[PR #6548] [CLOSED] fix(ida): exclude header and environment values from the registration digest #7378

New issue

Closed

opened 2026-11-01 21:47:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented 2026-11-01 21:47:25 +00:00

Owner

Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6548
Author: @Adolanium
Created: 10/23/2026
Status: ❌ Closed

Base: main ← Head: fix/ida-registration-digest-credentials

---

📝 Commits (2)

• 5f2b3c0 fix(ida): exclude header and environment values from the registration digest
• 0fb4ed2 fix(ida): withhold only marked credentials from the registration digest and rebind on private changes

📊 Changes

9 files changed (+225 additions, -13 deletions)

View changed files

📝 docs/ida-provider.md (+2 -2)
📝 src/application/AnalysisProvider.ts (+6 -0)
📝 src/application/binary/AnalysisProviderEvaluation.ts (+14 -3)
📝 src/application/binary/AnalysisProviderRegistry.ts (+6 -0)
📝 src/application/binary/BinarySession.ts (+5 -2)
📝 src/ida/IdaConfiguration.ts (+52 -1)
📝 src/ida/IdaProvider.test.ts (+97 -0)
📝 src/ida/IdaProvider.ts (+4 -5)
📝 tests/composition/analysis-sessions/providerBinding.test.ts (+39 -0)

📄 Description

Summary

Fixes #6549.

Status: draft until a maintainer approves the approach. It adds an optional field to the IDA registration and a provider-private binding key to shared session reuse. See the review threads.

The IDA analysis profile records a registration_digest, the SHA-256 of the whole MCP registration. The profile is returned with analysis results and retained in Evidence, so the digest committed to credential values in headers or env: anyone holding a candidate token could check it against the digest. This PR lets a registration mark which headers / env entries are secret, withholds only those values from the public digest, and keeps the full registration as a private binding key. The session compares that key before it reuses a live client. A rotated credential therefore reconnects without entering the profile, and non-secret values such as IDADIR keep distinguishing profiles.

Problem and expected behavior

IdaProvider.resolveAnalysisProfile set registration_digest to a hash of the full parsed registration. Two constraints apply:

• AGENTS.md asks REA to redact transport authentication credentials and explicitly marked sensitive values, without inferring secrecy from names. So which values to withhold has to be stated in the registration.
• The analysis profile is also what BinarySession compares before it reuses a live client for the same target. A digest without secret values would make a rotated token look unchanged and keep the old connection. An earlier revision of this PR did exactly that, and review caught it.

Expected: marked values never reach the profile, every other registration value still distinguishes profiles, and a change to any value, marked or not, starts a new client.

Change and scope

• src/ida/IdaConfiguration.ts: the registration accepts an optional sensitive list of names. Each name must be an entry of that registration's headers (HTTP) or env (stdio), or the registration is invalid. idaRegistrationDigest replaces only those values with [REDACTED], and keeps every other value, all names and the sensitive list itself. idaRegistrationBindingKey hashes the complete registration.
• src/application/AnalysisProvider.ts: AnalysisProfileResolution gains an optional, never-serialized bindingKey next to the existing provider-private createClient. The candidate evaluation and the registry binding carry it the same way they carry createClient.
• src/application/binary/BinarySession.ts: the same-target reuse check also requires an equal bindingKey. Providers that return none behave as before.
• IdaProvider.resolveAnalysisProfile returns the binding key with the profile.
• docs/ida-provider.md documents sensitive and what the digest covers.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block
integration. Link the required maintainer scope decision for new providers or
capabilities involving target execution, injection, mutation, or protection
recovery; ordinary fixes within existing boundaries may state "not applicable".
Draft PRs may leave the scope decision pending and the readiness and merge checklists
unchecked. Maintainers can help resolve open questions.

Contribution scope: this extends the IDA registration contract (new optional sensitive field) and the shared provider-binding contract (bindingKey). It is left as a draft for a maintainer decision on that approach; see the review threads.

Contract and boundary impact

• Semantic owner and earliest changed stage: IDA registration parsing and identity in IdaConfiguration.ts; client reuse in BinarySession.
• Contribution scope fit and linked maintainer decision: pending, see the review threads.
• CLI and MCP/tool-catalog contract: no tool schema change. IDA registrations may add sensitive; registrations without it keep today's digest. A registration that lists an unknown name fails validation.
• Provider, bridge, target-format, or platform compatibility: bindingKey is optional; only IDA returns one.
• Evidence, artifact, provenance, or reconstruction contract: marked values are withheld from the profile and Evidence. The binding key is never serialized: status output, snapshots and Evidence carry only the profile.
• Target selection, authority, upstream behavior, and cleanup details (if applicable): a changed registration value, including a marked one, now starts a new client for the same target and closes the old one.
• Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

• Read existing files or captured data.
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

• Tests added or updated:
  • src/ida/IdaProvider.test.ts, "withholds only marked HTTP header values from the public digest": with sensitive: ["Authorization"], a rotated bearer token keeps the digest but changes the binding key; a changed unmarked X-Backend header changes both; the same registration without sensitive gives a different digest.
  • "withholds only marked stdio environment values from the public digest": a rotated IDA_API_KEY keeps the digest and changes the binding key; a different IDADIR changes the digest.
  • "rejects a sensitive name that the registration does not define".
  • tests/composition/analysis-sessions/providerBinding.test.ts, "starts a new client when only the provider-private binding key changes": reopening and executing with an equal profile and key reuses the client; changing only the key creates a new client and closes the old one; session status never contains the key.
• Base reproduction or other evidence: negative checks at 0fb4ed21d. Dropping the key from the reuse check fails the session test. Withholding every value fails both IDA digest tests. Using the public digest as the binding key also fails both IDA digest tests.
• User-visible CLI/MCP output (if applicable): registration_digest values in IDA analysis profiles for registrations that use sensitive.
• Remaining proof gaps: no run against a real IDA MCP server.

For evidence-bearing changes:

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On Linux (WSL Ubuntu, Node 24.22.1) at 0fb4ed21d (on upstream/main 6c4d880f2), after npm run build:cached:

• npx tsc -p . --noEmit passed.
• npx oxfmt --check on the changed files: clean. npx oxlint on the eight changed source and test files: 16 warnings, the same as on main.
• npm run docs:check passed.
• npx vitest run src/ida tests/boundary/ida tests/composition/idaProvider.test.ts tests/composition/analysis-sessions src/application/binary: 45 files, 634 tests passed, in two runs.
• The three negative checks above failed their tests.

Compatibility, safety, and release

• Breaking changes or migration steps: none required. Users who keep credentials in headers or env should list them in sensitive.
• Real Hopper/Ghidra, browser, or OS coverage: Linux only; no real IDA.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: marked credentials leave the profile and Evidence; the full registration is compared only in memory.

Author readiness

Human owner: @Adolanium

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6548 **Author:** [@Adolanium](https://github.com/Adolanium) **Created:** 10/23/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/ida-registration-digest-credentials` --- ### 📝 Commits (2) - [`5f2b3c0`](https://github.com/morluto/rea/commit/5f2b3c05012590690a1ae2616b0f83fa4a6a59aa) fix(ida): exclude header and environment values from the registration digest - [`0fb4ed2`](https://github.com/morluto/rea/commit/0fb4ed21d1568aa4bfadc5f514907a9497ecee88) fix(ida): withhold only marked credentials from the registration digest and rebind on private changes ### 📊 Changes **9 files changed** (+225 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `docs/ida-provider.md` (+2 -2) 📝 `src/application/AnalysisProvider.ts` (+6 -0) 📝 `src/application/binary/AnalysisProviderEvaluation.ts` (+14 -3) 📝 `src/application/binary/AnalysisProviderRegistry.ts` (+6 -0) 📝 `src/application/binary/BinarySession.ts` (+5 -2) 📝 `src/ida/IdaConfiguration.ts` (+52 -1) 📝 `src/ida/IdaProvider.test.ts` (+97 -0) 📝 `src/ida/IdaProvider.ts` (+4 -5) 📝 `tests/composition/analysis-sessions/providerBinding.test.ts` (+39 -0) </details> ### 📄 Description ## Summary Fixes #6549. > **Status: draft until a maintainer approves the approach.** It adds an optional field to the IDA registration and a provider-private binding key to shared session reuse. See the review threads. The IDA analysis profile records a `registration_digest`, the SHA-256 of the whole MCP registration. The profile is returned with analysis results and retained in Evidence, so the digest committed to credential values in `headers` or `env`: anyone holding a candidate token could check it against the digest. This PR lets a registration mark which `headers` / `env` entries are secret, withholds only those values from the public digest, and keeps the full registration as a private binding key. The session compares that key before it reuses a live client. A rotated credential therefore reconnects without entering the profile, and non-secret values such as `IDADIR` keep distinguishing profiles. ## Problem and expected behavior `IdaProvider.resolveAnalysisProfile` set `registration_digest` to a hash of the full parsed registration. Two constraints apply: - AGENTS.md asks REA to redact transport authentication credentials and explicitly marked sensitive values, without inferring secrecy from names. So which values to withhold has to be stated in the registration. - The analysis profile is also what `BinarySession` compares before it reuses a live client for the same target. A digest without secret values would make a rotated token look unchanged and keep the old connection. An earlier revision of this PR did exactly that, and review caught it. Expected: marked values never reach the profile, every other registration value still distinguishes profiles, and a change to any value, marked or not, starts a new client. ## Change and scope - `src/ida/IdaConfiguration.ts`: the registration accepts an optional `sensitive` list of names. Each name must be an entry of that registration's `headers` (HTTP) or `env` (stdio), or the registration is invalid. `idaRegistrationDigest` replaces only those values with `[REDACTED]`, and keeps every other value, all names and the `sensitive` list itself. `idaRegistrationBindingKey` hashes the complete registration. - `src/application/AnalysisProvider.ts`: `AnalysisProfileResolution` gains an optional, never-serialized `bindingKey` next to the existing provider-private `createClient`. The candidate evaluation and the registry binding carry it the same way they carry `createClient`. - `src/application/binary/BinarySession.ts`: the same-target reuse check also requires an equal `bindingKey`. Providers that return none behave as before. - `IdaProvider.resolveAnalysisProfile` returns the binding key with the profile. - `docs/ida-provider.md` documents `sensitive` and what the digest covers. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Unresolved scope, authority, side effects, or required verification block integration. Link the required maintainer scope decision for new providers or capabilities involving target execution, injection, mutation, or protection recovery; ordinary fixes within existing boundaries may state "not applicable". Draft PRs may leave the scope decision pending and the readiness and merge checklists unchecked. Maintainers can help resolve open questions. Contribution scope: this extends the IDA registration contract (new optional `sensitive` field) and the shared provider-binding contract (`bindingKey`). It is left as a draft for a maintainer decision on that approach; see the review threads. ## Contract and boundary impact - Semantic owner and earliest changed stage: IDA registration parsing and identity in `IdaConfiguration.ts`; client reuse in `BinarySession`. - Contribution scope fit and linked maintainer decision: pending, see the review threads. - CLI and MCP/tool-catalog contract: no tool schema change. IDA registrations may add `sensitive`; registrations without it keep today's digest. A registration that lists an unknown name fails validation. - Provider, bridge, target-format, or platform compatibility: `bindingKey` is optional; only IDA returns one. - Evidence, artifact, provenance, or reconstruction contract: marked values are withheld from the profile and Evidence. The binding key is never serialized: status output, snapshots and Evidence carry only the profile. - Target selection, authority, upstream behavior, and cleanup details (if applicable): a changed registration value, including a marked one, now starts a new client for the same target and closes the old one. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage <!-- State whether evidence is executed, source-derived, or proposed. For fixes, show the original failure and explain how the regression would fail on the affected base revision when practical. Include the most useful proof inline; link long logs or artifacts, or put them in optional details. Documentation-only changes can use source, link, or rendered-document checks. --> - Tests added or updated: - `src/ida/IdaProvider.test.ts`, "withholds only marked HTTP header values from the public digest": with `sensitive: ["Authorization"]`, a rotated bearer token keeps the digest but changes the binding key; a changed unmarked `X-Backend` header changes both; the same registration without `sensitive` gives a different digest. - "withholds only marked stdio environment values from the public digest": a rotated `IDA_API_KEY` keeps the digest and changes the binding key; a different `IDADIR` changes the digest. - "rejects a sensitive name that the registration does not define". - `tests/composition/analysis-sessions/providerBinding.test.ts`, "starts a new client when only the provider-private binding key changes": reopening and executing with an equal profile and key reuses the client; changing only the key creates a new client and closes the old one; session status never contains the key. - Base reproduction or other evidence: negative checks at 0fb4ed21d. Dropping the key from the reuse check fails the session test. Withholding every value fails both IDA digest tests. Using the public digest as the binding key also fails both IDA digest tests. - User-visible CLI/MCP output (if applicable): `registration_digest` values in IDA analysis profiles for registrations that use `sensitive`. - Remaining proof gaps: no run against a real IDA MCP server. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed On Linux (WSL Ubuntu, Node 24.22.1) at 0fb4ed21d (on upstream/main 6c4d880f2), after `npm run build:cached`: - `npx tsc -p . --noEmit` passed. - `npx oxfmt --check` on the changed files: clean. `npx oxlint` on the eight changed source and test files: 16 warnings, the same as on main. - `npm run docs:check` passed. - `npx vitest run src/ida tests/boundary/ida tests/composition/idaProvider.test.ts tests/composition/analysis-sessions src/application/binary`: 45 files, 634 tests passed, in two runs. - The three negative checks above failed their tests. ## Compatibility, safety, and release - Breaking changes or migration steps: none required. Users who keep credentials in `headers` or `env` should list them in `sensitive`. - Real Hopper/Ghidra, browser, or OS coverage: Linux only; no real IDA. - Package or release metadata impact: none. - Security, privacy, process, or containment review: marked credentials leave the profile and Evidence; the full registration is compared only in memory. ## Author readiness <!-- The human owner completes these declarations before requesting review. The PR author is the owner by default. A different owner must explicitly accept ownership on this PR. AI agents must leave these declarations to a human to dictate to them or there could be catastrophic consequences for many users of REA. Draft PRs may leave them unchecked. These declarations record initial readiness when opening the PR for review; later pushes do not require a new human sign-off. Keep the description and validation evidence current as the work changes. See CONTRIBUTING.md#pull-request-ownership-and-readiness. --> Human owner: @Adolanium - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge <!-- Draft PRs may leave pending items unchecked. Resolve material scope and authority questions before integration. --> - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

bsakaguchi 2026-11-01 21:47:25 +00:00

• closed this issue
• added the
  pull-request
  label

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

codex/procedure-reference-stacked

release-please--branches--main--components--rea-agents

release-please--branches--main--components--rea-agents--release-notes

codex/kuna-independent-retry

codex/byte-search-overlay-coverage

codex/open-failure-target-receipt

codex/kuna-xref-evidence

codex/ghidra-ambiguous-procedure-recovery

codex/function-source-bundle

codex/trace-function-integration-prototype

codex/snapshot-source-closure

codex/recorded-evidence-array-pages

codex/evidence-recovery-redesign

codex/trace-feature-address-scope

codex/call-discovery-scope

codex/ghidra-literal-candidate-evidence

codex/decompile-directory-independent-retry

codex/retry-provenance-base

codex/value-flow-capability-experiment

codex/ghidra-containing-instruction

cursor/readme-discord-button-ef9f

dependabot/github_actions/actions/setup-node-7.1.0

dependabot/github_actions/actions/upload-artifact-7.0.2

dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df

codex/kuna-1989

fix/8559-native-ui-fixture-ownership

fix/8555-go-verifier-mcp-ownership

codex/provider-capability-recovery

fix/8642-rizin-target-stdin

codex/ghidra-memory-effect-scope

codex/ghidra-annotation-entry-selector

codex/ghidra-readonly-recovery

codex/ghidra-regex-verifier-recovery

codex/evidence-discovery-view-guidance

fix/8545-bulk-append-overflow

fix/8428-navigation-refusal-alternatives

codex/address-context-recovery

codex/matching-member-limitations

codex/unknown-scope-contract

codex/evidence-view-guidance

feat/8373-native-trace-views

codex/ghidra-snapshot-verifier-binding

codex/elf-export-visibility

codex/evidence-view-recovery

codex/native-reference-cli-help

codex/provider-candidate-observation-scope

codex/kuna-session-verification

codex/ghidra-switch-lifetime-guidance

codex/pseudocode-paging-discovery

codex/clarify-evidence-view-support

codex/kuna-xrefs-selector-recovery

codex/context-capacity-recovery

codex/evidence-closure-large-links

codex/same-function-evidence-identity

codex/ghidra-verifier-inspected-jdk

codex/audit-guided-workflows

codex/crash-prompt-retained-dossiers

codex/analysis-view-error-recovery

codex/kuna-verifier-target-selection

codex/ghidra-selected-project-call-coverage

codex/docs-native-analysis-scope

codex/ghidra-java-socket-boundary

codex/ghidra-retained-snapshot-verifier

codex/ghidra-search-inventory-facts

fix/8284-zero-argument-parameter-bindings

fix/8198-ui-action-handler-offset

fix/8257-elf-entry-label-identity

fix/8304-deferred-output-schema-projection

fix/8277-call-path-computed-target-uncertainty

fix/pr-8089-conflicts

fix/ci-static-duplicate-export

dependabot/npm_and_yarn/lint-staged-17.6.0

dependabot/github_actions/actions/download-artifact-8.0.2

dependabot/npm_and_yarn/write-file-atomic-8.0.0

dependabot/npm_and_yarn/canonicalize-5.1.0

dependabot/github_actions/actions/cache/restore-6.1.0

dependabot/npm_and_yarn/toon-format/toon-4.4.0

dependabot/github_actions/actions/deploy-pages-5.0.1

codex/review-fixes-pr-2403

codex/review-fixes-pr-2400

codex/process-terminal-width

codex/test-brittleness-cleanup

verify/7167-browser-connect-macos

fix/7167-browser-connect

feat/native-matching-allowance-setting

feat/browser-scenario-dry-run

test/managed-caller-parameters-20261024

codex/parser-fortythird-boundaries

fix/6926-pinvoke-platform-decorations-20261023

fix/6889-har-body-encoding-20261023

fix/6888-sqlite-schema-budget-20261023

fix/dependency-security-gates-6708

cursor/evidence-overwrite-rebase-b4ac

feat/4057-verify-native-exports

fix/windows-acl-observer-overhead-20261022

cursor/erlang-beam-restack-4476

cursor/pe-certificate-review-bf32

fix/6116-javascript-application-fs-errors

fix/6061-unmapped-runtime-script-unknown

feat/browser-scenario-summary

fix/pe-certificates

codex/verify-3407

cursor/rebase-5699

cursor/rebase-5352

cursor/rebase-5600

cursor/fix-cli-schema-omission-10a8

codex/audit-hopper-shutdown-reasons-20261021

fix/demangle-swift-omitted-record

fix/nib-boolean-value-types

cursor/cancellation-partial-observation-a5ac

fix/ib-object-limit-reasons

fix/electron-fuse-limit-advice

fix/kuna-doctor-dangling-cache

fix/fixed-budget-refusal-advice

fix/js-ipc-listener-dedup

fix/js-return-member-provenance

fix/dmg-integrity-retry-advice

fix/ida-doctor-readiness

fix/kuna-version-probe-output-drain

fix/legacy-swift-runtime-name-matching

fix/dylib-lazy-load-commands

fix/browser-scenario-startup-cancel

fix/swift-nested-punycode-classification

fix/compare-unselected-scopes

fix/objc-method-budget-coverage

fix/dmg-mounted-root-observations

audit/ci-tests-20261019-round2

release/6.7.0

fix/wabt-cleanup-retry-resolution

fix/electron-fuse-elf-pe-architecture

fix/native-plist-descriptor-ownership

fix/kuna-caller-cleanup-ownership

experiment/atomic-codemode-20261016

review/first-contributor-3776

fix/call-resolution-full-read-cycles

fix/member-mutation-selection-repeat

experiment/atomic-re-tools-20261015

perf/member-mutation-lazy-origins

perf/static-network-mutation-index

fix/hopper-startup-lifecycle

audit/3050-windows-proof-20261015

feat/windows-window-capture-2183

audit/3049-windows-proof-20261015

audit/3735-macos-fixtures-20261015

fix/batch-decompile-null-pseudocode

fix/kuna-inventory-honors-jobs

experiment/browser-codemode-tool-design-20261015

fix/hopper-clean-runtime-argv

codex/review-2049-27f1b367

review-fixes/pr-2787-routing

fix/3360-scoped-this-emitters

fix/3367-replaced-global-effects

fix/3838-compact-any-value-items

test/hopper-download-probe-20261015

codex/windows-runtime-creation-red-green-20261015

codex/windows-readonly-root-red-green-20261015

codex/windows-root-share-red-green-20261015

codex/exp-1685-win-mcp-startup

codex/bug-sweep-20261015

investigate/2190-windows-package-phases

investigate/3543-macos-cli-deadline

perf/3281-reverse-tools-feedback-quality

fix/3406-hopper-doctor-fixture

fix/3341-wrapper-require-test-context

fix/3301-owned-uninstall-fixtures

fix/3164-compiler-input-ownership

fix/pcap-cleanup-stdout-newline-20261014

perf/interface-builder-summary

codex/review-fixes-pr-1977

fix/ghidra-effective-jvm-platform

fix/docs-turkish-rust-link-20261013

fix/main-maintenance-ci-20261010

fix/recover-binary-session-process-effects

codex/review-fixes-pr-2457

codex/ci-required-cancellation-gate

fix/main-format-baseline-20261013

fix/setup-preserve-entry-fields

cursor/restore-main-checks-1ffc

fix/ghidra-bridge-hashmap-import

codex/shared-ci-jadx-json-default-20261013

codex/shared-ci-ghidra-test-groups-20261013

codex/shared-ci-java-fixture-format-20261013

codex/fix-intrinsic-invocation-boundaries

test/release-preflight-reusable-jobs

test/js-parameter-provenance-expectation

fix/linux-hopper-verification-current

test/2419-ghidra-elf-probe-size

followup/pr-1544-native-ida

codex/fold-pr-2230-contribution

docs/readme-responsible-use

fix/issue-2064

fix/issue-2050

fix/issue-2053

fix/issue-1968

fix/issue-1945

experiment/codemode-bridge-20261011

fix/tool-effects-negative-wording-1904-20261012

fix/1842-electron-interop-provenance

feat/recover-javascript-multi-input

refactor/website-i18n-prep

fix/nativeaot-pe-virtual-extent

fix/browser-verifier-ci-hang

fix/pe-resources-input-selection

docs/beginner-friendly-guides

docs/beginner-setup-guide

fix/javascript-analysis-worker-1563

fix/1649-ghidra-duplicate-names

fix/javascript-export-keys-integration-1369

test/maintenance-boundary-contracts-20261011

review/javascript-export-keys-1369

review/process-live-progress-1483

test/javascript-1495-growth-ratio

fix/ci-escape-timing

docs/normalized-terminal-geometry-1450

release/6.3.0

archive/release-6.3.0-pr1381

release/6.2.0

fix/electron-preload-dynamic-override

fix/javascript-self-referential-bundler-edges

release/6.1.0

cursor/grok-client-cherry-pick-0b56

feat/signature-posture

feat/dyld-shared-cache

feat/artifact-integrity-policy

feat/pkg-inventory

release/6.0.0

chore/sync-release-5.0.0

release/5.0.0

cursor/cloud-agent-node-787e

fix/javascript-xhr-open-endpoints

review/pr-711-realpath-fallback-wording

cleanup/replay-confinement

codex/test-suite-performance

codex/issue-foundations

codex/address-open-issues-2026-07-20

agent/javascript-vite-rollup-esbuild-adapters

agent/process-cleanup

agent/triage-integration

agent/unknown-commands-registry

feat/mcp-identity-metadata

morlvps/issue_cleanup

codex/installer-redesign

morl/roadmap-investigation-core

morl/roadmap-investigation-docs

release-please--branches--main--components--rea

rea-agents-6.8.0

rea-agents-6.7.0

rea-agents-6.6.0

experiment/atomic-codemode-wait-runtime-20261016

rea-agents-6.5.0

rea-agents-6.4.0

rea-agents-6.3.0

rea-agents-6.2.0

rea-agents-6.1.0

rea-agents-6.0.0

rea-agents-5.0.0

rea-agents-4.1.0

rea-agents-4.0.1

rea-agents-4.0.0

rea-agents-3.2.1

rea-agents-3.2.0

rea-agents-3.1.0

rea-agents-3.0.0

rea-agents-2.7.0

rea-agents-2.6.0

rea-agents-2.5.1

rea-agents-2.5.0

rea-agents-2.4.0

rea-agents-2.3.0

rea-agents-2.2.0

rea-agents-2.1.0

rea-agents-2.0.0

rea-agents-1.7.0

rea-agents-1.6.0

rea-agents-1.5.0

rea-agents-1.4.0

rea-agents-1.3.0

rea-agents-1.2.0

rea-agents-1.1.0

rea-agents-1.0.0

rea-agents-0.5.0

rea-agents-0.4.0

rea-agents-0.3.0

rea-0.2.1

rea-0.2.0

Labels

Clear labels   

area: bridge

  

area: bridge

  

area: build

  

area: build

  

area: build

  

area: cli

  

area: domain

  

area: evidence

  

area: mcp

  

area: native

  

area: providers

  

area: runtime

  

area: server

  

area: setup

  

area: tests

  

bug

  

design

  

documentation

  

enhancement

  

enhancement

  

enhancement

  

experiment

  

help wanted

  

i18n

  

invalid

  

P0: critical

  

P1: high

  

P2: medium

  

P2: medium

  

P2: medium

  

P3: low

  

performance

  

provider-request

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

roadmap

  

triage

No labels

area: bridge

area: bridge

area: build

area: build

area: build

area: cli

area: domain

area: evidence

area: mcp

area: native

area: providers

area: runtime

area: server

area: setup

area: tests

bug

design

documentation

enhancement

enhancement

enhancement

experiment

help wanted

i18n

invalid

P0: critical

P1: high

P2: medium

P2: medium

P2: medium

P3: low

performance

provider-request

pull-request

question

roadmap

triage

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7378

No description provided.