[BeqaKs]

Summary

Fixes #3423

Onboarding still presented npx rea-agents@latest setup and the main-branch curl … | bash installer without an adjacent pinned or reviewable alternative. This PR addresses the remaining item 1 of the issue; items 2–5 were verified as already aligned on current main and are not touched.

Problem and expected behavior

• docs/installation.md introduced @latest as the way to "request the latest release" without first showing a version-pinned command, and its tagged-installer example was hard-coded to 6.7.0 (current release is 6.8.0) outside release-please management.
• website/public/get-started/index.html showed only the main install.sh pipe, and its primary setup command only @latest.
• website/public/faq/index.html and README.md described @latest with no pinned alternative.

Expected: a pinned command is shown first, @latest is described as an explicit opt-in that follows every publish, and the existing tagged rea-agents-<version> download-review-run path is linked where onboarding presents the main pipe.

Change and scope

Documentation only.

• docs/installation.md: package-runner section now shows npx rea-agents@6.8.0 setup (inside x-release-please markers) before the @latest opt-in; the start-setup pointer explains unversioned/@latest resolution and @<version>; the curl wrapper section states the main pipe runs the branch at fetch time and points at the tagged download; the tagged example's rea_version moves to 6.8.0 under release-please markers so it tracks releases (docs/installation.md is already a generic extra-files entry).
• website/public/get-started/index.html: one sentence after the primary @latest setup command, and one paragraph after the main curl command linking to the tagged installer path.
• website/public/faq/index.html: one paragraph after the refresh/one-off guidance.
• README.md: one prose sentence (no new links or bash blocks, so translated README editions stay aligned).
• website/locales/*: regenerated with translations extract (three new source messages; the rest is reference line-number churn).

Not included: rewriting every @latest example across guides/translations, or adding the website HTML to release-please extra-files.

Items 2–5 verified on main (1ff5a65), unchanged

• 2 (passive pauses): docs/javascript-runtime-observation.md:105 and docs/browser-observation.md:164 already state REA does not send Debugger.setSkipAllPauses or resume pauses.
• 3 (scenario timeouts): docs/browser-scenario-contract.md:39-55 now describes duration/action/navigation timeouts versus command_timeout_ms; the "fixed provider-owned liveness limits" wording is gone.
• 4 (event caps): the same document now documents capture.limits retained event budgets; no "no event caps" claim remains.
• 5 (cache fingerprints): the 64 KiB incompleteness claim is no longer in docs/browser-observation.md (docs(browser): correct cache fingerprint completeness limits #3546).

Contract and boundary impact

• Semantic owner and earliest changed stage: install.sh and npm package resolution; docs only.
• Contribution scope fit and linked maintainer decision: not applicable (documentation only).
• CLI and MCP/tool-catalog contract: none.
• Provider, bridge, target-format, or platform compatibility: none.
• Evidence, artifact, provenance, or reconstruction contract: none.
• Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
• Generated metadata, package, or installation impact: release-please will now bump two version literals in docs/installation.md.

Expected effects:

• Read existing files or captured data.
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Source-derived: install.sh accepts --version and --dry-run (install.sh:82-88); tag rea-agents-6.8.0 exists upstream (git ls-remote); package.json version is 6.8.0; release-please-config.json lists docs/installation.md as a generic extra file.

• Tests added or updated: none (documentation only).
• Base reproduction or other evidence: issue [Docs] Pin install commands and align passive-observation and scenario timeout wording with code #3423 source review; installer not run.
• User-visible CLI/MCP output (if applicable): none changed.
• Remaining proof gaps: website.py check could not render the sharing image locally (native Cairo missing); its HTML sync check reported 0 pages changed.

Validation performed

• npm run docs:check — passes (including readmeConsistency.test.ts, 9 tests)
• python3 scripts/website.py translations extract — run; website.py check — shared HTML clean, sharing image skipped (no Cairo)
• npx prettier --check on the four edited source files — passes
• git diff --check — clean

Compatibility, safety, and release

• Breaking changes or migration steps: none
• Real Hopper/Ghidra, browser, or OS coverage: none; documentation only
• Package or release metadata impact: release-please version markers added in docs/installation.md
• Security, privacy, process, or containment review: none

Website scope

FAQ and get-started HTML are intentionally unchanged. Adding English-only onboarding paragraphs forced complete locale catalogs into data-translation-fallback and failed website CI. Pinned/@latest guidance lives in docs/installation.md and a short English README note instead.

Author readiness

Human owner: @BeqaKs

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[greptile-apps]

Confidence Score: 4/5

[Low impact] The PR changes installation guidance without changing installation behavior.

The PR should wait until the existing release-example test failure is fixed.

Findings

1.  Release example test fails ▶

Fix with agent prompt

### Issue 1
docs/installation.md:undefined-1945
The new installer block makes `releaseConfiguration.test.ts` fail. That test expects every version-marked block to contain `rea-agents@${packageJson.version}`, but this block contains only `rea_version=6.8.0`, so the check finds no match. Extend the test to check both example forms against the package version rather than removing the release markers.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR clarifies how to choose a known release and review the installer before running it.

• Setup guidance puts a pinned release beside @latest.
• The installer guide explains how to review a release-tagged script.
• The saved-profile guide drops its MIPS metadata detail.

No new actionable findings or security issues were identified. Whether another PR supersedes this work could not be checked because GitHub access required authentication.

_{Reviews (2) · Last reviewed commit: "docs: prefer pinned install commands and..." · Reviewed by Greptile}

[greptile-apps]

Release example test fails

The new installer block makes releaseConfiguration.test.ts fail. That test expects every version-marked block to contain rea-agents@${packageJson.version}, but this block contains only rea_version=6.8.0, so the check finds no match. Extend the test to check both example forms against the package version rather than removing the release markers.

Prompt To Fix With AI

This is a comment left during a code review.
Path: docs/installation.md
Line: 1945

Comment:
**Release example test fails**

The new installer block makes `releaseConfiguration.test.ts` fail. That test expects every version-marked block to contain `rea-agents@${packageJson.version}`, but this block contains only `rea_version=6.8.0`, so the check finds no match. Extend the test to check both example forms against the package version rather than removing the release markers.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[morluto]

Hey @BeqaKs, thanks for putting this together, the docs update looks useful. What's left: there is 1 unresolved review thread from Greptile, about "Release example test fails". Greptile is at 4/5 on the current head, mainly over "Release example test fails", so addressing that thread should bump it. Once that's done I'm happy to merge it.