REA 6.5.0 Adds Source-Scoped Analysis, Giving Reverse-Engineering Agents a Clear Evidence Boundary

Reverse-engineering agent tool REA released version 6.5.0 on October 14. The update focuses on specifying JavaScript sources, reconstructing relationships across bundles, and providing summary and pagination interfaces for retained analysis evidence. The GitHub release falls within this two-day observation window, while the changelog inside the release is dated October 13. Release announcement

REA provides coding agents with tools for inspecting applications. The official Electron example shows how the tool can trace an API call in the renderer to an IPC channel in the preload script, then locate the main process and CSV-writing function. These cross-file clues can help agents narrow the scope of an investigation. However, statically inferred call paths still need to be confirmed through runtime observation. Official analysis guide

The source-selection change affects the analysis work itself. Previously, even when a summary was requested, the reader still loaded text from all relevant files, and the analyzer processed the entire application before reducing the returned content. The new CLI allows repeated use of --source-path, while MCP accepts source_paths, so analysis results can be produced first for known entry-point files. Unselected files retain their identity and remain in the full inventory, and byte integrity is still verified, but they are not decoded as text or semantically analyzed. Import relationships do not automatically expand the selection. Implementation and validation notes

Version 6.5.0 also makes several types of analysis results return a concise summary first, with retained Evidence available through pagination, avoiding the need to rerun analysis to read details. Cross-bundle reconstruction preserves each file’s source information and relationships between imports across chunks. For agent workflows, this helps separate “which materials were analyzed” from “how much content was sent to the model in this turn,” while keeping unchecked areas explicitly unknown. Release notes

Engineers should still pay attention to the limits of the validation: source selection has been tested with real ASAR files using the Linux CLI and MCP, but there is no contemporaneous timing comparison with full analysis, so the results do not support claims of a fixed speedup. Cross-bundle tests are limited to Linux x64, Wakaru 1.14.0, and the project’s own esbuild and webpack samples. When adopting the feature, check that the selected sources include any necessary manifests, HTML, and source maps, and confirm that agents do not interpret partial evidence as a complete account of the application’s behavior. Test limitations, release validation scope