@reclaimprotocol/agent 0.1.10 → 0.1.11

package/src/provider/draft.ts

@@ -1,4 +1,4 @@
-import { synthesizeMatcher } from './matcher.ts'
+import { isOprfHashable, OPRF_MAX_BYTES, synthesizeMatcher } from './matcher.ts'
 import type {
 	CapturedRequest,
 	OprfMode,
@@ -9,6 +9,39 @@ import type {
 } from './schema.ts'
 import { splitSecrets } from './secrets.ts'
 
+/** OPRF mode for the auto-hash floor — TEE-native (attestor rejects oprf-raw,
+ *  isn't set up for gnark oprf). */
+const DEFAULT_SENSITIVE_HASH: OprfMode = 'oprf-mpc'
+
+// The deterministic ANTI-LEAK FLOOR: values whose SHAPE is unambiguously
+// sensitive PII, force-hashed no matter the field name or the model's judgment.
+// Deliberately only FIXED-FORMAT identifiers — OPRF is byte-exact, so a
+// self-mutable value (a display name re-cased) would be grindable and pointless
+// to hash; and a bare number is ambiguous (a private account id vs a PUBLIC
+// user id / follower count that's meant to be proven in the clear). Those
+// contextual calls are the model's, via an explicit per-target `hash`. This
+// floor is universal (not domain-specific) and high-precision.
+const EMAIL_VALUE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/
+const SSN_VALUE = /^\d{3}-\d{2}-\d{4}$/
+const IBAN_VALUE = /^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/
+
+function isCanonicalPii(value: string): boolean {
+	return EMAIL_VALUE.test(value)
+		|| SSN_VALUE.test(value) || IBAN_VALUE.test(value)
+}
+
+/** OPRF mode to apply when the caller passed none: the anti-leak floor —
+ *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
+ *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
+ *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
+ *  identity are the model's/plaintext call). */
+export function defaultSensitiveHash(value: string): OprfMode | undefined {
+	const hashable = isCanonicalPii(value)
+		&& isOprfHashable(value)
+		&& Buffer.byteLength(value, 'utf8') <= OPRF_MAX_BYTES
+	return hashable ? DEFAULT_SENSITIVE_HASH : undefined
+}
+
 /** One value to extract from the request: the captured `value`, a `name` (its
  *  param / capture-group), and an optional per-target OPRF `hash`. */
 export interface DraftTarget {
@@ -33,7 +66,7 @@ export interface DraftResult {
 	extractions: Extraction[]
 }
 
-/** Request headers that must NOT survive into the provider params. Two kinds:
+/** Request headers that must NOT survive into the provider params. Three kinds:
  *  - Conditional headers (`if-none-match`/`if-modified-since`/…): a captured
  *    cached ETag/date makes the origin answer 304/412 when the attestor
  *    re-issues, and the attestor treats non-2xx as failure. We always want the
@@ -41,7 +74,14 @@ export interface DraftResult {
  *  - Transfer headers the ATTESTOR sets itself (`connection: close`,
  *    `accept-encoding: identity`). Passing our own duplicates/collides with the
  *    request the attestor builds, so leave them out — the attestor already
- *    forces `identity` (uncompressed, so its byte-matching works). */
+ *    forces `identity` (uncompressed, so its byte-matching works).
+ *  - Host / framing headers the TRANSPORT owns (`host`, `content-length`,
+ *    `transfer-encoding`) and HTTP/2 pseudo-headers (`:authority`/`:method`/…,
+ *    which CDP surfaces on h2 captures). The attestor derives `Host` from the
+ *    URL and sets its own; a baked `Host` produces a DUPLICATE
+ *    (`found: h,h`) that fails the receipt check / 400s the origin. A stale
+ *    `content-length` breaks a re-serialized body. Pseudo-headers aren't valid
+ *    real headers at all. */
 const STRIP_REQUEST_HEADERS = new Set([
 	'if-none-match',
 	'if-modified-since',
@@ -50,8 +90,17 @@ const STRIP_REQUEST_HEADERS = new Set([
 	'if-range',
 	'connection',
 	'accept-encoding',
+	'host',
+	'content-length',
+	'transfer-encoding',
 ])
 
+/** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
+ *  `:scheme`) — never a valid request header the attestor can replay. */
+function isPseudoHeader(name: string): boolean {
+	return name.startsWith(':')
+}
+
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
@@ -60,7 +109,7 @@ function sanitizeRequestHeaders(
 ): Record<string, string> {
 	const out: Record<string, string> = {}
 	for(const [k, v] of Object.entries(headers)) {
-		if(STRIP_REQUEST_HEADERS.has(k.toLowerCase())) {
+		if(STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
 			continue
 		}
 
@@ -167,12 +216,17 @@ export function draftProvider(
 		}
 
 		seenParams.add(paramName)
+		// Precedence: explicit per-target hash → explicit request-wide hash →
+		// the anti-leak floor (force-OPRF values whose SHAPE is unambiguous PII).
+		// The model makes the contextual calls (which named fields are sensitive)
+		// via an explicit per-target hash; this floor only guarantees the obvious.
+		const effectiveHash = t.hash ?? hash ?? defaultSensitiveHash(t.value)
 		const synthesis = synthesizeMatcher(
 			req.responseBody,
 			req.contentType,
 			t.value,
 			paramName,
-			t.hash ?? hash,
+			effectiveHash,
 		)
 		if(!synthesis) {
 			throw new Error(

package/src/provider/matcher.ts

@@ -734,3 +734,10 @@ function inferValueClass(target: string): string | undefined {
 
 	return undefined
 }
+
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export function isOprfHashable(target: string): boolean {
+	return inferValueClass(target) !== undefined
+}

package/src/provider/to-version.ts

@@ -37,6 +37,19 @@ export interface AllowedJsRequest extends DraftRequest {
 	multiple?: boolean
 	/** Fail validation if no request matches this template. Default true. */
 	required?: boolean
+	/** Names of `${var}` placeholders in this template's `responseMatches`/
+	 *  `responseRedactions` that get substituted at verify time from the
+	 *  submitted proof's own witness params (e.g. an index list a
+	 *  `Reclaim.requestClaim` call attached alongside its `{{var}}`
+	 *  extractions). Omit (or leave empty) when the template has no such
+	 *  placeholders — verification then matches it literally as-is. */
+	templateParams?: string[]
+	/** How multiple values for `templateParams` expand into request specs.
+	 *  `'separate'` (default): one independent spec per value, each expected
+	 *  to match its own proof. `'merge'`: all values folded into ONE spec
+	 *  with one `responseMatches`/`responseRedactions` entry per value,
+	 *  matching a single proof that bundles them all into one claim. */
+	templateParamsMode?: 'separate' | 'merge'
 }
 
 /** Optional extras for a create-version body beyond the request list. */

package/src/old/tools/get-version-config.ts

@@ -1,56 +0,0 @@
-import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
-import type { ReclaimOldClient } from '../client.ts'
-
-/**
- * Read the full `providerConfig` (loginUrl, customInjection, requestData,
- * geoLocation, ...) of one provider version on the old devtools backend —
- * the latest version when `version` is omitted.
- *
- * Exists so a dev/agent can see what's CURRENTLY published before adding a
- * new version with `create_provider_version_from_capture`. That tool always
- * takes a FULL replacement `providerConfig` (no partial-patch endpoint on
- * this backend), so a version added without knowing the current
- * `customInjection` would silently publish it blank — wiping a working
- * login script instead of preserving it. Read it here first, then pass it
- * straight through (or omit `customInjection` on publish to have it carried
- * forward automatically).
- */
-export function getProviderVersionConfigTool(
-	client: ReclaimOldClient,
-): RegisteredTool {
-	return defineTool<{ providerId: string, version?: string }>(
-		{
-			name: 'get_provider_version_config',
-			description:
-				'Fetch the full providerConfig (loginUrl, customInjection, ' +
-				'requestData, geoLocation, ...) of one version on the old devtools ' +
-				'backend — the latest version when `version` is omitted. Readable ' +
-				'for any non-archived provider, not just ones you own. Use this ' +
-				'BEFORE calling create_provider_version_from_capture with a ' +
-				'`providerId` to see the currently-published customInjection/' +
-				'requestData so you know what you would be changing — that tool ' +
-				'replaces the whole providerConfig, so a field you never see and ' +
-				"never pass comes out blank in the new version, even if it's set " +
-				'today.',
-			inputSchema: {
-				type: 'object',
-				properties: {
-					providerId: {
-						type: 'string',
-						description: 'UUID of the provider (from get_me_providers).',
-					},
-					version: {
-						type: 'string',
-						description:
-							'Specific version to fetch, e.g. "1.0.2". Omit for the ' +
-							"provider's current latest version.",
-					},
-				},
-				required: ['providerId'],
-			},
-		},
-		async({ providerId, version }) => {
-			return client.getProviderConfig(providerId, version)
-		},
-	)
-}