rea-agents 1.5.0 → 1.7.0

package/scripts/rea.mjs

@@ -1,16 +1,29 @@
 #!/usr/bin/env node
 
+import { access } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
 // Route production MCP before importing Incur. Incur owns registration helpers
-// such as `mcp add`, while only dist/main.js may serve the 70-tool stdio server.
+// such as `mcp add`, while only dist/main.js may serve the 78-tool stdio server.
 const args = process.argv.slice(2);
 const { default: packageJson } = await import("../package.json", {
   with: { type: "json" },
 });
 process.env.REA_PACKAGE_VERSION = packageJson.version;
 const isMcpMode =
-  args[0] === "--mcp" || (args.length === 1 && args[0] === "mcp");
+  args.length === 1 && (args[0] === "--mcp" || args[0] === "mcp");
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const runtimeFiles = isMcpMode
+  ? ["dist/main.js"]
+  : ["dist/cli.js", "dist/cliOutput.js"];
 
-if (isMcpMode) {
+if (!(await compiledRuntimeExists(runtimeFiles))) {
+  process.stderr.write(
+    `REA's compiled runtime is missing. Run \`npm ci\` in ${packageRoot} to install dependencies and build REA, then restart it. If this is an installed package, reinstall rea-agents.\n`,
+  );
+  process.exitCode = 1;
+} else if (isMcpMode) {
   const { runEntrypoint } = await import("../dist/main.js");
   await runEntrypoint();
 } else {
@@ -20,3 +33,24 @@ if (isMcpMode) {
     stdout: (output) => process.stdout.write(sanitizeCliOutput(output)),
   });
 }
+
+async function compiledRuntimeExists(paths) {
+  for (const path of paths) {
+    try {
+      await access(resolve(packageRoot, path));
+    } catch (cause) {
+      if (isMissing(cause)) return false;
+      throw cause;
+    }
+  }
+  return true;
+}
+
+function isMissing(cause) {
+  return (
+    typeof cause === "object" &&
+    cause !== null &&
+    "code" in cause &&
+    cause.code === "ENOENT"
+  );
+}

package/skills/rea-analysis/SKILL.md

@@ -2,16 +2,18 @@
 name: rea-analysis
 description: Reverse engineer apps and websites with REA. Explore how features work, then build a version tailored to your project.
 metadata:
-  version: "13"
-  tool_count: 70
+  version: "14"
+  tool_count: 78
 ---
 
 # REA
 
 Use REA when the user wants to understand how an app or feature works, compare app versions, decompile code, or build a similar feature.
 
-For a website already open in a user-owned Chrome-family browser, use
-`list_browser_targets` and `inspect_web_page` instead of opening a binary. Ask
+For a website already open in a user-owned Chrome-family browser, start with
+`list_browser_targets` and `inspect_web_page` instead of opening a binary. Use
+`analyze_web_bundle`, `observe_web_session`, `discover_webmcp_tools`, capture
+comparison, or screenshot tools only for the corresponding investigation. Ask
 the user to approve the exact page origins and loopback CDP endpoint before the
 first call. Browser observation is disabled unless the operator configured
 `REA_BROWSER_OBSERVE_ENABLED`, `REA_BROWSER_CDP_ENDPOINTS_JSON`, and
@@ -19,11 +21,19 @@ first call. Browser observation is disabled unless the operator configured
 
 Browser inspection is passive. Never claim that it clicked, navigated,
 evaluated page JavaScript, captured prior activity, or contained the page's
-network. Query values, headers, bodies, cookies, storage values, console values,
-and WebSocket payloads are deliberately absent. Request script sources or
-storage key names only when the user separately approves those more sensitive
-outputs. Treat truncation and attach-window coverage as explicit limitations,
-and cite the returned Evidence v2 IDs.
+network. Query values, credentials, cookies, authorization headers, storage
+values, and raw WebSocket or JSON values are deliberately absent. Accessibility
+text, bounded redacted console primitives, value-free JSON/WebSocket shapes,
+script sources, storage key names, source-map fetches, and screenshot pixels
+each require their documented independent opt-in or approval. Treat truncation,
+policy filtering, and attach-window coverage as explicit limitations, and cite
+the returned Evidence v2 IDs. WebMCP declarations are page-declared untrusted;
+REA inventories them but never invokes them.
+
+Electron `file://` pages use `list_electron_targets` and
+`inspect_electron_page` with a separate loopback endpoint and canonical
+filesystem-root authority. Never claim that Electron inspection invoked IPC,
+evaluated renderer JavaScript, navigated, or escaped an approved root.
 
 ## Understand the request