@reclaimprotocol/agent 0.1.17 → 0.1.20

package/lib/old/login-cdp.js

@@ -113,15 +113,14 @@ export async function captureFirebaseTokenViaCdp(opts) {
     const { targetId } = await Target.createTarget({ url: loginUrl });
     try {
         const session = await handles.attachToTab(targetId);
-        const { Runtime } = session;
         const deadline = Date.now() + timeoutMs;
         while (Date.now() < deadline) {
-            const r = await Runtime.evaluate({
+            const result = await session.send('Runtime.evaluate', {
                 expression: EXTRACT_TOKEN_JS,
                 awaitPromise: true,
                 returnByValue: true,
             });
-            const value = r.result?.value;
+            const value = runtimeResultValue(result);
             if (typeof value === 'string' && value.length > 0) {
                 return { token: value, closedBrowser: launchedByUs };
             }
@@ -146,3 +145,12 @@ export async function captureFirebaseTokenViaCdp(opts) {
         await handles.close().catch(() => { });
     }
 }
+function runtimeResultValue(value) {
+    if (typeof value !== 'object' || !value || !('result' in value)) {
+        return undefined;
+    }
+    const result = value.result;
+    return typeof result === 'object' && result && 'value' in result
+        ? result.value
+        : undefined;
+}

package/lib/old/to-register.d.ts

@@ -3,15 +3,15 @@ import type { AllowedJsRequest } from '../provider/to-version.ts';
 import type { RegisterProviderBody, UpdateProviderConfigBody } from './client.ts';
 /**
  * Translate a drafted `ReclaimProvider` (from `propose_provider`) into the
- * OLD devtools backend shapes. Deliberately a SEPARATE module from
+ * devtools backend shapes. Deliberately a SEPARATE module from
  * `provider/to-version.ts` (the builder translator) — the two backends have
  * structurally different bodies:
  *
  *   - builder NESTS each redaction into its match's `extract`;
- *   - old devtools keeps `responseMatches` and `responseRedactions` as
+ *   - devtools keeps `responseMatches` and `responseRedactions` as
  *     PARALLEL arrays on each `requestData` entry.
  *
- * Old-devtools limit we enforce here (a clear error beats a confusing
+ * Devtools limit we enforce here (a clear error beats a confusing
  * server-side 400): only `GET` / `POST` methods. OPRF redactions are passed
  * through unchanged — the backend's `hash` field accepts them.
  */
@@ -23,7 +23,7 @@ export interface OldProviderOpts {
     /** Defaults to `true` when omitted. Register only (Provider-level flag). */
     useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
-    /** Page-injection script — old-devtools' name for the builder's
+    /** Page-injection script — the devtools name for the builder's
      *  `webSettings.jsUserScripts`. Top-level on register, nested under
      *  `providerConfig` on config (add-version). The backend rejects a few
      *  deprecated injection APIs (e.g. `window.payloadData`) with a 400. */
@@ -50,6 +50,14 @@ export interface OldProviderOpts {
     /** Config (add-version) ONLY — the register endpoint never reads this
      *  field from the request body. Free-form JSON. */
     extensionConfig?: unknown;
+    /** Provider-level `disableRequestReplay` (HAWKEYE document replay skip).
+     *  Config (add-version) ONLY: the register endpoint hardcodes it to false
+     *  — the publish tool follows a register up with an add-version call to
+     *  apply it for new providers (see `old/tools/publish.ts`). NOTE the
+     *  builder backend has NO equivalent; its inverse is
+     *  `webSettings.clientOptions.inapp.interceptorOptions
+     *  .isDocumentRequestReplayEnabled`. */
+    disableRequestReplay?: boolean;
 }
 interface OldResponseMatch {
     value: string;
@@ -68,11 +76,11 @@ interface OldResponseRedaction {
 }
 interface OldRequestData {
     url: string;
-    urlType: 'CONSTANT' | 'TEMPLATE';
+    urlType: 'REGEX' | 'CONSTANT' | 'TEMPLATE';
     method: 'GET' | 'POST';
     responseMatches: OldResponseMatch[];
     responseRedactions: OldResponseRedaction[];
-    credentials: 'include';
+    credentials: 'omit' | 'same-origin' | 'include';
     bodySniff?: {
         enabled: boolean;
         template: string;
@@ -88,7 +96,7 @@ export interface OldInjectedRequestData extends OldRequestData {
 }
 /** Translate fresh `allowedInjectedRequestData` drafts (the author's input
  *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
- *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  its own `allowedJsRequests`) into the devtools backend's shape. A
  *  carried-forward value read back from an existing version is ALREADY in
  *  this shape and should be passed straight through instead — don't run it
  *  through this a second time. */
@@ -101,7 +109,7 @@ export declare function providerToRegisterBody(providers: ReclaimProvider[], opt
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
 export declare function providerToConfigBody(providers: ReclaimProvider[], opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
-/** Minimal version triplet as the old backend stores it. */
+/** Minimal version triplet as the devtools backend stores it. */
 export interface SemverTriplet {
     major: number;
     minor: number;

package/lib/old/to-register.js

@@ -1,5 +1,6 @@
+import assert from 'node:assert';
 /** Default web settings, mirroring the builder openapi defaults
- *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The old
+ *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The
  *  backend accepts both: `geoLocation` lives on the providerConfig, `useProxy`
  *  is a Provider-level flag (register only). */
 const DEFAULT_GEO_LOCATION = '{{DYNAMIC_GEO}}';
@@ -10,29 +11,29 @@ const DEFAULT_USE_PROXY = true;
  *  entries — a `ReclaimProvider` satisfies it structurally either way. */
 function requestDataFromProvider(provider) {
     const method = String(provider.method).toUpperCase();
-    if (method !== 'GET' && method !== 'POST') {
-        throw new Error('Old devtools supports only GET/POST requests; got ' +
-            `"${provider.method}". Re-capture against a GET/POST endpoint.`);
-    }
-    // The old backend has no dotted interpolation: consumer-supplied params
+    assert(method === 'GET' || method === 'POST', new Error('Devtools supports only GET/POST requests; got ' +
+        `"${provider.method}". Re-capture against a GET/POST endpoint.`));
+    // The devtools backend has no dotted interpolation: consumer-supplied params
     // must use the `{{context_<name>}}` form here, not the builder's
     // `{{context.<name>}}`. Catch the mix-up at publish with a clear error
     // instead of a template that silently never resolves.
     const dotted = `${provider.url}\n${provider.body ?? ''}`
         .match(/\{\{context\.[A-Za-z_][A-Za-z0-9_]*\}\}/);
-    if (dotted) {
-        throw new Error(`Old devtools does not support ${dotted[0]} — rename ` +
-            'consumer-supplied params to the {{context_<name>}} form ' +
-            'for this backend.');
-    }
+    assert(!dotted, new Error(`Devtools does not support ${dotted?.[0]} — rename ` +
+        'consumer-supplied params to the {{context_<name>}} form ' +
+        'for this backend.'));
     const responseMatches = (provider.responseMatches ?? [])
         .map((m, i) => ({
         value: m.value,
         type: m.type ?? 'contains',
-        isOptional: false,
+        // The backend honors isOptional on BOTH register and add-version
+        // (responseMatches pass through verbatim) — forward the author's
+        // flag, default false. (`invert` has no old-backend equivalent and
+        // stays dropped.)
+        isOptional: m.isOptional ?? false,
         order: i,
     }));
-    // Old devtools wants `responseMatches` and `responseRedactions` as PARALLEL
+    // Devtools wants `responseMatches` and `responseRedactions` as PARALLEL
     // arrays — same shape the builder uses, so pass them through directly. We do
     // NOT enforce any match/redaction count relationship here (and never pad —
     // empty placeholder matches break proof generation): the author keeps full
@@ -58,33 +59,35 @@ function requestDataFromProvider(provider) {
     });
     const requestData = {
         url: provider.url,
-        // `{{param}}` placeholders → TEMPLATE so the backend templates them;
-        // otherwise a fixed CONSTANT url. (REGEX is never drafted.)
-        urlType: provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT',
+        // Explicit override wins; otherwise `{{param}}` placeholders → TEMPLATE
+        // so the backend templates them, else a fixed CONSTANT url.
+        urlType: provider.urlType
+            ?? (provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT'),
         method: method,
         responseMatches,
         responseRedactions,
         // The verification client re-supplies cookies/auth at runtime; secrets
         // are never persisted (propose_provider already stripped them).
-        credentials: 'include',
+        credentials: provider.credentials ?? 'include',
     };
     if (provider.body !== undefined) {
         requestData.bodySniff = { enabled: true, template: provider.body };
     }
-    // NOTE: `responseVariables` is intentionally omitted — the old backend
+    // NOTE: `responseVariables` is intentionally omitted — the devtools backend
     // auto-extracts it from `{{var}}` placeholders in responseMatches. Sending
     // it ourselves would risk drifting from the server's own extraction.
     return requestData;
 }
 /** One `requestData` entry per drafted provider. A multi-request provider
- *  becomes parallel entries that the old backend runs together at verification
- *  (the same way the builder version carries multiple `requests`). */
+ *  becomes parallel entries that the devtools backend runs together at
+ *  verification (the same way the builder version carries multiple
+ *  `requests`). */
 function requestDataFrom(providers) {
     return providers.map(requestDataFromProvider);
 }
 /** Translate fresh `allowedInjectedRequestData` drafts (the author's input
  *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
- *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  its own `allowedJsRequests`) into the devtools backend's shape. A
  *  carried-forward value read back from an existing version is ALREADY in
  *  this shape and should be passed straight through instead — don't run it
  *  through this a second time. */
@@ -165,6 +168,11 @@ export function providerToConfigBody(providers, opts, version, versionInfo) {
     if (opts.extensionConfig !== undefined) {
         providerConfig.extensionConfig = opts.extensionConfig;
     }
+    // The config (add-version) controller persists providerConfig verbatim,
+    // so this lands as-is; the register controller ignores it entirely.
+    if (opts.disableRequestReplay !== undefined) {
+        providerConfig.disableRequestReplay = opts.disableRequestReplay;
+    }
     return { providerConfig, version, versionInfo };
 }
 /**

package/lib/old/tools/publish.js

@@ -4,6 +4,12 @@ import { INJECTION_GUIDE } from "../../provider/injection-doc.js";
 import { countsFor, matchRedactionWarnings, } from "../../provider/match-redaction-warning.js";
 import { bumpPatchString, extractVersions, injectedRequestDataFrom, providerToConfigBody, providerToRegisterBody, } from "../to-register.js";
 const DEFAULT_VERSION_INFO = 'Updated from MCP browser capture';
+/** Pull the new provider's id out of a register response, tolerant of the
+ *  envelope (`{providerId}`, `{provider:{providerId}}`, `{id}`). */
+function extractProviderId(resp) {
+    const obj = resp;
+    return obj?.providerId ?? obj?.provider?.providerId ?? obj?.id;
+}
 /**
  * The old backend lets you add a version only to a provider YOU own. A
  * `providerId` for a public provider (or anyone else's) comes back as
@@ -44,7 +50,7 @@ function rethrowOwnershipError(err, providerId) {
 export function createVersionFromCaptureTool(client) {
     return defineTool({
         name: 'create_provider_version_from_capture',
-        description: 'Publish drafted ReclaimProvider(s) to the OLD devtools backend. ' +
+        description: 'Publish drafted ReclaimProvider(s) to the devtools backend. ' +
             'Pass the `provider` object from propose_provider VERBATIM and the ' +
             '`initialUrl` the user landed on (the login/landing page, NOT the ' +
             'API url). \n\n' +
@@ -62,7 +68,7 @@ export function createVersionFromCaptureTool(client) {
             "PUBLIC provider you don't own, omit `providerId` to register your " +
             'own copy (you cannot edit someone else\'s provider here). \n\n' +
             'For data gated behind login/navigation, pass `customInjection` — a ' +
-            'page-injection script (old-devtools\' name for the builder\'s ' +
+            'page-injection script (the devtools name for the builder\'s ' +
             'jsUserScripts) that drives the page to where the request fires. \n\n' +
             'BY DESIGN, this backend only ever CREATES A NEW VERSION (POST) — ' +
             'there is no partial-patch/edit endpoint, and this tool does NOT ' +
@@ -79,7 +85,14 @@ export function createVersionFromCaptureTool(client) {
             'values plus your change) back into this call. ' +
             '`allowedInjectedRequestData`/`useIncognitoWebview`/' +
             '`extensionConfig` only take effect on add-version — the register ' +
-            'endpoint (no `providerId`) ignores them. \n\n' +
+            'endpoint (no `providerId`) ignores them. `disableRequestReplay` ' +
+            'is also add-version-only, but when it is true the tool follows ' +
+            'a register up with an add-version call automatically so it takes ' +
+            'effect on new providers too. Per-request fields you may set on ' +
+            '`provider`/`providers`: `credentials` (omit/same-origin/include, ' +
+            'default include), `urlType` (REGEX/CONSTANT/TEMPLATE, default ' +
+            'derived from {{placeholders}}), and `isOptional` on each ' +
+            'responseMatch (default false). \n\n' +
             'Captured requests must be GET/POST. OPRF redactions are supported.',
         inputSchema: {
             type: 'object',
@@ -94,6 +107,19 @@ export function createVersionFromCaptureTool(client) {
                         method: { type: 'string' },
                         headers: { type: 'object' },
                         body: { type: 'string' },
+                        credentials: {
+                            type: 'string',
+                            enum: ['omit', 'same-origin', 'include'],
+                            description: 'How the verification client supplies cookies/auth ' +
+                                'when replaying this request. Default `include`.',
+                        },
+                        urlType: {
+                            type: 'string',
+                            enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+                            description: 'How the backend treats the URL. Default derived: ' +
+                                'TEMPLATE when the URL has {{placeholders}}, else ' +
+                                'CONSTANT.',
+                        },
                         responseMatches: { type: 'array' },
                         responseRedactions: { type: 'array' },
                         paramValues: { type: 'object' },
@@ -122,6 +148,14 @@ export function createVersionFromCaptureTool(client) {
                             method: { type: 'string' },
                             headers: { type: 'object' },
                             body: { type: 'string' },
+                            credentials: {
+                                type: 'string',
+                                enum: ['omit', 'same-origin', 'include'],
+                            },
+                            urlType: {
+                                type: 'string',
+                                enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+                            },
                             responseMatches: { type: 'array' },
                             responseRedactions: { type: 'array' },
                             paramValues: { type: 'object' },
@@ -196,12 +230,41 @@ export function createVersionFromCaptureTool(client) {
                         'the whole payload), template just that part with ' +
                         '`{{paramName}}` and keep the rest as fixed literal text; see ' +
                         'the "bodySniff" section of the customInjection field\'s guide ' +
-                        'for the exact mechanics and a worked example.',
+                        'for the exact mechanics and a worked example. ' +
+                        '⚠️ BEFORE populating this to gate ' +
+                        '`verifyProof(proof, { providerId })`: this whole entry (url, ' +
+                        'method, body, responseMatches, responseRedactions) feeds a ' +
+                        'client-side hash-equality check, and `url` is hashed VERBATIM ' +
+                        '— no regex/template resolution, even with `urlType: REGEX` or ' +
+                        '`TEMPLATE`. If the real captured URL contains ANY per-session ' +
+                        'part (a tracking nonce, CSRF token, cache-busting timestamp), ' +
+                        'no declared spec can EVER hash-match a real proof, no matter ' +
+                        'how correct the rest of this entry is — populating' +
+                        'it for such ' +
+                        'a provider makes verifyProof reject every real proof,' +
+                        'which is ' +
+                        'worse than leaving this field empty. Diff the same endpoint\'s' +
+                        ' captured URL across two separate sessions before wiring this ' +
+                        'up. If provider-hash validation keeps causing problems ' +
+                        '(unstable url, or any other persistent mismatch), the ' +
+                        'fallback on the verifying side is `verifyProof(proof, { ' +
+                        'dangerouslyDisableContentValidation: true })` — trusts only ' +
+                        'the attestor\'s signature, skips the hash-equality check ' +
+                        'entirely; see the "Provider-hash validation" section of the ' +
+                        'customInjection field\'s guide for the full mechanics and ' +
+                        'when to reach for it.',
                     items: {
                         type: 'object',
                         properties: {
                             url: { type: 'string' },
                             method: { type: 'string' },
+                            urlType: {
+                                type: 'string',
+                                enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+                                description: 'How the backend treats this URL. Default derived ' +
+                                    'from {{placeholders}} (TEMPLATE) like a normal ' +
+                                    'request entry.',
+                            },
                             body: {
                                 type: 'string',
                                 description: 'Becomes `bodySniff: { enabled: true, template: <this ' +
@@ -315,6 +378,14 @@ export function createVersionFromCaptureTool(client) {
                     description: 'Free-form JSON passed through to the client. Add-version ' +
                         'ONLY.',
                 },
+                disableRequestReplay: {
+                    type: 'boolean',
+                    description: 'Skip replaying the main document request (HAWKEYE ' +
+                        'provider-level flag). Honored on add-version; for a ' +
+                        'provider (no `providerId`) the register endpoint ignores ' +
+                        'it, so when true the tool automatically follows the ' +
+                        'register up with an add-version call that applies it.',
+                },
             },
             required: ['initialUrl'],
         },
@@ -348,6 +419,7 @@ export function createVersionFromCaptureTool(client) {
             stepsToFollow: args.stepsToFollow,
             useIncognitoWebview: args.useIncognitoWebview,
             extensionConfig: args.extensionConfig,
+            disableRequestReplay: args.disableRequestReplay,
             allowedInjectedRequestData: args.allowedInjectedRequestData
                 ? injectedRequestDataFrom(args.allowedInjectedRequestData)
                 : undefined
@@ -372,6 +444,11 @@ export function createVersionFromCaptureTool(client) {
                     'every page load (before navigating to initialUrl), matching ' +
                     'the builder\'s jsUserScripts.');
             }
+            // disableRequestReplay is honored ONLY on add-version, so a
+            // register can't set it — when true we immediately follow the
+            // register with an add-version call (which also lands any other
+            // register-ignored fields).
+            const followUp = args.disableRequestReplay === true;
             const REGISTER_IGNORED_KEYS = [
                 'allowedInjectedRequestData',
                 'useIncognitoWebview',
@@ -382,13 +459,36 @@ export function createVersionFromCaptureTool(client) {
             if (ignoredOnRegister.length) {
                 notes.push(`${ignoredOnRegister.join(', ')} ` +
                     `${ignoredOnRegister.length > 1 ? 'are' : 'is'} ` +
-                    'ignored on register (no providerId) — the old backend only ' +
-                    'reads them when adding a version. Publish once to create ' +
-                    'the provider, then call this again WITH the returned ' +
-                    'providerId to set them.');
+                    'ignored on register (no providerId) — the devtools backend only ' +
+                    'reads them when adding a version. ' +
+                    (followUp
+                        ? 'They were applied by the follow-up version the tool ' +
+                            'created to set disableRequestReplay.'
+                        : 'Publish once to create the provider, then call this ' +
+                            'again WITH the returned providerId to set them.'));
             }
             const body = providerToRegisterBody(providers, opts);
-            return withNotes(await client.registerProvider(body));
+            const registered = await client.registerProvider(body);
+            if (followUp) {
+                const newProviderId = extractProviderId(registered);
+                if (newProviderId) {
+                    const versionsResp = await client.listVersions(newProviderId);
+                    const followVersion = bumpPatchString(extractVersions(versionsResp));
+                    const configBody = providerToConfigBody(providers, { ...opts, disableRequestReplay: true }, followVersion, DEFAULT_VERSION_INFO);
+                    await client.updateProviderConfig(newProviderId, configBody);
+                    notes.push('disableRequestReplay is ignored by the register endpoint — ' +
+                        `applied it via a follow-up version (${followVersion}) on ` +
+                        'the new provider, which also lands any register-ignored ' +
+                        'fields you passed.');
+                }
+                else {
+                    notes.push('Could not apply disableRequestReplay: the register ' +
+                        'response did not include the new providerId. Call this ' +
+                        'tool again WITH `providerId` and `disableRequestReplay: ' +
+                        'true` to set it.');
+                }
+            }
+            return withNotes(registered);
         }
         // New version of an existing provider — pick the next patch above
         // the highest existing version. A provider you don't own (e.g. a

package/lib/provider/draft.d.ts

@@ -37,4 +37,24 @@ export interface DraftResult {
  *  `{{param}}`. Throwing discards the draft so the agent re-captures or
  *  re-proposes rather than shipping a provider pinned to this one user. */
 export declare function assertPortableMatches(matches: ResponseMatch[], redactions: ResponseRedaction[], targets: DraftTarget[]): void;
+/** Reject a draft that OPRF-hashes a target whose value ALSO appears in the
+ *  request URL. The whole point of `hash` is that the attestor never sees
+ *  the value in cleartext — but URL `paramValues` are always signed into the
+ *  attestor's context in the clear (attestor-core: "those in URL... will be
+ *  put into context and signed"), so a value that's both hashed in the
+ *  response AND present in the URL is visible there anyway. This isn't a
+ *  privacy nuance the author can weigh (unlike {@link assertPortableMatches}
+ *  bare-literal cases) — it doesn't verify. Throwing here, at draft time,
+ *  surfaces that immediately instead of a confusing later proof failure. */
+export declare function assertNoOprfUrlConflict(url: string, targets: DraftTarget[], effectiveHashes: (OprfMode | undefined)[]): void;
+/** Reject a draft whose URL bakes in a secret header/cookie's value beyond
+ *  what write-redaction can actually hide there. A secret value used in the
+ *  URL is NOT an automatic leak — write-redaction (`key-update`/`zk`) can
+ *  redact it from the attestor's view up to {@link secretUrlCharBudget}
+ *  characters, summed across every secret value that appears in that URL
+ *  (not per-value). Below the budget the header buys real privacy; at or
+ *  over it, the value is effectively visible regardless of hiding the
+ *  header (same class of problem as {@link assertNoOprfUrlConflict} for
+ *  OPRF-hashed targets, which has no such budget at all). */
+export declare function assertNoSecretUrlConflict(url: string, secrets: Record<string, string>, writeRedactionMode?: ReclaimProvider['writeRedactionMode']): void;
 export declare function draftProvider(req: CapturedRequest, targets: DraftTarget[], name: string, hash?: OprfMode): DraftResult;

package/lib/provider/draft.js

@@ -1,5 +1,6 @@
 import { isOprfHashable, OPRF_MAX_BYTES, synthesizeMatcher } from "./matcher.js";
-import { splitSecrets } from "./secrets.js";
+import { normalizeCandidates } from "./normalize.js";
+import { secretUrlCharBudget, splitSecrets, stripTransportHeaders, } from "./secrets.js";
 /** OPRF mode for the auto-hash floor — TEE-native (attestor rejects oprf-raw,
  *  isn't set up for gnark oprf). */
 const DEFAULT_SENSITIVE_HASH = 'oprf-mpc';
@@ -29,49 +30,6 @@ export function defaultSensitiveHash(value) {
         && Buffer.byteLength(value, 'utf8') <= OPRF_MAX_BYTES;
     return hashable ? DEFAULT_SENSITIVE_HASH : undefined;
 }
-/** Request headers that must NOT survive into the provider params. Three kinds:
- *  - Conditional headers (`if-none-match`/`if-modified-since`/…): a captured
- *    cached ETag/date makes the origin answer 304/412 when the attestor
- *    re-issues, and the attestor treats non-2xx as failure. We always want the
- *    full fresh response.
- *  - Transfer headers the ATTESTOR sets itself (`connection: close`,
- *    `accept-encoding: identity`). Passing our own duplicates/collides with the
- *    request the attestor builds, so leave them out — the attestor already
- *    forces `identity` (uncompressed, so its byte-matching works).
- *  - Host / framing headers the TRANSPORT owns (`host`, `content-length`,
- *    `transfer-encoding`) and HTTP/2 pseudo-headers (`:authority`/`:method`/…,
- *    which CDP surfaces on h2 captures). The attestor derives `Host` from the
- *    URL and sets its own; a baked `Host` produces a DUPLICATE
- *    (`found: h,h`) that fails the receipt check / 400s the origin. A stale
- *    `content-length` breaks a re-serialized body. Pseudo-headers aren't valid
- *    real headers at all. */
-const STRIP_REQUEST_HEADERS = new Set([
-    'if-none-match',
-    'if-modified-since',
-    'if-match',
-    'if-unmodified-since',
-    'if-range',
-    'connection',
-    'accept-encoding',
-    'host',
-    'content-length',
-    'transfer-encoding',
-    // Per-session anti-CSRF tokens. Not caught by splitSecrets (no `-token`
-    // suffix), so without this they baked in as PUBLIC headers and went stale at
-    // verify time — the attestor replayed one user's captured CSRF for everyone,
-    // which the origin rejects. A CSRF token is never portable; drop it.
-    'csrf',
-    'x-csrf',
-    'xsrf',
-    'x-xsrf',
-    'x-csrf-token',
-    'xsrf-token',
-]);
-/** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
- *  `:scheme`) — never a valid request header the attestor can replay. */
-function isPseudoHeader(name) {
-    return name.startsWith(':');
-}
 /** A header VALUE that is a per-session/request token — a UUID or a long opaque
  *  hex/base64 blob. Such a value is captured-user-specific: baked into the
  *  provider it goes stale and the origin rejects the replay for everyone else.
@@ -84,15 +42,17 @@ function isVolatileHeaderValue(value) {
         || /^[0-9a-f]{16,}$/i.test(v)
         || /^[A-Za-z0-9_-]{32,}$/.test(v);
 }
-/** Drop the headers the attestor manages or that would 304 at proof time
- *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
- *  attestor's replay looks like the browser's request. */
+/** Drop a PUBLIC header whose value is per-session/request volatile (see
+ *  {@link isVolatileHeaderValue}) — public headers get frozen into the
+ *  persisted provider, so a volatile one goes stale and fails every other
+ *  user's replay. Secret headers are re-captured fresh per verification
+ *  (never persisted), so this doesn't apply to them; keep every other
+ *  captured public header so the attestor's replay looks like the browser's
+ *  request. */
 function sanitizeRequestHeaders(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
-        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase())
-            || isPseudoHeader(k)
-            || isVolatileHeaderValue(v)) {
+        if (isVolatileHeaderValue(v)) {
             continue;
         }
         out[k] = v;
@@ -167,6 +127,63 @@ export function assertPortableMatches(matches, redactions, targets) {
         }
     }
 }
+/** Reject a draft that OPRF-hashes a target whose value ALSO appears in the
+ *  request URL. The whole point of `hash` is that the attestor never sees
+ *  the value in cleartext — but URL `paramValues` are always signed into the
+ *  attestor's context in the clear (attestor-core: "those in URL... will be
+ *  put into context and signed"), so a value that's both hashed in the
+ *  response AND present in the URL is visible there anyway. This isn't a
+ *  privacy nuance the author can weigh (unlike {@link assertPortableMatches}
+ *  bare-literal cases) — it doesn't verify. Throwing here, at draft time,
+ *  surfaces that immediately instead of a confusing later proof failure. */
+export function assertNoOprfUrlConflict(url, targets, effectiveHashes) {
+    for (const [i, t] of targets.entries()) {
+        const hash = effectiveHashes[i];
+        if (!hash) {
+            continue;
+        }
+        const inUrl = [t.value, ...normalizeCandidates(t.value)]
+            .some((v) => url.includes(v));
+        if (inUrl) {
+            throw new Error(`target "${t.name}" is OPRF-hashed (${hash}) but its value also `
+                + `appears in the request URL ("${url}") — the attestor signs URL `
+                + 'param values into context in the clear, so it would see this '
+                + 'value regardless of the hash. Drop `hash` for this target, or '
+                + "capture a request whose URL doesn't carry the value.");
+        }
+    }
+}
+/** Reject a draft whose URL bakes in a secret header/cookie's value beyond
+ *  what write-redaction can actually hide there. A secret value used in the
+ *  URL is NOT an automatic leak — write-redaction (`key-update`/`zk`) can
+ *  redact it from the attestor's view up to {@link secretUrlCharBudget}
+ *  characters, summed across every secret value that appears in that URL
+ *  (not per-value). Below the budget the header buys real privacy; at or
+ *  over it, the value is effectively visible regardless of hiding the
+ *  header (same class of problem as {@link assertNoOprfUrlConflict} for
+ *  OPRF-hashed targets, which has no such budget at all). */
+export function assertNoSecretUrlConflict(url, secrets, writeRedactionMode) {
+    let redactedChars = 0;
+    const overlapping = [];
+    for (const [name, value] of Object.entries(secrets)) {
+        const inUrl = [value, ...normalizeCandidates(value)]
+            .some((v) => url.includes(v));
+        if (inUrl) {
+            redactedChars += value.length;
+            overlapping.push(name);
+        }
+    }
+    const budget = secretUrlCharBudget(writeRedactionMode);
+    if (redactedChars > budget) {
+        throw new Error(`secret header(s) ${overlapping.map((n) => `"${n}"`).join(', ')} `
+            + `also appear in the request URL ("${url}"), totaling `
+            + `${redactedChars} character(s) to hide — over the ${budget}-`
+            + `character budget write-redaction (${writeRedactionMode
+                ?? 'key-update'}) can actually hide there. Drop the header, `
+            + "shorten/remove the value's overlap with the URL, or switch to "
+            + "'zk' if that raises the budget enough.");
+    }
+}
 /** Derive a `paramValues` key (and capture-group name) from the provider
  *  name's last alphanumeric token. `"GitHub Username"` → `"username"`,
  *  `"x-followers"` → `"followers"`. */
@@ -188,6 +205,7 @@ export function draftProvider(req, targets, name, hash) {
     const matches = [];
     const redactions = [];
     const extractions = [];
+    const effectiveHashes = [];
     let paramValues;
     const seenParams = new Set();
     for (const t of targets) {
@@ -202,6 +220,7 @@ export function draftProvider(req, targets, name, hash) {
         // The model makes the contextual calls (which named fields are sensitive)
         // via an explicit per-target hash; this floor only guarantees the obvious.
         const effectiveHash = t.hash ?? hash ?? defaultSensitiveHash(t.value);
+        effectiveHashes.push(effectiveHash);
         const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, effectiveHash);
         if (!synthesis) {
             throw new Error(`target value "${t.value}" not found in`
@@ -222,7 +241,12 @@ export function draftProvider(req, targets, name, hash) {
     }
     // Portability gate: never ship a draft that bakes a per-user value literally.
     assertPortableMatches(matches, redactions, targets);
-    const { secrets, publics } = splitSecrets(req.requestHeaders);
+    // OPRF gate: never ship a draft that hashes a value the URL also reveals.
+    assertNoOprfUrlConflict(req.url, targets, effectiveHashes);
+    const { secrets, publics } = splitSecrets(stripTransportHeaders(req.requestHeaders));
+    // Secret-header gate: never ship a draft whose URL reveals the same value a
+    // stripped secret header carries — hiding the header buys nothing then.
+    assertNoSecretUrlConflict(req.url, secrets);
     // Sanitize the public headers before they enter the provider. Two problems
     // a captured browser request carries: (1) `accept-encoding: gzip, …`, which
     // makes the attestor match against compressed bytes (it does no transparent

package/lib/provider/index.d.ts

@@ -3,7 +3,7 @@ export type { DraftResult } from './draft.ts';
 export { detectConcerns } from './constraints.ts';
 export { extractGraphqlOp, looksLikeGraphqlEndpoint } from './graphql.ts';
 export type { CapturedRequest, HttpMethod, OprfMode, ReclaimProvider, RequestConcern, ResponseMatch, ResponseRedaction, SecretParamRef, } from './schema.ts';
-export { classifyHeader, splitSecrets } from './secrets.ts';
+export { assertSecretParamValuesFitUrlBudget, classifyHeader, classifyParamName, secretUrlCharBudget, splitSecretParamValues, splitSecrets, stripTransportHeaders, } from './secrets.ts';
 export { providerToRequestSelection } from './to-version.ts';
 export { hashProviderParams, providers } from '@reclaimprotocol/attestor-core';
 export type { ProviderParams } from '@reclaimprotocol/attestor-core';

package/lib/provider/index.js

@@ -6,7 +6,7 @@
 export { draftProvider } from "./draft.js";
 export { detectConcerns } from "./constraints.js";
 export { extractGraphqlOp, looksLikeGraphqlEndpoint } from "./graphql.js";
-export { classifyHeader, splitSecrets } from "./secrets.js";
+export { assertSecretParamValuesFitUrlBudget, classifyHeader, classifyParamName, secretUrlCharBudget, splitSecretParamValues, splitSecrets, stripTransportHeaders, } from "./secrets.js";
 // Recipe → version `requests[]` (a `RequestSelection`) — the same mapping the
 // MCP publish uses, so the cloud authoring publish stays byte-identical.
 export { providerToRequestSelection } from "./to-version.js";