
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@sinlair/reagent
Advanced tools
Standalone local-first runtime and CLI for long-running research workflows.
Use one always-on runtime for research, memory, channels, and delivery surfaces.
reagent is the primary product surface.@sinlair/reagentReAgent is not a chat wrapper with a few extra research commands.
It is a standalone runtime and CLI for people who want:
ReAgent is currently strongest for:
The main product loop is:
reagent onboardreagent homereagent service ...reagent runtime ...reagent research ...reagent memory ...The design principle is simple:
npm install
npm run db:push
npm run dev
Minimal local setup:
LLM_PROVIDER=fallback
WECHAT_PROVIDER=mock
If PowerShell blocks npm, use npm.cmd.
npm install -g @sinlair/reagent
reagent onboard
reagent home
reagent service run
The published package name is @sinlair/reagent.
The installed command is reagent.
First-run flow:
reagent onboard
reagent home
reagent service run
Repair flow:
reagent doctor
reagent doctor --fix --skip-db
Daily control flow:
reagent home
reagent runtime status
reagent runtime logs --follow
reagent research recent
reagent research tasks
reagent memory recall "recent research choices"
reagent channels status
Example research flow:
reagent research enqueue "multimodal web agents" --question "Which open-source baselines are strongest?"
reagent research tasks
reagent research task <taskId>
reagent research report <taskId>
ReAgent is built around an always-on runtime.
Use:
reagent home for the product overviewreagent onboard for first-run setupreagent doctor for diagnostics and safe local repairreagent service ... to manage the supervised runtimereagent runtime ... to inspect health, status, dashboard, logs, and doctor outputAlways-on service lifecycle:
reagent service install
reagent service status
reagent service start
reagent service restart
reagent service stop
The web console is a companion surface, not the main control plane.
Use it for:
Use the CLI for:
ReAgent keeps research state durable.
Key layers:
MEMORY.md for long-term memorymemory/YYYY-MM-DD.md for daily notesmemory-index.jsonresearch/task-runs.jsonresearch/rounds/<taskId>/This is intentional:
| Path | Purpose |
|---|---|
./ | Root ReAgent runtime, CLI, web console, and API server |
docs/ | Product visuals and supporting docs |
| Mode | Commands | Notes |
|---|---|---|
| Development | npm run dev | Local development with live reload |
| PM2 | npm run pm2:start / npm run pm2:restart / npm run pm2:logs | Background runtime with PM2 |
| Windows Service | npm run service:install / npm run service:status / npm run service:start / npm run service:stop | Machine-level runtime on Windows |
See OPERATIONS.md for deployment and maintenance details.
OpenClaw is not the main product direction.
It is useful as:
If you are adopting ReAgent, install the standalone package:
npm install -g @sinlair/reagent
ReAgent does not ship a second public adapter package anymore. The product install path is the standalone @sinlair/reagent CLI.
Validation:
npm run check:all
npm run test
If you only want to validate the standalone publishable package:
npm run release:verify
npm run release:pack
ReAgent is informed by projects such as:
Released under the MIT License.
FAQs
Local-first research workspace and runtime CLI
The npm package @sinlair/reagent receives a total of 0 weekly downloads. As such, @sinlair/reagent popularity was classified as not popular.
We found that @sinlair/reagent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.