Add rea-captcha

[IRONICBo]

Why it belongs

rea-captcha is agent-enabling: it adds a substantive verification-recovery boundary to an external browser agent rather than claiming to be the planning agent itself. A Browser Use or Playwright/CDP workflow can keep its current session, pause for an authorized test action or human handoff, inspect fresh evidence, and resume only after the configured boundary reports clearance.

It fits the existing Browser Automation category because its documented purpose is recovering an interactive, multi-step browser workflow without replacing the caller-owned session.

First-party evidence

• Repository and README — TypeScript SDK, local stdio MCP server, Browser Use plugin, and caller-owned browser adapters.
• Browser Use handoff guide — same-session pause, bounded wait, uncached reinspection, and fail-closed behavior.
• Case matrix — provider test-key and authorized-origin boundaries; production interactive challenges remain human work.
• MIT license.

Validation

• npm run validate:content -- --require-submitters — passed for 16 categories and 65 tools.
• 84 non-platform-specific tests — passed.
• The complete local npm test additionally exercises a Bash mapfile workflow test that cannot run under macOS Bash 3.2; GitHub's Linux CI is the authoritative check for that repository-owned workflow test.

[foo-bender]

Outcome: changes-requested

Policy assessment
@IRONICBo The agent-enabling classification and web-browser-interaction-tools category fit a substantive caller-owned-session handoff/controller workflow; this is genuine MIT implementation source, not merely MCP marketing. Schema, product identity and the bounded authorized-test/human-production distinction check out. However, tools/rea-captcha.md overstates the Python channel's fail-closed boundary.

At current main and v0.3.1, ChallengePlugin._inspect turns an unavailable state or missing DOM into empty text; detect_challenge reports it inactive; _wait_for_human calls resume. An offline probe using the first-party plugin/detector with a mocked BrowserSession reproduced pause=1, resume=1, no error after an active challenge in both cases. This contradicts the claimed failure instead of resume on unavailable evidence. The main and v0.3.1 plugin bytes match; the downloaded official v0.3.1 wheel also contains identical plugin/detector bytes. This is not a live browser or third-party CAPTCHA test.

Please qualify the non-editorial guarantees (classification/inclusion rationales, limitations and body) by actual integration/version, explicitly disclose this Python failure mode, and replace or narrow the affected evidence claim with first-party evidence that matches implementation. If retaining the stronger Python guarantee, provide a fixed, versioned implementation with regression evidence. Do not apply stateful controller/one-shot guarantees to every channel: stateless MCP only analyzes evidence, and the Python plugin is narrower than the TypeScript controller.

Evidence checked
Fetched all four exact evidenceSources URLs and compared website/Browser Use docs, repository/controller/Playwright policy, skill/MCP, MIT license, package/npm and v0.3.1 release metadata. Three items validate; the guide guarantee below conflicts with implementation. Provider-test keys/exact authorized origins and human handling of production interactive challenges are supported; no hosted solver, arbitrary-production bypass or benchmark is established.

Evidence requiring correction or removal

• https://github.com/masakaai/rea-captcha/blob/main/docs/browser-use.md — The guide claims failure when evidence is unavailable, but the advertised Python plugin at both v0.3.1 and current main resumes after missing state/DOM. The offline probe reproduced that fail-open behavior; this URL therefore does not substantiate a reliable failure-on-unavailable-evidence guarantee for the listed Python channel.
  Please correct or remove each evidence item above.

Implementation snapshot: https://github.com/masakaai/rea-captcha/blob/1df0d2cd79518b05f4f1a1619a8f133aa6a22f38/python/src/rea_captcha/plugin.py and https://github.com/masakaai/rea-captcha/blob/1df0d2cd79518b05f4f1a1619a8f133aa6a22f38/python/src/rea_captcha/detector.py . Other checked evidence: https://github.com/masakaai/rea-captcha ; https://github.com/masakaai/rea-captcha/blob/main/docs/cases.md ; https://github.com/masakaai/rea-captcha/blob/main/LICENSE .

Checks run
Exact final head 7941626, reconciled with current main e4cd7a5 in an isolated clone: npm run validate:content passed; npm test passed (90/90); git diff --check passed. Documentation/source review is not authenticated product execution or an independent security/performance benchmark.
Additional check: offline Python 3.14 plugin/detector probe of unavailable-state and missing-DOM cases. No optional SEO evaluation or reviewer metadata commit was applied before resolving the contradiction.