@reclaimprotocol/agent 0.1.17 → 0.1.18

package/lib/consts.d.ts

@@ -44,6 +44,13 @@ export declare function useOldDevtools(): boolean;
  * `ConfigStore` (which would create an import cycle).
  */
 export declare function resolveOldMode(persisted?: 'old' | 'builder'): boolean;
+/**
+ * Where the effective mode came from — the same precedence as
+ * `resolveOldMode`: explicit `USE_OLD_DEVTOOLS` env var → persisted config
+ * `mode` → default (old). Surfaced by the `get_devtools_mode` tool so the
+ * user can tell why the server is in the mode it reports.
+ */
+export declare function oldModeSource(persisted?: 'old' | 'builder'): 'env' | 'config' | 'default';
 /** `%LOCALAPPDATA%` on Windows, used to probe a per-user Chrome install. */
 export declare function localAppData(): string | undefined;
 /** Explicit Chrome/Edge/Chromium binary path override. */

package/lib/consts.js

@@ -76,6 +76,21 @@ export function resolveOldMode(persisted) {
     }
     return true;
 }
+/**
+ * Where the effective mode came from — the same precedence as
+ * `resolveOldMode`: explicit `USE_OLD_DEVTOOLS` env var → persisted config
+ * `mode` → default (old). Surfaced by the `get_devtools_mode` tool so the
+ * user can tell why the server is in the mode it reports.
+ */
+export function oldModeSource(persisted) {
+    if (oldDevtoolsEnvSet()) {
+        return 'env';
+    }
+    if (persisted) {
+        return 'config';
+    }
+    return 'default';
+}
 // ---------------------------------------------------------------------------
 // Chrome / CDP launcher.
 // ---------------------------------------------------------------------------

package/lib/mcp/tools/agent/publish.js

@@ -13,6 +13,11 @@ const RESPONSE_MATCHES_SCHEMA = {
         properties: {
             type: { type: 'string', enum: ['regex', 'contains'] },
             value: { type: 'string' },
+            isOptional: {
+                type: 'boolean',
+                description: 'Mark this match non-fatal (verification continues when it ' +
+                    'fails). Default false.',
+            },
         },
         required: ['type', 'value'],
     },
@@ -44,6 +49,12 @@ const REQUEST_DRAFT_PROPERTIES = {
     },
     method: { type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH'] },
     body: { type: 'string', description: 'Request body template, if any.' },
+    credentials: {
+        type: 'string',
+        enum: ['omit', 'same-origin', 'include'],
+        description: 'How the verification client supplies cookies/auth when replaying ' +
+            'this request. Default `include`.',
+    },
     responseMatches: RESPONSE_MATCHES_SCHEMA,
     responseRedactions: RESPONSE_REDACTIONS_SCHEMA,
 };
@@ -173,6 +184,27 @@ export function createVersionFromCaptureTool(client) {
                         '`multiple`/`required` default to true.',
                     items: ALLOWED_JS_REQUEST_SCHEMA,
                 },
+                interceptorOptions: {
+                    type: 'object',
+                    description: 'In-app interception settings, stored as ' +
+                        'webSettings.clientOptions.inapp.interceptorOptions. ' +
+                        '`isDocumentRequestReplayEnabled` is the INVERSE of ' +
+                        'old-devtools\' `disableRequestReplay`: true replays the ' +
+                        'main document request via the attestor (default false).',
+                    properties: {
+                        interceptorType: {
+                            type: 'string',
+                            enum: ['HAWKEYE', 'MSWJS', 'CDP'],
+                            description: 'How traffic interception is implemented.',
+                        },
+                        isDocumentRequestReplayEnabled: { type: 'boolean' },
+                        interceptorSettings: {
+                            type: 'string',
+                            description: 'Free-form JSON config for the chosen interceptor.',
+                        },
+                    },
+                    required: ['interceptorType'],
+                },
             },
             required: ['providerId', 'initialUrl'],
         },
@@ -192,6 +224,7 @@ export function createVersionFromCaptureTool(client) {
             version: ver,
             jsUserScripts: args.jsUserScripts,
             allowedJsRequests: args.allowedJsRequests,
+            interceptorOptions: args.interceptorOptions,
         });
         const result = await client.call('CreateProviderVersion', {
             params: { providerId: args.providerId },

package/lib/mcp/tools/mode/mode.d.ts

@@ -1,8 +1,9 @@
 import type { ConfigStore } from '../../../config/store.ts';
 import { type RegisteredTool } from '../../server.ts';
 /**
- * The `set_devtools_mode` tool: persist which backend the MCP server targets
- * (legacy `old` devtools vs the new `builder`). The choice is written to
+ * The `set_devtools_mode` / `get_devtools_mode` tools: persist which backend
+ * the MCP server targets (`old` devtools vs the `builder`), and
+ * report the mode currently in effect. The choice is written to
  * `~/.reclaim/config.json` and applied the NEXT time the server starts —
  * the registered tool set, server instructions, and backend client are all
  * fixed at connect time, so the switch requires a restart/reconnect. Follows

package/lib/mcp/tools/mode/mode.js

@@ -1,8 +1,10 @@
 import { defaultConfigPath } from "../../../config/store.js";
+import { oldModeSource } from "../../../consts.js";
 import { defineTool } from "../../server.js";
 /**
- * The `set_devtools_mode` tool: persist which backend the MCP server targets
- * (legacy `old` devtools vs the new `builder`). The choice is written to
+ * The `set_devtools_mode` / `get_devtools_mode` tools: persist which backend
+ * the MCP server targets (`old` devtools vs the `builder`), and
+ * report the mode currently in effect. The choice is written to
  * `~/.reclaim/config.json` and applied the NEXT time the server starts —
  * the registered tool set, server instructions, and backend client are all
  * fixed at connect time, so the switch requires a restart/reconnect. Follows
@@ -18,8 +20,8 @@ export function buildModeTools(config, currentOldMode) {
     return [
         defineTool({
             name: 'set_devtools_mode',
-            description: 'Choose which backend the MCP server targets: "old" (legacy '
-                + 'Reclaim devtools) or "builder" (the new builder backend). '
+            description: 'Choose which backend the MCP server targets: "old" (devtools) '
+                + 'or "builder" (the builder backend). '
                 + 'Persists the choice to ~/.reclaim/config.json; it takes effect '
                 + 'the next time the MCP server starts, so restart/reconnect after '
                 + 'switching. An explicit USE_OLD_DEVTOOLS env var overrides this.',
@@ -45,5 +47,23 @@ export function buildModeTools(config, currentOldMode) {
                     : `Already running in "${parsed.mode}" mode; nothing to restart.`,
             };
         }),
+        defineTool({
+            name: 'get_devtools_mode',
+            description: 'Report which backend this MCP server is currently targeting: '
+                + '"old" (devtools) or "builder" (the builder '
+                + 'backend). Also reports WHY that mode is in effect (source: '
+                + 'a USE_OLD_DEVTOOLS env override, the persisted config, or '
+                + 'the default) and which mode is persisted for the next '
+                + 'start. Use set_devtools_mode to change it.',
+            inputSchema: { type: 'object', properties: {} },
+        }, async () => {
+            const persisted = config.read()?.mode;
+            return {
+                mode: current,
+                source: oldModeSource(persisted),
+                persistedMode: persisted ?? null,
+                configPath: defaultConfigPath(),
+            };
+        }),
     ];
 }

package/lib/old/to-register.d.ts

@@ -3,15 +3,15 @@ import type { AllowedJsRequest } from '../provider/to-version.ts';
 import type { RegisterProviderBody, UpdateProviderConfigBody } from './client.ts';
 /**
  * Translate a drafted `ReclaimProvider` (from `propose_provider`) into the
- * OLD devtools backend shapes. Deliberately a SEPARATE module from
+ * devtools backend shapes. Deliberately a SEPARATE module from
  * `provider/to-version.ts` (the builder translator) — the two backends have
  * structurally different bodies:
  *
  *   - builder NESTS each redaction into its match's `extract`;
- *   - old devtools keeps `responseMatches` and `responseRedactions` as
+ *   - devtools keeps `responseMatches` and `responseRedactions` as
  *     PARALLEL arrays on each `requestData` entry.
  *
- * Old-devtools limit we enforce here (a clear error beats a confusing
+ * Devtools limit we enforce here (a clear error beats a confusing
  * server-side 400): only `GET` / `POST` methods. OPRF redactions are passed
  * through unchanged — the backend's `hash` field accepts them.
  */
@@ -23,7 +23,7 @@ export interface OldProviderOpts {
     /** Defaults to `true` when omitted. Register only (Provider-level flag). */
     useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
-    /** Page-injection script — old-devtools' name for the builder's
+    /** Page-injection script — the devtools name for the builder's
      *  `webSettings.jsUserScripts`. Top-level on register, nested under
      *  `providerConfig` on config (add-version). The backend rejects a few
      *  deprecated injection APIs (e.g. `window.payloadData`) with a 400. */
@@ -50,6 +50,14 @@ export interface OldProviderOpts {
     /** Config (add-version) ONLY — the register endpoint never reads this
      *  field from the request body. Free-form JSON. */
     extensionConfig?: unknown;
+    /** Provider-level `disableRequestReplay` (HAWKEYE document replay skip).
+     *  Config (add-version) ONLY: the register endpoint hardcodes it to false
+     *  — the publish tool follows a register up with an add-version call to
+     *  apply it for new providers (see `old/tools/publish.ts`). NOTE the
+     *  builder backend has NO equivalent; its inverse is
+     *  `webSettings.clientOptions.inapp.interceptorOptions
+     *  .isDocumentRequestReplayEnabled`. */
+    disableRequestReplay?: boolean;
 }
 interface OldResponseMatch {
     value: string;
@@ -68,11 +76,11 @@ interface OldResponseRedaction {
 }
 interface OldRequestData {
     url: string;
-    urlType: 'CONSTANT' | 'TEMPLATE';
+    urlType: 'REGEX' | 'CONSTANT' | 'TEMPLATE';
     method: 'GET' | 'POST';
     responseMatches: OldResponseMatch[];
     responseRedactions: OldResponseRedaction[];
-    credentials: 'include';
+    credentials: 'omit' | 'same-origin' | 'include';
     bodySniff?: {
         enabled: boolean;
         template: string;
@@ -88,7 +96,7 @@ export interface OldInjectedRequestData extends OldRequestData {
 }
 /** Translate fresh `allowedInjectedRequestData` drafts (the author's input
  *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
- *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  its own `allowedJsRequests`) into the devtools backend's shape. A
  *  carried-forward value read back from an existing version is ALREADY in
  *  this shape and should be passed straight through instead — don't run it
  *  through this a second time. */
@@ -101,7 +109,7 @@ export declare function providerToRegisterBody(providers: ReclaimProvider[], opt
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
 export declare function providerToConfigBody(providers: ReclaimProvider[], opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
-/** Minimal version triplet as the old backend stores it. */
+/** Minimal version triplet as the devtools backend stores it. */
 export interface SemverTriplet {
     major: number;
     minor: number;

package/lib/old/to-register.js

@@ -1,5 +1,6 @@
+import assert from 'node:assert';
 /** Default web settings, mirroring the builder openapi defaults
- *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The old
+ *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The
  *  backend accepts both: `geoLocation` lives on the providerConfig, `useProxy`
  *  is a Provider-level flag (register only). */
 const DEFAULT_GEO_LOCATION = '{{DYNAMIC_GEO}}';
@@ -10,29 +11,29 @@ const DEFAULT_USE_PROXY = true;
  *  entries — a `ReclaimProvider` satisfies it structurally either way. */
 function requestDataFromProvider(provider) {
     const method = String(provider.method).toUpperCase();
-    if (method !== 'GET' && method !== 'POST') {
-        throw new Error('Old devtools supports only GET/POST requests; got ' +
-            `"${provider.method}". Re-capture against a GET/POST endpoint.`);
-    }
-    // The old backend has no dotted interpolation: consumer-supplied params
+    assert(method === 'GET' || method === 'POST', new Error('Devtools supports only GET/POST requests; got ' +
+        `"${provider.method}". Re-capture against a GET/POST endpoint.`));
+    // The devtools backend has no dotted interpolation: consumer-supplied params
     // must use the `{{context_<name>}}` form here, not the builder's
     // `{{context.<name>}}`. Catch the mix-up at publish with a clear error
     // instead of a template that silently never resolves.
     const dotted = `${provider.url}\n${provider.body ?? ''}`
         .match(/\{\{context\.[A-Za-z_][A-Za-z0-9_]*\}\}/);
-    if (dotted) {
-        throw new Error(`Old devtools does not support ${dotted[0]} — rename ` +
-            'consumer-supplied params to the {{context_<name>}} form ' +
-            'for this backend.');
-    }
+    assert(!dotted, new Error(`Devtools does not support ${dotted?.[0]} — rename ` +
+        'consumer-supplied params to the {{context_<name>}} form ' +
+        'for this backend.'));
     const responseMatches = (provider.responseMatches ?? [])
         .map((m, i) => ({
         value: m.value,
         type: m.type ?? 'contains',
-        isOptional: false,
+        // The backend honors isOptional on BOTH register and add-version
+        // (responseMatches pass through verbatim) — forward the author's
+        // flag, default false. (`invert` has no old-backend equivalent and
+        // stays dropped.)
+        isOptional: m.isOptional ?? false,
         order: i,
     }));
-    // Old devtools wants `responseMatches` and `responseRedactions` as PARALLEL
+    // Devtools wants `responseMatches` and `responseRedactions` as PARALLEL
     // arrays — same shape the builder uses, so pass them through directly. We do
     // NOT enforce any match/redaction count relationship here (and never pad —
     // empty placeholder matches break proof generation): the author keeps full
@@ -58,33 +59,35 @@ function requestDataFromProvider(provider) {
     });
     const requestData = {
         url: provider.url,
-        // `{{param}}` placeholders → TEMPLATE so the backend templates them;
-        // otherwise a fixed CONSTANT url. (REGEX is never drafted.)
-        urlType: provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT',
+        // Explicit override wins; otherwise `{{param}}` placeholders → TEMPLATE
+        // so the backend templates them, else a fixed CONSTANT url.
+        urlType: provider.urlType
+            ?? (provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT'),
         method: method,
         responseMatches,
         responseRedactions,
         // The verification client re-supplies cookies/auth at runtime; secrets
         // are never persisted (propose_provider already stripped them).
-        credentials: 'include',
+        credentials: provider.credentials ?? 'include',
     };
     if (provider.body !== undefined) {
         requestData.bodySniff = { enabled: true, template: provider.body };
     }
-    // NOTE: `responseVariables` is intentionally omitted — the old backend
+    // NOTE: `responseVariables` is intentionally omitted — the devtools backend
     // auto-extracts it from `{{var}}` placeholders in responseMatches. Sending
     // it ourselves would risk drifting from the server's own extraction.
     return requestData;
 }
 /** One `requestData` entry per drafted provider. A multi-request provider
- *  becomes parallel entries that the old backend runs together at verification
- *  (the same way the builder version carries multiple `requests`). */
+ *  becomes parallel entries that the devtools backend runs together at
+ *  verification (the same way the builder version carries multiple
+ *  `requests`). */
 function requestDataFrom(providers) {
     return providers.map(requestDataFromProvider);
 }
 /** Translate fresh `allowedInjectedRequestData` drafts (the author's input
  *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
- *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  its own `allowedJsRequests`) into the devtools backend's shape. A
  *  carried-forward value read back from an existing version is ALREADY in
  *  this shape and should be passed straight through instead — don't run it
  *  through this a second time. */
@@ -165,6 +168,11 @@ export function providerToConfigBody(providers, opts, version, versionInfo) {
     if (opts.extensionConfig !== undefined) {
         providerConfig.extensionConfig = opts.extensionConfig;
     }
+    // The config (add-version) controller persists providerConfig verbatim,
+    // so this lands as-is; the register controller ignores it entirely.
+    if (opts.disableRequestReplay !== undefined) {
+        providerConfig.disableRequestReplay = opts.disableRequestReplay;
+    }
     return { providerConfig, version, versionInfo };
 }
 /**

package/lib/old/tools/publish.js

@@ -4,6 +4,12 @@ import { INJECTION_GUIDE } from "../../provider/injection-doc.js";
 import { countsFor, matchRedactionWarnings, } from "../../provider/match-redaction-warning.js";
 import { bumpPatchString, extractVersions, injectedRequestDataFrom, providerToConfigBody, providerToRegisterBody, } from "../to-register.js";
 const DEFAULT_VERSION_INFO = 'Updated from MCP browser capture';
+/** Pull the new provider's id out of a register response, tolerant of the
+ *  envelope (`{providerId}`, `{provider:{providerId}}`, `{id}`). */
+function extractProviderId(resp) {
+    const obj = resp;
+    return obj?.providerId ?? obj?.provider?.providerId ?? obj?.id;
+}
 /**
  * The old backend lets you add a version only to a provider YOU own. A
  * `providerId` for a public provider (or anyone else's) comes back as
@@ -44,7 +50,7 @@ function rethrowOwnershipError(err, providerId) {
 export function createVersionFromCaptureTool(client) {
     return defineTool({
         name: 'create_provider_version_from_capture',
-        description: 'Publish drafted ReclaimProvider(s) to the OLD devtools backend. ' +
+        description: 'Publish drafted ReclaimProvider(s) to the devtools backend. ' +
             'Pass the `provider` object from propose_provider VERBATIM and the ' +
             '`initialUrl` the user landed on (the login/landing page, NOT the ' +
             'API url). \n\n' +
@@ -62,7 +68,7 @@ export function createVersionFromCaptureTool(client) {
             "PUBLIC provider you don't own, omit `providerId` to register your " +
             'own copy (you cannot edit someone else\'s provider here). \n\n' +
             'For data gated behind login/navigation, pass `customInjection` — a ' +
-            'page-injection script (old-devtools\' name for the builder\'s ' +
+            'page-injection script (the devtools name for the builder\'s ' +
             'jsUserScripts) that drives the page to where the request fires. \n\n' +
             'BY DESIGN, this backend only ever CREATES A NEW VERSION (POST) — ' +
             'there is no partial-patch/edit endpoint, and this tool does NOT ' +
@@ -79,7 +85,14 @@ export function createVersionFromCaptureTool(client) {
             'values plus your change) back into this call. ' +
             '`allowedInjectedRequestData`/`useIncognitoWebview`/' +
             '`extensionConfig` only take effect on add-version — the register ' +
-            'endpoint (no `providerId`) ignores them. \n\n' +
+            'endpoint (no `providerId`) ignores them. `disableRequestReplay` ' +
+            'is also add-version-only, but when it is true the tool follows ' +
+            'a register up with an add-version call automatically so it takes ' +
+            'effect on new providers too. Per-request fields you may set on ' +
+            '`provider`/`providers`: `credentials` (omit/same-origin/include, ' +
+            'default include), `urlType` (REGEX/CONSTANT/TEMPLATE, default ' +
+            'derived from {{placeholders}}), and `isOptional` on each ' +
+            'responseMatch (default false). \n\n' +
             'Captured requests must be GET/POST. OPRF redactions are supported.',
         inputSchema: {
             type: 'object',
@@ -94,6 +107,19 @@ export function createVersionFromCaptureTool(client) {
                         method: { type: 'string' },
                         headers: { type: 'object' },
                         body: { type: 'string' },
+                        credentials: {
+                            type: 'string',
+                            enum: ['omit', 'same-origin', 'include'],
+                            description: 'How the verification client supplies cookies/auth ' +
+                                'when replaying this request. Default `include`.',
+                        },
+                        urlType: {
+                            type: 'string',
+                            enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+                            description: 'How the backend treats the URL. Default derived: ' +
+                                'TEMPLATE when the URL has {{placeholders}}, else ' +
+                                'CONSTANT.',
+                        },
                         responseMatches: { type: 'array' },
                         responseRedactions: { type: 'array' },
                         paramValues: { type: 'object' },
@@ -122,6 +148,14 @@ export function createVersionFromCaptureTool(client) {
                             method: { type: 'string' },
                             headers: { type: 'object' },
                             body: { type: 'string' },
+                            credentials: {
+                                type: 'string',
+                                enum: ['omit', 'same-origin', 'include'],
+                            },
+                            urlType: {
+                                type: 'string',
+                                enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+                            },
                             responseMatches: { type: 'array' },
                             responseRedactions: { type: 'array' },
                             paramValues: { type: 'object' },
@@ -202,6 +236,13 @@ export function createVersionFromCaptureTool(client) {
                         properties: {
                             url: { type: 'string' },
                             method: { type: 'string' },
+                            urlType: {
+                                type: 'string',
+                                enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+                                description: 'How the backend treats this URL. Default derived ' +
+                                    'from {{placeholders}} (TEMPLATE) like a normal ' +
+                                    'request entry.',
+                            },
                             body: {
                                 type: 'string',
                                 description: 'Becomes `bodySniff: { enabled: true, template: <this ' +
@@ -315,6 +356,14 @@ export function createVersionFromCaptureTool(client) {
                     description: 'Free-form JSON passed through to the client. Add-version ' +
                         'ONLY.',
                 },
+                disableRequestReplay: {
+                    type: 'boolean',
+                    description: 'Skip replaying the main document request (HAWKEYE ' +
+                        'provider-level flag). Honored on add-version; for a ' +
+                        'provider (no `providerId`) the register endpoint ignores ' +
+                        'it, so when true the tool automatically follows the ' +
+                        'register up with an add-version call that applies it.',
+                },
             },
             required: ['initialUrl'],
         },
@@ -348,6 +397,7 @@ export function createVersionFromCaptureTool(client) {
             stepsToFollow: args.stepsToFollow,
             useIncognitoWebview: args.useIncognitoWebview,
             extensionConfig: args.extensionConfig,
+            disableRequestReplay: args.disableRequestReplay,
             allowedInjectedRequestData: args.allowedInjectedRequestData
                 ? injectedRequestDataFrom(args.allowedInjectedRequestData)
                 : undefined
@@ -372,6 +422,11 @@ export function createVersionFromCaptureTool(client) {
                     'every page load (before navigating to initialUrl), matching ' +
                     'the builder\'s jsUserScripts.');
             }
+            // disableRequestReplay is honored ONLY on add-version, so a
+            // register can't set it — when true we immediately follow the
+            // register with an add-version call (which also lands any other
+            // register-ignored fields).
+            const followUp = args.disableRequestReplay === true;
             const REGISTER_IGNORED_KEYS = [
                 'allowedInjectedRequestData',
                 'useIncognitoWebview',
@@ -382,13 +437,36 @@ export function createVersionFromCaptureTool(client) {
             if (ignoredOnRegister.length) {
                 notes.push(`${ignoredOnRegister.join(', ')} ` +
                     `${ignoredOnRegister.length > 1 ? 'are' : 'is'} ` +
-                    'ignored on register (no providerId) — the old backend only ' +
-                    'reads them when adding a version. Publish once to create ' +
-                    'the provider, then call this again WITH the returned ' +
-                    'providerId to set them.');
+                    'ignored on register (no providerId) — the devtools backend only ' +
+                    'reads them when adding a version. ' +
+                    (followUp
+                        ? 'They were applied by the follow-up version the tool ' +
+                            'created to set disableRequestReplay.'
+                        : 'Publish once to create the provider, then call this ' +
+                            'again WITH the returned providerId to set them.'));
             }
             const body = providerToRegisterBody(providers, opts);
-            return withNotes(await client.registerProvider(body));
+            const registered = await client.registerProvider(body);
+            if (followUp) {
+                const newProviderId = extractProviderId(registered);
+                if (newProviderId) {
+                    const versionsResp = await client.listVersions(newProviderId);
+                    const followVersion = bumpPatchString(extractVersions(versionsResp));
+                    const configBody = providerToConfigBody(providers, { ...opts, disableRequestReplay: true }, followVersion, DEFAULT_VERSION_INFO);
+                    await client.updateProviderConfig(newProviderId, configBody);
+                    notes.push('disableRequestReplay is ignored by the register endpoint — ' +
+                        `applied it via a follow-up version (${followVersion}) on ` +
+                        'the new provider, which also lands any register-ignored ' +
+                        'fields you passed.');
+                }
+                else {
+                    notes.push('Could not apply disableRequestReplay: the register ' +
+                        'response did not include the new providerId. Call this ' +
+                        'tool again WITH `providerId` and `disableRequestReplay: ' +
+                        'true` to set it.');
+                }
+            }
+            return withNotes(registered);
         }
         // New version of an existing provider — pick the next patch above
         // the highest existing version. A provider you don't own (e.g. a

package/lib/provider/injection-doc.js

@@ -14,9 +14,10 @@
  * It also covers the HAWKEYE-style live-interception path (`injectionType` /
  * `interceptorType`, `disableRequestReplay` / `isDocumentRequestReplayEnabled`)
  * and `bodySniff`, reverse-engineered from the old-devtools Prisma schema,
- * controller code, and dashboard field hints — neither publish tool exposes
- * these as inputs (both only build the standard replay flow), so this is
- * read-the-field-and-recognize-it documentation, not authoring guidance.
+ * controller code, and dashboard field hints. The replay flag IS settable via
+ * the publish tools (`disableRequestReplay` on old-devtools — add-version or
+ * the register follow-up; `interceptorOptions` on the builder), so this is
+ * recognition + authoring guidance for the remaining internals.
  */
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';

package/lib/provider/schema.d.ts

@@ -11,6 +11,24 @@ export type HttpMethod = HttpParams['method'];
  * jsonPath/xPath belong on the redaction, not here.
  */
 export type ResponseMatch = HttpParams['responseMatches'][number];
+/**
+ * A response match as drafted for PUBLISH: the attestor's match plus
+ * `isOptional` — a backend-side matcher flag (both the old devtools backend
+ * and the builder store it; the attestor's own params have no such field, so
+ * `propose_provider` drafts never set it — only an explicit publish input
+ * does). Default false on both backends.
+ */
+export type DraftResponseMatch = ResponseMatch & {
+    isOptional?: boolean;
+};
+/** How the verification client supplies cookies/auth when replaying a
+ *  request. Both backends accept the same enum (old devtools on
+ *  `requestData`, builder on `RequestSelection`); default `include`. */
+export type WebCredentials = 'omit' | 'same-origin' | 'include';
+/** Old-devtools `urlType` for a requestData entry. The builder backend has
+ *  no such field (templating is implicit in the URL's `{{param}}`
+ *  placeholders), so the builder translator ignores it. */
+export type OldUrlType = 'REGEX' | 'CONSTANT' | 'TEMPLATE';
 /**
  * Selector telling the prover which portion of the response to reveal:
  * `xPath`/`jsonPath` narrows the slice, `regex` (with named groups) matches
@@ -59,8 +77,15 @@ export interface ReclaimProvider {
     method: HttpMethod;
     headers?: Record<string, string>;
     body?: string;
-    responseMatches: ResponseMatch[];
+    responseMatches: DraftResponseMatch[];
     responseRedactions?: ResponseRedaction[];
+    /** How the verification client supplies cookies/auth on replay. Both
+     *  backends default to `include` when unset. */
+    credentials?: WebCredentials;
+    /** Old-devtools-only url type override (`REGEX`/`CONSTANT`/`TEMPLATE`).
+     *  Auto-derived from `{{param}}` placeholders when unset; ignored by the
+     *  builder backend. */
+    urlType?: OldUrlType;
     /** Public param refs (templated into URL/body), populated by draft layer. */
     paramValues?: Record<string, string>;
     /** Redaction mode for the transcript (attestor default: 'key-update'). */

package/lib/provider/to-version.d.ts

@@ -1,6 +1,6 @@
 import type { ReclaimClient } from '@reclaimprotocol/client';
 import type { CreateProviderVersionRequest, ProviderVersionRef } from '@reclaimprotocol/client/openapi';
-import type { HttpMethod, ReclaimProvider, ResponseMatch, ResponseRedaction } from './schema.ts';
+import type { DraftResponseMatch, HttpMethod, OldUrlType, ReclaimProvider, ResponseRedaction, WebCredentials } from './schema.ts';
 /** One entry of the version's `requests[]` (a `RequestSelection`), derived
  *  from the openapi type so it can't drift from what the server accepts. */
 type RequestSelection = CreateProviderVersionRequest['requests'][number];
@@ -13,8 +13,15 @@ export interface DraftRequest {
     body?: string;
     writeRedactionMode?: ReclaimProvider['writeRedactionMode'];
     additionalClientOptions?: ReclaimProvider['additionalClientOptions'];
-    responseMatches?: ResponseMatch[];
+    responseMatches?: DraftResponseMatch[];
     responseRedactions?: ResponseRedaction[];
+    /** How the verification client supplies cookies/auth on replay. Default
+     *  `include` (both backends). */
+    credentials?: WebCredentials;
+    /** Old-devtools `urlType` override. Ignored by THIS translator (the
+     *  builder backend has no urlType) — read only by the old-devtools
+     *  translator (`old/to-register.ts`). */
+    urlType?: OldUrlType;
 }
 /** A request the page's injection script is allowed to fire, plus the
  *  pagination/optionality flags of `RequestSelectionTemplate`. Reuses the
@@ -47,6 +54,16 @@ export interface CreateVersionOptions {
     jsUserScripts?: string;
     /** Requests the injection script may fire, as `RequestSelectionTemplate`s. */
     allowedJsRequests?: AllowedJsRequest[];
+    /** In-app interception options, mapped verbatim to
+     *  `webSettings.clientOptions.inapp.interceptorOptions`. `interceptorType`
+     *  is required by the backend whenever the object is present.
+     *  `isDocumentRequestReplayEnabled` is the INVERSE of old-devtools'
+     *  `disableRequestReplay` (default false). */
+    interceptorOptions?: {
+        interceptorType: 'HAWKEYE' | 'MSWJS' | 'CDP';
+        isDocumentRequestReplayEnabled?: boolean;
+        interceptorSettings?: string;
+    };
 }
 /**
  * Derive the version's `requiredContext` JSON Schema from the