rea-agents 4.1.0 → 6.0.0

package/dist/server/sessionToolPolicies.js

@@ -1,2 +1,2 @@
-export { PROCESS_PROVIDER } from "../application/ProcessEvidence.js";
+export { PROCESS_PROVIDER } from "../application/process/ProcessEvidence.js";
 export { ARTIFACT_COMPARISON_PROVIDER, BUNDLE_COMPARISON_PROVIDER, CALL_PATH_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, FUNCTION_COMPARISON_PROVIDER, RECONSTRUCTION_PROVIDER, STATIC_RUNTIME_PROVIDER, } from "../application/InvestigationProviders.js";

package/dist/server/toolResult.js

@@ -3,7 +3,7 @@ import {} from "../domain/analysisErrorBase.js";
 /**
  * Serialize an application result as MCP text and structured content.
  * Shared error projection preserves actionable local diagnostics while omitting
- * raw causes and captured process output.
+ * raw cause objects; explicitly retained bounded command output stays visible.
  */
 export const toCallToolResult = (result, contract) => result.ok ? successResult(result.value, contract) : errorResult(result.error);
 const errorResult = (error) => {

package/dist/windows/WindowsOwnedProcess.js

@@ -45,7 +45,9 @@ export class WindowsOwnedProcess extends EventEmitter {
             .filter((entry) => entry[1] !== undefined)
             .map(([key, value]) => `${key}=${value}`);
         const line = [
-            quoteWindowsProcessArgument(command),
+            // cmd.exe parses its own command line rather than the CRT argv rules;
+            // its executable token must match the native drive-path representation.
+            quoteWindowsProcessArgument(command.replaceAll("/", "\\")),
             ...arguments_.map((value) => verbatim ? value : quoteWindowsProcessArgument(value)),
         ].join(" ");
         const launched = launchSchema.parse(this.#authority.call("process_spawn", [

package/install.sh

@@ -3,6 +3,10 @@ set -euo pipefail
 
 PACKAGE="rea-agents"
 REPOSITORY="morluto/rea"
+numeric_identifier='(0|[1-9][0-9]*)'
+prerelease_identifier="(${numeric_identifier}|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)"
+build_identifier='[0-9A-Za-z-]+'
+version_pattern="${numeric_identifier}\\.${numeric_identifier}\\.${numeric_identifier}(-${prerelease_identifier}(\\.${prerelease_identifier})*)?(\\+${build_identifier}(\\.${build_identifier})*)?"
 version="${REA_VERSION:-}"
 dry_run=false
 start_setup=true
@@ -67,14 +71,20 @@ if ! [[ "$_node_patch" =~ ^[0-9]+(\+[0-9A-Za-z.-]+)?$ ]] ||
 fi
 
 if [[ -n "$version" ]]; then
-  [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || fail "version must be an exact semantic version."
+  [[ "$version" =~ ^${version_pattern}$ ]] || fail "version must be an exact semantic version."
 else
   release_json="$(curl -fsSL --proto '=https' --tlsv1.2 --retry 3 -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPOSITORY/releases/latest")" || fail "the latest REA release could not be resolved. Check network access or pass --version VERSION, then retry."
   tag="$(printf '%s' "$release_json" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{const v=JSON.parse(s).tag_name;if(typeof v!=="string")process.exit(1);process.stdout.write(v)})' 2>/dev/null)" || fail "the release response was invalid. Retry later or pass --version VERSION."
-  [[ "$tag" =~ ^rea-agents-([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?)$ ]] || fail "the latest release tag was invalid. Retry later or pass --version VERSION."
+  [[ "$tag" =~ ^rea-agents-(${version_pattern})$ ]] || fail "the latest release tag was invalid. Retry later or pass --version VERSION."
   version="${BASH_REMATCH[1]}"
 fi
 
+# npm's exact-version resolver cleans build metadata from the requested version,
+# so it may install the base release and make the post-install identity check fail.
+if [[ "$version" =~ \+ ]]; then
+  fail "npm cannot install an exact version with build metadata. Pass a version without build metadata, then retry."
+fi
+
 prefix_args=()
 if [[ "$platform" == "Linux" ]]; then
   prefix_args=(--prefix "$HOME/.local")

package/native/windows/README.md

@@ -66,6 +66,11 @@ Windows failures retain their constraint, requested coordinate, Win32 code,
 and system message. Unsupported filesystems and reparse paths are distinct
 from OS access denial and missing packaged controls.
 
+Ordinary drive-absolute paths accept backslashes, forward slashes, or mixed
+separators. File identity retains the original requested spelling. Separator
+translation does not resolve dot components, repeated separators, or extend
+the supported device/UNC namespaces; existing admission checks still apply.
+
 The bearer-token descriptor remains under its immutable private lease until
 `runtime_close` on Windows; POSIX removes the descriptor after the bridge reads
 it. Job ownership guarantees process termination on owner death, not deletion

package/native/windows/build/manifest.json

@@ -1,9 +1,9 @@
 {
-  "packageVersion": "4.1.0",
+  "packageVersion": "6.0.0",
   "platform": "win32",
   "architecture": "x64",
   "abiVersion": 1,
   "nodeApiVersion": 8,
   "artifact": "rea-windows-x64.node",
-  "artifactSha256": "47a8d4d03d1cd764c68e8881aecb9cda63c8bdbc00f770e5b428f31debc83b90"
+  "artifactSha256": "9914815706dcd4ef94d01543e31cb0b20035e98d5011d4b4e7f8e509823c8b1d"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rea-agents",
   "mcpName": "io.github.morluto/rea",
-  "version": "4.1.0",
+  "version": "6.0.0",
   "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
@@ -42,10 +42,16 @@
     "dist",
     "install.sh",
     "bridge/hopper_bridge.py",
+    "bridge/native/NativeUIChildren.swift",
     "bridge/native/ReaNativeUI.swift",
+    "bridge/native/rea_lldb_tracer.py",
+    "bridge/process/ProcessRunTokenReader.swift",
+    "bridge/process/ProcessRunTokenReaderMain.swift",
     "bridge/ghidra/ReaGhidraBridge.java",
     "bridge/ghidra/ReaGhidraExtensions.java",
     "bridge/ghidra/ReaGhidraPrepareCom.java",
+    "bridge/android/ReaJadxBridge.java",
+    "bridge/mitmproxy/capture.py",
     "scripts/rea.mjs",
     "scripts/electron-active-hook.cjs",
     "scripts/electron-active-hook-boundaries.cjs",
@@ -57,18 +63,31 @@
     "LICENSE",
     "native/windows/build/manifest.json",
     "native/windows/build/rea-windows-x64.node",
-    "scripts/verify-windows-native-artifact.mjs"
+    "scripts/verify-windows-native-artifact.mjs",
+    "bridge/pwntools/layout.py",
+    "bridge/pwntools/layout_impl.py",
+    "third_party/pwntools/README.md",
+    "third_party/evmole/README.md",
+    "third_party/evmole/LICENSE",
+    "bridge/pwntools/decoder_runtime.py",
+    "bridge/pwntools/recorded_crash.py",
+    "bridge/pwntools/recorded_crash_impl.py",
+    "bridge/pwndbg/launch.py",
+    "bridge/pwndbg/launch_impl.py",
+    "bridge/pwndbg/core_context.py",
+    "third_party/pwndbg/README.md",
+    "third_party/pwndbg/LICENSE.md"
   ],
   "scripts": {
     "deps:check": "node scripts/check-dependency-install.mjs",
     "metadata:generate": "node scripts/generate-package-metadata.mjs",
     "metadata:check": "node scripts/generate-package-metadata.mjs --check",
     "mcp-registry:check": "node scripts/verify-mcp-registry-metadata.mjs",
-    "mcp-catalog:generate": "npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs",
+    "mcp-catalog:generate": "npm run build:cached",
     "mcp-catalog:check": "node scripts/generate-mcp-tool-catalog.mjs --check",
     "prebuild": "npm run deps:check && npm run metadata:check",
     "build": "node scripts/run-exclusive.mjs build npm run build:unlocked",
-    "build:unlocked": "node scripts/clean-build-output.mjs && tsc -p tsconfig.build.json",
+    "build:unlocked": "node scripts/clean-build-output.mjs && tsc -p tsconfig.build.json && node scripts/generate-mcp-tool-catalog.mjs",
     "precheck": "npm run deps:check",
     "check": "turbo run typecheck lint format:check knip metadata:check",
     "precheck:fast": "npm run deps:check",
@@ -81,11 +100,11 @@
     "check:pr": "turbo run typecheck lint format:check knip metadata:check test:run && npm run docs:check && npm run jscpd && npm run scan:todos",
     "precheck:ci": "npm run deps:check",
     "check:ci": "turbo run typecheck lint format:check knip metadata:check jscpd scan:todos",
-    "build:cached": "turbo run build",
+    "build:cached": "node scripts/check-dependency-install.mjs && turbo run build",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
-    "lint": "oxlint",
-    "lint:fix": "oxlint --fix",
+    "lint": "oxlint && npm run verify:module-boundaries",
+    "lint:fix": "oxlint --fix && npm run verify:module-boundaries",
     "knip": "knip",
     "jscpd": "jscpd src/ tests/",
     "scan:todos": "node scripts/scan-todos.mjs",
@@ -119,29 +138,33 @@
     "typecheck": "tsc --noEmit",
     "verify:test-temp-hygiene": "npm run build:cached && node scripts/verify-test-temp-hygiene.mjs",
     "verify:hopper": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper.mjs",
-    "verify:apple-dispatch": "npm run build:cached && node scripts/verify-apple-dispatch.mjs",
+    "verify:apple-dispatch": "npm run build:cached && node scripts/verify/apple/dispatch.mjs",
     "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
-    "verify:keyed-archive": "npm run build:cached && node scripts/verify-keyed-archive.mjs",
+    "verify:keyed-archive": "npm run build:cached && node scripts/verify/apple/keyed-archive.mjs",
+    "verify:macos-bundle": "npm run build:cached && node scripts/verify/apple/macos-bundle.mjs",
     "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
     "verify:ida": "npm run build:cached && node scripts/verify-real-ida.mjs",
     "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
     "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
     "verify:ghidra:com": "npm run build:cached && node scripts/verify-real-ghidra-com.mjs",
     "verify:ghidra:aarch64-jump-table": "npm run build:cached && node scripts/verify-real-ghidra.mjs --aarch64-jump-table",
-    "verify:interface-builder": "npm run build:cached && node scripts/verify-interface-builder.mjs",
+    "verify:interface-builder": "npm run build:cached && node scripts/verify/apple/interface-builder.mjs",
     "verify:ghidra:cross-format": "npm run build:cached && node scripts/verify-real-ghidra.mjs --cross-format",
     "verify:ghidra:windows": "npm run build:cached && npm run build:ghidra-windows-fixture && node scripts/verify-real-ghidra-windows.mjs",
     "verify:browser": "npm run build:cached && node scripts/verify-real-browser.mjs",
+    "verify:browser:dom": "node scripts/verify-browser-dom-destinations.mjs",
+    "verify:browser:network": "npm run build:cached && node scripts/verify-browser-network.mjs",
     "verify:electron": "npm run build:cached && node scripts/verify-real-electron.mjs",
-    "verify:inspector": "npm run build:cached && node scripts/verify-real-javascript-runtime-observation.mjs",
-    "verify:javascript-runtime": "npm run build:cached && node scripts/verify-local-javascript-runtime.mjs",
-    "verify:javascript:digests": "npm run build:cached && node scripts/verify-large-javascript-digests.mjs",
-    "verify:application-workflows": "npm run build:cached && node scripts/verify-local-application-workflows.mjs",
-    "verify:managed": "npm run build:cached && node scripts/verify-managed-conformance.mjs",
-    "verify:firmware": "npm run build:cached && node scripts/verify-real-firmware.mjs",
-    "fixtures:firmware": "node scripts/generate-firmware-fixtures.mjs",
-    "verify:android": "npm run build:cached && node scripts/verify-real-android.mjs",
-    "fixtures:android": "node scripts/fetch-android-fixtures.mjs",
+    "verify:inspector": "npm run build:cached && node scripts/verify/inspector/runtime-observation.mjs",
+    "verify:javascript-runtime": "npm run build:cached && node scripts/verify/javascript/runtime-observation.mjs",
+    "verify:javascript:digests": "npm run build:cached && node scripts/verify/javascript/digests.mjs",
+    "verify:javascript:output": "npm run build:cached && node scripts/verify/javascript/output.mjs",
+    "verify:application-workflows": "npm run build:cached && node scripts/verify/javascript/application-workflows.mjs",
+    "verify:managed": "npm run build:cached && node scripts/verify/managed/conformance.mjs",
+    "verify:firmware": "npm run build:cached && node scripts/verify/firmware/analysis.mjs",
+    "fixtures:firmware": "node scripts/fixtures/firmware/generate.mjs",
+    "verify:android": "npm run build:cached && node scripts/verify/android/analysis.mjs",
+    "fixtures:android": "node scripts/fixtures/android/fetch.mjs",
     "verify:agent": "npm run build:cached && node scripts/verify-agent-experience.mjs",
     "verify:hopper:linux": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper-linux.mjs",
     "verify:setup:linux": "npm run build:cached && node scripts/verify-linux-setup-e2e.mjs",
@@ -156,14 +179,18 @@
     "config:print": "node scripts/print-mcp-config.mjs",
     "evidence:generate": "npm run build:cached && node scripts/generate-completion-ledger.mjs",
     "evidence:check": "npm run build:cached && node scripts/generate-completion-ledger.mjs --check",
+    "docs:dev": "vitepress dev docs",
+    "docs:build": "vitepress build docs",
+    "docs:preview": "vitepress preview docs",
     "docs:generate": "node scripts/run-exclusive.mjs docs npm run docs:generate:unlocked",
-    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-mcp-tool-catalog.mjs && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && node scripts/generate-error-schema.mjs",
+    "docs:generate:unlocked": "npm run metadata:generate && npm run build:cached && node scripts/generate-skill-metadata.mjs && node scripts/generate-product-catalog.mjs && node scripts/generate-completion-ledger.mjs && node scripts/generate-error-schema.mjs",
     "docs:check": "node scripts/run-exclusive.mjs docs turbo run docs:check:built",
     "docs:check:built": "node scripts/generate-package-metadata.mjs --check && node scripts/generate-mcp-tool-catalog.mjs --check && node scripts/generate-skill-metadata.mjs --check && node scripts/generate-product-catalog.mjs --check && node scripts/generate-completion-ledger.mjs --check && node scripts/check-doc-facts.mjs && node scripts/generate-error-schema.mjs --check",
     "docs:error-schema": "npm run build:cached && node scripts/generate-error-schema.mjs",
     "prepack": "node scripts/prepack.mjs",
     "prepare": "node scripts/prepare.mjs",
-    "verify:asset-catalog": "npm run build:cached && node scripts/verify-asset-catalog.mjs",
+    "verify:asset-catalog": "npm run build:cached && node scripts/verify/apple/asset-catalog.mjs",
+    "verify:native-calls": "npm run build:cached && node scripts/verify-native-calls.mjs",
     "verify:native-ui:permissions": "npm run build:cached && node scripts/verify-native-ui.mjs --allow-permission-denial",
     "test:focused": "node scripts/run-development-tests.mjs focused",
     "build:windows-native": "node scripts/build-windows-native.mjs",
@@ -173,7 +200,18 @@
     "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs",
     "build:ghidra:nativeaot": "node scripts/build-ghidra-nativeaot.mjs",
     "build:fixtures:nativeaot": "node scripts/generate-nativeaot-fixtures.mjs",
-    "verify:ghidra:nativeaot": "npm run build:cached && node scripts/verify-real-ghidra-nativeaot.mjs"
+    "verify:ghidra:nativeaot": "npm run build:cached && node scripts/verify-real-ghidra-nativeaot.mjs",
+    "verify:browser:scripts": "npm run build:cached && node scripts/verify-browser-scripts.mjs",
+    "verify:browser:modules": "npm run build:cached && node scripts/verify-browser-modules.mjs",
+    "verify:test-discovery": "node scripts/verify-test-discovery.mjs",
+    "verify:javascript:recovery": "node scripts/verify/javascript/recovery.mjs",
+    "verify:module-boundaries": "node scripts/verify-module-boundaries.mjs",
+    "verify:browser:source-maps": "npm run build:cached && node scripts/verify-browser-source-maps.mjs",
+    "verify:browser:runtime": "npm run build:cached && node scripts/verify-browser-runtime.mjs",
+    "verify:web:network-captures": "npm run build:cached && node scripts/verify-web-network-captures.mjs",
+    "verify:binary:layout": "npm run build:cached && node scripts/verify-binary-layout.mjs",
+    "verify:evm:interface": "npm run build:cached && node scripts/verify-evm-interface.mjs",
+    "verify:recorded:crash": "npm run build:cached && node scripts/verify-recorded-crash.mjs"
   },
   "lint-staged": {
     "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [
@@ -193,22 +231,33 @@
     "@modelcontextprotocol/server": "2.3.1",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/headless": "6.0.0",
-    "@zip.js/zip.js": "2.8.26",
+    "@zip.js/zip.js": "2.15.0",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
     "canonicalize": "3.0.0",
     "cross-spawn": "7.0.6",
     "diff": "9.0.0",
+    "har-schema": "2.0.0",
     "ignore": "7.0.6",
     "incur": "0.6.1",
     "isomorphic-git": "1.38.7",
     "jsonc-parser": "3.3.1",
+    "lossless-json": "4.3.1",
+    "parse5": "8.0.1",
     "pino": "10.4.0",
     "playwright-core": "1.58.2",
     "plist": "5.0.0",
     "semver": "7.8.5",
-    "smol-toml": "1.7.0",
+    "smol-toml": "1.9.0",
     "write-file-atomic": "7.0.0",
     "ws": "8.21.0",
-    "zod": "4.4.3"
+    "zod": "4.4.3",
+    "evmole": "0.9.3"
+  },
+  "overrides": {
+    "vitepress": {
+      "vite": "6.4.4"
+    }
   },
   "devDependencies": {
     "@fast-check/vitest": "0.5.0",
@@ -218,7 +267,6 @@
     "@types/write-file-atomic": "4.0.3",
     "@types/ws": "8.18.1",
     "@vitest/coverage-v8": "5.0.3",
-    "ajv": "8.20.0",
     "husky": "9.1.7",
     "jscpd": "5.0.12",
     "knip": "6.39.0",
@@ -227,6 +275,7 @@
     "oxlint": "1.87.0",
     "turbo": "2.11.7",
     "typescript": "7.0.2",
+    "vitepress": "1.6.4",
     "vitest": "5.0.3",
     "yaml": "2.9.0"
   }

package/scripts/hopper-demo-x11.py

@@ -20,11 +20,14 @@ import time
 # Keep this digest aligned with LinuxHopper.ts and rerun real-Hopper verification
 # before accepting another vendor build.
 SUPPORTED_HOPPER_SHA256 = {
-    "0294ced141cc373468ee22d8343e7dac41980cb05a937994ca81c9f09afe7ded"
+    "0294ced141cc373468ee22d8343e7dac41980cb05a937994ca81c9f09afe7ded",
+    "1339f9e58377442b0c6fcb0dfc3cec20d593cc557408521fad9a00dbc6b8da13",
 }
 EXPECTED_SCREEN = (1280, 1024)
-EXPECTED_DIALOG = (189, 370, 901, 284)
-DEMO_CLICK = (305, 632)
+DIALOG_TITLES = {"Registration", "Registration — Hopper Disassembler"}
+HOPPER_WINDOW_TITLE = "Hopper Disassembler"
+DEMO_CLICK_LEFT = 116
+DEMO_CLICK_BOTTOM = 22
 PRIVATE_DISPLAY_UNAVAILABLE = 70
 X11_AUTHORIZATION_FAILED = 71
 UNSUPPORTED_HOPPER_BUILD = 72
@@ -196,6 +199,47 @@ def windows(x11: ctypes.CDLL, display: int, root: int) -> list[tuple[int, int, i
     return found
 
 
+def window_title(x11: ctypes.CDLL, display: int, window: int) -> str | None:
+    title = ctypes.c_char_p()
+    if not x11.XFetchName(display, window, ctypes.byref(title)) or not title.value:
+        return None
+    try:
+        return title.value.decode("utf-8", "replace")
+    finally:
+        x11.XFree(ctypes.cast(title, ctypes.c_void_p))
+
+
+def window_transient_for(
+    x11: ctypes.CDLL, display: int, window: int
+) -> int | None:
+    parent = ctypes.c_ulong()
+    if not x11.XGetTransientForHint(display, window, ctypes.byref(parent)):
+        return None
+    return int(parent.value)
+
+
+def find_demo_dialog(
+    x11: ctypes.CDLL,
+    display: int,
+    observed: list[tuple[int, int, int, int, int]],
+) -> tuple[int, int, int, int, int] | None:
+    for candidate in observed:
+        window = candidate[0]
+        if window_title(x11, display, window) not in DIALOG_TITLES:
+            continue
+        parent = window_transient_for(x11, display, window)
+        if parent is None:
+            continue
+        if window_title(x11, display, parent) == HOPPER_WINDOW_TITLE:
+            return candidate
+    return None
+
+
+def demo_click(dialog: tuple[int, int, int, int, int]) -> tuple[int, int]:
+    _window, x, y, _width, height = dialog
+    return x + DEMO_CLICK_LEFT, y + height - DEMO_CLICK_BOTTOM
+
+
 def configure_x11(x11: ctypes.CDLL, xtst: ctypes.CDLL) -> None:
     window_pointer = ctypes.POINTER(ctypes.c_ulong)
     x11.XOpenDisplay.argtypes = [ctypes.c_char_p]
@@ -212,6 +256,18 @@ def configure_x11(x11: ctypes.CDLL, xtst: ctypes.CDLL) -> None:
         ctypes.POINTER(XWindowAttributes),
     ]
     x11.XGetWindowAttributes.restype = ctypes.c_int
+    x11.XFetchName.argtypes = [
+        ctypes.c_void_p,
+        ctypes.c_ulong,
+        ctypes.POINTER(ctypes.c_char_p),
+    ]
+    x11.XFetchName.restype = ctypes.c_int
+    x11.XGetTransientForHint.argtypes = [
+        ctypes.c_void_p,
+        ctypes.c_ulong,
+        ctypes.POINTER(ctypes.c_ulong),
+    ]
+    x11.XGetTransientForHint.restype = ctypes.c_int
     x11.XQueryTree.argtypes = [
         ctypes.c_void_p,
         ctypes.c_ulong,
@@ -644,6 +700,7 @@ def run_launch(args: argparse.Namespace) -> int:
 
         deadline = time.monotonic() + 10
         observed: list[tuple[int, int, int, int, int]] = []
+        dialog: tuple[int, int, int, int, int] | None = None
         while time.monotonic() < deadline:
             if socket.exists():
                 x11.XCloseDisplay(display)
@@ -659,7 +716,8 @@ def run_launch(args: argparse.Namespace) -> int:
                     "owned Hopper process exited",
                 )
             observed = windows(x11, display, root)
-            if any(window[1:] == EXPECTED_DIALOG for window in observed):
+            dialog = find_demo_dialog(x11, display, observed)
+            if dialog is not None:
                 break
             time.sleep(0.1)
         else:
@@ -675,8 +733,10 @@ def run_launch(args: argparse.Namespace) -> int:
                 "expected Hopper demo dialog not found",
             )
 
+        assert dialog is not None
+        click_x, click_y = demo_click(dialog)
         input_results = (
-            xtst.XTestFakeMotionEvent(display, -1, DEMO_CLICK[0], DEMO_CLICK[1], 0),
+            xtst.XTestFakeMotionEvent(display, -1, click_x, click_y, 0),
             xtst.XTestFakeButtonEvent(display, 1, True, 0),
             xtst.XTestFakeButtonEvent(display, 1, False, 0),
         )
@@ -695,9 +755,8 @@ def run_launch(args: argparse.Namespace) -> int:
     finally:
         if display is not None:
             x11.XCloseDisplay(display)
-        if child is not None and child.poll() is None:
-            child.terminate()
-            child.wait()
+        if child is not None:
+            stop_process(child)
         stop_process(xvfb)
         capture.close()
 

package/scripts/rea.mjs

@@ -19,7 +19,7 @@ const runtimeFiles = isMcpMode
   ? ["dist/main.js"]
   : isMcpDoctorMode
     ? ["dist/main.js", "dist/mcpDoctor.js"]
-    : ["dist/cli.js", "dist/cliOutput.js"];
+    : ["dist/cli.js", "dist/cliOutput.js", "dist/cli/streamedJsonOutput.js"];
 
 if (!(await compiledRuntimeExists(runtimeFiles))) {
   process.stderr.write(
@@ -39,8 +39,11 @@ if (!(await compiledRuntimeExists(runtimeFiles))) {
   process.exitCode = result.exitCode;
 } else {
   const { createCli } = await import("../dist/cli.js");
+  const { createStreamedCliJsonOutput } =
+    await import("../dist/cli/streamedJsonOutput.js");
   const {
     renderCliOutputArgumentError,
+    renderEmptyFilteredCliOutput,
     sanitizeCliOutput,
     validateCliOutputArguments,
   } = await import("../dist/cliOutput.js");
@@ -49,9 +52,22 @@ if (!(await compiledRuntimeExists(runtimeFiles))) {
     process.stdout.write(renderCliOutputArgumentError(outputArguments));
     process.exitCode = 1;
   } else {
-    await createCli().serve(args, {
-      stdout: (output) => process.stdout.write(sanitizeCliOutput(output)),
+    let wroteOutput = false;
+    const resultOutput = createStreamedCliJsonOutput(args, process.stdout);
+    await createCli(process.env, resultOutput).serve(args, {
+      stdout: (output) => {
+        if (resultOutput?.handled) {
+          if (resultOutput.failed)
+            process.stderr.write(sanitizeCliOutput(output));
+          return;
+        }
+        const sanitized = sanitizeCliOutput(output);
+        if (sanitized.length > 0) wroteOutput = true;
+        process.stdout.write(sanitized);
+      },
     });
+    if (!wroteOutput && !resultOutput?.handled)
+      process.stdout.write(renderEmptyFilteredCliOutput(args) ?? "");
   }
 }
 

package/skills/reverse-engineer-anything/SKILL.md

@@ -2,9 +2,9 @@
 name: reverse-engineer-anything
 description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "26"
-  tool_count: 125
-  catalog_digest: "ed9c36900e9223561d38ba30a44921f4ff101d5eca989920f9edc9dc91df470b"
+  version: "33"
+  tool_count: 139
+  catalog_digest: "4c5f67d076baf821b5cb6d6fb2cc0f6c274e96b627b85b892577760a6f71ab1a"
 ---
 
 # REA
@@ -93,7 +93,27 @@ explicit path or endpoint and do not need it.
   consult the NativeAOT workflow in `references/native-and-artifacts.md` for
   optional metadata recovery and its supported host/layout boundary.
 - User-owned browser page already open: `list_browser_targets`.
+- Retained HAR/native mitmproxy capture: `inspect_web_network_capture`. Select
+  original record ordinals when useful; inspect producer fields and byte/number
+  sidecars without fetching recorded URLs or claiming live attribution. See
+  [historical captures](https://github.com/morluto/rea/blob/main/docs/web-network-captures.md) for the exact upstream
+  profile and credential exclusions.
 - User-owned Electron runtime already open: `list_electron_targets`.
+- Explicit local EVM bytecode carrier: `inspect_evm_interface` with caller-selected
+  `raw` or `hex` encoding. Preserve carrier/decoded digests and treat selectors,
+  argument strings and mutability as inferred candidates; this performs no chain
+  lookup or target execution. See the
+  [EVM bytecode guide](https://github.com/morluto/rea/blob/main/docs/evm-bytecode.md).
+- Explicit Linux ELF file for offline layout, symbols, relocations or static
+  mitigation evidence: `inspect_binary_layout`. This target-free operation uses
+  caller-supplied pwntools without opening a disassembler database. Preserve its
+  raw locations and inference/coverage limits; see the
+  [offline binary guide](https://github.com/morluto/rea/blob/main/docs/binary-diagnostics.md).
+- Supplied Linux x86-64 ELF core: `inspect_recorded_crash`. Read every recorded
+  thread, raw note and source-bound register without opening a live target.
+  Historical PIDs do not select live processes. Request `include_debugger_context`
+  only when core-only mapping candidates help; see the
+  [recorded crash guide](https://github.com/morluto/rea/blob/main/docs/recorded-crashes.md).
 - Native executable, library, or analysis database: `open_binary`, then
   use focused analysis tools directly; call `binary_overview` when metadata or
   inventory context is useful and available from the selected provider.

package/skills/reverse-engineer-anything/references/android-applications.md

@@ -1,7 +1,7 @@
 # Android application artifacts
 
-Use the connected server's advertised Android tools. Repository main includes
-this family; npm 4.0.1 does not. A skill installation alone cannot add it to an
+Use the connected server's advertised Android tools. Repository main and npm
+4.1.0 include this family. A skill installation alone cannot add it to an
 older server.
 
 Start with `inspect_android_package` on the caller's APK path for package

package/skills/reverse-engineer-anything/references/javascript-applications.md

@@ -44,7 +44,7 @@ When advertised by the connected server, application trace and compare tools
 accept complete inline Evidence or
 `{"kind":"retained-evidence","evidence_id":"ev_<64 lowercase hex characters>"}`
 for their application input (`application`, or `left`/`right`). This notation is
-a template: replace it with the actual returned ID. npm 4.0.1 accepts only full
+a template: replace it with the actual returned ID. Versions before 4.1.0 accept only full
 inline Evidence. Use the exact ID
 returned by the producer on the same MCP connection. Resolution does not run
 analysis or select a provider; findings remain inline. Native observation