@reclaimprotocol/agent 0.1.11 → 0.1.13

package/lib/old/tools/verify-sdk-setup.js

@@ -0,0 +1,132 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { defineTool } from "../../mcp/server.js";
+import { findProjectRoot } from "../../paths.js";
+function readEnvFile(dir) {
+    const path = join(dir, '.env');
+    if (!existsSync(path)) {
+        return {};
+    }
+    const out = {};
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+        const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
+        if (m) {
+            out[m[1]] = m[2].replace(/^['"]|['"]$/g, '');
+        }
+    }
+    return out;
+}
+/**
+ * Health-check a project's @reclaimprotocol/js-sdk setup: SDK installed,
+ * RECLAIM_APP_ID/RECLAIM_APP_SECRET present (env or .env), and (if an appId
+ * is found) whether that app is actually linked/has quota, via the real
+ * check_app_status endpoint — not just static file checks.
+ */
+export function verifySdkSetupTool(client) {
+    return defineTool({
+        name: 'verify_reclaim_sdk_setup',
+        description: 'Health-check a project\'s @reclaimprotocol/js-sdk integration: SDK ' +
+            'installed, RECLAIM_APP_ID/RECLAIM_APP_SECRET present, and (if an ' +
+            'appId is found) whether that app is actually linked and has quota ' +
+            'left, by calling the real status endpoint.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectDir: {
+                    type: 'string',
+                    description: 'Project directory (default: detected project root).',
+                },
+            },
+        },
+    }, async ({ projectDir }) => {
+        const dir = projectDir ?? findProjectRoot(process.cwd());
+        const checks = [];
+        const pkgPath = join(dir, 'package.json');
+        let sdkInPkg = false;
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+                sdkInPkg = Boolean(pkg.dependencies?.['@reclaimprotocol/js-sdk'] ||
+                    pkg.devDependencies?.['@reclaimprotocol/js-sdk']);
+            }
+            catch {
+                // malformed package.json — fall through, reported below
+            }
+        }
+        const sdkInstalled = existsSync(join(dir, 'node_modules', '@reclaimprotocol', 'js-sdk'));
+        checks.push({
+            name: 'sdk_dependency',
+            ok: sdkInPkg,
+            detail: sdkInPkg
+                ? '@reclaimprotocol/js-sdk is listed in package.json'
+                : '@reclaimprotocol/js-sdk is NOT in package.json — run ' +
+                    '`npm install @reclaimprotocol/js-sdk`.',
+        });
+        checks.push({
+            name: 'sdk_installed',
+            ok: sdkInstalled,
+            detail: sdkInstalled
+                ? '@reclaimprotocol/js-sdk found in node_modules'
+                : 'Not found in node_modules — run your package manager\'s ' +
+                    'install command.',
+        });
+        const env = { ...readEnvFile(dir), ...process.env };
+        const appId = env.RECLAIM_APP_ID;
+        const appSecret = env.RECLAIM_APP_SECRET;
+        checks.push({
+            name: 'app_id',
+            ok: Boolean(appId),
+            detail: appId
+                ? `RECLAIM_APP_ID set (${appId})`
+                : 'RECLAIM_APP_ID missing (env or .env) — run ' +
+                    'issue_app_credentials or link_app_to_account.',
+        });
+        checks.push({
+            name: 'app_secret',
+            ok: Boolean(appSecret),
+            detail: appSecret
+                ? 'RECLAIM_APP_SECRET set'
+                : 'RECLAIM_APP_SECRET missing (env or .env).',
+        });
+        // Informational only — PUBLIC_URL is only needed for the async
+        // webhook callback, not the frontend-only flow, so a missing value
+        // doesn't fail the overall check.
+        const publicUrl = env.PUBLIC_URL;
+        checks.push({
+            name: 'public_url',
+            ok: true,
+            detail: publicUrl
+                ? `PUBLIC_URL set (${publicUrl}) — used as the webhook callback ` +
+                    'base for setAppCallbackUrl.'
+                : 'PUBLIC_URL not set — fine if you only read the proof from the ' +
+                    'frontend flow, but the async webhook callback needs a ' +
+                    'publicly-reachable URL or it will never fire. Get one via a ' +
+                    'tunnel (e.g. `ngrok http <port>`) or by deploying to a ' +
+                    'dev/staging server you already have — ask the user which they ' +
+                    'prefer.',
+        });
+        if (appId) {
+            try {
+                const status = await client.getApplicationStatus(appId);
+                const linked = status?.isLinked === true;
+                checks.push({
+                    name: 'app_status',
+                    ok: status?.available !== false,
+                    detail: `isLinked=${linked}, sandboxMode=${status?.sandboxMode}, ` +
+                        `available=${status?.available}` +
+                        (linked
+                            ? ''
+                            : ' — run link_app_to_account to lift the sandbox limit.'),
+                });
+            }
+            catch (err) {
+                checks.push({
+                    name: 'app_status',
+                    ok: false,
+                    detail: `Could not reach status endpoint: ${err instanceof Error ? err.message : String(err)}`,
+                });
+            }
+        }
+        return { projectDir: dir, checks, ok: checks.every((c) => c.ok) };
+    });
+}

package/lib/proof/attestor.js

@@ -6,7 +6,7 @@
 // revealed slice; jsonPath/xPath live on responseRedactions (what the prover
 // reveals), never on responseMatches.
 import { bytesToHex } from '@noble/hashes/utils.js';
-import { createClaimOnAttestor, } from '@reclaimprotocol/attestor-core';
+import { createClaimOnAttestor } from '@reclaimprotocol/attestor-core';
 // Side-effect: make external domhandler nodes DOM-like so attestor-core's
 // bundled `xpath` accepts them (see patch-domhandler.ts). Must load before any
 // proof runs its response-redaction extraction.
@@ -14,7 +14,7 @@ import "./patch-domhandler.js";
 import { agentTraceEnabled } from "../consts.js";
 import { resolveEthKey } from "../mcp/tools/authenticate/eth-key.js";
 import { installResponseDump } from "./debug-response-dump.js";
-import { buildHttpParams, ensureAttestorCrypto, parseClaim, resolveAttestorUrl, } from "./proof-core.js";
+import { buildHttpParams, ensureAttestorCrypto, parseClaim, resolveAttestorUrl } from "./proof-core.js";
 import { ensureZkFiles } from "./zk-files.js";
 /** Trim a captured log stream to the last N entries — for shrinking the
  *  LLM-visible response while the full stream stays in the on-disk dump. */

package/lib/provider/draft.js

@@ -56,19 +56,43 @@ const STRIP_REQUEST_HEADERS = new Set([
     'host',
     'content-length',
     'transfer-encoding',
+    // Per-session anti-CSRF tokens. Not caught by splitSecrets (no `-token`
+    // suffix), so without this they baked in as PUBLIC headers and went stale at
+    // verify time — the attestor replayed one user's captured CSRF for everyone,
+    // which the origin rejects. A CSRF token is never portable; drop it.
+    'csrf',
+    'x-csrf',
+    'xsrf',
+    'x-xsrf',
+    'x-csrf-token',
+    'xsrf-token',
 ]);
 /** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
  *  `:scheme`) — never a valid request header the attestor can replay. */
 function isPseudoHeader(name) {
     return name.startsWith(':');
 }
+/** A header VALUE that is a per-session/request token — a UUID or a long opaque
+ *  hex/base64 blob. Such a value is captured-user-specific: baked into the
+ *  provider it goes stale and the origin rejects the replay for everyone else.
+ *  Stable identifiers (a tenant/space id like `1237`, a timezone, client hints)
+ *  are short/structured and don't match, so they survive. */
+function isVolatileHeaderValue(value) {
+    const v = value.trim();
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+        .test(v)
+        || /^[0-9a-f]{16,}$/i.test(v)
+        || /^[A-Za-z0-9_-]{32,}$/.test(v);
+}
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
 function sanitizeRequestHeaders(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
-        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
+        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase())
+            || isPseudoHeader(k)
+            || isVolatileHeaderValue(v)) {
             continue;
         }
         out[k] = v;
@@ -86,6 +110,32 @@ function sanitizeRequestHeaders(headers) {
  *  `{{param}}`. Throwing discards the draft so the agent re-captures or
  *  re-proposes rather than shipping a provider pinned to this one user. */
 export function assertPortableMatches(matches, redactions, targets) {
+    // A baked email LOCAL-PART ("jane.doe@…") pins the provider to one user
+    // even when only the domain is captured as a param — the classic result of
+    // proving an email's domain substring. Reject it regardless of the declared
+    // targets (the local part is usually not itself a target, so the value scan
+    // below wouldn't catch it). Strip params + named groups + regex escapes
+    // first, then look for `localpart@` as a surviving literal.
+    const EMAIL_LOCAL_BAKED = /[A-Za-z0-9._%+-]{3,}@/;
+    const deregex = (s) => s
+        .replace(/\{\{[^}]*\}\}/g, '')
+        .replace(/\(\?<[^>]*>[^)]*\)/g, '')
+        .replace(/\\(.)/g, '$1');
+    const scanEmail = (text, where) => {
+        if (EMAIL_LOCAL_BAKED.test(deregex(text))) {
+            throw new Error(`drafted ${where} bakes a per-user email local-part as a literal — `
+                + 'the provider would be pinned to this user. Capture the WHOLE email '
+                + 'as a {{param}} (optionally OPRF-hashed), not just its domain.');
+        }
+    };
+    for (const [i, m] of matches.entries()) {
+        scanEmail(m.value, `responseMatch for "${targets[i]?.name ?? '?'}"`);
+    }
+    for (const r of redactions) {
+        if (r.regex) {
+            scanEmail(r.regex, 'responseRedaction regex');
+        }
+    }
     // Guard only values long enough to be plausibly user-specific; shorter runs
     // (single digits, 2-3 char tokens) collide with ordinary structural bytes.
     const MIN_ALNUM = 4;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.11",
+	"version": "0.1.13",
 	"description": "Reclaim Protocol's tools for agents — Reclaim Protocol lets your app verify **data points** about its users — a follower count, an account balance, an order history. This package gives your AI coding agent the tools to **find, build, test and fix the _data verification providers_** (the recipes that verify a data point) by inspecting and replaying captured requests, checking sessions, evaluate proofs, publishing updates, and much more.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -41,6 +41,7 @@
 		"src",
 		"scripts",
 		"skill",
+		"samples",
 		"README.md"
 	],
 	"engines": {
@@ -83,6 +84,7 @@
 	"dependencies": {
 		"@hapi/boom": "^9.1.4",
 		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@noble/hashes": "^2.2.0",
 		"@reclaimprotocol/attestor-core": "^5.0.8",
 		"@reclaimprotocol/client": "*",
 		"@reclaimprotocol/tls": "^0.1.3",

package/samples/demo-server/.env.example

@@ -0,0 +1,12 @@
+RECLAIM_APP_ID=
+RECLAIM_APP_SECRET=
+PORT=3000
+# REQUIRED for the webhook callback to land — Reclaim's servers can't reach
+# localhost. Pick ONE:
+#   - ngrok (or similar tunnel): run `ngrok http 3000` in a separate
+#     terminal and paste the https://<id>.ngrok-free.app URL it prints here.
+#   - A dev/staging server you can deploy this to quickly: point this at
+#     that server's public URL instead.
+# Without either, only the frontend-side flow (opening requestUrl) works —
+# the webhook never fires.
+PUBLIC_URL=

package/samples/demo-server/README.md

@@ -0,0 +1,24 @@
+# Reclaim demo server
+
+1. `npm install`
+2. Fill in `.env` (copy from `.env.example`) — get `RECLAIM_APP_ID`/
+   `RECLAIM_APP_SECRET` from the `issue_app_credentials` MCP tool, or your
+   existing app.
+3. Set `PUBLIC_URL` in `.env` to a URL Reclaim's servers can reach — pick
+   whichever fits:
+   - **ngrok**: in a separate terminal, run `ngrok http 3000` (install from
+     https://ngrok.com if needed) and copy the
+     `https://<id>.ngrok-free.app` URL it prints.
+   - **A dev/staging server you can deploy to quickly**: if you already have
+     one reachable from the internet, deploy this there and use its URL
+     instead — no local tunnel needed.
+   This step is REQUIRED — `localhost` is never reachable from Reclaim's
+   servers.
+4. `npm start`, then open http://localhost:3000/verify (or your deployed
+   URL's `/verify`) and click "Start verification".
+5. Watch the server logs for the `/webhooks/reclaim` payload once you
+   complete verification.
+
+This demo defaults to providerId `"example"` — a built-in smoke-test
+provider, so you can confirm the whole loop (request → open → callback)
+works before wiring in a real provider.

package/samples/demo-server/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "reclaim-demo-server",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "@reclaimprotocol/js-sdk": "^5.8.1",
+    "dotenv": "^16.4.5",
+    "express": "^4.21.2"
+  }
+}

package/samples/demo-server/server.js

@@ -0,0 +1,156 @@
+import express from "express";
+import "dotenv/config";
+import { ReclaimProofRequest, verifyProof } from "@reclaimprotocol/js-sdk";
+import { randomUUID } from "node:crypto";
+
+const app = express();
+const port = process.env.PORT || 3000;
+const providerId = __PROVIDER_ID__;
+// Left unpinned by default — set this if you need to pin a specific version.
+const providerVersion = __PROVIDER_VERSION__;
+
+app.set("trust proxy", true);
+app.use(express.json({ limit: "2mb" }));
+
+app.get("/health", (_req, res) => {
+  res.json({ ok: true });
+});
+
+app.get("/verify", (_req, res) => {
+  res.type("html").send(`<!doctype html>
+    <html lang="en">
+      <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>Reclaim demo verification</title>
+        <style>
+          body {
+            font-family: system-ui, sans-serif; max-width: 680px;
+            margin: 64px auto; padding: 0 20px; line-height: 1.5;
+          }
+          code { background: #f3f4f6; padding: 2px 6px; border-radius: 4px; }
+          button {
+            background: #111827; border: 0; border-radius: 8px; color: white;
+            cursor: pointer; font: inherit; padding: 12px 18px;
+          }
+          button:disabled { cursor: wait; opacity: 0.7; }
+          pre {
+            background: #f3f4f6; border-radius: 8px; overflow: auto;
+            padding: 12px;
+          }
+        </style>
+      </head>
+      <body>
+        <h1>Reclaim demo verification</h1>
+        <p>Uses provider <code>${providerId}</code>.</p>
+        <button id="start">Start verification</button>
+        <pre id="status">Ready.</pre>
+        <p>Webhook endpoint: <code>/webhooks/reclaim</code></p>
+        <script>
+          const button = document.getElementById("start");
+          const status = document.getElementById("status");
+          button.addEventListener("click", async () => {
+            button.disabled = true;
+            status.textContent = "Creating verification request...";
+            try {
+              const response = await fetch("/api/reclaim/request", {
+                method: "POST",
+              });
+              if (!response.ok) throw new Error(await response.text());
+              const { requestUrl } = await response.json();
+              status.textContent = "Opening Reclaim verification...";
+              window.open(requestUrl, "_blank", "noopener,noreferrer");
+              status.textContent =
+                "Verification opened. Complete it in the Reclaim window.";
+            } catch (error) {
+              status.textContent =
+                error instanceof Error ? error.message : String(error);
+              button.disabled = false;
+            }
+          });
+        </script>
+      </body>
+    </html>`);
+});
+
+app.post("/api/reclaim/request", async (req, res, next) => {
+  try {
+    const appId = process.env.RECLAIM_APP_ID;
+    const appSecret = process.env.RECLAIM_APP_SECRET;
+    if (!appId || !appSecret) {
+      return res.status(500).json({
+        error: "Missing RECLAIM_APP_ID or RECLAIM_APP_SECRET",
+      });
+    }
+
+    const origin =
+      process.env.PUBLIC_URL || `${req.protocol}://${req.get("host")}`;
+    const reclaimProofRequest = await ReclaimProofRequest.init(
+      appId,
+      appSecret,
+      providerId,
+      { providerVersion },
+    );
+    reclaimProofRequest.setAppCallbackUrl(
+      `${origin}/webhooks/reclaim`,
+      true,
+    );
+    reclaimProofRequest.setContext(
+      randomUUID(),
+      JSON.stringify({ createdAt: new Date().toISOString() }),
+    );
+
+    // getRequestUrl() is ASYNC in the current SDK — must be awaited.
+    const requestUrl = await reclaimProofRequest.getRequestUrl();
+
+    res.json({
+      request: reclaimProofRequest.toJsonString(),
+      requestUrl,
+    });
+  } catch (error) {
+    next(error);
+  }
+});
+
+app.post("/webhooks/reclaim", async (req, res, next) => {
+  try {
+    // With jsonProofResponse: true + express.json() above, req.body is
+    // already a parsed Proof/Proof[]. Without either of those, the raw body
+    // is text and must be JSON.parse()'d (and URL-decoded if form-encoded)
+    // before calling verifyProof.
+    const proof = req.body;
+
+    // The second argument is REQUIRED — must include providerId.
+    const result = await verifyProof(proof, { providerId, providerVersion });
+
+    console.log("Received Reclaim verification:");
+    console.log(JSON.stringify(
+      { isVerified: result.isVerified, data: result.data, error: result.error },
+      null,
+      2,
+    ));
+
+    res.status(200).json({ received: true, verified: result.isVerified });
+  } catch (error) {
+    next(error);
+  }
+});
+
+app.use((err, _req, res, _next) => {
+  console.error(err);
+  res.status(500).json({
+    error: err instanceof Error ? err.message : "Internal server error",
+  });
+});
+
+app.listen(port, () => {
+  console.log(`Reclaim demo server listening on http://localhost:${port}`);
+  console.log(`Verify page:      http://localhost:${port}/verify`);
+  console.log(`Webhook endpoint: http://localhost:${port}/webhooks/reclaim`);
+  if (!process.env.PUBLIC_URL) {
+    console.log(
+      "Set PUBLIC_URL (e.g. an ngrok URL) so the webhook is reachable " +
+      "from Reclaim's servers.",
+    );
+  }
+});

package/skill/js-sdk-integration.md

@@ -0,0 +1,119 @@
+# @reclaimprotocol/js-sdk — backend integration guide
+
+Keep `appSecret` on your BACKEND only. Everything below runs server-side;
+the browser only ever sees the `requestUrl`.
+
+## Testing locally, without deploying anything
+
+- **providerId `"example"`**: a canonical built-in smoke-test provider —
+  no need to author/publish your own provider just to confirm the SDK
+  plumbing works end-to-end. Swap in your real providerId once this passes.
+- **A public callback URL**: `setAppCallbackUrl` needs a URL Reclaim's
+  servers can reach over the public internet — `localhost` will never
+  receive the callback. Two ways to get one, pick whichever fits:
+  - **ngrok** (or a similar tunnel): `ngrok http 3000` (or your port)
+    alongside your local server, then set `PUBLIC_URL` to the
+    `https://<id>.ngrok-free.app` URL it prints. Zero-deploy, but the tunnel
+    URL is temporary.
+  - **A dev/staging server you can deploy to quickly**: if you already have
+    one reachable from the internet, just point `PUBLIC_URL` at it instead —
+    skips the extra local tool.
+  Without either, only the frontend-side flow (opening `requestUrl` and
+  reading the result client-side) works — the async webhook never lands.
+- `scaffold_reclaim_demo_server` defaults `providerId` to `"example"`; its
+  README covers both callback-URL options above — use it to get a working
+  local loop before wiring in a real provider.
+
+## 1. Install
+
+```bash
+npm install @reclaimprotocol/js-sdk
+```
+
+## 2. Create a proof request (backend)
+
+```js
+import { ReclaimProofRequest } from "@reclaimprotocol/js-sdk";
+
+const reclaimProofRequest = await ReclaimProofRequest.init(
+  process.env.RECLAIM_APP_ID,
+  process.env.RECLAIM_APP_SECRET,
+  providerId,
+  {
+    // acceptAiProviders: true,   // allow AI-verified providers
+    // useAppClip: true,          // mobile app-clip flow, not a browser popup
+    // providerVersion: "1.0.0",  // pin a specific provider version
+  },
+);
+
+// Deliver the verified proof back to your server asynchronously instead of
+// (or in addition to) reading it from the frontend callback:
+reclaimProofRequest.setAppCallbackUrl(
+  `${process.env.PUBLIC_URL}/webhooks/reclaim`,
+  true, // jsonProofResponse: send the callback body as JSON, not form-encoded
+);
+
+// Optional: attach your own correlation id / metadata, retrievable later.
+reclaimProofRequest.setContext(
+  sessionId,
+  JSON.stringify({ createdAt: Date.now() }),
+);
+
+// IMPORTANT: getRequestUrl() is ASYNC — await it.
+const requestUrl = await reclaimProofRequest.getRequestUrl();
+
+// Hand the requestUrl to the frontend to open in a new tab/window/webview.
+// If you need to rehydrate this request object later (e.g. in the webhook
+// handler, in a different process), persist reclaimProofRequest.toJsonString()
+// (sync) and rehydrate with:
+//   const req = await ReclaimProofRequest.fromJsonString(json); // ASYNC
+```
+
+## 3. Frontend: open the request URL
+
+Fetch `requestUrl` from your backend, then open it (popup/new tab/QR code) —
+never construct it in the browser, since that would require the appSecret
+client-side. Trigger the fetch+open from a real user click (not a page-load
+effect) or some browsers block the popup.
+
+## 4. Verify the callback (backend webhook)
+
+```js
+import { verifyProof } from "@reclaimprotocol/js-sdk";
+
+app.post("/webhooks/reclaim", express.json(), async (req, res) => {
+  // req.body is already a parsed object here because jsonProofResponse was
+  // true above AND express.json() parsed it. If you did NOT set
+  // jsonProofResponse (or aren't using express.json()), the body arrives as
+  // form-encoded/raw text and must be JSON.parse()'d (and decodeURIComponent'd
+  // if form-encoded) into a Proof / Proof[] before calling verifyProof.
+  const proof = req.body;
+
+  // The second argument is REQUIRED — at minimum providerId.
+  const result = await verifyProof(proof, {
+    providerId,
+    // providerVersion,       // optional, pin if you pinned it in init()
+  });
+
+  if (!result.isVerified) {   // NOTE: isVerified, not is_verified
+    console.error("Proof verification failed:", result.error);
+    return res.status(400).json({ verified: false, error: result.error });
+  }
+
+  console.log("Verified data:", result.data, result.publicData);
+  res.status(200).json({ verified: true });
+});
+```
+
+## Gotchas
+
+- `getRequestUrl()` and `ReclaimProofRequest.fromJsonString()` are async —
+  a missing `await` silently hands you a Promise instead of a string/instance.
+- `verifyProof`'s config arg is mandatory; omitting `providerId` throws.
+- Prefer `setContext` over the deprecated `addContext` (same signature).
+- `ReclaimProofRequest.init` needs network access to the Reclaim backend at
+  call time — don't call it at module load / cold-start if your platform pools
+  processes long-term; call it per-request instead.
+- Use `check_app_status` (this MCP server) to confirm your app is linked
+  and not still sandbox-limited before debugging "verification never lands"
+  issues.

package/src/cdp/launcher.ts

@@ -28,42 +28,42 @@ export interface LaunchOptions {
  */
 function browserCandidates(): string[] {
 	switch (platform()) {
-	case 'darwin':
-		return [
-			'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
-			join(
-				homedir(),
-				'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
-			),
-			'/Applications/Chromium.app/Contents/MacOS/Chromium',
-			'/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
-		]
-	case 'win32': {
-		const appData =
+		case 'darwin':
+			return [
+				'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+				join(
+					homedir(),
+					'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+				),
+				'/Applications/Chromium.app/Contents/MacOS/Chromium',
+				'/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
+			]
+		case 'win32': {
+			const appData =
 				localAppData() ?? join(homedir(), 'AppData', 'Local')
-		return [
+			return [
 			// System-wide Chrome
-			'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
-			'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
-			// Per-user Chrome ("Install for me only")
-			join(appData, 'Google', 'Chrome', 'Application', 'chrome.exe'),
-			// Edge — Chromium-based, preinstalled on Win 10/11
-			'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe',
-			'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe',
-		]
-	}
+				'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+				'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
+				// Per-user Chrome ("Install for me only")
+				join(appData, 'Google', 'Chrome', 'Application', 'chrome.exe'),
+				// Edge — Chromium-based, preinstalled on Win 10/11
+				'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe',
+				'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe',
+			]
+		}
 
-	case 'linux':
-		return [
-			'/usr/bin/google-chrome',
-			'/usr/bin/google-chrome-stable',
-			'/usr/bin/chromium',
-			'/usr/bin/chromium-browser',
-			'/snap/bin/chromium',
-			'/usr/bin/microsoft-edge',
-		]
-	default:
-		return []
+		case 'linux':
+			return [
+				'/usr/bin/google-chrome',
+				'/usr/bin/google-chrome-stable',
+				'/usr/bin/chromium',
+				'/usr/bin/chromium-browser',
+				'/snap/bin/chromium',
+				'/usr/bin/microsoft-edge',
+			]
+		default:
+			return []
 	}
 }
 

package/src/mcp/api/tools.ts

@@ -1,9 +1,8 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
+import type { ReclaimClient } from '@reclaimprotocol/client'
 import type {
-	ReclaimClient
-} from '@reclaimprotocol/client'
-import type {
-	IOperationArgs, IOperationId
+	IOperationArgs,
+	IOperationId
 } from '@reclaimprotocol/client/openapi'
 import { remapErrorAsResponse } from '../remap_errors.ts'
 import { MCP_TOOLS } from './operations.gen.ts'