@reclaimprotocol/agent 0.1.11 → 0.1.13

package/src/mcp/remap_errors.ts

@@ -29,7 +29,7 @@ export const remapErrorAsResponse = (
 			{
 				type: 'text' as const,
 				text: `${problemError.message}: ${problemError.data?.detail}`
-			 }
+			}
 		],
 	}
 }

package/src/mcp/tools/agent/shared.ts

@@ -14,10 +14,42 @@ import {
 } from '../../../authoring/index.ts'
 import { runAttestorProof } from '../../../proof/attestor.ts'
 import { replayProvider } from '../../../proof/replay.ts'
+import type { OprfMode, ReclaimProvider } from '../../../provider/schema.ts'
 import type { RegisteredTool } from '../../server.ts'
 import type { CaptureEntry, CaptureStore } from './capture.ts'
 import { shapeRichProofResult } from './proof.ts'
 
+/**
+ * OPRF mode this LOCAL (non-TEE) attestor can actually run. Recipes carry
+ * `oprf-mpc` — the canonical/publish mode a TEE expects — but the local dev
+ * attestor can't do MPC. gnark `oprf` (Linux/Mac, needs ZK circuits) is the
+ * strongest it supports; Windows falls back to server-side `oprf-raw` (no
+ * circuits). Proving with the wrong mode fails, which is what pushed the agent
+ * to hand-craft a plaintext workaround.
+ */
+const LOCAL_OPRF_MODE: OprfMode =
+	process.platform === 'win32' ? 'oprf-raw' : 'oprf'
+
+/**
+ * Clone `provider` with every `oprf-mpc` redaction remapped to the mode this
+ * local attestor can run, so the PROOF validates locally. The draft itself is
+ * untouched — it keeps `oprf-mpc`, so the PUBLISHED recipe is always the
+ * TEE-canonical mode regardless of where it was proved.
+ */
+function withLocalOprfMode(provider: ReclaimProvider): ReclaimProvider {
+	const reds = provider.responseRedactions
+	if(!reds?.some((r) => r.hash === 'oprf-mpc')) {
+		return provider
+	}
+
+	return {
+		...provider,
+		responseRedactions: reds.map((r) => {
+			return r.hash === 'oprf-mpc' ? { ...r, hash: LOCAL_OPRF_MODE } : r
+		}),
+	}
+}
+
 /** The local backend for one capture: drive its tab over CDP, read its
  *  captured requests, prove via the in-process attestor, replay by re-fetch. */
 function localBackend(entry: CaptureEntry): AuthoringBackend {
@@ -64,8 +96,10 @@ function localBackend(entry: CaptureEntry): AuthoringBackend {
 			}
 		},
 		prove: async(draft, opts) => {
+			// Prove with the locally-runnable OPRF mode; the draft (→ published
+			// recipe) keeps oprf-mpc.
 			const result = await runAttestorProof(
-				draft.provider,
+				withLocalOprfMode(draft.provider),
 				draft.secrets,
 				{
 					...(opts?.ownerAddress ? { ownerAddress: opts.ownerAddress } : {}),

package/src/mcp/tools/authenticate/authenticate.ts

@@ -1,7 +1,5 @@
 import type { ReclaimClient } from '@reclaimprotocol/client'
-import type {
-	CredentialAttachSession
-} from '@reclaimprotocol/client/openapi'
+import type { CredentialAttachSession } from '@reclaimprotocol/client/openapi'
 import { defineTool, type RegisteredTool } from '../../server.ts'
 import { writeSession } from './session-cache.ts'
 

package/src/mcp/tools/authenticate/decrypt-key.ts

@@ -11,10 +11,7 @@
  * The hex is loaded via the client's `loadDecryptionKey` and passed straight
  * through as `ReclaimConfig.credential` / to `decryptCallback`.
  */
-import {
-	type DecryptionKey,
-	loadDecryptionKey,
-} from '@reclaimprotocol/client'
+import { type DecryptionKey, loadDecryptionKey } from '@reclaimprotocol/client'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { findProjectRoot } from '../../../paths.ts'

package/src/old/client.ts

@@ -74,6 +74,22 @@ export interface MyProvidersQuery {
 	searchQuery?: string
 }
 
+/** `POST /api/applications/issue-credentials` response — a brand-new,
+ *  unassociated (sandboxed) app. `appSecret` is the raw eth private key;
+ *  it's returned once and never stored server-side in recoverable form. */
+export interface IssuedAppCredentials {
+	appId: string
+	appSecret: string
+}
+
+/** `GET /api/applications/link/nonce` response — a one-time, 5-minute-TTL
+ *  challenge the caller signs with the app's private key to prove ownership
+ *  in `linkAppToAccount`. */
+export interface LinkNonce {
+	nonce: string
+	expiresInSeconds: number
+}
+
 interface RequestOpts {
 	query?: Record<string, string | number | undefined>
 	body?: unknown
@@ -187,6 +203,50 @@ export class ReclaimOldClient {
 		return json
 	}
 
+	/** Mint a brand-new, unassociated (sandboxed) app — no auth required. Link
+	 *  it to an account afterwards with `getLinkNonce` + `linkAppToAccount`, or
+	 *  use it as-is within the sandbox session limit. */
+	async issueCredentials(): Promise<IssuedAppCredentials> {
+		const res = await this.#request('POST', '/applications/issue-credentials')
+		return (res as { data: IssuedAppCredentials }).data
+	}
+
+	/** One-time, 5-minute challenge for `linkAppToAccount`. Requires auth —
+	 *  the nonce is scoped to the authenticated user's uid. */
+	async getLinkNonce(): Promise<LinkNonce> {
+		const res = await this.#request('GET', '/applications/link/nonce', {
+			auth: true,
+		})
+		return (res as { data: LinkNonce }).data
+	}
+
+	/** Link an unassociated (`issueCredentials`-minted) app to the
+	 *  authenticated account. `signature` must be an EIP-191 signature, made
+	 *  with the app's private key, over the exact string
+	 *  `` `Link ${appId} to account ${userId} | nonce: ${nonce}` `` — see
+	 *  `buildLinkMessage` in the backend's `application.controller.ts`. Fails
+	 *  with `APP_ALREADY_LINKED` (400) if the app already belongs to someone. */
+	linkAppToAccount(
+		appId: string,
+		signature: string,
+		nonce: string,
+	): Promise<unknown> {
+		return this.#request('POST', '/applications/link', {
+			body: { appId, signature, nonce },
+			auth: true,
+		})
+	}
+
+	/** Public, unauthenticated app status — `isLinked`, sandbox/quota info.
+	 *  Works for any appId, owned or not. */
+	async getApplicationStatus(appId: string): Promise<unknown> {
+		const res = await this.#request(
+			'GET',
+			`/applications/status/${encodeURIComponent(appId)}`,
+		)
+		return (res as { data: unknown }).data
+	}
+
 	getMyProviders(query: MyProvidersQuery = {}): Promise<unknown> {
 		// Every one of these query params is REQUIRED by the backend
 		// validator (missing/invalid → 400), so default them all here.

package/src/old/tools/build.ts

@@ -2,11 +2,17 @@ import type { RegisteredTool } from '../../mcp/server.ts'
 import type { ReclaimOldClient } from '../client.ts'
 import type { ReclaimSdkClient } from '../sdk-client.ts'
 import { authenticateTool } from './authenticate.ts'
+import { checkAppStatusTool } from './check-app-status.ts'
 import { getProviderInfoTool } from './get-provider-info.ts'
+import { issueAppCredentialsTool } from './issue-app-credentials.ts'
+import { getJsSdkIntegrationGuideTool } from './js-sdk-integration-guide.ts'
+import { linkAppTool } from './link-app.ts'
 import { getMeProvidersTool } from './me-providers.ts'
 import { createVersionFromCaptureTool } from './publish.ts'
+import { scaffoldDemoServerTool } from './scaffold-demo-server.ts'
 import { sessionAnalyticsLogsTool } from './session-analytics-logs.ts'
 import { updateProviderMetadataTool } from './update-provider-metadata.ts'
+import { verifySdkSetupTool } from './verify-sdk-setup.ts'
 
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
@@ -29,5 +35,11 @@ export function buildOldBackendTools(
 		getProviderInfoTool(sdkClient),
 		updateProviderMetadataTool(client),
 		sessionAnalyticsLogsTool(client),
+		issueAppCredentialsTool(client),
+		linkAppTool(client),
+		checkAppStatusTool(client),
+		getJsSdkIntegrationGuideTool(),
+		scaffoldDemoServerTool(),
+		verifySdkSetupTool(client),
 	]
 }

package/src/old/tools/check-app-status.ts

@@ -0,0 +1,33 @@
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/**
+ * Public, unauthenticated app status lookup — works for any `appId`, owned
+ * or not, linked or sandboxed. Mirrors the backend's
+ * `GET /api/applications/status/:appId`.
+ */
+export function checkAppStatusTool(client: ReclaimOldClient): RegisteredTool {
+	return defineTool<{ appId: string }>(
+		{
+			name: 'check_app_status',
+			description:
+				'Check a Reclaim app\'s link/sandbox status by appId — no ' +
+				'authentication required. Returns whether the app is linked to a ' +
+				'dashboard account (`isLinked`), and for linked apps, remaining ' +
+				'session quota. A 404 means the appId has never been used yet — ' +
+				'it is created lazily on the first ReclaimProofRequest.init() call ' +
+				'or via issue_app_credentials.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					appId: {
+						type: 'string',
+						description: 'The eth-address appId to check.',
+					},
+				},
+				required: ['appId'],
+			},
+		},
+		async({ appId }) => client.getApplicationStatus(appId),
+	)
+}

package/src/old/tools/issue-app-credentials.ts

@@ -0,0 +1,44 @@
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/**
+ * Mint a brand-new eth-keypair APP (as opposed to authenticating as a
+ * dashboard user). `appId` is the eth address, `appSecret` the raw private
+ * key — this is the pair `@reclaimprotocol/js-sdk`'s `ReclaimProofRequest.init`
+ * expects. No auth required: the app starts unassociated (`creatorUid: null`)
+ * and sandboxed (`sandboxLimit: 100` sessions). Use `link_app_to_account` to
+ * attach it to your dashboard account, or `check_app_status` to inspect it.
+ */
+export function issueAppCredentialsTool(
+	client: ReclaimOldClient,
+): RegisteredTool {
+	return defineTool<Record<string, never>>(
+		{
+			name: 'issue_app_credentials',
+			description:
+				'Mint a new Reclaim APP (eth keypair) on the old devtools backend — ' +
+				'no authentication required. Returns `{ appId, appSecret }`: ' +
+				'`appId` is the eth address, `appSecret` the raw private key. This ' +
+				'is the appId/appSecret pair for @reclaimprotocol/js-sdk ' +
+				'(`ReclaimProofRequest.init(appId, appSecret, providerId)`). The app ' +
+				'starts UNLINKED and sandboxed (100 sessions) — call ' +
+				'link_app_to_account to attach it to your dashboard account and ' +
+				'check_app_status to check its state. Store `appSecret` like a ' +
+				'password (e.g. in a gitignored .env as RECLAIM_APP_SECRET) — it ' +
+				'is returned once and cannot be recovered from the server.',
+			inputSchema: { type: 'object', properties: {} },
+		},
+		async() => {
+			const { appId, appSecret } = await client.issueCredentials()
+			return {
+				appId,
+				appSecret,
+				note:
+					'Unlinked, sandboxed app (100 session limit). Set RECLAIM_APP_ID ' +
+					'and RECLAIM_APP_SECRET in your .env (gitignored). Run ' +
+					'link_app_to_account to attach it to your dashboard account and ' +
+					'lift the sandbox limit.',
+			}
+		},
+	)
+}

package/src/old/tools/js-sdk-integration-guide.ts

@@ -0,0 +1,38 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+
+/**
+ * Verified against `@reclaimprotocol/js-sdk` v5.8.1 source
+ * (`reclaim-js-sdk/src/Reclaim.ts`) — NOT copied unchecked from the archived
+ * `reclaim-mcp-server`'s guide, which predates several of these signatures.
+ * The prose lives in `skill/js-sdk-integration.md` so it can be edited as
+ * markdown without touching code — same pattern as `provider/injection-doc.ts`.
+ * The path resolves the same from `src/old/tools` (dev) and `lib/old/tools`
+ * (published): both are three levels below the package root.
+ */
+const GUIDE = readFileSync(
+	fileURLToPath(
+		new URL('../../../skill/js-sdk-integration.md', import.meta.url),
+	),
+	'utf8',
+).trim()
+
+export function getJsSdkIntegrationGuideTool(): RegisteredTool {
+	return defineTool<Record<string, never>>(
+		{
+			name: 'get_js_sdk_integration_guide',
+			description:
+				'Return a verified, copy-pasteable guide for integrating ' +
+				'@reclaimprotocol/js-sdk (backend proof request + callback ' +
+				'verification), checked against the current SDK source rather than ' +
+				'assumed from older docs. Covers testing locally without deploying: ' +
+				'the built-in "example" providerId for a quick smoke test, and using ' +
+				'ngrok to get a callback URL Reclaim\'s servers can actually reach. ' +
+				'Use scaffold_reclaim_demo_server to generate a runnable local demo ' +
+				'instead of copy-pasting by hand.',
+			inputSchema: { type: 'object', properties: {} },
+		},
+		async() => ({ guide: GUIDE }),
+	)
+}

package/src/old/tools/link-app.ts

@@ -0,0 +1,93 @@
+import { signEip191 } from '@reclaimprotocol/client'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/** Byte-for-byte the same format as the backend's `buildLinkMessage` in
+ *  `application.controller.ts` — MUST stay in lockstep with it. */
+function buildLinkMessage(
+	appId: string,
+	userId: string,
+	nonce: string,
+): string {
+	return `Link ${appId} to account ${userId} | nonce: ${nonce}`
+}
+
+/** The uid the backend binds into the signed message — `req.user.uid` there.
+ *  For a bearer identity this comes back from `POST /users/login`; for an eth
+ *  identity, `OldIdentity.uid` (already `eth:<address>`) IS that uid. */
+async function resolveUserId(client: ReclaimOldClient): Promise<string> {
+	const identity = client.getIdentity()
+	if(!identity) {
+		throw new Error(
+			'Not authenticated against old devtools. Call reclaim_authenticate ' +
+				'first.',
+		)
+	}
+
+	if(identity.kind === 'eth') {
+		return identity.uid
+	}
+
+	const res = await client.loginWithToken() as { user?: { uid?: string } }
+	const uid = res?.user?.uid
+	if(!uid) {
+		throw new Error(
+			'Could not resolve your account uid from POST /users/login — ' +
+			'unexpected response shape.',
+		)
+	}
+
+	return uid
+}
+
+/**
+ * Link an unassociated app (minted via `issue_app_credentials`, or any
+ * eth-keypair app you already hold the private key for) to the currently
+ * authenticated dashboard account. Proves ownership by signing a one-time
+ * challenge with the app's private key — the private key itself is only
+ * ever used locally to sign, never sent to the server.
+ */
+export function linkAppTool(client: ReclaimOldClient): RegisteredTool {
+	return defineTool<{ appId: string, appSecret: string }>(
+		{
+			name: 'link_app_to_account',
+			description:
+				'Link an eth-keypair app to your authenticated dashboard account — ' +
+				'use this to keep using an appId/appSecret you already have ' +
+				'(instead of minting a fresh one via issue_app_credentials). ' +
+				'Requires reclaim_authenticate first. Fetches a one-time nonce, ' +
+				'signs `Link <appId> to account <userId> | nonce: <nonce>` locally ' +
+				'with `appSecret` (EIP-191, never transmitted), and submits the ' +
+				'signature. Fails with APP_ALREADY_LINKED if the app is already ' +
+				'linked to a (possibly different) account.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					appId: {
+						type: 'string',
+						description: 'The eth-address appId to link.',
+					},
+					appSecret: {
+						type: 'string',
+						description:
+							'The app\'s raw eth private key — used only locally to sign ' +
+							'the link challenge, never sent to the server.',
+					},
+				},
+				required: ['appId', 'appSecret'],
+			},
+		},
+		async({ appId, appSecret }) => {
+			const userId = await resolveUserId(client)
+			const { nonce } = await client.getLinkNonce()
+			const message = buildLinkMessage(appId, userId, nonce)
+			const signature = signEip191(message, appSecret)
+			await client.linkAppToAccount(appId, signature, nonce)
+			return {
+				linked: true,
+				appId,
+				note: 'App linked to your account. Run check_app_status to confirm.',
+			}
+		},
+	)
+}

package/src/old/tools/publish.ts

@@ -147,9 +147,16 @@ export function createVersionFromCaptureTool(
 						description:
 							'Multiple proven drafts → one multi-request version (each ' +
 							'becomes a parallel `requestData` entry, all verified ' +
-							'together). Each item has the same shape as `provider`. Pass ' +
-							'this OR `provider`, not both.',
-						minItems: 1,
+							'together). Each item has the same shape as `provider` (if ' +
+							'both are passed, they are combined). May be omitted (or ' +
+							'empty) together with `provider` ONLY when adding a version ' +
+							'to an EXISTING provider (`providerId` set) — publishes with ' +
+							'zero `requestData` entries, for a pure customInjection/' +
+							'HAWKEYE provider that relies entirely on ' +
+							'`allowedInjectedRequestData` for validation instead of a ' +
+							'static requestData stub. Registering a brand-new provider ' +
+							'always needs at least one draft (its name comes from the ' +
+							'first one).',
 						items: {
 							type: 'object',
 							properties: {
@@ -299,20 +306,27 @@ export function createVersionFromCaptureTool(
 			},
 		},
 		async(args) => {
-			// Exactly one of `provider` / `providers` — normalize to an array so a
-			// multi-request capture publishes every request, not just the first.
-			const hasMany = Array.isArray(args.providers) && args.providers.length > 0
-			const hasOne = !!args.provider
-			if(hasMany === hasOne) {
+			// `provider` / `providers` are just two spellings of the same input —
+			// fold them into one array. Zero drafts is allowed ONLY when adding a
+			// version to an EXISTING provider (`providerId` set): that publishes
+			// with zero `requestData` entries, for a pure customInjection/HAWKEYE
+			// provider whose claims are validated entirely via
+			// `allowedInjectedRequestData`. Registering a brand-new provider still
+			// needs at least one draft — its name comes from the first one.
+			const providers = [
+				...(args.provider ? [args.provider] : []),
+				...(args.providers ?? []),
+			]
+			if(!providers.length && !args.providerId) {
 				throw new Boom(
-					'Pass exactly one of `provider` (a single draft) or `providers` ' +
-					'(an array of 1+ drafts).',
+					'Pass at least one of `provider`/`providers` when registering a ' +
+					'new provider (its name comes from the first draft). Omitting ' +
+					'both is only allowed when adding a version to an EXISTING ' +
+					'provider via `providerId`.',
 					{ statusCode: 400 },
 				)
 			}
 
-			const providers = hasMany ? args.providers! : [args.provider!]
-
 			const opts: OldProviderOpts = {
 				initialUrl: args.initialUrl,
 				description: args.description,

package/src/old/tools/scaffold-demo-server.ts

@@ -0,0 +1,120 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { isAbsolute, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import { findProjectRoot } from '../../paths.ts'
+
+/** The demo's source files live in `samples/demo-server/` so they can be
+ *  edited (and even run) as plain files without touching code — same pattern
+ *  as `skill/*.md`. The path resolves the same from `src/old/tools` (dev) and
+ *  `lib/old/tools` (published): both are three levels below the package root.
+ *
+ *  `server.js` there is corrected against `@reclaimprotocol/js-sdk` v5.8.1
+ *  (`Reclaim.ts`): awaits `getRequestUrl()`, uses `setContext` (not deprecated
+ *  `addContext`), JSON-parses the raw webhook body before `verifyProof`,
+ *  passes the required `{ providerId, providerVersion }` config, and reads
+ *  `result.isVerified` (not `is_verified`). `providerVersion` is left unpinned
+ *  by default — the built-in "example" providerId isn't versioned, so pinning
+ *  one is only meaningful once you swap in your own provider. */
+const SAMPLE_DIR = fileURLToPath(
+	new URL('../../../samples/demo-server', import.meta.url),
+)
+
+function readSample(name: string): string {
+	return readFileSync(join(SAMPLE_DIR, name), 'utf8')
+}
+
+/** `server.js` with its `__PROVIDER_ID__` / `__PROVIDER_VERSION__` tokens
+ *  substituted with JS literals. */
+function serverJs(
+	providerId: string,
+	providerVersion: string | undefined,
+): string {
+	return readSample('server.js')
+		.replace('__PROVIDER_ID__', JSON.stringify(providerId))
+		.replace(
+			'__PROVIDER_VERSION__',
+			providerVersion ? JSON.stringify(providerVersion) : 'undefined',
+		)
+}
+
+/**
+ * Scaffold a small, runnable Express demo that exercises the full
+ * @reclaimprotocol/js-sdk flow end-to-end: request a proof (backend), open it
+ * (frontend), and verify the async webhook callback (backend). Corrected
+ * against the CURRENT SDK API (see js-sdk-integration-guide) rather than
+ * older examples that predate several signature changes.
+ */
+const DEFAULT_PROVIDER_ID = 'example'
+
+export function scaffoldDemoServerTool(): RegisteredTool {
+	return defineTool<{
+		targetDir: string
+		providerId?: string
+		providerVersion?: string
+	}>(
+		{
+			name: 'scaffold_reclaim_demo_server',
+			description:
+				'Write a small runnable Express demo (server.js, package.json, ' +
+				'.env.example, README.md) that requests a Reclaim proof and ' +
+				'verifies the async webhook callback, using the CURRENT ' +
+				'@reclaimprotocol/js-sdk API. Defaults `providerId` to the built-in ' +
+				'"example" smoke-test provider so you can confirm the whole loop ' +
+				'without authoring one first. The webhook callback needs a URL ' +
+				'Reclaim\'s servers can reach — localhost never works — via EITHER ' +
+				'a tunnel (ngrok or similar) OR quickly deploying this demo to a ' +
+				'dev/staging server the user already has; ASK THE USER which they\'d ' +
+				'rather use before assuming ngrok, since either sets `PUBLIC_URL` in ' +
+				'.env (the generated README covers both). Use ' +
+				'get_js_sdk_integration_guide for the annotated write-up of the ' +
+				'same flow.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					targetDir: {
+						type: 'string',
+						description:
+							'Directory to write the demo into (created if missing). ' +
+							'Relative paths resolve against the project root.',
+					},
+					providerId: {
+						type: 'string',
+						description:
+							'Provider id the demo requests a proof for (default ' +
+							'"example", a built-in smoke-test provider — good for ' +
+							'confirming the flow works before wiring in a real one).',
+					},
+					providerVersion: {
+						type: 'string',
+						description:
+							'Provider version to pin (default: unpinned — "example" ' +
+							'isn\'t versioned, so only set this once you swap in your ' +
+							'own provider).',
+					},
+				},
+				required: ['targetDir'],
+			},
+		},
+		async({ targetDir, providerId, providerVersion }) => {
+			const dir = isAbsolute(targetDir)
+				? targetDir
+				: join(findProjectRoot(process.cwd()), targetDir)
+			mkdirSync(dir, { recursive: true })
+
+			const id = providerId ?? DEFAULT_PROVIDER_ID
+			writeFileSync(join(dir, 'server.js'), serverJs(id, providerVersion))
+			writeFileSync(join(dir, 'package.json'), readSample('package.json'))
+			writeFileSync(join(dir, '.env.example'), readSample('.env.example'))
+			writeFileSync(join(dir, 'README.md'), readSample('README.md'))
+
+			return {
+				dir,
+				providerId: id,
+				files: ['server.js', 'package.json', '.env.example', 'README.md'],
+				next: 'cd into the directory, npm install, copy .env.example to .env ' +
+					'and fill it in (including PUBLIC_URL from ngrok), then npm start.',
+			}
+		},
+	)
+}