@reclaimprotocol/agent 0.1.11 → 0.1.13

package/src/old/tools/verify-sdk-setup.ts

@@ -0,0 +1,162 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import { findProjectRoot } from '../../paths.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+interface Check {
+	name: string
+	ok: boolean
+	detail: string
+}
+
+function readEnvFile(dir: string): Record<string, string> {
+	const path = join(dir, '.env')
+	if(!existsSync(path)) {
+		return {}
+	}
+
+	const out: Record<string, string> = {}
+	for(const line of readFileSync(path, 'utf8').split('\n')) {
+		const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/)
+		if(m) {
+			out[m[1]] = m[2].replace(/^['"]|['"]$/g, '')
+		}
+	}
+
+	return out
+}
+
+/**
+ * Health-check a project's @reclaimprotocol/js-sdk setup: SDK installed,
+ * RECLAIM_APP_ID/RECLAIM_APP_SECRET present (env or .env), and (if an appId
+ * is found) whether that app is actually linked/has quota, via the real
+ * check_app_status endpoint — not just static file checks.
+ */
+export function verifySdkSetupTool(client: ReclaimOldClient): RegisteredTool {
+	return defineTool<{ projectDir?: string }>(
+		{
+			name: 'verify_reclaim_sdk_setup',
+			description:
+				'Health-check a project\'s @reclaimprotocol/js-sdk integration: SDK ' +
+				'installed, RECLAIM_APP_ID/RECLAIM_APP_SECRET present, and (if an ' +
+				'appId is found) whether that app is actually linked and has quota ' +
+				'left, by calling the real status endpoint.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					projectDir: {
+						type: 'string',
+						description: 'Project directory (default: detected project root).',
+					},
+				},
+			},
+		},
+		async({ projectDir }) => {
+			const dir = projectDir ?? findProjectRoot(process.cwd())
+			const checks: Check[] = []
+
+			const pkgPath = join(dir, 'package.json')
+			let sdkInPkg = false
+			if(existsSync(pkgPath)) {
+				try {
+					const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+					sdkInPkg = Boolean(
+						pkg.dependencies?.['@reclaimprotocol/js-sdk'] ||
+						pkg.devDependencies?.['@reclaimprotocol/js-sdk'],
+					)
+				} catch{
+					// malformed package.json — fall through, reported below
+				}
+			}
+
+			const sdkInstalled = existsSync(
+				join(dir, 'node_modules', '@reclaimprotocol', 'js-sdk'),
+			)
+			checks.push({
+				name: 'sdk_dependency',
+				ok: sdkInPkg,
+				detail: sdkInPkg
+					? '@reclaimprotocol/js-sdk is listed in package.json'
+					: '@reclaimprotocol/js-sdk is NOT in package.json — run ' +
+						'`npm install @reclaimprotocol/js-sdk`.',
+			})
+			checks.push({
+				name: 'sdk_installed',
+				ok: sdkInstalled,
+				detail: sdkInstalled
+					? '@reclaimprotocol/js-sdk found in node_modules'
+					: 'Not found in node_modules — run your package manager\'s ' +
+						'install command.',
+			})
+
+			const env = { ...readEnvFile(dir), ...process.env }
+			const appId = env.RECLAIM_APP_ID
+			const appSecret = env.RECLAIM_APP_SECRET
+			checks.push({
+				name: 'app_id',
+				ok: Boolean(appId),
+				detail: appId
+					? `RECLAIM_APP_ID set (${appId})`
+					: 'RECLAIM_APP_ID missing (env or .env) — run ' +
+						'issue_app_credentials or link_app_to_account.',
+			})
+			checks.push({
+				name: 'app_secret',
+				ok: Boolean(appSecret),
+				detail: appSecret
+					? 'RECLAIM_APP_SECRET set'
+					: 'RECLAIM_APP_SECRET missing (env or .env).',
+			})
+
+			// Informational only — PUBLIC_URL is only needed for the async
+			// webhook callback, not the frontend-only flow, so a missing value
+			// doesn't fail the overall check.
+			const publicUrl = env.PUBLIC_URL
+			checks.push({
+				name: 'public_url',
+				ok: true,
+				detail: publicUrl
+					? `PUBLIC_URL set (${publicUrl}) — used as the webhook callback ` +
+						'base for setAppCallbackUrl.'
+					: 'PUBLIC_URL not set — fine if you only read the proof from the ' +
+						'frontend flow, but the async webhook callback needs a ' +
+						'publicly-reachable URL or it will never fire. Get one via a ' +
+						'tunnel (e.g. `ngrok http <port>`) or by deploying to a ' +
+						'dev/staging server you already have — ask the user which they ' +
+						'prefer.',
+			})
+
+			if(appId) {
+				try {
+					const status = await client.getApplicationStatus(appId) as {
+						isLinked?: boolean
+						sandboxMode?: boolean
+						available?: boolean
+					}
+					const linked = status?.isLinked === true
+					checks.push({
+						name: 'app_status',
+						ok: status?.available !== false,
+						detail:
+							`isLinked=${linked}, sandboxMode=${status?.sandboxMode}, ` +
+							`available=${status?.available}` +
+							(linked
+								? ''
+								: ' — run link_app_to_account to lift the sandbox limit.'),
+					})
+				} catch(err) {
+					checks.push({
+						name: 'app_status',
+						ok: false,
+						detail: `Could not reach status endpoint: ${
+							err instanceof Error ? err.message : String(err)
+						}`,
+					})
+				}
+			}
+
+			return { projectDir: dir, checks, ok: checks.every((c) => c.ok) }
+		},
+	)
+}

package/src/proof/attestor.ts

@@ -8,7 +8,8 @@
 
 import { bytesToHex } from '@noble/hashes/utils.js'
 import {
-	createClaimOnAttestor, type Logger,
+	createClaimOnAttestor,
+	type Logger
 } from '@reclaimprotocol/attestor-core'
 // Side-effect: make external domhandler nodes DOM-like so attestor-core's
 // bundled `xpath` accepts them (see patch-domhandler.ts). Must load before any
@@ -19,7 +20,10 @@ import { resolveEthKey } from '../mcp/tools/authenticate/eth-key.ts'
 import type { ReclaimProvider } from '../provider/schema.ts'
 import { installResponseDump } from './debug-response-dump.ts'
 import {
-	buildHttpParams, ensureAttestorCrypto, parseClaim, resolveAttestorUrl,
+	buildHttpParams,
+	ensureAttestorCrypto,
+	parseClaim,
+	resolveAttestorUrl
 } from './proof-core.ts'
 import { ensureZkFiles } from './zk-files.ts'
 
@@ -129,7 +133,7 @@ const LOG_TAIL_LINES = 80
 function makeCaptureLogger(): {
 	logger: unknown
 	entries: AttestorLogEntry[]
-	} {
+} {
 	const entries: AttestorLogEntry[] = []
 	const make = (baseCtx: Record<string, unknown>): unknown => {
 		const log =

package/src/provider/draft.ts

@@ -93,6 +93,16 @@ const STRIP_REQUEST_HEADERS = new Set([
 	'host',
 	'content-length',
 	'transfer-encoding',
+	// Per-session anti-CSRF tokens. Not caught by splitSecrets (no `-token`
+	// suffix), so without this they baked in as PUBLIC headers and went stale at
+	// verify time — the attestor replayed one user's captured CSRF for everyone,
+	// which the origin rejects. A CSRF token is never portable; drop it.
+	'csrf',
+	'x-csrf',
+	'xsrf',
+	'x-xsrf',
+	'x-csrf-token',
+	'xsrf-token',
 ])
 
 /** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
@@ -101,6 +111,19 @@ function isPseudoHeader(name: string): boolean {
 	return name.startsWith(':')
 }
 
+/** A header VALUE that is a per-session/request token — a UUID or a long opaque
+ *  hex/base64 blob. Such a value is captured-user-specific: baked into the
+ *  provider it goes stale and the origin rejects the replay for everyone else.
+ *  Stable identifiers (a tenant/space id like `1237`, a timezone, client hints)
+ *  are short/structured and don't match, so they survive. */
+function isVolatileHeaderValue(value: string): boolean {
+	const v = value.trim()
+	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+		.test(v)
+		|| /^[0-9a-f]{16,}$/i.test(v)
+		|| /^[A-Za-z0-9_-]{32,}$/.test(v)
+}
+
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
@@ -109,7 +132,11 @@ function sanitizeRequestHeaders(
 ): Record<string, string> {
 	const out: Record<string, string> = {}
 	for(const [k, v] of Object.entries(headers)) {
-		if(STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
+		if(
+			STRIP_REQUEST_HEADERS.has(k.toLowerCase())
+			|| isPseudoHeader(k)
+			|| isVolatileHeaderValue(v)
+		) {
 			continue
 		}
 
@@ -134,6 +161,37 @@ export function assertPortableMatches(
 	redactions: ResponseRedaction[],
 	targets: DraftTarget[],
 ): void {
+	// A baked email LOCAL-PART ("jane.doe@…") pins the provider to one user
+	// even when only the domain is captured as a param — the classic result of
+	// proving an email's domain substring. Reject it regardless of the declared
+	// targets (the local part is usually not itself a target, so the value scan
+	// below wouldn't catch it). Strip params + named groups + regex escapes
+	// first, then look for `localpart@` as a surviving literal.
+	const EMAIL_LOCAL_BAKED = /[A-Za-z0-9._%+-]{3,}@/
+	const deregex = (s: string): string => s
+		.replace(/\{\{[^}]*\}\}/g, '')
+		.replace(/\(\?<[^>]*>[^)]*\)/g, '')
+		.replace(/\\(.)/g, '$1')
+	const scanEmail = (text: string, where: string): void => {
+		if(EMAIL_LOCAL_BAKED.test(deregex(text))) {
+			throw new Error(
+				`drafted ${where} bakes a per-user email local-part as a literal — `
+				+ 'the provider would be pinned to this user. Capture the WHOLE email '
+				+ 'as a {{param}} (optionally OPRF-hashed), not just its domain.',
+			)
+		}
+	}
+
+	for(const [i, m] of matches.entries()) {
+		scanEmail(m.value, `responseMatch for "${targets[i]?.name ?? '?'}"`)
+	}
+
+	for(const r of redactions) {
+		if(r.regex) {
+			scanEmail(r.regex, 'responseRedaction regex')
+		}
+	}
+
 	// Guard only values long enough to be plausibly user-specific; shorter runs
 	// (single digits, 2-3 char tokens) collide with ordinary structural bytes.
 	const MIN_ALNUM = 4