rea.run
Compliance
EN 中文

Changelog

What shipped, through rea-agents 6.4.0

Community index of GitHub releases from 3.2.0 (2026-10-03) through 6.4.0 (2026-10-11). Times are release published_at in UTC. npm latest checked on 2026-10-13 was 6.4.0. Feature sentences are shortened from those release bodies. The upgrade procedure lives on the breaking-change runbook.

Pin this site teaches

npx -y [email protected] setup
npx -y [email protected] doctor --json

Node engines for that tarball: ^22.19.0 || ^24.11.0 || >=26.0.0. MCP Registry id: io.github.morluto/rea (the registry installs the same npm package; it is not a second artifact). Client IDs: 6.4.0 matrix.

Release index

VersionPublished (UTC)Operator note
3.2.0 2026-10-03 16:43 Native investigation features (#486).
3.2.1 2026-10-03 19:58 Patch: tolerate npm registry propagation delay. No feature list.
4.0.0 2026-10-05 18:29 Breaking. Unscoped setup refreshes only existing REA registrations (--all-detected for every detected client). Replay, permission, and several tracing tools removed. Managed comparison metadata adds exact-signature matching.
4.0.1 2026-10-05 18:54 Patch: allow npm propagation time. No feature list.
4.1.0 2026-10-06 17:57 Static Android via headless JADX (#738), firmware Binwalk/Unblob, IDA read-only MCP (#754), Command Code setup (#645), more Ghidra surfaces including Windows x64 read-only.
5.0.0 2026-10-07 17:26 Breaking: Android analysis needs a full JDK 17+ with the compiler module. Also Apple/Android inventory graphs, browser capture tracing, Wakaru recovery. Upstream install notes at the 6.4.0 tag describe this checkpoint as 133 MCP tools.
6.0.0 2026-10-08 09:40 Breaking: MCP filesystem inputs require absolute host paths (#948, #1004). CLI relative paths remain. Steps.
6.1.0 2026-10-09 01:08 Breaking for Hopper: ECMAScript Unicode regex, five-second deadline, set_current_document removed. Steps.
6.2.0 2026-10-09 16:51 Breaking Evidence contract. Success payload is the record; read normalized_result. always-bump-minor called out in the migration guide. Steps.
6.3.0 2026-10-09 23:56 Breaking captures: producer accounting and transaction identity required. Do not synthesize missing web-diff dimensions. Steps.
6.4.0 2026-10-11 03:58 Current npm latest. Android ADB lane, caller-started JEB MCP, Pi / Hermes / Qwen Code setup, compact MCP schemas, large Evidence views. Breaking: network.websocket_connections replaces network.websocket_events. Steps.

Seven tags from 3.2.0 (3 Oct) through 6.0.0 (8 Oct), then 6.1.0–6.4.0 on 9–11 Oct. That pace is why a floating install in CI is a behavior change, not a refresh.

How to read a minor bump

  1. Open the GitHub release for the version you will install. Confirm published_at before you quote it.
  2. If the body contains BREAKING CHANGES, follow the runbook even when the bump is only minor. 6.2 states that always-bump-minor includes breaking releases.
  3. Refresh MCP tool definitions and restart the client. A new package does not update a server that is already running.
  4. Keep saved Evidence, snapshots, and captures until a regenerated file has been checked. Fresh analysis does not rewrite what an older capture proved.
  5. Re-run doctor --json on the pin and store the output with the ticket.

Not in npm 6.4.0

main after the 6.4.0 tag is not a release. As of the install doc on main checked 2026-10-13, Factory Droid (droid) and DeepSeek Harness (dsh) are pending a later npm publish. rea setup --client dsh against [email protected] is an unsupported client. Do not document them as available on this pin. Open pull requests (CodeBuddy setup, WebAssembly components, and others) are the same: wait until they merge and ship in an npm version above 6.4.0.

The supported-agents table inside tag rea-agents-6.4.0 still has a paragraph written while npm latest was 6.3.0, saying Pi, Hermes, and Qwen Code were not in that older tarball. The 6.4.0 release notes list those three setups as added, and a later main note says the published 6.4.0 package accepted dry-run plans for the 17 client IDs in that release. Use the client matrix, then doctor --client <id> --json.

Where to read next