From 49887f0239da4483153a5e1610058619855525db Mon Sep 17 00:00:00 2001 From: N0zoM1z0 <1705004398@qq.com> Date: Wed, 7 Oct 2026 16:36:24 +0000 Subject: [PATCH 1/3] fix(release): publish from explicit source checkpoints Dispatch preparation and publication against a frozen release branch. Bind package builds and provenance to the same tagged commit, enable release-branch PR CI, and document the maintainer workflow. Assisted-by: Sakuya (gensokyo-skills:sakuya-checkpointed-execution) --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 68 +++++- CONTRIBUTING.md | 38 +--- docs/.vitepress/config.ts | 1 + docs/releasing.md | 107 ++++++++++ .../filesystem/releaseWorkflow.test.ts | 194 ++++++++++++++++++ 6 files changed, 377 insertions(+), 33 deletions(-) create mode 100644 docs/releasing.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 740e7f2a5..98d548440 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,7 +4,7 @@ on: push: branches: [main] pull_request: - branches: [main] + branches: [main, "release/*"] concurrency: group: ci-${{ github.event.pull_request.number || github.ref }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5995f4c7e..f5c9635b3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,14 +1,24 @@ name: Release on: - push: - branches: [main] + workflow_dispatch: + inputs: + release_branch: + description: Frozen release branch (release/VERSION) + required: true + type: string + phase: + description: Prepare the release PR, or publish its reviewed merge + required: true + default: prepare + type: choice + options: [prepare, publish] env: HUSKY: "0" concurrency: - group: release-${{ github.ref }} + group: release-${{ inputs.release_branch }} cancel-in-progress: false jobs: @@ -21,13 +31,60 @@ jobs: outputs: release_created: ${{ steps.release.outputs.release_created }} tag_name: ${{ steps.release.outputs.tag_name }} + sha: ${{ steps.release.outputs.sha }} steps: + - name: Validate release selection + shell: bash + env: + GH_TOKEN: ${{ github.token }} + RELEASE_BRANCH: ${{ inputs.release_branch }} + RELEASE_PHASE: ${{ inputs.phase }} + run: | + if [[ "${RELEASE_PHASE}" == prepare && "${GITHUB_REF}" != "refs/heads/main" ]]; then + echo "Run prepare from main; release_branch selects the frozen source." >&2 + exit 1 + fi + if [[ "${RELEASE_PHASE}" == publish && "${GITHUB_REF}" != "refs/heads/${RELEASE_BRANCH}" ]]; then + echo "Run publish from the selected frozen release branch so npm provenance records its source." >&2 + exit 1 + fi + if [[ "${RELEASE_BRANCH}" != release/* ]]; then + echo "release_branch must select a release/ branch; main is not a release checkpoint." >&2 + exit 1 + fi + if ! git check-ref-format "refs/heads/${RELEASE_BRANCH}"; then + echo "Invalid release_branch: ${RELEASE_BRANCH}" >&2 + exit 1 + fi + gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${RELEASE_BRANCH}" \ + --jq '.object.sha' + - uses: googleapis/release-please-action@v4 id: release with: # A dedicated credential lets release-PR updates trigger CI. GitHub # requires manual approval for pull_request events from GITHUB_TOKEN. token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} + target-branch: ${{ inputs.release_branch }} + skip-github-release: ${{ inputs.phase == 'prepare' }} + skip-github-pull-request: ${{ inputs.phase == 'publish' }} + + - name: Require a merged release PR for publication + if: inputs.phase == 'publish' && steps.release.outputs.release_created != 'true' + run: | + echo "No new release was created. Merge the reviewed release PR into its frozen branch before publishing. For a partial publication, re-run failed jobs in the original run." >&2 + exit 1 + + - name: Bind publication to the dispatched checkpoint + if: inputs.phase == 'publish' && steps.release.outputs.release_created == 'true' + shell: bash + env: + RELEASE_SHA: ${{ steps.release.outputs.sha }} + run: | + if [[ "${RELEASE_SHA}" != "${GITHUB_SHA}" ]]; then + echo "The tagged release SHA differs from the dispatched checkpoint; refusing to publish mismatched source provenance." >&2 + exit 1 + fi - name: Check out release pull request if: steps.release.outputs.prs_created == 'true' @@ -99,6 +156,9 @@ jobs: id-token: write steps: - uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.sha }} + persist-credentials: false - uses: actions/setup-node@v6 with: @@ -164,7 +224,7 @@ jobs: steps: - uses: actions/checkout@v6 with: - ref: ${{ needs.release-please.outputs.tag_name }} + ref: ${{ needs.release-please.outputs.sha }} persist-credentials: false - name: Verify package and registry metadata versions diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 488f5ab04..70713b30a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -120,32 +120,14 @@ Describe the behavior change and verification performed in the pull request. Nev ## Maintainer release checklist -Run `npm run check:pr`, the isolated package verifier, package dry run, and two-target real-Hopper verifier described above. Build a local tarball and exercise the executable through the package boundary: +Use the [checkpoint release guide](docs/releasing.md). Releases start from an +explicit `release/VERSION` branch cut at a recorded commit. Manually prepare +the bot PR, wait for its exact-head CI and review, merge into that frozen +branch, and manually publish through the official Release workflow. Main +pushes do not update release PRs or publish packages. Both publishers build +the exact SHA tagged by Release Please. -```bash -npm pack -``` - -Use the exact filename printed by `npm pack` to run the packaged executable: - -```bash -npm exec --yes --package ./rea-agents-VERSION.tgz -- rea --help -``` - -Replace `VERSION` with the packed version; do not use a tarball from an earlier -build. - -Publish the public package: - -```bash -npm publish --access public -``` - -After npm registry propagation, verify the published CLI and connect the client SDK version pinned in `package.json` to the published server to confirm the canonical tool catalog: - -```bash -npx -y rea-agents@latest --help -npx -y rea-agents@latest doctor -npx -y rea-agents@latest setup --yes --all-detected -npx -y rea-agents@latest mcp -``` +Keep new implementation commits on main for the next release. The workflow +owns packaged-artifact verification, npm publication, the published CLI/MCP +canary, and MCP Registry publication. Sync release metadata back to main after +publication; see the guide for partial-publication recovery and verification. diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts index 8d25bfc85..0e36c4ad8 100644 --- a/docs/.vitepress/config.ts +++ b/docs/.vitepress/config.ts @@ -64,6 +64,7 @@ export default defineConfig({ { text: "MCP contracts", link: "/mcp-contracts" }, { text: "Tool design", link: "/tool-design" }, { text: "Testing", link: "/testing" }, + { text: "Releasing", link: "/releasing" }, { text: "Architecture decisions", link: "/adr/README" }, ], }, diff --git a/docs/releasing.md b/docs/releasing.md new file mode 100644 index 000000000..9db7918ba --- /dev/null +++ b/docs/releasing.md @@ -0,0 +1,107 @@ +# Releasing from a checkpoint + +REA releases use an explicit source checkpoint. Main can continue accepting +changes while a release is tested and published. The Release workflow runs +only when a maintainer dispatches it; main pushes do not refresh release PRs. + +## 1. Select the source + +Choose the next version from the unreleased Conventional Commits, including +breaking changes. Record the full source SHA and create `release/VERSION` at +that commit. The version is a maintainer choice; Release Please's proposed +version must agree before publication. + +For example, after selecting a reviewed commit for 5.0.0: + +```bash +git fetch origin main +git branch release/5.0.0 SOURCE_SHA +git push origin release/5.0.0 +``` + +Replace `SOURCE_SHA` with the selected full commit SHA. The checkpoint must +include this release workflow and CI support for release branches. For an +older checkpoint, backport only the release infrastructure first and record +that additional commit. Do not merge later implementation changes into the +release branch or rebase the candidate onto a moving main. + +## 2. Prepare the bot PR + +Run the workflow definition from main and select the frozen source separately: + +```bash +gh workflow run release.yml --ref main \ + -f release_branch=release/5.0.0 -f phase=prepare +``` + +Release Please targets that branch and prepares its version, changelog, and +registry metadata. The existing generation step normalizes the product +catalog. Preparation cannot create a GitHub release or publish a package. +Record the final bot PR head after normalization. Approve GitHub-blocked bot +workflow runs for that head when needed. + +Review the candidate's version, notes, generated metadata, and package +contents. Wait for the candidate's CI and relevant real-provider checks. +Routine local iterations need focused checks; CI owns full deterministic +coverage and platform lanes. If an artifact or real-provider check is +unavailable, report that limit before deciding to publish. + +Merge the reviewed PR into `release/5.0.0` with its head SHA matched. Further +main commits do not change this candidate. A necessary release fix belongs +on the release branch, must be reviewed and tested, and establishes a new +recorded checkpoint. + +## 3. Publish the reviewed merge + +After the release PR has merged: + +```bash +gh workflow run release.yml --ref release/5.0.0 \ + -f release_branch=release/5.0.0 -f phase=publish +``` + +Publication creates the release from the merged bot PR without preparing or +updating another PR. Both npm and MCP Registry jobs check out Release Please's +exact release SHA. They do not build the current main tip or a mutable branch. +The publish dispatch runs from the frozen release branch so npm's provenance +records the actual release commit. The workflow rejects a mismatch between +the tagged release SHA and the dispatch SHA before either registry publish. +See [npm's provenance implementation](https://github.com/npm/cli/blob/v11.16.0/workspaces/libnpmpublish/lib/provenance.js) +for the use of GitHub's workflow ref and commit SHA. + +The workflow builds the bundled Windows controls and verifies the packaged +artifact before npm publication. It then verifies the published CLI, the +capability-scoped MCP catalog, and the isolated package update path before +publishing MCP Registry metadata. + +Record these outcomes separately: + +- GitHub release and tag, including the resolved commit SHA. +- npm's exact version and integrity, with the published-package canary passed. +- MCP Registry's exact server version and matching npm package version. + +A GitHub tag alone does not establish npm or MCP Registry publication. + +## 4. Sync metadata back to main + +After publication, open a PR from the release branch back to main. Preserve +main's later implementation changes and resolve generated-file conflicts by +regenerating from the combined contracts with the released package version. +Review and test this synchronization PR, then use a merge commit so the release +tag remains in main's ancestry. Keep the released tag unchanged. + +Close any superseded rolling release PR. Future releases repeat the checkpoint +procedure from main; never resume automatic release-PR refreshes on main pushes. + +## Partial publication and retries + +Inspect the failed job and public registry state before retrying. When npm is +already published, the npm job verifies that exact version instead of +publishing it again. Re-run failed jobs in the original publication run so its +release SHA and outputs stay fixed. If only MCP publication failed, retry that +job after checking that the npm canary succeeded. + +Do not dispatch a fresh publish phase to repair an already-created release: +Release Please will not create the same release again. Do not move the tag, +delete the release, or unpublish npm as a retry. A defective public package +requires a reviewed correction and a new version. diff --git a/tests/boundary/filesystem/releaseWorkflow.test.ts b/tests/boundary/filesystem/releaseWorkflow.test.ts index e7a0c0935..58163cb23 100644 --- a/tests/boundary/filesystem/releaseWorkflow.test.ts +++ b/tests/boundary/filesystem/releaseWorkflow.test.ts @@ -1,8 +1,202 @@ +import { execFile } from "node:child_process"; import { readFile } from "node:fs/promises"; +import { promisify } from "node:util"; import { expect, it } from "vitest"; import { parse } from "yaml"; import { z } from "zod"; +const execFileAsync = promisify(execFile); +const stepSchema = z.object({ + name: z.string().optional(), + uses: z.string().optional(), + run: z.string().optional(), + with: z.record(z.string(), z.unknown()).optional(), +}); +const jobSchema = z.object({ + outputs: z.record(z.string(), z.string()).optional(), + steps: z.array(stepSchema), +}); + +async function readReleaseWorkflow() { + return z + .object({ + on: z.record(z.string(), z.unknown()), + jobs: z.object({ + "release-please": jobSchema, + publish: jobSchema, + "publish-mcp": jobSchema, + }), + }) + .parse( + parse( + await readFile( + new URL("../../../.github/workflows/release.yml", import.meta.url), + "utf8", + ), + ), + ); +} + +it("requires explicit release preparation or publication instead of main pushes", async () => { + const workflow = await readReleaseWorkflow(); + expect(Object.keys(workflow.on)).toEqual(["workflow_dispatch"]); + expect(workflow.on.workflow_dispatch).toMatchObject({ + inputs: { + release_branch: { required: true, type: "string" }, + phase: { + required: true, + type: "choice", + default: "prepare", + options: ["prepare", "publish"], + }, + }, + }); + const release = workflow.jobs["release-please"].steps.find((step) => + step.uses?.startsWith("googleapis/release-please-action@"), + ); + expect(release?.with).toMatchObject({ + "target-branch": "${{ inputs.release_branch }}", + "skip-github-release": "${{ inputs.phase == 'prepare' }}", + "skip-github-pull-request": "${{ inputs.phase == 'publish' }}", + }); +}); + +it("binds npm and MCP publication to the same immutable release SHA", async () => { + const workflow = await readReleaseWorkflow(); + expect(workflow.jobs["release-please"].outputs?.sha).toBe( + "${{ steps.release.outputs.sha }}", + ); + for (const job of [workflow.jobs.publish, workflow.jobs["publish-mcp"]]) { + const checkout = job.steps.find((step) => + step.uses?.startsWith("actions/checkout@"), + ); + expect(checkout?.with).toMatchObject({ + ref: "${{ needs.release-please.outputs.sha }}", + "persist-credentials": false, + }); + } +}); + +it + .skipIf(process.platform === "win32") + .each(["main", "feature/new-work", "release/", "release/../main"])( + "rejects %s as a checkpoint before contacting GitHub", + async (releaseBranch) => { + const workflow = await readReleaseWorkflow(); + const command = z + .string() + .parse( + workflow.jobs["release-please"].steps.find( + (step) => step.name === "Validate release selection", + )?.run, + ); + await expect( + execFileAsync("bash", ["-e", "-o", "pipefail", "-c", command], { + env: { + ...process.env, + GITHUB_REF: "refs/heads/main", + RELEASE_BRANCH: releaseBranch, + RELEASE_PHASE: "prepare", + }, + }), + ).rejects.toMatchObject({ + code: 1, + stderr: expect.stringMatching(/release_branch/u), + }); + }, +); + +it.skipIf(process.platform === "win32").each([ + { phase: "prepare", ref: "refs/heads/feature/unreviewed-workflow" }, + { phase: "publish", ref: "refs/heads/main" }, + { phase: "publish", ref: "refs/heads/release/another-version" }, +])( + "rejects $phase from $ref before contacting GitHub", + async ({ phase, ref }) => { + const workflow = await readReleaseWorkflow(); + const command = z + .string() + .parse( + workflow.jobs["release-please"].steps.find( + (step) => step.name === "Validate release selection", + )?.run, + ); + await expect( + execFileAsync("bash", ["-e", "-o", "pipefail", "-c", command], { + env: { + ...process.env, + GITHUB_REF: ref, + RELEASE_BRANCH: "release/5.0.0", + RELEASE_PHASE: phase, + }, + }), + ).rejects.toMatchObject({ + code: 1, + stderr: expect.stringContaining(`Run ${phase} from`), + }); + }, +); + +it.skipIf(process.platform === "win32").each([true, false])( + "publishes only when the tag and provenance source match (match: %s)", + async (match) => { + const workflow = await readReleaseWorkflow(); + const command = z + .string() + .parse( + workflow.jobs["release-please"].steps.find( + (step) => + step.name === "Bind publication to the dispatched checkpoint", + )?.run, + ); + const result = execFileAsync( + "bash", + ["-e", "-o", "pipefail", "-c", command], + { + env: { + ...process.env, + GITHUB_SHA: "1111111111111111111111111111111111111111", + RELEASE_SHA: match + ? "1111111111111111111111111111111111111111" + : "2222222222222222222222222222222222222222", + }, + }, + ); + if (match) { + await expect(result).resolves.toMatchObject({ stderr: "" }); + } else { + await expect(result).rejects.toMatchObject({ + code: 1, + stderr: expect.stringContaining( + "refusing to publish mismatched source provenance", + ), + }); + } + }, +); + +it("runs release PR CI without enabling implementation pushes on release branches", async () => { + const workflow = z + .object({ + on: z.object({ + push: z.object({ branches: z.array(z.string()) }), + pull_request: z.object({ branches: z.array(z.string()) }), + }), + }) + .parse( + parse( + await readFile( + new URL("../../../.github/workflows/ci.yml", import.meta.url), + "utf8", + ), + ), + ); + expect(workflow.on.push.branches).toEqual(["main"]); + expect(workflow.on.pull_request.branches).toEqual( + expect.arrayContaining(["main", "release/*"]), + ); +}); + // Publishing is irreversible. Keep the release authority invariant as a static // boundary check; it is not proof that package installation or publishing works. it("requires package verification before publishing and retains the registry canary", async () => { From fc58fa1eb01fe5a8200a78e9551799c9c1a3d256 Mon Sep 17 00:00:00 2001 From: N0zoM1z0 <1705004398@qq.com> Date: Wed, 7 Oct 2026 17:01:04 +0000 Subject: [PATCH 2/3] fix(release): drive checkpoint releases from frozen branches Use branch pushes for Release Please preparation and reviewed-merge publication. Reject moved source refs before tagging and bind registry provenance to the triggering release commit. Remove phase inputs and document the three steps. Assisted-by: Sakuya (gensokyo-skills:sakuya-checkpointed-execution) Assisted-by: Cirno (gensokyo-skills:cirno-radical-simplification) --- .github/workflows/release.yml | 56 +++------ CONTRIBUTING.md | 6 +- docs/releasing.md | 70 ++++++------ .../filesystem/releaseWorkflow.test.ts | 106 ++++++++++++------ 4 files changed, 127 insertions(+), 111 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5c9635b3..73d0cd748 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,24 +1,15 @@ name: Release on: + push: + branches: ["release/*"] workflow_dispatch: - inputs: - release_branch: - description: Frozen release branch (release/VERSION) - required: true - type: string - phase: - description: Prepare the release PR, or publish its reviewed merge - required: true - default: prepare - type: choice - options: [prepare, publish] env: HUSKY: "0" concurrency: - group: release-${{ inputs.release_branch }} + group: release-${{ github.ref }} cancel-in-progress: false jobs: @@ -37,27 +28,22 @@ jobs: shell: bash env: GH_TOKEN: ${{ github.token }} - RELEASE_BRANCH: ${{ inputs.release_branch }} - RELEASE_PHASE: ${{ inputs.phase }} + RELEASE_BRANCH: ${{ github.ref_name }} run: | - if [[ "${RELEASE_PHASE}" == prepare && "${GITHUB_REF}" != "refs/heads/main" ]]; then - echo "Run prepare from main; release_branch selects the frozen source." >&2 - exit 1 - fi - if [[ "${RELEASE_PHASE}" == publish && "${GITHUB_REF}" != "refs/heads/${RELEASE_BRANCH}" ]]; then - echo "Run publish from the selected frozen release branch so npm provenance records its source." >&2 - exit 1 - fi - if [[ "${RELEASE_BRANCH}" != release/* ]]; then - echo "release_branch must select a release/ branch; main is not a release checkpoint." >&2 + if [[ "${GITHUB_REF}" != "refs/heads/${RELEASE_BRANCH}" || "${RELEASE_BRANCH}" != release/* ]]; then + echo "Select a release/ branch; main and tags are not release checkpoints." >&2 exit 1 fi if ! git check-ref-format "refs/heads/${RELEASE_BRANCH}"; then - echo "Invalid release_branch: ${RELEASE_BRANCH}" >&2 + echo "Invalid release branch: ${RELEASE_BRANCH}" >&2 exit 1 fi - gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${RELEASE_BRANCH}" \ - --jq '.object.sha' + selected_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${RELEASE_BRANCH}" --jq '.object.sha')" + if [[ "${selected_sha}" != "${GITHUB_SHA}" ]]; then + echo "The release branch moved after this run was triggered; review its new checkpoint before publication." >&2 + exit 1 + fi + printf 'Selected release checkpoint: %s\n' "${selected_sha}" - uses: googleapis/release-please-action@v4 id: release @@ -65,24 +51,16 @@ jobs: # A dedicated credential lets release-PR updates trigger CI. GitHub # requires manual approval for pull_request events from GITHUB_TOKEN. token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} - target-branch: ${{ inputs.release_branch }} - skip-github-release: ${{ inputs.phase == 'prepare' }} - skip-github-pull-request: ${{ inputs.phase == 'publish' }} + target-branch: ${{ github.ref_name }} - - name: Require a merged release PR for publication - if: inputs.phase == 'publish' && steps.release.outputs.release_created != 'true' - run: | - echo "No new release was created. Merge the reviewed release PR into its frozen branch before publishing. For a partial publication, re-run failed jobs in the original run." >&2 - exit 1 - - - name: Bind publication to the dispatched checkpoint - if: inputs.phase == 'publish' && steps.release.outputs.release_created == 'true' + - name: Bind publication to the triggering checkpoint + if: steps.release.outputs.release_created == 'true' shell: bash env: RELEASE_SHA: ${{ steps.release.outputs.sha }} run: | if [[ "${RELEASE_SHA}" != "${GITHUB_SHA}" ]]; then - echo "The tagged release SHA differs from the dispatched checkpoint; refusing to publish mismatched source provenance." >&2 + echo "The tagged release SHA differs from the triggering checkpoint; refusing to publish mismatched source provenance." >&2 exit 1 fi diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 70713b30a..796b7cf22 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -121,9 +121,9 @@ Describe the behavior change and verification performed in the pull request. Nev ## Maintainer release checklist Use the [checkpoint release guide](docs/releasing.md). Releases start from an -explicit `release/VERSION` branch cut at a recorded commit. Manually prepare -the bot PR, wait for its exact-head CI and review, merge into that frozen -branch, and manually publish through the official Release workflow. Main +explicit `release/VERSION` branch cut at a recorded commit. Pushing the branch prepares +the bot PR. Wait for its exact-head CI and review; merging into that frozen +branch triggers publication through the official Release workflow. Main pushes do not update release PRs or publish packages. Both publishers build the exact SHA tagged by Release Please. diff --git a/docs/releasing.md b/docs/releasing.md index 9db7918ba..fe453323c 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -1,10 +1,10 @@ # Releasing from a checkpoint -REA releases use an explicit source checkpoint. Main can continue accepting +REA releases use a frozen source checkpoint. Main can continue accepting changes while a release is tested and published. The Release workflow runs -only when a maintainer dispatches it; main pushes do not refresh release PRs. +on `release/*` branches; main pushes do not refresh release PRs. -## 1. Select the source +## 1. Cut the release branch Choose the next version from the unreleased Conventional Commits, including breaking changes. Record the full source SHA and create `release/VERSION` at @@ -25,47 +25,43 @@ older checkpoint, backport only the release infrastructure first and record that additional commit. Do not merge later implementation changes into the release branch or rebase the candidate onto a moving main. -## 2. Prepare the bot PR - -Run the workflow definition from main and select the frozen source separately: +The branch push runs Release Please against that branch and opens a PR for +the version, changelog, and registry metadata. The generation step normalizes +the product catalog. To retry preparation after a failed run, select the same +frozen branch explicitly: ```bash -gh workflow run release.yml --ref main \ - -f release_branch=release/5.0.0 -f phase=prepare +gh workflow run release.yml --ref release/5.0.0 ``` -Release Please targets that branch and prepares its version, changelog, and -registry metadata. The existing generation step normalizes the product -catalog. Preparation cannot create a GitHub release or publish a package. +## 2. Review and merge the bot PR + Record the final bot PR head after normalization. Approve GitHub-blocked bot -workflow runs for that head when needed. +workflow runs for that head when needed. Review the candidate's version, +notes, generated metadata, and package contents. Wait for the candidate's CI +and relevant real-provider checks. Routine local iterations need focused +checks; CI owns full deterministic coverage and platform lanes. If an artifact +or real-provider check is unavailable, report that limit before deciding to +publish. -Review the candidate's version, notes, generated metadata, and package -contents. Wait for the candidate's CI and relevant real-provider checks. -Routine local iterations need focused checks; CI owns full deterministic -coverage and platform lanes. If an artifact or real-provider check is -unavailable, report that limit before deciding to publish. +Merge the reviewed PR into `release/5.0.0` with its head SHA matched. **This +merge authorizes and triggers publication.** Further main commits do not change +this candidate. Do not push or merge anything else into the release branch +while publication is running. A necessary release fix must be reviewed and +tested before the bot PR merges and establishes a new recorded checkpoint. -Merge the reviewed PR into `release/5.0.0` with its head SHA matched. Further -main commits do not change this candidate. A necessary release fix belongs -on the release branch, must be reviewed and tested, and establishes a new -recorded checkpoint. +## 3. Verify publication -## 3. Publish the reviewed merge +The merge push runs Release Please again, creates the tag and GitHub release, +and publishes npm followed by MCP Registry metadata. Both publishers check +out Release Please's exact release SHA. The triggering workflow also runs +from that release commit so npm's provenance records the actual source. -After the release PR has merged: - -```bash -gh workflow run release.yml --ref release/5.0.0 \ - -f release_branch=release/5.0.0 -f phase=publish -``` - -Publication creates the release from the merged bot PR without preparing or -updating another PR. Both npm and MCP Registry jobs check out Release Please's -exact release SHA. They do not build the current main tip or a mutable branch. -The publish dispatch runs from the frozen release branch so npm's provenance -records the actual release commit. The workflow rejects a mismatch between -the tagged release SHA and the dispatch SHA before either registry publish. +Before invoking Release Please, the workflow checks that the release branch +still equals the triggering SHA and rejects main or tag refs. Before either +registry publish, it rejects a mismatch between the tagged release SHA and +the triggering SHA. These checks detect moved branches; maintainers must also +keep the release branch frozen throughout publication. See [npm's provenance implementation](https://github.com/npm/cli/blob/v11.16.0/workspaces/libnpmpublish/lib/provenance.js) for the use of GitHub's workflow ref and commit SHA. @@ -82,7 +78,7 @@ Record these outcomes separately: A GitHub tag alone does not establish npm or MCP Registry publication. -## 4. Sync metadata back to main +## Sync metadata back to main After publication, open a PR from the release branch back to main. Preserve main's later implementation changes and resolve generated-file conflicts by @@ -101,7 +97,7 @@ publishing it again. Re-run failed jobs in the original publication run so its release SHA and outputs stay fixed. If only MCP publication failed, retry that job after checking that the npm canary succeeded. -Do not dispatch a fresh publish phase to repair an already-created release: +Do not start a fresh workflow run to repair an already-created release: Release Please will not create the same release again. Do not move the tag, delete the release, or unpublish npm as a retry. A defective public package requires a reviewed correction and a new version. diff --git a/tests/boundary/filesystem/releaseWorkflow.test.ts b/tests/boundary/filesystem/releaseWorkflow.test.ts index 58163cb23..177514cef 100644 --- a/tests/boundary/filesystem/releaseWorkflow.test.ts +++ b/tests/boundary/filesystem/releaseWorkflow.test.ts @@ -1,10 +1,13 @@ import { execFile } from "node:child_process"; -import { readFile } from "node:fs/promises"; +import { readFile, writeFile } from "node:fs/promises"; +import { delimiter, join } from "node:path"; import { promisify } from "node:util"; import { expect, it } from "vitest"; import { parse } from "yaml"; import { z } from "zod"; +import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js"; + const execFileAsync = promisify(execFile); const stepSchema = z.object({ name: z.string().optional(), @@ -37,28 +40,17 @@ async function readReleaseWorkflow() { ); } -it("requires explicit release preparation or publication instead of main pushes", async () => { +it("prepares and publishes only from frozen release branches", async () => { const workflow = await readReleaseWorkflow(); - expect(Object.keys(workflow.on)).toEqual(["workflow_dispatch"]); - expect(workflow.on.workflow_dispatch).toMatchObject({ - inputs: { - release_branch: { required: true, type: "string" }, - phase: { - required: true, - type: "choice", - default: "prepare", - options: ["prepare", "publish"], - }, - }, - }); + expect(workflow.on.push).toEqual({ branches: ["release/*"] }); + expect(workflow.on).toHaveProperty("workflow_dispatch"); + expect(workflow.on.workflow_dispatch).toBeNull(); const release = workflow.jobs["release-please"].steps.find((step) => step.uses?.startsWith("googleapis/release-please-action@"), ); - expect(release?.with).toMatchObject({ - "target-branch": "${{ inputs.release_branch }}", - "skip-github-release": "${{ inputs.phase == 'prepare' }}", - "skip-github-pull-request": "${{ inputs.phase == 'publish' }}", - }); + expect(release?.with?.["target-branch"]).toBe("${{ github.ref_name }}"); + expect(release?.with).not.toHaveProperty("skip-github-release"); + expect(release?.with).not.toHaveProperty("skip-github-pull-request"); }); it("binds npm and MCP publication to the same immutable release SHA", async () => { @@ -94,25 +86,26 @@ it execFileAsync("bash", ["-e", "-o", "pipefail", "-c", command], { env: { ...process.env, - GITHUB_REF: "refs/heads/main", + GITHUB_REF: `refs/heads/${releaseBranch}`, RELEASE_BRANCH: releaseBranch, - RELEASE_PHASE: "prepare", }, }), ).rejects.toMatchObject({ code: 1, - stderr: expect.stringMatching(/release_branch/u), + stderr: expect.stringMatching(/release.*branch/u), }); }, ); -it.skipIf(process.platform === "win32").each([ - { phase: "prepare", ref: "refs/heads/feature/unreviewed-workflow" }, - { phase: "publish", ref: "refs/heads/main" }, - { phase: "publish", ref: "refs/heads/release/another-version" }, -])( - "rejects $phase from $ref before contacting GitHub", - async ({ phase, ref }) => { +it + .skipIf(process.platform === "win32") + .each([ + "refs/heads/main", + "refs/tags/release/5.0.0", + "refs/heads/release/another-version", + ])( + "rejects a ref that does not select the release branch: %s", + async (ref) => { const workflow = await readReleaseWorkflow(); const command = z .string() @@ -127,16 +120,65 @@ it.skipIf(process.platform === "win32").each([ ...process.env, GITHUB_REF: ref, RELEASE_BRANCH: "release/5.0.0", - RELEASE_PHASE: phase, }, }), ).rejects.toMatchObject({ code: 1, - stderr: expect.stringContaining(`Run ${phase} from`), + stderr: expect.stringContaining("Select a release/ branch"), }); }, ); +it.skipIf(process.platform === "win32").each([true, false])( + "checks the release branch still matches its triggering commit before tagging (match: %s)", + async (match) => { + const workflow = await readReleaseWorkflow(); + const command = z + .string() + .parse( + workflow.jobs["release-please"].steps.find( + (step) => step.name === "Validate release selection", + )?.run, + ); + const directory = await createTestTempDirectory("rea-release-selection-"); + await writeFile( + join(directory, "gh"), + '#!/bin/sh\nprintf "%s\\n" "$TEST_RELEASE_REF_SHA"\n', + { mode: 0o755 }, + ); + const result = execFileAsync( + "bash", + ["-e", "-o", "pipefail", "-c", command], + { + env: { + ...process.env, + PATH: `${directory}${delimiter}${process.env.PATH ?? ""}`, + GITHUB_REF: "refs/heads/release/5.0.0", + RELEASE_BRANCH: "release/5.0.0", + GITHUB_REPOSITORY: "fixture/fixture", + GITHUB_SHA: "1111111111111111111111111111111111111111", + TEST_RELEASE_REF_SHA: match + ? "1111111111111111111111111111111111111111" + : "2222222222222222222222222222222222222222", + }, + }, + ); + if (match) { + await expect(result).resolves.toMatchObject({ + stdout: expect.stringContaining("Selected release checkpoint:"), + stderr: "", + }); + } else { + await expect(result).rejects.toMatchObject({ + code: 1, + stderr: expect.stringContaining( + "release branch moved after this run was triggered", + ), + }); + } + }, +); + it.skipIf(process.platform === "win32").each([true, false])( "publishes only when the tag and provenance source match (match: %s)", async (match) => { @@ -146,7 +188,7 @@ it.skipIf(process.platform === "win32").each([true, false])( .parse( workflow.jobs["release-please"].steps.find( (step) => - step.name === "Bind publication to the dispatched checkpoint", + step.name === "Bind publication to the triggering checkpoint", )?.run, ); const result = execFileAsync( From b33236ec082ae3a59421232f9067c095283c3f6d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 01:26:36 +0800 Subject: [PATCH 3/3] chore(release/5.0.0): release rea-agents 5.0.0 (#1007) * chore(release/5.0.0): release rea-agents 5.0.0 * chore: normalize release product catalog --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .release-please-manifest.json | 2 +- CHANGELOG.md | 259 ++++++++++++++++++++++++++++++++ README.md | 2 +- README_ar.md | 2 +- README_ja.md | 2 +- README_ko.md | 2 +- README_zh.md | 2 +- docs/installation.md | 2 +- docs/product-catalog.json | 2 +- package-lock.json | 4 +- package.json | 2 +- server.json | 4 +- src/generatedPackageMetadata.ts | 2 +- 13 files changed, 273 insertions(+), 14 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 411256bca..32dbe0e2b 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "4.1.0" + ".": "5.0.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 8dc158cb7..c689b5c0c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,264 @@ # Changelog +## [5.0.0](https://github.com/morluto/rea/compare/rea-agents-4.1.0...rea-agents-5.0.0) (2026-10-07) + + +### ⚠ BREAKING CHANGES + +* **native:** preserve incomplete native UI captures ([#991](https://github.com/morluto/rea/issues/991)) +* **android:** Android analysis now requires a full JDK 17 or newer with its compiler module for the packaged Java source bridge. + +### Features + +* **apple:** project macOS bundle anatomy in application graphs ([88c940b](https://github.com/morluto/rea/commit/88c940b165d788a491e212ea93e00462c4dde6a2)) +* **apple:** project macOS bundle anatomy in application graphs ([dd3e7ae](https://github.com/morluto/rea/commit/dd3e7aef0d52c478f6cdf475501c42ebe7f5c97e)) +* **application:** wire Android and Apple inventory graph tools ([#852](https://github.com/morluto/rea/issues/852)) ([e0fd820](https://github.com/morluto/rea/commit/e0fd8207a1fb738bcc34f204b55c4fa154f5f02d)) +* **browser:** attribute native execution and listener sources ([#917](https://github.com/morluto/rea/issues/917)) ([b5afa5f](https://github.com/morluto/rea/commit/b5afa5f91eed9ae31d670aeab9bbf5112d790ec2)) +* **browser:** capture correlated network content and lifecycle evidence ([#797](https://github.com/morluto/rea/issues/797)) ([f9eaf05](https://github.com/morluto/rea/commit/f9eaf056ef58215094513176a70fabae0740081f)) +* **browser:** trace captured website module imports ([#879](https://github.com/morluto/rea/issues/879)) ([01be082](https://github.com/morluto/rea/commit/01be082e9e11c78b91828c06a9c543c754783c07)) +* **browser:** trace captured website source-map locations ([#897](https://github.com/morluto/rea/issues/897)) ([f430c41](https://github.com/morluto/rea/commit/f430c416c72d444fbe521e0263f8935da4cdb040)) +* **javascript:** recover readable modules with Wakaru ([#848](https://github.com/morluto/rea/issues/848)) ([166dcd2](https://github.com/morluto/rea/commit/166dcd21d06f687a9c480a6a6d36beb3b4954dd0)) +* **native:** decode chained fixups, binds, ObjC categories and properties ([a657557](https://github.com/morluto/rea/commit/a65755728f7a10d984514c75fa863b84ddcdaee9)) +* **native:** decode chained fixups, binds, ObjC categories and properties ([3e24a72](https://github.com/morluto/rea/commit/3e24a72465fe6c628db1f836e93d74d7f4a92b80)) +* **native:** open iOS-style and iOS-on-Mac wrapper app bundles ([2ed89e6](https://github.com/morluto/rea/commit/2ed89e6529924248d2e21084f8730bedbb16bc3f)) +* **native:** open iOS-style and iOS-on-Mac wrapper app bundles ([aeebba3](https://github.com/morluto/rea/commit/aeebba391ee5c288b75cd828e7d18d32b40aa698)) +* **web:** export captured scripts for JavaScript application analysis ([#801](https://github.com/morluto/rea/issues/801)) ([472b72a](https://github.com/morluto/rea/commit/472b72a53068a8e2ec78fe239d687023482daaa7)) +* **website:** add a shared back-to-top link ([5047373](https://github.com/morluto/rea/commit/504737300632d8644fbd6c658d2c97e38bb54c3b)) +* **website:** introduce REA and the DX-Ball reconstruction ([#906](https://github.com/morluto/rea/issues/906)) ([4e3953c](https://github.com/morluto/rea/commit/4e3953cc45ce9c21786a7a6fc495d2350aa85d24)) + + +### Bug Fixes + +* address review nits from batch integration follow-ups ([#818](https://github.com/morluto/rea/issues/818)) ([5a0e0ba](https://github.com/morluto/rea/commit/5a0e0ba3b81ea0ec336addb07da98ec7bc0a35d3)) +* **android:** align runtime suffix inference ([#977](https://github.com/morluto/rea/issues/977)) ([fb3749a](https://github.com/morluto/rea/commit/fb3749aff692a7a8225dff00a4516b48a76866b6)) +* **android:** bound fragmented JADX MCP frame memory ([#937](https://github.com/morluto/rea/issues/937)) ([9e39795](https://github.com/morluto/rea/commit/9e397958951edb543134e3ad57e7ab253d6df21a)) +* **android:** preserve JVM settings and reuse metadata sessions ([#908](https://github.com/morluto/rea/issues/908)) ([eab34a9](https://github.com/morluto/rea/commit/eab34a9d8c5eebad6b04b85750be0276d679c3f9)) +* **apple:** attribute only application-root components in macOS inventories ([5524970](https://github.com/morluto/rea/commit/55249704c5c83cbf8d20ac7869863cc196da00a6)) +* **apple:** count only real framework version directories ([2e81e86](https://github.com/morluto/rea/commit/2e81e867b24da8314f666f62d154de5803040cdf)) +* **apple:** pair bridge hypotheses within one application root ([7acf4e7](https://github.com/morluto/rea/commit/7acf4e741a6a314ea7aabb18fc757e196158ff76)) +* **apple:** pair bridge hypotheses within one application root ([9226ade](https://github.com/morluto/rea/commit/9226ade5114f287eb8e1b00b08dd91da1cc66003)) +* **apple:** traverse keyed archive hierarchy collections ([#976](https://github.com/morluto/rea/issues/976)) ([71ac83f](https://github.com/morluto/rea/commit/71ac83f3dd376135098f460c86e7897183456ec5)) +* **artifacts:** accept APFS image disks ejected with their container ([d93ebec](https://github.com/morluto/rea/commit/d93ebec9df951d40e66ced667f07fadd2dd5d25a)) +* **artifacts:** accept APFS image disks ejected with their container ([b72c079](https://github.com/morluto/rea/commit/b72c079a9a90c374bd6dd30ff8c4387306b8f59b)) +* **artifacts:** accept the bundle subject when extracting an app bundle ([#891](https://github.com/morluto/rea/issues/891)) ([37d2eba](https://github.com/morluto/rea/commit/37d2ebac4c2a524eec6e32c4c57cbbb632491ad8)) +* **artifacts:** decode flat keyed-archive NIBs with data and shared references ([b3f013f](https://github.com/morluto/rea/commit/b3f013fa183e8351319a053575aeee5df337c276)) +* **artifacts:** decode flat keyed-archive NIBs with data and shared references ([2a4667b](https://github.com/morluto/rea/commit/2a4667bb79117b202abb009c0bb9ebfdfde57158)) +* **artifacts:** harden reader lifecycle boundaries ([#951](https://github.com/morluto/rea/issues/951)) ([2366bda](https://github.com/morluto/rea/commit/2366bda37b1084016d42a0d06920dc57e7c7723f)) +* **artifacts:** keep the post-snapshot detach check out of provenance ([62634e4](https://github.com/morluto/rea/commit/62634e4c0177bde8a08decc356da98fbe25d2000)) +* **artifacts:** preserve reader failure diagnostics ([#987](https://github.com/morluto/rea/issues/987)) ([fc4a9a0](https://github.com/morluto/rea/commit/fc4a9a05922ce8474fd0717bc800343b0a95bd41)) +* **artifacts:** project compiled AppKit actions from the control to its target ([b08228d](https://github.com/morluto/rea/commit/b08228d19f8a0f6dbc940e8d322ef2bb42d2ce1a)) +* **artifacts:** project compiled AppKit actions from the control to its target ([#905](https://github.com/morluto/rea/issues/905)) ([900d7c8](https://github.com/morluto/rea/commit/900d7c8606cbc1ccbca818827a55bf2eab28bca4)) +* **artifacts:** project UIKit runtime outlet and event connections ([aa8082e](https://github.com/morluto/rea/commit/aa8082ea6c0898feb4d842135aea6b9539f769f8)) +* **artifacts:** project UIKit runtime outlet and event connections ([8b24387](https://github.com/morluto/rea/commit/8b243877c22a5550d005e7b8abf93791ce8566b9)) +* **artifacts:** read AppKit connectors from flat keyed-archive NIBs ([#900](https://github.com/morluto/rea/issues/900)) ([27c272b](https://github.com/morluto/rea/commit/27c272bd9a42e7235c7991881196c60dbc126714)) +* **artifacts:** read keyed archive dictionaries keyed UID as dictionaries ([cfd2b0c](https://github.com/morluto/rea/commit/cfd2b0c75dfb9d51b936788a46d0338145803ece)) +* **artifacts:** read keyed archive dictionaries keyed UID as dictionaries ([35c82b9](https://github.com/morluto/rea/commit/35c82b93eb2579687bb446c3a8a2a9f1a7563d28)) +* **artifacts:** report which path constraint failed ([#847](https://github.com/morluto/rea/issues/847)) ([3f1a77f](https://github.com/morluto/rea/commit/3f1a77f68ec4355d8b792ccb2970bc03485889c9)) +* **browser:** distinguish computed call keys from identifiers ([#808](https://github.com/morluto/rea/issues/808)) ([02beb74](https://github.com/morluto/rea/commit/02beb745358f02bdaabed4bb523c5e3527a9841e)) +* **browser:** distinguish WebMCP registration frame owners ([#813](https://github.com/morluto/rea/issues/813)) ([b3b44d8](https://github.com/morluto/rea/commit/b3b44d8a2d8b2aa70a8ed8b9cddf365865fcc53f)) +* **browser:** fingerprint cookies at the selected page URL ([#763](https://github.com/morluto/rea/issues/763)) ([78014e3](https://github.com/morluto/rea/commit/78014e3d149f762c848581a0aac7e44f75d51225)) +* **browser:** identify NodeNext TypeScript original source artifacts ([#811](https://github.com/morluto/rea/issues/811)) ([e84ad86](https://github.com/morluto/rea/commit/e84ad86a7578fb46568663aca6fe6a6f3986cc8d)) +* **browser:** preserve evidence through deep AST analysis ([#924](https://github.com/morluto/rea/issues/924)) ([f826aa8](https://github.com/morluto/rea/commit/f826aa893fa7d55e87d907f0c94c39421a166dd8)) +* **browser:** preserve form destinations and satisfies mutation uncertainty ([#825](https://github.com/morluto/rea/issues/825)) ([6dd719e](https://github.com/morluto/rea/commit/6dd719eaf605b37cd5dad6d01d33527ca9d59f06)), closes [#820](https://github.com/morluto/rea/issues/820) +* **browser:** preserve Link header value delimiters ([#805](https://github.com/morluto/rea/issues/805)) ([dd36405](https://github.com/morluto/rea/commit/dd3640548fe3d1e8b92784a63fac55d757dcc1f0)) +* **build:** validate installed dependencies before cache hits ([#982](https://github.com/morluto/rea/issues/982)) ([a45fe86](https://github.com/morluto/rea/commit/a45fe86a39b9e7a7c21e3665b6de4763cb72d782)) +* capture IndexedDB object-store record fingerprints ([#809](https://github.com/morluto/rea/issues/809)) ([21a8bd0](https://github.com/morluto/rea/commit/21a8bd0ccde2326c8bc022714a88a438d8b89dde)) +* **cli:** align structured output guard with native flags ([#777](https://github.com/morluto/rea/issues/777)) ([e9fac56](https://github.com/morluto/rea/commit/e9fac56232e74c8287863ca5c4cc7d8e39fb4a40)) +* **cli:** emit empty structured filter projections ([#914](https://github.com/morluto/rea/issues/914)) ([2db668f](https://github.com/morluto/rea/commit/2db668f6ca91d2514a354fd459239b84031812e7)) +* **cli:** honor the selected native plist path ([#773](https://github.com/morluto/rea/issues/773)) ([0374865](https://github.com/morluto/rea/commit/0374865836aa4960657fb92f588c71e35dd3bed8)) +* **cli:** preserve output and comparison input validation ([#981](https://github.com/morluto/rea/issues/981)) ([d5c43d6](https://github.com/morluto/rea/commit/d5c43d65f0f6a1de8fb2eb5f2c1940a6ea2af20c)) +* **cli:** preserve unsupported historical-source imports ([#795](https://github.com/morluto/rea/issues/795)) ([911d580](https://github.com/morluto/rea/commit/911d58063477912042da5e9e573a9e8008956622)) +* **contracts:** align CLI/MCP boundary contracts ([#946](https://github.com/morluto/rea/issues/946)) ([4a60738](https://github.com/morluto/rea/commit/4a6073810a955d058c10f209157cbd68832a92c5)) +* **deps:** remediate smol-toml advisories ([93091ab](https://github.com/morluto/rea/commit/93091abb4dbd3cceee217d179db816895df24d70)) +* **deps:** remediate smol-toml advisories ([c55ae3b](https://github.com/morluto/rea/commit/c55ae3b9eccc17e6e8f4369e13044995d0650704)) +* **dotnet:** compare members with undecoded signatures by exact identity ([28fd49f](https://github.com/morluto/rea/commit/28fd49f0f6cf54e373411f5999e6b5722dd826f5)) +* **dotnet:** compare members with undecoded signatures by exact identity ([d52af3b](https://github.com/morluto/rea/commit/d52af3b321a321964598fb302edeb26552c9dffd)) +* **dotnet:** inspect native boundaries of non-managed and malformed PEs ([d5f28fb](https://github.com/morluto/rea/commit/d5f28fb29c5c3e8acef940fcae042e660e3a4d72)) +* **dotnet:** inspect native boundaries of non-managed and malformed PEs ([d98dcfa](https://github.com/morluto/rea/commit/d98dcfa8c2e46a7cc918aeb01058c26c4a84060c)) +* **dotnet:** keep a decoded member unknown beside an undecoded counterpart ([76b7020](https://github.com/morluto/rea/commit/76b70203d941ab85c1772f330407fd832d438c9c)) +* **dotnet:** keep admitted CLI header facts when metadata is unreadable ([e5ba693](https://github.com/morluto/rea/commit/e5ba6934e4ff819c09077ca70bd2417d37f85bc0)) +* **dotnet:** name the shared key in exact-signature ambiguities ([7714e76](https://github.com/morluto/rea/commit/7714e763d9ac2e87994068b3dee37ca6c5ffc6f4)) +* **dotnet:** treat ambiguous undecoded members as possible counterparts ([73370e1](https://github.com/morluto/rea/commit/73370e1c064899753988581c9a821e0e7f579561)) +* **errors:** report union input issues at the union's path ([bddeb63](https://github.com/morluto/rea/commit/bddeb634b583cf4f7d5fa6cf3a1ee821e05d2923)) +* **evaluation:** canonicalize Unicode argument keys ([#980](https://github.com/morluto/rea/issues/980)) ([0a4caf4](https://github.com/morluto/rea/commit/0a4caf4a0a1355b6a121fc88886b22e55843ac76)) +* **firmware:** accept the verified Binwalk and Unblob release lines ([#844](https://github.com/morluto/rea/issues/844)) ([bef4321](https://github.com/morluto/rea/commit/bef4321afb3d0d480e8a04ad7e256663542caa3d)) +* **firmware:** retain multi-file extraction failures ([#978](https://github.com/morluto/rea/issues/978)) ([8aaf9a1](https://github.com/morluto/rea/commit/8aaf9a19788beb6612332505850ad3407cb00027)) +* **ghidra:** admit the 12.1 line and the install's JDK range ([#840](https://github.com/morluto/rea/issues/840)) ([5cbf06c](https://github.com/morluto/rea/commit/5cbf06c7ad0ace599721bffd7da566b8a790b622)) +* **ghidra:** select exact packaged bridge scripts ([#800](https://github.com/morluto/rea/issues/800)) ([894c30e](https://github.com/morluto/rea/commit/894c30ef02d946f0c8de3ae6c9168d9525d95033)) +* **ida:** share concurrent session cleanup ([#950](https://github.com/morluto/rea/issues/950)) ([f14b6a8](https://github.com/morluto/rea/commit/f14b6a84306116716e78c5ffc84353ac07939593)) +* **installer:** validate exact semantic versions ([#954](https://github.com/morluto/rea/issues/954)) ([248972f](https://github.com/morluto/rea/commit/248972f327776687037dc07099117584c0674e77)) +* integrate 24 reviewed browser/native/semantics corrections ([#815](https://github.com/morluto/rea/issues/815)) ([3af3811](https://github.com/morluto/rea/commit/3af3811ab0a212b6aab6185628d47ecad37958fc)) +* **javascript:** advertise the exact empty seed rule and match empty API keys ([35e5508](https://github.com/morluto/rea/commit/35e5508fd095a062d7477bd6bb7d2d8e28201cd8)) +* **javascript:** analyze source maps with empty source names ([58ef8ac](https://github.com/morluto/rea/commit/58ef8ac3aa803d7b64dd12a5b2a2e8ec24261060)) +* **javascript:** analyze sources containing empty string literals ([e7cbfe0](https://github.com/morluto/rea/commit/e7cbfe04fdfd7affe50dba9e2c7a9a0a72291041)) +* **javascript:** analyze sources containing empty string literals ([11fc3b9](https://github.com/morluto/rea/commit/11fc3b981509e8107b10b2e75363f5bb489879db)) +* **javascript:** filter keyed-collection receivers only for get/delete ([00f707b](https://github.com/morluto/rea/commit/00f707b250451246d69a1205c39c6843fab6bb5b)) +* **javascript:** handle deep AST traversal and addition without stack overflow ([#915](https://github.com/morluto/rea/issues/915)) ([62b3711](https://github.com/morluto/rea/commit/62b37111e7f09887eb712c6e8e721e0334cf10b9)) +* **javascript:** handle deep static member paths ([#939](https://github.com/morluto/rea/issues/939)) ([348c65c](https://github.com/morluto/rea/commit/348c65c7ece1aee280f9431d995996b444e7549d)) +* **javascript:** keep bare relative URLs for computed-method XHR ([e32028d](https://github.com/morluto/rea/commit/e32028d1b566872ba8cd08fc6800c198d6aef30b)) +* **javascript:** keep computed-method XHR request URLs ([602d002](https://github.com/morluto/rea/commit/602d0021d45a6cdab9f806554f3ee12ea670ec97)) +* **javascript:** keep exact empty env keys and method names ([522c2d0](https://github.com/morluto/rea/commit/522c2d0ecb1eb7be262eaef2926cceac9a68badc)) +* **javascript:** keep exact empty env keys and method names ([f7954a8](https://github.com/morluto/rea/commit/f7954a8fd692f262ef3ce1507b957681150ce9c4)), closes [#783](https://github.com/morluto/rea/issues/783) +* **javascript:** keep exact empty require paths and request fields ([ad1f6b5](https://github.com/morluto/rea/commit/ad1f6b508fbdd44d8bf1884ed96ae69082808e7d)), closes [#783](https://github.com/morluto/rea/issues/783) +* **javascript:** keep exact empty values in graph identities ([f608127](https://github.com/morluto/rea/commit/f608127635ed8e0d105ad95252e5ea0dff899f5b)) +* **javascript:** keep exact empty values in graph identities ([63012ee](https://github.com/morluto/rea/commit/63012eeb601fc74ca82f3a027d852a5da1b099d2)) +* **javascript:** keep keyed-collection reads out of endpoints ([9075ce7](https://github.com/morluto/rea/commit/9075ce71ada4334407aa2d194dc82e3031e30260)) +* **javascript:** keep keyed-collection reads out of endpoints ([eb68761](https://github.com/morluto/rea/commit/eb68761eb0a35b876e33dd6115d0d07f97e99dd5)) +* **javascript:** keep literal HTTP methods on storage-named receivers ([9f48a76](https://github.com/morluto/rea/commit/9f48a76e1186cc43c6928eff1c82e93280caee1a)) +* **javascript:** keep literal-method and URL-literal requests on aliased receivers ([e3e7664](https://github.com/morluto/rea/commit/e3e76646657e950e24241ba715eb97ea385933e9)) +* **javascript:** keep mutated object initializer values unknown ([#752](https://github.com/morluto/rea/issues/752)) ([6caa38a](https://github.com/morluto/rea/commit/6caa38a0cad369ddff52b08f8d7d44c1b92ecac0)) +* **javascript:** keep storage open versions out of XHR endpoints ([4f51103](https://github.com/morluto/rea/commit/4f5110306d9edab94bf63bf81cf259324d96af57)) +* **javascript:** keep storage open versions out of XHR endpoints ([898b0f6](https://github.com/morluto/rea/commit/898b0f62d76ea1cf793140cb255cad16ab85b44d)) +* **javascript:** keep XHR and client endpoints that receiver spellings hid ([05f43ed](https://github.com/morluto/rea/commit/05f43ed388ae4e9316d320b592b6eba5b119ce89)) +* **javascript:** leave empty application values unlabeled ([527b76e](https://github.com/morluto/rea/commit/527b76ef78e84d29bb41bd45f1f83fae05ca66ca)) +* **javascript:** match exact empty literal channels and seeds ([e20da1f](https://github.com/morluto/rea/commit/e20da1f205b105b1b6a5decd3c2d0fe36fd12410)) +* **javascript:** never read window or document open as XHR ([ae849a7](https://github.com/morluto/rea/commit/ae849a72811857ba9755962ec48a1d76c9d1181a)) +* **javascript:** preserve computed Electron member uncertainty ([3a4a63f](https://github.com/morluto/rea/commit/3a4a63f70a2e42fb1fa48881e08b08d612289f2e)) +* **javascript:** preserve computed Electron member uncertainty ([1260cac](https://github.com/morluto/rea/commit/1260cacc67b8e0c93fb9434452053feca956e7e7)) +* **javascript:** project decoded file URL paths ([#810](https://github.com/morluto/rea/issues/810)) ([2572e1e](https://github.com/morluto/rea/commit/2572e1eb2f853a4cebfc8303d9e293e1d106d608)) +* **javascript:** read open() endpoints only from XHR method/URL pairs ([63e0822](https://github.com/morluto/rea/commit/63e0822cc794bd6ec1688340b3230ffb6b5c4a8c)) +* **javascript:** read open() endpoints only from XHR method/URL pairs ([1be3705](https://github.com/morluto/rea/commit/1be370543f7ea39016f86ebdec80a8ceaf7f8a28)) +* **javascript:** read substitution-free templates as exact strings ([c371d6e](https://github.com/morluto/rea/commit/c371d6e1e9cceb28e6cfc874e14c4e740bb87751)) +* **javascript:** read substitution-free templates as exact strings ([77cf757](https://github.com/morluto/rea/commit/77cf75710369acc6c304ec352ab25aa7274e04b1)) +* **javascript:** resolve bare source-map and worker URLs next to the script ([#890](https://github.com/morluto/rea/issues/890)) ([45fcd28](https://github.com/morluto/rea/commit/45fcd28b4018723bdb508a9229b74ab9eb749f75)) +* **javascript:** retain recovered call argument positions ([#929](https://github.com/morluto/rea/issues/929)) ([e6ba9c3](https://github.com/morluto/rea/commit/e6ba9c3af3053485f154825eea6a156127328be9)) +* **linux:** improve Hopper reliability and CachyOS support ([#963](https://github.com/morluto/rea/issues/963)) ([98b2b02](https://github.com/morluto/rea/commit/98b2b027afd8c80b68e9daaf97bdaa4d942105cc)) +* **mcp:** advertise reserved process environment key ([#949](https://github.com/morluto/rea/issues/949)) ([e0d76ae](https://github.com/morluto/rea/commit/e0d76ae80ddc70ae4d5afcbd1427afb81eee3669)) +* **mcp:** isolate optional observation adapter failures ([#838](https://github.com/morluto/rea/issues/838)) ([be3cfbf](https://github.com/morluto/rea/commit/be3cfbffdfbbb65da75dcec0518e2ebf387e66bc)) +* **mcp:** preserve exact guided prompt context ([#761](https://github.com/morluto/rea/issues/761)) ([66c26f2](https://github.com/morluto/rea/commit/66c26f280b1d494806ee182b52564166760f0ae2)) +* **native-ui:** handle incomplete accessibility child collections ([#944](https://github.com/morluto/rea/issues/944)) ([ac3bae3](https://github.com/morluto/rea/commit/ac3bae3cb97c4fb622eb1b6ac1f3b84e6a70ba03)) +* **native:** inspect plists containing data, dates, and non-finite reals ([bc2cd8b](https://github.com/morluto/rea/commit/bc2cd8b874e115eee446860043758a80bd583ad0)) +* **native:** inspect plists containing data, dates, and non-finite reals ([5ead2cf](https://github.com/morluto/rea/commit/5ead2cfbc47896b43502363d3568330f5d94762e)) +* **native:** keep echoed codesign paths out of signature fields ([#865](https://github.com/morluto/rea/issues/865)) ([4aa2b60](https://github.com/morluto/rea/commit/4aa2b60c1d84607a138395ae93260b2e50c2a721)) +* **native:** keep echoed Mach-O paths out of load commands and symbols ([ab985c6](https://github.com/morluto/rea/commit/ab985c6a10e9da856ed151100cee8459793c3573)) +* **native:** keep echoed Mach-O paths out of load commands and symbols ([37fe105](https://github.com/morluto/rea/commit/37fe105ba168488d05226f2912bed802e2d48d75)) +* **native:** keep integral plist reals beyond the JSON range as reals ([#860](https://github.com/morluto/rea/issues/860)) ([3b92a2b](https://github.com/morluto/rea/commit/3b92a2bceddaa1659654da08160813a3affbc6b7)) +* **native:** keep plist XML element types for large numbers ([f85056d](https://github.com/morluto/rea/commit/f85056d83e42a461c8c947792774580294d0ceb9)) +* **native:** keep the resolved bundle plist and permission failures ([418a556](https://github.com/morluto/rea/commit/418a5562f6f640503c751924a4787586c2c5c98a)) +* **native:** pass Swift symbols to swift-demangle as operands ([dd90965](https://github.com/morluto/rea/commit/dd90965058a9e6f7dd7f30eb7e462572e777db7f)) +* **native:** pass Swift symbols to swift-demangle as operands ([6c88094](https://github.com/morluto/rea/commit/6c88094da45258b346fe594764e561f999622a58)) +* **native:** preserve incomplete native UI captures ([#991](https://github.com/morluto/rea/issues/991)) ([9f496ef](https://github.com/morluto/rea/commit/9f496ef2d4a3aa68816287bf5d2ba1620d72c97a)) +* **native:** report exact plist integers beyond the JSON number range ([c9f49db](https://github.com/morluto/rea/commit/c9f49db907db0513ad8b22c9b2bbdcee400aff11)) +* **native:** report exact plist integers beyond the JSON number range ([430c297](https://github.com/morluto/rea/commit/430c297ca4ddb3491c2b835b889486e6a2ffdc17)) +* **native:** report plist permission denials as access failures ([5738a0c](https://github.com/morluto/rea/commit/5738a0cf8c111833847fecb2f7d0c2ee35eabbd6)) +* **native:** report why a selected plist cannot be inspected ([14f9b3d](https://github.com/morluto/rea/commit/14f9b3d93119a60a3cf5f3d9c138ca829a5462e8)) +* **native:** report why a selected plist cannot be inspected ([0674fac](https://github.com/morluto/rea/commit/0674facd468c3321584ece908031feee7220b9c6)) +* **plist:** keep character references beyond Unicode literal ([5afd8a8](https://github.com/morluto/rea/commit/5afd8a850b2ebd62e3400a5e2ece1a1cfa98bab6)) +* **plist:** read XML plists containing a __proto__ key ([faaee69](https://github.com/morluto/rea/commit/faaee693d5bb4bb957387ebd0f4338513c4c914a)) +* **plist:** read XML plists containing a __proto__ key ([a08be51](https://github.com/morluto/rea/commit/a08be51e9f0d23bd46b66bbdb88dbda44bc54c88)) +* **plist:** report omitted __proto__ entries in signatures and Interface Builder ([15ab5db](https://github.com/morluto/rea/commit/15ab5dbcaf3fac09756e98926373965247dad622)) +* **plist:** report omitted __proto__ entries in signatures and Interface Builder ([6729ee7](https://github.com/morluto/rea/commit/6729ee7636889a0a2ebc9fca8e35860476f8ca34)) +* preserve native UI failure reasons and dedupe version literals ([#854](https://github.com/morluto/rea/issues/854)) ([2d4a910](https://github.com/morluto/rea/commit/2d4a910fcd30e8d5b96fcb957b931e9aa3e4ab0c)) +* **process:** clarify Windows capture support and recovery ([#798](https://github.com/morluto/rea/issues/798)) ([50787b2](https://github.com/morluto/rea/commit/50787b2faf1a4bea799d041960ca2b91199ef403)) +* **process:** harden filesystem snapshot identity and cancellation ([#956](https://github.com/morluto/rea/issues/956)) ([93aa9eb](https://github.com/morluto/rea/commit/93aa9eb5c2551984182a4025d836e4223e8ecc8a)) +* **process:** retain provider output until streams close ([#928](https://github.com/morluto/rea/issues/928)) ([b929251](https://github.com/morluto/rea/commit/b9292516f4eedc2dedba713abf57f665ef1fb596)) +* **reference:** retain partial imports for unreadable directories ([#766](https://github.com/morluto/rea/issues/766)) ([cffc548](https://github.com/morluto/rea/commit/cffc548cd3127c5db811f20db4816039846b3170)) +* **release:** drive checkpoint releases from frozen branches ([fc58fa1](https://github.com/morluto/rea/commit/fc58fa1eb01fe5a8200a78e9551799c9c1a3d256)) +* **release:** publish from explicit source checkpoints ([49887f0](https://github.com/morluto/rea/commit/49887f0239da4483153a5e1610058619855525db)) +* **semantics:** isolate named function expression bindings ([#776](https://github.com/morluto/rea/issues/776)) ([ae81f64](https://github.com/morluto/rea/commit/ae81f64d2ad10e5cdbf8356819351c02480aee7a)) +* **semantics:** preserve direct promise ownership boundaries ([#758](https://github.com/morluto/rea/issues/758)) ([e1ca412](https://github.com/morluto/rea/commit/e1ca412757bb01be855a66bf72006e3becd497b6)) +* **semantics:** preserve empty string property keys ([#764](https://github.com/morluto/rea/issues/764)) ([630bdaf](https://github.com/morluto/rea/commit/630bdafcacc621105f6a43ed68a6e51651aca629)) +* **semantics:** recognize Node builtin default namespaces ([#769](https://github.com/morluto/rea/issues/769)) ([24a0bf9](https://github.com/morluto/rea/commit/24a0bf9a618604e2fa30817d673ce911c7842819)) +* **semantics:** retain trailing rest argument flows ([#756](https://github.com/morluto/rea/issues/756)) ([4bfd803](https://github.com/morluto/rea/commit/4bfd8038be0a60c43a452bec15e23799a0b040c0)) +* **setup:** accept the pinned Hopper RPM launcher ([#933](https://github.com/morluto/rea/issues/933)) ([dda8e6a](https://github.com/morluto/rea/commit/dda8e6a72890f87bdf8bbd3250b68b6648aae553)) +* **setup:** read an OpenCode V2 server named type as a table entry ([#866](https://github.com/morluto/rea/issues/866)) ([4e17be5](https://github.com/morluto/rea/commit/4e17be57053fb0ce2561d92e05b6e38ef789b2d4)) +* **setup:** register OpenCode V2 configurations in mcp.servers ([957069d](https://github.com/morluto/rea/commit/957069d14d832ddeac3f90dd141d379b81e2832a)) +* **setup:** register OpenCode V2 configurations in mcp.servers ([69d8afe](https://github.com/morluto/rea/commit/69d8afefc19e014a4bba7a182983a9e77e100a75)) +* **target:** decode app Info.plist executables with an XML parser ([c57f1b7](https://github.com/morluto/rea/commit/c57f1b74e0af5cf5fbb459cb247e1448cbf8df1b)) +* **target:** decode app Info.plist executables with an XML parser ([c182f72](https://github.com/morluto/rea/commit/c182f72ad3d9eea10b084a43527acb7c8ca2d6bf)) +* **test:** disconnect Hopper fixture IPC on SIGTERM ([b912b11](https://github.com/morluto/rea/commit/b912b117f019d5d3e4b4e3ef683e9b25f3a709bc)) +* **windows:** accept ordinary drive path separators ([#791](https://github.com/morluto/rea/issues/791)) ([b62931f](https://github.com/morluto/rea/commit/b62931f8335f58bfe344883a4f149e9eef73d835)) +* **windows:** remove cancelled snapshot outputs ([#957](https://github.com/morluto/rea/issues/957)) ([d76f7d1](https://github.com/morluto/rea/commit/d76f7d150895289aa1fb85a057b81ca7ff102df4)) + + +### Performance Improvements + +* **artifacts:** stream ASAR members without full buffering ([#962](https://github.com/morluto/rea/issues/962)) ([abd7a5e](https://github.com/morluto/rea/commit/abd7a5ed091061e4b1e83e5933e9009fb5b8d577)) +* **call-path:** prune dead ends and enumerate without recursion ([#909](https://github.com/morluto/rea/issues/909)) ([e52fe97](https://github.com/morluto/rea/commit/e52fe9719fec03f2aa79b1a1b9e11b38c229903c)) +* **cli:** defer catalog digests and use canonical cache scope ([9a15525](https://github.com/morluto/rea/commit/9a1552529889e9f5b52a88739eb767b92e57e24e)) +* **cli:** defer unused catalog work during command startup ([#920](https://github.com/morluto/rea/issues/920)) ([9a15525](https://github.com/morluto/rea/commit/9a1552529889e9f5b52a88739eb767b92e57e24e)) +* **comparison:** reuse canonical sort keys ([#990](https://github.com/morluto/rea/issues/990)) ([ebb065e](https://github.com/morluto/rea/commit/ebb065e2dc15f5763276f401521896f66bae6339)) +* **dotnet:** index declaring-type ranges once per metadata table ([#918](https://github.com/morluto/rea/issues/918)) ([7a9f587](https://github.com/morluto/rea/commit/7a9f587c3a9998d828b83388438976527ca7074f)) +* **dotnet:** index ordered declaring-type ranges once per table ([7a9f587](https://github.com/morluto/rea/commit/7a9f587c3a9998d828b83388438976527ca7074f)) +* **evidence:** scale imports and dependency graphs ([#941](https://github.com/morluto/rea/issues/941)) ([7dc40d3](https://github.com/morluto/rea/commit/7dc40d3d9e00caf013109942a5d9a1d7fdf9ec62)) +* **inspector:** bound runtime script location authorization ([#945](https://github.com/morluto/rea/issues/945)) ([58381ee](https://github.com/morluto/rea/commit/58381eefa24f73580e31eaa09dc14b9c04d78d6c)) +* **javascript:** analyze member chains without recursive copying ([#932](https://github.com/morluto/rea/issues/932)) ([dcde958](https://github.com/morluto/rea/commit/dcde9584508830a5d99ac5e2032f539563c69002)) +* **javascript:** index Promise return-site ownership ([#971](https://github.com/morluto/rea/issues/971)) ([2cedde9](https://github.com/morluto/rea/commit/2cedde9f1cf72b04bef37f9f004bb68d5ff6502a)) +* **javascript:** index semantic fingerprint relations ([#942](https://github.com/morluto/rea/issues/942)) ([c92a344](https://github.com/morluto/rea/commit/c92a344d4770125d85a11f3fc7a23d800bd30003)) +* **javascript:** reduce analysis and source-map work ([#955](https://github.com/morluto/rea/issues/955)) ([c7530f9](https://github.com/morluto/rea/commit/c7530f9a816d84354516d3ea137f4a0d91d3b8b3)) +* **providers:** assemble fragmented responses once per line ([#911](https://github.com/morluto/rea/issues/911)) ([df7151b](https://github.com/morluto/rea/commit/df7151ba305eab3a33a9261a023705b29862b308)) +* **reconstruction:** index coverage evaluation ([#983](https://github.com/morluto/rea/issues/983)) ([f26c8b5](https://github.com/morluto/rea/commit/f26c8b5b8cff10b93173359b5453874d659f2440)) +* **setup:** reuse initial diagnostics during planning ([#940](https://github.com/morluto/rea/issues/940)) ([118d43e](https://github.com/morluto/rea/commit/118d43e787e38857714852cc846b1b604a61950d)) + + +### Code Refactoring + +* add incremental capability migration safeguards ([#819](https://github.com/morluto/rea/issues/819)) ([75f50d8](https://github.com/morluto/rea/commit/75f50d86f6d504f4dd97a707871d39ec022b3047)) +* **android:** group layered source and verification ([#873](https://github.com/morluto/rea/issues/873)) ([8e8921d](https://github.com/morluto/rea/commit/8e8921d40c63b40ab7e1598f672063dd304d93f0)) +* **apple:** group artifact producers and verification ([#952](https://github.com/morluto/rea/issues/952)) ([ef1a0cc](https://github.com/morluto/rea/commit/ef1a0cc65af7918ef7204a39f42a4299b486c453)) +* **artifacts:** isolate JavaScript file acquisition ([#916](https://github.com/morluto/rea/issues/916)) ([f0a68dc](https://github.com/morluto/rea/commit/f0a68dce60e81b4d2f420bf774b61957a37326ac)) +* **binary:** group session selection and snapshot ownership ([#886](https://github.com/morluto/rea/issues/886)) ([dd114d3](https://github.com/morluto/rea/commit/dd114d39801973e958a582c8fcba7ccce0e50299)) +* **binary:** move production composition outside application workflows ([#965](https://github.com/morluto/rea/issues/965)) ([33d4761](https://github.com/morluto/rea/commit/33d4761cc7a96630b7c2fed890df83d433c45914)) +* **browser:** align inspector exclusions with canonical vocabulary ([#834](https://github.com/morluto/rea/issues/834)) ([de9593a](https://github.com/morluto/rea/commit/de9593ad48c0b97507f18949b7ad86ad9c743ebc)) +* **cli:** split core analysis command registrar ([#858](https://github.com/morluto/rea/issues/858)) ([8b9940a](https://github.com/morluto/rea/commit/8b9940a7b5d3fcd5a8eda6d397f0ab7c3aaf2ac9)) +* colocate investigation record implementation ([#867](https://github.com/morluto/rea/issues/867)) ([bb19c94](https://github.com/morluto/rea/commit/bb19c9477ef3eefd9c5b2e6cabe78cc94e6779ae)) +* compose investigation record ownership ([#845](https://github.com/morluto/rea/issues/845)) ([ce73c3f](https://github.com/morluto/rea/commit/ce73c3fed2e5fd20ae0113579345a69763eb7655)) +* declare auxiliary capabilities from source ([#853](https://github.com/morluto/rea/issues/853)) ([4a6c17c](https://github.com/morluto/rea/commit/4a6c17ce83dfd20412f0e168525314a20c61169e)) +* **domain:** consolidate property-key extraction behind semanticStaticPropertyKey ([#823](https://github.com/morluto/rea/issues/823)) ([764ff05](https://github.com/morluto/rea/commit/764ff05231f1a666dfa655492da42b4b6ba742c3)) +* **domain:** converge comparison mechanics on shared vocabulary ([#824](https://github.com/morluto/rea/issues/824)) ([c13c9d4](https://github.com/morluto/rea/commit/c13c9d41f8441a711266adee21429fb7433a6aa1)) +* **domain:** extract artifact path syntax helpers ([#830](https://github.com/morluto/rea/issues/830)) ([ef535b8](https://github.com/morluto/rea/commit/ef535b81fefc358b0bdb655e5aa057fc3949ce5f)) +* **domain:** extract source-map envelope walk and disambiguate stringValue ([#828](https://github.com/morluto/rea/issues/828)) ([64ebdf4](https://github.com/morluto/rea/commit/64ebdf45016bda679674cbd2287576eadf66a1fc)) +* **domain:** map validation taxonomies and add inventory Result seam ([#833](https://github.com/morluto/rea/issues/833)) ([78f4848](https://github.com/morluto/rea/commit/78f4848d70ce462426e9f221d6e7b3e34219bf46)) +* **domain:** split Interface Builder keyed-archive parse from graph builder ([#859](https://github.com/morluto/rea/issues/859)) ([da09706](https://github.com/morluto/rea/commit/da0970672da725dbb095ffcaefad07303ae85aab)) +* **firmware:** group layered source and verification ([#878](https://github.com/morluto/rea/issues/878)) ([507e8b3](https://github.com/morluto/rea/commit/507e8b3c7be75f8de69be214618394aca3585404)) +* **ghidra:** extract createClient and load-image attestation ([#856](https://github.com/morluto/rea/issues/856)) ([b7df5b7](https://github.com/morluto/rea/commit/b7df5b78052539e57967db8e6562befd70c6ebdc)) +* give Inspector its own capability directory ([#869](https://github.com/morluto/rea/issues/869)) ([021ba69](https://github.com/morluto/rea/commit/021ba690b07eab4b990be47f90946db9f70e0fc0)) +* **javascript:** group application workflows and verification ([#896](https://github.com/morluto/rea/issues/896)) ([0804722](https://github.com/morluto/rea/commit/0804722cdf721a8d767d02f9342ebdf8d186f7e1)) +* **javascript:** group domain semantics and contracts ([#907](https://github.com/morluto/rea/issues/907)) ([f6a58f1](https://github.com/morluto/rea/commit/f6a58f10629614fb7a6970421218b73d41bce6a5)) +* **managed:** group capability workflows and verification ([#926](https://github.com/morluto/rea/issues/926)) ([28713f9](https://github.com/morluto/rea/commit/28713f9b4dcb882f0e811653890fde70cb5fdadb)) +* **native:** group analyst semantics workflows and contracts ([#973](https://github.com/morluto/rea/issues/973)) ([ea4db4c](https://github.com/morluto/rea/commit/ea4db4c9f7cbc10dc701c4d5770109c08952a5b8)) +* **native:** split Apple dispatch metadata decode facets ([#855](https://github.com/morluto/rea/issues/855)) ([676959e](https://github.com/morluto/rea/commit/676959ecb55b606a567af3d2eb3d3edc96f0aa2f)) +* **provider:** declare deep capabilities from source ([#892](https://github.com/morluto/rea/issues/892)) ([b808e2d](https://github.com/morluto/rea/commit/b808e2d6bbbae38c1ff2e293e1cf77464d889bdd)) +* share Android and firmware provider factories ([#826](https://github.com/morluto/rea/issues/826)) ([3ed59b2](https://github.com/morluto/rea/commit/3ed59b281247f2180b3c79e658078507e4cc1be2)) + + +### Documentation + +* add concise lawful-use disclaimer ([#888](https://github.com/morluto/rea/issues/888)) ([4037c65](https://github.com/morluto/rea/commit/4037c6545dc8cc47f4602d8f06e5329ed641cdbb)) +* add DX-Ball reconstruction showcase ([#876](https://github.com/morluto/rea/issues/876)) ([895079d](https://github.com/morluto/rea/commit/895079dd093f02487789d9aa967f0cccbfe379d8)) +* add prominent website and showcase links to READMEs ([2ccc86c](https://github.com/morluto/rea/commit/2ccc86cd13d71f08b553d3b9962175144b882539)) +* add README star history chart ([#850](https://github.com/morluto/rea/issues/850)) ([11f27de](https://github.com/morluto/rea/commit/11f27deddf88703368942d3ddfc239a7ebe72e3e)) +* add website and showcase links to READMEs ([#930](https://github.com/morluto/rea/issues/930)) ([2ccc86c](https://github.com/morluto/rea/commit/2ccc86cd13d71f08b553d3b9962175144b882539)) +* **apple:** describe directory-based framework plist ambiguity ([6d74992](https://github.com/morluto/rea/commit/6d74992efed3271e8370c505afdde347609f8353)) +* audit and improve localized readmes translations and wording ([00a6ac3](https://github.com/morluto/rea/commit/00a6ac3de99f432bd6dbb88148a2aab5f8d3d338)) +* clarify NativeAOT scope and regenerate conformance ledger ([c945931](https://github.com/morluto/rea/commit/c945931961cbd488163c6d92ef91336ed506942e)) +* fix stale IDA roadmap item, mermaid paths, toolchain wording ([d2aed17](https://github.com/morluto/rea/commit/d2aed172ab79d98ff4e62c14d8f34cc49c1d17b4)) +* move quick start up and mark skill install optional ([554e9b1](https://github.com/morluto/rea/commit/554e9b1612f7799c2bc7177eb1a9b04a0f27d2e9)) +* note Cloud Agent Node.js toolchain ([#837](https://github.com/morluto/rea/issues/837)) ([6aa6350](https://github.com/morluto/rea/commit/6aa6350c800796d0953937e894ff176ae248e930)) +* publish VitePress documentation on GitHub Pages ([c78fe69](https://github.com/morluto/rea/commit/c78fe6990bcface6853ac5c11c90df6bc0df562d)) +* separate ambiguous and unavailable provider recovery ([c3f2b8e](https://github.com/morluto/rea/commit/c3f2b8e7742915dc27ab7c801a8a1a9127169896)) +* show task-scoped readiness and provider preference in the quick start ([880cca1](https://github.com/morluto/rea/commit/880cca1bca497bb53c97a821b470df0f2235e043)) +* show task-scoped readiness and provider preference in the quick start ([5fd0db3](https://github.com/morluto/rea/commit/5fd0db37d94f1c1a0495920c79e121d799da0d30)), closes [#726](https://github.com/morluto/rea/issues/726) +* update release boundary to npm 4.1.0 with Windows native bundle ([69be514](https://github.com/morluto/rea/commit/69be514c67c8b2eb8b450355a9782d9237748fda)) +* **website:** add Notion case study and improve onboarding ([a6ba772](https://github.com/morluto/rea/commit/a6ba772c08e2648e6602787a0ea537d75d72802d)) +* **website:** add TH04 bullet-ring case study ([f8d84da](https://github.com/morluto/rea/commit/f8d84da127fad871050c098b004a503b36795ad0)) +* **website:** add worked guides and keep Pages publishing manual ([#925](https://github.com/morluto/rea/issues/925)) ([4f25ee3](https://github.com/morluto/rea/commit/4f25ee33dcd4195f8d877f8835f81c4e08c95235)) +* **website:** clarify guides and case studies ([5065fcd](https://github.com/morluto/rea/commit/5065fcd5205ec7c0d259131431c2cf54d9f69cf6)) + + +### Tests + +* **artifacts:** report compiled connector records when a storyboard route is missing ([d421d3f](https://github.com/morluto/rea/commit/d421d3f286ce515b5126859a0f9cac60667a168e)) +* **artifacts:** report observed action routes when a compiled route is missing ([c60b737](https://github.com/morluto/rea/commit/c60b737f7db8e2c9a1982cdb4357fcda1f47ff08)) +* **artifacts:** write the storyboard fixture's action in Cocoa syntax ([53bfa7e](https://github.com/morluto/rea/commit/53bfa7e3f792cdb9f2e95fc954f3616426414bcc)) +* eliminate fixture races and prune redundant scaffolding ([#849](https://github.com/morluto/rea/issues/849)) ([f72931d](https://github.com/morluto/rea/commit/f72931d9dd54609bfca422750fc2667f80af691c)) + + +### Continuous Integration + +* consolidate macOS native baseline checks ([#935](https://github.com/morluto/rea/issues/935)) ([810fe53](https://github.com/morluto/rea/commit/810fe53e799b89dc215c52c9245d36fb2a44d9c4)) +* verify native arm64 and Intel macOS workflows ([#898](https://github.com/morluto/rea/issues/898)) ([4801a24](https://github.com/morluto/rea/commit/4801a24089964860db7f4855be21d2d4313c7eab)) + ## [4.1.0](https://github.com/morluto/rea/compare/rea-agents-4.0.1...rea-agents-4.1.0) (2026-10-06) diff --git a/README.md b/README.md index 896bd4277..233209af1 100644 --- a/README.md +++ b/README.md @@ -553,7 +553,7 @@ Setup offers supported agent integrations for selection. Existing REA registrati "mcpServers": { "rea": { "command": "npx", - "args": ["-y", "rea-agents@4.1.0", "mcp"] + "args": ["-y", "rea-agents@5.0.0", "mcp"] } } } diff --git a/README_ar.md b/README_ar.md index 7c7d98cb1..9cb606d39 100644 --- a/README_ar.md +++ b/README_ar.md @@ -243,7 +243,7 @@ rea setup "mcpServers": { "rea": { "command": "npx", - "args": ["-y", "rea-agents@4.1.0", "mcp"] + "args": ["-y", "rea-agents@5.0.0", "mcp"] } } } diff --git a/README_ja.md b/README_ja.md index 63ca5c66c..5739b274e 100644 --- a/README_ja.md +++ b/README_ja.md @@ -232,7 +232,7 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf "mcpServers": { "rea": { "command": "npx", - "args": ["-y", "rea-agents@4.1.0", "mcp"] + "args": ["-y", "rea-agents@5.0.0", "mcp"] } } } diff --git a/README_ko.md b/README_ko.md index 86b090b79..56de8102a 100644 --- a/README_ko.md +++ b/README_ko.md @@ -233,7 +233,7 @@ Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin "mcpServers": { "rea": { "command": "npx", - "args": ["-y", "rea-agents@4.1.0", "mcp"] + "args": ["-y", "rea-agents@5.0.0", "mcp"] } } } diff --git a/README_zh.md b/README_zh.md index bda517614..02540890a 100644 --- a/README_zh.md +++ b/README_zh.md @@ -232,7 +232,7 @@ Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsu "mcpServers": { "rea": { "command": "npx", - "args": ["-y", "rea-agents@4.1.0", "mcp"] + "args": ["-y", "rea-agents@5.0.0", "mcp"] } } } diff --git a/docs/installation.md b/docs/installation.md index 9caa72c65..fcbed20a3 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -408,7 +408,7 @@ For a client that requires manual configuration, use: "mcpServers": { "rea": { "command": "npx", - "args": ["-y", "rea-agents@4.1.0", "mcp"] + "args": ["-y", "rea-agents@5.0.0", "mcp"] } } } diff --git a/docs/product-catalog.json b/docs/product-catalog.json index 061f98abe..ea9de7746 100644 --- a/docs/product-catalog.json +++ b/docs/product-catalog.json @@ -1,7 +1,7 @@ { "package": { "name": "rea-agents", - "version": "4.1.0", + "version": "5.0.0", "sdk": { "server": "2.3.1", "client": "2.3.1", diff --git a/package-lock.json b/package-lock.json index f1c2520dc..33332d40e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "rea-agents", - "version": "4.1.0", + "version": "5.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "rea-agents", - "version": "4.1.0", + "version": "5.0.0", "license": "MIT", "dependencies": { "@babel/parser": "8.0.4", diff --git a/package.json b/package.json index 40c631738..f0612bc9e 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "rea-agents", "mcpName": "io.github.morluto/rea", - "version": "4.1.0", + "version": "5.0.0", "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.", "license": "MIT", "repository": { diff --git a/server.json b/server.json index 11161d5e7..116bde8aa 100644 --- a/server.json +++ b/server.json @@ -8,13 +8,13 @@ "url": "https://github.com/morluto/rea", "source": "github" }, - "version": "4.1.0", + "version": "5.0.0", "packages": [ { "registryType": "npm", "registryBaseUrl": "https://registry.npmjs.org", "identifier": "rea-agents", - "version": "4.1.0", + "version": "5.0.0", "runtimeHint": "npx", "transport": { "type": "stdio" diff --git a/src/generatedPackageMetadata.ts b/src/generatedPackageMetadata.ts index cee394dcd..c049e92da 100644 --- a/src/generatedPackageMetadata.ts +++ b/src/generatedPackageMetadata.ts @@ -1,7 +1,7 @@ /** Generated from package.json and package-lock.json; do not edit. */ export const PACKAGE_METADATA = { name: "rea-agents", - version: "4.1.0", // x-release-please-version + version: "5.0.0", // x-release-please-version serverSdkVersion: "2.3.1", clientSdkVersion: "2.3.1", coreSdkVersion: "2.3.1",