@reclaimprotocol/agent 0.1.0 → 0.1.1-dev.1

package/lib/proof/attestor.js

@@ -7,6 +7,7 @@
 // reveals), never on responseMatches.
 import { createClaimOnAttestor, } from '@reclaimprotocol/attestor-core';
 import { resolveOwnerPrivateKey } from "../mcp/tools/credentials/cache.js";
+import { ensureZkFiles } from "./zk-files.js";
 /** Trim a captured log stream to the last N entries — for shrinking the
  *  LLM-visible response while the full stream stays in the on-disk dump. */
 export function tailLogs(entries, n = LOG_TAIL_LINES) {
@@ -109,6 +110,9 @@ export async function runAttestorProof(provider, secrets, attestorUrl, ownerAddr
         };
     }
     try {
+        // Circuits aren't downloaded at install time (that blocked the MCP
+        // server's first launch). Fetch them lazily on the first proof.
+        await ensureZkFiles();
         const params = {
             url: provider.url,
             method: provider.method,

package/lib/proof/zk-files.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Ensure the zk circuit resources are on disk before a proof runs. Idempotent
+ * and concurrency-safe: the download runs at most once per process, and a
+ * failed attempt clears the latch so a later proof can retry.
+ *
+ * Resolves silently when the resources are already present (the warm npx cache,
+ * or after a manual `npm run download:zk-files`) and when
+ * `@reclaimprotocol/zk-symmetric-crypto` isn't installed at all (SDK-only
+ * consumers have nothing to prove).
+ *
+ * All output goes to stderr (fd 2): the MCP server speaks JSON-RPC over stdout,
+ * so a stray write to fd 1 mid-session would corrupt the protocol.
+ */
+export declare function ensureZkFiles(): Promise<void>;

package/lib/proof/zk-files.js

@@ -0,0 +1,73 @@
+// Lazy download of the @reclaimprotocol/zk-symmetric-crypto circuit resources
+// that the snarkjs proof engine needs. These are ~280MB and are NOT fetched in
+// a `postinstall` (that blocked the MCP server's first launch past the connect
+// timeout — see the install notes). Instead we fetch them on the first proof,
+// once, so the server starts immediately and only `run_proof` pays the cost.
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+const require = createRequire(import.meta.url);
+let inFlight;
+/**
+ * Ensure the zk circuit resources are on disk before a proof runs. Idempotent
+ * and concurrency-safe: the download runs at most once per process, and a
+ * failed attempt clears the latch so a later proof can retry.
+ *
+ * Resolves silently when the resources are already present (the warm npx cache,
+ * or after a manual `npm run download:zk-files`) and when
+ * `@reclaimprotocol/zk-symmetric-crypto` isn't installed at all (SDK-only
+ * consumers have nothing to prove).
+ *
+ * All output goes to stderr (fd 2): the MCP server speaks JSON-RPC over stdout,
+ * so a stray write to fd 1 mid-session would corrupt the protocol.
+ */
+export function ensureZkFiles() {
+    inFlight ??= download().catch((err) => {
+        inFlight = undefined;
+        throw err;
+    });
+    return inFlight;
+}
+async function download() {
+    let mainPath;
+    try {
+        mainPath = require.resolve('@reclaimprotocol/zk-symmetric-crypto');
+    }
+    catch {
+        return;
+    }
+    // mainPath is <pkg>/lib/index.js → resources live at <pkg>/resources, the
+    // downloader at <pkg>/lib/scripts/download-files.js. We only use the snarkjs
+    // engine (createClaimOnAttestor zkEngine: 'snarkjs'), so its presence is the
+    // signal that the circuits are ready.
+    const libDir = dirname(mainPath);
+    const pkgDir = dirname(libDir);
+    if (existsSync(join(pkgDir, 'resources', 'snarkjs'))) {
+        return;
+    }
+    const downloadScript = join(libDir, 'scripts', 'download-files.js');
+    if (!existsSync(downloadScript)) {
+        throw new Error('zk circuit downloader not found in '
+            + '@reclaimprotocol/zk-symmetric-crypto; '
+            + 'run `npm run download:zk-files` and retry.');
+    }
+    process.stderr.write('[reclaim-agent] downloading zkTLS proof circuits '
+        + '(~280MB, one-time)…\n');
+    // stdio fd 1→2: send the downloader's stdout to our stderr so its progress
+    // never lands on the MCP server's JSON-RPC stdout.
+    await new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [downloadScript], {
+            stdio: ['ignore', 2, 2],
+        });
+        child.on('error', reject);
+        child.on('exit', (code) => {
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`zk download exited ${code}`));
+            }
+        });
+    });
+}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.0",
+	"version": "0.1.1-dev.1",
 	"description": "Reclaim Protocol agent — SDK, CLI, and MCP server in one package. SDK + CLI talk to the builder backend; MCP server adds Chrome CDP capture, provider synthesis, replay, and zkTLS proof.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -45,8 +45,7 @@
 		"start:cli": "node lib/cli.js",
 		"start:mcp": "node lib/mcp-bin.js",
 		"inspect": "npx @modelcontextprotocol/inspector node lib/mcp-bin.js",
-		"download:zk-files": "node scripts/download-zk-files.js",
-		"postinstall": "node scripts/download-zk-files.js"
+		"download:zk-files": "node scripts/download-zk-files.js"
 	},
 	"keywords": [
 		"mcp",
@@ -86,4 +85,4 @@
 		"typescript": "^5.9.0",
 		"yaml": "^2.6.0"
 	}
-}
+}

package/src/proof/attestor.ts

@@ -11,6 +11,7 @@ import {
 } from '@reclaimprotocol/attestor-core'
 import { resolveOwnerPrivateKey } from '../mcp/tools/credentials/cache.ts'
 import type { ReclaimProvider } from '../provider/schema.ts'
+import { ensureZkFiles } from './zk-files.ts'
 
 export interface AttestorLogEntry {
 	level: 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal'
@@ -179,6 +180,10 @@ export async function runAttestorProof(
 	}
 
 	try {
+		// Circuits aren't downloaded at install time (that blocked the MCP
+		// server's first launch). Fetch them lazily on the first proof.
+		await ensureZkFiles()
+
 		const params: ProviderParams<'http'> = {
 			url: provider.url,
 			method: provider.method,

package/src/proof/zk-files.ts

@@ -0,0 +1,83 @@
+// Lazy download of the @reclaimprotocol/zk-symmetric-crypto circuit resources
+// that the snarkjs proof engine needs. These are ~280MB and are NOT fetched in
+// a `postinstall` (that blocked the MCP server's first launch past the connect
+// timeout — see the install notes). Instead we fetch them on the first proof,
+// once, so the server starts immediately and only `run_proof` pays the cost.
+
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+
+const require = createRequire(import.meta.url)
+
+let inFlight: Promise<void> | undefined
+
+/**
+ * Ensure the zk circuit resources are on disk before a proof runs. Idempotent
+ * and concurrency-safe: the download runs at most once per process, and a
+ * failed attempt clears the latch so a later proof can retry.
+ *
+ * Resolves silently when the resources are already present (the warm npx cache,
+ * or after a manual `npm run download:zk-files`) and when
+ * `@reclaimprotocol/zk-symmetric-crypto` isn't installed at all (SDK-only
+ * consumers have nothing to prove).
+ *
+ * All output goes to stderr (fd 2): the MCP server speaks JSON-RPC over stdout,
+ * so a stray write to fd 1 mid-session would corrupt the protocol.
+ */
+export function ensureZkFiles(): Promise<void> {
+	inFlight ??= download().catch((err) => {
+		inFlight = undefined
+		throw err
+	})
+	return inFlight
+}
+
+async function download(): Promise<void> {
+	let mainPath: string
+	try {
+		mainPath = require.resolve('@reclaimprotocol/zk-symmetric-crypto')
+	} catch{
+		return
+	}
+
+	// mainPath is <pkg>/lib/index.js → resources live at <pkg>/resources, the
+	// downloader at <pkg>/lib/scripts/download-files.js. We only use the snarkjs
+	// engine (createClaimOnAttestor zkEngine: 'snarkjs'), so its presence is the
+	// signal that the circuits are ready.
+	const libDir = dirname(mainPath)
+	const pkgDir = dirname(libDir)
+	if(existsSync(join(pkgDir, 'resources', 'snarkjs'))) {
+		return
+	}
+
+	const downloadScript = join(libDir, 'scripts', 'download-files.js')
+	if(!existsSync(downloadScript)) {
+		throw new Error(
+			'zk circuit downloader not found in '
+			+ '@reclaimprotocol/zk-symmetric-crypto; '
+			+ 'run `npm run download:zk-files` and retry.',
+		)
+	}
+
+	process.stderr.write(
+		'[reclaim-agent] downloading zkTLS proof circuits '
+		+ '(~280MB, one-time)…\n',
+	)
+	// stdio fd 1→2: send the downloader's stdout to our stderr so its progress
+	// never lands on the MCP server's JSON-RPC stdout.
+	await new Promise<void>((resolve, reject) => {
+		const child = spawn(process.execPath, [downloadScript], {
+			stdio: ['ignore', 2, 2],
+		})
+		child.on('error', reject)
+		child.on('exit', (code) => {
+			if(code === 0) {
+				resolve()
+			} else {
+				reject(new Error(`zk download exited ${code}`))
+			}
+		})
+	})
+}