2bf3663f65
* feat(browser): inspect retained HAR and mitmproxy capture evidence Add independent offline format adapters, inline CLI/MCP evidence, bounded owned decoder processes, and real producer verification. Refs #882 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): preserve capture boundaries during cancellation and decoding Honor cancellation during owned-command cleanup, retain opaque HAR extension content, and clean verifier resources on every failure path. Refs #882 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): exclude sensitive capture fields across representations Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance. Refs #882 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): exclude sensitive capture identities and bound diagnostics * fix(browser): validate excluded HAR subtrees before projection * fix(browser): distinguish capture input limits from decoder failures * fix(browser): preserve decoder failure categories * fix(browser): validate excluded native credential values * test(browser): report capture verifier assertions directly * fix(browser): classify native representation failures precisely * fix(browser): exclude URL userinfo after header whitespace * fix(browser): preserve capture evidence and failure boundaries * fix(browser): exclude sensitive literals from capture limitations * test(browser): check limitation values without JSON syntax * fix(browser): preserve acquisition integrity and exclude selection diagnostics * fix(browser): preserve capture acquisition and declaration boundaries * fix(mcp): project sensitive capture argument validation * fix: preserve capture bytes and prelaunch cancellation * fix(browser): exclude sensitive HAR record ancestry * fix(browser): preserve transport URL and parameter exclusions * fix(browser): preserve numeric redaction and canonical capture provenance * fix(browser): cover derived capture values and ownership preparation deadlines * fix(browser): exclude explicitly sensitive artifact digests * chore: regenerate generated metadata * fix(browser): reject lossy HAR member normalization * test(browser): assert the advertised unsupported-profile outcome * fix(browser): preserve JSON visitor nesting failure locations * fix(browser): exclude explicitly sensitive native source ranges --------- Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| binwalk@4fdab3d464 | ||
| ghidra-nativeaot@effeb734fc | ||
| jadx-headless-mcp@5844800a48 | ||
| unblob@1fcc7a0a58 | ||
| wakaru@6070266d24 | ||
| web-network-captures | ||
| README.md | ||
README.md
Upstream analysis engines
REA integrates existing tools through provider adapters. Upstream source remains unmodified and retains its own license; it is not copied into REA's domain or application code.
jadx-headless-mcp
- Source: https://github.com/1013503897/jadx-headless-mcp
- Submodule:
third_party/jadx-headless-mcp - Release:
v0.7.1 - Commit:
5844800a486d2248fa949b74c9896285f5b54de2 - License: Apache-2.0; see the submodule's
LICENSE. - Release identity:
src/android/JadxRelease.ts. - REA integration:
src/android/; no upstream patches in this version.
Fetch source for inspection with:
git submodule update --init third_party/jadx-headless-mcp
Normal REA builds and installed npm packages do not require this submodule or a
Gradle build. Supply a separately obtained JAR with REA_JADX_MCP_JAR; REA never
downloads engines during an analysis operation. The audited release JAR is
identified by SHA-256. A caller-supplied build reporting the supported protocol
version retains its actual digest and an unknown source revision unless its
bytes match the audited release.
When updating: review upstream protocol and license changes, update the gitlink and release identity together, exercise the adapter's producer regressions, and run the real APK CLI/MCP lane. Never attribute modified engine bytes to the audited source revision.
Public APK fixture
scripts/fetch-android-fixtures.mjs explicitly downloads the audited engine and
Appium ApiDemos v6.0.18 into ignored _reference/apk-integration/. Both downloads
are checked against fixed SHA-256 values. Fixture provenance is recorded in
scripts/fixtures/android-apidemos.json; the source uses Apache-2.0. This is a
static analysis fixture: no emulator, device, SDK installation or app execution
is needed. APKs and JARs are neither tracked nor included in npm packages.
Firmware engines
| Engine | Source | Release | Pinned commit | License |
|---|---|---|---|---|
| Binwalk | https://github.com/ReFirmLabs/binwalk | v3.1.0 | 4fdab3d464d97b68e0af9088df3f9e2e1545b21c |
MIT, upstream LICENSE |
| Unblob | https://github.com/onekey-sec/unblob | 26.6.4 | 1fcc7a0a584a70a96c31f5a276c20944d199a089 |
MIT, upstream LICENSE |
Source remains unmodified in third_party/binwalk and third_party/unblob.
Release records live in src/firmware/FirmwareRelease.ts; REA adapters own the
CLI/report interpretation and lifecycle in src/firmware/. Caller-supplied
executables retain their actual launcher digest and unknown source revision;
version output alone does not establish source identity. REA does not bundle
extractors or download/install firmware engines during analysis.
On updates: inspect actual pinned CLI and report producers, preserve licenses, update gitlinks/release records, run report regressions and the real firmware lane. See firmware setup and coverage.