[Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026)

TL;DR: 304 open pull requests can't merge yet. Each has a conflict, a failing check, or both. Their authors may already be working on them.

Current limitation

Many open pull requests have a merge conflict or a failing check. In a long queue they are easy to miss. This tracker lists them in one place. It is meant to help maintainers and contributors see the whole picture.

Desired outcome and success criteria

Each line below is an open pull request, not a draft, that has a merge conflict, a failing check, or both. Lines are grouped by days since the last activity, then by what blocks the merge. Authors may already be working on these. Nothing here asks for speed, and nothing here is a request to anyone.

A tag after a line says what blocks the merge. (conflicts) means the branch conflicts with main. (CI) means at least one check is failing. (both) means it has both.

0 to 2 days since the last activity (151)

Merge conflict only (68)

feat(ghidra): verify and pin the 32-bit ARM (armhf) lane #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts)
feat(process): add owned debugger shutdown lifecycle #1959 feat(process): add owned debugger shutdown lifecycle (conflicts)
fix(gdb)!: preserve interrupt and provider cleanup ownership #1961 fix(gdb)!: preserve interrupt and provider cleanup ownership (conflicts)
feat(javascript): resolve package exports and imports wildcard patterns #2018 feat(javascript): resolve package exports and imports wildcard patterns (conflicts)
docs(readme): add Hinglish translation #2043 docs(readme): add Hinglish translation (conflicts)
feat(browser): retain worker source and runtime evidence #2068 feat(browser): retain worker source and runtime evidence (conflicts)
docs(i18n): add Bangla (bn) README and website translation #2142 docs(i18n): add Bangla (bn) README and website translation (conflicts)
feat(angr): add angr MCP analysis provider #2418 feat(angr): add angr MCP analysis provider (conflicts)
fix(wasm): raise the WABT output budget to 128 MiB #2694 fix(wasm): raise the WABT output budget to 128 MiB (conflicts)
feat(electron): report custom URL protocol registrations #2978 feat(electron): report custom URL protocol registrations (conflicts)
feat(evm): inspect exact Solidity compiler artifacts #3024 feat(evm): inspect exact Solidity compiler artifacts (conflicts)
feat(mcp): scope advertised tools by family through REA_MCP_TOOL_FAMILIES #3026 feat(mcp): scope advertised tools by family through REA_MCP_TOOL_FAMILIES (conflicts)
feat(providers): enable agent-aware deep provider selection #3090 feat(providers): enable agent-aware deep provider selection (conflicts)
feat(ghidra): persistent project cache with cross-session identity #3531 feat(ghidra): persistent project cache with cross-session identity (conflicts)
fix(javascript): keep parent budget exhaustion from advising more memory #3550 fix(javascript): keep parent budget exhaustion from advising more memory (conflicts)
fix(android): classify a pre-handshake JADX heap shortage as a resource limit #3573 fix(android): classify a pre-handshake JADX heap shortage as a resource limit (conflicts)
feat(android)!: expose method access flags and absent body reasons #3585 feat(android)!: expose method access flags and absent body reasons (conflicts)
feat(doctor): diagnose firmware integration readiness #3899 feat(doctor): diagnose firmware integration readiness (conflicts)
fix(cli): flush piped diagnostics before exiting #4038 fix(cli): flush piped diagnostics before exiting (conflicts)
feat(clients): register ggcode during setup #4039 feat(clients): register ggcode during setup (conflicts)
feat(radare2): prototype transports and analyst capabilities #4148 feat(radare2): prototype transports and analyst capabilities (conflicts)
feat(analysis-view): page retained browser scenario steps and text #4163 feat(analysis-view): page retained browser scenario steps and text (conflicts)
feat(ida): verify headless caller relationships with call graphs #4200 feat(ida): verify headless caller relationships with call graphs (conflicts)
feat(ghidra): report blocks the decompiler removed as unreachable #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts)
fix(javascript): invalidate Webpack getters through loader aliases #4355 fix(javascript): invalidate Webpack getters through loader aliases (conflicts)
feat(call-path): trace multiple goals and report backward roots #4417 feat(call-path): trace multiple goals and report backward roots (conflicts)
fix(browser): keep Termux Chromium profiles on a writable temp directory #4519 fix(browser): keep Termux Chromium profiles on a writable temp directory (conflicts)
feat(browser-extension): inspect declared CRX and XPI manifest surfaces #4554 feat(browser-extension): inspect declared CRX and XPI manifest surfaces (conflicts)
feat(clients): register Kiro during setup #4618 feat(clients): register Kiro during setup (conflicts)
feat(ida): support the official Hex-Rays IDA MCP headlessly #4813 feat(ida): support the official Hex-Rays IDA MCP headlessly (conflicts)
feat(skill): add opt-in Coordo evidence handoffs #4831 feat(skill): add opt-in Coordo evidence handoffs (conflicts)
fix(call-path): bound inline shortest-path enumeration #4984 fix(call-path): bound inline shortest-path enumeration (conflicts)
feat(reconstruction)!: require failing verifier controls #4991 feat(reconstruction)!: require failing verifier controls (conflicts)
fix(browser): reclaim scenario profiles whose owner is gone #4995 fix(browser): reclaim scenario profiles whose owner is gone (conflicts)
feat(skill): coordinate evidence-led REA investigations #5000 feat(skill): coordinate evidence-led REA investigations (conflicts)
fix(mcp): support retained pseudocode summaries and paging #5046 fix(mcp): support retained pseudocode summaries and paging (conflicts)
test(electron): isolate active provider lifecycle tests #5116 test(electron): isolate active provider lifecycle tests (conflicts)
docs: add REA guide and architecture patterns aligned to 6.7.0 #5197 docs: add REA guide and architecture patterns aligned to 6.7.0 (conflicts)
Fix #4856: Prevent call stack overflow on large TOML files #5211 Fix [Bug] TOML client setup and uninstall fail on valid documents with many preserved lines #4856: Prevent call stack overflow on large TOML files (conflicts)
fix: allow Tiny PE e_lfanew inside DOS header #5216 fix: allow Tiny PE e_lfanew inside DOS header (conflicts)
test(ghidra): strengthen raw-binary, firmware, and instruction flow verification #5263 test(ghidra): strengthen raw-binary, firmware, and instruction flow verification (conflicts)
fix(javascript): keep var reads before their declarator unknown #5303 fix(javascript): keep var reads before their declarator unknown (conflicts)
feat(managed): show readable type names in member signatures #5309 feat(managed): show readable type names in member signatures (conflicts)
feat(firmware): map STM32, GD32, and ESP32 SoC peripherals and auto-detect target platform #5361 feat(firmware): map STM32, GD32, and ESP32 SoC peripherals and auto-detect target platform (conflicts)
feat(android): add optional DroidASC class discovery backend #5380 feat(android): add optional DroidASC class discovery backend (conflicts)
fix(process): reschedule poll on failure and bound stream buffer #5558 fix(process): reschedule poll on failure and bound stream buffer (conflicts)
fix(browser): propagate timeout to all CDP calls and enforce full IHDR chunk check #5560 fix(browser): propagate timeout to all CDP calls and enforce full IHDR chunk check (conflicts)
fix(firmware): reclassify output-directory admission failures as invalid_request #5902 fix(firmware): reclassify output-directory admission failures as invalid_request (conflicts)
fix(setup): preserve concurrent skill edits during rollback #5936 fix(setup): preserve concurrent skill edits during rollback (conflicts)
fix(managed): report malformed PE layout during member comparison as invalid input (#6075) #6145 fix(managed): report malformed PE layout during member comparison as invalid input ([Bug] compare-managed-members reports malformed PE input as unreadable output #6075) (conflicts)
fix(javascript): bound member-mutation traversal and add max-heap-mb to compare-application-versions (#6127) #6146 fix(javascript): bound member-mutation traversal and add max-heap-mb to compare-application-versions (analyze-javascript-application exhausts a 6 GiB worker heap on a 233 KB file #6127) (conflicts)
feat: extended artifact formats, Gzip reader, Python/PyInstaller, PE inspector, JVM reader, Minidump parser, and platform portability #6147 feat: extended artifact formats, Gzip reader, Python/PyInstaller, PE inspector, JVM reader, Minidump parser, and platform portability (conflicts)
fix(ghidra): name procedure-listing commands when name resolution fails #6177 fix(ghidra): name procedure-listing commands when name resolution fails (conflicts)
fix(javascript): include slotless accesses in property traces #6190 fix(javascript): include slotless accesses in property traces (conflicts)
fix(javascript): keep selected-input filesystem failures typed #6245 fix(javascript): keep selected-input filesystem failures typed (conflicts)
feat(harmony): add xpanda-backed Ark bytecode analysis #6288 feat(harmony): add xpanda-backed Ark bytecode analysis (conflicts)
test(correlation): cover contradictory findings and retained evidence #6307 test(correlation): cover contradictory findings and retained evidence (conflicts)
fix(reconstruction)!: require distinct contents for fixture controls #6367 fix(reconstruction)!: require distinct contents for fixture controls (conflicts)
fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema #6389 fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema (conflicts)
feat(mcp): add opt-in release notifications #6477 feat(mcp): add opt-in release notifications (conflicts)
fix(discovery): advertise attached IDA navigation effects #7017 fix(discovery): advertise attached IDA navigation effects (conflicts)
feat(binary-ninja-headless): add owned headless Binary Ninja provider #7041 feat(binary-ninja-headless): add owned headless Binary Ninja provider (conflicts)
feat(mcp): advertise bounded output schemas in a compact profile #7054 feat(mcp): advertise bounded output schemas in a compact profile (conflicts)
feat(native): make the function-matching allowance a runtime setting #7112 feat(native): make the function-matching allowance a runtime setting (conflicts)
fix(mcp): preserve non-array element types in reduced compact array items #7114 fix(mcp): preserve non-array element types in reduced compact array items (conflicts)
feat(browser): validate browser scenarios with --dry-run before launching #7116 feat(browser): validate browser scenarios with --dry-run before launching (conflicts)
fix(cli): validate environment-serve --port as decimal text #7156 fix(cli): validate environment-serve --port as decimal text (conflicts)
fix(artifacts): name the failing side in compare_artifacts input errors #7157 fix(artifacts): name the failing side in compare_artifacts input errors (conflicts)

Failing CI only (42)

fix(javascript): preserve Vite dependency values and indexes #1840 fix(javascript): preserve Vite dependency values and indexes (CI)
feat(setup): support CodeBuddy as a setup client #2492 feat(setup): support CodeBuddy as a setup client (CI)
feat(ghidra): report computed branches without a recovered jump table #2977 feat(ghidra): report computed branches without a recovered jump table (CI)
feat(adb): add UI Automator discovery, waits and actions #3004 feat(adb): add UI Automator discovery, waits and actions (CI)
test(artifact): cover multiple inspection inventory substeps #3463 test(artifact): cover multiple inspection inventory substeps (CI)
feat(reverse): add radare2 one-shot commands and analysis sessions #3521 feat(reverse): add radare2 one-shot commands and analysis sessions (CI)
fix(reference): preserve physical symlink targets #3562 fix(reference): preserve physical symlink targets (CI)
test(process): cover endpoint-only port normalization #4036 test(process): cover endpoint-only port normalization (CI)
test(adb): bind snapshot cleanup fixtures to runtime ownership #4741 test(adb): bind snapshot cleanup fixtures to runtime ownership (CI)
fix(javascript): attribute call-path unknowns only where the walk can reach Electron #4915 fix(javascript): attribute call-path unknowns only where the walk can reach Electron (CI)
Fix typo in README and add repository description #4969 Fix typo in README and add repository description (CI)
ci(windows): run the caller path separator regression in the Windows lane #4988 ci(windows): run the caller path separator regression in the Windows lane (CI)
feat(experiments): add MCP tool-selection eval harness #5024 feat(experiments): add MCP tool-selection eval harness (CI)
fix(cli): load Evidence record pairs from JSON files #5129 fix(cli): load Evidence record pairs from JSON files (CI)
docs:增加文本中部分文字(fixes #1) #5143 docs:增加文本中部分文字(fixes Add dynamic binary sessions and guided onboarding #1) (CI)
feat(clients): support Antigravity CLI with shared-registration lifecycle coverage #5145 feat(clients): support Antigravity CLI with shared-registration lifecycle coverage (CI)
fix(adb): reuse shared PNG header validation #5172 fix(adb): reuse shared PNG header validation (CI)
test(mcp): normalize server identity fixture paths on Windows #5213 test(mcp): normalize server identity fixture paths on Windows (CI)
fix(browser): bound initial navigation when command_timeout_ms is omitted #5285 fix(browser): bound initial navigation when command_timeout_ms is omitted (CI)
fix: correct cmd.exe /s /c argument quoting for Windows batch launchers #5317 fix: correct cmd.exe /s /c argument quoting for Windows batch launchers (CI)
fix(ghidra): raise decompiler max payload cap for very large functions #5325 fix(ghidra): raise decompiler max payload cap for very large functions (CI)
Revise tagline in README for emphasis #5389 Revise tagline in README for emphasis (CI)
fix(browser): explain target changes without suggesting configuration repair #6199 fix(browser): explain target changes without suggesting configuration repair (CI)
test(javascript): order the caller abort by frame, not wall clock #6294 test(javascript): order the caller abort by frame, not wall clock (CI)
test(javascript): cover Request endpoint identity and provenance #6365 test(javascript): cover Request endpoint identity and provenance (CI)
fix(browser): return completed scenario capture when cleanup is unconfirmed #6381 fix(browser): return completed scenario capture when cleanup is unconfirmed (CI)
feat(cli): add provider-free 'profile' command with per-fact confidence #6396 feat(cli): add provider-free 'profile' command with per-fact confidence (CI)
fix(pyinstaller): leave PE carrier binary members unmarked #6730 fix(pyinstaller): leave PE carrier binary members unmarked (CI)
fix(ghidra): admit newer 12.x releases as compatible builds #6924 fix(ghidra): admit newer 12.x releases as compatible builds (CI)
fix(prompts): include existing static artifact investigation routes #6925 fix(prompts): include existing static artifact investigation routes (CI)
REA ENGINEER #6940 REA ENGINEER (CI)
fix(process): settle exits during Linux credential observation #6983 fix(process): settle exits during Linux credential observation (CI)
ci(real-go-binary): pin Go 1.26.10 #6992 ci(real-go-binary): pin Go 1.26.10 (CI)
feat(workflows): expose guided prompts through CLI and MCP #6995 feat(workflows): expose guided prompts through CLI and MCP (CI)
feat(guidance): search bundled REA workflow guidance #6996 feat(guidance): search bundled REA workflow guidance (CI)
test(domain): kill surviving mutants in redactExplicitText #7005 test(domain): kill surviving mutants in redactExplicitText (CI)
test(domain): pin artifactExpansionBudget constants and floor boundary #7006 test(domain): pin artifactExpansionBudget constants and floor boundary (CI)
feat(browser): add passive CSS variables and design token extraction #7030 feat(browser): add passive CSS variables and design token extraction (CI)
test(inspector): keep the target cancellation fixture path exactly reported #7056 test(inspector): keep the target cancellation fixture path exactly reported (CI)
perf(javascript): reuse semantic coverage projections #7096 perf(javascript): reuse semantic coverage projections (CI)
feat(ghidra): admit DOS MZ targets on Windows P0 #7144 feat(ghidra): admit DOS MZ targets on Windows P0 (CI)
fix: treat other-user-namespace processes as withheld during cleanup #7145 fix: treat other-user-namespace processes as withheld during cleanup (CI)

Merge conflict and failing CI (41)

feat(javascript): add proof-gated js-redox deobfuscation #1815 feat(javascript): add proof-gated js-redox deobfuscation (both)
fix(javascript): preserve builtin effects at their read sites #2041 fix(javascript): preserve builtin effects at their read sites (both)
docs: add Central Kurdish (Sorani) README translation #2268 docs: add Central Kurdish (Sorani) README translation (both)
feat(ghidra): select a pre-imported project with -process #2358 feat(ghidra): select a pre-imported project with -process (both)
feat(wasm): decode WebAssembly components offline #2406 feat(wasm): decode WebAssembly components offline (both)
docs: organize canonical documentation layout and verify new pages #2791 docs: organize canonical documentation layout and verify new pages (both)
feat(browser): derive API surfaces from retained SAZ captures #2884 feat(browser): derive API surfaces from retained SAZ captures (both)
docs: add Bangla (বাংলা) README translation #3657 docs: add Bangla (বাংলা) README translation (both)
fix(flutter): inspect the renamed Dart AOT snapshot layout #3662 fix(flutter): inspect the renamed Dart AOT snapshot layout (both)
fix(android): disable JVM perf data for JADX Java launches #3772 fix(android): disable JVM perf data for JADX Java launches (both)
fix(reconstruction): evaluate declared dependency closure and risks #3802 fix(reconstruction): evaluate declared dependency closure and risks (both)
feat(procmon): read saved Process Monitor XML and CSV exports as Evidence #3967 feat(procmon): read saved Process Monitor XML and CSV exports as Evidence (both)
feat(unreal): inspect Unreal pak footers and indexes #4362 feat(unreal): inspect Unreal pak footers and indexes (both)
fix(ghidra): admit recordless legacy MIPS32 carves missing section tables #4532 fix(ghidra): admit recordless legacy MIPS32 carves missing section tables (both)
fix(setup): bound Hopper downloads by idle time instead of total duration #4719 fix(setup): bound Hopper downloads by idle time instead of total duration (both)
fix(adb): attribute pull file refusals to the device path #4720 fix(adb): attribute pull file refusals to the device path (both)
feat(ghidra): admit RISC-V position-independent executables (#4487) #4811 feat(ghidra): admit RISC-V position-independent executables ([Feature] Ghidra RISC-V lane: admit position-independent executables (ET_DYN); distro riscv64 binaries are almost all PIE #4487) (both)
fix: clean up quality gate findings #4857 fix: clean up quality gate findings (both)
fix: ELF multi-architecture support and quality fixes #4871 fix: ELF multi-architecture support and quality fixes (both)
Improve reverse engineering reliability, Android analysis, and binary diagnostics #4887 Improve reverse engineering reliability, Android analysis, and binary diagnostics (both)
test(adb): cover push device-state refusal attribution #4963 test(adb): cover push device-state refusal attribution (both)
docs(i18n): add Azerbaijani README and sync Turkish edition #4971 docs(i18n): add Azerbaijani README and sync Turkish edition (both)
fix(update): refuse unverified Bun ancestor ownership #5061 fix(update): refuse unverified Bun ancestor ownership (both)
test(process): reduce macOS wall-clock capture test flakiness #5065 test(process): reduce macOS wall-clock capture test flakiness (both)
Fix README.md filename typo #5066 Fix README.md filename typo (both)
docs(gemini): diagnose model schema rejection separately from MCP setup #5067 docs(gemini): diagnose model schema rejection separately from MCP setup (both)
fix(artifacts): keep readable entries of a directory with unreadable entries #5230 fix(artifacts): keep readable entries of a directory with unreadable entries (both)
fix(macho): exact arm64e.x1 slice names and mach-o-universal format #5254 fix(macho): exact arm64e.x1 slice names and mach-o-universal format (both)
docs: add Urdu README translation #5276 docs: add Urdu README translation (both)
fix(process): preserve observed command failures before cancellation #5296 fix(process): preserve observed command failures before cancellation (both)
fix(cli): reject invalid token-window bounds #5544 fix(cli): reject invalid token-window bounds (both)
fix(evidence): stop offering overwrite for outputs that never overwrite #5597 fix(evidence): stop offering overwrite for outputs that never overwrite (both)
fix(domain): reject ELF files whose program header table runs past the end #6165 fix(domain): reject ELF files whose program header table runs past the end (both)
fix(browser): start coverage at domain enablement #6276 fix(browser): start coverage at domain enablement (both)
fix(cli): advertise the observe-web-execution duration maximum #6303 fix(cli): advertise the observe-web-execution duration maximum (both)
feat(windows): admit live SQLite, process, and window tools #6326 feat(windows): admit live SQLite, process, and window tools (both)
fix(cli): document supported Rust, IL2CPP, model and GPU Evidence in inspect-analysis-view help #6351 fix(cli): document supported Rust, IL2CPP, model and GPU Evidence in inspect-analysis-view help (both)
fix(mcp): advertise attached-capture incompleteness in compare_web_captures example #6632 fix(mcp): advertise attached-capture incompleteness in compare_web_captures example (both)
feat(ci): require live dependency security evidence for releases #6728 feat(ci): require live dependency security evidence for releases (both)
fix(javascript): follow Electron through aliases of Webpack externals #6993 fix(javascript): follow Electron through aliases of Webpack externals (both)
feat(artifacts): inventory and extract Bun standalone executable module graphs #6998 feat(artifacts): inventory and extract Bun standalone executable module graphs (both)

3 to 5 days since the last activity (101)

Merge conflict only (35)

fix(javascript): preserve Node package lookup and artifact path identity #2702 fix(javascript): preserve Node package lookup and artifact path identity (conflicts)
feat(jeb): detect JEB endpoint in setup and doctor #2987 feat(jeb): detect JEB endpoint in setup and doctor (conflicts)
feat(browser): add screenshot bounds and region comparisons #2988 feat(browser): add screenshot bounds and region comparisons (conflicts)
feat(config): persist provider settings in a user config file #3023 feat(config): persist provider settings in a user config file (conflicts)
fix(debugger): shield inferior identity verification on proc stat ENOENT #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts)
docs(firmware): disclose procps ps prerequisite #3761 docs(firmware): disclose procps ps prerequisite (conflicts)
feat(native): inspect Windows minidump streams offline #3770 feat(native): inspect Windows minidump streams offline (conflicts)
feat(bridge): discover BYO x64dbg without launching a session #3773 feat(bridge): discover BYO x64dbg without launching a session (conflicts)
feat(native): static packer identification for PE and ELF #3775 feat(native): static packer identification for PE and ELF (conflicts)
feat(artifacts): inventory and extract .NET single-file bundles #3787 feat(artifacts): inventory and extract .NET single-file bundles (conflicts)
feat(cli): report MCP catalog size in doctor #3905 feat(cli): report MCP catalog size in doctor (conflicts)
feat(evidence): add literal text query to retained Evidence summaries #3966 feat(evidence): add literal text query to retained Evidence summaries (conflicts)
fix(plist): preserve real character data #4047 fix(plist): preserve real character data (conflicts)
feat(evidence): cluster inspected artifacts into families by root digest #4133 feat(evidence): cluster inspected artifacts into families by root digest (conflicts)
docs(ar): synchronize README_ar.md with upstream English documentation #4139 docs(ar): synchronize README_ar.md with upstream English documentation (conflicts)
feat(windows): capture selected windows through owned helpers #4143 feat(windows): capture selected windows through owned helpers (conflicts)
feat(i18n): add Albanian README and website translations #4172 feat(i18n): add Albanian README and website translations (conflicts)
docs(i18n): add Gujarati translations #4209 docs(i18n): add Gujarati translations (conflicts)
fix: decode escaped ESM reference paths #4323 fix: decode escaped ESM reference paths (conflicts)
test(ghidra): align fixtures with Windows host boundaries #4334 test(ghidra): align fixtures with Windows host boundaries (conflicts)
fix(native): reject empty Swift protocol or type names in conformance descriptors #4472 fix(native): reject empty Swift protocol or type names in conformance descriptors (conflicts)
feat(evidence): add evidence bundle audit command and MCP tool #4482 feat(evidence): add evidence bundle audit command and MCP tool (conflicts)
fix(managed): compare member bodies by nominal identity across builds #4516 fix(managed): compare member bodies by nominal identity across builds (conflicts)
docs(i18n): sync Go, SQLite and Bun update facts in translated READMEs #4570 docs(i18n): sync Go, SQLite and Bun update facts in translated READMEs (conflicts)
fix(browser): record dedicated worker requests through attached sessions #4585 fix(browser): record dedicated worker requests through attached sessions (conflicts)
feat(evidence): cluster artifacts from retained Evidence references and summaries #4589 feat(evidence): cluster artifacts from retained Evidence references and summaries (conflicts)
feat(ghidra): select the loopback bridge transport on POSIX hosts #4591 feat(ghidra): select the loopback bridge transport on POSIX hosts (conflicts)
fix(domain): admit SPARC V9 (EM_SPARCV9, 43) ELF binaries #4843 fix(domain): admit SPARC V9 (EM_SPARCV9, 43) ELF binaries (conflicts)
fix(verify): clean up ADB transfer probe #5233 fix(verify): clean up ADB transfer probe (conflicts)
chore(android): update jadx-headless-mcp provider to 0.8.0 #5248 chore(android): update jadx-headless-mcp provider to 0.8.0 (conflicts)
docs(cli): complete the cancellation-routing command list #5366 docs(cli): complete the cancellation-routing command list (conflicts)
Fix/javascript source selection limitations #5428 Fix/javascript source selection limitations (conflicts)
fix(ghidra): keep the session transcript out of bridge failure replies #5509 fix(ghidra): keep the session transcript out of bridge failure replies (conflicts)
fix(native): keep ELF layout independent of pwntools kernel probes #5755 fix(native): keep ELF layout independent of pwntools kernel probes (conflicts)
fix(trace): retain linear call path traversal state #5938 fix(trace): retain linear call path traversal state (conflicts)

Failing CI only (12)

fix(ledger): map non-canonical bundle TypeError to AnalysisInputError #3288 fix(ledger): map non-canonical bundle TypeError to AnalysisInputError (CI)
test(cli): cover Frida argument admission and spawn ordering #3356 test(cli): cover Frida argument admission and spawn ordering (CI)
fix(adb): verify pushes to long device paths #3458 fix(adb): verify pushes to long device paths (CI)
feat(artifacts): read compiled AndroidManifest.xml attributes #3496 feat(artifacts): read compiled AndroidManifest.xml attributes (CI)
Lunz Research Group Apresents: REA-LUNZ-CAUSAL-ENGINE #3750 Lunz Research Group Apresents: REA-LUNZ-CAUSAL-ENGINE (CI)
fix(jeb): reconnect after stale MCP sessions #3754 fix(jeb): reconnect after stale MCP sessions (CI)
docs: add a static VB6 native OCX investigation workflow #3810 docs: add a static VB6 native OCX investigation workflow (CI)
refactor(ghidra): share native AOT entry class constant #4386 refactor(ghidra): share native AOT entry class constant (CI)
fix(javascript): treat exact location-only moves as unchanged #4536 fix(javascript): treat exact location-only moves as unchanged (CI)
docs: add a .NET static-analysis walkthrough #4611 docs: add a .NET static-analysis walkthrough (CI)
feat(js): resolve class instance method calls in semantic graphs #4675 feat(js): resolve class instance method calls in semantic graphs (CI)
fix(setup): admit only syntax Gemini CLI loads in settings.json #5054 fix(setup): admit only syntax Gemini CLI loads in settings.json (CI)

Merge conflict and failing CI (54)

docs(website): add reproducible starter demos #1704 docs(website): add reproducible starter demos (both)
fix(setup): preserve user fields on an existing REA client entry #1732 fix(setup): preserve user fields on an existing REA client entry (both)
fix(setup): show non-interactive setup results in a terminal #2185 fix(setup): show non-interactive setup results in a terminal (both)
docs(readme): add Georgian (ka) translation #2243 docs(readme): add Georgian (ka) translation (both)
feat(ios): Add iOS app support - add jailbroken runtime debugging lanes #2264 feat(ios): Add iOS app support - add jailbroken runtime debugging lanes (both)
feat(ghidra): admit plain MIPS32 PIC shared images #2362 feat(ghidra): admit plain MIPS32 PIC shared images (both)
feat(setup): support private Claude Code project registrations #2414 feat(setup): support private Claude Code project registrations (both)
fix(javascript): preserve intrinsic invocation read identity #2465 fix(javascript): preserve intrinsic invocation read identity (both)
docs(skills): add source attribution and evidence handoff guidance #2701 docs(skills): add source attribution and evidence handoff guidance (both)
feat(native): retain LLDB source coordinates and verify Pascal calls #2800 feat(native): retain LLDB source coordinates and verify Pascal calls (both)
test(docs): refresh README link drift mutations #2817 test(docs): refresh README link drift mutations (both)
docs: add Hindi (हिन्दी) translation of README #2862 docs: add Hindi (हिन्दी) translation of README (both)
fix(browser): preserve explicit URL references and endpoint evidence #2878 fix(browser): preserve explicit URL references and endpoint evidence (both)
feat(ghidra)!: preserve paged warnings and require observed comparison coverage #2904 feat(ghidra)!: preserve paged warnings and require observed comparison coverage (both)
test(ghidra): verify MIPS declaration and cleanup boundaries #2919 test(ghidra): verify MIPS declaration and cleanup boundaries (both)
fix(javascript): global augmentation kind and additional web/browser inspections #2986 fix(javascript): global augmentation kind and additional web/browser inspections (both)
Fix/android runtime fallback #3030 Fix/android runtime fallback (both)
feat(managed): decode signature-owned custom attribute arguments #3317 feat(managed): decode signature-owned custom attribute arguments (both)
feat(artifacts): recognize CFB containers with explicit coverage limits #3404 feat(artifacts): recognize CFB containers with explicit coverage limits (both)
feat(javascript): recover synchronous child-process creation #3433 feat(javascript): recover synchronous child-process creation (both)
fix(process): bound bridge response framing #3444 fix(process): bound bridge response framing (both)
fix(setup): default Claude Desktop to compact MCP schemas #3486 fix(setup): default Claude Desktop to compact MCP schemas (both)
fix(reference): preserve root permission failures #3498 fix(reference): preserve root permission failures (both)
fix(hopper): normalize cross-platform launcher paths #3558 fix(hopper): normalize cross-platform launcher paths (both)
Feat/pri resources #3589 Feat/pri resources (both)
fix(security): harden archive and Hopper probes #3659 fix(security): harden archive and Hopper probes (both)
feat(jvm): export Vineflower sources with explicit dependencies #3753 feat(jvm): export Vineflower sources with explicit dependencies (both)
feat(ghidra): open a caller-selected persistent project read-only #3817 feat(ghidra): open a caller-selected persistent project read-only (both)
test(browser): cover invalid WebMCP annotation payloads #3837 test(browser): cover invalid WebMCP annotation payloads (both)
feat(website): polish interactions and remove em dashes #3903 feat(website): polish interactions and remove em dashes (both)
feat(setup): add MiniMax Code client #3968 feat(setup): add MiniMax Code client (both)
feat(website): propose a new REA identity and homepage #3969 feat(website): propose a new REA identity and homepage (both)
feat(go)!: inspect compiler-declared function entries #3976 feat(go)!: inspect compiler-declared function entries (both)
fix(sqlite): normalize index table identifiers using ASCII folding #4021 fix(sqlite): normalize index table identifiers using ASCII folding (both)
docs(mcp): name WorkBuddy/CodeBuddy compact profile for gateway 11133 #4028 docs(mcp): name WorkBuddy/CodeBuddy compact profile for gateway 11133 (both)
feat(artifacts): select extraction entries and output destination #4031 feat(artifacts): select extraction entries and output destination (both)
feat(windows): support Windows ARM64 native controls and provider boundaries #4061 feat(windows): support Windows ARM64 native controls and provider boundaries (both)
feat(mcp): support real-time operation progress and ETA notifications #4161 feat(mcp): support real-time operation progress and ETA notifications (both)
fix(website): translate coding agent as an AI assistant in Russian and Ukrainian #4222 fix(website): translate coding agent as an AI assistant in Russian and Ukrainian (both)
fix(browser): preserve uncertainty for omitted initiator URLs (#4211) #4224 fix(browser): preserve uncertainty for omitted initiator URLs ([Bug] Omitted initiator URLs cause unsupported passive network comparison results #4211) (both)
fix(apple): retain keyed archive scalar object kinds #4317 fix(apple): retain keyed archive scalar object kinds (both)
fix(artifact): accept POSIX names beginning with letter-colon on non-Windows hosts #4333 fix(artifact): accept POSIX names beginning with letter-colon on non-Windows hosts (both)
fix(cleanup): restore shared ownership across browser, capture, and adb boundaries #4345 fix(cleanup): restore shared ownership across browser, capture, and adb boundaries (both)
fix(managed): authorize signature kind against its metadata row kind #4420 fix(managed): authorize signature kind against its metadata row kind (both)
fix(browser): record dedicated worker requests in page inspection #4456 fix(browser): record dedicated worker requests in page inspection (both)
docs: add Urdu (اردو) README translation #4491 docs: add Urdu (اردو) README translation (both)
fix(setup): preserve exact Windows AppData roots #4523 fix(setup): preserve exact Windows AppData roots (both)
fix(native): scale NativeAOT work budget and resolve base types by index #4559 fix(native): scale NativeAOT work budget and resolve base types by index (both)
fix(javascript): scope candidate this event receivers #4656 fix(javascript): scope candidate this event receivers (both)
fix(apktool): fall back to packageInfo when manifest package is omitted #4696 fix(apktool): fall back to packageInfo when manifest package is omitted (both)
fix(javascript): bound alias-cycle call-target and returned-reference expansion #4716 fix(javascript): bound alias-cycle call-target and returned-reference expansion (both)
fix(cli): stream default TOON results past the string limit #4807 fix(cli): stream default TOON results past the string limit (both)
feat(browser): wake or classify discarded CDP page targets before inspection #5368 feat(browser): wake or classify discarded CDP page targets before inspection (both)
docs(skill): unify reverse-engineering and UI/UX workflows #5712 docs(skill): unify reverse-engineering and UI/UX workflows (both)

6 or more days since the last activity (52)

Merge conflict only (9)

feat(domain): add opt-in address-normalized function text views #2124 feat(domain): add opt-in address-normalized function text views (conflicts)
fix(cli): preserve mcp doctor output choices on argument errors #2693 fix(cli): preserve mcp doctor output choices on argument errors (conflicts)
test(browser): cover DOM relation whitespace and empty values #2845 test(browser): cover DOM relation whitespace and empty values (conflicts)
docs(skill): flag hidden-window throttling in passive browser observation #3124 docs(skill): flag hidden-window throttling in passive browser observation (conflicts)
feat(binary): recognize XEX2 and PowerPC PE basefiles #3429 feat(binary): recognize XEX2 and PowerPC PE basefiles (conflicts)
feat(reconstruction): verify visual screenshot claims #3529 feat(reconstruction): verify visual screenshot claims (conflicts)
feat(experiments): prototype Electron IPC effect attribution #3742 feat(experiments): prototype Electron IPC effect attribution (conflicts)
feat(ghidra): apply a caller-selected PDB that matches the target #3818 feat(ghidra): apply a caller-selected PDB that matches the target (conflicts)
feat(managed)!: expose file-backed field initialization data #3835 feat(managed)!: expose file-backed field initialization data (conflicts)

Failing CI only (13)

feat(evaluation): run agent evaluation against Claude Code and Gemini CLI #1971 feat(evaluation): run agent evaluation against Claude Code and Gemini CLI (CI)
feat(cli): expose caller-selected reference-source path exclusions #2630 feat(cli): expose caller-selected reference-source path exclusions (CI)
fix(javascript): resolve spread and constant kill-signal arguments #2830 fix(javascript): resolve spread and constant kill-signal arguments (CI)
perf(ghidra): resolve Swift select provenance once per function #2870 perf(ghidra): resolve Swift select provenance once per function (CI)
fix(hopper): support WSLg socket symlinks for private displays #2969 fix(hopper): support WSLg socket symlinks for private displays (CI)
fix(hopper): release a Spotlight not-found launch from the signed helper #3011 fix(hopper): release a Spotlight not-found launch from the signed helper (CI)
Configure the Cursor Cloud Agent environment #3043 Configure the Cursor Cloud Agent environment (CI)
fix(evaluation): require explicit REA server identity for routing credit #3045 fix(evaluation): require explicit REA server identity for routing credit (CI)
docs: clarify automated agent development setup #3074 docs: clarify automated agent development setup (CI)
Improve page template UI: responsive layout, dark mode, reading progress #3258 Improve page template UI: responsive layout, dark mode, reading progress (CI)
test(javascript): cover missing package-manifest companions staying unknown #3339 test(javascript): cover missing package-manifest companions staying unknown (CI)
docs(skills): add REA repository analysis workflow #3411 docs(skills): add REA repository analysis workflow (CI)
feat(android): check split APK set consistency from manifest facts #3495 feat(android): check split APK set consistency from manifest facts (CI)

Merge conflict and failing CI (30)

fix(adb): project actionable pm path refusal details #1903 fix(adb): project actionable pm path refusal details (both)
feat(ghidra): add bounded PS-X EXE static analysis #1948 feat(ghidra): add bounded PS-X EXE static analysis (both)
feat(ghidra): admit caller-selected matching dSYM companions #2025 feat(ghidra): admit caller-selected matching dSYM companions (both)
docs(skill): pin the package runner and treat target content as untrusted #2052 docs(skill): pin the package runner and treat target content as untrusted (both)
feat(javascript)!: bound semantic graphs by serialized Evidence bytes #2092 feat(javascript)!: bound semantic graphs by serialized Evidence bytes (both)
feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine #2093 feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine (both)
feat(javascript): fold constant values and recover Electron boundaries through wrappers #2094 feat(javascript): fold constant values and recover Electron boundaries through wrappers (both)
fix(javascript): admit measured transfer retention in parent result budget #2097 fix(javascript): admit measured transfer retention in parent result budget (both)
feat(website): add Central Kurdish (Sorani) locale #2407 feat(website): add Central Kurdish (Sorani) locale (both)
feat(managed): bind Portable PDB sequence points to selected methods #2435 feat(managed): bind Portable PDB sequence points to selected methods (both)
feat(java): inspect archives and decompile selected classes #2717 feat(java): inspect archives and decompile selected classes (both)
fix(ghidra): keep unreported Java bitness unknown #2771 fix(ghidra): keep unreported Java bitness unknown (both)
feat(plugins): ship release-pinned Claude Code and Codex plugins #2815 feat(plugins): ship release-pinned Claude Code and Codex plugins (both)
feat(artifacts): inspect classic iNES container regions #2816 feat(artifacts): inspect classic iNES container regions (both)
feat(windows): add REA desktop GUI #2819 feat(windows): add REA desktop GUI (both)
fix(browser): classify malformed screenshot payloads as protocol errors #2839 fix(browser): classify malformed screenshot payloads as protocol errors (both)
fix(android): require explicit invoke coverage state #2850 fix(android): require explicit invoke coverage state (both)
feat(native): decode RT_STRING and RT_VERSION payloads in PE resources #2887 feat(native): decode RT_STRING and RT_VERSION payloads in PE resources (both)
fix(filesystem): PRoot compatibility for sameRegularFileState #2922 fix(filesystem): PRoot compatibility for sameRegularFileState (both)
feat(ghidra): admit bounded m68k ELF analysis through Ghidra #2923 feat(ghidra): admit bounded m68k ELF analysis through Ghidra (both)
feat(plugin): add a Cursor plugin that registers the pinned REA server #3003 feat(plugin): add a Cursor plugin that registers the pinned REA server (both)
feat(cli): run ordered tool batches in one provider session #3028 feat(cli): run ordered tool batches in one provider session (both)
fix(ghidra): recover registered Borland SEH handler gaps #3029 fix(ghidra): recover registered Borland SEH handler gaps (both)
docs(skill): add optional public-source research guidance #3037 docs(skill): add optional public-source research guidance (both)
fix(android): decode guardian readiness across UTF-8 chunks #3048 fix(android): decode guardian readiness across UTF-8 chunks (both)
feat(setup): support OpenClaw native MCP and active profiles #3100 feat(setup): support OpenClaw native MCP and active profiles (both)
feat(ghidra): admit ELF and thin Mach-O targets on Windows #3129 feat(ghidra): admit ELF and thin Mach-O targets on Windows (both)
fix(application): surface web resource cleanup errors via tagged error algebra #3492 fix(application): surface web resource cleanup errors via tagged error algebra (both)
docs(i18n): add Devanagari CSS, Hindi README base, and initial website translations #3547 docs(i18n): add Devanagari CSS, Hindi README base, and initial website translations (both)
Rama #5622 Rama (both)

Pull requests where a maintainer asked for changes (5)

A maintainer asked for changes on these 5 at some point. They are also in the groups above. I did not check whether the author has updated them since.

feat(ghidra): verify and pin the 32-bit ARM (armhf) lane #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts)
fix(debugger): shield inferior identity verification on proc stat ENOENT #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts)
feat(windows): capture selected windows through owned helpers #4143 feat(windows): capture selected windows through owned helpers (conflicts)
feat(i18n): add Albanian README and website translations #4172 feat(i18n): add Albanian README and website translations (conflicts)
feat(ghidra): report blocks the decompiler removed as unreachable #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts)

Moved on since opening (315)

feat(setup): register Kimi Code client with compact schema profile #1804 feat(setup): register Kimi Code client with compact schema profile; closed 25 Oct without a merge
fix(reverse)!: retain cleanup and session ownership for local inspection #1960 fix(reverse)!: retain cleanup and session ownership for local inspection; closed 25 Oct without a merge
feat(packaging): prepare a Windows portable runtime #2136 feat(packaging): prepare a Windows portable runtime; no conflict now and checks passing
feat(mcp): accept common argument-name aliases for procedure and search tools #2148 feat(mcp): accept common argument-name aliases for procedure and search tools; no conflict now and checks running
feat(ghidra): open pre-imported projects with -process instead of re-importing #2150 feat(ghidra): open pre-imported projects with -process instead of re-importing; no conflict now and checks passing
test(artifacts): exercise ASAR header admission boundaries #2314 test(artifacts): exercise ASAR header admission boundaries; closed 25 Oct without a merge
feat(diagnostics): report a byte entropy profile for one local file #2331 feat(diagnostics): report a byte entropy profile for one local file; merged 22 Oct
feat(artifacts): inventory and extract PyInstaller archives #2433 feat(artifacts): inventory and extract PyInstaller archives; merged 21 Oct
feat(harness): add a build-free REA bundle and guarded distribution #2636 feat(harness): add a build-free REA bundle and guarded distribution; closed 24 Oct without a merge
fix(native): support configurable REA_PWNTOOLS_MAX_INPUT_BYTES for large artifacts #2676 fix(native): support configurable REA_PWNTOOLS_MAX_INPUT_BYTES for large artifacts; closed 25 Oct without a merge
docs(go): clarify cumulative build-info search budget #2731 docs(go): clarify cumulative build-info search budget; merged 21 Oct
feat: add FreeBuff agent support for REA setup #2736 feat: add FreeBuff agent support for REA setup; merged 25 Oct
test(agent): grade Notes export facts and track fixture changes #2801 test(agent): grade Notes export facts and track fixture changes; closed 25 Oct without a merge
docs: add Greek (Ελληνικά) translation of README #2866 docs: add Greek (Ελληνικά) translation of README; closed 23 Oct without a merge
fix(adb): drop the remaining exclusivity claim from push guidance #2868 fix(adb): drop the remaining exclusivity claim from push guidance; no conflict now and checks passing
fix(captures): redact normalized HAR numeric values #2872 fix(captures): redact normalized HAR numeric values; closed 23 Oct without a merge
fix(web-capture): bound the mitmproxy headline facet index #2876 fix(web-capture): bound the mitmproxy headline facet index; no conflict now and checks passing
perf(javascript): cut redundant key encoding in semantic member-mutation traversal #2891 perf(javascript): cut redundant key encoding in semantic member-mutation traversal; closed 23 Oct without a merge
feat(mcp): keep compact input schemas within ten nesting levels #2905 feat(mcp): keep compact input schemas within ten nesting levels; closed 25 Oct without a merge
fix(security): bound scenario retention and loopback admission #2961 fix(security): bound scenario retention and loopback admission; closed 21 Oct without a merge
fix(javascript): recover RPC link URLs declared with template literals #2963 fix(javascript): recover RPC link URLs declared with template literals; no conflict now and checks passing
Build #3071 Build; closed 25 Oct without a merge
fix(managed): report InitLocals comparison changes #3225 fix(managed): report InitLocals comparison changes; closed 23 Oct without a merge
test(process): cover cancellation during obstructed root lookup #3263 test(process): cover cancellation during obstructed root lookup; no conflict now and checks passing
fix(artifacts): classify localized DMG verification failures #3290 fix(artifacts): classify localized DMG verification failures; closed 25 Oct without a merge
feat(analysis-view): select HAR MIME types in capture previews #3293 feat(analysis-view): select HAR MIME types in capture previews; no conflict now and checks passing
refactor(pcap): give TShark selection and version admission one owner #3407 refactor(pcap): give TShark selection and version admission one owner; merged 22 Oct
feat(analysis-view): locate unavailable response facts by record #3425 feat(analysis-view): locate unavailable response facts by record; no conflict now and checks passing
fix(security): pin CI actions, protect Hopper xauth and downloads, flag old apktool #3440 fix(security): pin CI actions, protect Hopper xauth and downloads, flag old apktool; closed 25 Oct without a merge
fix(wasm): preserve local matches for dotted selected paths #3455 fix(wasm): preserve local matches for dotted selected paths; closed 23 Oct without a merge
fix(browser): reserve the initial scenario step id from action inputs #3493 fix(browser): reserve the initial scenario step id from action inputs; merged 21 Oct
fix(mcp): recover structured tool arguments clients serialize as JSON text #3525 fix(mcp): recover structured tool arguments clients serialize as JSON text; no conflict now and checks passing
fix(electron): forward selected XAUTHORITY to owned capture environment #3544 fix(electron): forward selected XAUTHORITY to owned capture environment; closed 25 Oct without a merge
fix(electron): block and record shell.trashItem #3559 fix(electron): block and record shell.trashItem; closed 25 Oct without a merge
fix(native): check every slice of a signed universal Mach-O #3583 fix(native): check every slice of a signed universal Mach-O; closed 25 Oct without a merge
feat(jvm): inspect JVM source-line & local-variable debug metadata (#2377) #3586 feat(jvm): inspect JVM source-line & local-variable debug metadata ([Feature] Inspect JVM source-line and local-variable metadata for debugging readiness #2377); no conflict now and checks passing
fix(contracts): reject NUL bytes in objdump and rizin local path inputs #3600 fix(contracts): reject NUL bytes in objdump and rizin local path inputs; merged 24 Oct
feat(windows): admit arm64 hosts for the bundled native controls #3602 feat(windows): admit arm64 hosts for the bundled native controls; no conflict now and checks passing
refactor(go): parse module records once at the build-info owner #3604 refactor(go): parse module records once at the build-info owner; closed 25 Oct without a merge
fix(artifacts): recognize leading JSON whitespace in ASAR headers #3658 fix(artifacts): recognize leading JSON whitespace in ASAR headers; closed 25 Oct without a merge
fix(managed): keep native-boundary inspection alive for very large issue inventories #3660 fix(managed): keep native-boundary inspection alive for very large issue inventories; closed 24 Oct without a merge
fix(windows): name the missing native artifact and its recovery path on source checkouts #3760 fix(windows): name the missing native artifact and its recovery path on source checkouts; no conflict now and checks passing
fix(mcp): normalize compact schemas for strict gateways #3806 fix(mcp): normalize compact schemas for strict gateways; merged 25 Oct
fix(native): trace UI actions for all receiver kinds #3828 fix(native): trace UI actions for all receiver kinds; closed 23 Oct without a merge
fix(process): reject the __proto__ environment name the PTY backend drops #3834 fix(process): reject the proto environment name the PTY backend drops; closed 24 Oct without a merge
feat(android): add boot wait and resource-id to code tracing #3840 feat(android): add boot wait and resource-id to code tracing; no conflict now and checks passing
fix(javascript): attribute service workers only to the navigator global #3841 fix(javascript): attribute service workers only to the navigator global; closed 21 Oct without a merge
fix(javascript): preserve proven WebSocket endpoint identities #3940 fix(javascript): preserve proven WebSocket endpoint identities; no conflict now and checks passing
fix: exclude credential header values from header allocation budget preflight #3994 fix: exclude credential header values from header allocation budget preflight; closed 25 Oct without a merge
fix(mcp): advertise a screenshot example with a valid PNG checksum #3995 fix(mcp): advertise a screenshot example with a valid PNG checksum; closed 25 Oct without a merge
fix(js): ignore unrelated join/resolve for Electron preload paths #3996 fix(js): ignore unrelated join/resolve for Electron preload paths; closed 24 Oct without a merge
fix(managed): reject runtime locations on managed static evidence #4004 fix(managed): reject runtime locations on managed static evidence; closed 24 Oct without a merge
fix(browser): compare retained script source identities #4014 fix(browser): compare retained script source identities; closed 25 Oct without a merge
fix(javascript): preserve structural fingerprint semantics #4020 fix(javascript): preserve structural fingerprint semantics; closed 21 Oct without a merge
fix(contracts): restore canonical mobile graph examples #4037 fix(contracts): restore canonical mobile graph examples; closed 24 Oct without a merge
fix(browser): preserve frame identity across captures #4040 fix(browser): preserve frame identity across captures; merged 23 Oct
fix(reference): preserve imports with symlinks into unreadable subtrees #4053 fix(reference): preserve imports with symlinks into unreadable subtrees; closed 21 Oct without a merge
fix(reference-source): keep a partial graph for symlinks into unenumerated directories #4060 fix(reference-source): keep a partial graph for symlinks into unenumerated directories; closed 21 Oct without a merge
fix(adb): normalize absent installer package sentinels #4073 fix(adb): normalize absent installer package sentinels; merged 21 Oct
fix(providers): report provider-selection diagnostics when the selected provider refuses its profile #4103 fix(providers): report provider-selection diagnostics when the selected provider refuses its profile; merged 22 Oct
fix(managed): match Windows module paths independently of the host #4144 fix(managed): match Windows module paths independently of the host; closed 24 Oct without a merge
docs(hermes): explain nested-home routing and preview limits #4145 docs(hermes): explain nested-home routing and preview limits; no conflict now and checks passing
fix(javascript): prune unreachable constant return branches #4173 fix(javascript): prune unreachable constant return branches; closed 25 Oct without a merge
fix(artifacts): reject directory targets for source maps (#4212) #4214 fix(artifacts): reject directory targets for source maps ([Bug] Source-map edges target known directory containers #4212); closed 24 Oct without a merge
fix(native): map Go and Rust ppc reports to the powerpc subject #4220 fix(native): map Go and Rust ppc reports to the powerpc subject; closed 25 Oct without a merge
fix(reference): select a package main for trailing-slash requires #4221 fix(reference): select a package main for trailing-slash requires; closed 24 Oct without a merge
fix(javascript): preserve optional native-addon bindings #4259 fix(javascript): preserve optional native-addon bindings; closed 25 Oct without a merge
feat(mcp): add native vulnerability review prompt #4283 feat(mcp): add native vulnerability review prompt; closed 23 Oct without a merge
feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources #4285 feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources; no conflict now and checks passing
fix(ida): keep omitted callee truncation markers unknown #4286 fix(ida): keep omitted callee truncation markers unknown; merged 21 Oct
fix(swift): retain uncertainty for substituted extension contexts #4319 fix(swift): retain uncertainty for substituted extension contexts; closed 25 Oct without a merge
fix(captures): scope HAR HTTP interpretation to entries #4351 fix(captures): scope HAR HTTP interpretation to entries; merged 22 Oct
fix(artifacts): reconcile ARM32 Mach-O slice names by subtype #4352 fix(artifacts): reconcile ARM32 Mach-O slice names by subtype; merged 22 Oct
fix(native): report every slice of a signed universal Mach-O signature #4359 fix(native): report every slice of a signed universal Mach-O signature; closed 24 Oct without a merge
perf(schema): reduce retained integer validator allocations #4360 perf(schema): reduce retained integer validator allocations; merged 22 Oct
fix(javascript): grow a binding's returned-reference projection once per chain #4363 fix(javascript): grow a binding's returned-reference projection once per chain; closed 24 Oct without a merge
fix(browser): bound observe_web_session windows to the Node.js timer limit #4391 fix(browser): bound observe_web_session windows to the Node.js timer limit; closed 21 Oct without a merge
fix(reference): retain static template require dependencies #4401 fix(reference): retain static template require dependencies; closed 22 Oct without a merge
fix(enhanced): validate get_objc_protocols direct-call input #4408 fix(enhanced): validate get_objc_protocols direct-call input; closed 24 Oct without a merge
fix(reference): retain exact CommonJS template require specifiers #4409 fix(reference): retain exact CommonJS template require specifiers; closed 24 Oct without a merge
fix(inspector): count unresolved locations after script deduplication #4410 fix(inspector): count unresolved locations after script deduplication; closed 25 Oct without a merge
fix(browser): retain bundle default origin scope #4413 fix(browser): retain bundle default origin scope; merged 22 Oct
fix(artifacts): preserve binary keyed archive integers above Int64.max #4422 fix(artifacts): preserve binary keyed archive integers above Int64.max; closed 24 Oct without a merge
perf(mcp): defer analysis runtime after catalog discovery #4424 perf(mcp): defer analysis runtime after catalog discovery; merged 22 Oct
fix(firmware): reject staged files cut off at the per-file limit #4430 fix(firmware): reject staged files cut off at the per-file limit; no conflict now and checks passing
fix(evidence): accept legacy null coverage identity #4442 fix(evidence): accept legacy null coverage identity; closed 24 Oct without a merge
fix(rizin): bound recent frame history by UTF-8 bytes #4464 fix(rizin): bound recent frame history by UTF-8 bytes; closed 22 Oct without a merge
docs(i18n): correct Korean Aegis analysis guidance #4480 docs(i18n): correct Korean Aegis analysis guidance; closed 23 Oct without a merge
fix: resolve critical lifecycle, admission, and analysis defects (#4475, #4483, #4490, #4494, #4495, #4509) #4493 fix: resolve critical lifecycle, admission, and analysis defects ([Bug] Firmware read-handle close failures discard outcomes and lose cleanup ownership #4475, [Bug] Artifact readback can replace IO failures and report success after cancellation #4483, [Bug] Destructuring Electron from a Webpack module-table external drops BrowserWindow and IPC (const {BrowserWindow, ipcMain} = external_electron_) #4490, [Bug] draw.io ASAR capture opens an invalid-file dialog before declared actions #4494, [Bug] Dyld resolution duplicates blocking file admission and loses descriptor cleanup outcomes #4495, [Bug] Leading whitespace in ESM specifiers creates false resolved local imports #4509); closed 24 Oct without a merge
fix(ownership): retain failed artifact and native handles #4503 fix(ownership): retain failed artifact and native handles; closed 25 Oct without a merge
fix(javascript): preserve raw ESM path classification #4510 fix(javascript): preserve raw ESM path classification; closed 21 Oct without a merge
fix(electron): exclude scripts from unauthorized frames #4529 fix(electron): exclude scripts from unauthorized frames; closed 25 Oct without a merge
fix(native): reject empty Objective-C ivar names in class metadata #4548 fix(native): reject empty Objective-C ivar names in class metadata; closed 25 Oct without a merge
docs(i18n): add the Linux procps prerequisite to translated READMEs #4566 docs(i18n): add the Linux procps prerequisite to translated READMEs; closed 25 Oct without a merge
fix(reference): resolve query and fragment ESM imports to their pathname #4572 fix(reference): resolve query and fragment ESM imports to their pathname; no conflict now and checks passing
fix(mcp): require an absolute input_path for JavaScript application analysis #4576 fix(mcp): require an absolute input_path for JavaScript application analysis; closed 24 Oct without a merge
fix(adb): refuse push on ambiguous existence probe failure (#4574) #4579 fix(adb): refuse push on ambiguous existence probe failure ([Bug] push-adb-file pushes without overwrite after an ambiguous existence-probe failure #4574); closed 25 Oct without a merge
fix(ghidra): discover Homebrew keg-only openjdk candidates on macOS (#4556) #4583 fix(ghidra): discover Homebrew keg-only openjdk candidates on macOS ([Bug] Ghidra java check fails with Homebrew keg-only openjdk on macOS #4556); closed 24 Oct without a merge
fix(ida): retain analysis profile in partial operation evidence #4645 fix(ida): retain analysis profile in partial operation evidence; merged 21 Oct
fix(javascript): keep directory-form HTML URL references distinct from files #4646 fix(javascript): keep directory-form HTML URL references distinct from files; merged 22 Oct
docs(cli): list Kuna as a doctor provider #4651 docs(cli): list Kuna as a doctor provider; closed 25 Oct without a merge
fix(adb): preserve device and file error identity #4655 fix(adb): preserve device and file error identity; closed 21 Oct without a merge
[Bug] Signature inspection returns success after cancellation during final cleanup #4739 [Bug] Signature inspection returns success after cancellation during final cleanup; closed 21 Oct without a merge
fix(lldb): retain journal descriptor cleanup ownership #4751 fix(lldb): retain journal descriptor cleanup ownership; closed 25 Oct without a merge
docs: repair out-of-tree links so the documentation build passes #4769 docs: repair out-of-tree links so the documentation build passes; closed 23 Oct without a merge
docs: add open-source decompiler selection guide #4773 docs: add open-source decompiler selection guide; now a draft
fix(javascript): preserve CommonJS exports through TypeScript wrappers #4784 fix(javascript): preserve CommonJS exports through TypeScript wrappers; no conflict now and checks passing
fix: prevent source maps targeting directories #4790 fix: prevent source maps targeting directories; closed 25 Oct without a merge
feat(python): inspect CPython pyc headers and marshal code objects #4826 feat(python): inspect CPython pyc headers and marshal code objects; merged 22 Oct
fix(errors): separate recovery actions from failure messages #4829 fix(errors): separate recovery actions from failure messages; no conflict now and checks passing
feat(pe): inspect Authenticode certificate tables #4830 feat(pe): inspect Authenticode certificate tables; merged 22 Oct
feat(erlang): inspect BEAM IFF chunks and tables #4833 feat(erlang): inspect BEAM IFF chunks and tables; merged 22 Oct
feat(elf): inspect PT_NOTE and SHT_NOTE tables #4837 feat(elf): inspect PT_NOTE and SHT_NOTE tables; merged 22 Oct
fix(mcp): close the session when a signal interrupts startup #4884 fix(mcp): close the session when a signal interrupts startup; closed 24 Oct without a merge
fix(setup): tell MSIX Claude Desktop's process view from any private roaming file #4903 fix(setup): tell MSIX Claude Desktop's process view from any private roaming file; merged 22 Oct
docs(companions): propose opt-in integration contract #4970 docs(companions): propose opt-in integration contract; no conflict now and checks passing
fix(native): preserve Mach-O install-name whitespace #4979 fix(native): preserve Mach-O install-name whitespace; merged 22 Oct
fix(javascript): name the exhausted heap and max_heap_mb in heap failures #4997 fix(javascript): name the exhausted heap and max_heap_mb in heap failures; closed 21 Oct without a merge
docs: clarify JEB Linux CE MCP launch #5009 docs: clarify JEB Linux CE MCP launch; closed 25 Oct without a merge
test(update): isolate CLI subprocess deadlines #5019 test(update): isolate CLI subprocess deadlines; merged 21 Oct
fix(jeb): preserve artifact path in project-open refusals #5020 fix(jeb): preserve artifact path in project-open refusals; closed 25 Oct without a merge
feat(kuna): admit Windows PE images through the verified provider lane #5023 feat(kuna): admit Windows PE images through the verified provider lane; no conflict now and checks passing
feat(android): project a structured manifest component inventory #5025 feat(android): project a structured manifest component inventory; merged 24 Oct
feat(cli): accept JavaScript source selections from a JSON array or file #5029 feat(cli): accept JavaScript source selections from a JSON array or file; merged 24 Oct
feat(docs): add VitePress dead-link verification to CI workflow (#5030) #5044 feat(docs): add VitePress dead-link verification to CI workflow ([Feature] Add VitePress dead-link verification to CI docs workflow #5030); closed 25 Oct without a merge
fix(setup): treat empty COPILOT_HOME as unset #5053 fix(setup): treat empty COPILOT_HOME as unset; closed 25 Oct without a merge
feat(plugin): ship a Claude Code plugin for the MCP server #5064 feat(plugin): ship a Claude Code plugin for the MCP server; closed 22 Oct without a merge
feat(rust): read cargo-auditable dependencies from WebAssembly modules #5069 feat(rust): read cargo-auditable dependencies from WebAssembly modules; no conflict now and checks passing
fix(setup): accept and preserve Codex per-tool settings (#3862, #3863) #5115 fix(setup): accept and preserve Codex per-tool settings ([Bug] rea doctor marks a Codex registration invalid when it has per-tool approval settings #3862, [Bug] rea setup deletes Codex per-tool approval settings when refreshing the registration #3863); closed 25 Oct without a merge
fix(cli): clamp exhausted failure token-window start to the token total #5119 fix(cli): clamp exhausted failure token-window start to the token total; closed 25 Oct without a merge
fix(setup): keep client and skill setup when the Hopper install fails #5120 fix(setup): keep client and skill setup when the Hopper install fails; merged 22 Oct
fix(apple): report empty asset inventory as complete at any offset #5123 fix(apple): report empty asset inventory as complete at any offset; closed 21 Oct without a merge
fix(artifacts): keep a member's own name when its logical path is NFC #5125 fix(artifacts): keep a member's own name when its logical path is NFC; no conflict now and checks passing
fix(artifacts): preserve original Unicode spelling when NFC normalization changes a logical path #5127 fix(artifacts): preserve original Unicode spelling when NFC normalization changes a logical path; no conflict now and checks passing
fix(managed): distinguish truncated compressed signature integers #5133 fix(managed): distinguish truncated compressed signature integers; closed 25 Oct without a merge
perf(javascript): prune typed-array element reference escapes #5139 perf(javascript): prune typed-array element reference escapes; merged 22 Oct
fix(hermes): preserve external YAML anchor consumers #5152 fix(hermes): preserve external YAML anchor consumers; no conflict now and checks passing
fix(analysis): preserve execution analysis profile in composed Evidence #5156 fix(analysis): preserve execution analysis profile in composed Evidence; closed 24 Oct without a merge
fix(evm): preserve advertised detail schema metadata #5157 fix(evm): preserve advertised detail schema metadata; closed 24 Oct without a merge
feat(cli): summarize managed members with durable Evidence paging #5167 feat(cli): summarize managed members with durable Evidence paging; merged 22 Oct
fix(mcp): advertise empty-string literals as typed strings #5203 fix(mcp): advertise empty-string literals as typed strings; closed 25 Oct without a merge
fix(android): select Windows JADX java.exe from PATH, not the working directory #5204 fix(android): select Windows JADX java.exe from PATH, not the working directory; closed 24 Oct without a merge
fix(objdump): scope debug-link warnings to DWARF inspections #5210 fix(objdump): scope debug-link warnings to DWARF inspections; closed 21 Oct without a merge
docs: describe AOT image buffer as declared size plus one byte #5226 docs: describe AOT image buffer as declared size plus one byte; closed 25 Oct without a merge
fix(mcp): omit empty-string schema literals #5227 fix(mcp): omit empty-string schema literals; closed 25 Oct without a merge
fix(apple): classify keyed-archive objects by declared superclasses #5228 fix(apple): classify keyed-archive objects by declared superclasses; merged 22 Oct
fix(cli): clamp exhausted failure token windows #5231 fix(cli): clamp exhausted failure token windows; closed 25 Oct without a merge
fix(windows): align path handling across Hopper, Electron, and ADB #5235 fix(windows): align path handling across Hopper, Electron, and ADB; merged 22 Oct
fix(evm): clarify worker address space as profile ceiling in limitations #5239 fix(evm): clarify worker address space as profile ceiling in limitations; closed 25 Oct without a merge
fix(cli): keep debug-with-rizin success status after confirmed fallback cleanup #5247 fix(cli): keep debug-with-rizin success status after confirmed fallback cleanup; closed 25 Oct without a merge
fix(apple): avoid truncation flag for empty catalogs #5260 fix(apple): avoid truncation flag for empty catalogs; closed 21 Oct without a merge
fix(hopper): bound bridge request frames like the Cutter bridge #5262 fix(hopper): bound bridge request frames like the Cutter bridge; merged 22 Oct
fix(hopper): clarify version-mismatched unsupported builds #5275 fix(hopper): clarify version-mismatched unsupported builds; no conflict now and checks passing
docs(errors): include Omarchy and current host-support messages in error catalogue (#5078) #5278 docs(errors): include Omarchy and current host-support messages in error catalogue ([Bug] Host-support error catalogue omits Omarchy and understates doctor support #5078); merged 21 Oct
fix(sqlite): bind returned cleanup errors to their exact root and worker owners #5301 fix(sqlite): bind returned cleanup errors to their exact root and worker owners; closed 25 Oct without a merge
ci: publish OpenSSF Scorecard results #5304 ci: publish OpenSSF Scorecard results; no conflict now and checks passing
fix(native): report unresolved native UI PID and window selections as invalid input #5307 fix(native): report unresolved native UI PID and window selections as invalid input; closed 25 Oct without a merge
fix(managed): retain type discovery after member limits #5312 fix(managed): retain type discovery after member limits; merged 22 Oct
feat(firmware): attribute hardware MMIO peripheral memory regions in native disassembly #5348 feat(firmware): attribute hardware MMIO peripheral memory regions in native disassembly; merged 22 Oct
feat(environment)!: serve the environment state by default #5351 feat(environment)!: serve the environment state by default; merged 21 Oct
feat(environment): render more read tools from the state and describe responses #5352 feat(environment): render more read tools from the state and describe responses; merged 21 Oct
feat(macho): report per-slice encryption status in inspect_macho #5359 feat(macho): report per-slice encryption status in inspect_macho; no conflict now and checks passing
test(sqlite): keep incomplete cleanup primary over late cancellation #5365 test(sqlite): keep incomplete cleanup primary over late cancellation; merged 21 Oct
fix(gdb): preserve the caller's abort reason when startup is cancelled #5374 fix(gdb): preserve the caller's abort reason when startup is cancelled; closed 21 Oct without a merge
fix(gdb): keep a failed startup retained for cleanup out of ready state #5375 fix(gdb): keep a failed startup retained for cleanup out of ready state; closed 21 Oct without a merge
fix(gdb): keep the caller's abort reason when startup cancels #5382 fix(gdb): keep the caller's abort reason when startup cancels; closed 21 Oct without a merge
fix(javascript): resolve preceding exported variable initializers and computed method keys #5387 fix(javascript): resolve preceding exported variable initializers and computed method keys; no conflict now and checks passing
fix(ghidra): publish the stable launcher root when it proves the install #5392 fix(ghidra): publish the stable launcher root when it proves the install; closed 21 Oct without a merge
fix(objdump): scope debug-link caveat to DWARF #5410 fix(objdump): scope debug-link caveat to DWARF; closed 24 Oct without a merge
fix(ghidra): treat format-specific disabled analyzers as not applicable #5425 fix(ghidra): treat format-specific disabled analyzers as not applicable; merged 22 Oct
fix(adb): read the package id from appId on Android 16 #5427 fix(adb): read the package id from appId on Android 16; closed 25 Oct without a merge
#5430 fix(native): declare filesystem write effect for inspect_signature; closed 25 Oct without a merge
#5432 fix(mcp): report duplicate unknowns accurately; closed 21 Oct without a merge
#5471 fix(cli): restore documented guidance for argument validation errors; closed 24 Oct without a merge
#5478 test(managed): retain repeated member-site coverage; no conflict now and checks passing
#5491 fix(mcp): refuse a one-element initialize batch without evicting the session; closed 25 Oct without a merge
#5495 fix(artifacts): distinguish non-directory output paths from identity changes; closed 25 Oct without a merge
#5508 fix(setup): preserve explicit clients with all-detected selection; merged 22 Oct
#5514 fix(cli): print compact mcp doctor JSON when stdout is redirected; merged 22 Oct
#5518 docs(web-bundle): describe objectValue as a named-property lookup; closed 21 Oct without a merge
#5519 docs(errors): record the implemented process-input read diagnostic; closed 23 Oct without a merge
#5539 fix(gdb): keep inferior-tty verification for read-only queries; no conflict now and checks passing
#5545 feat(native-api): add varargs field to inspect_native_api boundary; no conflict now and checks passing
#5548 fix(native): remove completed signing capture limitation; merged 21 Oct
#5555 docs(artifacts): clarify unsupported DMG extraction; merged 21 Oct
#5563 fix(apple): attribute object-budget omissions to the object budget; closed 21 Oct without a merge
#5564 fix(sqlite): name the selected path in malformed-database errors; merged 21 Oct
#5565 fix(kuna): reject a dangling cache root link in doctor; closed 21 Oct without a merge
#5566 fix(native): keep per-input demangle outcomes when swift-demangle skips _; closed 21 Oct without a merge
#5567 fix(electron): report fixed fuse reader bounds as non-retryable; closed 21 Oct without a merge
#5569 fix(apple): decode NIBArchive boolean value types with the correct polarity; closed 21 Oct without a merge
#5570 fix(signals): report rejected sigrok selectors as invalid input; merged 21 Oct
#5571 fix(artifacts): report a stable symlink loop as a path resolution failure; merged 21 Oct
#5572 fix(artifacts): keep DMG root observations when the image is already attached; closed 21 Oct without a merge
#5577 fix(desktop): classify rejected desktop roots as target failures; merged 21 Oct
#5578 fix(cli): reject negative and fractional token window values; closed 25 Oct without a merge
#5579 fix(browser): keep cancellation for scenario captures cancelled during startup; closed 21 Oct without a merge
#5581 fix(environment): report later bundle write failures as host failures; merged 21 Oct
#5582 fix(apple): trace LC_LAZY_LOAD_DYLIB_INFO lazy dylib dependencies; closed 20 Oct without a merge
#5583 fix(swift): match legacy runtime names by format, not a _Tt substring; closed 21 Oct without a merge
#5587 fix(process): bound output draining after a stoppable command's grace; closed 20 Oct without a merge
#5588 fix(diagnostics): name fixed inspection budgets in refusal recovery; closed 21 Oct without a merge
#5591 fix(ida): fail doctor readiness for FIFO registrations and unusable workspace roots; closed 20 Oct without a merge
#5592 fix(artifacts): stop offering integrity-policy retries for checksum-invalid DMGs; closed 21 Oct without a merge
#5594 fix(javascript): carry a directly returned value's literal to its return site; closed 21 Oct without a merge
#5596 fix(cli): report malformed output values in the selected structured format; closed 25 Oct without a merge
#5599 fix(mcp): align trace feature description with result; closed 25 Oct without a merge
#5600 feat(environment): apply evidence-gated write effects to the served state; merged 22 Oct
#5602 fix(cli): route analyze based on bundle layout, not directory name suffix; closed 24 Oct without a merge
#5612 fix(native): keep .. after directory symlinks in selected plist paths; closed 24 Oct without a merge
#5618 fix(kuna): reject version/digest mismatch from replaced executable; closed 25 Oct without a merge
#5629 feat(cli)!: export row-oriented results as JSON Lines; merged 23 Oct
#5639 fix(browser): exclude replayed lifecycle milestones from session activity; closed 20 Oct without a merge
#5644 fix(observation): keep incomplete cancellation observations; merged 20 Oct
#5645 fix(process): retain compiler roots after bounded output drain; closed 21 Oct without a merge
#5660 feat(analysis)!: default function MCP output to retained summaries; merged 24 Oct
#5662 feat(ghidra): bound one procedure's decompile without closing the session; merged 23 Oct
#5664 feat(analysis-view): share templated positions across manifest tools; merged 21 Oct
#5672 fix(artifacts): own source errors during output setup; no conflict now and checks passing
#5699 feat(environment): compare an environment with probe captures of its application; merged 22 Oct
#5754 fix(native): keep recorded-core note types owner-qualified; closed 25 Oct without a merge
#5764 docs(native): explain resource-only bundle admission; no conflict now and checks passing
#5776 build(deps): update vite to 8.3.4 for launch-editor advisories; closed 25 Oct without a merge
#5778 fix(native): reject mixed dyld refusal diagnostics; no conflict now and checks passing
#5785 feat(il2cpp): link generic method instances behind --generic-instances; merged 24 Oct
#5787 feat(environment): list every entity on a list's whole lines; merged 22 Oct
#5788 fix(native): admit thin arm64_32 Mach-O targets for static inspection; merged 22 Oct
#5790 fix(mcp): stop advertising an unreturned operation count for trace_feature; closed 25 Oct without a merge
#5793 fix(mcp): report Linux-only integrations as unsupported_host off their hosts; merged 22 Oct
#5794 feat(binary-ninja): add GUI MCP analysis provider; no conflict now and checks passing
#5800 feat(environment): answer list filters, search, sorting and paging from the state; merged 22 Oct
#5869 fix(javascript): omit unselected-source limitation when every source is selected; closed 25 Oct without a merge
#5888 fix(native): keep Ghidra data labels out of Objective-C class names; closed 25 Oct without a merge
#5918 fix(model): admit safetensors header lengths that resemble pickle markers; merged 22 Oct
#5927 fix(reference)!: honor nested .gitignore files; closed 24 Oct without a merge
#6005 fix(mcp): name response-byte and startup ceilings in recovery; merged 21 Oct
#6014 fix(providers): name JEB, IDA, and one-shot command deadlines; merged 21 Oct
#6019 feat(javascript): retain queryable static route inventories; merged 22 Oct
#6054 fix(artifacts): preserve DMG caller cancellation reason; closed 25 Oct without a merge
#6059 fix(native): recover macOS command deadlines; merged 21 Oct
#6062 npm run test:focused -- tests/process-global/hopperFileOffsetDescriptorOwnership.test.ts - 4 passed.; closed 25 Oct without a merge
#6096 feat(hyperagent-local): ship My Agent local app; closed 21 Oct without a merge
#6124 fix(ghidra): point Windows ELF rejection to WSL2 fallback; closed 25 Oct without a merge
#6129 fix(javascript): preserve unavailable source coverage for invalid UTF-8; closed 25 Oct without a merge
#6139 fix(native): inspect an explicit plist path over MCP without an open target; closed 24 Oct without a merge
#6141 fix(snapshot): keep mismatch, output-loss, and declaration require diagnostics precise; closed 23 Oct without a merge
#6150 fix(diagnostics): attribute input and refusal failures to their source; closed 23 Oct without a merge
#6151 fix(cancellation): preserve the caller abort reason; closed 23 Oct without a merge
#6155 fix(domain): reject unwalkable Mach-O load-command tables at admission; closed 24 Oct without a merge
#6157 Personal; closed 22 Oct without a merge
#6178 test(fixtures): skip permission-denial tests when DAC-bypass caps keep files readable; closed 24 Oct without a merge
#6179 fix(pcap): report capture summaries unsupported where their bound is unavailable; closed 25 Oct without a merge
#6180 docs(errors): correct stale capability-unknown and comparison-rationale rows; closed 23 Oct without a merge
#6184 fix(analysis-view): attribute unsupported artifact view kinds to view; closed 25 Oct without a merge
#6188 fix(adb): name unexecutable adb paths in readiness refusals; no conflict now and checks passing
#6202 fix(analysis-view): preserve binary layout field diagnostics; closed 24 Oct without a merge
#6203 fix(analysis-view): preserve HAR grouping parent diagnostics; closed 25 Oct without a merge
#6240 feat(ghidra): analyze GameCube/Wii DOL executables through Ghidra; merged 24 Oct
#6241 fix(il2cpp): accept names filters on type references; closed 24 Oct without a merge
#6246 fix: correct pcap parent guidance and preserve loader base uncertainty; closed 24 Oct without a merge
#6248 fix(cli): describe analysis-view parents through the shared contract; closed 25 Oct without a merge
#6253 fix(doctor): check only the current platform's Hopper launcher candidates; merged 23 Oct
#6274 fix(javascript): propagate ancestor absence in export shape comparisons; closed 25 Oct without a merge
#6306 chore(experiments): prototype MCAP summary inspection; no conflict now and checks passing
#6315 fix(runtime)!: require patched Node.js security releases; merged 23 Oct
#6317 fix(artifacts): include table index in CArchive TOC entry diagnostics; closed 25 Oct without a merge
#6324 Fix snapshot replay tests for unknown question assertions; closed 25 Oct without a merge
#6327 fix(sqlite): report result-column capacity refusals as capacity; merged 23 Oct
#6340 fix(browser): keep refresh guidance for a missing CDP target; merged 22 Oct
#6342 fix(process): name the fixed finalization delivery grace; no conflict now and checks passing
#6350 fix(contracts): advertise the Frida remote address character set; no conflict now and checks passing
#6355 fix(doctor): ignore Linux Hopper launcher candidates on macOS; closed 25 Oct without a merge
#6356 fix(browser): preserve script inventory boundary across async source reads; closed 25 Oct without a merge
#6369 fix(gdb): reject queued commands once their session is closing; closed 23 Oct without a merge
#6371 fix(native): report plist symlink loops and overlong paths as selection failures; merged 23 Oct
#6372 fix(hopper): report invalid regex patterns as pattern input errors; merged 23 Oct
#6373 fix(browser): record session load failures only for main-frame documents; closed 24 Oct without a merge
#6383 docs: repair dead anchors and unambiguous documentation errors; no conflict now and checks passing
#6384 fix(javascript): exclude type, enum and meta-property names from lexical reads; closed 24 Oct without a merge
#6385 feat(environment): give more write tools a state target; merged 24 Oct
#6386 docs(skill): state the setup install limit once; closed 23 Oct without a merge
#6388 fix(sqlite): attribute result-column limit to columns instead of data…; closed 24 Oct without a merge
#6392 fix(ghidra): thin the selected universal Mach-O slice into the private import; no conflict now and checks passing
#6393 fix(artifacts): keep the primary catalog failure when cleanup fails; closed 25 Oct without a merge
#6395 fix(signals): name the limiter as a possible cause of a failed sigrok version probe; no conflict now and checks passing
#6416 chore(deps): update Vite security patch and dependency inventory; merged 23 Oct
#6492 fix(python): keep pyc string previews on Unicode boundaries; merged 23 Oct
#6498 fix(android): preserve schema issues in input errors; closed 24 Oct without a merge
#6509 feat(pe): inspect import and delay-load tables; merged 24 Oct
#6511 feat(apple): inspect IPS crash reports; merged 24 Oct
#6628 fix(python): classify negative marshal string sizes as malformed; closed 25 Oct without a merge
#6633 fix(python): classify negative marshal string lengths as malformed input; closed 25 Oct without a merge
#6645 fix(hopper): preserve POSIX path separators for macOS and Linux Hopper launchers; closed 25 Oct without a merge
#6724 fix(uninstall): keep the reason when valid Cordis YAML is refused; closed 24 Oct without a merge
#6744 fix(objdump): name the rejected field in inspect-with-objdump input errors; closed 24 Oct without a merge
#6748 fix(ghidra): report kernel OOM kills as a memory constraint; merged 23 Oct
#6753 fix(environment): preserve astral token boundaries; closed 24 Oct without a merge
#6759 fix(cli): advertise required CLI selector choices; merged 23 Oct
#6761 fix(execution): exclude discarded POST bodies from request metadata accounting; closed 25 Oct without a merge
#6769 fix(zip): report symlinks declared without permission bits; closed 23 Oct without a merge
#6777 fix(entropy): report symlink loops and overlong paths as path input errors; closed 23 Oct without a merge
#6778 fix(javascript): keep unisolated program-var route values unknown; no conflict now and checks passing
#6791 fix(analysis-view): case-insensitive search now matches Greek final sigma; closed 25 Oct without a merge
#6802 fix(wasm): retain glue query and fragment across line terminators; merged 23 Oct
#6902 fix(environment): preserve literal early ISO years; closed 25 Oct without a merge
#6974 fix(hopper): keep installed apt dependencies at their versions during Linux setup; merged 24 Oct
#6976 fix(apple): keep the nested Rosetta registers of translated crash reports; closed 25 Oct without a merge
#6979 fix(browser): report an out-of-range script_index as a selection fault; merged 25 Oct
#6989 fix(il2cpp): link arm64 builds whose registrations were inlined; merged 24 Oct
#6990 fix(apple): refuse unpaired surrogates in IPS JSON strings; merged 24 Oct
#6991 fix(ghidra): bound bridge request lines above the authentication handshake; no conflict now and checks passing
#7028 fix(evidence): link composed workflows to consumed observations; merged 24 Oct
#7033 test(firmware): exercise the staging ceiling through the emitted refusal; no conflict now and checks passing
#7044 test(javascript): cover the inline-HTML unavailable scope through the public CLI; no conflict now and checks passing
#7052 feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles; merged 25 Oct

Verification details (optional)

I checked each pull request live on 20 October 2026. The fold says how the list is made.

How this list is made

Snapshot. I took a snapshot of the open pull requests at about 4:14 PM UTC on 20 October 2026. It held 357 open pull requests that are not drafts and either conflict with main or have a failing check.
Live check. I re-read each one live. All 357 were still open. Five had changed. Two now conflict, so they moved to the both group. Three have no conflict now and their checks are running, so they are left out. That leaves 354.
Refresh. I refreshed the list at about 7:17 PM UTC on 25 October 2026, using the board as it stood then. 315 moved out, to the Moved on since opening fold. 265 new ones are added. When a pull request's block changes, its line moves to the matching list. Old lines stay in the day group they were in. That makes 304.
Last activity. The days count from the author's last push or comment. Maintainer comments do not reset it. A pull request with no author activity counts from its last push.
Failing CI. Any failing check counts, whether or not it is required.
Changes requested. A review with changes requested, from an owner, member or collaborator who is not the author.
Age. Every pull request here is 14 days old or younger.

Related trackers

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates

#3537: Open bugs, by subsystem (matbrgz)
#4330: Duplicate issues, in clusters (matbrgz)
#5653: New issues by area, pointing at #4330 for duplicates (CassieFox23)

Features and roadmap

#3796: Feature requests, by area (CassieFox23)
#2383: Support for the top 100 languages (matbrgz)
#2357: Static file and crash report work (matbrgz)
#3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
#4027: Browser, Electron and JS work (N0zoM1z0)
#32: The main roadmap (morluto)
#48: The Evidence v2 epic (morluto)
#2039: The roadmap in plain words, a discussion (CassieFox23)

Docs

#3795: Open docs issues and PRs (CassieFox23)

Pull requests

#3582: Ready to close or merge, issues and PRs (CassieFox23)
#5654: Open PRs with conflicts or red CI (this one, CassieFox23)

Show and tell

#1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23

#5262 is not conflict again @CassieFox23 , thanks to @morluto

@CassieFox23

@CassieFox23 #6327 didnt fail any CI Check i think, only some were skipped

Thanks, DeryFerd, you're right about the current head. On 7ab66ee, 25 checks pass, 19 are skipped, and none fail.

The (CI) tag means a check was failing when the tracker read the board. That read was at 12:18 PM EDT today. The branch was force-pushed after that, so the tag came from the earlier head. Tonight's tracker refresh moves it to the passing list.

🤖 Written with Claude Code (Haiku 5.5, verified by Opus 5.5), posted with my OK 🦊

@CassieFox23

@CassieFox23 thank you very much.

new PRs: #6990 and #6991 are failed because main upstream is still failed, i'll keep updatting it

update: #6991 is now full green

Navigation Menu

[Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #5654

Current limitation

Desired outcome and success criteria

Verification details (optional)

Related trackers

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

[Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #5654

Description

Current limitation

Desired outcome and success criteria

Verification details (optional)

Related trackers

Activity

DeryFerd commented on Oct 22, 2026

DeryFerd commented on Oct 22, 2026

CassieFox23 commented on Oct 22, 2026

DeryFerd commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions