v1.0.8 — language follows the interface, in-place updates, manual language picker

Pinned-version REA for DeepSeek Harness. Four releases since 1.0.4, all driven by testing the
plugin against a real profile.

Upgrade

Desktop profiles are managed by the Electron application, so update from inside the app. The card
re-reads the on-disk version after every action, so the new version is shown without a manual
refresh.

# web / tui profiles
dsh plugin --profile web add dsh-rea-agents@1.0.8

Fixed

The section did not reliably follow the interface language. This took three attempts, and the
first two fixed the wrong thing — which field was read, then how the subscription was wired. The
mechanism was wrong: the section expected the shell to hand it a translator through props, and that
seat is not populated for this slot, so it fell back to a fixed English translator that by
definition never follows the interface. It now reads the shell's language itself and holds it as
component state, so a change redraws the section. Nothing depends on an injection this project has
not measured.

"Update" could be deadlocked by an unrelated dependency. pnpm verifies the whole lockfile
before changing anything, so any entry still inside its supply-chain waiting period blocks every
operation — in the report, a freshly published dshmarket blocked updating REA. Update is now a
single in-place pnpm add (the preceding remove was unnecessary, and was itself the step that
failed), and when pnpm does refuse, the offending entries are parsed out of its own message and
exempted for one retry. The package being installed is never exempted: if REA's own target is
too new the run stays failed and says so.

A successful update could leave the card showing the old version until it was refreshed by hand.
An install takes close to a minute and its reply is losable; the card trusted that reply. Every
action now re-reads the state from disk, and a lost reply whose version did move is reported as the
success it is rather than as a failure.

Added

A manual language picker — "Follow interface / 中文 / English" — in the section's corner, with a
visible label. It applies to this section only and does not change DSH's own setting: you may prefer
a Chinese interface while sharing English screenshots, or the reverse. The choice is remembered in
the browser.

Notes

• 207 REA tools across native binaries, APKs, firmware, packet captures, browser and Electron
  targets, WASM and SQLite; engines are yours, and a missing one names the variable to set.
• Requires Node ≥ 22.19.0.
• The card states which version each source reports — current, registry latest, and the profile's
  declaration — so an update that lands behind the newest is explained rather than presented as a
  success.

v1.0.4 — pinned-version REA

Pinned-version REA for DeepSeek Harness.

REA (rea-agents) is a reverse-engineering MCP server with 207 tools
covering native binaries, APKs, firmware, packet captures, browser and Electron targets, WASM and
SQLite.

The usual way to wire it into a harness is npx -y rea-agents@latest mcp. That is convenient and it
means every harness start downloads and executes whatever the registry most recently published.
For a tool whose whole job is producing evidence you then reason about, that is the wrong default: a
silent upgrade makes results incomparable between sessions, and a compromised release is live
immediately with no version to roll back to.

This plugin inverts the default. Boot reads a pinned copy from disk, and the version moves only when
you press Update on the plugin's own card. Both counts are shown side by side, and an update that
lands behind the registry's newest is reported as caused by pnpm's minimumReleaseAge policy rather
than presented as a success.

Install

Desktop — the profile is managed exclusively by the Electron application, so install from inside
the app: Plugins → Add.

# web / tui profiles, from the CLI
dsh plugin --profile web add dsh-rea-agents

Restart dsh, then open Plugins → dsh-rea-agents and press Install on the card to fetch REA
itself into the profile at one exact version.

Confirming REA is connected

A version on the card only proves the plugin is running. To confirm the tools are registered with the
model, hand this to the assistant:

List your mcp__rea__ tools, then call mcp__rea__binary_session with an empty {} and show me
what it returns.

Engines are yours to provide

The plugin installs no analysis engine, exactly like REA itself. Native binaries need Ghidra 12.1.x +
JDK 21+ (or your own IDA); APKs need jadx and apktool; devices need adb; packet, signal, firmware and
WASM work needs tshark, sigrok-cli, binwalk or unblob, and WABT. A missing engine makes only its own
tools report provider_unavailable, and the message names the variable to set.

What is pinned, and where

<profile>/package.json              # dependencies: rea-agents@<version>, declared exactly
<profile>/dsh-rea-agents/pin.json   # pin record: version, time, origin, withheld builds

The plugin never reads or writes your cordis.patch.yml.

In this release

• Pins rea-agents to one exact version and starts its MCP server from that copy
• Controls on the plugin's own card: install, check for a newer version, update, uninstall, refresh
• Judges install success by what landed on disk, so pnpm's ignored optional frida build script is
  reported as a withheld build rather than a failed installation
• A distinct rea-agents-mcp entry id, so a stale hand-written rea-mcp override in a profile cannot
  silently switch the MCP server off while the card keeps working
• Bilingual (Chinese / English), following the active interface locale
• GET /rea-agents/diagnose reports whether the browser half reached the page's module graph

Full changelog: CHANGELOG.md