@reclaimprotocol/agent 0.1.10 → 0.1.11

package/lib/provider/dom-xpath.js

@@ -15,6 +15,76 @@ import "../proof/patch-domhandler.js";
 /** Identifying attributes stable enough to anchor an xPath on (value-bearing
  *  attrs like `content`/`href`/`value` are excluded). */
 const IDENT_ATTRS = ['name', 'property', 'itemprop', 'data-testid', 'rel', 'for'];
+/** Base weight by anchor kind: purpose-built test hooks and ids beat classes,
+ *  which beat a positional path. Modulated by {@link tokenQuality}. */
+const TYPE_WEIGHT = {
+    'ident-attr': 0.95,
+    id: 0.9,
+    class: 0.6,
+    positional: 0.3,
+};
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * How likely an identifier token is to survive a future render, by its SHAPE —
+ * framework-agnostic, so it catches generated ids/classes from any tool (this
+ * year's or next) without naming them. Returns `[0.02, 1]`.
+ *
+ * Volatile shapes (machine-generated): a `:` (React `useId` `:r1:`, Radix), a
+ * UUID, digit-heavy or trailing-digit tokens (`ember123`, `tab-2`), hex/hash
+ * runs (`css-1a2b3c`), or opaque wordless strings. Durable shapes (human
+ * authored): real word segments, kebab/snake of words (`settings-header`,
+ * `primary_email_select`).
+ */
+function tokenQuality(token) {
+    const t = token.trim();
+    if (!t) {
+        return 0.3;
+    }
+    // Kill signals — these tokens are (almost) always per-render generated.
+    if (t.includes(':') || UUID_RE.test(t)) {
+        return 0.05;
+    }
+    let q = 1;
+    const len = t.length;
+    const digits = (t.match(/\d/g) ?? []).length;
+    const digitRatio = digits / len;
+    // A trailing digit run after letters is the classic generated-id tail.
+    if (/[A-Za-z][-_]?\d+$/.test(t)) {
+        q *= 0.3;
+    }
+    if (digitRatio > 0.3) {
+        q *= 0.4;
+    }
+    else if (digitRatio > 0.15) {
+        q *= 0.7;
+    }
+    // A pure hex/short-hash run (`1a2b3c`, `deadbeef`) — no semantic content.
+    if (/^[0-9a-f]{6,}$/i.test(t)) {
+        q *= 0.15;
+    }
+    // A real word — an alpha run ≥3 that ITSELF contains a vowel — is the
+    // strongest durability signal; its absence means the token is opaque /
+    // hash-like (`css-1a2b3c`, `sc-bdfBwQ`). Checking per-segment matters: a
+    // stray vowel elsewhere in a hash must not count as "has a word".
+    const hasWord = (t.match(/[A-Za-z]+/g) ?? [])
+        .some((run) => run.length >= 3 && /[aeiou]/i.test(run));
+    if (!hasWord) {
+        q *= 0.3;
+    }
+    if (len > 40) {
+        q *= 0.6;
+    }
+    return Math.max(0.02, Math.min(1, q));
+}
+/** Stability score for a candidate: base weight for its kind × the shape
+ *  quality of its identifier, minus a small depth nudge so a nearer/shorter
+ *  anchor wins an otherwise-tie. Positional paths score on kind alone. */
+function anchorStability(c) {
+    const base = TYPE_WEIGHT[c.kind];
+    const quality = c.kind === 'positional' ? 1 : tokenQuality(c.token ?? '');
+    const depthNudge = 1 - Math.min(c.depth, 8) * 0.01;
+    return base * quality * depthNudge;
+}
 /**
  * A verified xPath to the tightest element containing one of `targets`, or
  * undefined if the value isn't present in the parsed tree. Prefers a short
@@ -45,14 +115,24 @@ export function elementAnchor(html, targets) {
     if (startIndex === null || endIndex === null) {
         return undefined;
     }
-    for (const candidate of candidateXPaths(el)) {
-        if (matchesUniquely(doc, candidate, el)) {
-            // `[startIndex, endIndex)` is exactly the slice the attestor reveals for
-            // this xPath (its getNodeRange uses these same parse5 source locations).
-            return { xPath: candidate, start: startIndex, end: endIndex };
-        }
+    // Score EVERY candidate that provably resolves (first-match, uniquely) to the
+    // target, and take the most durable — not merely the first that resolves.
+    // Because each survivor already matches uniquely NOW, the choice only trades
+    // on FUTURE stability; it can never pick a wrong/non-resolving node.
+    const verified = [...candidateXPaths(el)]
+        .map((c, i) => ({ c, i }))
+        .filter(({ c }) => matchesUniquely(doc, c.xPath, el));
+    if (!verified.length) {
+        return undefined;
     }
-    return undefined;
+    verified.sort((a, b) => {
+        return anchorStability(b.c) - anchorStability(a.c) ||
+            a.c.depth - b.c.depth ||
+            a.i - b.i;
+    });
+    // `[startIndex, endIndex)` is exactly the slice the attestor reveals for this
+    // xPath (its getNodeRange uses these same parse5 source locations).
+    return { xPath: verified[0].c.xPath, start: startIndex, end: endIndex };
 }
 /** The tightest element that DIRECTLY holds a target. Prefers a COMPLETE-value
  *  occurrence — an attribute whose value IS the target, or a text child that IS
@@ -97,46 +177,119 @@ function smallestElement(els) {
         .sort((a, b) => elementSpan(a) - elementSpan(b))
         .at(0);
 }
-/** Candidate xPaths for `el`, best (most stable / shortest) first. */
+/** Every candidate xPath for `el`, each tagged with what it anchors on. The
+ *  caller verifies + scores them ({@link anchorStability}) rather than trusting
+ *  emission order, so the DURABILITY winner is chosen, not the first that
+ *  resolves. Order here is only the final tie-break. */
 function* candidateXPaths(el) {
     const tag = el.name;
     const a = el.attribs ?? {};
     if (a.id) {
-        yield `//${tag}[@id=${xpathLiteral(a.id)}]`;
+        yield { xPath: `//${tag}[@id=${xpathLiteral(a.id)}]`, kind: 'id',
+            token: a.id, depth: 0 };
     }
     for (const name of IDENT_ATTRS) {
         if (a[name]) {
-            yield `//${tag}[@${name}=${xpathLiteral(a[name])}]`;
-        }
-    }
-    if (a.class) {
-        const distinctive = a.class
-            .split(/\s+/)
-            .filter(Boolean)
-            .sort((x, y) => y.length - x.length)[0];
-        if (distinctive) {
-            yield `//${tag}[contains(@class, ${xpathLiteral(distinctive)})]`;
+            yield { xPath: `//${tag}[@${name}=${xpathLiteral(a[name])}]`,
+                kind: 'ident-attr', token: a[name], depth: 0 };
         }
     }
     // A uniquely-identified DIRECT child pins the parent without a positional
-    // path (`//span[span[@id="labels"]]`). Self-verification (firstSelected)
-    // discards it when the child id/attr isn't unique — e.g. GitHub reuses
-    // `id="labels"` per email row — so it never silently matches the wrong node.
+    // path (`//span[span[@id="labels"]]`). Self-verification discards it when the
+    // child id/attr isn't unique — e.g. GitHub reuses `id="labels"` per email row
+    // — so it never silently matches the wrong node.
     for (const child of el.children) {
         if (!isTag(child)) {
             continue;
         }
         const ca = child.attribs ?? {};
         if (ca.id) {
-            yield `//${tag}[${child.name}[@id=${xpathLiteral(ca.id)}]]`;
+            yield { xPath: `//${tag}[${child.name}[@id=${xpathLiteral(ca.id)}]]`,
+                kind: 'id', token: ca.id, depth: 0 };
         }
         for (const name of IDENT_ATTRS) {
             if (ca[name]) {
-                yield `//${tag}[${child.name}[@${name}=${xpathLiteral(ca[name])}]]`;
+                yield {
+                    xPath: `//${tag}[${child.name}[@${name}=${xpathLiteral(ca[name])}]]`,
+                    kind: 'ident-attr', token: ca[name], depth: 0,
+                };
             }
         }
     }
-    yield absolutePath(el);
+    // The value element's own distinctive class.
+    const distinctive = distinctiveClass(a.class);
+    if (distinctive) {
+        yield { xPath: `//${tag}[contains(@class, ${xpathLiteral(distinctive)})]`,
+            kind: 'class', token: distinctive, depth: 0 };
+    }
+    // Ancestor-anchored (id/attr, then class), descending positionally to `el`.
+    yield* ancestorAnchoredCandidates(el);
+    yield { xPath: absolutePath(el), kind: 'positional', depth: 99 };
+}
+/** The longest whitespace-delimited token of a class attribute (the most
+ *  distinctive one), or undefined when there's no class. */
+function distinctiveClass(cls) {
+    return (cls ?? '')
+        .split(/\s+/)
+        .filter(Boolean)
+        .sort((x, y) => y.length - x.length)[0];
+}
+/** Positional path from `anc` (exclusive) down to `el` (inclusive), e.g.
+ *  `/ul[1]/li[3]/a[1]`; empty string when `anc` is not an ancestor of `el`. */
+function relativeSteps(anc, el) {
+    const parts = [];
+    let node = el;
+    while (node && isTag(node) && node !== anc) {
+        const tag = node.name;
+        let index = 1;
+        for (let sib = node.prev; sib; sib = sib.prev) {
+            if (isTag(sib) && sib.name === tag) {
+                index++;
+            }
+        }
+        parts.unshift(`/${tag}[${index}]`);
+        node = node.parent;
+    }
+    return node === anc ? parts.join('') : '';
+}
+/** Ancestors of `el` (nearest first) with their depth, skipping
+ *  `html`/`body`/`head` (≈ the absolute path) and non-ancestors. Capped depth
+ *  keeps paths short. */
+function* anchorAncestors(el) {
+    let depth = 1;
+    for (let anc = el.parent; anc && isTag(anc) && depth <= 10; anc = anc.parent, depth++) {
+        const tag = anc.name;
+        if (tag === 'html' || tag === 'body' || tag === 'head') {
+            continue;
+        }
+        const rel = relativeSteps(anc, el);
+        if (rel) {
+            yield { tag, attribs: anc.attribs ?? {}, rel, depth };
+        }
+    }
+}
+/** Ancestor-anchored candidates, descending positionally to `el`
+ *  (`//div[@id="nav"]/ul[1]/li[1]/a[1]`): an id / identifying-attr or a
+ *  distinctive-class anchor per ancestor, tagged with its kind + depth so the
+ *  scorer weighs a stable ancestor id above the value's own utility class. */
+function* ancestorAnchoredCandidates(el) {
+    for (const { tag, attribs, rel, depth } of anchorAncestors(el)) {
+        if (attribs.id) {
+            yield { xPath: `//${tag}[@id=${xpathLiteral(attribs.id)}]${rel}`,
+                kind: 'id', token: attribs.id, depth };
+        }
+        for (const name of IDENT_ATTRS) {
+            if (attribs[name]) {
+                const xp = `//${tag}[@${name}=${xpathLiteral(attribs[name])}]${rel}`;
+                yield { xPath: xp, kind: 'ident-attr', token: attribs[name], depth };
+            }
+        }
+        const dc = distinctiveClass(attribs.class);
+        if (dc) {
+            yield { xPath: `//${tag}[contains(@class, ${xpathLiteral(dc)})]${rel}`,
+                kind: 'class', token: dc, depth };
+        }
+    }
 }
 /** Chrome "full XPath"-style absolute path: `/html[1]/body[1]/…/tag[n]`, where
  *  n is the element's 1-based position among same-tag siblings. */

package/lib/provider/draft.d.ts

@@ -1,4 +1,10 @@
 import type { CapturedRequest, OprfMode, ReclaimProvider, ResponseMatch, ResponseRedaction, SecretParamRef } from './schema.ts';
+/** OPRF mode to apply when the caller passed none: the anti-leak floor —
+ *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
+ *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
+ *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
+ *  identity are the model's/plaintext call). */
+export declare function defaultSensitiveHash(value: string): OprfMode | undefined;
 /** One value to extract from the request: the captured `value`, a `name` (its
  *  param / capture-group), and an optional per-target OPRF `hash`. */
 export interface DraftTarget {

package/lib/provider/draft.js

@@ -1,6 +1,35 @@
-import { synthesizeMatcher } from "./matcher.js";
+import { isOprfHashable, OPRF_MAX_BYTES, synthesizeMatcher } from "./matcher.js";
 import { splitSecrets } from "./secrets.js";
-/** Request headers that must NOT survive into the provider params. Two kinds:
+/** OPRF mode for the auto-hash floor — TEE-native (attestor rejects oprf-raw,
+ *  isn't set up for gnark oprf). */
+const DEFAULT_SENSITIVE_HASH = 'oprf-mpc';
+// The deterministic ANTI-LEAK FLOOR: values whose SHAPE is unambiguously
+// sensitive PII, force-hashed no matter the field name or the model's judgment.
+// Deliberately only FIXED-FORMAT identifiers — OPRF is byte-exact, so a
+// self-mutable value (a display name re-cased) would be grindable and pointless
+// to hash; and a bare number is ambiguous (a private account id vs a PUBLIC
+// user id / follower count that's meant to be proven in the clear). Those
+// contextual calls are the model's, via an explicit per-target `hash`. This
+// floor is universal (not domain-specific) and high-precision.
+const EMAIL_VALUE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/;
+const SSN_VALUE = /^\d{3}-\d{2}-\d{4}$/;
+const IBAN_VALUE = /^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/;
+function isCanonicalPii(value) {
+    return EMAIL_VALUE.test(value)
+        || SSN_VALUE.test(value) || IBAN_VALUE.test(value);
+}
+/** OPRF mode to apply when the caller passed none: the anti-leak floor —
+ *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
+ *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
+ *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
+ *  identity are the model's/plaintext call). */
+export function defaultSensitiveHash(value) {
+    const hashable = isCanonicalPii(value)
+        && isOprfHashable(value)
+        && Buffer.byteLength(value, 'utf8') <= OPRF_MAX_BYTES;
+    return hashable ? DEFAULT_SENSITIVE_HASH : undefined;
+}
+/** Request headers that must NOT survive into the provider params. Three kinds:
  *  - Conditional headers (`if-none-match`/`if-modified-since`/…): a captured
  *    cached ETag/date makes the origin answer 304/412 when the attestor
  *    re-issues, and the attestor treats non-2xx as failure. We always want the
@@ -8,7 +37,14 @@ import { splitSecrets } from "./secrets.js";
  *  - Transfer headers the ATTESTOR sets itself (`connection: close`,
  *    `accept-encoding: identity`). Passing our own duplicates/collides with the
  *    request the attestor builds, so leave them out — the attestor already
- *    forces `identity` (uncompressed, so its byte-matching works). */
+ *    forces `identity` (uncompressed, so its byte-matching works).
+ *  - Host / framing headers the TRANSPORT owns (`host`, `content-length`,
+ *    `transfer-encoding`) and HTTP/2 pseudo-headers (`:authority`/`:method`/…,
+ *    which CDP surfaces on h2 captures). The attestor derives `Host` from the
+ *    URL and sets its own; a baked `Host` produces a DUPLICATE
+ *    (`found: h,h`) that fails the receipt check / 400s the origin. A stale
+ *    `content-length` breaks a re-serialized body. Pseudo-headers aren't valid
+ *    real headers at all. */
 const STRIP_REQUEST_HEADERS = new Set([
     'if-none-match',
     'if-modified-since',
@@ -17,14 +53,22 @@ const STRIP_REQUEST_HEADERS = new Set([
     'if-range',
     'connection',
     'accept-encoding',
+    'host',
+    'content-length',
+    'transfer-encoding',
 ]);
+/** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
+ *  `:scheme`) — never a valid request header the attestor can replay. */
+function isPseudoHeader(name) {
+    return name.startsWith(':');
+}
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
 function sanitizeRequestHeaders(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
-        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase())) {
+        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
             continue;
         }
         out[k] = v;
@@ -103,7 +147,12 @@ export function draftProvider(req, targets, name, hash) {
                 + 'give them distinct names');
         }
         seenParams.add(paramName);
-        const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, t.hash ?? hash);
+        // Precedence: explicit per-target hash → explicit request-wide hash →
+        // the anti-leak floor (force-OPRF values whose SHAPE is unambiguous PII).
+        // The model makes the contextual calls (which named fields are sensitive)
+        // via an explicit per-target hash; this floor only guarantees the obvious.
+        const effectiveHash = t.hash ?? hash ?? defaultSensitiveHash(t.value);
+        const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, effectiveHash);
         if (!synthesis) {
             throw new Error(`target value "${t.value}" not found in`
                 + ` response body for request ${req.requestId}`);

package/lib/provider/matcher.d.ts

@@ -31,3 +31,7 @@ export interface MatcherSynthesis {
  * proof time. Throws when `hash` is set on a free-form value (no safe class).
  */
 export declare function synthesizeMatcher(body: string, contentType: string, target: string, paramName: string, hash?: OprfMode): MatcherSynthesis | undefined;
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export declare function isOprfHashable(target: string): boolean;

package/lib/provider/matcher.js

@@ -548,3 +548,9 @@ function inferValueClass(target) {
     }
     return undefined;
 }
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export function isOprfHashable(target) {
+    return inferValueClass(target) !== undefined;
+}

package/lib/provider/to-version.d.ts

@@ -25,6 +25,19 @@ export interface AllowedJsRequest extends DraftRequest {
     multiple?: boolean;
     /** Fail validation if no request matches this template. Default true. */
     required?: boolean;
+    /** Names of `${var}` placeholders in this template's `responseMatches`/
+     *  `responseRedactions` that get substituted at verify time from the
+     *  submitted proof's own witness params (e.g. an index list a
+     *  `Reclaim.requestClaim` call attached alongside its `{{var}}`
+     *  extractions). Omit (or leave empty) when the template has no such
+     *  placeholders — verification then matches it literally as-is. */
+    templateParams?: string[];
+    /** How multiple values for `templateParams` expand into request specs.
+     *  `'separate'` (default): one independent spec per value, each expected
+     *  to match its own proof. `'merge'`: all values folded into ONE spec
+     *  with one `responseMatches`/`responseRedactions` entry per value,
+     *  matching a single proof that bundles them all into one claim. */
+    templateParamsMode?: 'separate' | 'merge';
 }
 /** Optional extras for a create-version body beyond the request list. */
 export interface CreateVersionOptions {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.10",
+	"version": "0.1.11",
 	"description": "Reclaim Protocol's tools for agents — Reclaim Protocol lets your app verify **data points** about its users — a follower count, an account balance, an order history. This package gives your AI coding agent the tools to **find, build, test and fix the _data verification providers_** (the recipes that verify a data point) by inspecting and replaying captured requests, checking sessions, evaluate proofs, publishing updates, and much more.",
 	"type": "module",
 	"main": "./lib/index.js",

package/src/authoring/tools.ts

@@ -205,6 +205,82 @@ export function authoringTools(
 				}))
 			},
 		),
+		defineTool<Record<string, unknown>>(
+			{
+				name: 'wait_for_login',
+				description:
+					'Wait for the user to finish logging in. Polls the browser\'s '
+					+ 'REAL cookies over CDP (httpOnly INCLUDED) until a NEW session '
+					+ 'cookie appears, ignoring analytics/bot cookies. The ONLY '
+					+ 'correct login wait — NEVER use wait_for_page for it: page JS '
+					+ 'can\'t see the httpOnly session cookie (hangs the whole '
+					+ 'timeout), yet DOES see pre-login tracking cookies (a '
+					+ 'length/substring check fires instantly, before the user '
+					+ 'types). Snapshots the baseline itself — call right after '
+					+ 'navigating to the login page. Does NOT navigate (never yanks '
+					+ 'the user off login/2FA). Returns { loggedIn, newCookies }.',
+				inputSchema: objectSchema({ timeoutMs: { type: 'number' } }),
+			},
+			async(args) => {
+				const backend = resolveBackend(args)
+				const deadline = Date.now() + (Number(args.timeoutMs) || 180_000)
+				const cookies = async() => {
+					const res = (await backend.sendCdp('Network.getCookies')) as {
+						cookies?: { name: string, httpOnly?: boolean }[]
+					}
+					return res.cookies ?? []
+				}
+
+				// Analytics / bot-protection / pre-auth infra cookies appear (and
+				// rotate) without any login — never the signal, even when new.
+				const JUNK = new RegExp('^(' + [
+					'_ga', '_gid', '_gat', '_ym', '__ddg', '__gads', '__gpi', '__eoi',
+					'__utm', '_fbp', 'fbp', 'fr', 'FCCDCF', 'pinLogger',
+					'userFirstVisit', 'cf_', '_dd_', 'bcookie', 'bscookie', 'lidc',
+				].join('|') + ')', 'i')
+				// A real session/auth cookie name. Deliberately NOT bare `token` — a
+				// challenge/CSRF token (e.g. LinkedIn `chp_token`) contains it and is
+				// set BEFORE auth completes. Any new httpOnly cookie is also a
+				// candidate (server-set session cookies are usually httpOnly).
+				const SESSION = /sess|sid|jwt|_session|auth|logged.?in|remember|li_at/i
+				// Auth/challenge URL paths — while the page is still on one, login is
+				// NOT done (a mid-flow cookie must not count). Cross-site-stable, far
+				// more so than cookie names.
+				const AUTH_URL = new RegExp([
+					'login', 'signin', 'sign-in', 'challenge', 'checkpoint', '\\buas\\b',
+					'authorize', '\\bsso\\b', 'mfa', '2fa', 'two-factor', 'otp', 'verify',
+					'password',
+				].join('|'), 'i')
+				const offAuthUrl = async() => {
+					const { value } = await evalInPage(backend, 'location.href')
+					const href = typeof value === 'string' ? value : ''
+					try {
+						const u = new URL(href)
+						return !AUTH_URL.test(u.pathname + u.search)
+					} catch{
+						return false
+					}
+				}
+
+				const initial = await cookies()
+				const baseline = new Set(initial.map((c) => c.name))
+				while(Date.now() < deadline) {
+					const current = await cookies()
+					const fresh = current
+						.filter((c) => !baseline.has(c.name) && !JUNK.test(c.name))
+					const hit = fresh.filter((c) => c.httpOnly || SESSION.test(c.name))
+					// BOTH required: a new session cookie AND the page has left the auth
+					// flow. Either alone false-positives (mid-flow token; stray nav).
+					if(hit.length && await offAuthUrl()) {
+						return { loggedIn: true, newCookies: hit.map((c) => c.name) }
+					}
+
+					await sleep(1000)
+				}
+
+				return { loggedIn: false, newCookies: [] }
+			},
+		),
 		defineTool<Record<string, unknown>>(
 			{
 				name: 'list_requests',

package/src/mcp/tools/agent/find.ts

@@ -21,7 +21,12 @@ export function findTool(resolveBackend: ResolveBackend): RegisteredTool {
 				'Search captured responses for any encoding of `value` (raw, '
 				+ 'URL/JSON/HTML-escaped, …). Returns a ranked candidate list with '
 				+ 'the matched variant, score, and a short snippet — used to locate '
-				+ 'the request that returns a target. Server-side; bodies stay here.',
+				+ 'the request that returns a target. Also finds SPLIT matches: when '
+				+ '`value` is multi-word (e.g. a full name), a response that carries '
+				+ 'every word SEPARATELY (a JSON profile API with first/last name in '
+				+ 'distinct fields) is returned with `splitMatch:true` — prove those '
+				+ 'per-field (a redaction per part) rather than as one string. '
+				+ 'Server-side; bodies stay here.',
 			inputSchema: objectSchema(
 				{ value: { type: 'string' }, limit: { type: 'number' } },
 				['value'],
@@ -29,37 +34,60 @@ export function findTool(resolveBackend: ResolveBackend): RegisteredTool {
 		},
 		async(args) => {
 			const backend = resolveBackend(args)
-			const variants = normalizeCandidates(String(args.value))
+			const value = String(args.value)
+			const variants = normalizeCandidates(value)
+			// Name-part tokens (≥3 chars) for split-field detection — a JSON API
+			// often carries a full name as separate first/last fields, so the whole
+			// string never matches even though the value IS there.
+			const tokens = value.split(/\s+/).filter((t) => t.length >= 3)
+			const snip = (body: string, idx: number, len: number) => {
+				const s = Math.max(0, idx - 40)
+
+				return body.slice(s, Math.min(body.length, idx + len + 40))
+			}
+
 			const ranked = []
 			for(const r of backend.capture.requests.values()) {
 				if(!r.responseBody) {
 					continue
 				}
 
+				const body = r.responseBody
+				// Prefer JSON responses + smaller bodies (likely API endpoints).
+				const base = (r.contentType.includes('json') ? 10 : 0)
+					+ Math.max(0, 5 - Math.log10(Math.max(r.size, 1)))
+
 				let hit: { snippet: string, variant: string } | undefined
 				for(const v of variants) {
-					const idx = r.responseBody.indexOf(v)
+					const idx = body.indexOf(v)
 					if(idx >= 0) {
-						const start = Math.max(0, idx - 40)
-						const end = Math.min(r.responseBody.length, idx + v.length + 40)
-						hit = { snippet: r.responseBody.slice(start, end), variant: v }
+						hit = { snippet: snip(body, idx, v.length), variant: v }
 						break
 					}
 				}
 
-				if(!hit) {
+				if(hit) {
+					// Whole-value match — ranked above split matches (+5).
+					ranked.push({
+						...publicRequest(r),
+						matchedVariant: hit.variant,
+						snippet: hit.snippet,
+						score: base + 5,
+					})
 					continue
 				}
 
-				// Prefer JSON responses + smaller bodies (likely API endpoints).
-				const score = (r.contentType.includes('json') ? 10 : 0)
-					+ Math.max(0, 5 - Math.log10(Math.max(r.size, 1)))
-				ranked.push({
-					...publicRequest(r),
-					matchedVariant: hit.variant,
-					snippet: hit.snippet,
-					score,
-				})
+				// Split match: every word present separately (e.g. first/last name
+				// in distinct JSON fields). Requires ≥2 tokens so it's specific.
+				if(tokens.length >= 2 && tokens.every((t) => body.includes(t))) {
+					ranked.push({
+						...publicRequest(r),
+						matchedVariant: `split:${tokens.join('+')}`,
+						splitMatch: true,
+						snippet: snip(body, body.indexOf(tokens[0]), tokens[0].length),
+						score: base,
+					})
+				}
 			}
 
 			ranked.sort((a, b) => b.score - a.score)

package/src/mcp/tools/agent/propose.ts

@@ -83,12 +83,12 @@ export function proposeTool(resolveBackend: ResolveBackend): RegisteredTool {
 			}
 
 			for(const t of targets) {
-				if((t.hash ?? defaultHash) !== undefined
-					&& t.value.length > OPRF_MAX_BYTES) {
+				const bytes = Buffer.byteLength(t.value, 'utf8')
+				if((t.hash ?? defaultHash) !== undefined && bytes > OPRF_MAX_BYTES) {
 					throw new Error(
 						`OPRF caps hashed values at ${OPRF_MAX_BYTES} bytes; got `
-						+ `${t.value.length}-byte "${t.value}". Use a tighter `
-						+ 'target or drop `hash`.',
+						+ `${bytes}-byte "${t.value}". Use a tighter target or drop `
+						+ '`hash`.',
 					)
 				}
 			}

package/src/old/client.ts

@@ -147,24 +147,6 @@ export class ReclaimOldClient {
 		)
 	}
 
-	/** Full `providerConfig` (loginUrl, customInjection, requestData, ...) for
-	 *  one version — the latest when `version` is omitted. Readable for ANY
-	 *  non-archived provider (not owner-restricted), same as the dashboard's
-	 *  edit-form prefill fetch. */
-	getProviderConfig(
-		providerId: string,
-		version?: string,
-	): Promise<unknown> {
-		return this.#request(
-			'GET',
-			`/providers/${encodeURIComponent(providerId)}/config`,
-			{
-				auth: true,
-				query: version ? { versionNumber: version } : undefined,
-			},
-		)
-	}
-
 	/** Partial update on the PROVIDER document itself — name/description/
 	 *  providerType/tags/isActive, after creation. The backend 403s if you
 	 *  don't own the provider (and aren't admin); other providerConfig-style

package/src/old/to-register.ts

@@ -93,6 +93,8 @@ interface OldRequestData {
 export interface OldInjectedRequestData extends OldRequestData {
 	required?: boolean
 	multiple?: boolean
+	templateParams?: string[]
+	templateParamsMode?: 'separate' | 'merge'
 }
 
 /** Build the single `requestData` entry shared by register + update. Takes
@@ -200,11 +202,15 @@ function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
 export function injectedRequestDataFrom(
 	requests: AllowedJsRequest[],
 ): OldInjectedRequestData[] {
-	return requests.map((req) => ({
-		...requestDataFromProvider(req),
-		required: req.required ?? true,
-		multiple: req.multiple ?? true,
-	}))
+	return requests.map((req) => {
+		return {
+			...requestDataFromProvider(req),
+			required: req.required ?? true,
+			multiple: req.multiple ?? true,
+			templateParams: req.templateParams,
+			templateParamsMode: req.templateParamsMode,
+		}
+	})
 }
 
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. Every