hexgraph: v0.9.0

0.9.0 (2026-07-07)

Features

• gate the whole-program tools on a saved analysis (error -> re_analyze) (#261) (a84ea48)
• make re_analyze + the analysis gate backend-aware (radare2, not just Ghidra) (#263) (9229979)
• mcp: re_* query tools + gated re_script escape-hatch (#267) (fa6fa3e)
• persist radare2 analysis as a reusable project (analyze-once for the r2 backend) (#262) (aabb016)
• persistent per-target Ghidra bridge — resident project, fast repeated decompiles (PR1) (#264) (0968acb)
• re_analyze — explicit detached whole-binary analysis with single-flight (#260) (50fcd67)
• serve all Ghidra ops (xrefs/taint/emulate/rename) over the resident bridge (#268) (818fb50)

Bug Fixes

• enforce the analysis invariant — only re_analyze runs a full analysis (#270) (ee2d641)
• give sandbox probes a container-side self-timeout (orphan-proof the budget) (#257) (fd44a9b)
• never auto-delete Ghidra analysis; eviction is explicit-only (#259) (faeee73)
• re_disassemble uses a targeted r2 path, not the whole-binary decompiler (#258) (5bf5a26)
• re_search_code byte/immediate scan no longer runs a whole-binary analysis (2547s timeout) (#269) (1645b3b)
• serve xrefs from the warm Ghidra project, not a cold per-call r2 sweep (#256) (abaaaab)
• tolerate non-array agent-authored evidence in the finding inspector (no white-screen) (#253) (2406445)
• validate src_build phases instead of crashing or faking success (#255) (6ddfb70)