08ec2bf82f
chore(main): release rea-agents 6.3.0 ( #1341 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-10 07:14:55 +08:00
6ce3288f3b
fix(cli): stream JSON inputs beyond the whole-document string limit ( #1360 )
...
Stream large CLI JSON files through a strict UTF-8 decoder and standard JSON parser using the same admitted regular-file handle. Preserve native parsing for small inputs, typed malformed-input/resource/access-denied errors, cancellation, and complete Evidence.
Verified with focused public CLI regressions, a 768 MB whitespace-padded valid request, and the Windows native decoder boundary. Individual strings and the assembled object graph remain subject to native runtime limits. All 27 final-head checks passed.
Refs #1331
2026-10-10 04:53:09 +08:00
a64851f259
chore(release/6.2.0): release rea-agents 6.2.0 ( #1305 )
...
* chore(release/6.2.0): release rea-agents 6.2.0
* docs(release): complete 6.2 breaking migration notes
* fix(dev): allow formatter-ignored staged files
* docs(release): include all unreleased mainline entries
* docs(release): note ignored-file hook repair
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-09 16:17:20 +00:00
70e5c24718
chore(main): release rea-agents 6.1.0 ( #1106 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-09 08:15:17 +08:00
6fee42689a
chore(release/6.0.0): release rea-agents 6.0.0 ( #1058 )
...
* chore(release/6.0.0): release rea-agents 5.1.0
* chore: normalize release product catalog
* chore(release): correct 6.0.0 candidate and migration notes
Keep the recorded application checkpoint unchanged. The upstream history walk
stops at the merged side-branch release commit and omits older unreleased main
commits; restore the missing notes and absolute-path migration instructions.
Set all release metadata to the agreed SemVer 6.0.0.
Assisted-by: Sakuya (gensokyo-skills:sakuya-checkpointed-execution)
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 17:40:01 +08:00
7af7bc88ce
feat(evm): inspect offline bytecode interfaces through EVMole ( #1051 )
...
* feat(evm): inspect offline bytecode interfaces through evmole
* fix(evm): distinguish unsupported bytecode targets
* style(evm): format verifier string-prefix checks
2026-10-08 15:32:05 +08:00
1154f2f03c
fix(javascript): reconstruct HTML script loads accurately ( #1042 )
...
* fix: parse HTML script references with HTML semantics
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* test(javascript): cover exact HTML script resource identity
---------
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 13:24:24 +08:00
2bf3663f65
feat(browser): inspect historical web network captures ( #992 )
...
* feat(browser): inspect retained HAR and mitmproxy capture evidence
Add independent offline format adapters, inline CLI/MCP evidence, bounded
owned decoder processes, and real producer verification.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): preserve capture boundaries during cancellation and decoding
Honor cancellation during owned-command cleanup, retain opaque HAR
extension content, and clean verifier resources on every failure path.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): exclude sensitive capture fields across representations
Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): exclude sensitive capture identities and bound diagnostics
* fix(browser): validate excluded HAR subtrees before projection
* fix(browser): distinguish capture input limits from decoder failures
* fix(browser): preserve decoder failure categories
* fix(browser): validate excluded native credential values
* test(browser): report capture verifier assertions directly
* fix(browser): classify native representation failures precisely
* fix(browser): exclude URL userinfo after header whitespace
* fix(browser): preserve capture evidence and failure boundaries
* fix(browser): exclude sensitive literals from capture limitations
* test(browser): check limitation values without JSON syntax
* fix(browser): preserve acquisition integrity and exclude selection diagnostics
* fix(browser): preserve capture acquisition and declaration boundaries
* fix(mcp): project sensitive capture argument validation
* fix: preserve capture bytes and prelaunch cancellation
* fix(browser): exclude sensitive HAR record ancestry
* fix(browser): preserve transport URL and parameter exclusions
* fix(browser): preserve numeric redaction and canonical capture provenance
* fix(browser): cover derived capture values and ownership preparation deadlines
* fix(browser): exclude explicitly sensitive artifact digests
* chore: regenerate generated metadata
* fix(browser): reject lossy HAR member normalization
* test(browser): assert the advertised unsupported-profile outcome
* fix(browser): preserve JSON visitor nesting failure locations
* fix(browser): exclude explicitly sensitive native source ranges
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 07:53:41 +08:00
76e7e510bb
perf(artifacts): replace quadratic ZIP overlap checks ( #1013 )
2026-10-08 02:08:39 +08:00
b33236ec08
chore(release/5.0.0): release rea-agents 5.0.0 ( #1007 )
...
* chore(release/5.0.0): release rea-agents 5.0.0
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 01:26:36 +08:00
c78fe6990b
docs: publish VitePress documentation on GitHub Pages
2026-10-07 16:58:04 +08:00
c55ae3b9ec
fix(deps): remediate smol-toml advisories
2026-10-06 21:55:36 -07:00
3af3811ab0
fix: integrate 24 reviewed browser/native/semantics corrections ( #815 )
...
* fix(reference): resolve emitted extensions to TypeScript source
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* test(reference): retain legitimate declaration import counterparts
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(mcp): recognize implicit form elicitation capability
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(ghidra): reject contradictory NativeAOT reports
* fix(native): preserve thin architectures across echoed filename lines
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): preserve app bundle executable filename whitespace
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(doctor): validate Node-wrapped client policy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(reference): preserve observed entry failure reasons
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(artifacts): verify opaque bytes before reusing inventory identities
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix(browser): resolve DOM destinations against document base URL
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
* fix: recover serialized native NIB view hierarchy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* ci: exercise native compiled NIB hierarchy regressions
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
* fix(deps): remediate reachable archive-parsing advisories
Two high-severity advisories are reachable from untrusted target content:
- @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed
app bundles in the keyed-archive reader. Refreshed to 0.9.12.
- brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while
analyzing untrusted ASAR archives. Refreshed to 5.0.12.
Both are in-range patch updates (plist declares ^0.9.10, minimatch declares
^5.0.5), so no source or API change is required and no direct dependency
declaration moves. Lockfile-only change.
The remaining smol-toml advisory is not included: it parses operator-owned
client configuration rather than untrusted target content, and its fix moves
outside the declared range and changes leading-BOM handling.
* fix(semantics): link wrapped arrow Promise returns
* fix(reconstruction): preserve unknown graph limitations
* fix(native): preserve exact code signing identifiers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): recognize only whole otool command headers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): retain nm-proven literal export names
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(javascript): project decoded file URL paths
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix: preserve explicit source-relative URL observation spelling
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(native): project Mach-O evidence into container file offsets
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
* fix(browser): normalize referrer policy fallback lists
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Kaoru0822 <aisakamimaki@gmail.com>
Co-authored-by: DeryFerd <deryferdikao125@gmail.com>
2026-10-07 10:33:10 +08:00
9622b4b4cf
chore(main): release rea-agents 4.1.0 ( #635 )
...
* chore(main): release rea-agents 4.1.0
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-07 01:57:26 +08:00
2c1bf92010
fix(cli): disable unmanaged skill synchronization
2026-10-05 23:27:46 -07:00
9b392bb2f8
chore(deps): finish toolchain upgrades and drop dead weight ( #644 )
...
* chore(deps): finish toolchain upgrades and drop dead weight
pino 9 to 10, @types/node 24 to 26, oxlint 1.73 to 1.87, knip 6.26
to 6.39, turbo 2.10 to 2.11. Narrow engines to supported majors
(22/24/26; vitest 5 refuses Node 25). Scope no-var-requires off for
Electron CJS hooks and fixtures.
Remove TypeDoc: incompatible with TypeScript 7 at install and
runtime, used by nothing in any gate. Drop the dep, docs:api
workflow, typedoc.json, CI artifact step, and related docs.
Replace graphology with a local call-graph adjacency plus BFS: the
only consumer is call-path search, and graphology-types ships no
types entry for TS7 NodeNext resolution. Delete both graphology
dependencies.
Remove dead re-exports newly flagged by knip 6.39.
* chore: drop stale typedoc and replay references
Remove the docs:api release-checklist step, the orphaned docs/api
ignore entry, and the nonexistent replay glob from the adapters
project.
2026-10-06 06:02:02 +08:00
965d0b35f9
chore(deps): remove incompatible TypeDoc generator
2026-10-06 05:46:44 +08:00
dee8853fde
chore(deps): upgrade typescript, vitest, and MCP SDK to latest ( #633 )
...
typescript 5.9.3 to 7.0.2, vitest 4.1.10 to 5.0.3 (plus
@vitest/coverage-v8 and @fast-check/vitest 0.5.0 for peer compat),
@Modelcontextprotocol/client and server 2.0.0 to 2.3.1. Migrate the
removed describe.sequential to concurrent:false and regenerate
package metadata and product catalog.
Also restore byte-faithful reads in parseCliJsonInput: the safeJson
migration dropped the fatal UTF-8 check from #613 . Vitest 5 requires
Node 22/24/26+, so verify on Node 24 (repo-pinned toolchain).
2026-10-06 05:15:17 +08:00
feeb19b8b3
chore(main): release rea-agents 4.0.1 ( #622 )
...
* chore(main): release rea-agents 4.0.1
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-06 02:54:44 +08:00
1a936887b2
chore(main): release rea-agents 4.0.0 ( #502 )
...
* chore(main): release rea-agents 4.0.0
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-06 02:29:30 +08:00
5daaa453ff
chore: migrate formatting to Oxfmt ( #615 )
2026-10-06 01:59:19 +08:00
6256b68666
feat(setup)!: expand agent integrations and verify updates ( #577 )
...
* feat(setup)!: expand agent integrations and simplify onboarding
Add native configuration formats for OpenCode, Antigravity, GitHub Copilot
CLI, VS Code, and Devin. Preserve JSONC comments and unrelated settings
while making setup and uninstall ownership-aware and idempotent.
Select agent targets before planning, separate discovery from intent, and
keep agent-only setup independent of optional provider prerequisites.
Cover configuration boundaries and interactive behavior in packaged checks.
BREAKING CHANGE: unscoped setup refreshes only existing REA-owned
registrations. Use --all-detected to configure every detected client.
Setup JSON contains a compact doctor summary; use rea doctor for full
diagnostics. Cancellation and successful dry runs now exit successfully.
* feat(cli)!: replace upgrade with verified updates
Resolve an exact release through npm's configured registry, update only the
identified installation, and verify its new executable before reporting success.
Return a read-only maintenance plan for existing enabled REA integrations.
BREAKING CHANGE: replace rea upgrade with rea update; no alias is retained.
Successful update JSON uses status "updated", reports the verified installed
version, and returns an unapplied maintenance plan instead of opening setup.
2026-10-05 23:06:19 +08:00
4007b20fc2
fix(mcp): emit valid schemas for empty arrays ( #535 )
...
Replace empty tuples with a shared empty-array schema. Validate all input
and output schemas against Draft 2020-12 during catalog generation and
packaged MCP verification, with runtime and catalog regression coverage.
Closes #528
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-05 15:32:58 +08:00
0356f7677f
chore(main): release rea-agents 3.2.1 ( #499 )
...
* chore(main): release rea-agents 3.2.1
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-04 03:58:16 +08:00
b7539467a6
chore(main): release rea-agents 3.2.0 ( #472 )
...
* chore(main): release rea-agents 3.2.0
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-04 00:43:14 +08:00
b3529aa327
test: replace brittle workflow and readme checks
2026-09-29 08:44:41 +08:00
344b9b6dff
chore(main): release rea-agents 3.1.0 ( #463 )
...
* chore(main): release rea-agents 3.1.0
* chore: normalize release product catalog
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-10 03:47:06 +08:00
71f03a7224
chore(main): release rea-agents 3.0.0
2026-08-01 07:17:25 +00:00
17d7dbc461
build: upgrade MCP SDK to 2.0.0
2026-07-29 17:42:43 +00:00
8ab40974d3
chore(main): release rea-agents 2.7.0
2026-07-28 06:53:17 +00:00
58c749e831
chore(main): release rea-agents 2.6.0
2026-07-26 15:31:39 +00:00
0190bcbef1
chore(main): release rea-agents 2.5.1
2026-07-25 09:17:41 +00:00
ea953e6984
chore(main): release rea-agents 2.5.0
2026-07-24 15:38:39 +00:00
1ac3118aa2
feat(browser): capture controlled Playwright scenarios
2026-07-24 13:16:01 +00:00
829d9a0933
chore(main): release rea-agents 2.4.0
2026-07-23 07:39:29 +00:00
d4c52b3e30
chore(main): release rea-agents 2.3.0
2026-07-23 01:38:53 +00:00
f236b95316
build: separate cached local and PR checks
2026-07-22 15:05:36 +00:00
d25e98c3f9
feat: complete REA remediation program
2026-07-22 22:09:12 +09:00
31f4c3bf0d
chore(main): release rea-agents 2.2.0
2026-07-20 13:25:37 +00:00
ffab5d2707
chore(main): release rea-agents 2.1.0
2026-07-18 06:19:28 +00:00
1b90e7f992
feat(cli): support package-name setup wizard
2026-07-18 13:37:19 +08:00
16002ff3c2
feat(cli): improve setup onboarding
2026-07-18 11:59:16 +08:00
34252f55e9
fix(npm): use latest entry points without install scripts
2026-07-17 00:16:46 +00:00
25735bf140
chore(main): release rea-agents 2.0.0
2026-07-16 13:57:07 +00:00
3cc127f2af
chore(main): release rea-agents 1.7.0
2026-07-15 21:43:57 +00:00
557c3bea0f
chore(main): release rea-agents 1.6.0
2026-07-14 23:03:57 +00:00
1d1d234eed
fix(upgrade): prevent version downgrades
2026-07-14 20:45:30 +00:00
be76f8090b
feat: add web and Electron reverse-engineering workflows
2026-07-14 20:24:12 +09:00
ae0197d160
chore(main): release rea-agents 1.5.0
2026-07-14 08:19:14 +00:00
f154ba3812
chore(main): release rea-agents 1.4.0
2026-07-14 02:16:17 +00:00
github-actions[bot]
Ysopwnable
Rudy Mizrahi Celekli
morluto
Kaoru0822
N0zoM1z0