): compare an environment with probe captures of its application; merged 22 Oct
  • #5754 fix(native): keep recorded-core note types owner-qualified; closed 25 Oct without a merge
  • #5764 docs(native): explain resource-only bundle admission; no conflict now and checks passing
  • #5776 build(deps): update vite to 8.3.4 for launch-editor advisories; closed 25 Oct without a merge
  • #5778 fix(native): reject mixed dyld refusal diagnostics; merged 27 Oct
  • #5785 feat(il2cpp): link generic method instances behind --generic-instances; merged 24 Oct
  • #5787 feat(environment): list every entity on a list's whole lines; merged 22 Oct
  • #5788 fix(native): admit thin arm64_32 Mach-O targets for static inspection; merged 22 Oct
  • #5790 fix(mcp): stop advertising an unreturned operation count for trace_feature; closed 25 Oct without a merge
  • #5793 fix(mcp): report Linux-only integrations as unsupported_host off their hosts; merged 22 Oct
  • #5794 feat(binary-ninja): add GUI MCP analysis provider; no conflict now and checks passing
  • #5800 feat(environment): answer list filters, search, sorting and paging from the state; merged 22 Oct
  • #5869 fix(javascript): omit unselected-source limitation when every source is selected; closed 25 Oct without a merge
  • #5888 fix(native): keep Ghidra data labels out of Objective-C class names; closed 25 Oct without a merge
  • #5918 fix(model): admit safetensors header lengths that resemble pickle markers; merged 22 Oct
  • #5927 fix(reference)!: honor nested .gitignore files; closed 24 Oct without a merge
  • #5938 fix(trace): retain linear call path traversal state; closed 26 Oct without a merge
  • #6005 fix(mcp): name response-byte and startup ceilings in recovery; merged 21 Oct
  • #6014 fix(providers): name JEB, IDA, and one-shot command deadlines; merged 21 Oct
  • #6019 feat(javascript): retain queryable static route inventories; merged 22 Oct
  • #6054 fix(artifacts): preserve DMG caller cancellation reason; closed 25 Oct without a merge
  • #6059 fix(native): recover macOS command deadlines; merged 21 Oct
  • #6062 npm run test:focused -- tests/process-global/hopperFileOffsetDescriptorOwnership.test.ts - 4 passed.; closed 25 Oct without a merge
  • #6096 feat(hyperagent-local): ship My Agent local app; closed 21 Oct without a merge
  • #6129 fix(javascript): preserve unavailable source coverage for invalid UTF-8; closed 25 Oct without a merge
  • #6139 fix(native): inspect an explicit plist path over MCP without an open target; closed 24 Oct without a merge
  • #6141 fix(snapshot): keep mismatch, output-loss, and declaration require diagnostics precise; closed 23 Oct without a merge
  • #6145 fix(managed): report malformed PE layout during member comparison as invalid input (#6075); closed 26 Oct without a merge
  • #6150 fix(diagnostics): attribute input and refusal failures to their source; closed 23 Oct without a merge
  • #6151 fix(cancellation): preserve the caller abort reason; closed 23 Oct without a merge
  • #6155 fix(domain): reject unwalkable Mach-O load-command tables at admission; closed 24 Oct without a merge
  • #6157 Personal; closed 22 Oct without a merge
  • #6178 test(fixtures): skip permission-denial tests when DAC-bypass caps keep files readable; closed 24 Oct without a merge
  • #6179 fix(pcap): report capture summaries unsupported where their bound is unavailable; closed 25 Oct without a merge
  • #6180 docs(errors): correct stale capability-unknown and comparison-rationale rows; closed 23 Oct without a merge
  • #6184 fix(analysis-view): attribute unsupported artifact view kinds to view; closed 25 Oct without a merge
  • #6188 fix(adb): separate unresolvable paths and host capacity in adb spawn failures; no conflict now and checks passing
  • #6199 fix(browser): explain target changes without suggesting configuration repair; closed 26 Oct without a merge
  • #6202 fix(analysis-view): preserve binary layout field diagnostics; closed 24 Oct without a merge
  • #6203 fix(analysis-view): preserve HAR grouping parent diagnostics; closed 25 Oct without a merge
  • #6240 feat(ghidra): analyze GameCube/Wii DOL executables through Ghidra; merged 24 Oct
  • #6241 fix(il2cpp): accept names filters on type references; closed 24 Oct without a merge
  • #6245 fix(javascript): keep selected-input filesystem failures typed; closed 31 Oct without a merge
  • #6246 fix: correct pcap parent guidance and preserve loader base uncertainty; closed 24 Oct without a merge
  • #6248 fix(cli): describe analysis-view parents through the shared contract; closed 25 Oct without a merge
  • #6253 fix(doctor): check only the current platform's Hopper launcher candidates; merged 23 Oct
  • #6274 fix(javascript): propagate ancestor absence in export shape comparisons; closed 25 Oct without a merge
  • #6276 fix(browser): start coverage at domain enablement; closed 26 Oct without a merge
  • #6303 fix(cli): advertise the observe-web-execution duration maximum; closed 26 Oct without a merge
  • #6306 chore(experiments): prototype MCAP summary inspection; no conflict now and checks passing
  • #6307 test(correlation): cover contradictory findings and retained evidence; no conflict now and checks passing
  • #6315 fix(runtime)!: require patched Node.js security releases; merged 23 Oct
  • #6317 fix(artifacts): include table index in CArchive TOC entry diagnostics; closed 25 Oct without a merge
  • #6324 Fix snapshot replay tests for unknown question assertions; closed 25 Oct without a merge
  • #6327 fix(sqlite): report result-column capacity refusals as capacity; merged 23 Oct
  • #6340 fix(browser): keep refresh guidance for a missing CDP target; merged 22 Oct
  • #6342 fix(process): name the fixed finalization delivery grace; no conflict now and checks passing
  • #6351 fix(cli): document supported Rust, IL2CPP, model and GPU Evidence in inspect-analysis-view help; closed 26 Oct without a merge
  • #6355 fix(doctor): ignore Linux Hopper launcher candidates on macOS; closed 25 Oct without a merge
  • #6356 fix(browser): preserve script inventory boundary across async source reads; closed 25 Oct without a merge
  • #6365 test(javascript): cover Request endpoint identity and provenance; no conflict now and checks passing
  • #6369 fix(gdb): reject queued commands once their session is closing; closed 23 Oct without a merge
  • #6371 fix(native): report plist symlink loops and overlong paths as selection failures; merged 23 Oct
  • #6372 fix(hopper): report invalid regex patterns as pattern input errors; merged 23 Oct
  • #6373 fix(browser): record session load failures only for main-frame documents; closed 24 Oct without a merge
  • #6383 docs: repair dead anchors and unambiguous documentation errors; no conflict now and checks passing
  • #6384 fix(javascript): exclude type, enum and meta-property names from lexical reads; closed 24 Oct without a merge
  • #6385 feat(environment): give more write tools a state target; merged 24 Oct
  • #6386 docs(skill): state the setup install limit once; closed 23 Oct without a merge
  • #6388 fix(sqlite): attribute result-column limit to columns instead of data…; closed 24 Oct without a merge
  • #6389 fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema; closed 26 Oct without a merge
  • #6392 fix(ghidra): thin the selected universal Mach-O slice into the private import; no conflict now and checks passing
  • #6393 fix(artifacts): keep the primary catalog failure when cleanup fails; closed 25 Oct without a merge
  • #6395 fix(signals): name the limiter as a possible cause of a failed sigrok version probe; no conflict now and checks passing
  • #6416 chore(deps): update Vite security patch and dependency inventory; merged 23 Oct
  • #6462 fix(javascript): accept retained empty endpoint seeds; no conflict now and checks passing
  • #6492 fix(python): keep pyc string previews on Unicode boundaries; merged 23 Oct
  • #6498 fix(android): preserve schema issues in input errors; closed 24 Oct without a merge
  • #6509 feat(pe): inspect import and delay-load tables; merged 24 Oct
  • #6511 feat(apple): inspect IPS crash reports; merged 24 Oct
  • #6628 fix(python): classify negative marshal string sizes as malformed; closed 25 Oct without a merge
  • #6632 fix(mcp): advertise attached-capture incompleteness in compare_web_captures example; closed 26 Oct without a merge
  • #6633 fix(python): classify negative marshal string lengths as malformed input; closed 25 Oct without a merge
  • #6645 fix(hopper): preserve POSIX path separators for macOS and Linux Hopper launchers; closed 25 Oct without a merge
  • #6724 fix(uninstall): keep the reason when valid Cordis YAML is refused; closed 24 Oct without a merge
  • #6730 fix(pyinstaller): leave PE carrier binary members unmarked; no conflict now and checks passing
  • #6744 fix(objdump): name the rejected field in inspect-with-objdump input errors; closed 24 Oct without a merge
  • #6748 fix(ghidra): report kernel OOM kills as a memory constraint; merged 23 Oct
  • #6753 fix(environment): preserve astral token boundaries; closed 24 Oct without a merge
  • #6759 fix(cli): advertise required CLI selector choices; merged 23 Oct
  • #6761 fix(execution): exclude discarded POST bodies from request metadata accounting; closed 25 Oct without a merge
  • #6769 fix(zip): report symlinks declared without permission bits; closed 23 Oct without a merge
  • #6777 fix(entropy): report symlink loops and overlong paths as path input errors; closed 23 Oct without a merge
  • #6778 fix(javascript): keep unisolated program-var route values unknown; no conflict now and checks passing
  • #6791 fix(analysis-view): case-insensitive search now matches Greek final sigma; closed 25 Oct without a merge
  • #6802 fix(wasm): retain glue query and fragment across line terminators; merged 23 Oct
  • #6902 fix(environment): preserve literal early ISO years; closed 25 Oct without a merge
  • #6924 fix(ghidra): admit newer 12.x releases as compatible builds; merged 26 Oct
  • #6925 fix(prompts): include existing static artifact investigation routes; no conflict now and checks passing
  • #6949 fix(pyinstaller): require NUL-padded CArchive TOC names; now a draft
  • #6970 feat(comparison): add opt-in address-normalized function text views; no conflict now and checks passing
  • #6974 fix(hopper): keep installed apt dependencies at their versions during Linux setup; merged 24 Oct
  • #6976 fix(apple): keep the nested Rosetta registers of translated crash reports; closed 25 Oct without a merge
  • #6979 fix(browser): report an out-of-range script_index as a selection fault; merged 25 Oct
  • #6989 fix(il2cpp): link arm64 builds whose registrations were inlined; merged 24 Oct
  • #6990 fix(apple): refuse unpaired surrogates in IPS JSON strings; merged 24 Oct
  • #6991 fix(ghidra): bound bridge request lines above the authentication handshake; no conflict now and checks passing
  • #6995 feat(workflows): expose guided prompts through CLI and MCP; merged 28 Oct
  • #6996 feat(guidance): search installed workflow sections; merged 29 Oct
  • #6998 feat(artifacts): inspect and extract Bun standalone module graphs; merged 29 Oct
  • #7005 test(domain): kill surviving mutants in redactExplicitText; now a draft
  • #7006 test(domain): pin artifactExpansionBudget constants and floor boundary; now a draft
  • #7028 fix(evidence): link composed workflows to consumed observations; merged 24 Oct
  • #7033 test(firmware): exercise the staging ceiling through the emitted refusal; closed 27 Oct without a merge
  • #7042 feat(cli): report opt-in command timings; merged 28 Oct
  • #7044 test(javascript): cover the inline-HTML unavailable scope through the public CLI; no conflict now and checks passing
  • #7052 feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles; merged 25 Oct
  • #7054 feat(mcp): advertise bounded output schemas in a compact profile; closed 26 Oct without a merge
  • #7112 feat(native): make the function-matching allowance a runtime setting; closed 26 Oct without a merge
  • #7114 fix(mcp): preserve non-array element types in reduced compact array items; closed 26 Oct without a merge
  • #7116 feat(browser): validate browser scenarios with --dry-run before launching; closed 30 Oct without a merge
  • #7136 feat(artifacts): inventory and extract Intel HEX and Motorola S-record regions; merged 28 Oct
  • #7137 feat(android): annotate class and method inspection with R8/ProGuard mappings; closed 28 Oct without a merge
  • #7145 fix: treat other-user-namespace processes as withheld during cleanup; now a draft
  • #7150 fix(setup): replace the fixed Hopper download deadline with a stall timeout; no conflict now and checks passing
  • #7156 fix(cli): validate environment-serve --port as decimal text; closed 26 Oct without a merge
  • #7157 fix(artifacts): name the failing side in compare_artifacts input errors; closed 26 Oct without a merge
  • #7163 docs(errors): point catalogue rows at the current error owners; no conflict now and checks passing
  • #7166 fix(apple): observe keyed-archive dates when the offset table reaches the trailer; no conflict now and checks passing
  • #7172 fix(mcp)!: require allowed hosts for non-loopback HTTP binds; merged 26 Oct
  • #7176 fix(artifacts): name the compare_artifacts side of a rejected summary; closed 1 Nov without a merge
  • #7177 feat(artifacts): add dry-run plan for artifact extraction; no conflict now and checks passing
  • #7232 fix(flutter): read unlabeled Dart Version::String() from engines; no conflict now and checks passing
  • #7233 fix(javascript): report effective piped stdio for exec and execFile; closed 2 Nov without a merge
  • #7234 feat(artifacts): add U-Boot legacy uImage reader (part of #7129); merged 28 Oct
  • #7238 fix(flutter): identify source-defined Dart VM versions; no conflict now and checks passing
  • #7240 fix(macho): 修复 lazy-bind 重复绑定解析; no conflict now and checks passing
  • #7241 fix(files): expectedSize 后继续检查到 EOF; no conflict now and checks passing
  • #7242 fix(native): 校验绑定来源的完整身份; no conflict now and checks passing
  • #7246 docs(setup): describe FreeBuff as published setup support; no conflict now and checks passing
  • #7252 docs(skill): route SPA passive capture through allowed_origins; no conflict now and checks passing
  • #7254 feat(cli): add CSV and TSV analysis views; merged 28 Oct
  • #7255 fix(javascript): prove Webpack interop from loader aliases; closed 2 Nov without a merge
  • #7258 docs: pin install commands and clarify @latest as opt-in; no conflict now and checks passing
  • #7302 fix(wasm): name the compare_wasm_interfaces side of rejected Evidence; no conflict now and checks passing
  • #7305 test(devicetree): cover summary counts, node paging, and property selection in devicetree views; no conflict now and checks passing
  • #7309 fix(mcp): stamp required resultType on tools/call results under protocol 2026-07-28; no conflict now and checks passing
  • #7334 fix(cli): state each option default once in help output; no conflict now and checks passing
  • #7365 fix(artifacts): classify bundle executables by their own name; no conflict now and checks passing
  • #7368 feat(artifacts): inspect and extract Intel HEX and S-record firmware; closed 28 Oct without a merge
  • #7452 fix(artifacts): report required bytes for ASAR header limits; no conflict now and checks passing
  • #7453 fix(cli): reject surplus MCP registration arguments; no conflict now and checks passing
  • #7476 docs(index): drop the duplicated native-inspection guide row; closed 29 Oct without a merge
  • #7480 fix(docs): drop duplicate native-inspection guide row; no conflict now and checks passing
  • #7487 feat(rizin)!: record which tool and version answered execute_rizin_command; no conflict now and checks passing
  • #7526 fix(browser): preserve script exports with filesystem-unrepresentable paths; merged 28 Oct
  • #7600 feat(environment): serve sorted creates, listed references and toggles; merged 29 Oct
  • #7622 fix(cli): emit compact JSON validation errors for demangle-swift; no conflict now and checks passing
  • #7701 fix(native)!: correct Mach-O dispatch admission and errors; closed 29 Oct without a merge
  • #7702 fix(setup): stop doubling the period in invalid registration remediation; closed 29 Oct without a merge
  • #7771 feat(artifacts): inventory and extract U-Boot FIT images; merged 29 Oct
  • #7802 fix(cli): honor the selected format for unknown mcp subcommands; no conflict now and checks passing
  • #7831 fix(native): preserve Mach-O target selection in macOS tools; merged 29 Oct
  • #7852 fix(cli)!: refuse lossy text output; merged 29 Oct
  • #7855 fix(cli): preserve caller paths in format inspections; merged 29 Oct
  • #7859 feat(windows): inspect Shell Link (.lnk) shortcut files; no conflict now and checks passing
  • #7869 feat(artifacts): compare inventories from Evidence sources; merged 28 Oct
  • #7905 fix(mcp)!: bound validation work before tool dispatch; merged 29 Oct
  • #8088 feat(browser): accept mitmproxy 12.3.1 for native capture decode; no conflict now and checks passing
  • #8182 fix(security): remove unsafe exec(compile()) in bridge/ (pwntools, pwndbg); closed 2 Nov without a merge
  • #8231 fix(artifacts): decide how compare_artifacts compares every format_metadata kind; no conflict now and checks passing
  • #8331 fix(javascript): resolve module-level Electron options in functions; closed 1 Nov without a merge
  • #8470 fix(ghidra): guide recovery from unresolved procedure selectors; no conflict now and checks passing
  • #8497 feat(unity): inspect WebGL data containers and SerializedFile assets; no conflict now and checks passing
  • #8525 feat(audit): report what a shipped app exposes to static analysis; no conflict now and checks passing
  • #8533 feat(native): page retained feature traces through analysis views; closed 2 Nov without a merge
  • #8548 fix(setup): refuse Hopper on macOS below the release's minimum; merged 2 Nov
  • #8557 fix(evidence): bound malformed file field diagnostics; no conflict now and checks passing
  • #8586 refactor(ci): parse readiness fences with a static expression; merged 1 Nov
  • #8598 fix(cli): reject non-decimal byte-entropy window options; no conflict now and checks passing
  • #8599 fix(rust): state inflate limits on the consumed zlib stream; no conflict now and checks passing
  • #8600 fix(cli): reject empty artifact targets before resolution; no conflict now and checks passing
  • #8601 fix(cli): reject non-decimal native UI and command deadline options; no conflict now and checks passing
  • #8603 fix(pe): reject empty and non-minimal certificate serial INTEGERs; no conflict now and checks passing
  • #8604 docs(mcp): list every tool that omits the untrusted-content marker; no conflict now and checks passing
How it's built
  • Snapshot. I took a snapshot of the open pull requests at about 4:14 PM UTC on 20 October 2026. It held 357 open pull requests that are not drafts and either conflict with main or have a failing check.
  • Live check. I re-read each one live. All 357 were still open. Five had changed. Two now conflict, so they moved to the both group. Three have no conflict now and their checks are running, so they are left out. That leaves 354.
  • Refresh. 475 moved out, to the Moved on since opening fold. 470 new ones are added. When a pull request's block changes, its line moves to the matching list. Old lines stay in the day group they were in. That makes 349.
  • Last activity. The days count from the author's last push or comment. Maintainer comments do not reset it. A pull request with no author activity counts from its last push.
  • Failing CI. Any failing check counts, whether or not it is required.
  • Changes requested. A review with changes requested, from an owner, member or collaborator who is not the author.
  • Age. Every pull request here is 22 days old or younger.

If something's wrong

Comment on this issue and name the line. I will fix the list.

Related trackers

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates
  • #3537: Open bugs, by subsystem (matbrgz)
  • #4330: Duplicate issues, in clusters (matbrgz)
  • #5653: New issues by area, pointing at #4330 for duplicates (CassieFox23)
Features and roadmap
  • #3796: Feature requests, by area (CassieFox23)
  • #2383: Support for the top 100 languages (matbrgz)
  • #2357: Static file and crash report work (matbrgz)
  • #3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
  • #4027: Browser, Electron and JS work (N0zoM1z0)
  • #32: The main roadmap (morluto)
  • #48: The Evidence v2 epic (morluto)
  • #2039: The roadmap in plain words, a discussion (CassieFox23)
Docs
  • #3795: Open docs issues and PRs (CassieFox23)
Pull requests
  • #3582: Ready to close or merge, issues and PRs (CassieFox23)
  • #5654: Open PRs with conflicts or red CI (this one, CassieFox23)
Show and tell
  • #1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5654 [![Type: Tracker](https://img.shields.io/badge/type-tracker-purple.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Active](https://img.shields.io/badge/status-active-brightgreen.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) **TL;DR:** 349 open pull requests can't merge yet. Each has a conflict, a failing check, or both. Their authors may already be working on them. ### What's here Many open pull requests have a merge conflict or a failing check. In a long queue they are easy to miss. This list gathers them in one place. It is meant to help maintainers and contributors see the whole picture. The list is built from what is open on GitHub. Last refreshed: 10:29 PM UTC on 2 November 2026. ### Pull requests that can't merge yet Each line below is an open pull request, not a draft, that has a merge conflict, a failing check, or both. Lines are grouped by days since the last activity, then by what blocks the merge. Authors may already be working on these. Nothing here asks for speed, and nothing here is a request to anyone. A tag after a line says what blocks the merge. (conflicts) means the branch conflicts with main. (CI) means at least one check is failing. (both) means it has both. <details> <summary>0 to 2 days since the last activity (213)</summary> **Merge conflict only (64)** - #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts) - #2043 docs(readme): add Hinglish translation (conflicts) - #2418 feat(angr): add angr MCP analysis provider (conflicts) - #2694 fix(wasm): raise the WABT output budget to 128 MiB (conflicts) - #3090 feat(providers): enable agent-aware deep provider selection (conflicts) - #3521 feat(reverse): add radare2 one-shot commands and analysis sessions (conflicts) - #3531 feat(ghidra): persistent project cache with cross-session identity (conflicts) - #3573 fix(android): classify a pre-handshake JADX heap shortage as a resource limit (conflicts) - #3585 feat(android)!: expose method access flags and absent body reasons (conflicts) - #3586 feat(jvm): inspect JVM source-line & local-variable debug metadata (#2377) (conflicts) - #3840 feat(android): add boot wait and resource-id to code tracing (conflicts) - #4043 fix(setup): write the recommended tool call timeout into dsh registrations (conflicts) - #4163 feat(analysis-view): page retained browser scenario steps and text (conflicts) - #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts) - #4417 feat(call-path): trace multiple goals and report backward roots (conflicts) - #4554 feat(browser-extension): inspect declared CRX and XPI manifest surfaces (conflicts) - #4618 feat(clients): register Kiro during setup (conflicts) - #4811 feat(ghidra): admit RISC-V position-independent executables (#4487) (conflicts) - #4813 feat(ida): support the official Hex-Rays IDA MCP headlessly (conflicts) - #4984 fix(call-path): bound inline shortest-path enumeration (conflicts) - #4991 feat(reconstruction)!: require failing verifier controls (conflicts) - #4995 fix(browser): reclaim scenario profiles whose owner is gone (conflicts) - #5046 fix(mcp): support retained pseudocode summaries and paging (conflicts) - #5197 docs: add REA guide and architecture patterns aligned to 6.7.0 (conflicts) - #5211 Fix #4856: Prevent call stack overflow on large TOML files (conflicts) - #5216 fix: allow Tiny PE e_lfanew inside DOS header (conflicts) - #5263 test(ghidra): strengthen raw-binary, firmware, and instruction flow verification (conflicts) - #5303 fix(javascript): keep var reads before their declarator unknown (conflicts) - #5361 feat(firmware): map STM32, GD32, and ESP32 SoC peripherals and auto-detect target platform (conflicts) - #5380 feat(android): add optional DroidASC class discovery backend (conflicts) - #5558 fix(process): reschedule poll on failure and bound stream buffer (conflicts) - #5560 fix(browser): ensure cancellation deadline and teardown on hanging CDP calls (conflicts) - #5902 fix(firmware): reclassify output-directory admission failures as invalid_request (conflicts) - #6142 fix(ghidra): add structured startup-timeout diagnostics (conflicts) - #6146 fix(javascript): bound member-mutation traversal and add max-heap-mb to compare-application-versions (#6127) (conflicts) - #6147 feat: extended artifact formats, Gzip reader, Python/PyInstaller, PE inspector, JVM reader, Minidump parser, and platform portability (conflicts) - #6177 fix(ghidra): name procedure-listing commands when name resolution fails (conflicts) - #6190 fix(javascript): include slotless accesses in property traces (conflicts) - #6288 feat(harmony): add xpanda-backed Ark bytecode analysis (conflicts) - #6294 test(javascript): order the caller abort by frame, not wall clock (conflicts) - #6347 fix(cli): delegate rea mcp add to setup --client on Windows (#5811) (conflicts) - #6350 fix(contracts): advertise the Frida remote address character set (conflicts) - #6367 fix(reconstruction)!: require distinct contents for fixture controls (conflicts) - #6699 fix(app-bundle): apply the Info.plist decode budget to XML plists (conflicts) - #6856 fix(comparison): reject blank function names (conflicts) - #7041 feat(binary-ninja-headless): add owned headless Binary Ninja provider (conflicts) - #7144 feat(ghidra): admit DOS MZ targets on Windows P0 (conflicts) - #7154 feat(mcp): advertise each tool's family in tools/list _meta (conflicts) - #7239 feat(ghidra): accept Ghidra 12.2.x as a compatible, unverified release line (conflicts) - #7245 feat(android): project expected JNI/JNA symbol names and structural attack-surface facts (conflicts) - #7340 fix(mcp): report session tool target requirements accurately (conflicts) - #7766 fix(cli): accumulate repeated allowed-hosts occurrences (conflicts) - #7778 fix(android): point JADX setup errors at the pinned public JAR (conflicts) - #8025 fix(rizin): preserve stopped session diagnostics (conflicts) - #8048 feat(ghidra,domain): add cortex-m raw binary support, relax ghidra ve… (conflicts) - #8157 fix(mcp): ensure resultType on tools/call wire results (conflicts) - #8161 feat(native): surface inferred prototype instruction conflicts (conflicts) - #8291 fix(analysis-view)!: distinguish unavailable native collections (conflicts) - #8326 fix(mcp): deliver guidance results under their advertised result object (conflicts) - #8340 fix(providers): mark callee coverage partial at computed call sites (conflicts) - #8343 fix(native): keep fixed zero-parameter calls out of missing-binding unknowns (conflicts) - #8537 fix(navigation): name instruction alternatives in navigation refusals (conflicts) - #8568 fix(analysis): append large inventories without exceeding call-argument limits (conflicts) - #8653 fix(session): guide retained cleanup before opening another target (#8353) (conflicts) **Failing CI only (90)** - #2977 feat(ghidra): report computed branches without a recovered jump table (CI) - #3662 fix(flutter): inspect the renamed Dart AOT snapshot layout (CI) - #4038 fix(cli): preserve command status after complete pipe reads (CI) - #4355 fix(javascript): preserve loader getters across inactive defaults (CI) - #4741 test(adb): bind snapshot cleanup fixtures to runtime ownership (CI) - #5024 feat(experiments): add MCP tool-selection eval harness (CI) - #5129 fix(cli): load Evidence record pairs from JSON files (CI) - #5172 fix(adb): reuse shared PNG header validation (CI) - #5213 test(mcp): normalize server identity fixture paths on Windows (CI) - #5317 fix: correct cmd.exe /s /c argument quoting for Windows batch launchers (CI) - #5325 fix(ghidra): raise decompiler max payload cap for very large functions (CI) - #5936 test(setup): cover skill aliases and independent cleanup retries (CI) - #6381 fix(browser): return completed scenario capture when cleanup is unconfirmed (CI) - #6396 feat(cli): add provider-free 'profile' command with per-fact confidence (CI) - #6477 feat(mcp): add opt-in release notifications (CI) - #6940 REA ENGINEER (CI) - #6992 ci(real-go-binary): pin Go 1.26.10 (CI) - #7017 fix(discovery): advertise attached IDA navigation effects (CI) - #7056 test(inspector): keep the target cancellation fixture path exactly reported (CI) - #7160 fix(pe): admit Authenticode nesting depth of signed Windows binaries (CI) - #7161 fix(environment): map id-list elements when a scalar set also changed (CI) - #7174 feat(process): support FreeBSD hosts (CI) - #7197 feat: add investigation-loop domain module (Phase 1, #7193) (CI) - #7229 fix(electron): resolve module constant window options read inside functions (CI) - #7231 chore(bridge): remove unused imports and a shadowed loop variable (CI) - #7237 feat(elf): decode FDO packaging and dlopen note metadata (CI) - #7278 fix(cli): count the full-output envelope for TOON/YAML token counts (CI) - #7449 fix(mcp): advertise absolute filesystem paths (CI) - #7463 Initial commit (CI) - #7486 feat(ghidra): admit Xtensa ELF through a pinned lane (CI) - #7502 fix(validation): stop reporting an exclusive bound as an inclusive minimum (CI) - #7528 fix(native): reject nonzero reserved ELF dynamic symbols (CI) - #7530 fix(pe): classify valid DOS targets as unsupported (CI) - #7591 Feat/studio (CI) - #7619 feat(setup): prefer client plugins with opt-in Cursor installation (CI) - #7776 fix(browser): preserve nonstandard response status codes (CI) - #7870 fix(cli): reject malformed dry-run values (CI) - #7878 docs(i18n): mention bun add --global in translated FAQ update answers (CI) - #7951 feat(ghidra): open M-profile raw images at a separate load base (CI) - #8094 fix(ida): surface actionable error when headless decompile lacks pagination (CI) - #8111 fix(native): wrap the legacy rebase cursor at 64 bits like dyld (CI) - #8128 chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.1 (CI) - #8129 build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 (CI) - #8130 chore(deps-dev): bump `@toon-format/toon` from 2.3.1 to 4.4.0 (CI) - #8131 chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 (CI) - #8132 chore(deps): bump canonicalize from 3.0.0 to 5.1.0 (CI) - #8133 chore(deps): bump actions/setup-node from 4.4.0 to 7.1.0 (CI) - #8134 chore(deps): bump write-file-atomic from 7.0.0 to 8.0.0 (CI) - #8135 chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.2 (CI) - #8136 chore(deps-dev): bump lint-staged from 16.4.0 to 17.6.0 (CI) - #8151 fix(cli): exit with code 1 on cleanup failure when exit code is undef… (CI) - #8220 docs(mcp): name the accepted seed kinds on trace_application_feature (CI) - #8265 Revise README for usage and community engagement (CI) - #8268 fix(analysis): order graph depths numerically (CI) - #8269 Revise README for REA project introduction (CI) - #8280 chore(deps): bump the npm-minor-and-patch group across 2 directories with 34 updates (CI) - #8379 fix(ghidra): report selected project identity failures (CI) - #8381 test(ghidra): check retained historical snapshot evidence (CI) - #8382 fix(ghidra): respect Java Unix socket path limits (CI) - #8384 fix(native): retain value trace source evidence (CI) - #8389 docs(mcp): document native function analysis scope (CI) - #8401 feat(ghidra): admit RISC-V ilp32f ELF with a derived calling convention (CI) - #8412 fix(evidence): clarify unsupported view recovery (CI) - #8414 fix: guide address-context comment recovery (CI) - #8437 fix(mcp): clarify retained dossier handoff in crash prompt (CI) - #8439 docs(tool-design): audit agent workflow guidance (CI) - #8440 fix(verification): use inspected Ghidra JDK (CI) - #8442 fix(native)!: recognize identical function evidence (CI) - #8443 fix!: qualify call paths by provider discovery (CI) - #8447 feat(go): add capped build-info admission overrides (CI) - #8457 fix(evidence): traverse large source link sets safely (CI) - #8458 perf(artifacts): skip re-creating owned extraction directories (CI) - #8481 fix(mcp): surface pageable pseudocode workflow (CI) - #8484 docs(mcp): clarify Ghidra edit lifetime on switches (CI) - #8487 feat(mcp): refresh provider candidates without switching (CI) - #8514 fix(cli): guide analysts to typed incoming references (CI) - #8527 feat(artifacts): inventory and extract Deno compile executables (CI) - #8536 test(ghidra): check structured snapshot profile mismatch (CI) - #8547 docs(mcp): clarify residual unknown target scope (CI) - #8558 fix(native): show function match limitations by default (CI) - #8567 fix(session): guide unsupported provider recovery (CI) - #8575 fix(trace): disclose address-only reference scope (CI) - #8578 test(ghidra): check regex recovery at its owning boundary (CI) - #8581 fix(ghidra): explain read-only project recovery (CI) - #8584 fix(ghidra): clarify function annotation selectors (CI) - #8625 fix(artifacts): report oversized Zstandard ZIP windows as a resource limit (CI) - #8647 fix(rizin): keep debug targets off the debugger command stream (CI) - #8650 fix(verifiers): retain the Go fixture root until MCP ownership completes (CI) - #8670 fix(javascript): reconcile Node targets with entry assets (CI) - #8687 fix(kuna): keep timeout recovery from changing workers (CI) **Merge conflict and failing CI (59)** - #1815 feat(javascript): add proof-gated js-redox deobfuscation (both) - #1840 fix(javascript)!: preserve Vite dependency values and uncertainty (both) - #2018 feat(javascript): resolve package exports and imports wildcard patterns (both) - #2068 feat(browser): retain worker source and runtime evidence (both) - #2406 feat(wasm): decode WebAssembly components offline (both) - #2791 docs: organize canonical documentation layout and verify new pages (both) - #2884 feat(browser): derive API surfaces from retained SAZ captures (both) - #3004 feat(adb): add UI Automator discovery, waits and actions (both) - #3772 fix(android): disable JVM perf data for JADX Java launches (both) - #3967 feat(procmon): read saved Process Monitor XML and CSV exports as Evidence (both) - #4362 feat(unreal): inspect Unreal pak footers and indexes (both) - #4532 fix(ghidra): admit recordless legacy MIPS32 carves missing section tables (both) - #4719 fix(setup): bound Hopper downloads by idle time instead of total duration (both) - #4720 fix(adb): attribute pull file refusals to the device path (both) - #4857 fix: clean up quality gate findings (both) - #4871 fix: ELF multi-architecture support and quality fixes (both) - #4887 Improve reverse engineering reliability, Android analysis, and binary diagnostics (both) - #4963 test(adb): cover push device-state refusal attribution (both) - #4971 docs(i18n): add Azerbaijani README and sync Turkish edition (both) - #5061 fix(update): refuse unverified Bun ancestor ownership (both) - #5230 fix(artifacts): keep readable entries of a directory with unreadable entries (both) - #5254 fix(macho): exact arm64e.x1 slice names and mach-o-universal format (both) - #5276 docs: add Urdu README translation (both) - #5296 fix(process): preserve observed command failures before cancellation (both) - #5544 fix(cli): reject invalid token-window bounds (both) - #5597 fix(evidence): stop offering overwrite for outputs that never overwrite (both) - #6124 fix(ghidra): point Windows ELF rejection to WSL2 fallback (both) - #6165 fix(domain): reject ELF files whose program header table runs past the end (both) - #6326 feat(windows): admit live SQLite, process, and window tools (both) - #6728 feat(ci): require live dependency security evidence for releases (both) - #6930 test(gpu): retain unsupported PE layout delivery regression (both) - #6983 fix(process): settle exits during Linux credential observation (both) - #6993 fix(javascript): follow Electron through aliases of Webpack externals (both) - #7030 feat(browser): add passive CSS variables and design token extraction (both) - #7096 perf(javascript): reuse semantic coverage projections (both) - #7186 feat(unity): inventory Addressables content catalogs (both) - #7216 fix(update): report Frida native module readiness (both) - #7248 feat(scripts): add repository integrity check (both) - #7264 feat(android): project declared component process and access flags (both) - #7339 feat(solana): add Solana sBPF program analysis domain (both) - #7454 test(windows): declare the native loader fixture optional header (both) - #7466 feat(desktop): add installable REA desktop app (both) - #7489 fix(native): admit retroactive flag when decoding Swift static witness tables (both) - #7529 fix(pe): preserve TLS templates in virtual zero padding (both) - #7867 fix(pcap): exclude HTTP credentials from failed command observations (both) - #7868 feat(elf): inspect dynamic dependencies and required symbol versions (both) - #8012 feat(ghidra): analyze Game Boy SM83 cartridge ROMs (both) - #8262 fix(mcp): name the missing closure for inline investigation Evidence (both) - #8376 fix(ghidra)!: preserve facts in inventory searches (both) - #8377 fix(mcp): qualify retained Evidence view guidance (both) - #8391 fix(ghidra): qualify selected project call coverage (both) - #8397 fix(kuna): guide inventory selector recovery (both) - #8406 fix(test): report caller target selection coverage (both) - #8413 fix(ghidra): explain read-only project edit refusals (both) - #8424 fix!: preserve address context resource recovery (both) - #8464 fix(ghidra)!: load ESP-IDF flash code in Ghidra's default address space (both) - #8480 docs(mcp): clarify retained evidence view support (both) - #8485 feat(mcp): report provider release verification in session (both) - #8519 fix(elf): preserve dynamic export visibility (both) </details> <details> <summary>3 to 5 days since the last activity (83)</summary> **Merge conflict only (37)** - #2136 feat(packaging): prepare a Windows portable runtime (conflicts) - #2362 feat(ghidra): admit plain MIPS32 PIC shared images (conflicts) - #2987 feat(jeb): detect JEB endpoint in setup and doctor (conflicts) - #2988 feat(browser): add screenshot bounds and region comparisons (conflicts) - #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts) - #3753 feat(jvm): export Vineflower sources with explicit dependencies (conflicts) - #3770 feat(native): inspect Windows minidump streams offline (conflicts) - #3773 feat(bridge): discover BYO x64dbg without launching a session (conflicts) - #3775 feat(native): static packer identification for PE and ELF (conflicts) - #3903 feat(website): polish interactions and remove em dashes (conflicts) - #3905 feat(cli): report MCP catalog size in doctor (conflicts) - #3966 feat(evidence): add literal text query to retained Evidence summaries (conflicts) - #4031 feat(artifacts): select extraction entries and output destination (conflicts) - #4133 feat(evidence): cluster inspected artifacts into families by root digest (conflicts) - #4139 docs(ar): synchronize README_ar.md with upstream English documentation (conflicts) - #4143 feat(windows): capture selected windows through owned helpers (conflicts) - #4172 feat(i18n): add Albanian README and website translations (conflicts) - #4209 docs(i18n): add Gujarati translations (conflicts) - #4334 test(ghidra): align fixtures with Windows host boundaries (conflicts) - #4367 feat(setup): add IBM Bob client registration (conflicts) - #4482 feat(evidence): add evidence bundle audit command and MCP tool (conflicts) - #4516 fix(managed): compare member bodies by nominal identity across builds (conflicts) - #4585 fix(browser): record dedicated worker requests through attached sessions (conflicts) - #4589 feat(evidence): cluster artifacts from retained Evidence references and summaries (conflicts) - #4591 feat(ghidra): select the loopback bridge transport on POSIX hosts (conflicts) - #4843 fix(domain): admit SPARC V9 (EM_SPARCV9, 43) ELF binaries (conflicts) - #5248 chore(android): update jadx-headless-mcp provider to 0.8.0 (conflicts) - #5755 fix(native): keep ELF layout independent of pwntools kernel probes (conflicts) - #7046 fix(capture): run without a PTY where the native preload cannot fork (conflicts) - #7147 fix(process): identify inaccessible Linux namespace peers (conflicts) - #7283 feat(setup): discover project-scoped MCP registrations in doctor and … (conflicts) - #7753 fix(wasm): retain rejected REA_WABT_BIN_DIRECTORY value in refusal (conflicts) - #7756 docs(ci): match SQLite and build-cache lane descriptions to workflows (conflicts) - #7772 feat(android): pin jadx-headless-mcp 0.8.0 (conflicts) - #7783 feat(native): inspect Linux BTF types and BTF.ext records (conflicts) - #7797 fix(cli): publish partial Evidence to --evidence_output on failure (conflicts) - #8077 fix(cli): publish partial Evidence bundle on failure when evidence_output is set (conflicts) **Failing CI only (9)** - #3356 test(cli): cover Frida argument admission and spawn ordering (CI) - #3496 feat(artifacts): read compiled AndroidManifest.xml attributes (CI) - #3750 Lunz Research Group Apresents: REA-LUNZ-CAUSAL-ENGINE (CI) - #3810 docs: add a static VB6 native OCX investigation workflow (CI) - #4083 perf(cli): skip command schemas for standalone version queries (CI) - #4536 fix(javascript): treat exact location-only moves as unchanged (CI) - #4611 docs: add a .NET static-analysis walkthrough (CI) - #4675 feat(js): resolve class instance method calls in semantic graphs (CI) - #4807 fix(cli): stream default TOON results past the string limit (CI) **Merge conflict and failing CI (37)** - #1704 docs(website): add reproducible starter demos (both) - #1732 fix(setup): preserve user fields on an existing REA client entry (both) - #2185 fix(setup): show non-interactive setup results in a terminal (both) - #2264 feat(ios): Add iOS app support - add jailbroken runtime debugging lanes (both) - #2414 feat(setup): support private Claude Code project registrations (both) - #2465 fix(javascript): preserve intrinsic invocation read identity (both) - #2701 docs(skills): add source attribution and evidence handoff guidance (both) - #2862 docs: add Hindi (हिन्दी) translation of README (both) - #2878 fix(browser): preserve explicit URL references and endpoint evidence (both) - #2904 feat(ghidra)!: preserve paged warnings and require observed comparison coverage (both) - #2919 test(ghidra): verify MIPS declaration and cleanup boundaries (both) - #2986 fix(javascript): global augmentation kind and additional web/browser inspections (both) - #3030 Fix/android runtime fallback (both) - #3317 feat(managed): decode signature-owned custom attribute arguments (both) - #3404 feat(artifacts): recognize CFB containers with explicit coverage limits (both) - #3433 feat(javascript): recover synchronous child-process creation (both) - #3486 fix(setup): default Claude Desktop to compact MCP schemas (both) - #3558 fix(hopper): normalize cross-platform launcher paths (both) - #3589 Feat/pri resources (both) - #3659 fix(security): harden archive and Hopper probes (both) - #3817 feat(ghidra): select an existing-project program inside a project folder (both) - #3837 test(browser): cover invalid WebMCP annotation payloads (both) - #3968 feat(setup): add MiniMax Code client (both) - #3976 feat(go)!: inspect compiler-declared function entries (both) - #4061 feat(windows): support Windows ARM64 native controls and provider boundaries (both) - #4161 feat(mcp): support real-time operation progress and ETA notifications (both) - #4224 fix(browser): preserve uncertainty for omitted initiator URLs (#4211) (both) - #4317 fix(apple): retain keyed archive scalar object kinds (both) - #4345 fix(cleanup): restore shared ownership across browser, capture, and adb boundaries (both) - #4456 fix(browser): record dedicated worker requests in page inspection (both) - #4491 docs: add Urdu (اردو) README translation (both) - #4523 fix(setup): preserve exact Windows AppData roots (both) - #4559 fix(native): scale NativeAOT work budget and resolve base types by index (both) - #4656 fix(javascript): scope candidate this event receivers (both) - #4716 fix(javascript): bound alias-cycle call-target and returned-reference expansion (both) - #5368 feat(browser): wake or classify discarded CDP page targets before inspection (both) - #5712 docs(skill): unify reverse-engineering and UI/UX workflows (both) </details> <details> <summary>6 or more days since the last activity (53)</summary> **Merge conflict only (17)** - #2693 fix(cli): preserve mcp doctor output choices on argument errors (conflicts) - #2845 test(browser): cover DOM relation whitespace and empty values (conflicts) - #3124 docs(skill): flag hidden-window throttling in passive browser observation (conflicts) - #3429 feat(binary): recognize XEX2 and PowerPC PE basefiles (conflicts) - #3513 fix(browser): keep an undecodable Electron worker target uncertain (conflicts) - #3529 feat(reconstruction): verify visual screenshot claims (conflicts) - #3697 Feat/claude code codex plugin (conflicts) - #3742 feat(experiments): prototype Electron IPC effect attribution (conflicts) - #3762 Feat/lucas profile roadmap (conflicts) - #3769 Fix/review feedback 3762 (conflicts) - #3818 feat(ghidra): apply a caller-selected PDB that matches the target (conflicts) - #3835 feat(managed)!: expose file-backed field initialization data (conflicts) - #4198 fix(ghidra): prevent loader relocations from constant folding (conflicts) - #4911 Feat/snes rom 65816 (conflicts) - #4924 test(http3): verify reset and partial-response capture semantics (conflicts) - #6089 fix(adb): preserve filesystem meaning of host paths (conflicts) - #7004 feat(doctor): report the configured workflow beside an audit-wide result (conflicts) **Failing CI only (9)** - #2830 fix(javascript): resolve spread and constant kill-signal arguments (CI) - #2870 perf(ghidra): resolve Swift select provenance once per function (CI) - #2969 fix(hopper): support WSLg socket symlinks for private displays (CI) - #3043 Configure the Cursor Cloud Agent environment (CI) - #3074 docs: clarify automated agent development setup (CI) - #3258 Improve page template UI: responsive layout, dark mode, reading progress (CI) - #3339 test(javascript): cover missing package-manifest companions staying unknown (CI) - #3411 docs(skills): add REA repository analysis workflow (CI) - #3495 feat(android): check split APK set consistency from manifest facts (CI) **Merge conflict and failing CI (27)** - #1903 fix(adb): project actionable pm path refusal details (both) - #1948 feat(ghidra): add bounded PS-X EXE static analysis (both) - #1971 feat(evaluation): run agent evaluation against Claude Code and Gemini CLI (both) - #2025 feat(ghidra): admit caller-selected matching dSYM companions (both) - #2052 docs(skill): pin the package runner and treat target content as untrusted (both) - #2092 feat(javascript)!: bound semantic graphs by serialized Evidence bytes (both) - #2093 feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine (both) - #2094 feat(javascript): fold constant values and recover Electron boundaries through wrappers (both) - #2097 fix(javascript): admit measured transfer retention in parent result budget (both) - #2407 feat(website): add Central Kurdish (Sorani) locale (both) - #2435 feat(managed): bind Portable PDB sequence points to selected methods (both) - #2717 feat(java): inspect archives and decompile selected classes (both) - #2771 fix(ghidra): keep unreported Java bitness unknown (both) - #2819 feat(windows): add REA desktop GUI (both) - #2850 fix(android): require explicit invoke coverage state (both) - #2887 feat(native): decode RT_STRING and RT_VERSION payloads in PE resources (both) - #2922 fix(filesystem): PRoot compatibility for sameRegularFileState (both) - #2923 feat(ghidra): admit bounded m68k ELF analysis through Ghidra (both) - #3028 feat(cli): run ordered tool batches in one provider session (both) - #3029 fix(ghidra): recover registered Borland SEH handler gaps (both) - #3037 docs(skill): add optional public-source research guidance (both) - #3048 fix(android): decode guardian readiness across UTF-8 chunks (both) - #3100 feat(setup): support OpenClaw native MCP and active profiles (both) - #3129 feat(ghidra): admit ELF and thin Mach-O targets on Windows (both) - #3492 fix(application): surface web resource cleanup errors via tagged error algebra (both) - #3547 docs(i18n): add Devanagari CSS, Hindi README base, and initial website translations (both) - #5622 Rama (both) </details> <details> <summary>Pull requests where a maintainer asked for changes (6)</summary> A maintainer asked for changes on these 6 at some point. They are also in the groups above. I did not check whether the author has updated them since. - #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts) - #3513 fix(browser): keep an undecodable Electron worker target uncertain (conflicts) - #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts) - #4143 feat(windows): capture selected windows through owned helpers (conflicts) - #4172 feat(i18n): add Albanian README and website translations (conflicts) - #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts) </details> <details> <summary>Moved on since opening (475)</summary> - #1804 feat(setup): register Kimi Code client with compact schema profile; closed 25 Oct without a merge - #1959 feat(process): add owned debugger shutdown lifecycle; no conflict now and checks passing - #1960 fix(reverse)!: retain cleanup and session ownership for local inspection; closed 25 Oct without a merge - #1961 fix(gdb)!: preserve interrupt and provider cleanup ownership; no conflict now and checks passing - #2041 fix(javascript): preserve builtin effects at their read sites; no conflict now and checks passing - #2124 feat(domain): add opt-in address-normalized function text views; closed 26 Oct without a merge - #2142 docs(i18n): add Bangla (bn) README and website translation; no conflict now and checks passing - #2148 feat(mcp): accept common argument-name aliases for procedure and search tools; no conflict now and checks passing - #2150 feat(ghidra): open pre-imported projects with -process instead of re-importing; closed 26 Oct without a merge - #2243 docs(readme): add Georgian (ka) translation; closed 26 Oct without a merge - #2268 docs: add Central Kurdish (Sorani) README translation; closed 26 Oct without a merge - #2314 test(artifacts): exercise ASAR header admission boundaries; closed 25 Oct without a merge - #2331 feat(diagnostics): report a byte entropy profile for one local file; merged 22 Oct - #2358 feat(ghidra): select a pre-imported project with -process; closed 26 Oct without a merge - #2433 feat(artifacts): inventory and extract PyInstaller archives; merged 21 Oct - #2492 feat(setup): support CodeBuddy as a setup client; no conflict now and checks passing - #2630 feat(cli): expose caller-selected reference-source path exclusions; no conflict now and checks passing - #2636 feat(harness): add a build-free REA bundle and guarded distribution; closed 24 Oct without a merge - #2676 fix(native): support configurable REA_PWNTOOLS_MAX_INPUT_BYTES for large artifacts; closed 25 Oct without a merge - #2702 fix(javascript): preserve Node package lookup and artifact path identity; closed 29 Oct without a merge - #2731 docs(go): clarify cumulative build-info search budget; merged 21 Oct - #2736 feat: add FreeBuff agent support for REA setup; merged 25 Oct - #2800 feat(native): retain LLDB source coordinates and verify Pascal calls; no conflict now and checks passing - #2801 test(agent): grade Notes export facts and track fixture changes; closed 25 Oct without a merge - #2815 feat(plugins): ship release-pinned Claude Code and Codex plugins; closed 27 Oct without a merge - #2816 feat(artifacts): inspect classic iNES container regions; merged 31 Oct - #2817 test(docs): refresh README link drift mutations; closed 26 Oct without a merge - #2839 fix(browser): classify malformed screenshot payloads as protocol errors; closed 26 Oct without a merge - #2866 docs: add Greek (Ελληνικά) translation of README; closed 23 Oct without a merge - #2868 fix(adb): drop the remaining exclusivity claim from push guidance; no conflict now and checks passing - #2872 fix(captures): redact normalized HAR numeric values; closed 23 Oct without a merge - #2876 fix(web-capture): bound the mitmproxy headline facet index; no conflict now and checks passing - #2891 perf(javascript): cut redundant key encoding in semantic member-mutation traversal; closed 23 Oct without a merge - #2905 feat(mcp): keep compact input schemas within ten nesting levels; closed 25 Oct without a merge - #2961 fix(security): bound scenario retention and loopback admission; closed 21 Oct without a merge - #2963 fix(javascript): recover RPC link URLs declared with template literals; no conflict now and checks passing - #2978 feat(electron): report custom URL protocol registrations; merged 30 Oct - #3003 feat(plugin): bundle Cursor with REA runtime and skill; no conflict now and checks passing - #3011 fix(hopper): release a Spotlight not-found launch from the signed helper; closed 26 Oct without a merge - #3023 feat(config): persist provider settings in a user config file; no conflict now and checks passing - #3024 feat(evm): inspect exact Solidity compiler artifacts; no conflict now and checks passing - #3026 feat(mcp): scope advertised tools by family through REA_MCP_TOOL_FAMILIES; closed 26 Oct without a merge - #3045 fix(evaluation): require explicit REA server identity for routing credit; closed 26 Oct without a merge - #3071 Build; closed 25 Oct without a merge - #3225 fix(managed): report InitLocals comparison changes; closed 23 Oct without a merge - #3263 test(process): cover cancellation during obstructed root lookup; closed 30 Oct without a merge - #3288 fix(ledger): map non-canonical bundle TypeError to AnalysisInputError; closed 26 Oct without a merge - #3290 fix(artifacts): classify localized DMG verification failures; closed 25 Oct without a merge - #3293 feat(analysis-view): select HAR MIME types in capture previews; closed 29 Oct without a merge - #3407 refactor(pcap): give TShark selection and version admission one owner; merged 22 Oct - #3425 feat(analysis-view): locate unavailable response facts by record; closed 28 Oct without a merge - #3440 fix(security): pin CI actions, protect Hopper xauth and downloads, flag old apktool; closed 25 Oct without a merge - #3444 fix(process): bound bridge response framing; no conflict now and checks passing - #3455 fix(wasm): preserve local matches for dotted selected paths; closed 23 Oct without a merge - #3458 fix(adb): verify pushes to long device paths; closed 29 Oct without a merge - #3463 test(artifact): cover multiple inspection inventory substeps; closed 26 Oct without a merge - #3468 fix(target): report targets held open by another process as retryable; no conflict now and checks passing - #3493 fix(browser): reserve the initial scenario step id from action inputs; merged 21 Oct - #3498 fix(reference): preserve root permission failures; closed 26 Oct without a merge - #3525 fix(mcp): recover structured tool arguments clients serialize as JSON text; no conflict now and checks passing - #3544 fix(electron): forward selected XAUTHORITY to owned capture environment; closed 25 Oct without a merge - #3550 fix(javascript): keep parent budget exhaustion from advising more memory; closed 30 Oct without a merge - #3559 fix(electron): block and record shell.trashItem; closed 25 Oct without a merge - #3562 fix(reference): preserve physical symlink targets; closed 27 Oct without a merge - #3583 fix(native): check every slice of a signed universal Mach-O; closed 25 Oct without a merge - #3600 fix(contracts): reject NUL bytes in objdump and rizin local path inputs; merged 24 Oct - #3602 feat(windows): admit arm64 hosts for the bundled native controls; no conflict now and checks passing - #3604 refactor(go): parse module records once at the build-info owner; closed 25 Oct without a merge - #3657 docs: add Bangla (বাংলা) README translation; closed 28 Oct without a merge - #3658 fix(artifacts): recognize leading JSON whitespace in ASAR headers; closed 25 Oct without a merge - #3660 fix(managed): keep native-boundary inspection alive for very large issue inventories; closed 24 Oct without a merge - #3754 fix(jeb): reconnect after stale MCP sessions; no conflict now and checks passing - #3760 fix(windows): name the missing native artifact and its recovery path on source checkouts; no conflict now and checks passing - #3761 docs(firmware): disclose procps ps prerequisite; closed 26 Oct without a merge - #3787 feat(artifacts): inspect and extract .NET single-file bundles; merged 29 Oct - #3802 fix(reconstruction): evaluate declared dependency closure and risks; closed 26 Oct without a merge - #3806 fix(mcp): normalize compact schemas for strict gateways; merged 25 Oct - #3828 fix(native): trace UI actions for all receiver kinds; closed 23 Oct without a merge - #3834 fix(process): reject the __proto__ environment name the PTY backend drops; closed 24 Oct without a merge - #3841 fix(javascript): attribute service workers only to the navigator global; closed 21 Oct without a merge - #3899 feat(doctor): diagnose firmware integration readiness; no conflict now and checks passing - #3940 fix(javascript): preserve proven WebSocket endpoint identities; closed 31 Oct without a merge - #3969 feat(website): new REA identity and a calculator teardown redesign; no conflict now and checks passing - #3994 fix: exclude credential header values from header allocation budget preflight; closed 25 Oct without a merge - #3995 fix(mcp): advertise a screenshot example with a valid PNG checksum; closed 25 Oct without a merge - #3996 fix(js): ignore unrelated join/resolve for Electron preload paths; closed 24 Oct without a merge - #4004 fix(managed): reject runtime locations on managed static evidence; closed 24 Oct without a merge - #4014 fix(browser): compare retained script source identities; closed 25 Oct without a merge - #4020 fix(javascript): preserve structural fingerprint semantics; closed 21 Oct without a merge - #4021 fix(sqlite): normalize index table identifiers using ASCII folding; no conflict now and checks passing - #4028 docs(mcp): narrow WorkBuddy/CodeBuddy 11133 guidance to full override; no conflict now and checks passing - #4036 test(process): cover endpoint-only port normalization; closed 26 Oct without a merge - #4037 fix(contracts): restore canonical mobile graph examples; closed 24 Oct without a merge - #4039 feat(clients): register ggcode during setup; no conflict now and checks passing - #4040 fix(browser): preserve frame identity across captures; merged 23 Oct - #4047 fix(plist): preserve real character data; closed 27 Oct without a merge - #4053 fix(reference): preserve imports with symlinks into unreadable subtrees; closed 21 Oct without a merge - #4060 fix(reference-source): keep a partial graph for symlinks into unenumerated directories; closed 21 Oct without a merge - #4073 fix(adb): normalize absent installer package sentinels; merged 21 Oct - #4103 fix(providers): report provider-selection diagnostics when the selected provider refuses its profile; merged 22 Oct - #4144 fix(managed): match Windows module paths independently of the host; closed 24 Oct without a merge - #4145 docs(hermes): explain nested-home routing and preview limits; merged 27 Oct - #4148 feat(radare2): prototype transports and analyst capabilities; no conflict now and checks passing - #4173 fix(javascript): prune unreachable constant return branches; closed 25 Oct without a merge - #4200 feat(ida): verify headless caller relationships with call graphs; no conflict now and checks passing - #4214 fix(artifacts): reject directory targets for source maps (#4212); closed 24 Oct without a merge - #4220 fix(native): map Go and Rust ppc reports to the powerpc subject; closed 25 Oct without a merge - #4221 fix(reference): select a package main for trailing-slash requires; closed 24 Oct without a merge - #4222 fix(website): translate coding agent as an AI assistant in Russian and Ukrainian; closed 26 Oct without a merge - #4259 fix(javascript): preserve optional native-addon bindings; closed 25 Oct without a merge - #4283 feat(mcp): add native vulnerability review prompt; closed 23 Oct without a merge - #4285 feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources; no conflict now and checks passing - #4286 fix(ida): keep omitted callee truncation markers unknown; merged 21 Oct - #4319 fix(swift): retain uncertainty for substituted extension contexts; closed 25 Oct without a merge - #4323 fix(javascript): resolve relative ESM backslash paths; merged 28 Oct - #4333 fix(artifact): accept POSIX names beginning with letter-colon on non-Windows hosts; closed 26 Oct without a merge - #4351 fix(captures): scope HAR HTTP interpretation to entries; merged 22 Oct - #4352 fix(artifacts): reconcile ARM32 Mach-O slice names by subtype; merged 22 Oct - #4359 fix(native): report every slice of a signed universal Mach-O signature; closed 24 Oct without a merge - #4360 perf(schema): reduce retained integer validator allocations; merged 22 Oct - #4363 fix(javascript): grow a binding's returned-reference projection once per chain; closed 24 Oct without a merge - #4386 refactor(ghidra): share native AOT entry class constant; closed 26 Oct without a merge - #4391 fix(browser): bound observe_web_session windows to the Node.js timer limit; closed 21 Oct without a merge - #4401 fix(reference): retain static template require dependencies; closed 22 Oct without a merge - #4408 fix(enhanced): validate get_objc_protocols direct-call input; closed 24 Oct without a merge - #4409 fix(reference): retain exact CommonJS template require specifiers; closed 24 Oct without a merge - #4410 fix(inspector): count unresolved locations after script deduplication; closed 25 Oct without a merge - #4413 fix(browser): retain bundle default origin scope; merged 22 Oct - #4420 fix(managed): authorize signature kind against its metadata row kind; closed 26 Oct without a merge - #4422 fix(artifacts): preserve binary keyed archive integers above Int64.max; closed 24 Oct without a merge - #4424 perf(mcp): defer analysis runtime after catalog discovery; merged 22 Oct - #4430 fix(firmware): reject staged files cut off at the per-file limit; no conflict now and checks passing - #4442 fix(evidence): accept legacy null coverage identity; closed 24 Oct without a merge - #4464 fix(rizin): bound recent frame history by UTF-8 bytes; closed 22 Oct without a merge - #4472 fix(native): reject empty Swift protocol or type names in conformance descriptors; closed 26 Oct without a merge - #4480 docs(i18n): correct Korean Aegis analysis guidance; closed 23 Oct without a merge - #4493 fix: resolve critical lifecycle, admission, and analysis defects (#4475, #4483, #4490, #4494, #4495, #4509); closed 24 Oct without a merge - #4503 fix(ownership): retain failed artifact and native handles; closed 25 Oct without a merge - #4510 fix(javascript): preserve raw ESM path classification; closed 21 Oct without a merge - #4519 fix(browser): keep Termux Chromium profiles on a writable temp directory; no conflict now and checks passing - #4529 fix(electron): exclude scripts from unauthorized frames; closed 25 Oct without a merge - #4548 fix(native): reject empty Objective-C ivar names in class metadata; closed 25 Oct without a merge - #4566 docs(i18n): add the Linux procps prerequisite to translated READMEs; closed 25 Oct without a merge - #4570 docs(i18n): sync Go, SQLite and Bun update facts in translated READMEs; closed 26 Oct without a merge - #4572 fix(reference): keep the raw query and fragment on unresolved ESM paths; no conflict now and checks passing - #4576 fix(mcp): require an absolute input_path for JavaScript application analysis; closed 24 Oct without a merge - #4579 fix(adb): refuse push on ambiguous existence probe failure (#4574); closed 25 Oct without a merge - #4583 fix(ghidra): discover Homebrew keg-only openjdk candidates on macOS (#4556); closed 24 Oct without a merge - #4645 fix(ida): retain analysis profile in partial operation evidence; merged 21 Oct - #4646 fix(javascript): keep directory-form HTML URL references distinct from files; merged 22 Oct - #4651 docs(cli): list Kuna as a doctor provider; closed 25 Oct without a merge - #4655 fix(adb): preserve device and file error identity; closed 21 Oct without a merge - #4696 fix(apktool): fall back to packageInfo when manifest package is omitted; no conflict now and checks passing - #4739 [Bug] Signature inspection returns success after cancellation during final cleanup; closed 21 Oct without a merge - #4751 fix(lldb): retain journal descriptor cleanup ownership; closed 25 Oct without a merge - #4769 docs: repair out-of-tree links so the documentation build passes; closed 23 Oct without a merge - #4773 docs: add open-source decompiler selection guide; now a draft - #4784 fix(javascript): preserve CommonJS exports through TypeScript wrappers; no conflict now and checks passing - #4790 fix: prevent source maps targeting directories; closed 25 Oct without a merge - #4826 feat(python): inspect CPython pyc headers and marshal code objects; merged 22 Oct - #4829 fix(errors): separate recovery actions from failure messages; no conflict now and checks passing - #4830 feat(pe): inspect Authenticode certificate tables; merged 22 Oct - #4831 feat(skill): add opt-in Coordo evidence handoffs; closed 1 Nov without a merge - #4833 feat(erlang): inspect BEAM IFF chunks and tables; merged 22 Oct - #4837 feat(elf): inspect PT_NOTE and SHT_NOTE tables; merged 22 Oct - #4884 fix(mcp): close the session when a signal interrupts startup; closed 24 Oct without a merge - #4897 fix(update): bound update subprocess output collection (#4888); no conflict now and checks passing - #4903 fix(setup): tell MSIX Claude Desktop's process view from any private roaming file; merged 22 Oct - #4915 fix(javascript): attribute call-path unknowns only where the walk can reach Electron; no conflict now and checks passing - #4969 Fix typo in README and add repository description; closed 26 Oct without a merge - #4970 docs(companions): propose opt-in integration contract; no conflict now and checks passing - #4979 fix(native): preserve Mach-O install-name whitespace; merged 22 Oct - #4988 ci(windows): run the caller path separator regression in the Windows lane; no conflict now and checks passing - #4997 fix(javascript): name the exhausted heap and max_heap_mb in heap failures; closed 21 Oct without a merge - #5000 feat(skill): coordinate evidence-led REA investigations; closed 1 Nov without a merge - #5009 docs: clarify JEB Linux CE MCP launch; closed 25 Oct without a merge - #5019 test(update): isolate CLI subprocess deadlines; merged 21 Oct - #5020 fix(jeb): preserve artifact path in project-open refusals; closed 25 Oct without a merge - #5023 feat(kuna): admit Windows PE images through the verified provider lane; no conflict now and checks passing - #5025 feat(android): project a structured manifest component inventory; merged 24 Oct - #5029 feat(cli): accept JavaScript source selections from a JSON array or file; merged 24 Oct - #5044 feat(docs): add VitePress dead-link verification to CI workflow (#5030); closed 25 Oct without a merge - #5053 fix(setup): treat empty COPILOT_HOME as unset; closed 25 Oct without a merge - #5054 fix(setup): admit only syntax Gemini CLI loads in settings.json; closed 29 Oct without a merge - #5064 feat(plugin): ship a Claude Code plugin for the MCP server; closed 22 Oct without a merge - #5065 test(process): reduce macOS wall-clock capture test flakiness; closed 26 Oct without a merge - #5066 Fix README.md filename typo; closed 26 Oct without a merge - #5067 docs(gemini): diagnose model schema rejection separately from MCP setup; closed 31 Oct without a merge - #5069 feat(rust): read cargo-auditable dependencies from WebAssembly modules; no conflict now and checks passing - #5115 fix(setup): accept and preserve Codex per-tool settings (#3862, #3863); closed 25 Oct without a merge - #5116 test(electron): isolate active provider lifecycle tests; no conflict now and checks passing - #5119 fix(cli): clamp exhausted failure token-window start to the token total; closed 25 Oct without a merge - #5120 fix(setup): keep client and skill setup when the Hopper install fails; merged 22 Oct - #5123 fix(apple): report empty asset inventory as complete at any offset; closed 21 Oct without a merge - #5125 fix(artifacts): keep a member's own name when its logical path is NFC; closed 26 Oct without a merge - #5127 fix(artifacts): preserve original Unicode spelling when NFC normalization changes a logical path; closed 26 Oct without a merge - #5133 fix(managed): distinguish truncated compressed signature integers; closed 25 Oct without a merge - #5139 perf(javascript): prune typed-array element reference escapes; merged 22 Oct - #5143 docs:增加文本中部分文字(fixes #1); closed 26 Oct without a merge - #5145 feat(clients): support Antigravity CLI with shared-registration lifecycle coverage; no conflict now and checks passing - #5152 fix(hermes): preserve external YAML anchor consumers; merged 27 Oct - #5156 fix(analysis): preserve execution analysis profile in composed Evidence; closed 24 Oct without a merge - #5157 fix(evm): preserve advertised detail schema metadata; closed 24 Oct without a merge - #5167 feat(cli): summarize managed members with durable Evidence paging; merged 22 Oct - #5203 fix(mcp): advertise empty-string literals as typed strings; closed 25 Oct without a merge - #5204 fix(android): select Windows JADX java.exe from PATH, not the working directory; closed 24 Oct without a merge - #5210 fix(objdump): scope debug-link warnings to DWARF inspections; closed 21 Oct without a merge - #5226 docs: describe AOT image buffer as declared size plus one byte; closed 25 Oct without a merge - #5227 fix(mcp): omit empty-string schema literals; closed 25 Oct without a merge - #5228 fix(apple): classify keyed-archive objects by declared superclasses; merged 22 Oct - #5231 fix(cli): clamp exhausted failure token windows; closed 25 Oct without a merge - #5233 fix(verify): clean up ADB transfer probe; closed 26 Oct without a merge - #5235 fix(windows): align path handling across Hopper, Electron, and ADB; merged 22 Oct - #5239 fix(evm): clarify worker address space as profile ceiling in limitations; closed 25 Oct without a merge - #5247 fix(cli): keep debug-with-rizin success status after confirmed fallback cleanup; closed 25 Oct without a merge - #5260 fix(apple): avoid truncation flag for empty catalogs; closed 21 Oct without a merge - #5262 fix(hopper): bound bridge request frames like the Cutter bridge; merged 22 Oct - #5275 fix(hopper): clarify version-mismatched unsupported builds; no conflict now and checks passing - #5278 docs(errors): include Omarchy and current host-support messages in error catalogue (#5078); merged 21 Oct - #5285 fix(browser): bound initial navigation when command_timeout_ms is omitted; closed 29 Oct without a merge - #5301 fix(sqlite): bind returned cleanup errors to their exact root and worker owners; closed 25 Oct without a merge - #5304 ci: publish OpenSSF Scorecard results; closed 26 Oct without a merge - #5307 fix(native): report unresolved native UI PID and window selections as invalid input; closed 25 Oct without a merge - #5309 feat(managed)!: show readable type names in member signatures; merged 29 Oct - #5312 fix(managed): retain type discovery after member limits; merged 22 Oct - #5348 feat(firmware): attribute hardware MMIO peripheral memory regions in native disassembly; merged 22 Oct - #5351 feat(environment)!: serve the environment state by default; merged 21 Oct - #5352 feat(environment): render more read tools from the state and describe responses; merged 21 Oct - #5359 feat(macho): report per-slice encryption status in inspect_macho; merged 29 Oct - #5365 test(sqlite): keep incomplete cleanup primary over late cancellation; merged 21 Oct - #5366 docs(cli): complete the cancellation-routing command list; closed 26 Oct without a merge - #5374 fix(gdb): preserve the caller's abort reason when startup is cancelled; closed 21 Oct without a merge - #5375 fix(gdb): keep a failed startup retained for cleanup out of ready state; closed 21 Oct without a merge - #5382 fix(gdb): keep the caller's abort reason when startup cancels; closed 21 Oct without a merge - #5387 fix(javascript): resolve preceding exported variable initializers and computed method keys; merged 27 Oct - #5389 Revise tagline in README for emphasis; closed 26 Oct without a merge - #5392 fix(ghidra): publish the stable launcher root when it proves the install; closed 21 Oct without a merge - #5410 fix(objdump): scope debug-link caveat to DWARF; closed 24 Oct without a merge - #5425 fix(ghidra): treat format-specific disabled analyzers as not applicable; merged 22 Oct - #5427 fix(adb): read the package id from appId on Android 16; closed 25 Oct without a merge - #5428 Fix/javascript source selection limitations; closed 26 Oct without a merge - #5430 fix(native): declare filesystem write effect for inspect_signature; closed 25 Oct without a merge - #5432 fix(mcp): report duplicate unknowns accurately; closed 21 Oct without a merge - #5471 fix(cli): restore documented guidance for argument validation errors; closed 24 Oct without a merge - #5478 test(managed): retain repeated member-site coverage; closed 30 Oct without a merge - #5491 fix(mcp): refuse a one-element initialize batch without evicting the session; closed 25 Oct without a merge - #5495 fix(artifacts): distinguish non-directory output paths from identity changes; closed 25 Oct without a merge - #5508 fix(setup): preserve explicit clients with all-detected selection; merged 22 Oct - #5509 fix(ghidra): keep the session transcript out of bridge failure replies; closed 29 Oct without a merge - #5514 fix(cli): print compact mcp doctor JSON when stdout is redirected; merged 22 Oct - #5518 docs(web-bundle): describe objectValue as a named-property lookup; closed 21 Oct without a merge - #5519 docs(errors): record the implemented process-input read diagnostic; closed 23 Oct without a merge - #5539 fix(gdb): keep inferior-tty verification for read-only queries; no conflict now and checks passing - #5545 feat(native-api): add varargs field to inspect_native_api boundary; no conflict now and checks passing - #5548 fix(native): remove completed signing capture limitation; merged 21 Oct - #5555 docs(artifacts): clarify unsupported DMG extraction; merged 21 Oct - #5563 fix(apple): attribute object-budget omissions to the object budget; closed 21 Oct without a merge - #5564 fix(sqlite): name the selected path in malformed-database errors; merged 21 Oct - #5565 fix(kuna): reject a dangling cache root link in doctor; closed 21 Oct without a merge - #5566 fix(native): keep per-input demangle outcomes when swift-demangle skips `_`; closed 21 Oct without a merge - #5567 fix(electron): report fixed fuse reader bounds as non-retryable; closed 21 Oct without a merge - #5569 fix(apple): decode NIBArchive boolean value types with the correct polarity; closed 21 Oct without a merge - #5570 fix(signals): report rejected sigrok selectors as invalid input; merged 21 Oct - #5571 fix(artifacts): report a stable symlink loop as a path resolution failure; merged 21 Oct - #5572 fix(artifacts): keep DMG root observations when the image is already attached; closed 21 Oct without a merge - #5577 fix(desktop): classify rejected desktop roots as target failures; merged 21 Oct - #5578 fix(cli): reject negative and fractional token window values; closed 25 Oct without a merge - #5579 fix(browser): keep cancellation for scenario captures cancelled during startup; closed 21 Oct without a merge - #5581 fix(environment): report later bundle write failures as host failures; merged 21 Oct - #5582 fix(apple): trace LC_LAZY_LOAD_DYLIB_INFO lazy dylib dependencies; closed 20 Oct without a merge - #5583 fix(swift): match legacy runtime names by format, not a _Tt substring; closed 21 Oct without a merge - #5587 fix(process): bound output draining after a stoppable command's grace; closed 20 Oct without a merge - #5588 fix(diagnostics): name fixed inspection budgets in refusal recovery; closed 21 Oct without a merge - #5591 fix(ida): fail doctor readiness for FIFO registrations and unusable workspace roots; closed 20 Oct without a merge - #5592 fix(artifacts): stop offering integrity-policy retries for checksum-invalid DMGs; closed 21 Oct without a merge - #5594 fix(javascript): carry a directly returned value's literal to its return site; closed 21 Oct without a merge - #5596 fix(cli): report malformed output values in the selected structured format; closed 25 Oct without a merge - #5599 fix(mcp): align trace feature description with result; closed 25 Oct without a merge - #5600 feat(environment): apply evidence-gated write effects to the served state; merged 22 Oct - #5602 fix(cli): route analyze based on bundle layout, not directory name suffix; closed 24 Oct without a merge - #5612 fix(native): keep .. after directory symlinks in selected plist paths; closed 24 Oct without a merge - #5618 fix(kuna): reject version/digest mismatch from replaced executable; closed 25 Oct without a merge - #5629 feat(cli)!: export row-oriented results as JSON Lines; merged 23 Oct - #5639 fix(browser): exclude replayed lifecycle milestones from session activity; closed 20 Oct without a merge - #5644 fix(observation): keep incomplete cancellation observations; merged 20 Oct - #5645 fix(process): retain compiler roots after bounded output drain; closed 21 Oct without a merge - #5660 feat(analysis)!: default function MCP output to retained summaries; merged 24 Oct - #5662 feat(ghidra): bound one procedure's decompile without closing the session; merged 23 Oct - #5664 feat(analysis-view): share templated positions across manifest tools; merged 21 Oct - #5672 fix(artifacts): handle ASAR cancellation before output consumption; no conflict now and checks passing - #5699 feat(environment): compare an environment with probe captures of its application; merged 22 Oct - #5754 fix(native): keep recorded-core note types owner-qualified; closed 25 Oct without a merge - #5764 docs(native): explain resource-only bundle admission; no conflict now and checks passing - #5776 build(deps): update vite to 8.3.4 for launch-editor advisories; closed 25 Oct without a merge - #5778 fix(native): reject mixed dyld refusal diagnostics; merged 27 Oct - #5785 feat(il2cpp): link generic method instances behind --generic-instances; merged 24 Oct - #5787 feat(environment): list every entity on a list's whole lines; merged 22 Oct - #5788 fix(native): admit thin arm64_32 Mach-O targets for static inspection; merged 22 Oct - #5790 fix(mcp): stop advertising an unreturned operation count for trace_feature; closed 25 Oct without a merge - #5793 fix(mcp): report Linux-only integrations as unsupported_host off their hosts; merged 22 Oct - #5794 feat(binary-ninja): add GUI MCP analysis provider; no conflict now and checks passing - #5800 feat(environment): answer list filters, search, sorting and paging from the state; merged 22 Oct - #5869 fix(javascript): omit unselected-source limitation when every source is selected; closed 25 Oct without a merge - #5888 fix(native): keep Ghidra data labels out of Objective-C class names; closed 25 Oct without a merge - #5918 fix(model): admit safetensors header lengths that resemble pickle markers; merged 22 Oct - #5927 fix(reference)!: honor nested .gitignore files; closed 24 Oct without a merge - #5938 fix(trace): retain linear call path traversal state; closed 26 Oct without a merge - #6005 fix(mcp): name response-byte and startup ceilings in recovery; merged 21 Oct - #6014 fix(providers): name JEB, IDA, and one-shot command deadlines; merged 21 Oct - #6019 feat(javascript): retain queryable static route inventories; merged 22 Oct - #6054 fix(artifacts): preserve DMG caller cancellation reason; closed 25 Oct without a merge - #6059 fix(native): recover macOS command deadlines; merged 21 Oct - #6062 npm run test:focused -- tests/process-global/hopperFileOffsetDescriptorOwnership.test.ts - 4 passed.; closed 25 Oct without a merge - #6096 feat(hyperagent-local): ship My Agent local app; closed 21 Oct without a merge - #6129 fix(javascript): preserve unavailable source coverage for invalid UTF-8; closed 25 Oct without a merge - #6139 fix(native): inspect an explicit plist path over MCP without an open target; closed 24 Oct without a merge - #6141 fix(snapshot): keep mismatch, output-loss, and declaration require diagnostics precise; closed 23 Oct without a merge - #6145 fix(managed): report malformed PE layout during member comparison as invalid input (#6075); closed 26 Oct without a merge - #6150 fix(diagnostics): attribute input and refusal failures to their source; closed 23 Oct without a merge - #6151 fix(cancellation): preserve the caller abort reason; closed 23 Oct without a merge - #6155 fix(domain): reject unwalkable Mach-O load-command tables at admission; closed 24 Oct without a merge - #6157 Personal; closed 22 Oct without a merge - #6178 test(fixtures): skip permission-denial tests when DAC-bypass caps keep files readable; closed 24 Oct without a merge - #6179 fix(pcap): report capture summaries unsupported where their bound is unavailable; closed 25 Oct without a merge - #6180 docs(errors): correct stale capability-unknown and comparison-rationale rows; closed 23 Oct without a merge - #6184 fix(analysis-view): attribute unsupported artifact view kinds to view; closed 25 Oct without a merge - #6188 fix(adb): separate unresolvable paths and host capacity in adb spawn failures; no conflict now and checks passing - #6199 fix(browser): explain target changes without suggesting configuration repair; closed 26 Oct without a merge - #6202 fix(analysis-view): preserve binary layout field diagnostics; closed 24 Oct without a merge - #6203 fix(analysis-view): preserve HAR grouping parent diagnostics; closed 25 Oct without a merge - #6240 feat(ghidra): analyze GameCube/Wii DOL executables through Ghidra; merged 24 Oct - #6241 fix(il2cpp): accept names filters on type references; closed 24 Oct without a merge - #6245 fix(javascript): keep selected-input filesystem failures typed; closed 31 Oct without a merge - #6246 fix: correct pcap parent guidance and preserve loader base uncertainty; closed 24 Oct without a merge - #6248 fix(cli): describe analysis-view parents through the shared contract; closed 25 Oct without a merge - #6253 fix(doctor): check only the current platform's Hopper launcher candidates; merged 23 Oct - #6274 fix(javascript): propagate ancestor absence in export shape comparisons; closed 25 Oct without a merge - #6276 fix(browser): start coverage at domain enablement; closed 26 Oct without a merge - #6303 fix(cli): advertise the observe-web-execution duration maximum; closed 26 Oct without a merge - #6306 chore(experiments): prototype MCAP summary inspection; no conflict now and checks passing - #6307 test(correlation): cover contradictory findings and retained evidence; no conflict now and checks passing - #6315 fix(runtime)!: require patched Node.js security releases; merged 23 Oct - #6317 fix(artifacts): include table index in CArchive TOC entry diagnostics; closed 25 Oct without a merge - #6324 Fix snapshot replay tests for unknown question assertions; closed 25 Oct without a merge - #6327 fix(sqlite): report result-column capacity refusals as capacity; merged 23 Oct - #6340 fix(browser): keep refresh guidance for a missing CDP target; merged 22 Oct - #6342 fix(process): name the fixed finalization delivery grace; no conflict now and checks passing - #6351 fix(cli): document supported Rust, IL2CPP, model and GPU Evidence in inspect-analysis-view help; closed 26 Oct without a merge - #6355 fix(doctor): ignore Linux Hopper launcher candidates on macOS; closed 25 Oct without a merge - #6356 fix(browser): preserve script inventory boundary across async source reads; closed 25 Oct without a merge - #6365 test(javascript): cover Request endpoint identity and provenance; no conflict now and checks passing - #6369 fix(gdb): reject queued commands once their session is closing; closed 23 Oct without a merge - #6371 fix(native): report plist symlink loops and overlong paths as selection failures; merged 23 Oct - #6372 fix(hopper): report invalid regex patterns as pattern input errors; merged 23 Oct - #6373 fix(browser): record session load failures only for main-frame documents; closed 24 Oct without a merge - #6383 docs: repair dead anchors and unambiguous documentation errors; no conflict now and checks passing - #6384 fix(javascript): exclude type, enum and meta-property names from lexical reads; closed 24 Oct without a merge - #6385 feat(environment): give more write tools a state target; merged 24 Oct - #6386 docs(skill): state the setup install limit once; closed 23 Oct without a merge - #6388 fix(sqlite): attribute result-column limit to columns instead of data…; closed 24 Oct without a merge - #6389 fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema; closed 26 Oct without a merge - #6392 fix(ghidra): thin the selected universal Mach-O slice into the private import; no conflict now and checks passing - #6393 fix(artifacts): keep the primary catalog failure when cleanup fails; closed 25 Oct without a merge - #6395 fix(signals): name the limiter as a possible cause of a failed sigrok version probe; no conflict now and checks passing - #6416 chore(deps): update Vite security patch and dependency inventory; merged 23 Oct - #6462 fix(javascript): accept retained empty endpoint seeds; no conflict now and checks passing - #6492 fix(python): keep pyc string previews on Unicode boundaries; merged 23 Oct - #6498 fix(android): preserve schema issues in input errors; closed 24 Oct without a merge - #6509 feat(pe): inspect import and delay-load tables; merged 24 Oct - #6511 feat(apple): inspect IPS crash reports; merged 24 Oct - #6628 fix(python): classify negative marshal string sizes as malformed; closed 25 Oct without a merge - #6632 fix(mcp): advertise attached-capture incompleteness in compare_web_captures example; closed 26 Oct without a merge - #6633 fix(python): classify negative marshal string lengths as malformed input; closed 25 Oct without a merge - #6645 fix(hopper): preserve POSIX path separators for macOS and Linux Hopper launchers; closed 25 Oct without a merge - #6724 fix(uninstall): keep the reason when valid Cordis YAML is refused; closed 24 Oct without a merge - #6730 fix(pyinstaller): leave PE carrier binary members unmarked; no conflict now and checks passing - #6744 fix(objdump): name the rejected field in inspect-with-objdump input errors; closed 24 Oct without a merge - #6748 fix(ghidra): report kernel OOM kills as a memory constraint; merged 23 Oct - #6753 fix(environment): preserve astral token boundaries; closed 24 Oct without a merge - #6759 fix(cli): advertise required CLI selector choices; merged 23 Oct - #6761 fix(execution): exclude discarded POST bodies from request metadata accounting; closed 25 Oct without a merge - #6769 fix(zip): report symlinks declared without permission bits; closed 23 Oct without a merge - #6777 fix(entropy): report symlink loops and overlong paths as path input errors; closed 23 Oct without a merge - #6778 fix(javascript): keep unisolated program-var route values unknown; no conflict now and checks passing - #6791 fix(analysis-view): case-insensitive search now matches Greek final sigma; closed 25 Oct without a merge - #6802 fix(wasm): retain glue query and fragment across line terminators; merged 23 Oct - #6902 fix(environment): preserve literal early ISO years; closed 25 Oct without a merge - #6924 fix(ghidra): admit newer 12.x releases as compatible builds; merged 26 Oct - #6925 fix(prompts): include existing static artifact investigation routes; no conflict now and checks passing - #6949 fix(pyinstaller): require NUL-padded CArchive TOC names; now a draft - #6970 feat(comparison): add opt-in address-normalized function text views; no conflict now and checks passing - #6974 fix(hopper): keep installed apt dependencies at their versions during Linux setup; merged 24 Oct - #6976 fix(apple): keep the nested Rosetta registers of translated crash reports; closed 25 Oct without a merge - #6979 fix(browser): report an out-of-range script_index as a selection fault; merged 25 Oct - #6989 fix(il2cpp): link arm64 builds whose registrations were inlined; merged 24 Oct - #6990 fix(apple): refuse unpaired surrogates in IPS JSON strings; merged 24 Oct - #6991 fix(ghidra): bound bridge request lines above the authentication handshake; no conflict now and checks passing - #6995 feat(workflows): expose guided prompts through CLI and MCP; merged 28 Oct - #6996 feat(guidance): search installed workflow sections; merged 29 Oct - #6998 feat(artifacts): inspect and extract Bun standalone module graphs; merged 29 Oct - #7005 test(domain): kill surviving mutants in redactExplicitText; now a draft - #7006 test(domain): pin artifactExpansionBudget constants and floor boundary; now a draft - #7028 fix(evidence): link composed workflows to consumed observations; merged 24 Oct - #7033 test(firmware): exercise the staging ceiling through the emitted refusal; closed 27 Oct without a merge - #7042 feat(cli): report opt-in command timings; merged 28 Oct - #7044 test(javascript): cover the inline-HTML unavailable scope through the public CLI; no conflict now and checks passing - #7052 feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles; merged 25 Oct - #7054 feat(mcp): advertise bounded output schemas in a compact profile; closed 26 Oct without a merge - #7112 feat(native): make the function-matching allowance a runtime setting; closed 26 Oct without a merge - #7114 fix(mcp): preserve non-array element types in reduced compact array items; closed 26 Oct without a merge - #7116 feat(browser): validate browser scenarios with --dry-run before launching; closed 30 Oct without a merge - #7136 feat(artifacts): inventory and extract Intel HEX and Motorola S-record regions; merged 28 Oct - #7137 feat(android): annotate class and method inspection with R8/ProGuard mappings; closed 28 Oct without a merge - #7145 fix: treat other-user-namespace processes as withheld during cleanup; now a draft - #7150 fix(setup): replace the fixed Hopper download deadline with a stall timeout; no conflict now and checks passing - #7156 fix(cli): validate environment-serve --port as decimal text; closed 26 Oct without a merge - #7157 fix(artifacts): name the failing side in compare_artifacts input errors; closed 26 Oct without a merge - #7163 docs(errors): point catalogue rows at the current error owners; no conflict now and checks passing - #7166 fix(apple): observe keyed-archive dates when the offset table reaches the trailer; no conflict now and checks passing - #7172 fix(mcp)!: require allowed hosts for non-loopback HTTP binds; merged 26 Oct - #7176 fix(artifacts): name the compare_artifacts side of a rejected summary; closed 1 Nov without a merge - #7177 feat(artifacts): add dry-run plan for artifact extraction; no conflict now and checks passing - #7232 fix(flutter): read unlabeled Dart Version::String() from engines; no conflict now and checks passing - #7233 fix(javascript): report effective piped stdio for exec and execFile; closed 2 Nov without a merge - #7234 feat(artifacts): add U-Boot legacy uImage reader (part of #7129); merged 28 Oct - #7238 fix(flutter): identify source-defined Dart VM versions; no conflict now and checks passing - #7240 fix(macho): 修复 lazy-bind 重复绑定解析; no conflict now and checks passing - #7241 fix(files): expectedSize 后继续检查到 EOF; no conflict now and checks passing - #7242 fix(native): 校验绑定来源的完整身份; no conflict now and checks passing - #7246 docs(setup): describe FreeBuff as published setup support; no conflict now and checks passing - #7252 docs(skill): route SPA passive capture through allowed_origins; no conflict now and checks passing - #7254 feat(cli): add CSV and TSV analysis views; merged 28 Oct - #7255 fix(javascript): prove Webpack interop from loader aliases; closed 2 Nov without a merge - #7258 docs: pin install commands and clarify `@latest` as opt-in; no conflict now and checks passing - #7302 fix(wasm): name the compare_wasm_interfaces side of rejected Evidence; no conflict now and checks passing - #7305 test(devicetree): cover summary counts, node paging, and property selection in devicetree views; no conflict now and checks passing - #7309 fix(mcp): stamp required resultType on tools/call results under protocol 2026-07-28; no conflict now and checks passing - #7334 fix(cli): state each option default once in help output; no conflict now and checks passing - #7365 fix(artifacts): classify bundle executables by their own name; no conflict now and checks passing - #7368 feat(artifacts): inspect and extract Intel HEX and S-record firmware; closed 28 Oct without a merge - #7452 fix(artifacts): report required bytes for ASAR header limits; no conflict now and checks passing - #7453 fix(cli): reject surplus MCP registration arguments; no conflict now and checks passing - #7476 docs(index): drop the duplicated native-inspection guide row; closed 29 Oct without a merge - #7480 fix(docs): drop duplicate native-inspection guide row; no conflict now and checks passing - #7487 feat(rizin)!: record which tool and version answered execute_rizin_command; no conflict now and checks passing - #7526 fix(browser): preserve script exports with filesystem-unrepresentable paths; merged 28 Oct - #7600 feat(environment): serve sorted creates, listed references and toggles; merged 29 Oct - #7622 fix(cli): emit compact JSON validation errors for demangle-swift; no conflict now and checks passing - #7701 fix(native)!: correct Mach-O dispatch admission and errors; closed 29 Oct without a merge - #7702 fix(setup): stop doubling the period in invalid registration remediation; closed 29 Oct without a merge - #7771 feat(artifacts): inventory and extract U-Boot FIT images; merged 29 Oct - #7802 fix(cli): honor the selected format for unknown mcp subcommands; no conflict now and checks passing - #7831 fix(native): preserve Mach-O target selection in macOS tools; merged 29 Oct - #7852 fix(cli)!: refuse lossy text output; merged 29 Oct - #7855 fix(cli): preserve caller paths in format inspections; merged 29 Oct - #7859 feat(windows): inspect Shell Link (.lnk) shortcut files; no conflict now and checks passing - #7869 feat(artifacts): compare inventories from Evidence sources; merged 28 Oct - #7905 fix(mcp)!: bound validation work before tool dispatch; merged 29 Oct - #8088 feat(browser): accept mitmproxy 12.3.1 for native capture decode; no conflict now and checks passing - #8182 fix(security): remove unsafe exec(compile()) in bridge/ (pwntools, pwndbg); closed 2 Nov without a merge - #8231 fix(artifacts): decide how compare_artifacts compares every format_metadata kind; no conflict now and checks passing - #8331 fix(javascript): resolve module-level Electron options in functions; closed 1 Nov without a merge - #8470 fix(ghidra): guide recovery from unresolved procedure selectors; no conflict now and checks passing - #8497 feat(unity): inspect WebGL data containers and SerializedFile assets; no conflict now and checks passing - #8525 feat(audit): report what a shipped app exposes to static analysis; no conflict now and checks passing - #8533 feat(native): page retained feature traces through analysis views; closed 2 Nov without a merge - #8548 fix(setup): refuse Hopper on macOS below the release's minimum; merged 2 Nov - #8557 fix(evidence): bound malformed file field diagnostics; no conflict now and checks passing - #8586 refactor(ci): parse readiness fences with a static expression; merged 1 Nov - #8598 fix(cli): reject non-decimal byte-entropy window options; no conflict now and checks passing - #8599 fix(rust): state inflate limits on the consumed zlib stream; no conflict now and checks passing - #8600 fix(cli): reject empty artifact targets before resolution; no conflict now and checks passing - #8601 fix(cli): reject non-decimal native UI and command deadline options; no conflict now and checks passing - #8603 fix(pe): reject empty and non-minimal certificate serial INTEGERs; no conflict now and checks passing - #8604 docs(mcp): list every tool that omits the untrusted-content marker; no conflict now and checks passing </details> <details> <summary>How it's built</summary> - **Snapshot.** I took a snapshot of the open pull requests at about 4:14 PM UTC on 20 October 2026. It held 357 open pull requests that are not drafts and either conflict with main or have a failing check. - **Live check.** I re-read each one live. All 357 were still open. Five had changed. Two now conflict, so they moved to the both group. Three have no conflict now and their checks are running, so they are left out. That leaves 354. - **Refresh.** 475 moved out, to the Moved on since opening fold. 470 new ones are added. When a pull request's block changes, its line moves to the matching list. Old lines stay in the day group they were in. That makes 349. - **Last activity.** The days count from the author's last push or comment. Maintainer comments do not reset it. A pull request with no author activity counts from its last push. - **Failing CI.** Any failing check counts, whether or not it is required. - **Changes requested.** A review with changes requested, from an owner, member or collaborator who is not the author. - **Age.** Every pull request here is 22 days old or younger. </details> ### If something's wrong Comment on this issue and name the line. I will fix the list. ### Related trackers Every open tracker in the repo, so you can get to any of them from here. <details> <summary>Bugs and duplicates</summary> - #3537: Open bugs, by subsystem (matbrgz) - #4330: Duplicate issues, in clusters (matbrgz) - #5653: New issues by area, pointing at #4330 for duplicates (CassieFox23) </details> <details> <summary>Features and roadmap</summary> - #3796: Feature requests, by area (CassieFox23) - #2383: Support for the top 100 languages (matbrgz) - #2357: Static file and crash report work (matbrgz) - #3714 to #3719: six RFC epics on formats and bytecode (matbrgz) - #4027: Browser, Electron and JS work (N0zoM1z0) - #32: The main roadmap (morluto) - #48: The Evidence v2 epic (morluto) - #2039: The roadmap in plain words, a discussion (CassieFox23) </details> <details> <summary>Docs</summary> - #3795: Open docs issues and PRs (CassieFox23) </details> <details> <summary>Pull requests</summary> - #3582: Ready to close or merge, issues and PRs (CassieFox23) - #5654: Open PRs with conflicts or red CI (this one, CassieFox23) </details> <details> <summary>Show and tell</summary> - #1435: Linux setup notes and test queue, a discussion (CassieFox23) </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@DeryFerd commented on GitHub (Oct 22, 2026):

#5262 is not conflict again @CassieFox23 , thanks to @morluto

<!-- gh-comment-id:6338664316 --> @DeryFerd commented on GitHub (Oct 22, 2026): #5262 is not conflict again @CassieFox23 , thanks to @morluto
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@DeryFerd commented on GitHub (Oct 22, 2026):

@CassieFox23 #6327 didnt fail any CI Check i think, only some were skipped

<!-- gh-comment-id:6349298276 --> @DeryFerd commented on GitHub (Oct 22, 2026): @CassieFox23 #6327 didnt fail any CI Check i think, only some were skipped
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@CassieFox23 commented on GitHub (Oct 22, 2026):

Thanks, DeryFerd, you're right about the current head. On 7ab66ee3a, 25 checks pass, 19 are skipped, and none fail.

The (CI) tag means a check was failing when the tracker read the board. That read was at 12:18 PM EDT today. The branch was force-pushed after that, so the tag came from the earlier head. Tonight's tracker refresh moves it to the passing list.

🤖 Written with Claude Code (Haiku 5.5, verified by Opus 5.5), posted with my OK 🦊

<!-- gh-comment-id:6351299577 --> @CassieFox23 commented on GitHub (Oct 22, 2026): Thanks, DeryFerd, you're right about the current head. On 7ab66ee3a, 25 checks pass, 19 are skipped, and none fail. The (CI) tag means a check was failing when the tracker read the board. That read was at 12:18 PM EDT today. The branch was force-pushed after that, so the tag came from the earlier head. Tonight's tracker refresh moves it to the passing list. 🤖 Written with Claude Code (Haiku 5.5, verified by Opus 5.5), posted with my OK 🦊
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@DeryFerd commented on GitHub (Oct 24, 2026):

@CassieFox23 thank you very much.

new PRs: #6990 and #6991 are failed because main upstream is still failed, i'll keep updatting it

update: #6991 is now full green

<!-- gh-comment-id:6388676857 --> @DeryFerd commented on GitHub (Oct 24, 2026): @CassieFox23 thank you very much. new PRs: #6990 and #6991 are failed because main upstream is still failed, i'll keep updatting it update: #6991 is now full green
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@akshad-exe commented on GitHub (Oct 26, 2026):

@CassieFox23 For the #7054 (conflicts) line: I rebased and pushed the branch; GitHub now reports head 8ab20ab8f as mergeable, and Greptile Review passes on this head. Locally, build:cached, check:fast, docs:check, and the affected focused MCP tests passed. I have not verified a passing full CI run on this head: the current CI run reports action_required with no jobs. Could a maintainer approve/allow that run when convenient? I will address any failures it reports. The tracker line reflects its 25 October snapshot; please update it on the next refresh. Thanks!

<!-- gh-comment-id:6407258606 --> @akshad-exe commented on GitHub (Oct 26, 2026): @CassieFox23 For the #7054 `(conflicts)` line: I rebased and pushed the branch; GitHub now reports head `8ab20ab8f` as **mergeable**, and Greptile Review passes on this head. Locally, `build:cached`, `check:fast`, `docs:check`, and the affected focused MCP tests passed. I have **not** verified a passing full CI run on this head: [the current CI run](https://github.com/morluto/rea/actions/runs/40261616893) reports `action_required` with no jobs. Could a maintainer approve/allow that run when convenient? I will address any failures it reports. The tracker line reflects its 25 October snapshot; please update it on the next refresh. Thanks!
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@moah0911 commented on GitHub (Oct 29, 2026):

@CassieFox23 , resolved the merge conflict #7778 , it's good to go

<!-- gh-comment-id:6488665973 --> @moah0911 commented on GitHub (Oct 29, 2026): @CassieFox23 , resolved the merge conflict #7778 , it's good to go
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@GamerDubz commented on GitHub (Oct 30, 2026):

@CassieFox23 update for the #3003 (both) line: the conflicts are resolved at bf65bc9e2, and GitHub now reports the PR as mergeable. CI required passed, Greptile passed, and there are no failing or pending checks on this head. Please update that entry on the next refresh. Thanks!

#7619 still has merge conflicts, so that entry should stay.

<!-- gh-comment-id:6516992304 --> @GamerDubz commented on GitHub (Oct 30, 2026): @CassieFox23 update for the #3003 `(both)` line: the conflicts are resolved at `bf65bc9e2`, and GitHub now reports the PR as mergeable. [CI required passed](https://github.com/morluto/rea/actions/runs/40865604461/job/123431736036), Greptile passed, and there are no failing or pending checks on this head. Please update that entry on the next refresh. Thanks! #7619 still has merge conflicts, so that entry should stay.
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@GamerDubz commented on GitHub (Oct 30, 2026):

@CassieFox23 update for the #7619 (conflicts) line: resolved in 239217ca2, and GitHub now reports the PR as mergeable.

The merge keeps upstream's installation-bound direct registrations and moves the still-needed plugin command runner out of the deleted prewarm module. Locally, 203 setup/service/CLI tests passed (2 Windows skips); typecheck, lint, formatting, docs, architecture and the final build passed. The normal commit and pre-push hooks ran successfully.

Fresh hosted CI is still running, with no failures reported so far, so I am only reporting the conflict as resolved. Please update that entry on the next refresh. Thanks!

<!-- gh-comment-id:6518453818 --> @GamerDubz commented on GitHub (Oct 30, 2026): @CassieFox23 update for the #7619 `(conflicts)` line: resolved in `239217ca2`, and GitHub now reports the PR as mergeable. The merge keeps upstream's installation-bound direct registrations and moves the still-needed plugin command runner out of the deleted prewarm module. Locally, 203 setup/service/CLI tests passed (2 Windows skips); typecheck, lint, formatting, docs, architecture and the final build passed. The normal commit and pre-push hooks ran successfully. Fresh hosted CI is still running, with no failures reported so far, so I am only reporting the conflict as resolved. Please update that entry on the next refresh. Thanks!
bsakaguchi commented 2026-10-31 00:40:21 +00:00
Author
Owner
Copy link

@GamerDubz commented on GitHub (Oct 30, 2026):

@CassieFox23 quick update on #7619 at 1024eead1: the merge conflicts are resolved, and GitHub reports it as mergeable. Greptile passed with no new findings, and all eight test shards plus Portable tests passed.

CI is still blocked by the macOS arm64 package job. The package repack command exited successfully, but cleanup could not verify a live process's ownership token (malformed_procargs); CI required then failed because of that job. The cause is not confirmed, so I haven't weakened the ownership checks or marked this as fixed.

I tried rerunning the failed jobs, but GitHub returned Must have admin rights to Repository. Could a maintainer rerun the failed jobs on run 41059655323? For the tracker, this is now CI-only rather than a merge conflict. Thanks!

<!-- gh-comment-id:6531368889 --> @GamerDubz commented on GitHub (Oct 30, 2026): @CassieFox23 quick update on #7619 at `1024eead1`: the merge conflicts are resolved, and GitHub reports it as mergeable. Greptile passed with no new findings, and all eight test shards plus Portable tests passed. CI is still blocked by the [macOS arm64 package job](https://github.com/morluto/rea/actions/runs/41059655323/job/124076886300). The package repack command exited successfully, but cleanup could not verify a live process's ownership token (`malformed_procargs`); `CI required` then failed because of that job. The cause is not confirmed, so I haven't weakened the ownership checks or marked this as fixed. I tried rerunning the failed jobs, but GitHub returned `Must have admin rights to Repository`. Could a maintainer rerun the failed jobs on run `41059655323`? For the tracker, this is now CI-only rather than a merge conflict. Thanks!
bsakaguchi commented 2026-11-01 21:11:08 +00:00
Author
Owner
Copy link

@ArifAli8866 commented on GitHub (Oct 31, 2026):

@CassieFox23 update for the #4897 fix(update): bound update subprocess output collection (#4888) (conflicts) line: the merge conflicts are resolved at bd49463a2 (with the PR diff restored strictly to the 3 owning update files), and GitHub now reports the PR as mergeable.

PR readiness, Validate author declaration, and Greptile Review (5/5, no open findings) have all passed on bd49463a2. Locally, all 148/148 tests across the 7 focused update/process-output test files, check:fast, verify:test-discovery, verify:module-boundaries, format:check, metadata:check, verify:architecture-guards, knip:production, and lint:typed passed. Hosted GitHub Actions workflows on bd49463a2 are currently in action_required awaiting maintainer workflow approval. Please update that entry on the next refresh. Thanks!

<!-- gh-comment-id:6550057525 --> @ArifAli8866 commented on GitHub (Oct 31, 2026): @CassieFox23 update for the `#4897 fix(update): bound update subprocess output collection (#4888) (conflicts)` line: the merge conflicts are resolved at `bd49463a2` (with the PR diff restored strictly to the 3 owning update files), and GitHub now reports the PR as **mergeable**. `PR readiness`, `Validate author declaration`, and `Greptile Review` (`5/5`, no open findings) have all passed on `bd49463a2`. Locally, all 148/148 tests across the 7 focused update/process-output test files, `check:fast`, `verify:test-discovery`, `verify:module-boundaries`, `format:check`, `metadata:check`, `verify:architecture-guards`, `knip:production`, and `lint:typed` passed. Hosted GitHub Actions workflows on `bd49463a2` are currently in `action_required` awaiting maintainer workflow approval. Please update that entry on the next refresh. Thanks!
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#3425
No description provided.