4aa51bfe19
* feat(process): add owned debugger shutdown lifecycle * feat(reverse): add local inspection commands * feat(gdb): add persistent debugger integration * feat(cutter): add Cutter bridge integration * test(reverse): enforce complete integration coverage * fix(process): preserve debugger shutdown ownership * fix(reverse): retain evidence across interrupted commands * fix(gdb): honor captured provider environment * test(process): cover debugger shutdown retries * fix(reverse): retain evidence for interrupted providers * test(process): cover debugger shutdown retries * fix(reverse): retain evidence for interrupted providers * fix(server): snapshot provider environment at creation * fix(reverse): close review gaps with complete coverage * fix(reverse): address inspection review findings * fix(gdb): bound sessions and retain cleanup ownership * fix(ci): require reverse-tools quality lane * fix(process): unref inherited debugger output pipes * fix(reverse): address remaining PR 1960 findings * fix(gdb): address remaining PR 1961 findings * fix(reverse): account for unrestricted provider execution * fix(process): retain debugger ownership until safe shutdown * fix(process): preserve replacement debugger sessions * fix(reverse): preserve admission and output provenance * fix(process): retain exited debugger until output settles * fix(mcp): bound provider admission and debugger cleanup * fix(reverse): preserve failure provenance and classify E2BIG * fix(gdb): preserve startup cleanup and detach safety * fix(process): retain debugger ownership after detach failure * fix(reverse): preserve mutation and failure provenance * fix(gdb): address debugger review findings * fix(reverse): rebind sessions after external mutation * fix(process): cap debugger output after exit * fix(gdb): protect one-shot detach verification * feat(debugger): add reverse tool coverage gate * test(debugger): cover integrated failure paths * fix(gdb): bound and preserve session observations * fix(gdb): address review regressions * style: format merged integration files * fix(reverse): preserve session and output evidence * refactor(gdb): share repeated test and partial result setup * fix(gdb): invalidate TTY proof for Python aliases * fix(reverse): retain failure output byte counts * test(process): synchronize late debugger output * fix(gdb): invalidate TTY proof for wrapped commands * fix(gdb): recognize wit command abbreviation * test(reverse): wait for cancelled descendant readiness * test(reverse): bound descendant cancellation cleanup * style(reverse): format integration tests and adapters * style: format reverse engineering integration files * test(reverse): remove duplicate environment harness * test(gdb): share session startup assertions * fix(gdb): invalidate output proof for command abbreviations * test(reverse): share composition edge case scenarios * fix(ci): recognize verification and mutation tool entries * test(rizin): cover successful fake inferior detach * test(cli): align full output failure envelope * test(cli): isolate reverse command lifecycle service * test(process): share debugger output fixture setup * fix(binary): preserve high-bit Windows signature bytes * style(binary): format Windows signature parser * test(mcp): preserve call coverage in unchanged comparison * fix(ci): include reverse tools Vitest configs in lint cache * fix(mcp): preserve target content on delivery errors * ci: align duplication ceiling with expanded suite * test(reverse): allow signal admission mutants * fix(reverse): bound retained cleanup failures to process owners * fix(test): replace drifting mutation ranges with owned selectors * fix(reverse): admit persistent commands and retain cleanup ownership * fix(cutter): recover timed-out commands from exact receipts * fix(cutter): reject unsupported bridge request kinds * fix(ci): repair client format and shared verification fixtures * fix(native): preserve debugger cleanup ownership and bridge authentication * test(native): retain diagnostics without perfect coverage requirements * chore(licenses): refresh locked dependency inventory and notices * fix(test): exclude transient command locks from mutation sandboxes * fix(gdb): admit only platforms with safe detach verification * fix(cutter): retain bounded completion receipts until acknowledgement * fix(cutter): acknowledge commands rejected before UI dispatch * test(reverse): fail cancellation checks before fixture teardown * test(gdb): clean up the retained broken-stdin fixture owner * docs(test): clarify focused provider verification scope * fix(rizin): retain close cleanup failures * fix(gdb): wait for inferior stop and bound MI buffering * fix(cutter): retain failed receipt acknowledgements * fix(rizin): return retained session identity on rebind failure * fix(gdb): preserve startup cancellation and lossy status * fix(rizin): retain launch provenance and assemble frames once * fix(cutter): recover receipts across callers and bound discovery * docs: describe debugger evidence and bridge recovery * fix(process): keep cleanup incomplete while writers remain Stopping a debugger no longer reports success when inherited output streams stay open, so BinarySession cannot reopen a binary a child is still changing. Concurrent Cutter cleanup retries share one receipt acknowledgement instead of treating a consumed receipt as failure. * fix(debuggers): recover cleanup with captured process identities * fix(analysis): retire sessions after unrestricted commands * fix(cli): preserve completed evidence after cleanup recovery * fix(cutter): bound frame collection and coalesce cleanup * fix(windows): resolve selected provider paths absolutely * fix(gdb): report decoding loss in failed startup evidence * fix(rizin): scope decoding loss to collected command frames * test(mcp): cover snapshot retirement in reverse tools CI --------- Co-authored-by: Daniel Gonçalves Araujo <47118053+dandgabr@users.noreply.github.com> Co-authored-by: REA Maintainers <noreply@github.com> Co-authored-by: OpenAI Codex <codex@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|---|---|---|
| .. | ||
| Apache-2.0.txt | ||
| GCC-Runtime-Library-Exception-3.1.txt | ||
| GPL-3.0.txt | ||
| LGPL-2.0.txt | ||
| MIT-template.txt | ||
| MinGW-w64-runtime.txt | ||
| Node-22.19.0-LICENSE.txt | ||
| README.md | ||
| cfworker-MIT.txt | ||
| dotnet-runtime-MIT.txt | ||
| frida-17.23.2-COPYING.txt | ||
| ghidra-12.1.4-DISCLAIMER.txt | ||
| ghidra-12.1.4-LICENSE.txt | ||
| ghidra-12.1.4-NOTICE.txt | ||
| nativeaot-parser-MIT.txt | ||
| npm-dependencies.txt | ||
| npm-runtime-notices.txt | ||
| upstream-sources.json | ||
| xterm-MIT.txt | ||
README.md
Preserved licenses and attribution
Start with THIRD_PARTY_NOTICES.md for the distinction between distributed material and separately obtained tools. These files retain upstream texts; they do not change REA's MIT license.
| Files | Provenance and scope |
|---|---|
npm-dependencies.txt |
Every package path in the root lockfile, with its exact version, declared license, scope, download URL, and integrity. Includes development and optional platform entries. |
npm-runtime-notices.txt |
Original license, copyright, and NOTICE texts collected from integrity-verified locked runtime npm archives across all platforms; also the license of Rolldown's generated runtime helpers. The archive manifest's name and version are checked. |
nativeaot-parser-MIT.txt |
Original Washi notice for derived NativeAOT parser code; source revision is recorded in the parser and the root notices. |
dotnet-runtime-MIT.txt |
Original .NET Foundation MIT text from the NativeAOT reference revision a3b2d40328be0be3f8dd43f0e5cc925b8827b044. |
ghidra-12.1.4-{LICENSE,NOTICE,DISCLAIMER}.txt |
Unchanged top-level documents from Ghidra_12.1.4_build. Ghidra is not bundled; these reference copies do not replace its component and GPL support-program notices. The US-government-specific disclaimer applies to Ghidra, not to REA. |
cfworker-MIT.txt, xterm-MIT.txt |
Original notices missing from their published runtime npm archives, recovered from the releases' upstream Git revisions. They are included in the corresponding runtime entries. |
Apache-2.0.txt, MIT-template.txt |
Standard license texts for explicitly documented upstream notice gaps. The MIT placeholders are not an attribution to an inferred author or year. |
frida-17.23.2-COPYING.txt, LGPL-2.0.txt |
Unchanged licensing supplements for the optional Frida dependency: tagged Frida wxWindows notice and GNU Library GPL v2 text. The npm archive and tagged Node binding omit a standalone license/copyright document; these texts do not recover binding or prebuild-component attribution. |
MinGW-w64-runtime.txt |
Upstream's combined runtime copyright and license notices, snapshot from v12.0.0, for the statically linked Windows addon. This is a notice snapshot, not a pin of the compiler used in release CI. |
GPL-3.0.txt, GCC-Runtime-Library-Exception-3.1.txt |
Unchanged GPLv3 and GCC runtime exception texts from GCC 14.2.0. The exception permits eligible compiled combinations under its conditions; the runtime keeps its own license. This snapshot does not assert that every release uses GCC 14.2.0. |
Node-22.19.0-LICENSE.txt |
The original Node 22.19.0 license and third-party notices. The Windows addon uses Node-API headers from that release; the complete Node runtime and all components listed in this reference document are not bundled. |
upstream-sources.json |
Source URLs and SHA-256 digests for the new unchanged reference and supplemental texts. These digests identify the preserved local texts. |
Additional preserved originals live at evmole/LICENSE, pwndbg/LICENSE.md, and the website dinosaur notice.
Collection scope and maintenance
The inventory and runtime texts were prepared from the root lockfile. The collection downloaded the locked npm archives, checked their lockfile integrity and package identity, and read license/NOTICE/copyright documents without installing packages or executing lifecycle scripts. It includes optional platform packages that may not be present in one local installation. Temporary archives were removed after collection.
For releases that omit original documents, the collection uses pinned upstream
texts, embedded source/README license sections, or the same release's parent
notice for the @lydell/node-pty prebuilt family. evmole@0.9.3 uses the existing
preserved upstream license. clean-git-ref@2.0.1 and minimisted@2.0.1 provide
only license and author metadata: their missing original copyright documents
remain explicitly identified in the runtime texts. Do not describe those
entries as complete recovered attribution.
frida@17.23.2 also lacks an original standalone notice in its npm archive and
tagged Node source. Its declared license and the preserved licensing supplements
are recorded explicitly without inferring a copyright holder or year.
These records do not establish the legal accuracy of upstream metadata or
prove that every upstream source-file attribution has been supplied in an
archive. Review and refresh them when dependencies change; compare reference
texts with the sources and SHA-256 digests in upstream-sources.json.
When updating engines, copied code, website assets, or the Windows release toolchain, review their actual upstream notices as well. The Linux MinGW-w64 compiler in release CI is not version-pinned by REA: compare its installed runtime/component notices with the retained snapshots and update them if they differ. Do not assume that a compiler change leaves redistribution requirements unchanged. Preserve applicable originals with any additionally bundled engine; top-level reference copies alone may not cover its entire distribution.
Generate the exact locked inventory with npm run licenses:generate. After
refreshing verified runtime notices, update their header fingerprint to the
generator's reported runtime_dependency_fingerprint, then run
npm run licenses:check; docs:check also runs this check. It compares the
inventory, runtime package identities,
license declarations, archive URLs/integrity, runtime dependency fingerprint,
and preserved reference digests. It does not verify legal completeness or
replace inspection of original upstream notices.