morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

New issue
Open
opened 2026-10-15 18:28:25 +00:00 by bsakaguchi · 3 comments
bsakaguchi commented 2026-10-15 18:28:25 +00:00
Owner
Copy link

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2383

Type: Tracker Status: Proposed Ecosystem: REA

Goal

Track a concrete, evidence-backed coverage audit for the 100 languages named in the October 2026 TIOBE Index, then link independently scoped improvements and their PRs. This is an index and prioritization aid, not a promise that REA supports 100 languages or that every language needs a dedicated provider.

Source: TIOBE Index, October 2026, consulted on 2026-10-12. TIOBE publishes individual positions for 1–50 and lists the 51–100 group alphabetically without individual positions. The two sections below preserve that distinction. The complete membership was checked: 50 + 50 = 100 unique entries. No popularity ratings are copied into this tracker.

What a checked language means

A checkbox means that its coverage audit is recorded and linked, including these facets:

Facet Required audit evidence
Artifact selection Actual compiler/interpreter/runtime, version, target format and exact input identity
Static inspection Available format/member/type/bytecode/instruction/reference facts and explicit unavailable facets
Source attribution Original source/debug metadata versus derived decompiler output; identity and mapping limitations
Recorded diagnostics Admitted dumps, traces or logs, with capture/runtime compatibility and coverage
Runtime debugging Actual supported provider/platform, target selection, stop/frame/value semantics, effects and cleanup
CLI/MCP Verified public workflows and retained Evidence through both adapters
Verification Reproducible owned/licensed fixture, checks run, provider identity and unverified platform/version combinations
Follow-up Existing child issues/PRs or a justified unsupported/not-applicable decision

An open checkbox means audit pending, not “no current capability.” Native file routing or successful static decompilation alone does not establish language-specific debugging. Interpreter, VM, query-language, visual-language and hardware-language entries may need different artifact/observation models; record not-applicable facets instead of inventing a debugger.

Triage and implementation rules

  • Reuse current provider contracts and existing issues before adding a provider or tool. Several languages can share a runtime while requiring separate semantic verification.
  • Each concrete domain/feature gets its own issue and its own docs/specs///{spec.md,plan.md,tasks.md}. This tracker must not become a single cross-domain implementation specification.
  • Keep static/recorded analysis separate from live launch/attach, evaluation, writes, injection and device effects. New providers/runtime capabilities follow the explicit maintainer scope decision in CONTRIBUTING.md before substantial implementation for integration.
  • Prioritize the already requested Pascal/Delphi, Java/JVM, Android and .NET lanes, then triage other entries according to concrete analyst needs and reusable provider coverage.
  • Record support only for actually verified compiler/runtime/provider/host combinations. A related issue link below is not an implementation claim.
  • Keep this October snapshot stable. Later monthly membership/rank changes can be recorded in a dated update without silently relabeling this baseline or losing completed audits.

Individually ranked languages: positions 1–50

Languages in the 51–100 group: alphabetical, individually unranked

  • ActionScript — TIOBE 51–100 group
  • Apex — TIOBE 51–100 group
  • Bash — TIOBE 51–100 group
  • bc — TIOBE 51–100 group
  • BCPL — TIOBE 51–100 group
  • Bourne shell — TIOBE 51–100 group
  • C shell — TIOBE 51–100 group
  • C++/CLI — TIOBE 51–100 group; related: #2380; managed/native mixed-mode capability remains unresolved
  • Clojure — TIOBE 51–100 group; related: #1558, #2376; JVM lane only, compiler-specific audit pending
  • CoffeeScript — TIOBE 51–100 group
  • cT — TIOBE 51–100 group
  • EGL — TIOBE 51–100 group
  • Elixir — TIOBE 51–100 group
  • Erlang — TIOBE 51–100 group
  • F# — TIOBE 51–100 group; related: #2351, #2380; managed metadata foundation requires F# verification
  • GAMS — TIOBE 51–100 group
  • Groovy — TIOBE 51–100 group; related: #1558, #2376, #2377; JVM lane only, compiler-specific audit pending
  • Inform — TIOBE 51–100 group
  • Io — TIOBE 51–100 group
  • J# — TIOBE 51–100 group; related: #2380 (legacy-runtime compatibility unresolved)
  • JScript — TIOBE 51–100 group
  • JScript.NET — TIOBE 51–100 group; related: #2380 (legacy-runtime compatibility unresolved)
  • LabVIEW — TIOBE 51–100 group
  • Logo — TIOBE 51–100 group
  • ML — TIOBE 51–100 group
  • Mojo — TIOBE 51–100 group
  • MQL5 — TIOBE 51–100 group
  • MS-DOS batch — TIOBE 51–100 group
  • Nim — TIOBE 51–100 group
  • OpenCL — TIOBE 51–100 group
  • PL/I — TIOBE 51–100 group
  • Pure Data — TIOBE 51–100 group
  • PureBasic — TIOBE 51–100 group
  • Q — TIOBE 51–100 group
  • REBOL — TIOBE 51–100 group
  • Ring — TIOBE 51–100 group
  • RPG — TIOBE 51–100 group
  • Solidity — related: #2388–#2396, #3736 (stack-to-SSA decompilation) — TIOBE 51–100 group; related: #972; PRs #1051, #2308 (offline EVM interface evidence, not source/runtime parity), #2420 (terminal CBOR candidate facts, lossless scalar keys/integers and reported compiler versions); follow-ups: #2388, #2389, #2390, #2391, #2392, #2393, #2394, #2395, #2396
  • SQR — TIOBE 51–100 group
  • Tcl — TIOBE 51–100 group
  • tcsh — TIOBE 51–100 group
  • thinBasic — TIOBE 51–100 group
  • V — TIOBE 51–100 group
  • VHDL — TIOBE 51–100 group
  • XBase++ — TIOBE 51–100 group
  • XC — TIOBE 51–100 group
  • Xen — TIOBE 51–100 group
  • Xojo — TIOBE 51–100 group
  • XPL — TIOBE 51–100 group
  • Z shell — TIOBE 51–100 group

Existing focused work

  • General native debugger lifecycle: #1267.
  • Java static domain and compiler debug metadata: #1558, #2377.
  • JVM debugging: #2376.
  • Android/ART and Java/JNI correlation: #717, #1813, #2378, #2379.
  • Free Pascal/Delphi debugging and offline MAP symbols: #2372, #2373, #2375.
  • .NET Portable PDB, managed debugging and recorded diagnostics: #2351, #2380, #2381, #2370.
  • Existing LLDB call-location source coordinates: #2382.
  • Independent format/analysis backlog index: #2357.

Tracker maintenance

  • Verify the source edition, 100-entry membership and ranked/unranked distinction.
  • Link existing focused proposals rather than open 100 duplicate feature requests.
  • Audit current advertised capabilities and real-provider coverage for the priority language/runtime families.
  • Link each completed language audit to its evidence and remaining feature issues.
  • Revisit priorities after maintainer scope decisions and verified PR outcomes.

Expanded issue and PR relationship index

Repository metadata snapshot on 2026-10-12: 795 issues and 1552 PRs, across all states. The indices below link 971 distinct related entries: 504 language/runtime entries here and **467 shared native-provider/debugger/format entries in the complementary native index.

Relations are indexed by the actual language/runtime/provider topics in the repository history. They include proposed capabilities, fixes, verification and historical contributions. State is captured as of this snapshot; related does not mean approved, currently shipped, or verified on every compiler/host.

Important historical correction: PR #449 and closed issue #367 added JVM/Python bytecode scaffolding that was never exposed as a tool and was subsequently removed. Issue #2296 documents that history. They remain historical references, not evidence of current JVM/Python inspection support. Likewise, Go PR #1363 concerns build metadata, Dart PR #1582 artifact identification, and EVM PR #1051 offline interface evidence; none alone establishes a language-specific debugger.

State legend: issue OPEN/CLOSED is discussion status; PR OPEN/CLOSED/MERGED is contribution status. Closed unmerged PRs are retained as superseded/abandoned references, not delivered features. Merged history must still be checked against current contracts and verification.

Pascal and Delphi: 3 issues + 1 PR

  • PR #2400 [OPEN] — bounded native call-entry source positions; owned Free Pascal CLI/MCP fixture verified on Darwin, without a typed-local or interactive-step conformance claim.

  • Issue #2375 [OPEN] — [Design] Delphi stopped-frame values and exception evidence without implicit property evaluation

  • Issue #2373 [OPEN] — [Feature] Inspect caller-selected Delphi MAP symbols with explicit address and binary provenance

  • Issue #2372 [OPEN] — [Design] Free Pascal source debugging with an explicit GDB capability matrix

JVM and Android: 31 issues + 45 PRs
  • Issue #2379 [OPEN] — [Design] Correlate Android Java/JNI and native debugger observations with verified module identities
  • Issue #2378 [OPEN] — [Design] Attach to a selected debuggable Android app with device and ART process identity
  • Issue #2377 [OPEN] — [Feature] Inspect JVM source-line and local-variable metadata for debugging readiness
  • Issue #2376 [OPEN] — [Design] Observe caller-selected JVM debugger sessions through JDI/JDWP
  • Issue #2317 [CLOSED] — [Bug] Artifact inventory labels JVM class files as universal Mach-O executables
  • Issue #2225 [CLOSED] — [Bug] ADB activity startup treats Status: timeout as a successful launch
  • Issue #2175 [CLOSED] — fix(adb): logcat reports character units in total_bytes
  • Issue #1978 [CLOSED] — [Bug] search_android_classes fails on APKs where JADX lists okio.SegmentedByteString twice
  • Issue #1952 [CLOSED] — ADB refusals show generic target advice, and a relative REA_ADB_PATH escapes as UNKNOWN
  • Issue #1945 [CLOSED] — apktool refusals show generic target advice, and a relative REA_APKTOOL_COMMAND escapes as UNKNOWN
  • Issue #1860 [CLOSED] — [Bug] Android engine admission rejects duplicate ZIP resource names in the audited JAR
  • Issue #1850 [CLOSED] — [Bug] Focused Android class searches embed the complete provider inventory
  • Issue #1846 [CLOSED] — [Bug] Android method inspection loses executable static initializer evidence
  • Issue #1813 [OPEN] — [Design] Android split APK sets: set identity and relationship evidence before a bundletool lane
  • Issue #1774 [CLOSED] — [Bug] Windows: apktool launcher probe fails with spawn EINVAL when REA_APKTOOL_COMMAND points to a .cmd/.bat wrapper
  • Issue #1598 [CLOSED] — fix(ci): format concurrent APKTool and update maintenance changes
  • Issue #1585 [CLOSED] — fix(ci): restore formatting gate after ADB schema repair
  • Issue #1581 [CLOSED] — [Bug] ADB input patterns break Unicode-set MCP schema validation
  • Issue #1558 [OPEN] — [Feature] Java analysis
  • Issue #1470 [CLOSED] — [Bug] inspect-artifact rejects a valid APK whose entries differ only in case
  • Issue #1451 [OPEN] — [Feature] support droidasc for REA Android reverse feature
  • Issue #1441 [CLOSED] — [Bug] JADX cleanup-failure fixture loses the reason for incomplete teardown
  • Issue #1262 [CLOSED] — [Feature] codex 提示 REA 的 Android/JADX 流程在当前 Windows 宿主上不可用，需要受支持的 Linux/macOS 环境。
  • Issue #1125 [CLOSED] — fix(android): failures recommend doctor without relevant diagnostics
  • Issue #1124 [CLOSED] — fix(android): binary_session advertises tools without the required engine
  • Issue #901 [CLOSED] — fix(android): avoid eager JADX code generation and retain owned APK sessions
  • Issue #893 [CLOSED] — JADX provider OOMs on real-world multidex APK (11 dex, 133MB)
  • Issue #717 [OPEN] — [Feature] Integrate APK analysis tools into REA: research and roadmap
  • Issue #367 [CLOSED] — Add JVM and Python bytecode providers
  • Issue #366 [CLOSED] — Add Android APK/AAB/DEX and iOS IPA static investigation providers
  • Issue #356 [CLOSED] — Add artifact graph readers for IPA, APK, MSIX, and other container families
  • PR #2359 [OPEN] — fix(adb): count requested permissions that the device marks restricted
  • PR #2354 [OPEN] — fix(adb): report the device state when a push cannot probe the path
  • PR #2344 [OPEN] — fix(adb): keep the device's refusal when a package change exits nonzero
  • PR #2329 [CLOSED] — fix(inventory): stop labeling JVM class files as universal Mach-O
  • PR #2327 [OPEN] — fix(artifacts): distinguish JVM classes from universal Mach-O files
  • PR #2237 [CLOSED] — fix(adb): logcat total_bytes counts UTF-8 bytes instead of UTF-16 code units
  • PR #2226 [OPEN] — fix(adb): reject timed-out activity launches and retain observations
  • PR #2221 [MERGED] — fix(adb): preserve existing bugreport archives
  • PR #2219 [CLOSED] — fix(android): preserve duplicate JADX class aliases in searches
  • PR #2212 [MERGED] — fix(adb): count UTF-8 bytes in logcat total_bytes
  • PR #2145 [MERGED] — fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools
  • PR #2066 [CLOSED] — test(adb): restore fixtures and the quoting regression after listing changes
  • PR #1984 [MERGED] — test(android): verify duplicate class inventory behavior on empty discovery queries
  • PR #1962 [MERGED] — fix(adb): reject unsafe host file names when pulling one device file
  • PR #1954 [MERGED] — fix(adb): share host configuration refusals with apktool
  • PR #1946 [MERGED] — fix(apktool): name host requirements in configuration refusals
  • PR #1903 [OPEN] — fix(adb): project actionable pm path refusal details
  • PR #1890 [MERGED] — fix(android): bound inline search Evidence with retained inventory provenance
  • PR #1880 [CLOSED] — fix(android): restore real-lane verifier imports
  • PR #1876 [MERGED] — fix(android): preserve executable static initializer evidence
  • PR #1875 [CLOSED] — fix(android): recover folded static initializer instructions
  • PR #1777 [MERGED] — fix(apktool): run Windows batch launchers through cmd.exe
  • PR #1668 [MERGED] — test(ci): stabilize JADX recovery and ignore generated reports
  • PR #1655 [MERGED] — fix(browser): support Termux Android scenarios
  • PR #1639 [MERGED] — test(android): preserve reason in JADX cleanup-failure teardown poll
  • PR #1582 [MERGED] — feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing
  • PR #1556 [MERGED] — feat(apktool): decode Android resource tables through a caller-supplied launcher
  • PR #1552 [MERGED] — feat(adb): complete ADB device support for Android analysis
  • PR #1536 [MERGED] — feat(jeb): add JEB engine provider over its MCP interface
  • PR #1443 [MERGED] — test(android): retain incomplete cleanup failure reasons
  • PR #1276 [MERGED] — fix(android): support owned JADX stdio on Windows
  • PR #1266 [MERGED] — feat(website): add an Android showcase and clearer project prompts
  • PR #1145 [MERGED] — fix(android): validate engine archive prerequisites
  • PR #1027 [MERGED] — fix(windows): allow Java to read retained target snapshots
  • PR #977 [MERGED] — fix(android): align runtime suffix inference
  • PR #937 [MERGED] — fix(android): bound fragmented JADX MCP frame memory
  • PR #908 [MERGED] — fix(android)!: preserve JVM settings and reuse metadata sessions
  • PR #903 [CLOSED] — fix(android): allow explicit JADX heap limits
  • PR #873 [MERGED] — refactor(android): group layered source and verification
  • PR #852 [MERGED] — feat(application): wire Android and Apple inventory graph tools
  • PR #826 [MERGED] — refactor: share Android and firmware provider factories
  • PR #742 [MERGED] — fix(android): validate explicit Java runtime
  • PR #738 [MERGED] — feat(android): integrate static APK analysis with headless JADX
  • PR #451 [MERGED] — feat(mobile): add Android APK/AAB/DEX and iOS IPA static investigation providers
  • PR #449 [MERGED] — feat(bytecode): add JVM and Python bytecode providers
.NET and managed diagnostics: 25 issues + 56 PRs
  • Issue #2381 [OPEN] — [Design] Inspect recorded .NET dump stacks and heaps with matching runtime/DAC provenance
  • Issue #2380 [OPEN] — [Design] Managed .NET debugger sessions with CLR, module and stop-scoped value identity
  • Issue #2370 [OPEN] — [Feature] Inspect caller-selected recorded EventPipe traces
  • Issue #2352 [OPEN] — [Feature] Inventory and extract ordinary .NET single-file bundles
  • Issue #2351 [OPEN] — [Feature] Bind Portable PDB sequence points to selected managed methods
  • Issue #2299 [OPEN] — [Feature] Return optional decompiled C# for selected .NET members as reconstruction inference
  • Issue #2191 [CLOSED] — [Bug] Malformed PE section headers make managed inspection report execution_failure instead of invalid input
  • Issue #2160 [OPEN] — [Feature] Name the declaring type of call-edge and field-access targets in inspect_managed_members
  • Issue #2158 [OPEN] — [Feature] Decode ldstr user strings in inspect_managed_members
  • Issue #2121 [CLOSED] — [Bug] inspect-managed-members --type with a repeated or empty name reports execution_failure and recommends rea doctor
  • Issue #1953 [CLOSED] — inspect_managed_members falls back to a per-member TypeDef scan for unordered member lists (quadratic)
  • Issue #1940 [CLOSED] — inspect_managed_artifact rescans TypeDef rows for every local attribute constructor (quadratic)
  • Issue #1878 [CLOSED] — [Bug] Temporary managed row cursors exhaust the retained metadata budget
  • Issue #1832 [CLOSED] — [Bug] inspect-managed-members marks generic, array, fnptr, and custom-modifier member signatures unsupported
  • Issue #1812 [CLOSED] — [Bug] inspect-managed-members reports .NET facade assemblies as complete with zero types because exported (forwarded) types are never parsed
  • Issue #1801 [CLOSED] — [Bug] Managed static provider rejects game-sized assemblies: 256x per-byte IL/blob charge exhausts the 64 MiB budget at ~256 KB of IL
  • Issue #1736 [CLOSED] — fix(managed): distinguish .NET Standard API targets from runtime family
  • Issue #1596 [CLOSED] — [Bug] Managed RVAs past section virtual size decode as present
  • Issue #1371 [CLOSED] — [Bug] CLI --format json dies with RangeError: Invalid string length on a large managed assembly; jsonl and the default format succeed
  • Issue #1185 [CLOSED] — [Bug] NativeAOT unsupported-host rejection is reported as execution_failure with retry and doctor advice
  • Issue #744 [OPEN] — [Bug] NativeAOT Decompilation Support
  • Issue #553 [CLOSED] — Managed PE/CLI inspection must use explicit targets consistently through CLI and MCP
  • Issue #362 [CLOSED] — Add broader PE/COFF/PDB static inspection
  • Issue #358 [CLOSED] — Add managed-runtime dynamic observation provider
  • Issue #267 [CLOSED] — Add approval-gated managed-runtime characterization
  • PR #2342 [OPEN] — fix(managed): classify 32-bit-preferred assemblies as platform neutral
  • PR #2241 [OPEN] — fix(managed): decode the CIL no. prefix
  • PR #2194 [MERGED] — fix(managed): report malformed PE layouts as invalid input
  • PR #2192 [CLOSED] — fix(managed): report malformed PE layouts as invalid input
  • PR #2163 [OPEN] — feat(managed): name the declaring type of call and field targets
  • PR #2162 [OPEN] — feat(managed): decode ldstr user strings in member inspection
  • PR #2127 [CLOSED] — fix(cli): validate inspect-managed-members --type against the provider contract
  • PR #2125 [MERGED] — fix(managed): validate CLI type selections with the member contract
  • PR #2116 [OPEN] — fix(managed): pair members by declared identity before name-free remaps
  • PR #2075 [OPEN] — fix(managed): classify ReadyToRun images without ILONLY as modern .NET
  • PR #2037 [MERGED] — docs(cli): add a managed assembly inspection workflow
  • PR #1985 [MERGED] — fix(managed): admit ReadyToRun images built for non-Windows hosts
  • PR #1955 [MERGED] — fix(managed): share first-match member list ownership
  • PR #1943 [MERGED] — fix(managed): index attribute constructor owners once per layout
  • PR #1924 [OPEN] — test(evaluation): grade managed agent fixture facts
  • PR #1897 [MERGED] — fix(managed): bind row budget charges to metadata identities
  • PR #1893 [MERGED] — fix(managed): honor metadata ExtraData before table decoding
  • PR #1886 [MERGED] — fix(managed): resolve member ownership through pointer tables
  • PR #1864 [CLOSED] — fix(managed): project ExportedType forwarders in member inspection
  • PR #1837 [CLOSED] — fix(managed): decode common ECMA-335 member signature element types
  • PR #1835 [MERGED] — fix(managed): decode generic, array, fnptr, and modifier signatures
  • PR #1828 [MERGED] — fix(managed): report ExportedType rows in managed member inspection
  • PR #1825 [CLOSED] — fix(managed): surface exported (forwarded) types in member inspection
  • PR #1822 [MERGED] — fix(managed): bound transient CIL by decoded instruction count
  • PR #1768 [MERGED] — fix(managed): charge retained member facts instead of decoding bounds
  • PR #1743 [MERGED] — fix(managed): distinguish .NET Standard targets from runtimes
  • PR #1706 [MERGED] — feat(managed): select declaring types in inspect_managed_members
  • PR #1679 [CLOSED] — fix(native): bound NativeAOT PE reads by section virtual size
  • PR #1595 [CLOSED] — fix(dotnet): map managed RVAs through section virtual size
  • PR #938 [MERGED] — fix(dotnet): validate managed metadata and CIL boundaries
  • PR #926 [MERGED] — refactor(managed): group capability workflows and verification
  • PR #887 [MERGED] — fix(dotnet): inspect native boundaries of non-managed and malformed PEs
  • PR #675 [CLOSED] — fix(dotnet): keep non-CIL method implementations unknown
  • PR #607 [MERGED] — fix(managed): distinguish metadata handles from member accesses
  • PR #605 [MERGED] — fix(managed): recognize PE Thumb and ARMNT machines
  • PR #598 [MERGED] — fix(managed): classify truncated signatures as malformed
  • PR #447 [MERGED] — feat(pe): add broader PE/COFF/PDB static inspection
  • PR #300 [MERGED] — docs(managed): align normalized CIL claims with shipped v1 semantics
  • PR #298 [MERGED] — fix(managed): preserve page incompleteness in graph and comparison
  • PR #297 [MERGED] — fix(dotnet): downgrade truncated CIL identity and coverage
  • PR #295 [MERGED] — fix(managed): emit valid x64 conformance PE
  • PR #285 [MERGED] — feat: add managed characterization and reconstruction coverage
  • PR #283 [MERGED] — fix(dotnet): admit real CLI GUID and fat CIL bodies
  • PR #282 [MERGED] — feat(dotnet): add BYO ILSpy oracle diagnostics
  • PR #278 [MERGED] — test(dotnet): verify managed app graph manifests
  • PR #277 [MERGED] — feat(managed): project static evidence into application graph
  • PR #276 [MERGED] — test(dotnet): verify managed app manifests
  • PR #275 [MERGED] — feat(dotnet): verify managed native boundaries
  • PR #273 [MERGED] — feat(dotnet): import managed reconstructions
  • PR #272 [MERGED] — feat(dotnet): add managed runtime correlation planning
  • PR #271 [MERGED] — test(dotnet): add managed conformance verifier
  • PR #270 [MERGED] — feat(dotnet): add managed native boundary inspection
  • PR #269 [MERGED] — feat(dotnet): add managed member comparison
  • PR #263 [MERGED] — feat(dotnet): add managed member inspection
  • PR #260 [MERGED] — feat(dotnet): add managed artifact triage
  • PR #259 [MERGED] — docs(analysis): define managed-code evidence boundary
JavaScript, TypeScript and Electron: 70 issues + 246 PRs
  • Issue #2297 [OPEN] — [Feature] Recover function names, source mappings and types from stripped Go binaries
  • Issue #2272 [CLOSED] — [Bug] capture_electron_scenario reports every unresolvable path as application_path/invalid_format and drops the cause
  • Issue #2269 [OPEN] — [Bug] capture_electron_scenario kills the REA process (MCP server exits) when executable_path is an existing non-executable file
  • Issue #2257 [OPEN] — [Bug] Windows: intermittent "Open Windows path component failed [C:] (Win32 32)" fails analyze-javascript-application as non-retryable capability_unavailable
  • Issue #2174 [CLOSED] — fix(javascript): bundled isolated-world contextBridge exposure is omitted
  • Issue #2171 [CLOSED] — fix(javascript): renamed bundler exports parameters produce empty export-name metadata
  • Issue #2128 [OPEN] — [Bug] analyze-javascript-application: every ASAR input misreported as ENOENT on Windows (directory input works)
  • Issue #2058 [CLOSED] — [Bug] TypeScript import-equals declarations lose their module dependency during analysis
  • Issue #2024 [CLOSED] — [Bug] A null source name drops all known originals from a retained source map
  • Issue #1968 [CLOSED] — Cancellation after the last selected JavaScript source misreports the next unselected file as cancelled
  • Issue #1965 [CLOSED] — Curated Windows CI lane still lists the moved javascriptArtifactReconstruction suite
  • Issue #1911 [CLOSED] — [Bug] JavaScript admission reserves 80% of parent capacity for any later file
  • Issue #1909 [CLOSED] — [Bug] Nested Function.prototype.call chains bypass Electron intrinsic mutation checks
  • Issue #1882 [CLOSED] — [Bug] Retained prefixed source maps lose original-source evidence during application analysis
  • Issue #1848 [CLOSED] — [Feature] Prioritize caller-selected JavaScript sources before unrelated application analysis
  • Issue #1847 [CLOSED] — [Bug] JavaScript semantic workers exhaust heap on modest generated wrapper files
  • Issue #1842 [CLOSED] — [Bug] Electron interop helper names can attribute unrelated constructors to Electron
  • Issue #1831 [CLOSED] — [Bug] JavaScript namespace re-exports are omitted from complete semantic graphs
  • Issue #1811 [CLOSED] — [Bug] TypeScript NodeNext imports such as ./dep.js stay not-found in analyze-javascript-application
  • Issue #1802 [CLOSED] — [Bug] Electron analysis reports 0 BrowserWindows and 0 preloads when main uses electron.BrowserWindow namespace form; miss is not logged as unknown
  • Issue #1782 [CLOSED] — [Bug] Percent-encoded local source-map URLs fail to resolve inventoried files
  • Issue #1781 [CLOSED] — [Bug] JavaScript sourceMappingURL line comments truncate URLs at asterisks
  • Issue #1761 [CLOSED] — [Bug] A sibling node_modules file overrides package exports during JavaScript analysis
  • Issue #1748 [CLOSED] — [Bug] Repeated endpoint observations cause quadratic JavaScript graph accumulation
  • Issue #1738 [CLOSED] — fix(browser): account for source-map redirect error expansion
  • Issue #1729 [CLOSED] — fix(browser): source map redirects omit the effective resolution URL
  • Issue #1656 [CLOSED] — [Bug] Electron APIs are not recovered through aliasing variables (e.g. const ipc = ipcMain)
  • Issue #1653 [CLOSED] — bug(javascript): cancellation hides a failed owned-analyzer cleanup retry
  • Issue #1605 [CLOSED] — [Feature] Recover related scripts together in recover_javascript_sources
  • Issue #1589 [CLOSED] — [Bug] Windows Electron cleanup signals an unverified PID
  • Issue #1565 [CLOSED] — Improve resource limits and timeout handling for large JavaScript semantic analysis
  • Issue #1563 [CLOSED] — bug(javascript): public Bun module exhausts bounded heap and terminates CLI/MCP
  • Issue #1538 [CLOSED] — bug(javascript): wide receiver return expansion exceeds the function argument limit
  • Issue #1497 [CLOSED] — fix(browser): lock an attached CDP scenario by the URL the connection uses
  • Issue #1462 [CLOSED] — [Bug] JavaScript analysis blocks MCP ping and cancellation during synchronous computation
  • Issue #1387 [OPEN] — 6.3.0: analyze-javascript-application --json aborts on a large bundle that 6.2.0 completes
  • Issue #1380 [CLOSED] — [Bug] analyze-javascript-application aborts with RangeError on a large inline source map in a two-byte source
  • Issue #1367 [CLOSED] — [Bug] Malformed UNC source-map path aborts REA on Node builds its engines field allows
  • Issue #1336 [CLOSED] — [Feature] Let REA analyze Flathub Electron apps that fail the integrity check
  • Issue #1331 [CLOSED] — [Bug] CLI JSON input above the V8 string limit is reported as invalid-json, so large Evidence cannot be traced
  • Issue #1237 [CLOSED] — fix(electron): later dynamic overrides retain a stale preload association
  • Issue #1236 [CLOSED] — fix(javascript): local HTML script URLs falsely report missing assets
  • Issue #1234 [CLOSED] — fix(artifacts): byte-identical files erase JavaScript path classifications
  • Issue #1146 [CLOSED] — [Bug] analyze_javascript_application fails result validation when a webpack chunk lazily requests its own chunk id
  • Issue #1137 [CLOSED] — fix(process): cold macOS ownership-helper compilation exhausts source-map CLI deadlines
  • Issue #1129 [CLOSED] — [Bug] analyze_javascript_application fails result validation when any module imports itself
  • Issue #1009 [CLOSED] — analyze-javascript-application: schema rejection at /identity/key (too_small) on plain minified JS directory
  • Issue #861 [CLOSED] — analyze-javascript-application: unreadable_output '/label (too_small)' on a Vite bundle containing SheetJS (xlsx)
  • Issue #829 [OPEN] — Unify local-artifact vs live-DOM vs source-map URL policies
  • Issue #827 [CLOSED] — [Feature] Recover readable JavaScript sources through a pluggable upstream adapter
  • Issue #822 [CLOSED] — fix(javascript): computed-identifier member keys in electron native/ipc analyzers
  • Issue #799 [CLOSED] — [Feature] Export captured website scripts into existing JavaScript analysis
  • Issue #746 [CLOSED] — analyze-javascript-application: zero output for minutes then generic unreadable_output failure on a 24 MB Electron ASAR (Obsidian 1.12.7)
  • Issue #720 [CLOSED] — [Bug] Supported JavaScript directories receive misleading target diagnostics
  • Issue #623 [CLOSED] — analyze_javascript_application fails on large targets: RangeError: Invalid string length masked as reason 'io'
  • Issue #571 [CLOSED] — analyze_javascript_application fails on any archive containing a directory named like a code file (e.g. npm scope @zip.js)
  • Issue #559 [CLOSED] — javascript: finish converting property-name readers and consolidate binding resolution
  • Issue #530 [CLOSED] — Windows: V8 Inspector excludes every file-backed Node target (Node mangles file://C:/ to file://C:_ which fails URL parsing)
  • Issue #404 [CLOSED] — Add runtime semantic tracing for generated JavaScript applications
  • Issue #397 [CLOSED] — Add Node/Electron V8 inspector runtime observation provider
  • Issue #376 [CLOSED] — Capture Electron IPC channel/direction/sender/receiver with redacted payloads
  • Issue #375 [OPEN] — Capture Electron main/preload/utility process lifecycle and shell events
  • Issue #374 [CLOSED] — Implement Playwright/CDP capture driver and step-indexed output
  • Issue #279 [CLOSED] — ci: real-browser check flakes with Chrome CDP startup timeout
  • Issue #195 [CLOSED] — fix(domain): treat source-map extension case-insensitively in artifact edge mapping
  • Issue #194 [CLOSED] — fix(browser): accept page-scoped CDP websocket endpoints
  • Issue #117 [CLOSED] — Add semantic analysis for JavaScript and packaged application bundles
  • Issue #68 [CLOSED] — Add native JavaScript bundle indexing and semantic queries
  • Issue #64 [OPEN] — Add Electron shell and IPC instrumentation
  • Issue #63 [CLOSED] — Build a Playwright/CDP differential recorder
  • PR #2366 [OPEN] — fix(javascript): keep paths after __dirname inside the source directory
  • PR #2347 [OPEN] — fix(javascript): keep ASAR-named files without an ASAR header opaque
  • PR #2306 [OPEN] — fix(javascript): preserve CommonJS directory and ancestor lookup
  • PR #2302 [OPEN] — fix(electron): point scenario path errors at the field that failed
  • PR #2279 [OPEN] — fix(electron): identify each unresolved scenario path
  • PR #2276 [OPEN] — fix(electron): reject non-executable files before Playwright launch
  • PR #2234 [OPEN] — fix(javascript): collect exports through renamed bundler exports parameters
  • PR #2233 [OPEN] — fix(javascript): recover bundled exposeInIsolatedWorld contextBridge exposures
  • PR #2104 [OPEN] — fix(javascript): resolve module-relative Worker URL references
  • PR #2097 [OPEN] — fix(javascript): admit measured transfer retention in parent result budget
  • PR #2094 [OPEN] — feat(javascript): fold constant values and recover Electron boundaries through wrappers
  • PR #2093 [OPEN] — feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine
  • PR #2092 [OPEN] — feat(javascript)!: bound semantic graphs by serialized Evidence bytes
  • PR #2085 [CLOSED] — feat(javascript): resolve package pattern maps
  • PR #2081 [OPEN] — fix(javascript): retain TypeScript import-equals module dependencies
  • PR #2077 [OPEN] — fix(javascript): keep CommonJS require file URLs unresolved
  • PR #2062 [MERGED] — fix(javascript): preserve import-equals declaration and export evidence
  • PR #2061 [MERGED] — test(javascript): verify CommonJS file URL boundaries via CLI and MCP
  • PR #2060 [OPEN] — fix(javascript): retain explicit TypeScript import resolution modes
  • PR #2041 [OPEN] — fix(javascript): recover CommonJS builtin effects
  • PR #2034 [MERGED] — test(sourcemap): consolidate source map regressions
  • PR #2032 [CLOSED] — test(javascript): verify CommonJS extension lookup through CLI and MCP
  • PR #2031 [MERGED] — test(javascript): consolidate module lookup regressions
  • PR #2028 [CLOSED] — test(javascript): verify empty package main fallback through CLI and MCP
  • PR #2018 [OPEN] — feat(javascript): resolve package exports and imports wildcard patterns
  • PR #1975 [CLOSED] — fix(javascript): keep unselected sources out of cancellation failures
  • PR #1944 [MERGED] — feat(javascript): analyze selected application sources
  • PR #1941 [MERGED] — fix(javascript): bound value evaluation through nested closure aliases
  • PR #1939 [MERGED] — fix(javascript): preserve package and source-map boundary identity
  • PR #1934 [MERGED] — fix(javascript): retain completed facts through cancellation
  • PR #1921 [MERGED] — fix(javascript): preserve graphs within parent capacity
  • PR #1920 [CLOSED] — fix(javascript): admit deferred semantic graphs after later sources
  • PR #1916 [MERGED] — fix(javascript): normalize package URLs before array selection
  • PR #1915 [MERGED] — fix(javascript): report available parent result budget in coverage limits
  • PR #1914 [OPEN] — fix(javascript): preserve intrinsic invocation read identity
  • PR #1912 [MERGED] — fix(javascript): follow actual receivers in nested intrinsic calls
  • PR #1905 [MERGED] — perf(javascript): index source-map ignore lists per leaf
  • PR #1888 [CLOSED] — fix(javascript): preserve bare package specifier suffixes
  • PR #1887 [CLOSED] — fix(javascript): recover retained prefixed source maps
  • PR #1884 [CLOSED] — fix(javascript): resolve ESM package self references
  • PR #1874 [MERGED] — fix(javascript): trace wrapped Electron IPC paths in large bundles
  • PR #1871 [MERGED] — perf(javascript): skip nested callables during fingerprint traversal
  • PR #1862 [MERGED] — feat(javascript): resolve exact package import aliases
  • PR #1857 [MERGED] — fix(javascript): prove namespace interop before attributing Electron APIs
  • PR #1840 [OPEN] — fix(javascript): preserve Vite dependency values and indexes
  • PR #1834 [OPEN] — test(web): cover nullable HTTP captures through CDP and CLI
  • PR #1833 [MERGED] — fix(javascript): preserve namespace re-export relationships
  • PR #1827 [MERGED] — fix(javascript): follow bundler namespace interop for Electron APIs
  • PR #1820 [CLOSED] — fix(javascript): resolve NodeNext emitted extensions in application analysis
  • PR #1818 [CLOSED] — fix(javascript): resolve NodeNext emitted extensions to TypeScript sources
  • PR #1815 [OPEN] — feat(javascript): add proof-gated js-redox deobfuscation
  • PR #1810 [OPEN] — fix(javascript): recognize GraphQL operations after leading fragment interpolations
  • PR #1803 [CLOSED] — fix(javascript): retain unbound require semantic module links
  • PR #1799 [MERGED] — fix(javascript): retain unbound CommonJS semantic imports
  • PR #1797 [CLOSED] — fix(javascript): keep asterisks inside a sourceMappingURL line comment
  • PR #1789 [MERGED] — perf(javascript): skip the repeated-prefix scan on first capture visits
  • PR #1788 [MERGED] — fix(javascript): preserve and resolve complete source-map URLs
  • PR #1787 [CLOSED] — fix(javascript): percent-decode local URL references once
  • PR #1786 [CLOSED] — fix(javascript): keep asterisks in line-comment source-map URLs
  • PR #1767 [MERGED] — fix(javascript): bound self-alias mutation paths that never prune
  • PR #1762 [MERGED] — fix(javascript): honor package exports before sibling files
  • PR #1759 [MERGED] — fix(javascript): index repeated graph observations before final sorting
  • PR #1742 [MERGED] — fix(browser): retain effective source-map response urls
  • PR #1740 [MERGED] — fix(javascript): report JSON status for imported package manifests
  • PR #1686 [MERGED] — feat(javascript): recover code-split bundles from multiple inputs
  • PR #1673 [MERGED] — fix(javascript): recover Electron APIs through default imports and optional calls
  • PR #1671 [CLOSED] — fix(javascript): respect static path helper ownership
  • PR #1670 [MERGED] — feat(javascript): recognize tRPC procedures and GraphQL operations
  • PR #1664 [MERGED] — fix(javascript): exclude overwritten Electron API identities
  • PR #1654 [MERGED] — fix(javascript): preserve cleanup failures during preparation cancellation
  • PR #1651 [MERGED] — fix(javascript): isolate source analysis and retain bounded partial evidence
  • PR #1645 [CLOSED] — fix(browser): bound CDP message payloads to the shared protocol budget
  • PR #1644 [MERGED] — test(javascript): retain resource ownership in deep-return fixture
  • PR #1642 [CLOSED] — fix(browser): decode prefixed source-map responses
  • PR #1631 [MERGED] — test(javascript): share semantic graph fixtures
  • PR #1615 [MERGED] — fix(javascript): preserve trailing slash in package directory requests
  • PR #1610 [CLOSED] — fix(javascript): bound module source payload before deep semantic analysis
  • PR #1601 [MERGED] — perf(javascript): reduce retained semantic analysis allocations
  • PR #1600 [CLOSED] — fix(javascript): preserve exact static CommonJS export keys
  • PR #1588 [MERGED] — fix(browser): skip Windows Electron signals without verified lineage
  • PR #1577 [MERGED] — fix(javascript): retain runtime scope in bundled module relationships
  • PR #1569 [CLOSED] — fix(javascript): track shared references returned by getters
  • PR #1568 [MERGED] — feat(javascript): return a retained summary view on request
  • PR #1557 [MERGED] — fix(javascript): yield during receiver and reference classification
  • PR #1545 [MERGED] — fix(javascript): yield during the largest AST traversals
  • PR #1542 [MERGED] — fix(javascript): yield inside semantic analysis and large projection passes
  • PR #1540 [MERGED] — fix(javascript): accept the Wakaru 1.x release line and verify 1.14.0
  • PR #1539 [MERGED] — fix(javascript): avoid argument limits when expanding escaped receivers
  • PR #1537 [MERGED] — perf(javascript): index returned object targets
  • PR #1529 [CLOSED] — test(javascript): check #1495 growth rate instead of wall time
  • PR #1526 [MERGED] — test(javascript): verify escaped receivers through CLI and MCP
  • PR #1525 [MERGED] — fix(javascript): yield during per-file projection and graph construction
  • PR #1520 [CLOSED] — perf(javascript): index returned method analysis
  • PR #1519 [CLOSED] — perf(javascript): index returned method analysis
  • PR #1517 [MERGED] — fix(javascript): expand an escaped receiver's methods once (#1495)
  • PR #1474 [MERGED] — perf(javascript)!: stop repeating the semantic identifier strategy per fact
  • PR #1471 [MERGED] — fix(javascript): retain returned-reference mutation uncertainty
  • PR #1468 [CLOSED] — fix(javascript): attribute writes through a simple thunk's call result
  • PR #1458 [MERGED] — perf(javascript): derive the application graph ID once
  • PR #1457 [MERGED] — perf(javascript): hash each semantic evidence context once
  • PR #1448 [MERGED] — test(javascript): reuse comparison node fixtures
  • PR #1445 [MERGED] — fix(javascript): invalidate references stored through property targets
  • PR #1444 [MERGED] — fix(javascript): stop replaying earlier writes for each object property write
  • PR #1437 [MERGED] — fix(javascript): preserve effects through yielded array references
  • PR #1434 [MERGED] — perf(javascript): index change-graph nodes once per comparison
  • PR #1427 [MERGED] — fix(javascript)!: avoid event payload copies in graph metadata
  • PR #1424 [MERGED] — fix(javascript): unify package resolution and resolve exact exports subpaths
  • PR #1423 [MERGED] — fix(javascript)!: avoid endpoint payload copies in graph metadata
  • PR #1414 [CLOSED] — test(javascript): preserve member-alias fanout and loop regressions
  • PR #1410 [MERGED] — perf(javascript): aggregate semantic family coverage once
  • PR #1408 [MERGED] — fix(javascript): retain shorter literal metadata encodings
  • PR #1407 [MERGED] — fix(javascript)!: stop copying literals into semantic metadata
  • PR #1400 [MERGED] — fix(electron): support packaged app.asar pages and rewritten unpacked companions
  • PR #1393 [MERGED] — fix(javascript): stop reading media preload attributes as Electron preloads
  • PR #1392 [CLOSED] — fix(javascript): root application graphs at the application manifest
  • PR #1391 [MERGED] — fix(javascript): recognize Electron APIs through renamed bindings
  • PR #1390 [MERGED] — fix(javascript): bound member-mutation paths through reassignment loops
  • PR #1388 [CLOSED] — fix(javascript): avoid regex overflow for large source maps
  • PR #1386 [MERGED] — fix(javascript): handle oversized inline source maps
  • PR #1385 [CLOSED] — test(javascript): expect provable precision for the short-circuit mutation
  • PR #1372 [MERGED] — fix(javascript): decline source-map UNC references with an unusable host
  • PR #1370 [MERGED] — perf(javascript): validate the version change graph once
  • PR #1369 [CLOSED] — fix(javascript): preserve exact static CommonJS export keys
  • PR #1368 [MERGED] — fix(javascript): scan direct returns without recursive stack growth
  • PR #1366 [MERGED] — fix(mcp): preserve JavaScript workflow identity validation
  • PR #1361 [MERGED] — fix(javascript): honor module-sync package exports
  • PR #1351 [MERGED] — fix(javascript): resolve exported callables through lexical bindings
  • PR #1347 [MERGED] — perf(javascript): index version relationships once per comparison
  • PR #1333 [CLOSED] — fix(javascript): reject invalid package exports configurations
  • PR #1332 [CLOSED] — fix(javascript): distinguish prefix-only builtins from packages
  • PR #1328 [CLOSED] — fix(javascript): preserve semantic evidence through satisfies
  • PR #1326 [CLOSED] — fix(javascript): avoid positive-zero evidence for signed zero
  • PR #1324 [CLOSED] — fix(javascript): preserve distinct namespace provenance components
  • PR #1323 [CLOSED] — fix(javascript): select TypeScript declaration and CTS parser modes
  • PR #1312 [CLOSED] — fix(browser): follow only HTTP redirect statuses for source maps
  • PR #1295 [MERGED] — fix(javascript): reject encoded separators joined by HTML URL whitespace
  • PR #1292 [MERGED] — fix(javascript): preserve uncertainty after references escape to calls
  • PR #1287 [MERGED] — fix(javascript): resolve HTML script URLs after URL whitespace and percent decoding
  • PR #1286 [MERGED] — fix(electron): resolve effective preload after option overrides
  • PR #1239 [MERGED] — fix(javascript): classify application input selection failures by cause
  • PR #1218 [MERGED] — fix(javascript): allow cancellation during semantic graph commitment
  • PR #1216 [MERGED] — fix(javascript): report located sources with differing digests as modified
  • PR #1215 [MERGED] — fix(javascript): match source-map originals that name parent directories
  • PR #1181 [MERGED] — fix(javascript): resolve package exports targets only to the exact file
  • PR #1160 [MERGED] — feat(javascript): report observed export property presence
  • PR #1157 [MERGED] — fix(javascript): omit self-referential static references with disclosure
  • PR #1156 [MERGED] — fix(cli): cancel routed JavaScript analysis in rea analyze
  • PR #1153 [CLOSED] — fix(javascript): omit self-referential bundler edges with disclosure
  • PR #1152 [MERGED] — fix(javascript): preserve graphs with async chunk self-references
  • PR #1130 [MERGED] — fix(javascript): omit self-referential import edges with disclosure
  • PR #1120 [MERGED] — test(browser): pin DOM and source-map URL policy classifications
  • PR #1112 [MERGED] — perf(javascript): reuse validated immutable graphs
  • PR #1109 [MERGED] — fix(browser): compose nested source-map column offsets
  • PR #1102 [MERGED] — fix(javascript): parse plain TypeScript artifact dialects
  • PR #1098 [MERGED] — fix(javascript): honor cancellation before evidence publication
  • PR #1093 [MERGED] — fix(javascript): preserve original BOM source coordinates
  • PR #1092 [MERGED] — fix(javascript): preserve HTML carriage return source ranges
  • PR #1087 [MERGED] — fix(javascript): retain NodeNext artifact source facts
  • PR #1055 [MERGED] — fix(javascript): complete large-ASAR analysis with file-local projection
  • PR #1046 [MERGED] — fix(javascript): resolve root package exports arrays
  • PR #1045 [MERGED] — fix(javascript): recognize digits in artifact URI schemes
  • PR #1042 [MERGED] — fix(javascript): reconstruct HTML script loads accurately
  • PR #1031 [MERGED] — fix(javascript): resolve module URLs and reject invalid exports targets
  • PR #1028 [MERGED] — perf(javascript): cache canonical export comparison sort keys
  • PR #1025 [MERGED] — test(javascript): cover plain long-line loader identities
  • PR #1024 [MERGED] — fix(cli): stream large JavaScript JSON results
  • PR #1008 [MERGED] — fix(javascript): report application analysis progress on the CLI
  • PR #971 [MERGED] — perf(javascript): index Promise return-site ownership
  • PR #966 [MERGED] — fix(javascript): bound semantic node projection for resource safety
  • PR #955 [MERGED] — perf(javascript): reduce analysis and source-map work
  • PR #942 [MERGED] — perf(javascript): index semantic fingerprint relations
  • PR #939 [MERGED] — fix(javascript): handle deep static member paths
  • PR #932 [MERGED] — perf(javascript): analyze member chains without recursive copying
  • PR #929 [MERGED] — fix(javascript): retain recovered call argument positions
  • PR #916 [MERGED] — refactor(artifacts): isolate JavaScript file acquisition
  • PR #915 [MERGED] — fix(javascript): handle deep AST traversal and addition without stack overflow
  • PR #907 [MERGED] — refactor(javascript): group domain semantics and contracts
  • PR #902 [CLOSED] — feat(artifacts): let extraction and JavaScript analysis record integrity mismatches
  • PR #897 [MERGED] — feat(browser): trace captured website source-map locations
  • PR #896 [MERGED] — refactor(javascript): group application workflows and verification
  • PR #895 [MERGED] — fix(javascript): keep storage open versions out of XHR endpoints
  • PR #890 [MERGED] — fix(javascript): resolve bare source-map and worker URLs next to the script
  • PR #877 [MERGED] — fix(javascript): keep XHR and client endpoints that receiver spellings hid
  • PR #874 [MERGED] — fix(javascript): keep keyed-collection reads out of endpoints
  • PR #872 [MERGED] — fix(javascript): read open() endpoints only from XHR method/URL pairs
  • PR #871 [MERGED] — fix(javascript): read substitution-free templates as exact strings
  • PR #848 [MERGED] — feat(javascript): recover readable modules with Wakaru
  • PR #843 [MERGED] — fix(javascript): keep exact empty values in graph identities
  • PR #839 [MERGED] — fix(javascript): analyze sources containing empty string literals
  • PR #836 [MERGED] — fix(javascript): keep exact empty env keys and method names
  • PR #835 [MERGED] — fix(javascript): preserve computed Electron member uncertainty
  • PR #828 [MERGED] — refactor(domain): extract source-map envelope walk and disambiguate stringValue
  • PR #811 [MERGED] — fix(browser): identify NodeNext TypeScript original source artifacts
  • PR #810 [MERGED] — fix(javascript): project decoded file URL paths
  • PR #801 [MERGED] — feat(web): export captured scripts for JavaScript application analysis
  • PR #755 [CLOSED] — fix(reference): resolve emitted extensions to TypeScript source
  • PR #752 [MERGED] — fix(javascript): keep mutated object initializer values unknown
  • PR #749 [MERGED] — fix(javascript): expose result schema failures
  • PR #733 [MERGED] — fix(target): explain the JavaScript directory analysis route
  • PR #731 [MERGED] — fix(javascript): preserve unknown branches in primitive unions
  • PR #712 [MERGED] — fix(javascript): preserve path.resolve reset semantics
  • PR #710 [MERGED] — fix(electron): respect computed option keys and overrides
  • PR #691 [MERGED] — fix(javascript): count all source line terminators
  • PR #689 [CLOSED] — fix(browser): reject malformed indexed source-map offsets
  • PR #687 [CLOSED] — fix(javascript): keep optional parameter input unknown
  • PR #678 [CLOSED] — fix(javascript): invalidate values on nontrivial binding writes
  • PR #673 [CLOSED] — fix(javascript): keep nonfinite values outside JSON lattice
  • PR #672 [MERGED] — fix(javascript): read source-map directives only from comments
  • PR #671 [CLOSED] — fix(javascript): respect object property overwrite order
  • PR #668 [CLOSED] — fix(javascript): preserve array index positions
  • PR #666 [MERGED] — fix(javascript): preserve primitive addition coercion
  • PR #663 [MERGED] — fix(javascript): scope candidate ambiguity to query traversal
  • PR #646 [MERGED] — fix(javascript): hash graph and evidence JSON incrementally
  • PR #611 [MERGED] — fix(browser): release discarded source-map response bodies
  • PR #606 [MERGED] — fix(javascript): preserve Node exports fallback stop reasons
  • PR #591 [MERGED] — fix(javascript): honor package exports condition order
  • PR #589 [MERGED] — fix(javascript): respect HTML base URL components
  • PR #588 [MERGED] — fix(browser): derive source-map imports from syntax nodes
  • PR #576 [MERGED] — fix(javascript): preserve literal CommonJS path punctuation
  • PR #575 [MERGED] — fix(javascript): prefer package entrypoints over directory indexes
  • PR #546 [MERGED] — fix(browser): ignore duplicate frame navigations and read block-form source map directives
  • PR #538 [MERGED] — fix(javascript): correct lexical and dynamic scope analysis
  • PR #537 [MERGED] — fix(javascript): classify assignment targets and retain compound-assignment reads
  • PR #536 [MERGED] — fix(javascript): honor computed keys when naming callables, exports, requests and options
  • PR #518 [MERGED] — fix(browser): resolve redirected source map paths from final URL
  • PR #517 [MERGED] — fix(browser): release cancelled CDP cleanup without waiting for responses
  • PR #511 [MERGED] — fix(javascript): isolate lexical loop bindings
  • PR #510 [MERGED] — fix(javascript): bind named class expressions in their class scope
  • PR #509 [MERGED] — fix(javascript): respect lexical shadowing of require
  • PR #508 [MERGED] — fix(javascript): retain property reads during updates
  • PR #507 [MERGED] — fix(javascript): avoid invented computed destructuring properties
  • PR #464 [MERGED] — feat(electron): add autonomous Electron runtime analysis
  • PR #420 [MERGED] — feat(javascript): add bounded semantic tracing
  • PR #402 [MERGED] — fix(cli): route JavaScript applications from analyze
  • PR #304 [MERGED] — feat(javascript): add webpack and rspack runtime adapters
  • PR #303 [MERGED] — feat(javascript): recover commonjs and esm module relationships
  • PR #302 [MERGED] — feat(javascript): add binding and constant-value semantic IR
  • PR #299 [MERGED] — fix(electron): resolve package and dirname entrypoints by context
  • PR #280 [MERGED] — fix(electron): keep missing unpacked ASAR entries unavailable
  • PR #258 [MERGED] — feat(application): add isolated JavaScript replay
  • PR #255 [MERGED] — feat(electron): reconcile static artifacts with passive runtime
  • PR #252 [MERGED] — feat(electron): map static process and IPC boundaries
  • PR #249 [MERGED] — feat(artifact): reconstruct JavaScript application structure
  • PR #248 [MERGED] — feat(domain): add versioned JavaScript Application Graph
  • PR #218 [MERGED] — fix(browser): support page-scoped CDP transports
  • PR #209 [MERGED] — feat: add web and Electron analysis workflows
Go, Swift and Objective-C: 7 issues + 9 PRs
  • Issue #2167 [CLOSED] — fix(go): inspect-go-binary rejects valid Mach-O binaries with unmapped debug segments
  • Issue #2030 [OPEN] — [Feature] Decode Swift String literals in native function results
  • Issue #484 [CLOSED] — [Feature] Expose typed Swift and Objective-C dispatch metadata across providers
  • Issue #385 [OPEN] — Design and implement bounded Objective-C runtime observation
  • Issue #353 [CLOSED] — Add deeper Objective-C/Swift metadata and database save/licensing support
  • Issue #156 [CLOSED] — Objective-C class discovery includes non-class OBJC symbols
  • Issue #71 [OPEN] — Add approval-gated Objective-C runtime observation
  • PR #2246 [OPEN] — fix(go): read Mach-O images with unmapped debug segments
  • PR #2089 [OPEN] — fix(go): read build info from unstripped Mach-O binaries
  • PR #1363 [MERGED] — feat(go): inspect embedded binary build metadata
  • PR #1315 [CLOSED] — fix(symbols): discover emitted Swift protocol descriptors
  • PR #1313 [CLOSED] — fix(symbols): exclude Objective-C bookkeeping from declaration inventories
  • PR #964 [MERGED] — feat(native): observe function and Objective-C method calls under LLDB
  • PR #953 [MERGED] — feat(native): decode chained fixups, binds, ObjC categories and properties
  • PR #868 [MERGED] — fix(native): pass Swift symbols to swift-demangle as operands
  • PR #452 [MERGED] — feat(metadata): add deeper ObjC/Swift metadata and database save/licensing
Python, Dart and EVM: 4 issues + 5 PRs
  • Issue #2296 [OPEN] — [Feature] Decompile static Python bytecode (.pyc) files into labeled source inference
  • Issue #1431 [OPEN] — [Feature] HarmonyOS/OpenHarmony package and Ark bytecode analysis (ArkDecompiler evaluation)
  • Issue #972 [CLOSED] — [Feature] Modular EVM bytecode analysis and execution evidence adapters
  • Issue #494 [OPEN] — Investigate Hopper remaining on Executing Python Script overlay
  • PR #2334 [OPEN] — fix(flutter): reject ambiguous ELF mappings and bound note reads
  • PR #2308 [MERGED] — feat(evm): add retained interface summary delivery
  • PR #2261 [MERGED] — refactor(evm): bind offline analysis through a static descriptor
  • PR #1622 [MERGED] — perf(evm): avoid repeated cleanup diagnostics
  • PR #1051 [MERGED] — feat(evm): inspect offline bytecode interfaces through EVMole
Additional source-language and Rust references: 2 issues + 1 PRs
  • Issue #1659 [CLOSED] — [Bug] search_strings misses some Rust string literals and does not say so
  • Issue #1609 [CLOSED] — [Bug] Reference source imports lose Git HEAD after regular-file read admission
  • PR #1770 [MERGED] — fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts

Shared native providers, architecture/file admission, symbols, debugger ownership, Frida, WASM and recorded core/minidump foundations: see the full 467-entry complementary index. These shared capabilities must be matched to each language's actual compiler, artifact and observation needs.

Solidity follow-up batch (2026-10-12)

These nine independently scoped follow-ups extend the existing EVM interface lane and roadmap #972. Each issue owns its requirements and future spec/plan; the original relationship inventory above remains a dated snapshot. Suggested initial implementation: compiler artifacts and metadata, then source/ABI/storage facts, followed by proxy, recorded-trace and CFG profiles. PRs will be linked as verified increments land.

Current implementation and test follow-ups

  • #2400 implements the source-coordinate increment of #2382 and contributes owned Free Pascal verification for the #2372 lane. #2397 records a separate native-verifier investigation.
  • #2420 implements terminal CBOR inspection for #2388: exact scalar facts, partial/malformed coverage, historical Evidence compatibility and compiled-worker/MCP regressions. Supplied metadata JSON commitment binding remains pending.
  • #2403 addresses documentation organization issue #2401, preserves current public routes and MCP pagination guidance, and adds built-page regression verification to documentation CI.
  • Specs and ADRs use domain/feature slugs rather than a shared numeric counter. These increments do not complete a full language coverage audit.
Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2383 [![Type: Tracker](https://img.shields.io/badge/type-tracker-purple.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Goal Track a concrete, evidence-backed coverage audit for the 100 languages named in the **October 2026 TIOBE Index**, then link independently scoped improvements and their PRs. This is an index and prioritization aid, not a promise that REA supports 100 languages or that every language needs a dedicated provider. **Source:** [TIOBE Index, October 2026](https://www.tiobe.com/tiobe-index/), consulted on 2026-10-12. TIOBE publishes individual positions for 1–50 and lists the 51–100 group alphabetically without individual positions. The two sections below preserve that distinction. The complete membership was checked: **50 + 50 = 100 unique entries**. No popularity ratings are copied into this tracker. ## What a checked language means A checkbox means that its **coverage audit** is recorded and linked, including these facets: | Facet | Required audit evidence | |---|---| | Artifact selection | Actual compiler/interpreter/runtime, version, target format and exact input identity | | Static inspection | Available format/member/type/bytecode/instruction/reference facts and explicit unavailable facets | | Source attribution | Original source/debug metadata versus derived decompiler output; identity and mapping limitations | | Recorded diagnostics | Admitted dumps, traces or logs, with capture/runtime compatibility and coverage | | Runtime debugging | Actual supported provider/platform, target selection, stop/frame/value semantics, effects and cleanup | | CLI/MCP | Verified public workflows and retained Evidence through both adapters | | Verification | Reproducible owned/licensed fixture, checks run, provider identity and unverified platform/version combinations | | Follow-up | Existing child issues/PRs or a justified unsupported/not-applicable decision | An open checkbox means **audit pending**, not “no current capability.” Native file routing or successful static decompilation alone does not establish language-specific debugging. Interpreter, VM, query-language, visual-language and hardware-language entries may need different artifact/observation models; record not-applicable facets instead of inventing a debugger. ## Triage and implementation rules - Reuse current provider contracts and existing issues before adding a provider or tool. Several languages can share a runtime while requiring separate semantic verification. - Each concrete domain/feature gets its own issue and its own docs/specs/<domain>/<feature-slug>/{spec.md,plan.md,tasks.md}. This tracker must not become a single cross-domain implementation specification. - Keep static/recorded analysis separate from live launch/attach, evaluation, writes, injection and device effects. New providers/runtime capabilities follow the explicit maintainer scope decision in CONTRIBUTING.md before substantial implementation for integration. - Prioritize the already requested Pascal/Delphi, Java/JVM, Android and .NET lanes, then triage other entries according to concrete analyst needs and reusable provider coverage. - Record support only for actually verified compiler/runtime/provider/host combinations. A related issue link below is not an implementation claim. - Keep this October snapshot stable. Later monthly membership/rank changes can be recorded in a dated update without silently relabeling this baseline or losing completed audits. ## Individually ranked languages: positions 1–50 - [ ] **Python** — TIOBE #1; related: #2296, #3678 (packaged apps: PyInstaller, PYZ, zipapp); historical PR #449 and issue #367 (scaffolding later removed) - [ ] **C** — TIOBE #2; related: #1267; PR #964; source-coordinate follow-up #2382 - [ ] **C++** — TIOBE #3; related: #1267, #3624 (RTTI, vtables, virtual dispatch), #2382; PR #964 - [ ] **Java** — TIOBE #4; related: #1558, #2376, #2377, #3617 (Applets/JNLP), #3645 (Java Card), #3696 (Serialization streams); PR #2327 - [ ] **C#** — TIOBE #5; related: #2351, #2380, #2381, #2299; PRs #260, #263, #269, #2162, #2163 - [ ] **JavaScript** — TIOBE #6; related: PRs #249, #302, #303, #420, #464, #848, #1686; full JS index below - [ ] **Visual Basic** — TIOBE #7; related: #2351, #2380, #3628 (VBA p-code de-stomping); managed metadata PRs #260, #263 - [ ] **R** — TIOBE #8 - [ ] **SQL** — TIOBE #9 - [ ] **Rust** — TIOBE #10; related: #1659, #4102 (Mach-O slice selection without lipo); shared native-provider string evidence is not full Rust support - [ ] **Go** — TIOBE #11; related: #2297, #2167, #4102; PR #1363 (build metadata), PRs #2089 and #2246 (open) - [ ] **PHP** — TIOBE #12; related: PR #1770 (reference-source facts, not a PHP runtime debugger) - [ ] **Fortran** — TIOBE #13 - [ ] **Swift** — TIOBE #14; related: #2030, #1187, #484; PRs #452, #1208, #2049 - [ ] **Scratch** — TIOBE #15 - [ ] **COBOL** — TIOBE #16 - [ ] **Perl** — TIOBE #17 - [ ] **Julia** — TIOBE #18 - [ ] **Delphi/Object Pascal** — TIOBE #19; related: #2372, #2373, #2375, #2810 (VCL TPF0 forms), #2811 (VMT class graph), #2825 (AnsiString cp1252); PR #2400 - [ ] **MATLAB** — TIOBE #20 - [ ] **Ada** — TIOBE #21 - [ ] **SAS** — TIOBE #22 - [ ] **Assembly language** — TIOBE #23; related: #1267; PRs #964, #1961, #1959; shared native index - [ ] **Classic Visual Basic** — TIOBE #24; related: #3618 (ActiveX, COM, OCX TypeLib), #3628 (VBA/macros) - [ ] **Objective-C** — TIOBE #25; related: #385, #71, #484; PRs #452, #964 - [ ] **OCaml** — TIOBE #26 - [ ] **Dart** — TIOBE #27; related: PR #1582 (Flutter snapshot/AOT artifact identification; not a Dart debugger) - [ ] **Ruby** — TIOBE #28 - [ ] **VBScript** — TIOBE #29 - [ ] **PL/SQL** — TIOBE #30 - [ ] **Prolog** — TIOBE #31 - [ ] **Kotlin** — TIOBE #32; related: #717, #2378, #2379; Android PRs #738, #1552; JVM proposal #2376 - [ ] **ABAP** — TIOBE #33 - [ ] **D** — TIOBE #34 - [ ] **Lua** — related: #3699 (Lua & LuaJIT bytecode, chunks, CFG) — TIOBE #35 - [ ] **Lisp** — TIOBE #36 - [ ] **Caml** — TIOBE #37 - [ ] **TypeScript** — TIOBE #38; related: PRs #1102, #1087, #811; full JS/TS index below - [ ] **GML** — TIOBE #39 - [ ] **Scala** — TIOBE #40; related: #1558, #2376, #2377; host-JVM proposal, compiler-specific audit pending - [ ] **Haskell** — TIOBE #41 - [ ] **PowerShell** — TIOBE #42 - [ ] **Transact-SQL** — TIOBE #43 - [ ] **Ladder Logic** — TIOBE #44 - [ ] **(Visual) FoxPro** — TIOBE #45 - [ ] **Zig** — TIOBE #46 - [ ] **X++** — TIOBE #47 - [ ] **XSLT** — TIOBE #48 - [ ] **CFML** — TIOBE #49 - [ ] **Awk** — TIOBE #50 ## Languages in the 51–100 group: alphabetical, individually unranked - [ ] **ActionScript** — TIOBE 51–100 group - [ ] **Apex** — TIOBE 51–100 group - [ ] **Bash** — TIOBE 51–100 group - [ ] **bc** — TIOBE 51–100 group - [ ] **BCPL** — TIOBE 51–100 group - [ ] **Bourne shell** — TIOBE 51–100 group - [ ] **C shell** — TIOBE 51–100 group - [ ] **C++/CLI** — TIOBE 51–100 group; related: #2380; managed/native mixed-mode capability remains unresolved - [ ] **Clojure** — TIOBE 51–100 group; related: #1558, #2376; JVM lane only, compiler-specific audit pending - [ ] **CoffeeScript** — TIOBE 51–100 group - [ ] **cT** — TIOBE 51–100 group - [ ] **EGL** — TIOBE 51–100 group - [ ] **Elixir** — TIOBE 51–100 group - [ ] **Erlang** — TIOBE 51–100 group - [ ] **F#** — TIOBE 51–100 group; related: #2351, #2380; managed metadata foundation requires F# verification - [ ] **GAMS** — TIOBE 51–100 group - [ ] **Groovy** — TIOBE 51–100 group; related: #1558, #2376, #2377; JVM lane only, compiler-specific audit pending - [ ] **Inform** — TIOBE 51–100 group - [ ] **Io** — TIOBE 51–100 group - [ ] **J#** — TIOBE 51–100 group; related: #2380 (legacy-runtime compatibility unresolved) - [ ] **JScript** — TIOBE 51–100 group - [ ] **JScript.NET** — TIOBE 51–100 group; related: #2380 (legacy-runtime compatibility unresolved) - [ ] **LabVIEW** — TIOBE 51–100 group - [ ] **Logo** — TIOBE 51–100 group - [ ] **ML** — TIOBE 51–100 group - [ ] **Mojo** — TIOBE 51–100 group - [ ] **MQL5** — TIOBE 51–100 group - [ ] **MS-DOS batch** — TIOBE 51–100 group - [ ] **Nim** — TIOBE 51–100 group - [ ] **OpenCL** — TIOBE 51–100 group - [ ] **PL/I** — TIOBE 51–100 group - [ ] **Pure Data** — TIOBE 51–100 group - [ ] **PureBasic** — TIOBE 51–100 group - [ ] **Q** — TIOBE 51–100 group - [ ] **REBOL** — TIOBE 51–100 group - [ ] **Ring** — TIOBE 51–100 group - [ ] **RPG** — TIOBE 51–100 group - [ ] **Solidity** — related: #2388–#2396, #3736 (stack-to-SSA decompilation) — TIOBE 51–100 group; related: #972; PRs #1051, #2308 (offline EVM interface evidence, not source/runtime parity), #2420 (terminal CBOR candidate facts, lossless scalar keys/integers and reported compiler versions); follow-ups: #2388, #2389, #2390, #2391, #2392, #2393, #2394, #2395, #2396 - [ ] **SQR** — TIOBE 51–100 group - [ ] **Tcl** — TIOBE 51–100 group - [ ] **tcsh** — TIOBE 51–100 group - [ ] **thinBasic** — TIOBE 51–100 group - [ ] **V** — TIOBE 51–100 group - [ ] **VHDL** — TIOBE 51–100 group - [ ] **XBase++** — TIOBE 51–100 group - [ ] **XC** — TIOBE 51–100 group - [ ] **Xen** — TIOBE 51–100 group - [ ] **Xojo** — TIOBE 51–100 group - [ ] **XPL** — TIOBE 51–100 group - [ ] **Z shell** — TIOBE 51–100 group ## Existing focused work - General native debugger lifecycle: #1267. - Java static domain and compiler debug metadata: #1558, #2377. - JVM debugging: #2376. - Android/ART and Java/JNI correlation: #717, #1813, #2378, #2379. - Free Pascal/Delphi debugging and offline MAP symbols: #2372, #2373, #2375. - .NET Portable PDB, managed debugging and recorded diagnostics: #2351, #2380, #2381, #2370. - Existing LLDB call-location source coordinates: #2382. - Independent format/analysis backlog index: #2357. ### Tracker maintenance - [x] Verify the source edition, 100-entry membership and ranked/unranked distinction. - [x] Link existing focused proposals rather than open 100 duplicate feature requests. - [ ] Audit current advertised capabilities and real-provider coverage for the priority language/runtime families. - [ ] Link each completed language audit to its evidence and remaining feature issues. - [ ] Revisit priorities after maintainer scope decisions and verified PR outcomes. ## Expanded issue and PR relationship index Repository metadata snapshot on 2026-10-12: **795 issues and 1552 PRs**, across all states. The indices below link **971 distinct related entries**: **504 language/runtime entries here** and **467 shared native-provider/debugger/format entries in the [complementary native index](https://github.com/morluto/rea/issues/2383#issuecomment-6132669473). Relations are indexed by the actual language/runtime/provider topics in the repository history. They include proposed capabilities, fixes, verification and historical contributions. State is captured as of this snapshot; related does not mean approved, currently shipped, or verified on every compiler/host. **Important historical correction:** PR #449 and closed issue #367 added JVM/Python bytecode scaffolding that was never exposed as a tool and was subsequently removed. Issue #2296 documents that history. They remain historical references, not evidence of current JVM/Python inspection support. Likewise, Go PR #1363 concerns build metadata, Dart PR #1582 artifact identification, and EVM PR #1051 offline interface evidence; none alone establishes a language-specific debugger. **State legend:** issue OPEN/CLOSED is discussion status; PR OPEN/CLOSED/MERGED is contribution status. Closed unmerged PRs are retained as superseded/abandoned references, not delivered features. Merged history must still be checked against current contracts and verification. <details> <summary>Pascal and Delphi: 3 issues + 1 PR</summary> - PR #2400 [OPEN] — bounded native call-entry source positions; owned Free Pascal CLI/MCP fixture verified on Darwin, without a typed-local or interactive-step conformance claim. - Issue #2375 [OPEN] — [Design] Delphi stopped-frame values and exception evidence without implicit property evaluation - Issue #2373 [OPEN] — [Feature] Inspect caller-selected Delphi MAP symbols with explicit address and binary provenance - Issue #2372 [OPEN] — [Design] Free Pascal source debugging with an explicit GDB capability matrix </details> <details> <summary>JVM and Android: 31 issues + 45 PRs</summary> - Issue #2379 [OPEN] — [Design] Correlate Android Java/JNI and native debugger observations with verified module identities - Issue #2378 [OPEN] — [Design] Attach to a selected debuggable Android app with device and ART process identity - Issue #2377 [OPEN] — [Feature] Inspect JVM source-line and local-variable metadata for debugging readiness - Issue #2376 [OPEN] — [Design] Observe caller-selected JVM debugger sessions through JDI/JDWP - Issue #2317 [CLOSED] — [Bug] Artifact inventory labels JVM class files as universal Mach-O executables - Issue #2225 [CLOSED] — [Bug] ADB activity startup treats Status: timeout as a successful launch - Issue #2175 [CLOSED] — fix(adb): logcat reports character units in total_bytes - Issue #1978 [CLOSED] — [Bug] search_android_classes fails on APKs where JADX lists okio.SegmentedByteString twice - Issue #1952 [CLOSED] — ADB refusals show generic target advice, and a relative REA_ADB_PATH escapes as UNKNOWN - Issue #1945 [CLOSED] — apktool refusals show generic target advice, and a relative REA_APKTOOL_COMMAND escapes as UNKNOWN - Issue #1860 [CLOSED] — [Bug] Android engine admission rejects duplicate ZIP resource names in the audited JAR - Issue #1850 [CLOSED] — [Bug] Focused Android class searches embed the complete provider inventory - Issue #1846 [CLOSED] — [Bug] Android method inspection loses executable static initializer evidence - Issue #1813 [OPEN] — [Design] Android split APK sets: set identity and relationship evidence before a bundletool lane - Issue #1774 [CLOSED] — [Bug] Windows: apktool launcher probe fails with spawn EINVAL when REA_APKTOOL_COMMAND points to a .cmd/.bat wrapper - Issue #1598 [CLOSED] — fix(ci): format concurrent APKTool and update maintenance changes - Issue #1585 [CLOSED] — fix(ci): restore formatting gate after ADB schema repair - Issue #1581 [CLOSED] — [Bug] ADB input patterns break Unicode-set MCP schema validation - Issue #1558 [OPEN] — [Feature] Java analysis - Issue #1470 [CLOSED] — [Bug] inspect-artifact rejects a valid APK whose entries differ only in case - Issue #1451 [OPEN] — [Feature] support droidasc for REA Android reverse feature - Issue #1441 [CLOSED] — [Bug] JADX cleanup-failure fixture loses the reason for incomplete teardown - Issue #1262 [CLOSED] — [Feature] codex 提示 REA 的 Android/JADX 流程在当前 Windows 宿主上不可用，需要受支持的 Linux/macOS 环境。 - Issue #1125 [CLOSED] — fix(android): failures recommend doctor without relevant diagnostics - Issue #1124 [CLOSED] — fix(android): binary_session advertises tools without the required engine - Issue #901 [CLOSED] — fix(android): avoid eager JADX code generation and retain owned APK sessions - Issue #893 [CLOSED] — JADX provider OOMs on real-world multidex APK (11 dex, 133MB) - Issue #717 [OPEN] — [Feature] Integrate APK analysis tools into REA: research and roadmap - Issue #367 [CLOSED] — Add JVM and Python bytecode providers - Issue #366 [CLOSED] — Add Android APK/AAB/DEX and iOS IPA static investigation providers - Issue #356 [CLOSED] — Add artifact graph readers for IPA, APK, MSIX, and other container families - PR #2359 [OPEN] — fix(adb): count requested permissions that the device marks restricted - PR #2354 [OPEN] — fix(adb): report the device state when a push cannot probe the path - PR #2344 [OPEN] — fix(adb): keep the device's refusal when a package change exits nonzero - PR #2329 [CLOSED] — fix(inventory): stop labeling JVM class files as universal Mach-O - PR #2327 [OPEN] — fix(artifacts): distinguish JVM classes from universal Mach-O files - PR #2237 [CLOSED] — fix(adb): logcat total_bytes counts UTF-8 bytes instead of UTF-16 code units - PR #2226 [OPEN] — fix(adb): reject timed-out activity launches and retain observations - PR #2221 [MERGED] — fix(adb): preserve existing bugreport archives - PR #2219 [CLOSED] — fix(android): preserve duplicate JADX class aliases in searches - PR #2212 [MERGED] — fix(adb): count UTF-8 bytes in logcat total_bytes - PR #2145 [MERGED] — fix(jeb): confine an invalid REA_JEB_MCP_URL to the JEB tools - PR #2066 [CLOSED] — test(adb): restore fixtures and the quoting regression after listing changes - PR #1984 [MERGED] — test(android): verify duplicate class inventory behavior on empty discovery queries - PR #1962 [MERGED] — fix(adb): reject unsafe host file names when pulling one device file - PR #1954 [MERGED] — fix(adb): share host configuration refusals with apktool - PR #1946 [MERGED] — fix(apktool): name host requirements in configuration refusals - PR #1903 [OPEN] — fix(adb): project actionable pm path refusal details - PR #1890 [MERGED] — fix(android): bound inline search Evidence with retained inventory provenance - PR #1880 [CLOSED] — fix(android): restore real-lane verifier imports - PR #1876 [MERGED] — fix(android): preserve executable static initializer evidence - PR #1875 [CLOSED] — fix(android): recover folded static initializer instructions - PR #1777 [MERGED] — fix(apktool): run Windows batch launchers through cmd.exe - PR #1668 [MERGED] — test(ci): stabilize JADX recovery and ignore generated reports - PR #1655 [MERGED] — fix(browser): support Termux Android scenarios - PR #1639 [MERGED] — test(android): preserve reason in JADX cleanup-failure teardown poll - PR #1582 [MERGED] — feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing - PR #1556 [MERGED] — feat(apktool): decode Android resource tables through a caller-supplied launcher - PR #1552 [MERGED] — feat(adb): complete ADB device support for Android analysis - PR #1536 [MERGED] — feat(jeb): add JEB engine provider over its MCP interface - PR #1443 [MERGED] — test(android): retain incomplete cleanup failure reasons - PR #1276 [MERGED] — fix(android): support owned JADX stdio on Windows - PR #1266 [MERGED] — feat(website): add an Android showcase and clearer project prompts - PR #1145 [MERGED] — fix(android): validate engine archive prerequisites - PR #1027 [MERGED] — fix(windows): allow Java to read retained target snapshots - PR #977 [MERGED] — fix(android): align runtime suffix inference - PR #937 [MERGED] — fix(android): bound fragmented JADX MCP frame memory - PR #908 [MERGED] — fix(android)!: preserve JVM settings and reuse metadata sessions - PR #903 [CLOSED] — fix(android): allow explicit JADX heap limits - PR #873 [MERGED] — refactor(android): group layered source and verification - PR #852 [MERGED] — feat(application): wire Android and Apple inventory graph tools - PR #826 [MERGED] — refactor: share Android and firmware provider factories - PR #742 [MERGED] — fix(android): validate explicit Java runtime - PR #738 [MERGED] — feat(android): integrate static APK analysis with headless JADX - PR #451 [MERGED] — feat(mobile): add Android APK/AAB/DEX and iOS IPA static investigation providers - PR #449 [MERGED] — feat(bytecode): add JVM and Python bytecode providers </details> <details> <summary>.NET and managed diagnostics: 25 issues + 56 PRs</summary> - Issue #2381 [OPEN] — [Design] Inspect recorded .NET dump stacks and heaps with matching runtime/DAC provenance - Issue #2380 [OPEN] — [Design] Managed .NET debugger sessions with CLR, module and stop-scoped value identity - Issue #2370 [OPEN] — [Feature] Inspect caller-selected recorded EventPipe traces - Issue #2352 [OPEN] — [Feature] Inventory and extract ordinary .NET single-file bundles - Issue #2351 [OPEN] — [Feature] Bind Portable PDB sequence points to selected managed methods - Issue #2299 [OPEN] — [Feature] Return optional decompiled C# for selected .NET members as reconstruction inference - Issue #2191 [CLOSED] — [Bug] Malformed PE section headers make managed inspection report execution_failure instead of invalid input - Issue #2160 [OPEN] — [Feature] Name the declaring type of call-edge and field-access targets in inspect_managed_members - Issue #2158 [OPEN] — [Feature] Decode ldstr user strings in inspect_managed_members - Issue #2121 [CLOSED] — [Bug] inspect-managed-members --type with a repeated or empty name reports execution_failure and recommends rea doctor - Issue #1953 [CLOSED] — inspect_managed_members falls back to a per-member TypeDef scan for unordered member lists (quadratic) - Issue #1940 [CLOSED] — inspect_managed_artifact rescans TypeDef rows for every local attribute constructor (quadratic) - Issue #1878 [CLOSED] — [Bug] Temporary managed row cursors exhaust the retained metadata budget - Issue #1832 [CLOSED] — [Bug] inspect-managed-members marks generic, array, fnptr, and custom-modifier member signatures unsupported - Issue #1812 [CLOSED] — [Bug] inspect-managed-members reports .NET facade assemblies as complete with zero types because exported (forwarded) types are never parsed - Issue #1801 [CLOSED] — [Bug] Managed static provider rejects game-sized assemblies: 256x per-byte IL/blob charge exhausts the 64 MiB budget at ~256 KB of IL - Issue #1736 [CLOSED] — fix(managed): distinguish .NET Standard API targets from runtime family - Issue #1596 [CLOSED] — [Bug] Managed RVAs past section virtual size decode as present - Issue #1371 [CLOSED] — [Bug] CLI --format json dies with RangeError: Invalid string length on a large managed assembly; jsonl and the default format succeed - Issue #1185 [CLOSED] — [Bug] NativeAOT unsupported-host rejection is reported as `execution_failure` with retry and doctor advice - Issue #744 [OPEN] — [Bug] NativeAOT Decompilation Support - Issue #553 [CLOSED] — Managed PE/CLI inspection must use explicit targets consistently through CLI and MCP - Issue #362 [CLOSED] — Add broader PE/COFF/PDB static inspection - Issue #358 [CLOSED] — Add managed-runtime dynamic observation provider - Issue #267 [CLOSED] — Add approval-gated managed-runtime characterization - PR #2342 [OPEN] — fix(managed): classify 32-bit-preferred assemblies as platform neutral - PR #2241 [OPEN] — fix(managed): decode the CIL no. prefix - PR #2194 [MERGED] — fix(managed): report malformed PE layouts as invalid input - PR #2192 [CLOSED] — fix(managed): report malformed PE layouts as invalid input - PR #2163 [OPEN] — feat(managed): name the declaring type of call and field targets - PR #2162 [OPEN] — feat(managed): decode ldstr user strings in member inspection - PR #2127 [CLOSED] — fix(cli): validate inspect-managed-members --type against the provider contract - PR #2125 [MERGED] — fix(managed): validate CLI type selections with the member contract - PR #2116 [OPEN] — fix(managed): pair members by declared identity before name-free remaps - PR #2075 [OPEN] — fix(managed): classify ReadyToRun images without ILONLY as modern .NET - PR #2037 [MERGED] — docs(cli): add a managed assembly inspection workflow - PR #1985 [MERGED] — fix(managed): admit ReadyToRun images built for non-Windows hosts - PR #1955 [MERGED] — fix(managed): share first-match member list ownership - PR #1943 [MERGED] — fix(managed): index attribute constructor owners once per layout - PR #1924 [OPEN] — test(evaluation): grade managed agent fixture facts - PR #1897 [MERGED] — fix(managed): bind row budget charges to metadata identities - PR #1893 [MERGED] — fix(managed): honor metadata ExtraData before table decoding - PR #1886 [MERGED] — fix(managed): resolve member ownership through pointer tables - PR #1864 [CLOSED] — fix(managed): project ExportedType forwarders in member inspection - PR #1837 [CLOSED] — fix(managed): decode common ECMA-335 member signature element types - PR #1835 [MERGED] — fix(managed): decode generic, array, fnptr, and modifier signatures - PR #1828 [MERGED] — fix(managed): report ExportedType rows in managed member inspection - PR #1825 [CLOSED] — fix(managed): surface exported (forwarded) types in member inspection - PR #1822 [MERGED] — fix(managed): bound transient CIL by decoded instruction count - PR #1768 [MERGED] — fix(managed): charge retained member facts instead of decoding bounds - PR #1743 [MERGED] — fix(managed): distinguish .NET Standard targets from runtimes - PR #1706 [MERGED] — feat(managed): select declaring types in inspect_managed_members - PR #1679 [CLOSED] — fix(native): bound NativeAOT PE reads by section virtual size - PR #1595 [CLOSED] — fix(dotnet): map managed RVAs through section virtual size - PR #938 [MERGED] — fix(dotnet): validate managed metadata and CIL boundaries - PR #926 [MERGED] — refactor(managed): group capability workflows and verification - PR #887 [MERGED] — fix(dotnet): inspect native boundaries of non-managed and malformed PEs - PR #675 [CLOSED] — fix(dotnet): keep non-CIL method implementations unknown - PR #607 [MERGED] — fix(managed): distinguish metadata handles from member accesses - PR #605 [MERGED] — fix(managed): recognize PE Thumb and ARMNT machines - PR #598 [MERGED] — fix(managed): classify truncated signatures as malformed - PR #447 [MERGED] — feat(pe): add broader PE/COFF/PDB static inspection - PR #300 [MERGED] — docs(managed): align normalized CIL claims with shipped v1 semantics - PR #298 [MERGED] — fix(managed): preserve page incompleteness in graph and comparison - PR #297 [MERGED] — fix(dotnet): downgrade truncated CIL identity and coverage - PR #295 [MERGED] — fix(managed): emit valid x64 conformance PE - PR #285 [MERGED] — feat: add managed characterization and reconstruction coverage - PR #283 [MERGED] — fix(dotnet): admit real CLI GUID and fat CIL bodies - PR #282 [MERGED] — feat(dotnet): add BYO ILSpy oracle diagnostics - PR #278 [MERGED] — test(dotnet): verify managed app graph manifests - PR #277 [MERGED] — feat(managed): project static evidence into application graph - PR #276 [MERGED] — test(dotnet): verify managed app manifests - PR #275 [MERGED] — feat(dotnet): verify managed native boundaries - PR #273 [MERGED] — feat(dotnet): import managed reconstructions - PR #272 [MERGED] — feat(dotnet): add managed runtime correlation planning - PR #271 [MERGED] — test(dotnet): add managed conformance verifier - PR #270 [MERGED] — feat(dotnet): add managed native boundary inspection - PR #269 [MERGED] — feat(dotnet): add managed member comparison - PR #263 [MERGED] — feat(dotnet): add managed member inspection - PR #260 [MERGED] — feat(dotnet): add managed artifact triage - PR #259 [MERGED] — docs(analysis): define managed-code evidence boundary </details> <details> <summary>JavaScript, TypeScript and Electron: 70 issues + 246 PRs</summary> - Issue #2297 [OPEN] — [Feature] Recover function names, source mappings and types from stripped Go binaries - Issue #2272 [CLOSED] — [Bug] capture_electron_scenario reports every unresolvable path as application_path/invalid_format and drops the cause - Issue #2269 [OPEN] — [Bug] capture_electron_scenario kills the REA process (MCP server exits) when executable_path is an existing non-executable file - Issue #2257 [OPEN] — [Bug] Windows: intermittent "Open Windows path component failed [C:\] (Win32 32)" fails analyze-javascript-application as non-retryable capability_unavailable - Issue #2174 [CLOSED] — fix(javascript): bundled isolated-world contextBridge exposure is omitted - Issue #2171 [CLOSED] — fix(javascript): renamed bundler exports parameters produce empty export-name metadata - Issue #2128 [OPEN] — [Bug] analyze-javascript-application: every ASAR input misreported as ENOENT on Windows (directory input works) - Issue #2058 [CLOSED] — [Bug] TypeScript import-equals declarations lose their module dependency during analysis - Issue #2024 [CLOSED] — [Bug] A null source name drops all known originals from a retained source map - Issue #1968 [CLOSED] — Cancellation after the last selected JavaScript source misreports the next unselected file as cancelled - Issue #1965 [CLOSED] — Curated Windows CI lane still lists the moved javascriptArtifactReconstruction suite - Issue #1911 [CLOSED] — [Bug] JavaScript admission reserves 80% of parent capacity for any later file - Issue #1909 [CLOSED] — [Bug] Nested Function.prototype.call chains bypass Electron intrinsic mutation checks - Issue #1882 [CLOSED] — [Bug] Retained prefixed source maps lose original-source evidence during application analysis - Issue #1848 [CLOSED] — [Feature] Prioritize caller-selected JavaScript sources before unrelated application analysis - Issue #1847 [CLOSED] — [Bug] JavaScript semantic workers exhaust heap on modest generated wrapper files - Issue #1842 [CLOSED] — [Bug] Electron interop helper names can attribute unrelated constructors to Electron - Issue #1831 [CLOSED] — [Bug] JavaScript namespace re-exports are omitted from complete semantic graphs - Issue #1811 [CLOSED] — [Bug] TypeScript NodeNext imports such as ./dep.js stay not-found in analyze-javascript-application - Issue #1802 [CLOSED] — [Bug] Electron analysis reports 0 BrowserWindows and 0 preloads when main uses electron.BrowserWindow namespace form; miss is not logged as unknown - Issue #1782 [CLOSED] — [Bug] Percent-encoded local source-map URLs fail to resolve inventoried files - Issue #1781 [CLOSED] — [Bug] JavaScript sourceMappingURL line comments truncate URLs at asterisks - Issue #1761 [CLOSED] — [Bug] A sibling node_modules file overrides package exports during JavaScript analysis - Issue #1748 [CLOSED] — [Bug] Repeated endpoint observations cause quadratic JavaScript graph accumulation - Issue #1738 [CLOSED] — fix(browser): account for source-map redirect error expansion - Issue #1729 [CLOSED] — fix(browser): source map redirects omit the effective resolution URL - Issue #1656 [CLOSED] — [Bug] Electron APIs are not recovered through aliasing variables (e.g. `const ipc = ipcMain`) - Issue #1653 [CLOSED] — bug(javascript): cancellation hides a failed owned-analyzer cleanup retry - Issue #1605 [CLOSED] — [Feature] Recover related scripts together in `recover_javascript_sources` - Issue #1589 [CLOSED] — [Bug] Windows Electron cleanup signals an unverified PID - Issue #1565 [CLOSED] — Improve resource limits and timeout handling for large JavaScript semantic analysis - Issue #1563 [CLOSED] — bug(javascript): public Bun module exhausts bounded heap and terminates CLI/MCP - Issue #1538 [CLOSED] — bug(javascript): wide receiver return expansion exceeds the function argument limit - Issue #1497 [CLOSED] — fix(browser): lock an attached CDP scenario by the URL the connection uses - Issue #1462 [CLOSED] — [Bug] JavaScript analysis blocks MCP ping and cancellation during synchronous computation - Issue #1387 [OPEN] — 6.3.0: analyze-javascript-application --json aborts on a large bundle that 6.2.0 completes - Issue #1380 [CLOSED] — [Bug] analyze-javascript-application aborts with RangeError on a large inline source map in a two-byte source - Issue #1367 [CLOSED] — [Bug] Malformed UNC source-map path aborts REA on Node builds its engines field allows - Issue #1336 [CLOSED] — [Feature] Let REA analyze Flathub Electron apps that fail the integrity check - Issue #1331 [CLOSED] — [Bug] CLI JSON input above the V8 string limit is reported as invalid-json, so large Evidence cannot be traced - Issue #1237 [CLOSED] — fix(electron): later dynamic overrides retain a stale preload association - Issue #1236 [CLOSED] — fix(javascript): local HTML script URLs falsely report missing assets - Issue #1234 [CLOSED] — fix(artifacts): byte-identical files erase JavaScript path classifications - Issue #1146 [CLOSED] — [Bug] analyze_javascript_application fails result validation when a webpack chunk lazily requests its own chunk id - Issue #1137 [CLOSED] — fix(process): cold macOS ownership-helper compilation exhausts source-map CLI deadlines - Issue #1129 [CLOSED] — [Bug] analyze_javascript_application fails result validation when any module imports itself - Issue #1009 [CLOSED] — analyze-javascript-application: schema rejection at /identity/key (too_small) on plain minified JS directory - Issue #861 [CLOSED] — analyze-javascript-application: unreadable_output '/label (too_small)' on a Vite bundle containing SheetJS (xlsx) - Issue #829 [OPEN] — Unify local-artifact vs live-DOM vs source-map URL policies - Issue #827 [CLOSED] — [Feature] Recover readable JavaScript sources through a pluggable upstream adapter - Issue #822 [CLOSED] — fix(javascript): computed-identifier member keys in electron native/ipc analyzers - Issue #799 [CLOSED] — [Feature] Export captured website scripts into existing JavaScript analysis - Issue #746 [CLOSED] — analyze-javascript-application: zero output for minutes then generic unreadable_output failure on a 24 MB Electron ASAR (Obsidian 1.12.7) - Issue #720 [CLOSED] — [Bug] Supported JavaScript directories receive misleading target diagnostics - Issue #623 [CLOSED] — analyze_javascript_application fails on large targets: RangeError: Invalid string length masked as reason 'io' - Issue #571 [CLOSED] — analyze_javascript_application fails on any archive containing a directory named like a code file (e.g. npm scope @zip.js) - Issue #559 [CLOSED] — javascript: finish converting property-name readers and consolidate binding resolution - Issue #530 [CLOSED] — Windows: V8 Inspector excludes every file-backed Node target (Node mangles file://C:/ to file://C:_ which fails URL parsing) - Issue #404 [CLOSED] — Add runtime semantic tracing for generated JavaScript applications - Issue #397 [CLOSED] — Add Node/Electron V8 inspector runtime observation provider - Issue #376 [CLOSED] — Capture Electron IPC channel/direction/sender/receiver with redacted payloads - Issue #375 [OPEN] — Capture Electron main/preload/utility process lifecycle and shell events - Issue #374 [CLOSED] — Implement Playwright/CDP capture driver and step-indexed output - Issue #279 [CLOSED] — ci: real-browser check flakes with Chrome CDP startup timeout - Issue #195 [CLOSED] — fix(domain): treat source-map extension case-insensitively in artifact edge mapping - Issue #194 [CLOSED] — fix(browser): accept page-scoped CDP websocket endpoints - Issue #117 [CLOSED] — Add semantic analysis for JavaScript and packaged application bundles - Issue #68 [CLOSED] — Add native JavaScript bundle indexing and semantic queries - Issue #64 [OPEN] — Add Electron shell and IPC instrumentation - Issue #63 [CLOSED] — Build a Playwright/CDP differential recorder - PR #2366 [OPEN] — fix(javascript): keep paths after __dirname inside the source directory - PR #2347 [OPEN] — fix(javascript): keep ASAR-named files without an ASAR header opaque - PR #2306 [OPEN] — fix(javascript): preserve CommonJS directory and ancestor lookup - PR #2302 [OPEN] — fix(electron): point scenario path errors at the field that failed - PR #2279 [OPEN] — fix(electron): identify each unresolved scenario path - PR #2276 [OPEN] — fix(electron): reject non-executable files before Playwright launch - PR #2234 [OPEN] — fix(javascript): collect exports through renamed bundler exports parameters - PR #2233 [OPEN] — fix(javascript): recover bundled exposeInIsolatedWorld contextBridge exposures - PR #2104 [OPEN] — fix(javascript): resolve module-relative Worker URL references - PR #2097 [OPEN] — fix(javascript): admit measured transfer retention in parent result budget - PR #2094 [OPEN] — feat(javascript): fold constant values and recover Electron boundaries through wrappers - PR #2093 [OPEN] — feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine - PR #2092 [OPEN] — feat(javascript)!: bound semantic graphs by serialized Evidence bytes - PR #2085 [CLOSED] — feat(javascript): resolve package pattern maps - PR #2081 [OPEN] — fix(javascript): retain TypeScript import-equals module dependencies - PR #2077 [OPEN] — fix(javascript): keep CommonJS require file URLs unresolved - PR #2062 [MERGED] — fix(javascript): preserve import-equals declaration and export evidence - PR #2061 [MERGED] — test(javascript): verify CommonJS file URL boundaries via CLI and MCP - PR #2060 [OPEN] — fix(javascript): retain explicit TypeScript import resolution modes - PR #2041 [OPEN] — fix(javascript): recover CommonJS builtin effects - PR #2034 [MERGED] — test(sourcemap): consolidate source map regressions - PR #2032 [CLOSED] — test(javascript): verify CommonJS extension lookup through CLI and MCP - PR #2031 [MERGED] — test(javascript): consolidate module lookup regressions - PR #2028 [CLOSED] — test(javascript): verify empty package main fallback through CLI and MCP - PR #2018 [OPEN] — feat(javascript): resolve package exports and imports wildcard patterns - PR #1975 [CLOSED] — fix(javascript): keep unselected sources out of cancellation failures - PR #1944 [MERGED] — feat(javascript): analyze selected application sources - PR #1941 [MERGED] — fix(javascript): bound value evaluation through nested closure aliases - PR #1939 [MERGED] — fix(javascript): preserve package and source-map boundary identity - PR #1934 [MERGED] — fix(javascript): retain completed facts through cancellation - PR #1921 [MERGED] — fix(javascript): preserve graphs within parent capacity - PR #1920 [CLOSED] — fix(javascript): admit deferred semantic graphs after later sources - PR #1916 [MERGED] — fix(javascript): normalize package URLs before array selection - PR #1915 [MERGED] — fix(javascript): report available parent result budget in coverage limits - PR #1914 [OPEN] — fix(javascript): preserve intrinsic invocation read identity - PR #1912 [MERGED] — fix(javascript): follow actual receivers in nested intrinsic calls - PR #1905 [MERGED] — perf(javascript): index source-map ignore lists per leaf - PR #1888 [CLOSED] — fix(javascript): preserve bare package specifier suffixes - PR #1887 [CLOSED] — fix(javascript): recover retained prefixed source maps - PR #1884 [CLOSED] — fix(javascript): resolve ESM package self references - PR #1874 [MERGED] — fix(javascript): trace wrapped Electron IPC paths in large bundles - PR #1871 [MERGED] — perf(javascript): skip nested callables during fingerprint traversal - PR #1862 [MERGED] — feat(javascript): resolve exact package import aliases - PR #1857 [MERGED] — fix(javascript): prove namespace interop before attributing Electron APIs - PR #1840 [OPEN] — fix(javascript): preserve Vite dependency values and indexes - PR #1834 [OPEN] — test(web): cover nullable HTTP captures through CDP and CLI - PR #1833 [MERGED] — fix(javascript): preserve namespace re-export relationships - PR #1827 [MERGED] — fix(javascript): follow bundler namespace interop for Electron APIs - PR #1820 [CLOSED] — fix(javascript): resolve NodeNext emitted extensions in application analysis - PR #1818 [CLOSED] — fix(javascript): resolve NodeNext emitted extensions to TypeScript sources - PR #1815 [OPEN] — feat(javascript): add proof-gated js-redox deobfuscation - PR #1810 [OPEN] — fix(javascript): recognize GraphQL operations after leading fragment interpolations - PR #1803 [CLOSED] — fix(javascript): retain unbound require semantic module links - PR #1799 [MERGED] — fix(javascript): retain unbound CommonJS semantic imports - PR #1797 [CLOSED] — fix(javascript): keep asterisks inside a sourceMappingURL line comment - PR #1789 [MERGED] — perf(javascript): skip the repeated-prefix scan on first capture visits - PR #1788 [MERGED] — fix(javascript): preserve and resolve complete source-map URLs - PR #1787 [CLOSED] — fix(javascript): percent-decode local URL references once - PR #1786 [CLOSED] — fix(javascript): keep asterisks in line-comment source-map URLs - PR #1767 [MERGED] — fix(javascript): bound self-alias mutation paths that never prune - PR #1762 [MERGED] — fix(javascript): honor package exports before sibling files - PR #1759 [MERGED] — fix(javascript): index repeated graph observations before final sorting - PR #1742 [MERGED] — fix(browser): retain effective source-map response urls - PR #1740 [MERGED] — fix(javascript): report JSON status for imported package manifests - PR #1686 [MERGED] — feat(javascript): recover code-split bundles from multiple inputs - PR #1673 [MERGED] — fix(javascript): recover Electron APIs through default imports and optional calls - PR #1671 [CLOSED] — fix(javascript): respect static path helper ownership - PR #1670 [MERGED] — feat(javascript): recognize tRPC procedures and GraphQL operations - PR #1664 [MERGED] — fix(javascript): exclude overwritten Electron API identities - PR #1654 [MERGED] — fix(javascript): preserve cleanup failures during preparation cancellation - PR #1651 [MERGED] — fix(javascript): isolate source analysis and retain bounded partial evidence - PR #1645 [CLOSED] — fix(browser): bound CDP message payloads to the shared protocol budget - PR #1644 [MERGED] — test(javascript): retain resource ownership in deep-return fixture - PR #1642 [CLOSED] — fix(browser): decode prefixed source-map responses - PR #1631 [MERGED] — test(javascript): share semantic graph fixtures - PR #1615 [MERGED] — fix(javascript): preserve trailing slash in package directory requests - PR #1610 [CLOSED] — fix(javascript): bound module source payload before deep semantic analysis - PR #1601 [MERGED] — perf(javascript): reduce retained semantic analysis allocations - PR #1600 [CLOSED] — fix(javascript): preserve exact static CommonJS export keys - PR #1588 [MERGED] — fix(browser): skip Windows Electron signals without verified lineage - PR #1577 [MERGED] — fix(javascript): retain runtime scope in bundled module relationships - PR #1569 [CLOSED] — fix(javascript): track shared references returned by getters - PR #1568 [MERGED] — feat(javascript): return a retained summary view on request - PR #1557 [MERGED] — fix(javascript): yield during receiver and reference classification - PR #1545 [MERGED] — fix(javascript): yield during the largest AST traversals - PR #1542 [MERGED] — fix(javascript): yield inside semantic analysis and large projection passes - PR #1540 [MERGED] — fix(javascript): accept the Wakaru 1.x release line and verify 1.14.0 - PR #1539 [MERGED] — fix(javascript): avoid argument limits when expanding escaped receivers - PR #1537 [MERGED] — perf(javascript): index returned object targets - PR #1529 [CLOSED] — test(javascript): check #1495 growth rate instead of wall time - PR #1526 [MERGED] — test(javascript): verify escaped receivers through CLI and MCP - PR #1525 [MERGED] — fix(javascript): yield during per-file projection and graph construction - PR #1520 [CLOSED] — perf(javascript): index returned method analysis - PR #1519 [CLOSED] — perf(javascript): index returned method analysis - PR #1517 [MERGED] — fix(javascript): expand an escaped receiver's methods once (#1495) - PR #1474 [MERGED] — perf(javascript)!: stop repeating the semantic identifier strategy per fact - PR #1471 [MERGED] — fix(javascript): retain returned-reference mutation uncertainty - PR #1468 [CLOSED] — fix(javascript): attribute writes through a simple thunk's call result - PR #1458 [MERGED] — perf(javascript): derive the application graph ID once - PR #1457 [MERGED] — perf(javascript): hash each semantic evidence context once - PR #1448 [MERGED] — test(javascript): reuse comparison node fixtures - PR #1445 [MERGED] — fix(javascript): invalidate references stored through property targets - PR #1444 [MERGED] — fix(javascript): stop replaying earlier writes for each object property write - PR #1437 [MERGED] — fix(javascript): preserve effects through yielded array references - PR #1434 [MERGED] — perf(javascript): index change-graph nodes once per comparison - PR #1427 [MERGED] — fix(javascript)!: avoid event payload copies in graph metadata - PR #1424 [MERGED] — fix(javascript): unify package resolution and resolve exact exports subpaths - PR #1423 [MERGED] — fix(javascript)!: avoid endpoint payload copies in graph metadata - PR #1414 [CLOSED] — test(javascript): preserve member-alias fanout and loop regressions - PR #1410 [MERGED] — perf(javascript): aggregate semantic family coverage once - PR #1408 [MERGED] — fix(javascript): retain shorter literal metadata encodings - PR #1407 [MERGED] — fix(javascript)!: stop copying literals into semantic metadata - PR #1400 [MERGED] — fix(electron): support packaged app.asar pages and rewritten unpacked companions - PR #1393 [MERGED] — fix(javascript): stop reading media preload attributes as Electron preloads - PR #1392 [CLOSED] — fix(javascript): root application graphs at the application manifest - PR #1391 [MERGED] — fix(javascript): recognize Electron APIs through renamed bindings - PR #1390 [MERGED] — fix(javascript): bound member-mutation paths through reassignment loops - PR #1388 [CLOSED] — fix(javascript): avoid regex overflow for large source maps - PR #1386 [MERGED] — fix(javascript): handle oversized inline source maps - PR #1385 [CLOSED] — test(javascript): expect provable precision for the short-circuit mutation - PR #1372 [MERGED] — fix(javascript): decline source-map UNC references with an unusable host - PR #1370 [MERGED] — perf(javascript): validate the version change graph once - PR #1369 [CLOSED] — fix(javascript): preserve exact static CommonJS export keys - PR #1368 [MERGED] — fix(javascript): scan direct returns without recursive stack growth - PR #1366 [MERGED] — fix(mcp): preserve JavaScript workflow identity validation - PR #1361 [MERGED] — fix(javascript): honor module-sync package exports - PR #1351 [MERGED] — fix(javascript): resolve exported callables through lexical bindings - PR #1347 [MERGED] — perf(javascript): index version relationships once per comparison - PR #1333 [CLOSED] — fix(javascript): reject invalid package exports configurations - PR #1332 [CLOSED] — fix(javascript): distinguish prefix-only builtins from packages - PR #1328 [CLOSED] — fix(javascript): preserve semantic evidence through satisfies - PR #1326 [CLOSED] — fix(javascript): avoid positive-zero evidence for signed zero - PR #1324 [CLOSED] — fix(javascript): preserve distinct namespace provenance components - PR #1323 [CLOSED] — fix(javascript): select TypeScript declaration and CTS parser modes - PR #1312 [CLOSED] — fix(browser): follow only HTTP redirect statuses for source maps - PR #1295 [MERGED] — fix(javascript): reject encoded separators joined by HTML URL whitespace - PR #1292 [MERGED] — fix(javascript): preserve uncertainty after references escape to calls - PR #1287 [MERGED] — fix(javascript): resolve HTML script URLs after URL whitespace and percent decoding - PR #1286 [MERGED] — fix(electron): resolve effective preload after option overrides - PR #1239 [MERGED] — fix(javascript): classify application input selection failures by cause - PR #1218 [MERGED] — fix(javascript): allow cancellation during semantic graph commitment - PR #1216 [MERGED] — fix(javascript): report located sources with differing digests as modified - PR #1215 [MERGED] — fix(javascript): match source-map originals that name parent directories - PR #1181 [MERGED] — fix(javascript): resolve package exports targets only to the exact file - PR #1160 [MERGED] — feat(javascript): report observed export property presence - PR #1157 [MERGED] — fix(javascript): omit self-referential static references with disclosure - PR #1156 [MERGED] — fix(cli): cancel routed JavaScript analysis in rea analyze - PR #1153 [CLOSED] — fix(javascript): omit self-referential bundler edges with disclosure - PR #1152 [MERGED] — fix(javascript): preserve graphs with async chunk self-references - PR #1130 [MERGED] — fix(javascript): omit self-referential import edges with disclosure - PR #1120 [MERGED] — test(browser): pin DOM and source-map URL policy classifications - PR #1112 [MERGED] — perf(javascript): reuse validated immutable graphs - PR #1109 [MERGED] — fix(browser): compose nested source-map column offsets - PR #1102 [MERGED] — fix(javascript): parse plain TypeScript artifact dialects - PR #1098 [MERGED] — fix(javascript): honor cancellation before evidence publication - PR #1093 [MERGED] — fix(javascript): preserve original BOM source coordinates - PR #1092 [MERGED] — fix(javascript): preserve HTML carriage return source ranges - PR #1087 [MERGED] — fix(javascript): retain NodeNext artifact source facts - PR #1055 [MERGED] — fix(javascript): complete large-ASAR analysis with file-local projection - PR #1046 [MERGED] — fix(javascript): resolve root package exports arrays - PR #1045 [MERGED] — fix(javascript): recognize digits in artifact URI schemes - PR #1042 [MERGED] — fix(javascript): reconstruct HTML script loads accurately - PR #1031 [MERGED] — fix(javascript): resolve module URLs and reject invalid exports targets - PR #1028 [MERGED] — perf(javascript): cache canonical export comparison sort keys - PR #1025 [MERGED] — test(javascript): cover plain long-line loader identities - PR #1024 [MERGED] — fix(cli): stream large JavaScript JSON results - PR #1008 [MERGED] — fix(javascript): report application analysis progress on the CLI - PR #971 [MERGED] — perf(javascript): index Promise return-site ownership - PR #966 [MERGED] — fix(javascript): bound semantic node projection for resource safety - PR #955 [MERGED] — perf(javascript): reduce analysis and source-map work - PR #942 [MERGED] — perf(javascript): index semantic fingerprint relations - PR #939 [MERGED] — fix(javascript): handle deep static member paths - PR #932 [MERGED] — perf(javascript): analyze member chains without recursive copying - PR #929 [MERGED] — fix(javascript): retain recovered call argument positions - PR #916 [MERGED] — refactor(artifacts): isolate JavaScript file acquisition - PR #915 [MERGED] — fix(javascript): handle deep AST traversal and addition without stack overflow - PR #907 [MERGED] — refactor(javascript): group domain semantics and contracts - PR #902 [CLOSED] — feat(artifacts): let extraction and JavaScript analysis record integrity mismatches - PR #897 [MERGED] — feat(browser): trace captured website source-map locations - PR #896 [MERGED] — refactor(javascript): group application workflows and verification - PR #895 [MERGED] — fix(javascript): keep storage open versions out of XHR endpoints - PR #890 [MERGED] — fix(javascript): resolve bare source-map and worker URLs next to the script - PR #877 [MERGED] — fix(javascript): keep XHR and client endpoints that receiver spellings hid - PR #874 [MERGED] — fix(javascript): keep keyed-collection reads out of endpoints - PR #872 [MERGED] — fix(javascript): read open() endpoints only from XHR method/URL pairs - PR #871 [MERGED] — fix(javascript): read substitution-free templates as exact strings - PR #848 [MERGED] — feat(javascript): recover readable modules with Wakaru - PR #843 [MERGED] — fix(javascript): keep exact empty values in graph identities - PR #839 [MERGED] — fix(javascript): analyze sources containing empty string literals - PR #836 [MERGED] — fix(javascript): keep exact empty env keys and method names - PR #835 [MERGED] — fix(javascript): preserve computed Electron member uncertainty - PR #828 [MERGED] — refactor(domain): extract source-map envelope walk and disambiguate stringValue - PR #811 [MERGED] — fix(browser): identify NodeNext TypeScript original source artifacts - PR #810 [MERGED] — fix(javascript): project decoded file URL paths - PR #801 [MERGED] — feat(web): export captured scripts for JavaScript application analysis - PR #755 [CLOSED] — fix(reference): resolve emitted extensions to TypeScript source - PR #752 [MERGED] — fix(javascript): keep mutated object initializer values unknown - PR #749 [MERGED] — fix(javascript): expose result schema failures - PR #733 [MERGED] — fix(target): explain the JavaScript directory analysis route - PR #731 [MERGED] — fix(javascript): preserve unknown branches in primitive unions - PR #712 [MERGED] — fix(javascript): preserve path.resolve reset semantics - PR #710 [MERGED] — fix(electron): respect computed option keys and overrides - PR #691 [MERGED] — fix(javascript): count all source line terminators - PR #689 [CLOSED] — fix(browser): reject malformed indexed source-map offsets - PR #687 [CLOSED] — fix(javascript): keep optional parameter input unknown - PR #678 [CLOSED] — fix(javascript): invalidate values on nontrivial binding writes - PR #673 [CLOSED] — fix(javascript): keep nonfinite values outside JSON lattice - PR #672 [MERGED] — fix(javascript): read source-map directives only from comments - PR #671 [CLOSED] — fix(javascript): respect object property overwrite order - PR #668 [CLOSED] — fix(javascript): preserve array index positions - PR #666 [MERGED] — fix(javascript): preserve primitive addition coercion - PR #663 [MERGED] — fix(javascript): scope candidate ambiguity to query traversal - PR #646 [MERGED] — fix(javascript): hash graph and evidence JSON incrementally - PR #611 [MERGED] — fix(browser): release discarded source-map response bodies - PR #606 [MERGED] — fix(javascript): preserve Node exports fallback stop reasons - PR #591 [MERGED] — fix(javascript): honor package exports condition order - PR #589 [MERGED] — fix(javascript): respect HTML base URL components - PR #588 [MERGED] — fix(browser): derive source-map imports from syntax nodes - PR #576 [MERGED] — fix(javascript): preserve literal CommonJS path punctuation - PR #575 [MERGED] — fix(javascript): prefer package entrypoints over directory indexes - PR #546 [MERGED] — fix(browser): ignore duplicate frame navigations and read block-form source map directives - PR #538 [MERGED] — fix(javascript): correct lexical and dynamic scope analysis - PR #537 [MERGED] — fix(javascript): classify assignment targets and retain compound-assignment reads - PR #536 [MERGED] — fix(javascript): honor computed keys when naming callables, exports, requests and options - PR #518 [MERGED] — fix(browser): resolve redirected source map paths from final URL - PR #517 [MERGED] — fix(browser): release cancelled CDP cleanup without waiting for responses - PR #511 [MERGED] — fix(javascript): isolate lexical loop bindings - PR #510 [MERGED] — fix(javascript): bind named class expressions in their class scope - PR #509 [MERGED] — fix(javascript): respect lexical shadowing of require - PR #508 [MERGED] — fix(javascript): retain property reads during updates - PR #507 [MERGED] — fix(javascript): avoid invented computed destructuring properties - PR #464 [MERGED] — feat(electron): add autonomous Electron runtime analysis - PR #420 [MERGED] — feat(javascript): add bounded semantic tracing - PR #402 [MERGED] — fix(cli): route JavaScript applications from analyze - PR #304 [MERGED] — feat(javascript): add webpack and rspack runtime adapters - PR #303 [MERGED] — feat(javascript): recover commonjs and esm module relationships - PR #302 [MERGED] — feat(javascript): add binding and constant-value semantic IR - PR #299 [MERGED] — fix(electron): resolve package and dirname entrypoints by context - PR #280 [MERGED] — fix(electron): keep missing unpacked ASAR entries unavailable - PR #258 [MERGED] — feat(application): add isolated JavaScript replay - PR #255 [MERGED] — feat(electron): reconcile static artifacts with passive runtime - PR #252 [MERGED] — feat(electron): map static process and IPC boundaries - PR #249 [MERGED] — feat(artifact): reconstruct JavaScript application structure - PR #248 [MERGED] — feat(domain): add versioned JavaScript Application Graph - PR #218 [MERGED] — fix(browser): support page-scoped CDP transports - PR #209 [MERGED] — feat: add web and Electron analysis workflows </details> <details> <summary>Go, Swift and Objective-C: 7 issues + 9 PRs</summary> - Issue #2167 [CLOSED] — fix(go): inspect-go-binary rejects valid Mach-O binaries with unmapped debug segments - Issue #2030 [OPEN] — [Feature] Decode Swift String literals in native function results - Issue #484 [CLOSED] — [Feature] Expose typed Swift and Objective-C dispatch metadata across providers - Issue #385 [OPEN] — Design and implement bounded Objective-C runtime observation - Issue #353 [CLOSED] — Add deeper Objective-C/Swift metadata and database save/licensing support - Issue #156 [CLOSED] — Objective-C class discovery includes non-class _OBJC_ symbols - Issue #71 [OPEN] — Add approval-gated Objective-C runtime observation - PR #2246 [OPEN] — fix(go): read Mach-O images with unmapped debug segments - PR #2089 [OPEN] — fix(go): read build info from unstripped Mach-O binaries - PR #1363 [MERGED] — feat(go): inspect embedded binary build metadata - PR #1315 [CLOSED] — fix(symbols): discover emitted Swift protocol descriptors - PR #1313 [CLOSED] — fix(symbols): exclude Objective-C bookkeeping from declaration inventories - PR #964 [MERGED] — feat(native): observe function and Objective-C method calls under LLDB - PR #953 [MERGED] — feat(native): decode chained fixups, binds, ObjC categories and properties - PR #868 [MERGED] — fix(native): pass Swift symbols to swift-demangle as operands - PR #452 [MERGED] — feat(metadata): add deeper ObjC/Swift metadata and database save/licensing </details> <details> <summary>Python, Dart and EVM: 4 issues + 5 PRs</summary> - Issue #2296 [OPEN] — [Feature] Decompile static Python bytecode (.pyc) files into labeled source inference - Issue #1431 [OPEN] — [Feature] HarmonyOS/OpenHarmony package and Ark bytecode analysis (ArkDecompiler evaluation) - Issue #972 [CLOSED] — [Feature] Modular EVM bytecode analysis and execution evidence adapters - Issue #494 [OPEN] — Investigate Hopper remaining on Executing Python Script overlay - PR #2334 [OPEN] — fix(flutter): reject ambiguous ELF mappings and bound note reads - PR #2308 [MERGED] — feat(evm): add retained interface summary delivery - PR #2261 [MERGED] — refactor(evm): bind offline analysis through a static descriptor - PR #1622 [MERGED] — perf(evm): avoid repeated cleanup diagnostics - PR #1051 [MERGED] — feat(evm): inspect offline bytecode interfaces through EVMole </details> <details> <summary>Additional source-language and Rust references: 2 issues + 1 PRs</summary> - Issue #1659 [CLOSED] — [Bug] search_strings misses some Rust string literals and does not say so - Issue #1609 [CLOSED] — [Bug] Reference source imports lose Git HEAD after regular-file read admission - PR #1770 [MERGED] — fix(reference): report sloppy scripts, PHP, C# and enclosing Git facts </details> Shared native providers, architecture/file admission, symbols, debugger ownership, Frida, WASM and recorded core/minidump foundations: see the [full 467-entry complementary index](https://github.com/morluto/rea/issues/2383#issuecomment-6132669473). These shared capabilities must be matched to each language's actual compiler, artifact and observation needs. ## Solidity follow-up batch (2026-10-12) - https://github.com/morluto/rea/issues/2388 — inspect bytecode CBOR metadata losslessly and bind supplied metadata files - https://github.com/morluto/rea/issues/2389 — select exact solc Standard JSON contract artifacts and bytecode kinds - https://github.com/morluto/rea/issues/2390 — map EVM byte PCs to original and generated source spans - https://github.com/morluto/rea/issues/2391 — decode supplied ABI calldata, logs and revert payloads with explicit ambiguity - https://github.com/morluto/rea/issues/2392 — inspect and compare compiler storage layouts without inferring live state - https://github.com/morluto/rea/issues/2393 — inspect offline proxy patterns and supplied implementation-slot evidence - https://github.com/morluto/rea/issues/2394 — inspect recorded EVM opcode/call traces and attribute debugging locations - https://github.com/morluto/rea/issues/2395 — expose fork-profiled EVM disassembly and bounded control-flow evidence - https://github.com/morluto/rea/issues/2396 — compare exact bytecode with separately explained compiler patch spans These nine independently scoped follow-ups extend the existing EVM interface lane and roadmap #972. Each issue owns its requirements and future spec/plan; the original relationship inventory above remains a dated snapshot. Suggested initial implementation: compiler artifacts and metadata, then source/ABI/storage facts, followed by proxy, recorded-trace and CFG profiles. PRs will be linked as verified increments land. ## Current implementation and test follow-ups - #2400 implements the source-coordinate increment of #2382 and contributes owned Free Pascal verification for the #2372 lane. #2397 records a separate native-verifier investigation. - #2420 implements terminal CBOR inspection for #2388: exact scalar facts, partial/malformed coverage, historical Evidence compatibility and compiled-worker/MCP regressions. Supplied metadata JSON commitment binding remains pending. - #2403 addresses documentation organization issue #2401, preserves current public routes and MCP pagination guidance, and adds built-page regression verification to documentation CI. - Specs and ADRs use domain/feature slugs rather than a shared numeric counter. These increments do not complete a full language coverage audit.
bsakaguchi commented 2026-10-15 18:28:30 +00:00
Author
Owner
Copy link

@matbrgz commented on GitHub (Oct 12, 2026):

Complementary index: native providers, debugger lifecycle and format foundations

Snapshot: 2026-10-12. This index covers shared native-analysis/decompilation providers, symbol/instruction facts, debugger/instrumentation lifecycle and recorded-format foundations referenced by the top-100 language audit.

These are topic relationships, not assertions that a native provider supports every compiled language, that an open PR is available, or that a historically merged feature remains in the current product. Architecture admission is distinct from compiler/language semantics. Refer to the exact PR, current contracts and real-provider verification before recording a support claim.

State legend: issue OPEN/CLOSED describes discussion state; PR OPEN/CLOSED/MERGED describes contribution state. A closed unmerged PR is not delivered support. A closed issue may have been superseded or declined.

467 related entries: 182 issues and 285 PRs.

Issues
  • Issue #2382 [OPEN] — [Feature] Retain LLDB source coordinates for observed native call locations
  • Issue #2369 [OPEN] — [Feature] Inspect Linux BTF type and function metadata offline
  • Issue #2357 [OPEN] — [Roadmap] Track scoped static artifact and recorded-crash improvements
  • Issue #2356 [OPEN] — [Feature] Compare admitted WebAssembly import and export interfaces
  • Issue #2355 [OPEN] — [Feature] Inspect recorded Windows minidump streams without a live target
  • Issue #2353 [OPEN] — [Feature] Decode recorded Linux AArch64 ELF core evidence
  • Issue #2350 [OPEN] — [Feature] Inspect WebAssembly components and canonical ABI declarations offline
  • Issue #2343 [OPEN] — [Bug] MZ new-header signature check strips the high bit, so corrupt bytes read as NE/LX/PE (main CI red)
  • Issue #2338 [OPEN] — Ghidra MIPS: admit plain MIPS32 PIC shared libraries (ET_DYN) at their link base
  • Issue #2335 [OPEN] — [Feature] Headless IDA: resolve containing procedures and report the admitted program as the document
  • Issue #2330 [OPEN] — fix(artifacts): correct ZIP non-entry coverage description
  • Issue #2326 [OPEN] — [Bug] Callee and caller reads give no warning when Ghidra's function body stops short
  • Issue #2322 [OPEN] — [Bug] build_call_path can no longer establish not_found from headless IDA Evidence after #1544
  • Issue #2301 [OPEN] — IDA provider rejects upstream ida-pro-mcp 2.0.0 in both attached and headless modes
  • Issue #2300 [OPEN] — [Feature] Show one function's pseudocode from several decompiler providers in one call
  • Issue #2298 [OPEN] — [Feature] Decompile WebAssembly functions into labeled pseudocode
  • Issue #2285 [OPEN] — [Bug] Headless IDA private input for a universal Mach-O includes bytes after the selected slice
  • Issue #2270 [OPEN] — [Bug] Hopper not detected on Linux during setup
  • Issue #2259 [OPEN] — [Bug] Ghidra provider never applies a PE's sidecar PDB; name lookups fail and no limitation is reported
  • Issue #2258 [OPEN] — A recommended list of open-source decompilers
  • Issue #2213 [CLOSED] — [Bug] Frida input errors say "correct the listed arguments" but list none
  • Issue #2204 [CLOSED] — [Bug] Ghidra provider stays unavailable when JAVA_HOME contains non-ASCII characters on Windows
  • Issue #2186 [OPEN] — Proposal: admit bounded ARM / ARM64 PE targets on Windows Ghidra P0
  • Issue #2183 [OPEN] — feat(windows): capture target-bound native window evidence
  • Issue #2172 [CLOSED] — fix(targets): linker-generated PE DLL with a short DOS header is classified as DOS
  • Issue #2139 [CLOSED] — [Bug] IDA provider analyzes the x86_64 slice of a universal Mach-O while reporting arm64
  • Issue #2138 [OPEN] — [Feature] Complete the upstream session evidence in headless IDA cleanup diagnostics
  • Issue #2078 [OPEN] — decompile rejects file offsets — Ghidra image-base rebase is invisible to the caller
  • Issue #2076 [OPEN] — [Bug] Prompt argument completion cold-starts Ghidra/Hopper and cannot be cancelled
  • Issue #2063 [OPEN] — [Feature] Add RISC-V ELF analysis through Ghidra (RV32/RV64)
  • Issue #1994 [CLOSED] — Document the macOS Ghidra decompiler build (12.1.4 ships none)
  • Issue #1992 [CLOSED] — Ghidra launch failures surface no actionable diagnostics (macOS)
  • Issue #1970 [CLOSED] — [Bug] Mach-O dylib-use commands are rejected as missing legacy timestamps
  • Issue #1964 [CLOSED] — [Bug] trace_call_path reports truncated: true on every IDA trace, and get_call_graph nodes carry provider-wide limitations
  • Issue #1957 [OPEN] — [Feature] Consider alternative to Ghidra/Hopper/Hex-Rays: Kuna
  • Issue #1956 [CLOSED] — [Bug] Valid WASM DataCount sections are rejected by WABT output parsing
  • Issue #1938 [CLOSED] — [Feature] Admit relocatable MIPS32r2 ELF objects (kernel modules) through Ghidra
  • Issue #1937 [CLOSED] — [Feature] Admit soft-float MIPS32r2 ELF through Ghidra with integer-register float storage
  • Issue #1935 [CLOSED] — [Feature] Enable verify:gemini-client on native Windows
  • Issue #1923 [CLOSED] — [Feature] Enable verify:claude-client on native Windows (the lane already passes there)
  • Issue #1859 [CLOSED] — [Bug] Windows real-Ghidra verifiers fail on every host after #1635, #1419 and #1667
  • Issue #1852 [CLOSED] — [Feature] Explain available REA static lanes after unsupported native admission
  • Issue #1851 [CLOSED] — [Feature] Verify and admit MIPS16 shared ELF images in the native analysis lane
  • Issue #1849 [CLOSED] — [Feature] Provide bounded native function delivery with actionable retained-evidence continuation
  • Issue #1839 [CLOSED] — [Feature] Add native DeepSeek Harness (DSH) client support to REA setup
  • Issue #1819 [CLOSED] — [Bug] inspect-artifact reports executable:false for every Windows host file, including real PE .exe images
  • Issue #1808 [OPEN] — [Bug] Hopper 6.6.0-demo crashes (SIGSEGV) while REA analyzes /usr/libexec/sharingd; failed launch leaves poisoned session
  • Issue #1794 [CLOSED] — [Bug] Headless IDA reports no callees on ARM64 targets
  • Issue #1783 [OPEN] — [Bug] Ghidra provider times out on a 1.85 MB Swift/ObjC arm64 Mach-O: auto-analysis stalls in ObjcMessageAnalyzer and cannot be skipped
  • Issue #1775 [CLOSED] — [Bug] Mach-O LC_BUILD_VERSION accepts tool records outside cmdsize
  • Issue #1769 [CLOSED] — [Bug] Headless IDA reports a missing procedure as unreadable_output
  • Issue #1766 [CLOSED] — [Bug] Headless IDA fails with unreadable_output while the worker reports a transient busy health
  • Issue #1751 [CLOSED] — fix(hopper): failed one-shot analysis stays alive and holds its target lease
  • Issue #1750 [OPEN] — fix(hopper): saved databases open without starting the analysis bridge
  • Issue #1745 [OPEN] — [Feature] Confirm the 32-bit ARM (armhf / ARMv7 EABI) native lane and pin ARM:LE:32:v7 instead of auto-selection
  • Issue #1741 [OPEN] — [Feature] Add PowerPC (32-bit big-endian) native analysis through Ghidra, with a GameCube/Wii DOL follow-up
  • Issue #1720 [OPEN] — [Bug] query tool calls die at a flat ~60s timeout, shorter than configured Ghidra startup timeout
  • Issue #1712 [CLOSED] — [Bug] Attached IDA analysis reports no UI effects despite legacy GUI actions
  • Issue #1710 [CLOSED] — [Bug] Headless IDA cleanup cannot recover after the supervisor reaps an owned worker
  • Issue #1702 [CLOSED] — [Bug] inspect-pe-resources rejects stock Windows resource images at the default entry budget
  • Issue #1701 [OPEN] — [Bug] Windows native authority self-test fails on real Windows: "Delete owned object by handle failed" (Win32 5), and leaves probe directories behind
  • Issue #1681 [OPEN] — [Design] Pin the Hopper publisher identity in the macOS installer
  • Issue #1649 [CLOSED] — [Bug] Ghidra set_address_name accepts a duplicate name and returns true
  • Issue #1641 [OPEN] — [Feature] Add 6502 and 65816 (WDC) native analysis through Ghidra
  • Issue #1634 [CLOSED] — [Feature] Ghidra: admit set_address_name / set_addresses_names
  • Issue #1625 [CLOSED] — [Bug] Native client verifiers leave HOME unbound and bypass Pi default skill discovery
  • Issue #1620 [OPEN] — [Feature] Admit legacy MIPS32 ELFs with an unspecified ABI, pinning the 32-bit Ghidra language (auto-selection picks MIPS:LE:64:64-32R6addr)
  • Issue #1619 [CLOSED] — [Bug] MIPS ELF whose section header table lies past EOF is refused although PT_MIPS_ABIFLAGS is present
  • Issue #1597 [CLOSED] — [Bug] verify:ghidra entry-alias check fails on macOS arm64
  • Issue #1548 [CLOSED] — bug(verification): native value adapter checks discard Node heap budgets
  • Issue #1518 [CLOSED] — [Bug] Ghidra boundary verifier fails on duplicate output schema ids since #1433
  • Issue #1503 [CLOSED] — fix(native): keep interface-builder trace coverage partial when decode is partial
  • Issue #1502 [CLOSED] — fix(native): select the FAT slice for the admitted CPU type
  • Issue #1499 [CLOSED] — fix(native): report pointer-fixup coverage from the commands actually read
  • Issue #1416 [OPEN] — [Feature] Support the official Hex-Rays IDA MCP server as an analysis provider
  • Issue #1353 [CLOSED] — [Docs] README: FAQ setup command, IDA in the intro, Node badge
  • Issue #1339 [CLOSED] — [Bug] A dot in the TMPDIR path makes Ghidra abort, reported as a generic "retry once" failure
  • Issue #1330 [OPEN] — [Feature] Add PSP/Allegrex native analysis through Ghidra
  • Issue #1290 [CLOSED] — [Feature] Support native x86/x64 PE DLLs in the Windows Ghidra provider
  • Issue #1267 [OPEN] — [Feature] Live native debugging through x64dbg, GDB and LLDB adapters
  • Issue #1255 [CLOSED] — docs(ghidra): clarify supported heap and CPU controls
  • Issue #1254 [CLOSED] — feat(artifacts): inspect PE resource identities and payload ranges
  • Issue #1247 [CLOSED] — feat(native): inspect selected facets of retained function dossiers
  • Issue #1246 [OPEN] — feat(native): inspect data-region accesses and overlapping field candidates
  • Issue #1245 [CLOSED] — feat(native): preserve access kind and inference provenance in compact xrefs
  • Issue #1244 [OPEN] — feat(native): surface instruction conflicts with inferred function prototypes
  • Issue #1243 [CLOSED] — feat(native): return resolved procedure identity in batch decompilation
  • Issue #1242 [CLOSED] — fix(native): preserve decoded return evidence in Ghidra instruction flow
  • Issue #1238 [CLOSED] — fix(ghidra): real verifier rejects a valid zero-operand ENDBR64 entry
  • Issue #1235 [CLOSED] — fix(artifacts): direct Mach-O inspection reports an executable as a resource
  • Issue #1219 [CLOSED] — [Bug] Ghidra provider aborts on every operation when the runtime root path contains a dot-prefixed element
  • Issue #1193 [OPEN] — [Feature] Analyze a caller-selected matching dSYM with the Ghidra provider
  • Issue #1192 [CLOSED] — [Feature] Diagnose a Ghidra native decompiler built for the wrong platform or architecture
  • Issue #1191 [CLOSED] — [Bug] One terminal SIGINT through npx orphans the Ghidra JVM and its runtime directories
  • Issue #1190 [CLOSED] — [Bug] Failed Ghidra runtime cleanup omits the leftover path, and a later close reports success while it remains
  • Issue #1189 [CLOSED] — [Bug] A truncated Mach-O header is admitted as a valid executable and then fails as a provider execution_failure
  • Issue #1187 [CLOSED] — [Bug] analyze_swift_types returns an empty inventory for a modern Swift binary with the Ghidra provider
  • Issue #1186 [CLOSED] — [Bug] rea xrefs rejects the symbol-name selector its help advertises
  • Issue #1184 [CLOSED] — [Bug] Configuration errors omit the rejected Ghidra setting and its absolute-path constraint
  • Issue #1183 [CLOSED] — [Bug] Doctor and setup accept a relative GHIDRA_INSTALL_DIR that the registered MCP server rejects at startup
  • Issue #1170 [CLOSED] — [Bug] Ghidra cannot select a function by the imported _main symbol from its name inventory
  • Issue #1131 [CLOSED] — Ghidra provider rejects linux/arm64 hosts (hard-coded x64 allowlist) — one-line fix proven working
  • Issue #1066 [CLOSED] — [Bug] Setup writes bare "npx" into agent MCP configs on native Windows
  • Issue #1048 [OPEN] — [Feature] Open a pre-imported Ghidra project so import and auto-analysis can happen outside the startup deadline
  • Issue #1036 [CLOSED] — [Bug] Preserve prototype-named JSON members through Evidence boundaries
  • Issue #1026 [CLOSED] — [Bug] Windows Ghidra snapshot lease blocks Java readers
  • Issue #969 [CLOSED] — [Feature] Modular binary diagnostics and debugger adapters using pwntools and pwndbg
  • Issue #968 [OPEN] — [Feature] Modular native runtime instrumentation through a Frida adapter
  • Issue #884 [CLOSED] — [Feature] Integrate WABT for WebAssembly artifact inspection and website glue evidence
  • Issue #832 [CLOSED] — [Bug] Linux: Ghidra provider unusable — GHIDRA_INSTALL_DIR not detected and Arch-family host flagged unsupported
  • Issue #821 [CLOSED] — [Bug] Ghidra provider pins Java to exactly major 21 and the Ghidra version to the exact string "12.1.4", blocking working installs
  • Issue #793 [CLOSED] — Linux Hopper setup rejects the pinned 6.4.2 RPM launcher
  • Issue #790 [CLOSED] — [Bug] Ghidra bridge discovery collides with a same-named working-directory entry
  • Issue #786 [CLOSED] — [Bug] Windows native boundaries reject ordinary forward-slash drive paths
  • Issue #778 [OPEN] — [Docs] Track reproducible demos across REA analysis domains
  • Issue #760 [CLOSED] — Thin Mach-O architecture inventory misreads filenames containing line breaks
  • Issue #747 [CLOSED] — [Feature] Integrate IDA Pro MCP as an attached and headless analysis provider
  • Issue #743 [CLOSED] — [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
  • Issue #740 [OPEN] — [Design] Roadmap: clarify investigation ownership and modularize REA capability integration
  • Issue #727 [CLOSED] — [Docs] Explain Ghidra query deadlines and recovery after client cancellation
  • Issue #684 [CLOSED] — [Bug] inspect-signature fails with execution_failure on universal Mach-O binaries with a signed arm64/arm64e slice and an unsigned x86_64 slice
  • Issue #674 [CLOSED] — [Bug] inspect-macho fails on universal x86_64 + arm64e Mach-O binaries such as /bin/ls
  • Issue #656 [CLOSED] — [Bug] Ghidra provider analyzes the x86_64 slice of a universal Mach-O while reporting arm64
  • Issue #642 [CLOSED] — Clarify HopperTargetLease realpath fallback semantics
  • Issue #641 [CLOSED] — Review HopperCleanup shutdown-request error identity
  • Issue #640 [CLOSED] — Review GhidraClient shutdown-handshake error mapping
  • Issue #639 [CLOSED] — Review GhidraRequestQueue settlement error value
  • Issue #592 [CLOSED] — native: byte-swapped fat headers (FAT_CIGAM / FAT_CIGAM_64) are misreported as unsupported thin Mach-O
  • Issue #568 [CLOSED] — Report the real cause when the native PTY backend is unavailable
  • Issue #563 [CLOSED] — native: positional header decoding and remaining unvalidated parser coercions
  • Issue #527 [CLOSED] — Windows: Ghidra provider is hard-gated off via hasWindowsNativeAuthority, contradicting the advertised Windows x64 P0
  • Issue #501 [CLOSED] — Hopper list_strings / list_names double-convert the address → -32000 invalid_request on every inspect
  • Issue #497 [CLOSED] — [Feature] Add approved UI observation for native desktop applications
  • Issue #492 [CLOSED] — [Feature] Inspect recovered native data types and layouts
  • Issue #491 [CLOSED] — [Feature] Inspect one native instruction with structured operand facts
  • Issue #487 [OPEN] — [Feature] Improve Ghidra AArch64 jump-table recovery
  • Issue #483 [CLOSED] — [Feature] Trace native UI controls through dispatch to handlers
  • Issue #482 [CLOSED] — [Feature] Trace native state and value dependencies across functions
  • Issue #481 [CLOSED] — [Feature] Add a read-only Ghidra provider for macOS
  • Issue #479 [OPEN] — [Bug] Reuse Hopper GUI windows across REA sessions for the same target
  • Issue #478 [CLOSED] — [UX] Make Hopper provider failures diagnosable from MCP
  • Issue #352 [CLOSED] — Add bounded byte reads and file-offset mapping to Hopper
  • Issue #350 [CLOSED] — Ship typed Hopper API facade and standalone tests
  • Issue #346 [CLOSED] — Build jump-table and ABI fixture proof for native API reconstruction
  • Issue #345 [CLOSED] — Infer native API boundary types with evidence and confidence
  • Issue #344 [OPEN] — Run real-Hopper two-binary semantic conformance workflow
  • Issue #343 [OPEN] — Real-Hopper verifier for CFG successors and assembly output
  • Issue #342 [OPEN] — Real-Hopper verifier for caller/callee chains
  • Issue #341 [OPEN] — Run real-Hopper analyze_function dossier conformance
  • Issue #340 [OPEN] — Verify Hopper cancellation, timeout, mutation readback, and shutdown
  • Issue #339 [OPEN] — Record real-Hopper semantic proof for source-built fixtures
  • Issue #327 [OPEN] — Create and read back protected runtime-root DACLs via native Node-API
  • Issue #325 [OPEN] — Project native addon into protected retained authority before load
  • Issue #319 [OPEN] — Integrate Windows native authority package into release and real-Windows verifier
  • Issue #318 [OPEN] — Implement Windows native authority Node-API package
  • Issue #288 [OPEN] — Own Windows Ghidra process trees with kill-on-close semantics
  • Issue #287 [OPEN] — Define a trusted Windows native authority and packaging boundary
  • Issue #187 [CLOSED] — native: make inspect_macho resilient when vtool is unavailable
  • Issue #179 [CLOSED] — native: expose output truncation metadata in command capture result
  • Issue #176 [CLOSED] — native: propagate output truncation state in command captures
  • Issue #174 [CLOSED] — fix(native): avoid reparsing lipo output in list_architectures
  • Issue #166 [CLOSED] — BridgeLauncher Linux demo detection misses non-literal Hopper launcher paths
  • Issue #164 [CLOSED] — setup --install-hopper is ignored when Hopper is already configured
  • Issue #159 [CLOSED] — fix(native): retry failed Xcrun tool resolution instead of caching permanent failures
  • Issue #144 [CLOSED] — fix(native): report output truncation via stdout/stderr truncated flags
  • Issue #120 [CLOSED] — Hopper owned shutdown can block or leave document cleanup incomplete
  • Issue #108 [CLOSED] — Hopper analysis continues after timeout and close_binary, retaining 4 GB RSS
  • Issue #77 [CLOSED] — CLI analyze command calls unsupported Hopper bridge method (binary_overview)
  • Issue #56 [CLOSED] — Replace temporal Hopper cleanup with explicit process ownership
  • Issue #55 [OPEN] — Strengthen semantic Hopper conformance across source-built fixtures
  • Issue #54 [OPEN] — Complete Hopper function dossiers with real references and CFG edges
  • Issue #48 [OPEN] — Epic: Evidence v2 and deterministic process fidelity
  • Issue #42 [CLOSED] — Add managed-runtime, bytecode, and package ecosystem providers
  • Issue #34 [CLOSED] — Add a native macOS inspection provider
  • Issue #32 [OPEN] — Roadmap: evolve REA into an agent-first multi-tool analysis platform
  • Issue #31 [OPEN] — Complete truthful analyze_function dossiers
  • Issue #26 [CLOSED] — Evaluate Ghidra, IDA, Binary Ninja, Rizin, and LIEF providers
  • Issue #25 [OPEN] — Build a multi-binary Hopper conformance and fidelity suite
  • Issue #22 [CLOSED] — Expand the Hopper capability set for complete native analysis
  • Issue #19 [CLOSED] — Harden Hopper automation lifecycle, diagnostics, and headless ergonomics
  • Issue #17 [CLOSED] — Add an evidence-driven native API reconstruction workflow
  • Issue #16 [CLOSED] — Fix false-positive paths in real-Hopper verification
Pull requests
  • PR #2374 [OPEN] — feat(ida): resolve containing procedures and report the admitted program as the document
  • PR #2364 [OPEN] — fix(native): parse renamed dyld_info re-exports
  • PR #2362 [OPEN] — feat(ghidra): admit plain MIPS32 PIC shared images
  • PR #2361 [OPEN] — fix(ghidra): bound the Java version probe output
  • PR #2360 [OPEN] — fix(ghidra): warn when callee/caller reads stop at a truncated function body
  • PR #2358 [OPEN] — feat(ghidra): select a pre-imported project with -process
  • PR #2341 [OPEN] — feat(native): search analyzed memory for masked byte patterns
  • PR #2337 [OPEN] — fix(artifacts): describe ZIP non-entry coverage accurately
  • PR #2336 [OPEN] — fix(ci): run the Windows native lane with its process boundary fixture
  • PR #2324 [OPEN] — fix(ida): preserve native coverage and verify returned values
  • PR #2312 [MERGED] — test(mcp): fix three MCP boundary suites on native Windows
  • PR #2307 [OPEN] — fix(ida): report missing tools when a compatibility profile mismatches
  • PR #2305 [OPEN] — fix(frida): drain admitted operations and honor queued cancellation
  • PR #2295 [OPEN] — docs(contributing): explain Windows native prerequisites for source checkouts
  • PR #2291 [OPEN] — fix(ida): stop the private input of a universal Mach-O at the end of the selected slice
  • PR #2283 [OPEN] — fix(ghidra): report unapplied PE CodeView PDB limitation
  • PR #2281 [OPEN] — fix(native): name the retained pwntools process group in cleanup resources
  • PR #2275 [OPEN] — fix(ghidra): disclose missing PDB symbol coverage
  • PR #2266 [OPEN] — fix(windows): classify transient native self-test failures as retryable
  • PR #2262 [OPEN] — fix(native): refuse inspect_signature on non-Mach-O targets
  • PR #2236 [CLOSED] — fix(ida): update native bridge for main and verify with IDA Pro
  • PR #2227 [OPEN] — fix(targets): recognize PE images with short DOS stubs
  • PR #2224 [MERGED] — docs: preserve the native guide title anchor
  • PR #2217 [MERGED] — fix(frida): name the argument each Frida input error rejects
  • PR #2216 [MERGED] — test(native): verify real PE and DOS entry views
  • PR #2215 [CLOSED] — fix(frida): validate caller-selected script file before starting a session
  • PR #2211 [MERGED] — fix(frida): reject an unreadable script file before starting a session
  • PR #2206 [MERGED] — fix(ghidra): encode Java probe output as UTF-8
  • PR #2201 [MERGED] — fix(ida): thin the selected FAT slice into the private headless input
  • PR #2199 [OPEN] — feat(windows): capture selected native windows
  • PR #2193 [MERGED] — feat(wasm): add opt-in first-call summary delivery
  • PR #2151 [MERGED] — feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane
  • PR #2150 [OPEN] — feat(ghidra): open pre-imported projects with -process instead of re-importing
  • PR #2131 [MERGED] — ci: narrow native-host lane selection and reuse build caches
  • PR #2122 [MERGED] — feat(analysis): add opt-in retained inventory and WASM views
  • PR #2117 [OPEN] — fix(wasm): report WABT output past its budget as a resource constraint
  • PR #2114 [OPEN] — fix(wasm): preserve original glue source locations
  • PR #2112 [MERGED] — docs(ghidra): verified macOS arm64 native decompiler build recipe
  • PR #2110 [OPEN] — fix(artifacts): preserve Mach-O load-command string identity
  • PR #2108 [OPEN] — fix(windows): classify native readiness failures by stage
  • PR #2107 [OPEN] — fix(native): preserve literal line breaks in signing identifiers
  • PR #2102 [MERGED] — fix(wasm): preserve leading BOM in custom section names
  • PR #2101 [OPEN] — fix(native): expose loaded image bases in overviews
  • PR #2084 [MERGED] — fix(wasm): stop appending WABT remediation to unrelated runtime-root failures
  • PR #2079 [OPEN] — feat(ghidra): support raw NMOS 6502 analysis
  • PR #2073 [OPEN] — fix(host): separate REA host support from Hopper installer targets
  • PR #2065 [OPEN] — fix(native): name numeric Mach-O build-version platforms and tools
  • PR #2049 [OPEN] — feat(ghidra): decode Swift String literals in function dossiers
  • PR #2040 [OPEN] — fix(native): select one slice when universal Mach-O slices share a CPU type
  • PR #2025 [OPEN] — feat(ghidra): admit caller-selected matching dSYM companions
  • PR #2014 [MERGED] — fix(ghidra): recover stale clients on same-target reopen
  • PR #2011 [MERGED] — fix(ghidra): retain launcher command outcome in launch failure diagnostics
  • PR #2010 [OPEN] — fix(ghidra): retain bounded LaunchSupport failure output
  • PR #2007 [OPEN] — fix(target): probe WASM before inferred database routing
  • PR #1995 [MERGED] — fix(native): reject required otool fields truncated before their value
  • PR #1991 [MERGED] — feat(ghidra): admit verified MIPS16 shared ELF images
  • PR #1982 [MERGED] — fix(native): accept universal binaries with LIB64 x86_64 slices
  • PR #1981 [MERGED] — fix(wasm): inspect modules whose custom section names contain NUL
  • PR #1974 [MERGED] — test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane
  • PR #1972 [MERGED] — test(native): replay complete dylib-use provider output
  • PR #1967 [MERGED] — fix(wasm): preserve debug module names in WABT output
  • PR #1963 [MERGED] — fix(wasm): accept unpadded WABT section rows
  • PR #1961 [OPEN] — feat(gdb): add persistent debugger integration
  • PR #1960 [OPEN] — feat(reverse): add local inspection commands
  • PR #1959 [OPEN] — feat(process): add owned debugger shutdown lifecycle
  • PR #1950 [MERGED] — feat(ghidra): admit relocatable MIPS32r2 ELF objects
  • PR #1949 [MERGED] — feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage
  • PR #1948 [OPEN] — feat(ghidra): add bounded PS-X EXE static analysis
  • PR #1942 [OPEN] — fix(verification): align Linux Hopper setup lane with current contracts
  • PR #1931 [MERGED] — perf(ghidra): compile bundle activator with bridge scripts
  • PR #1927 [MERGED] — fix(hopper): preserve observed process failures across requests
  • PR #1922 [OPEN] — feat(ghidra): verify and pin the 32-bit ARM (armhf) lane
  • PR #1918 [CLOSED] — test(contracts): audit static WASM and Harmony wording
  • PR #1917 [MERGED] — fix(test): audit static Wasm and Harmony tool wording
  • PR #1913 [MERGED] — feat(ghidra): apply validated analyzer overrides before analysis
  • PR #1910 [MERGED] — fix(mcp): provide native evidence paging continuation
  • PR #1906 [MERGED] — fix(ida): preserve non-x86 call edges and workflow uncertainty
  • PR #1900 [MERGED] — test(native): skip the inaccessible-directory diagnostic as root
  • PR #1898 [OPEN] — feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language
  • PR #1889 [OPEN] — fix(artifacts): identify WebAssembly module targets at native admission
  • PR #1885 [MERGED] — fix(test): wait for Hopper reconnect listener readiness
  • PR #1877 [MERGED] — fix(ghidra): report progress while startup is pending
  • PR #1872 [MERGED] — feat(target): explain static WASM inspection after native rejection
  • PR #1870 [OPEN] — docs(installation): document building the macOS Ghidra native decompiler
  • PR #1868 [MERGED] — feat(native): admit raw binaries with caller-supplied architecture and entry
  • PR #1866 [MERGED] — fix(hopper): wait for late bridges during cleanup
  • PR #1863 [MERGED] — fix(windows): bring the real Windows Ghidra verifiers up to date
  • PR #1845 [OPEN] — fix(ida): retain private input after ambiguous open
  • PR #1841 [OPEN] — fix(ida): let one-shot commands exit after retaining cleanup
  • PR #1826 [MERGED] — fix(windows): retain failed native inspection ownership
  • PR #1817 [MERGED] — fix(hopper): preserve startup failures and recover denied launches
  • PR #1800 [OPEN] — feat(ghidra): disable named auto-analyzers via REA_GHIDRA_DISABLED_ANALYZERS
  • PR #1785 [MERGED] — fix(ida): report a procedure IDA cannot resolve as invalid input
  • PR #1778 [MERGED] — fix(ida): wait out a transient busy worker health in headless sessions
  • PR #1764 [MERGED] — fix(ida): declare GUI navigation for attached legacy analysis
  • PR #1763 [MERGED] — fix(hopper): let failed one-shot commands exit while retaining a lease
  • PR #1747 [OPEN] — feat(ghidra): admit 32-bit big-endian PowerPC ELF
  • PR #1715 [MERGED] — feat(native): expose typed incoming references at exact addresses
  • PR #1713 [MERGED] — fix(native): retain failed command cleanup owners
  • PR #1709 [OPEN] — fix(native): honor Mach-O chained pointer locations and library ordinals
  • PR #1708 [MERGED] — fix(native): retain failed pwntools process and runtime cleanup
  • PR #1703 [MERGED] — fix(native): raise default PE resource entry budget to 16384
  • PR #1698 [MERGED] — fix(ghidra): keep JVM warnings out of LaunchSupport output
  • PR #1689 [MERGED] — docs(website): add beginner help to the native analysis guide
  • PR #1678 [MERGED] — fix(native): bound PE resource RVAs by section virtual size
  • PR #1677 [CLOSED] — fix(native): report missing and non-file PE resource targets as input errors
  • PR #1672 [OPEN] — feat(ghidra): surface instruction-backed prototype conflicts
  • PR #1667 [MERGED] — feat(ghidra): configurable import language and analysis seeds
  • PR #1666 [CLOSED] — fix(ghidra): recover returning import callers
  • PR #1663 [CLOSED] — fix(ghidra): disclose that string search covers only defined strings
  • PR #1660 [MERGED] — ci: scope provider and native verification by changed inputs
  • PR #1652 [CLOSED] — fix(ghidra): reject occupied compact address names
  • PR #1646 [MERGED] — fix(tests): verify Qwen skills through an isolated native home
  • PR #1643 [CLOSED] — test(hopper): recognize signal-terminated diagnostic fixtures
  • PR #1640 [MERGED] — fix(test): preserve Ghidra interior-label controls on Mach-O
  • PR #1638 [MERGED] — fix(tests): bind HOME in native client and deepseek verifiers
  • PR #1635 [MERGED] — feat(ghidra): admit set_address_name and set_addresses_names
  • PR #1629 [MERGED] — fix(ghidra): admit carved MIPS ELF with incomplete section tables
  • PR #1599 [MERGED] — feat(ghidra): admit bounded PSP ELF through installed Allegrex
  • PR #1592 [MERGED] — feat(ghidra): recover signed AArch64 relative jump tables
  • PR #1584 [MERGED] — test(native): skip the DMG EACCES diagnostic as root
  • PR #1570 [MERGED] — feat(native): return a retained summary view of binary layouts on request
  • PR #1550 [MERGED] — test(ghidra): preserve Node heap options in adapter verification
  • PR #1544 [MERGED] — feat(ida): support optional native IDA Free MCP in attached mode
  • PR #1533 [MERGED] — feat(wasm): inspect local artifacts with WABT
  • PR #1531 [MERGED] — fix(windows): load native controls in Node-API hosts not named node.exe
  • PR #1507 [MERGED] — fix(native): page every retained function dossier collection
  • PR #1482 [MERGED] — feat(artifacts): inspect PE resource identities and payload ranges
  • PR #1481 [MERGED] — fix(ida): canonicalize the headless workspace root before opening
  • PR #1467 [CLOSED] — Feat/ghidra existing project
  • PR #1438 [MERGED] — fix(native): preserve compact reference provenance
  • PR #1436 [MERGED] — test(native): verify macOS provenance through real CLI and MCP
  • PR #1430 [MERGED] — perf(native): record macOS command provenance once in its Evidence
  • PR #1426 [MERGED] — fix(hopper): treat a directory launcher path as missing
  • PR #1420 [MERGED] — docs: correct stale logging, Ghidra host, and example path statements
  • PR #1419 [MERGED] — fix(ghidra): clear wrong no-return flags before serving a session
  • PR #1418 [CLOSED] — fix(cli): describe native command options accurately in help
  • PR #1405 [MERGED] — perf(hopper): stop repeating Hopper replies as raw_result
  • PR #1404 [MERGED] — perf(native): record pwntools diagnostics once in their Evidence
  • PR #1394 [MERGED] — test(native): skip the EACCES directory diagnostic as root
  • PR #1382 [MERGED] — fix(ghidra): keep the cross-format branch callee multi-block
  • PR #1374 [MERGED] — fix(ghidra): verify dense jump tables on an optimized fixture
  • PR #1362 [MERGED] — feat(native): admit bounded MIPS ELF analysis through Ghidra
  • PR #1359 [MERGED] — feat: add Frida instrumentation support
  • PR #1355 [CLOSED] — docs: clarify README setup command, mention IDA, and update Node badge
  • PR #1348 [MERGED] — docs: explain CI scope and native runner reuse
  • PR #1345 [MERGED] — feat(native): inspect oversized retained function dossiers via bounded views
  • PR #1344 [MERGED] — fix(ci): scope verification and reuse native runners
  • PR #1342 [CLOSED] — feat(ghidra): admit native x86 and x86-64 PE DLLs on Windows
  • PR #1325 [MERGED] — fix(native): refuse to list architectures of non-Mach-O targets
  • PR #1309 [CLOSED] — fix(comparison): keep Ghidra generated function names ambiguous
  • PR #1306 [CLOSED] — fix(apple): recognize legacy simulator Mach-O platforms
  • PR #1303 [MERGED] — feat(ghidra): support native PE DLLs on Windows
  • PR #1300 [MERGED] — test(apple): verify compiled Mach-O root occurrence facts
  • PR #1298 [MERGED] — test(artifacts): pin per-occurrence roles for direct Mach-O roots and shared bytes
  • PR #1297 [MERGED] — fix(ghidra): use dot-free private session paths
  • PR #1289 [MERGED] — fix(ghidra): stop dereferencing the removed error payload in address verification
  • PR #1285 [MERGED] — fix(hopper): probe interior navigation from multi-byte instructions
  • PR #1281 [MERGED] — fix(ci): pass selected environment to Windows Ghidra fixture
  • PR #1280 [MERGED] — fix(ghidra): reject a native decompiler built for another host
  • PR #1279 [CLOSED] — feat: add analysis tool integrations
  • PR #1278 [MERGED] — docs(ghidra): explain supported heap and CPU controls
  • PR #1275 [MERGED] — fix(hopper): allow restart after verified owned-provider shutdown
  • PR #1270 [MERGED] — fix(native): distinguish batch selectors from resolved entries
  • PR #1268 [MERGED] — fix(ghidra): preserve decoded return flow evidence
  • PR #1258 [MERGED] — fix(native): name the plist selection that works when Info.plist is missing
  • PR #1229 [MERGED] — perf(hopper): resolve string search records once per query
  • PR #1222 [MERGED] — fix(ghidra): do not run Java from a relative JAVA_HOME in doctor and setup
  • PR #1209 [MERGED] — fix(cli): resolve xrefs symbol selectors after address validation
  • PR #1208 [MERGED] — fix(ghidra): classify modern Swift manglings in swift type analysis
  • PR #1206 [CLOSED] — fix(cli): advertise an address, not a symbol name, on the xrefs selector
  • PR #1201 [MERGED] — fix(ghidra): keep and name a runtime directory that close could not remove
  • PR #1200 [MERGED] — fix(ghidra): reject relative installation and Java paths in doctor and setup
  • PR #1198 [MERGED] — fix(ghidra): report NativeAOT host and target refusals as unsupported, not failures
  • PR #1196 [MERGED] — fix(native): refuse truncated executable headers at target admission
  • PR #1195 [MERGED] — fix(ghidra): resolve secondary symbols at function entries
  • PR #1182 [MERGED] — fix(doctor): find the Homebrew Hopper cask without writing Homebrew caches
  • PR #1176 [MERGED] — fix(session): require an open target for session-bound native and artifact tools
  • PR #1158 [MERGED] — fix(hopper): reserve Linux demo application before launch
  • PR #1119 [MERGED] — fix(hopper): enforce caller-supplied request deadlines
  • PR #1118 [MERGED] — fix(hopper): preserve owned basic-block endpoint instructions
  • PR #1111 [MERGED] — fix(hopper): verify lease cleanup and repair the macOS test lane
  • PR #1107 [MERGED] — ci: run signature target binding regressions on native macOS
  • PR #1105 [MERGED] — fix(hopper): report launcher failures before bridge timeout
  • PR #1099 [MERGED] — fix(native): bind signature observations to registered target versions
  • PR #1084 [MERGED] — fix(native): keep signature failure evidence instead of collapsing it
  • PR #1069 [MERGED] — test(artifacts): verify native directory identity on supported Windows runtimes
  • PR #1054 [MERGED] — feat(native): inspect recorded crashes through pwntools and pwndbg
  • PR #1049 [MERGED] — fix(domain): preserve prototype-named JSON members through Evidence boundaries
  • PR #1044 [MERGED] — fix(hopper): diagnose MCP provider failures with stage, state, and request context
  • PR #1037 [MERGED] — feat(native): inspect offline ELF layout through pwntools
  • PR #1030 [MERGED] — feat(ghidra): support native x86 PE applications on Windows
  • PR #1016 [MERGED] — fix(ci): avoid slow Azure archive for the native cross compiler
  • PR #1015 [CLOSED] — docs(ghidra): explain Windows P0 rejections for 32-bit x86 PE targets
  • PR #991 [MERGED] — fix(native)!: preserve incomplete native UI captures
  • PR #974 [MERGED] — feat(ghidra): make the startup deadline configurable
  • PR #973 [MERGED] — refactor(native): group analyst semantics workflows and contracts
  • PR #963 [MERGED] — fix(linux): improve Hopper reliability and CachyOS support
  • PR #950 [MERGED] — fix(ida): share concurrent session cleanup
  • PR #944 [MERGED] — fix(native-ui): handle incomplete accessibility child collections
  • PR #935 [MERGED] — ci: consolidate macOS native baseline checks
  • PR #934 [CLOSED] — feat(native): report code-signing posture in inspect_signature
  • PR #927 [MERGED] — feat(artifacts): trace Mach-O dylib resolution in bundles
  • PR #917 [MERGED] — feat(browser): attribute native execution and listener sources
  • PR #910 [MERGED] — feat(native): open iOS-style and iOS-on-Mac wrapper app bundles
  • PR #898 [MERGED] — ci: verify native arm64 and Intel macOS workflows
  • PR #880 [MERGED] — fix(native): keep echoed Mach-O paths out of load commands and symbols
  • PR #875 [MERGED] — fix(native): report why a selected plist cannot be inspected
  • PR #865 [MERGED] — fix(native): keep echoed codesign paths out of signature fields
  • PR #860 [MERGED] — fix(native): keep integral plist reals beyond the JSON range as reals
  • PR #856 [MERGED] — refactor(ghidra): extract createClient and load-image attestation
  • PR #855 [MERGED] — refactor(native): split Apple dispatch metadata decode facets
  • PR #854 [MERGED] — fix: preserve native UI failure reasons and dedupe version literals
  • PR #846 [MERGED] — fix(native): report exact plist integers beyond the JSON number range
  • PR #841 [MERGED] — fix(native): inspect plists containing data, dates, and non-finite reals
  • PR #840 [MERGED] — fix(ghidra): admit the 12.1 line and the install's JDK range
  • PR #815 [MERGED] — fix: integrate 24 reviewed browser/native/semantics corrections
  • PR #812 [CLOSED] — fix(native): project Mach-O evidence into container file offsets
  • PR #807 [CLOSED] — fix(native): retain nm-proven literal export names
  • PR #804 [CLOSED] — fix(native): recognize only whole otool command headers
  • PR #803 [CLOSED] — fix(native): preserve exact code signing identifiers
  • PR #800 [MERGED] — fix(ghidra): select exact packaged bridge scripts
  • PR #782 [CLOSED] — fix: recover serialized native NIB view hierarchy
  • PR #777 [MERGED] — fix(cli): align structured output guard with native flags
  • PR #773 [MERGED] — fix(cli): honor the selected native plist path
  • PR #767 [CLOSED] — fix(native): preserve app bundle executable filename whitespace
  • PR #762 [CLOSED] — fix(native): preserve thin architectures across echoed filename lines
  • PR #759 [CLOSED] — fix(ghidra): reject contradictory NativeAOT reports
  • PR #754 [MERGED] — feat(ida): add read-only GUI and headless MCP providers
  • PR #748 [MERGED] — feat(ghidra): integrate optional NativeAOT metadata recovery
  • PR #739 [MERGED] — fix(hopper): retain shutdown request diagnostics
  • PR #736 [MERGED] — docs(ghidra): explain first-query deadlines and recovery
  • PR #730 [CLOSED] — docs(hopper): validate realpath fallback wording
  • PR #713 [MERGED] — fix(ghidra): refuse ambiguous universal Mach-O imports
  • PR #711 [MERGED] — docs(hopper): document HopperTargetLease realpath fallback
  • PR #709 [MERGED] — feat(ghidra): add atomic function annotation edits
  • PR #704 [MERGED] — fix(native): select concrete arm64e Mach-O slices
  • PR #702 [MERGED] — feat(ghidra): admit explicit DOS COM analysis
  • PR #701 [MERGED] — fix(native): inspect mixed-signature Mach-O slices
  • PR #699 [MERGED] — feat(ghidra): enable Windows x64 read-only analysis
  • PR #697 [MERGED] — feat(ghidra): verify DOS load images and expose memory evidence
  • PR #690 [CLOSED] — fix(native): preserve numeric-looking Mach-O identifiers
  • PR #685 [CLOSED] — fix(dotnet): preserve C identifier underscores in native matching
  • PR #681 [CLOSED] — fix(native): preserve final demangled symbol whitespace
  • PR #679 [CLOSED] — fix(artifacts): align native DMG mount and detach lifecycle
  • PR #669 [MERGED] — fix(native): retain spaced symbols in dyld inventory
  • PR #662 [MERGED] — test(hopper): synchronize startup cancellation with launcher readiness
  • PR #647 [MERGED] — fix(ghidra): preserve request and shutdown failure diagnostics
  • PR #632 [MERGED] — refactor(native): extract FAT header format switch in Mach-O slice selection
  • PR #618 [CLOSED] — fix(native): decode little-endian fat headers as universal binaries
  • PR #608 [MERGED] — fix(native): reject signal-terminated command captures
  • PR #601 [MERGED] — fix(native): inspect the selected universal Mach-O architecture
  • PR #596 [MERGED] — fix(comparison): match generated names without swallowing symbol prefixes
  • PR #590 [MERGED] — fix(native): inspect Apple dispatch metadata in FAT64 binaries
  • PR #586 [MERGED] — fix(native): decode Mach protection bits in their proper positions
  • PR #584 [MERGED] — fix(package): separate agent and Hopper setup support
  • PR #579 [MERGED] — fix(ghidra): recover evidenced switch cases and default targets
  • PR #556 [MERGED] — feat(ghidra): add DOS MZ analysis and complete function extents
  • PR #540 [MERGED] — fix(replay): keep proto own properties and reject symbol-keyed results
  • PR #534 [MERGED] — fix(native): match compound otool keys exactly and badge unknown thread entrypoints
  • PR #533 [MERGED] — fix(native): normalize otool line endings and strip plist JSON BOM
  • PR #532 [MERGED] — fix(native): retain lazy dylibs, normalize version-min builds, limit thread entrypoints
  • PR #531 [MERGED] — fix(native): reject trailing text in lipo integers and keep multi-word otool keys
  • PR #525 [MERGED] — fix(native): capture Mach-O header metadata alongside load commands
  • PR #520 [MERGED] — fix(native): preserve text-valued load command metadata
  • PR #516 [MERGED] — fix(native): retain re-exported Mach-O library dependencies
  • PR #503 [MERGED] — fix: correct native inventories and bridge error classification
  • PR #500 [MERGED] — feat(native): add inspection primitives, dispatch traces and approved UI observation
  • PR #486 [MERGED] — feat(native): add investigation features
  • PR #429 [MERGED] — fix(hopper): add bounded analysis recovery
  • PR #410 [MERGED] — fix(process): protect unrelated Hopper during cleanup
  • PR #286 [MERGED] — test(ci): guard Windows Ghidra workflow isolation
  • PR #284 [MERGED] — feat(ghidra): add experimental Windows x64 P0 support
  • PR #247 [MERGED] — feat(ghidra): add function analysis and conformance
  • PR #246 [MERGED] — feat(ghidra): implement read-only inventory operations
  • PR #245 [MERGED] — feat(ghidra): add private headless provider session
  • PR #227 [MERGED] — fix(hopper): cancel startup before closing
  • PR #223 [MERGED] — fix(doctor): honor explicit Hopper launcher
  • PR #213 [MERGED] — fix(hopper): select verified Linux demo mode explicitly
  • PR #207 [MERGED] — fix(native): harden command capture edge cases
  • PR #127 [MERGED] — docs: add Hopper screenshot to README
  • PR #116 [MERGED] — fix(hopper): complete owned Linux shutdown
  • PR #110 [MERGED] — fix(linux): start Hopper demo sessions headlessly
  • PR #109 [MERGED] — feat(analysis): persist snapshots and close Hopper reliably
  • PR #95 [MERGED] — feat!: add evidence-safe process capture v4 and native DMG traversal

Scope note: dedicated commercial-protection recovery request #2080 and the separately scoped iOS runtime PR #2264 are not accepted language/debugger coverage in this tracker. Their existence does not approve those workflows.

<!-- gh-comment-id:6132669473 --> @matbrgz commented on GitHub (Oct 12, 2026): ## Complementary index: native providers, debugger lifecycle and format foundations Snapshot: 2026-10-12. This index covers shared native-analysis/decompilation providers, symbol/instruction facts, debugger/instrumentation lifecycle and recorded-format foundations referenced by the top-100 language audit. These are **topic relationships**, not assertions that a native provider supports every compiled language, that an open PR is available, or that a historically merged feature remains in the current product. Architecture admission is distinct from compiler/language semantics. Refer to the exact PR, current contracts and real-provider verification before recording a support claim. State legend: issue OPEN/CLOSED describes discussion state; PR OPEN/CLOSED/MERGED describes contribution state. A closed unmerged PR is not delivered support. A closed issue may have been superseded or declined. **467 related entries:** 182 issues and 285 PRs. <details> <summary>Issues</summary> - Issue #2382 [OPEN] — [Feature] Retain LLDB source coordinates for observed native call locations - Issue #2369 [OPEN] — [Feature] Inspect Linux BTF type and function metadata offline - Issue #2357 [OPEN] — [Roadmap] Track scoped static artifact and recorded-crash improvements - Issue #2356 [OPEN] — [Feature] Compare admitted WebAssembly import and export interfaces - Issue #2355 [OPEN] — [Feature] Inspect recorded Windows minidump streams without a live target - Issue #2353 [OPEN] — [Feature] Decode recorded Linux AArch64 ELF core evidence - Issue #2350 [OPEN] — [Feature] Inspect WebAssembly components and canonical ABI declarations offline - Issue #2343 [OPEN] — [Bug] MZ new-header signature check strips the high bit, so corrupt bytes read as NE/LX/PE (main CI red) - Issue #2338 [OPEN] — Ghidra MIPS: admit plain MIPS32 PIC shared libraries (ET_DYN) at their link base - Issue #2335 [OPEN] — [Feature] Headless IDA: resolve containing procedures and report the admitted program as the document - Issue #2330 [OPEN] — fix(artifacts): correct ZIP non-entry coverage description - Issue #2326 [OPEN] — [Bug] Callee and caller reads give no warning when Ghidra's function body stops short - Issue #2322 [OPEN] — [Bug] build_call_path can no longer establish not_found from headless IDA Evidence after #1544 - Issue #2301 [OPEN] — IDA provider rejects upstream ida-pro-mcp 2.0.0 in both attached and headless modes - Issue #2300 [OPEN] — [Feature] Show one function's pseudocode from several decompiler providers in one call - Issue #2298 [OPEN] — [Feature] Decompile WebAssembly functions into labeled pseudocode - Issue #2285 [OPEN] — [Bug] Headless IDA private input for a universal Mach-O includes bytes after the selected slice - Issue #2270 [OPEN] — [Bug] Hopper not detected on Linux during setup - Issue #2259 [OPEN] — [Bug] Ghidra provider never applies a PE's sidecar PDB; name lookups fail and no limitation is reported - Issue #2258 [OPEN] — A recommended list of open-source decompilers - Issue #2213 [CLOSED] — [Bug] Frida input errors say "correct the listed arguments" but list none - Issue #2204 [CLOSED] — [Bug] Ghidra provider stays unavailable when JAVA_HOME contains non-ASCII characters on Windows - Issue #2186 [OPEN] — Proposal: admit bounded ARM / ARM64 PE targets on Windows Ghidra P0 - Issue #2183 [OPEN] — feat(windows): capture target-bound native window evidence - Issue #2172 [CLOSED] — fix(targets): linker-generated PE DLL with a short DOS header is classified as DOS - Issue #2139 [CLOSED] — [Bug] IDA provider analyzes the x86_64 slice of a universal Mach-O while reporting arm64 - Issue #2138 [OPEN] — [Feature] Complete the upstream session evidence in headless IDA cleanup diagnostics - Issue #2078 [OPEN] — decompile rejects file offsets — Ghidra image-base rebase is invisible to the caller - Issue #2076 [OPEN] — [Bug] Prompt argument completion cold-starts Ghidra/Hopper and cannot be cancelled - Issue #2063 [OPEN] — [Feature] Add RISC-V ELF analysis through Ghidra (RV32/RV64) - Issue #1994 [CLOSED] — Document the macOS Ghidra decompiler build (12.1.4 ships none) - Issue #1992 [CLOSED] — Ghidra launch failures surface no actionable diagnostics (macOS) - Issue #1970 [CLOSED] — [Bug] Mach-O dylib-use commands are rejected as missing legacy timestamps - Issue #1964 [CLOSED] — [Bug] trace_call_path reports truncated: true on every IDA trace, and get_call_graph nodes carry provider-wide limitations - Issue #1957 [OPEN] — [Feature] Consider alternative to Ghidra/Hopper/Hex-Rays: Kuna - Issue #1956 [CLOSED] — [Bug] Valid WASM DataCount sections are rejected by WABT output parsing - Issue #1938 [CLOSED] — [Feature] Admit relocatable MIPS32r2 ELF objects (kernel modules) through Ghidra - Issue #1937 [CLOSED] — [Feature] Admit soft-float MIPS32r2 ELF through Ghidra with integer-register float storage - Issue #1935 [CLOSED] — [Feature] Enable verify:gemini-client on native Windows - Issue #1923 [CLOSED] — [Feature] Enable verify:claude-client on native Windows (the lane already passes there) - Issue #1859 [CLOSED] — [Bug] Windows real-Ghidra verifiers fail on every host after #1635, #1419 and #1667 - Issue #1852 [CLOSED] — [Feature] Explain available REA static lanes after unsupported native admission - Issue #1851 [CLOSED] — [Feature] Verify and admit MIPS16 shared ELF images in the native analysis lane - Issue #1849 [CLOSED] — [Feature] Provide bounded native function delivery with actionable retained-evidence continuation - Issue #1839 [CLOSED] — [Feature] Add native DeepSeek Harness (DSH) client support to REA setup - Issue #1819 [CLOSED] — [Bug] inspect-artifact reports executable:false for every Windows host file, including real PE .exe images - Issue #1808 [OPEN] — [Bug] Hopper 6.6.0-demo crashes (SIGSEGV) while REA analyzes /usr/libexec/sharingd; failed launch leaves poisoned session - Issue #1794 [CLOSED] — [Bug] Headless IDA reports no callees on ARM64 targets - Issue #1783 [OPEN] — [Bug] Ghidra provider times out on a 1.85 MB Swift/ObjC arm64 Mach-O: auto-analysis stalls in ObjcMessageAnalyzer and cannot be skipped - Issue #1775 [CLOSED] — [Bug] Mach-O LC_BUILD_VERSION accepts tool records outside cmdsize - Issue #1769 [CLOSED] — [Bug] Headless IDA reports a missing procedure as unreadable_output - Issue #1766 [CLOSED] — [Bug] Headless IDA fails with unreadable_output while the worker reports a transient busy health - Issue #1751 [CLOSED] — fix(hopper): failed one-shot analysis stays alive and holds its target lease - Issue #1750 [OPEN] — fix(hopper): saved databases open without starting the analysis bridge - Issue #1745 [OPEN] — [Feature] Confirm the 32-bit ARM (armhf / ARMv7 EABI) native lane and pin ARM:LE:32:v7 instead of auto-selection - Issue #1741 [OPEN] — [Feature] Add PowerPC (32-bit big-endian) native analysis through Ghidra, with a GameCube/Wii DOL follow-up - Issue #1720 [OPEN] — [Bug] query tool calls die at a flat ~60s timeout, shorter than configured Ghidra startup timeout - Issue #1712 [CLOSED] — [Bug] Attached IDA analysis reports no UI effects despite legacy GUI actions - Issue #1710 [CLOSED] — [Bug] Headless IDA cleanup cannot recover after the supervisor reaps an owned worker - Issue #1702 [CLOSED] — [Bug] inspect-pe-resources rejects stock Windows resource images at the default entry budget - Issue #1701 [OPEN] — [Bug] Windows native authority self-test fails on real Windows: "Delete owned object by handle failed" (Win32 5), and leaves probe directories behind - Issue #1681 [OPEN] — [Design] Pin the Hopper publisher identity in the macOS installer - Issue #1649 [CLOSED] — [Bug] Ghidra set_address_name accepts a duplicate name and returns true - Issue #1641 [OPEN] — [Feature] Add 6502 and 65816 (WDC) native analysis through Ghidra - Issue #1634 [CLOSED] — [Feature] Ghidra: admit set_address_name / set_addresses_names - Issue #1625 [CLOSED] — [Bug] Native client verifiers leave HOME unbound and bypass Pi default skill discovery - Issue #1620 [OPEN] — [Feature] Admit legacy MIPS32 ELFs with an unspecified ABI, pinning the 32-bit Ghidra language (auto-selection picks MIPS:LE:64:64-32R6addr) - Issue #1619 [CLOSED] — [Bug] MIPS ELF whose section header table lies past EOF is refused although PT_MIPS_ABIFLAGS is present - Issue #1597 [CLOSED] — [Bug] verify:ghidra entry-alias check fails on macOS arm64 - Issue #1548 [CLOSED] — bug(verification): native value adapter checks discard Node heap budgets - Issue #1518 [CLOSED] — [Bug] Ghidra boundary verifier fails on duplicate output schema ids since #1433 - Issue #1503 [CLOSED] — fix(native): keep interface-builder trace coverage partial when decode is partial - Issue #1502 [CLOSED] — fix(native): select the FAT slice for the admitted CPU type - Issue #1499 [CLOSED] — fix(native): report pointer-fixup coverage from the commands actually read - Issue #1416 [OPEN] — [Feature] Support the official Hex-Rays IDA MCP server as an analysis provider - Issue #1353 [CLOSED] — [Docs] README: FAQ setup command, IDA in the intro, Node badge - Issue #1339 [CLOSED] — [Bug] A dot in the TMPDIR path makes Ghidra abort, reported as a generic "retry once" failure - Issue #1330 [OPEN] — [Feature] Add PSP/Allegrex native analysis through Ghidra - Issue #1290 [CLOSED] — [Feature] Support native x86/x64 PE DLLs in the Windows Ghidra provider - Issue #1267 [OPEN] — [Feature] Live native debugging through x64dbg, GDB and LLDB adapters - Issue #1255 [CLOSED] — docs(ghidra): clarify supported heap and CPU controls - Issue #1254 [CLOSED] — feat(artifacts): inspect PE resource identities and payload ranges - Issue #1247 [CLOSED] — feat(native): inspect selected facets of retained function dossiers - Issue #1246 [OPEN] — feat(native): inspect data-region accesses and overlapping field candidates - Issue #1245 [CLOSED] — feat(native): preserve access kind and inference provenance in compact xrefs - Issue #1244 [OPEN] — feat(native): surface instruction conflicts with inferred function prototypes - Issue #1243 [CLOSED] — feat(native): return resolved procedure identity in batch decompilation - Issue #1242 [CLOSED] — fix(native): preserve decoded return evidence in Ghidra instruction flow - Issue #1238 [CLOSED] — fix(ghidra): real verifier rejects a valid zero-operand ENDBR64 entry - Issue #1235 [CLOSED] — fix(artifacts): direct Mach-O inspection reports an executable as a resource - Issue #1219 [CLOSED] — [Bug] Ghidra provider aborts on every operation when the runtime root path contains a dot-prefixed element - Issue #1193 [OPEN] — [Feature] Analyze a caller-selected matching dSYM with the Ghidra provider - Issue #1192 [CLOSED] — [Feature] Diagnose a Ghidra native decompiler built for the wrong platform or architecture - Issue #1191 [CLOSED] — [Bug] One terminal SIGINT through `npx` orphans the Ghidra JVM and its runtime directories - Issue #1190 [CLOSED] — [Bug] Failed Ghidra runtime cleanup omits the leftover path, and a later close reports success while it remains - Issue #1189 [CLOSED] — [Bug] A truncated Mach-O header is admitted as a valid executable and then fails as a provider `execution_failure` - Issue #1187 [CLOSED] — [Bug] `analyze_swift_types` returns an empty inventory for a modern Swift binary with the Ghidra provider - Issue #1186 [CLOSED] — [Bug] `rea xrefs` rejects the symbol-name selector its help advertises - Issue #1184 [CLOSED] — [Bug] Configuration errors omit the rejected Ghidra setting and its absolute-path constraint - Issue #1183 [CLOSED] — [Bug] Doctor and setup accept a relative `GHIDRA_INSTALL_DIR` that the registered MCP server rejects at startup - Issue #1170 [CLOSED] — [Bug] Ghidra cannot select a function by the imported `_main` symbol from its name inventory - Issue #1131 [CLOSED] — Ghidra provider rejects linux/arm64 hosts (hard-coded x64 allowlist) — one-line fix proven working - Issue #1066 [CLOSED] — [Bug] Setup writes bare "npx" into agent MCP configs on native Windows - Issue #1048 [OPEN] — [Feature] Open a pre-imported Ghidra project so import and auto-analysis can happen outside the startup deadline - Issue #1036 [CLOSED] — [Bug] Preserve prototype-named JSON members through Evidence boundaries - Issue #1026 [CLOSED] — [Bug] Windows Ghidra snapshot lease blocks Java readers - Issue #969 [CLOSED] — [Feature] Modular binary diagnostics and debugger adapters using pwntools and pwndbg - Issue #968 [OPEN] — [Feature] Modular native runtime instrumentation through a Frida adapter - Issue #884 [CLOSED] — [Feature] Integrate WABT for WebAssembly artifact inspection and website glue evidence - Issue #832 [CLOSED] — [Bug] Linux: Ghidra provider unusable — GHIDRA_INSTALL_DIR not detected and Arch-family host flagged unsupported - Issue #821 [CLOSED] — [Bug] Ghidra provider pins Java to exactly major 21 and the Ghidra version to the exact string "12.1.4", blocking working installs - Issue #793 [CLOSED] — Linux Hopper setup rejects the pinned 6.4.2 RPM launcher - Issue #790 [CLOSED] — [Bug] Ghidra bridge discovery collides with a same-named working-directory entry - Issue #786 [CLOSED] — [Bug] Windows native boundaries reject ordinary forward-slash drive paths - Issue #778 [OPEN] — [Docs] Track reproducible demos across REA analysis domains - Issue #760 [CLOSED] — Thin Mach-O architecture inventory misreads filenames containing line breaks - Issue #747 [CLOSED] — [Feature] Integrate IDA Pro MCP as an attached and headless analysis provider - Issue #743 [CLOSED] — [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - Issue #740 [OPEN] — [Design] Roadmap: clarify investigation ownership and modularize REA capability integration - Issue #727 [CLOSED] — [Docs] Explain Ghidra query deadlines and recovery after client cancellation - Issue #684 [CLOSED] — [Bug] inspect-signature fails with execution_failure on universal Mach-O binaries with a signed arm64/arm64e slice and an unsigned x86_64 slice - Issue #674 [CLOSED] — [Bug] inspect-macho fails on universal x86_64 + arm64e Mach-O binaries such as /bin/ls - Issue #656 [CLOSED] — [Bug] Ghidra provider analyzes the x86_64 slice of a universal Mach-O while reporting arm64 - Issue #642 [CLOSED] — Clarify HopperTargetLease realpath fallback semantics - Issue #641 [CLOSED] — Review HopperCleanup shutdown-request error identity - Issue #640 [CLOSED] — Review GhidraClient shutdown-handshake error mapping - Issue #639 [CLOSED] — Review GhidraRequestQueue settlement error value - Issue #592 [CLOSED] — native: byte-swapped fat headers (FAT_CIGAM / FAT_CIGAM_64) are misreported as unsupported thin Mach-O - Issue #568 [CLOSED] — Report the real cause when the native PTY backend is unavailable - Issue #563 [CLOSED] — native: positional header decoding and remaining unvalidated parser coercions - Issue #527 [CLOSED] — Windows: Ghidra provider is hard-gated off via hasWindowsNativeAuthority, contradicting the advertised Windows x64 P0 - Issue #501 [CLOSED] — Hopper `list_strings` / `list_names` double-convert the address → `-32000 invalid_request` on every `inspect` - Issue #497 [CLOSED] — [Feature] Add approved UI observation for native desktop applications - Issue #492 [CLOSED] — [Feature] Inspect recovered native data types and layouts - Issue #491 [CLOSED] — [Feature] Inspect one native instruction with structured operand facts - Issue #487 [OPEN] — [Feature] Improve Ghidra AArch64 jump-table recovery - Issue #483 [CLOSED] — [Feature] Trace native UI controls through dispatch to handlers - Issue #482 [CLOSED] — [Feature] Trace native state and value dependencies across functions - Issue #481 [CLOSED] — [Feature] Add a read-only Ghidra provider for macOS - Issue #479 [OPEN] — [Bug] Reuse Hopper GUI windows across REA sessions for the same target - Issue #478 [CLOSED] — [UX] Make Hopper provider failures diagnosable from MCP - Issue #352 [CLOSED] — Add bounded byte reads and file-offset mapping to Hopper - Issue #350 [CLOSED] — Ship typed Hopper API facade and standalone tests - Issue #346 [CLOSED] — Build jump-table and ABI fixture proof for native API reconstruction - Issue #345 [CLOSED] — Infer native API boundary types with evidence and confidence - Issue #344 [OPEN] — Run real-Hopper two-binary semantic conformance workflow - Issue #343 [OPEN] — Real-Hopper verifier for CFG successors and assembly output - Issue #342 [OPEN] — Real-Hopper verifier for caller/callee chains - Issue #341 [OPEN] — Run real-Hopper analyze_function dossier conformance - Issue #340 [OPEN] — Verify Hopper cancellation, timeout, mutation readback, and shutdown - Issue #339 [OPEN] — Record real-Hopper semantic proof for source-built fixtures - Issue #327 [OPEN] — Create and read back protected runtime-root DACLs via native Node-API - Issue #325 [OPEN] — Project native addon into protected retained authority before load - Issue #319 [OPEN] — Integrate Windows native authority package into release and real-Windows verifier - Issue #318 [OPEN] — Implement Windows native authority Node-API package - Issue #288 [OPEN] — Own Windows Ghidra process trees with kill-on-close semantics - Issue #287 [OPEN] — Define a trusted Windows native authority and packaging boundary - Issue #187 [CLOSED] — native: make inspect_macho resilient when vtool is unavailable - Issue #179 [CLOSED] — native: expose output truncation metadata in command capture result - Issue #176 [CLOSED] — native: propagate output truncation state in command captures - Issue #174 [CLOSED] — fix(native): avoid reparsing lipo output in list_architectures - Issue #166 [CLOSED] — BridgeLauncher Linux demo detection misses non-literal Hopper launcher paths - Issue #164 [CLOSED] — setup --install-hopper is ignored when Hopper is already configured - Issue #159 [CLOSED] — fix(native): retry failed Xcrun tool resolution instead of caching permanent failures - Issue #144 [CLOSED] — fix(native): report output truncation via stdout/stderr truncated flags - Issue #120 [CLOSED] — Hopper owned shutdown can block or leave document cleanup incomplete - Issue #108 [CLOSED] — Hopper analysis continues after timeout and close_binary, retaining 4 GB RSS - Issue #77 [CLOSED] — CLI analyze command calls unsupported Hopper bridge method (binary_overview) - Issue #56 [CLOSED] — Replace temporal Hopper cleanup with explicit process ownership - Issue #55 [OPEN] — Strengthen semantic Hopper conformance across source-built fixtures - Issue #54 [OPEN] — Complete Hopper function dossiers with real references and CFG edges - Issue #48 [OPEN] — Epic: Evidence v2 and deterministic process fidelity - Issue #42 [CLOSED] — Add managed-runtime, bytecode, and package ecosystem providers - Issue #34 [CLOSED] — Add a native macOS inspection provider - Issue #32 [OPEN] — Roadmap: evolve REA into an agent-first multi-tool analysis platform - Issue #31 [OPEN] — Complete truthful analyze_function dossiers - Issue #26 [CLOSED] — Evaluate Ghidra, IDA, Binary Ninja, Rizin, and LIEF providers - Issue #25 [OPEN] — Build a multi-binary Hopper conformance and fidelity suite - Issue #22 [CLOSED] — Expand the Hopper capability set for complete native analysis - Issue #19 [CLOSED] — Harden Hopper automation lifecycle, diagnostics, and headless ergonomics - Issue #17 [CLOSED] — Add an evidence-driven native API reconstruction workflow - Issue #16 [CLOSED] — Fix false-positive paths in real-Hopper verification </details> <details> <summary>Pull requests</summary> - PR #2374 [OPEN] — feat(ida): resolve containing procedures and report the admitted program as the document - PR #2364 [OPEN] — fix(native): parse renamed dyld_info re-exports - PR #2362 [OPEN] — feat(ghidra): admit plain MIPS32 PIC shared images - PR #2361 [OPEN] — fix(ghidra): bound the Java version probe output - PR #2360 [OPEN] — fix(ghidra): warn when callee/caller reads stop at a truncated function body - PR #2358 [OPEN] — feat(ghidra): select a pre-imported project with -process - PR #2341 [OPEN] — feat(native): search analyzed memory for masked byte patterns - PR #2337 [OPEN] — fix(artifacts): describe ZIP non-entry coverage accurately - PR #2336 [OPEN] — fix(ci): run the Windows native lane with its process boundary fixture - PR #2324 [OPEN] — fix(ida): preserve native coverage and verify returned values - PR #2312 [MERGED] — test(mcp): fix three MCP boundary suites on native Windows - PR #2307 [OPEN] — fix(ida): report missing tools when a compatibility profile mismatches - PR #2305 [OPEN] — fix(frida): drain admitted operations and honor queued cancellation - PR #2295 [OPEN] — docs(contributing): explain Windows native prerequisites for source checkouts - PR #2291 [OPEN] — fix(ida): stop the private input of a universal Mach-O at the end of the selected slice - PR #2283 [OPEN] — fix(ghidra): report unapplied PE CodeView PDB limitation - PR #2281 [OPEN] — fix(native): name the retained pwntools process group in cleanup resources - PR #2275 [OPEN] — fix(ghidra): disclose missing PDB symbol coverage - PR #2266 [OPEN] — fix(windows): classify transient native self-test failures as retryable - PR #2262 [OPEN] — fix(native): refuse inspect_signature on non-Mach-O targets - PR #2236 [CLOSED] — fix(ida): update native bridge for main and verify with IDA Pro - PR #2227 [OPEN] — fix(targets): recognize PE images with short DOS stubs - PR #2224 [MERGED] — docs: preserve the native guide title anchor - PR #2217 [MERGED] — fix(frida): name the argument each Frida input error rejects - PR #2216 [MERGED] — test(native): verify real PE and DOS entry views - PR #2215 [CLOSED] — fix(frida): validate caller-selected script file before starting a session - PR #2211 [MERGED] — fix(frida): reject an unreadable script file before starting a session - PR #2206 [MERGED] — fix(ghidra): encode Java probe output as UTF-8 - PR #2201 [MERGED] — fix(ida): thin the selected FAT slice into the private headless input - PR #2199 [OPEN] — feat(windows): capture selected native windows - PR #2193 [MERGED] — feat(wasm): add opt-in first-call summary delivery - PR #2151 [MERGED] — feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane - PR #2150 [OPEN] — feat(ghidra): open pre-imported projects with -process instead of re-importing - PR #2131 [MERGED] — ci: narrow native-host lane selection and reuse build caches - PR #2122 [MERGED] — feat(analysis): add opt-in retained inventory and WASM views - PR #2117 [OPEN] — fix(wasm): report WABT output past its budget as a resource constraint - PR #2114 [OPEN] — fix(wasm): preserve original glue source locations - PR #2112 [MERGED] — docs(ghidra): verified macOS arm64 native decompiler build recipe - PR #2110 [OPEN] — fix(artifacts): preserve Mach-O load-command string identity - PR #2108 [OPEN] — fix(windows): classify native readiness failures by stage - PR #2107 [OPEN] — fix(native): preserve literal line breaks in signing identifiers - PR #2102 [MERGED] — fix(wasm): preserve leading BOM in custom section names - PR #2101 [OPEN] — fix(native): expose loaded image bases in overviews - PR #2084 [MERGED] — fix(wasm): stop appending WABT remediation to unrelated runtime-root failures - PR #2079 [OPEN] — feat(ghidra): support raw NMOS 6502 analysis - PR #2073 [OPEN] — fix(host): separate REA host support from Hopper installer targets - PR #2065 [OPEN] — fix(native): name numeric Mach-O build-version platforms and tools - PR #2049 [OPEN] — feat(ghidra): decode Swift String literals in function dossiers - PR #2040 [OPEN] — fix(native): select one slice when universal Mach-O slices share a CPU type - PR #2025 [OPEN] — feat(ghidra): admit caller-selected matching dSYM companions - PR #2014 [MERGED] — fix(ghidra): recover stale clients on same-target reopen - PR #2011 [MERGED] — fix(ghidra): retain launcher command outcome in launch failure diagnostics - PR #2010 [OPEN] — fix(ghidra): retain bounded LaunchSupport failure output - PR #2007 [OPEN] — fix(target): probe WASM before inferred database routing - PR #1995 [MERGED] — fix(native): reject required otool fields truncated before their value - PR #1991 [MERGED] — feat(ghidra): admit verified MIPS16 shared ELF images - PR #1982 [MERGED] — fix(native): accept universal binaries with LIB64 x86_64 slices - PR #1981 [MERGED] — fix(wasm): inspect modules whose custom section names contain NUL - PR #1974 [MERGED] — test(ghidra): require pending multi-HI16 coverage in the real MIPS relocatable lane - PR #1972 [MERGED] — test(native): replay complete dylib-use provider output - PR #1967 [MERGED] — fix(wasm): preserve debug module names in WABT output - PR #1963 [MERGED] — fix(wasm): accept unpadded WABT section rows - PR #1961 [OPEN] — feat(gdb): add persistent debugger integration - PR #1960 [OPEN] — feat(reverse): add local inspection commands - PR #1959 [OPEN] — feat(process): add owned debugger shutdown lifecycle - PR #1950 [MERGED] — feat(ghidra): admit relocatable MIPS32r2 ELF objects - PR #1949 [MERGED] — feat(ghidra): admit soft-float MIPS32r2 ELF with integer-register float storage - PR #1948 [OPEN] — feat(ghidra): add bounded PS-X EXE static analysis - PR #1942 [OPEN] — fix(verification): align Linux Hopper setup lane with current contracts - PR #1931 [MERGED] — perf(ghidra): compile bundle activator with bridge scripts - PR #1927 [MERGED] — fix(hopper): preserve observed process failures across requests - PR #1922 [OPEN] — feat(ghidra): verify and pin the 32-bit ARM (armhf) lane - PR #1918 [CLOSED] — test(contracts): audit static WASM and Harmony wording - PR #1917 [MERGED] — fix(test): audit static Wasm and Harmony tool wording - PR #1913 [MERGED] — feat(ghidra): apply validated analyzer overrides before analysis - PR #1910 [MERGED] — fix(mcp): provide native evidence paging continuation - PR #1906 [MERGED] — fix(ida): preserve non-x86 call edges and workflow uncertainty - PR #1900 [MERGED] — test(native): skip the inaccessible-directory diagnostic as root - PR #1898 [OPEN] — feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language - PR #1889 [OPEN] — fix(artifacts): identify WebAssembly module targets at native admission - PR #1885 [MERGED] — fix(test): wait for Hopper reconnect listener readiness - PR #1877 [MERGED] — fix(ghidra): report progress while startup is pending - PR #1872 [MERGED] — feat(target): explain static WASM inspection after native rejection - PR #1870 [OPEN] — docs(installation): document building the macOS Ghidra native decompiler - PR #1868 [MERGED] — feat(native): admit raw binaries with caller-supplied architecture and entry - PR #1866 [MERGED] — fix(hopper): wait for late bridges during cleanup - PR #1863 [MERGED] — fix(windows): bring the real Windows Ghidra verifiers up to date - PR #1845 [OPEN] — fix(ida): retain private input after ambiguous open - PR #1841 [OPEN] — fix(ida): let one-shot commands exit after retaining cleanup - PR #1826 [MERGED] — fix(windows): retain failed native inspection ownership - PR #1817 [MERGED] — fix(hopper): preserve startup failures and recover denied launches - PR #1800 [OPEN] — feat(ghidra): disable named auto-analyzers via REA_GHIDRA_DISABLED_ANALYZERS - PR #1785 [MERGED] — fix(ida): report a procedure IDA cannot resolve as invalid input - PR #1778 [MERGED] — fix(ida): wait out a transient busy worker health in headless sessions - PR #1764 [MERGED] — fix(ida): declare GUI navigation for attached legacy analysis - PR #1763 [MERGED] — fix(hopper): let failed one-shot commands exit while retaining a lease - PR #1747 [OPEN] — feat(ghidra): admit 32-bit big-endian PowerPC ELF - PR #1715 [MERGED] — feat(native): expose typed incoming references at exact addresses - PR #1713 [MERGED] — fix(native): retain failed command cleanup owners - PR #1709 [OPEN] — fix(native): honor Mach-O chained pointer locations and library ordinals - PR #1708 [MERGED] — fix(native): retain failed pwntools process and runtime cleanup - PR #1703 [MERGED] — fix(native): raise default PE resource entry budget to 16384 - PR #1698 [MERGED] — fix(ghidra): keep JVM warnings out of LaunchSupport output - PR #1689 [MERGED] — docs(website): add beginner help to the native analysis guide - PR #1678 [MERGED] — fix(native): bound PE resource RVAs by section virtual size - PR #1677 [CLOSED] — fix(native): report missing and non-file PE resource targets as input errors - PR #1672 [OPEN] — feat(ghidra): surface instruction-backed prototype conflicts - PR #1667 [MERGED] — feat(ghidra): configurable import language and analysis seeds - PR #1666 [CLOSED] — fix(ghidra): recover returning import callers - PR #1663 [CLOSED] — fix(ghidra): disclose that string search covers only defined strings - PR #1660 [MERGED] — ci: scope provider and native verification by changed inputs - PR #1652 [CLOSED] — fix(ghidra): reject occupied compact address names - PR #1646 [MERGED] — fix(tests): verify Qwen skills through an isolated native home - PR #1643 [CLOSED] — test(hopper): recognize signal-terminated diagnostic fixtures - PR #1640 [MERGED] — fix(test): preserve Ghidra interior-label controls on Mach-O - PR #1638 [MERGED] — fix(tests): bind HOME in native client and deepseek verifiers - PR #1635 [MERGED] — feat(ghidra): admit set_address_name and set_addresses_names - PR #1629 [MERGED] — fix(ghidra): admit carved MIPS ELF with incomplete section tables - PR #1599 [MERGED] — feat(ghidra): admit bounded PSP ELF through installed Allegrex - PR #1592 [MERGED] — feat(ghidra): recover signed AArch64 relative jump tables - PR #1584 [MERGED] — test(native): skip the DMG EACCES diagnostic as root - PR #1570 [MERGED] — feat(native): return a retained summary view of binary layouts on request - PR #1550 [MERGED] — test(ghidra): preserve Node heap options in adapter verification - PR #1544 [MERGED] — feat(ida): support optional native IDA Free MCP in attached mode - PR #1533 [MERGED] — feat(wasm): inspect local artifacts with WABT - PR #1531 [MERGED] — fix(windows): load native controls in Node-API hosts not named node.exe - PR #1507 [MERGED] — fix(native): page every retained function dossier collection - PR #1482 [MERGED] — feat(artifacts): inspect PE resource identities and payload ranges - PR #1481 [MERGED] — fix(ida): canonicalize the headless workspace root before opening - PR #1467 [CLOSED] — Feat/ghidra existing project - PR #1438 [MERGED] — fix(native): preserve compact reference provenance - PR #1436 [MERGED] — test(native): verify macOS provenance through real CLI and MCP - PR #1430 [MERGED] — perf(native): record macOS command provenance once in its Evidence - PR #1426 [MERGED] — fix(hopper): treat a directory launcher path as missing - PR #1420 [MERGED] — docs: correct stale logging, Ghidra host, and example path statements - PR #1419 [MERGED] — fix(ghidra): clear wrong no-return flags before serving a session - PR #1418 [CLOSED] — fix(cli): describe native command options accurately in help - PR #1405 [MERGED] — perf(hopper): stop repeating Hopper replies as raw_result - PR #1404 [MERGED] — perf(native): record pwntools diagnostics once in their Evidence - PR #1394 [MERGED] — test(native): skip the EACCES directory diagnostic as root - PR #1382 [MERGED] — fix(ghidra): keep the cross-format branch callee multi-block - PR #1374 [MERGED] — fix(ghidra): verify dense jump tables on an optimized fixture - PR #1362 [MERGED] — feat(native): admit bounded MIPS ELF analysis through Ghidra - PR #1359 [MERGED] — feat: add Frida instrumentation support - PR #1355 [CLOSED] — docs: clarify README setup command, mention IDA, and update Node badge - PR #1348 [MERGED] — docs: explain CI scope and native runner reuse - PR #1345 [MERGED] — feat(native): inspect oversized retained function dossiers via bounded views - PR #1344 [MERGED] — fix(ci): scope verification and reuse native runners - PR #1342 [CLOSED] — feat(ghidra): admit native x86 and x86-64 PE DLLs on Windows - PR #1325 [MERGED] — fix(native): refuse to list architectures of non-Mach-O targets - PR #1309 [CLOSED] — fix(comparison): keep Ghidra generated function names ambiguous - PR #1306 [CLOSED] — fix(apple): recognize legacy simulator Mach-O platforms - PR #1303 [MERGED] — feat(ghidra): support native PE DLLs on Windows - PR #1300 [MERGED] — test(apple): verify compiled Mach-O root occurrence facts - PR #1298 [MERGED] — test(artifacts): pin per-occurrence roles for direct Mach-O roots and shared bytes - PR #1297 [MERGED] — fix(ghidra): use dot-free private session paths - PR #1289 [MERGED] — fix(ghidra): stop dereferencing the removed error payload in address verification - PR #1285 [MERGED] — fix(hopper): probe interior navigation from multi-byte instructions - PR #1281 [MERGED] — fix(ci): pass selected environment to Windows Ghidra fixture - PR #1280 [MERGED] — fix(ghidra): reject a native decompiler built for another host - PR #1279 [CLOSED] — feat: add analysis tool integrations - PR #1278 [MERGED] — docs(ghidra): explain supported heap and CPU controls - PR #1275 [MERGED] — fix(hopper): allow restart after verified owned-provider shutdown - PR #1270 [MERGED] — fix(native): distinguish batch selectors from resolved entries - PR #1268 [MERGED] — fix(ghidra): preserve decoded return flow evidence - PR #1258 [MERGED] — fix(native): name the plist selection that works when Info.plist is missing - PR #1229 [MERGED] — perf(hopper): resolve string search records once per query - PR #1222 [MERGED] — fix(ghidra): do not run Java from a relative JAVA_HOME in doctor and setup - PR #1209 [MERGED] — fix(cli): resolve xrefs symbol selectors after address validation - PR #1208 [MERGED] — fix(ghidra): classify modern Swift manglings in swift type analysis - PR #1206 [CLOSED] — fix(cli): advertise an address, not a symbol name, on the xrefs selector - PR #1201 [MERGED] — fix(ghidra): keep and name a runtime directory that close could not remove - PR #1200 [MERGED] — fix(ghidra): reject relative installation and Java paths in doctor and setup - PR #1198 [MERGED] — fix(ghidra): report NativeAOT host and target refusals as unsupported, not failures - PR #1196 [MERGED] — fix(native): refuse truncated executable headers at target admission - PR #1195 [MERGED] — fix(ghidra): resolve secondary symbols at function entries - PR #1182 [MERGED] — fix(doctor): find the Homebrew Hopper cask without writing Homebrew caches - PR #1176 [MERGED] — fix(session): require an open target for session-bound native and artifact tools - PR #1158 [MERGED] — fix(hopper): reserve Linux demo application before launch - PR #1119 [MERGED] — fix(hopper): enforce caller-supplied request deadlines - PR #1118 [MERGED] — fix(hopper): preserve owned basic-block endpoint instructions - PR #1111 [MERGED] — fix(hopper): verify lease cleanup and repair the macOS test lane - PR #1107 [MERGED] — ci: run signature target binding regressions on native macOS - PR #1105 [MERGED] — fix(hopper): report launcher failures before bridge timeout - PR #1099 [MERGED] — fix(native): bind signature observations to registered target versions - PR #1084 [MERGED] — fix(native): keep signature failure evidence instead of collapsing it - PR #1069 [MERGED] — test(artifacts): verify native directory identity on supported Windows runtimes - PR #1054 [MERGED] — feat(native): inspect recorded crashes through pwntools and pwndbg - PR #1049 [MERGED] — fix(domain): preserve prototype-named JSON members through Evidence boundaries - PR #1044 [MERGED] — fix(hopper): diagnose MCP provider failures with stage, state, and request context - PR #1037 [MERGED] — feat(native): inspect offline ELF layout through pwntools - PR #1030 [MERGED] — feat(ghidra): support native x86 PE applications on Windows - PR #1016 [MERGED] — fix(ci): avoid slow Azure archive for the native cross compiler - PR #1015 [CLOSED] — docs(ghidra): explain Windows P0 rejections for 32-bit x86 PE targets - PR #991 [MERGED] — fix(native)!: preserve incomplete native UI captures - PR #974 [MERGED] — feat(ghidra): make the startup deadline configurable - PR #973 [MERGED] — refactor(native): group analyst semantics workflows and contracts - PR #963 [MERGED] — fix(linux): improve Hopper reliability and CachyOS support - PR #950 [MERGED] — fix(ida): share concurrent session cleanup - PR #944 [MERGED] — fix(native-ui): handle incomplete accessibility child collections - PR #935 [MERGED] — ci: consolidate macOS native baseline checks - PR #934 [CLOSED] — feat(native): report code-signing posture in inspect_signature - PR #927 [MERGED] — feat(artifacts): trace Mach-O dylib resolution in bundles - PR #917 [MERGED] — feat(browser): attribute native execution and listener sources - PR #910 [MERGED] — feat(native): open iOS-style and iOS-on-Mac wrapper app bundles - PR #898 [MERGED] — ci: verify native arm64 and Intel macOS workflows - PR #880 [MERGED] — fix(native): keep echoed Mach-O paths out of load commands and symbols - PR #875 [MERGED] — fix(native): report why a selected plist cannot be inspected - PR #865 [MERGED] — fix(native): keep echoed codesign paths out of signature fields - PR #860 [MERGED] — fix(native): keep integral plist reals beyond the JSON range as reals - PR #856 [MERGED] — refactor(ghidra): extract createClient and load-image attestation - PR #855 [MERGED] — refactor(native): split Apple dispatch metadata decode facets - PR #854 [MERGED] — fix: preserve native UI failure reasons and dedupe version literals - PR #846 [MERGED] — fix(native): report exact plist integers beyond the JSON number range - PR #841 [MERGED] — fix(native): inspect plists containing data, dates, and non-finite reals - PR #840 [MERGED] — fix(ghidra): admit the 12.1 line and the install's JDK range - PR #815 [MERGED] — fix: integrate 24 reviewed browser/native/semantics corrections - PR #812 [CLOSED] — fix(native): project Mach-O evidence into container file offsets - PR #807 [CLOSED] — fix(native): retain nm-proven literal export names - PR #804 [CLOSED] — fix(native): recognize only whole otool command headers - PR #803 [CLOSED] — fix(native): preserve exact code signing identifiers - PR #800 [MERGED] — fix(ghidra): select exact packaged bridge scripts - PR #782 [CLOSED] — fix: recover serialized native NIB view hierarchy - PR #777 [MERGED] — fix(cli): align structured output guard with native flags - PR #773 [MERGED] — fix(cli): honor the selected native plist path - PR #767 [CLOSED] — fix(native): preserve app bundle executable filename whitespace - PR #762 [CLOSED] — fix(native): preserve thin architectures across echoed filename lines - PR #759 [CLOSED] — fix(ghidra): reject contradictory NativeAOT reports - PR #754 [MERGED] — feat(ida): add read-only GUI and headless MCP providers - PR #748 [MERGED] — feat(ghidra): integrate optional NativeAOT metadata recovery - PR #739 [MERGED] — fix(hopper): retain shutdown request diagnostics - PR #736 [MERGED] — docs(ghidra): explain first-query deadlines and recovery - PR #730 [CLOSED] — docs(hopper): validate realpath fallback wording - PR #713 [MERGED] — fix(ghidra): refuse ambiguous universal Mach-O imports - PR #711 [MERGED] — docs(hopper): document HopperTargetLease realpath fallback - PR #709 [MERGED] — feat(ghidra): add atomic function annotation edits - PR #704 [MERGED] — fix(native): select concrete arm64e Mach-O slices - PR #702 [MERGED] — feat(ghidra): admit explicit DOS COM analysis - PR #701 [MERGED] — fix(native): inspect mixed-signature Mach-O slices - PR #699 [MERGED] — feat(ghidra): enable Windows x64 read-only analysis - PR #697 [MERGED] — feat(ghidra): verify DOS load images and expose memory evidence - PR #690 [CLOSED] — fix(native): preserve numeric-looking Mach-O identifiers - PR #685 [CLOSED] — fix(dotnet): preserve C identifier underscores in native matching - PR #681 [CLOSED] — fix(native): preserve final demangled symbol whitespace - PR #679 [CLOSED] — fix(artifacts): align native DMG mount and detach lifecycle - PR #669 [MERGED] — fix(native): retain spaced symbols in dyld inventory - PR #662 [MERGED] — test(hopper): synchronize startup cancellation with launcher readiness - PR #647 [MERGED] — fix(ghidra): preserve request and shutdown failure diagnostics - PR #632 [MERGED] — refactor(native): extract FAT header format switch in Mach-O slice selection - PR #618 [CLOSED] — fix(native): decode little-endian fat headers as universal binaries - PR #608 [MERGED] — fix(native): reject signal-terminated command captures - PR #601 [MERGED] — fix(native): inspect the selected universal Mach-O architecture - PR #596 [MERGED] — fix(comparison): match generated names without swallowing symbol prefixes - PR #590 [MERGED] — fix(native): inspect Apple dispatch metadata in FAT64 binaries - PR #586 [MERGED] — fix(native): decode Mach protection bits in their proper positions - PR #584 [MERGED] — fix(package): separate agent and Hopper setup support - PR #579 [MERGED] — fix(ghidra): recover evidenced switch cases and default targets - PR #556 [MERGED] — feat(ghidra): add DOS MZ analysis and complete function extents - PR #540 [MERGED] — fix(replay): keep __proto__ own properties and reject symbol-keyed results - PR #534 [MERGED] — fix(native): match compound otool keys exactly and badge unknown thread entrypoints - PR #533 [MERGED] — fix(native): normalize otool line endings and strip plist JSON BOM - PR #532 [MERGED] — fix(native): retain lazy dylibs, normalize version-min builds, limit thread entrypoints - PR #531 [MERGED] — fix(native): reject trailing text in lipo integers and keep multi-word otool keys - PR #525 [MERGED] — fix(native): capture Mach-O header metadata alongside load commands - PR #520 [MERGED] — fix(native): preserve text-valued load command metadata - PR #516 [MERGED] — fix(native): retain re-exported Mach-O library dependencies - PR #503 [MERGED] — fix: correct native inventories and bridge error classification - PR #500 [MERGED] — feat(native): add inspection primitives, dispatch traces and approved UI observation - PR #486 [MERGED] — feat(native): add investigation features - PR #429 [MERGED] — fix(hopper): add bounded analysis recovery - PR #410 [MERGED] — fix(process): protect unrelated Hopper during cleanup - PR #286 [MERGED] — test(ci): guard Windows Ghidra workflow isolation - PR #284 [MERGED] — feat(ghidra): add experimental Windows x64 P0 support - PR #247 [MERGED] — feat(ghidra): add function analysis and conformance - PR #246 [MERGED] — feat(ghidra): implement read-only inventory operations - PR #245 [MERGED] — feat(ghidra): add private headless provider session - PR #227 [MERGED] — fix(hopper): cancel startup before closing - PR #223 [MERGED] — fix(doctor): honor explicit Hopper launcher - PR #213 [MERGED] — fix(hopper): select verified Linux demo mode explicitly - PR #207 [MERGED] — fix(native): harden command capture edge cases - PR #127 [MERGED] — docs: add Hopper screenshot to README - PR #116 [MERGED] — fix(hopper): complete owned Linux shutdown - PR #110 [MERGED] — fix(linux): start Hopper demo sessions headlessly - PR #109 [MERGED] — feat(analysis): persist snapshots and close Hopper reliably - PR #95 [MERGED] — feat!: add evidence-safe process capture v4 and native DMG traversal </details> Scope note: dedicated commercial-protection recovery request #2080 and the separately scoped iOS runtime PR #2264 are not accepted language/debugger coverage in this tracker. Their existence does not approve those workflows.
bsakaguchi commented 2026-10-15 18:28:32 +00:00
Author
Owner
Copy link

@matbrgz commented on GitHub (Oct 14, 2026):

Cross-Language Audit Update: Recent Runtime, Bytecode & Decompiler Issues (October 14, 2026)

Following up on the baseline language coverage audit, this update indexes newly filed issues across target runtimes, decompiler bridges, and debug metadata pipelines to cross-reference with the TIOBE language lanes:

1. Java / JVM / Android (#4, #32, #40)

  • #3517 — JADX "Java heap space" load failure points to rea doctor, which reports healthy
  • #3488 — inspect_android_method returns neighbouring members as the "complete" body of a native method
  • #3443 — inspect_android_method reports an inlined Java method as "native/abstract" with no body
  • #3368 — Package inspection rounds distinct Android version codes to the same value
  • #1558 — Java reverse engineering and bytecode analysis tracking

2. JavaScript / TypeScript & Web Runtimes (#6, #38)

  • #3535 — Electron reached through esbuild's __require shim is invisible (0 windows / 0 IPC on esbuild-bundled main processes)
  • #3474 — capture_electron_scenario active hook does not block or record shell.trashItem
  • #3473 — electronActiveHook test fails when ancestor directory contains an electron package due to CJS resolution precedence over NODE_PATH
  • #3453 — capture_electron_scenario waits for full 60 s startup deadline when target's EnableNodeCliInspectArguments fuse is disabled
  • #3452 — capture_electron_scenario does not block app.moveToApplicationsFolder
  • #3414 — Owned Electron capture drops the selected X11 authorization path
  • #3400 — Overflowing JavaScript timer delays abort application analysis
  • #3382 — Electron script frame attribution and identity change after context destruction
  • #3350 — Harmony projection omits JavaScript runtime hints for supported source extensions

3. C# / Visual Basic & .NET CLR (#5, #7, TIOBE 51–100 C++/CLI)

  • #3364 — Truncated managed metadata diagnostics report stream offsets as file offsets
  • #3352 — Managed graph projection rejects inspector Evidence with an empty module name
  • #3348 — Managed member comparison reports changed method headers as unchanged
  • #3199 — Managed member comparison remaps methods with unequal constants at high confidence
  • #3366 — Native-boundary summary reports false for mixed-mode assemblies
  • #3351 — Managed/native verification contradicts Windows module paths on macOS
  • #2299 — Return optional decompiler output alongside bytecode

4. Objective-C & Swift (#14, #25)

  • #3345 — Incomplete Objective-C property attributes produce established atomic and read-write flags
  • #3343 — UI action traces omit known Objective-C handlers for non-controller receivers
  • #3336 — Malformed Objective-C property records discard valid sibling metadata

5. Dart & Flutter (#27)

  • #3346 — Dart AOT inspection reports complete coverage for conflicting section-backed tables

6. Go & Rust (#10, #11)

  • #3398 — An unrelated .go.buildinfo section blocks Rust dependency inspection
  • #3397 — Unnamed ELF read-only sections lose embedded Rust compiler-path evidence
  • #2297 — Recover function signatures from Go pclntab

7. Delphi / Object Pascal (#19)

  • #2926 — Delphi/Borland SEH handler blocks are cut from Ghidra function bodies without notice (addressed in PR #3029)

8. Native Bridges, Decompilation & Assembly (#2, #3, #23)

  • #3509 — Open target lost after MCP transport failure; Ghidra analyses longer than the client's idle timeout can never complete (stdio)
  • #3204 — Ghidra instruction incoming references include synthetic entry-point metadata
  • #3032 — macOS: closing a large Ghidra session reports cleanup_incomplete (sysctl_errno_22) while the JVM is mid-exit
  • #3415 — Real MIPS verifier oracle omits parsed GNU attribute absence

Note: Consolidated subsystem bug tracking is maintained in #3537.

<!-- gh-comment-id:6171831718 --> @matbrgz commented on GitHub (Oct 14, 2026): ## Cross-Language Audit Update: Recent Runtime, Bytecode & Decompiler Issues (October 14, 2026) Following up on the baseline language coverage audit, this update indexes newly filed issues across target runtimes, decompiler bridges, and debug metadata pipelines to cross-reference with the TIOBE language lanes: ### 1. Java / JVM / Android (#4, #32, #40) - #3517 — JADX "Java heap space" load failure points to `rea doctor`, which reports healthy - #3488 — `inspect_android_method` returns neighbouring members as the "complete" body of a native method - #3443 — `inspect_android_method` reports an inlined Java method as "native/abstract" with no body - #3368 — Package inspection rounds distinct Android version codes to the same value - #1558 — Java reverse engineering and bytecode analysis tracking ### 2. JavaScript / TypeScript & Web Runtimes (#6, #38) - #3535 — Electron reached through esbuild's `__require` shim is invisible (0 windows / 0 IPC on esbuild-bundled main processes) - #3474 — `capture_electron_scenario` active hook does not block or record `shell.trashItem` - #3473 — `electronActiveHook` test fails when ancestor directory contains an electron package due to CJS resolution precedence over `NODE_PATH` - #3453 — `capture_electron_scenario` waits for full 60 s startup deadline when target's `EnableNodeCliInspectArguments` fuse is disabled - #3452 — `capture_electron_scenario` does not block `app.moveToApplicationsFolder` - #3414 — Owned Electron capture drops the selected X11 authorization path - #3400 — Overflowing JavaScript timer delays abort application analysis - #3382 — Electron script frame attribution and identity change after context destruction - #3350 — Harmony projection omits JavaScript runtime hints for supported source extensions ### 3. C# / Visual Basic & .NET CLR (#5, #7, TIOBE 51–100 C++/CLI) - #3364 — Truncated managed metadata diagnostics report stream offsets as file offsets - #3352 — Managed graph projection rejects inspector Evidence with an empty module name - #3348 — Managed member comparison reports changed method headers as unchanged - #3199 — Managed member comparison remaps methods with unequal constants at high confidence - #3366 — Native-boundary summary reports false for mixed-mode assemblies - #3351 — Managed/native verification contradicts Windows module paths on macOS - #2299 — Return optional decompiler output alongside bytecode ### 4. Objective-C & Swift (#14, #25) - #3345 — Incomplete Objective-C property attributes produce established atomic and read-write flags - #3343 — UI action traces omit known Objective-C handlers for non-controller receivers - #3336 — Malformed Objective-C property records discard valid sibling metadata ### 5. Dart & Flutter (#27) - #3346 — Dart AOT inspection reports complete coverage for conflicting section-backed tables ### 6. Go & Rust (#10, #11) - #3398 — An unrelated `.go.buildinfo` section blocks Rust dependency inspection - #3397 — Unnamed ELF read-only sections lose embedded Rust compiler-path evidence - #2297 — Recover function signatures from Go pclntab ### 7. Delphi / Object Pascal (#19) - #2926 — Delphi/Borland SEH handler blocks are cut from Ghidra function bodies without notice (addressed in PR #3029) ### 8. Native Bridges, Decompilation & Assembly (#2, #3, #23) - #3509 — Open target lost after MCP transport failure; Ghidra analyses longer than the client's idle timeout can never complete (stdio) - #3204 — Ghidra instruction incoming references include synthetic entry-point metadata - #3032 — macOS: closing a large Ghidra session reports `cleanup_incomplete` (`sysctl_errno_22`) while the JVM is mid-exit - #3415 — Real MIPS verifier oracle omits parsed GNU attribute absence *Note: Consolidated subsystem bug tracking is maintained in #3537.*
bsakaguchi commented 2026-10-31 00:29:41 +00:00
Author
Owner
Copy link

@CassieFox23 commented on GitHub (Oct 18, 2026):

TL;DR: Here's every open tracker in the repo, so people can hop between them.

Thanks, matbrgz, for keeping this one.

Related trackers

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates

  • #3537: Open bugs, by subsystem (matbrgz)
  • #4330: Duplicate issues, in clusters (matbrgz)

Features and roadmap

  • #3796: Feature requests, by area (CassieFox23)
  • #2383: Support for the top 100 languages (matbrgz)
  • #2357: Static file and crash report work (matbrgz)
  • #3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
  • #4027: Browser, Electron and JS work (N0zoM1z0)
  • #32: The main roadmap (morluto)
  • #48: The Evidence v2 epic (morluto)
  • #2039: The roadmap in plain words, a discussion (CassieFox23)

Docs

  • #3795: Open docs issues and PRs (CassieFox23)

Pull requests

  • #3582: Open PRs whose fix is already on main (CassieFox23)

Show and tell

  • #1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

<!-- gh-comment-id:6245954607 --> @CassieFox23 commented on GitHub (Oct 18, 2026): **TL;DR:** Here's every open tracker in the repo, so people can hop between them. Thanks, matbrgz, for keeping this one. ### Related trackers Every open tracker in the repo, so you can get to any of them from here. **Bugs and duplicates** - #3537: Open bugs, by subsystem (matbrgz) - #4330: Duplicate issues, in clusters (matbrgz) **Features and roadmap** - #3796: Feature requests, by area (CassieFox23) - #2383: Support for the top 100 languages (matbrgz) - #2357: Static file and crash report work (matbrgz) - #3714 to #3719: six RFC epics on formats and bytecode (matbrgz) - #4027: Browser, Electron and JS work (N0zoM1z0) - #32: The main roadmap (morluto) - #48: The Evidence v2 epic (morluto) - #2039: The roadmap in plain words, a discussion (CassieFox23) **Docs** - #3795: Open docs issues and PRs (CassieFox23) **Pull requests** - #3582: Open PRs whose fix is already on main (CassieFox23) **Show and tell** - #1435: Linux setup notes and test queue, a discussion (CassieFox23) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#794
No description provided.