v1.0.4 — pinned-version REA

Pinned-version REA for DeepSeek Harness.

REA (rea-agents) is a reverse-engineering MCP server with 207 tools
covering native binaries, APKs, firmware, packet captures, browser and Electron targets, WASM and
SQLite.

The usual way to wire it into a harness is npx -y rea-agents@latest mcp. That is convenient and it
means every harness start downloads and executes whatever the registry most recently published.
For a tool whose whole job is producing evidence you then reason about, that is the wrong default: a
silent upgrade makes results incomparable between sessions, and a compromised release is live
immediately with no version to roll back to.

This plugin inverts the default. Boot reads a pinned copy from disk, and the version moves only when
you press Update on the plugin's own card. Both counts are shown side by side, and an update that
lands behind the registry's newest is reported as caused by pnpm's minimumReleaseAge policy rather
than presented as a success.

Install

Desktop — the profile is managed exclusively by the Electron application, so install from inside
the app: Plugins → Add.

# web / tui profiles, from the CLI
dsh plugin --profile web add dsh-rea-agents

Restart dsh, then open Plugins → dsh-rea-agents and press Install on the card to fetch REA
itself into the profile at one exact version.

Confirming REA is connected

A version on the card only proves the plugin is running. To confirm the tools are registered with the
model, hand this to the assistant:

List your mcp__rea__ tools, then call mcp__rea__binary_session with an empty {} and show me
what it returns.

Engines are yours to provide

The plugin installs no analysis engine, exactly like REA itself. Native binaries need Ghidra 12.1.x +
JDK 21+ (or your own IDA); APKs need jadx and apktool; devices need adb; packet, signal, firmware and
WASM work needs tshark, sigrok-cli, binwalk or unblob, and WABT. A missing engine makes only its own
tools report provider_unavailable, and the message names the variable to set.

What is pinned, and where

<profile>/package.json              # dependencies: rea-agents@<version>, declared exactly
<profile>/dsh-rea-agents/pin.json   # pin record: version, time, origin, withheld builds

The plugin never reads or writes your cordis.patch.yml.

In this release

• Pins rea-agents to one exact version and starts its MCP server from that copy
• Controls on the plugin's own card: install, check for a newer version, update, uninstall, refresh
• Judges install success by what landed on disk, so pnpm's ignored optional frida build script is
  reported as a withheld build rather than a failed installation
• A distinct rea-agents-mcp entry id, so a stale hand-written rea-mcp override in a profile cannot
  silently switch the MCP server off while the card keeps working
• Bilingual (Chinese / English), following the active interface locale
• GET /rea-agents/diagnose reports whether the browser half reached the page's module graph

Full changelog: CHANGELOG.md