@reclaimprotocol/agent 0.1.20 → 0.1.22

package/lib/mcp/remap_errors.js

@@ -12,9 +12,10 @@ export const remapErrorAsResponse = (err) => {
             content: [{ type: 'text', text }],
         };
     }
+    const data = err.data;
     return {
         isError: true,
-        structuredContent: err.data,
+        ...(data ? { structuredContent: data } : {}),
         content: [{ type: 'text', text }],
     };
 };

package/lib/mcp/start.js

@@ -10,7 +10,7 @@ import { ReclaimSdkClient } from "../old/sdk-client.js";
 import { buildOldBackendTools } from "../old/tools/build.js";
 import { NAME, VERSION } from "../pkg.js";
 import { registerTools } from "./api/tools.js";
-import { buildAgentTools, buildBuilderAuthenticationTools, buildBuilderOrganizationTools, buildCredentialTools, buildLocalCredentialTools, buildModeTools, buildVerificationTools, readSession, } from "./tools/index.js";
+import { buildAgentState, buildAgentTools, buildBuilderAuthenticationTools, buildBuilderOrganizationTools, buildCredentialTools, buildLocalCredentialTools, buildModeTools, buildVerificationTools, readSession, } from "./tools/index.js";
 import { BUILDER_MODE_INSTRUCTIONS } from "./instructions.js";
 import { registerToolList } from "./server.js";
 export async function startMcpServer() {
@@ -49,13 +49,16 @@ export async function startMcpServer() {
             identity: resolveInitialIdentity(),
         });
         const sdkClient = new ReclaimSdkClient({ baseUrl: sdkApiUrl() });
+        // Shared with buildAgentTools below so the old-mode publish tool can see
+        // the live attach state (e.g. to flag a still-open browser session).
+        const agentState = buildAgentState();
         registerToolList(server, buildBuilderAuthenticationTools(builderClient));
         registerToolList(server, buildBuilderOrganizationTools(builderClient));
         registerToolList(server, buildLocalCredentialTools());
-        registerToolList(server, buildOldBackendTools(oldClient, sdkClient));
+        registerToolList(server, buildOldBackendTools(oldClient, sdkClient, agentState.attach));
         if (agentToolsEnabled) {
             // No builder client → no builder publish tool (old mode has its own).
-            registerToolList(server, buildAgentTools(undefined, builderClient));
+            registerToolList(server, buildAgentTools(undefined, builderClient, agentState));
         }
         // NOTE: registerTools() is intentionally NOT called — generated tools off.
     }

package/lib/mcp/tools/agent/attach.js

@@ -18,6 +18,11 @@ export function attachTool(state, builderClient, name = 'attach_browser', before
                 + 'port), builder (quota-accounted Popcorn browser with a '
                 + 'shareable live view), or custom (caller-supplied CDP '
                 + 'websocket). '
+                + 'For builder mode, orgId may be omitted: it auto-resolves to '
+                + 'the account\'s only organization, or — if there is more '
+                + 'than one — returns needsChoice with the full list so the '
+                + 'caller can ask the developer which to use and re-call with '
+                + 'that orgId. '
                 + 'Builder and custom CDP credentials are held in memory and never '
                 + 'returned.',
         inputSchema: {
@@ -52,7 +57,30 @@ export function attachTool(state, builderClient, name = 'attach_browser', before
                 configPath: defaultConfigPath(),
             };
         }
-        const next = await connect(mode, parsed, persisted, builderClient, dependencies);
+        let orgId = parsed.orgId;
+        if (mode === 'builder' && !orgId) {
+            assert(builderClient, badRequest('Builder browser service is unavailable'));
+            const { data } = await builderClient.call('ListOrgs', { query: {} });
+            const orgs = data.items ?? [];
+            assert(orgs.length, badRequest('No organizations available for this account — create one '
+                + 'first, or authenticate as a user who belongs to one.'));
+            if (orgs.length > 1) {
+                return {
+                    needsChoice: true,
+                    message: 'This account belongs to more than one organization. Ask '
+                        + 'the developer which one to use, then re-call '
+                        + 'attach_browser with mode "builder" and that orgId.',
+                    organizations: orgs.map((o) => ({
+                        id: o.id,
+                        name: o.name,
+                        kind: o.kind,
+                        status: o.status,
+                    })),
+                };
+            }
+            orgId = orgs[0].id;
+        }
+        const next = await connect(mode, { ...parsed, orgId }, persisted, builderClient, dependencies);
         try {
             await beforeReplace?.();
             await disposeAttached(state);

package/lib/mcp/tools/agent/build.d.ts

@@ -21,9 +21,16 @@ export interface AgentState {
     };
     captures: CaptureStore;
 }
+/** Exported so a mode (e.g. old-devtools) that supplies its own publish tool
+ *  can build the attach/capture state up front and share the SAME instance
+ *  with `buildAgentTools` — letting that publish tool see the live attach
+ *  state (e.g. to remind the caller about a still-open browser session). */
+export declare function buildAgentState(): AgentState;
 /** Build the flat list of `RegisteredTool` entries, ready for
  *  `registerToolList`.
  *  Pass `client` to include the builder `create_provider_version_from_capture`;
  *  omit it (e.g. OLD-devtools mode) to register only the backend-independent
- *  capture/proof tools — old mode supplies its own publish tool. */
-export declare function buildAgentTools(client?: ReclaimClient, builderClient?: ReclaimClient | undefined): RegisteredTool[];
+ *  capture/proof tools — old mode supplies its own publish tool.
+ *  Pass `externalState` to share attach/capture state with tools registered
+ *  elsewhere (e.g. old mode's publish tool) instead of building a fresh one. */
+export declare function buildAgentTools(client?: ReclaimClient, builderClient?: ReclaimClient | undefined, externalState?: AgentState): RegisteredTool[];

package/lib/mcp/tools/agent/build.js

@@ -19,7 +19,11 @@ import { howItWorksTool } from "./how-it-works.js";
 import { createVersionFromCaptureTool } from "./publish.js";
 import { sessionTools } from "./session.js";
 import { sharedAuthoringTools } from "./shared.js";
-function buildAgentState() {
+/** Exported so a mode (e.g. old-devtools) that supplies its own publish tool
+ *  can build the attach/capture state up front and share the SAME instance
+ *  with `buildAgentTools` — letting that publish tool see the live attach
+ *  state (e.g. to remind the caller about a still-open browser session). */
+export function buildAgentState() {
     return {
         attach: { config: new ConfigStore() },
         captures: { sessions: new Map() },
@@ -29,9 +33,11 @@ function buildAgentState() {
  *  `registerToolList`.
  *  Pass `client` to include the builder `create_provider_version_from_capture`;
  *  omit it (e.g. OLD-devtools mode) to register only the backend-independent
- *  capture/proof tools — old mode supplies its own publish tool. */
-export function buildAgentTools(client, builderClient = client) {
-    const state = buildAgentState();
+ *  capture/proof tools — old mode supplies its own publish tool.
+ *  Pass `externalState` to share attach/capture state with tools registered
+ *  elsewhere (e.g. old mode's publish tool) instead of building a fresh one. */
+export function buildAgentTools(client, builderClient = client, externalState) {
+    const state = externalState ?? buildAgentState();
     ensureAttestorCrypto();
     const tools = [];
     // Stateless docs tool — serve the mode-specific authoring guide to any
@@ -55,7 +61,7 @@ export function buildAgentTools(client, builderClient = client) {
         tools.push(t);
     }
     if (client) {
-        tools.push(createVersionFromCaptureTool(client));
+        tools.push(createVersionFromCaptureTool(client, state.attach));
     }
     return tools;
 }

package/lib/mcp/tools/agent/index.d.ts

@@ -1,2 +1,2 @@
-export { buildAgentTools } from './build.ts';
+export { buildAgentState, buildAgentTools } from './build.ts';
 export type { AgentState } from './build.ts';

package/lib/mcp/tools/agent/index.js

@@ -1,3 +1,3 @@
 // Barrel for the agent tool group (Chrome CDP capture, provider synthesis,
 // replay, zkTLS proof). Import from here, not the individual files.
-export { buildAgentTools } from "./build.js";
+export { buildAgentState, buildAgentTools } from "./build.js";

package/lib/mcp/tools/agent/publish.d.ts

@@ -1,3 +1,6 @@
 import type { ReclaimClient } from '@reclaimprotocol/client';
 import { type RegisteredTool } from '../../server.ts';
-export declare function createVersionFromCaptureTool(client: ReclaimClient): RegisteredTool;
+import type { AttachState } from './attach.ts';
+export declare function createVersionFromCaptureTool(client: ReclaimClient, attachRef?: {
+    current?: AttachState;
+}): RegisteredTool;

package/lib/mcp/tools/agent/publish.js

@@ -97,7 +97,7 @@ const ALLOWED_JS_REQUEST_SCHEMA = {
     },
     required: ['url', 'method'],
 };
-export function createVersionFromCaptureTool(client) {
+export function createVersionFromCaptureTool(client, attachRef) {
     return defineTool({
         name: 'create_provider_version_from_capture',
         description: 'Persist drafted ReclaimProvider(s) as a provider version. ' +
@@ -125,7 +125,11 @@ export function createVersionFromCaptureTool(client) {
             'sessions (verification matches those values exactly; a missing ' +
             'field is a 400 at session create). ' +
             'Refine types/descriptions via `update_provider_version` while ' +
-            'still on draft.',
+            'still on draft. ' +
+            'On success, if a browser is still attached, the response\'s ' +
+            '`_notes` reminds you to confirm with the developer before ' +
+            'calling `dispose_browser` — never close it unprompted, they ' +
+            'may want it for further edits.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -261,6 +265,20 @@ export function createVersionFromCaptureTool(client) {
             ...(args.allowedJsRequests ?? []).map((r, i) => countsFor(`Injected request ${i + 1}`, r)),
         ];
         notes.push(...matchRedactionWarnings(requestCounts));
+        // A browser session left attached after a successful publish is easy
+        // to forget about — surface it so the caller asks the developer
+        // before closing it (a builder-mode session is quota-accounted and
+        // otherwise just sits until its TTL expires).
+        const attached = attachRef?.current;
+        if (attached) {
+            notes.push(`A "${attached.mode}" browser session is still attached` +
+                (attached.browserSessionId
+                    ? ` (browserSessionId: ${attached.browserSessionId})`
+                    : '') +
+                '. Ask the developer whether they want to keep it open for ' +
+                'further edits — only call dispose_browser once they confirm ' +
+                'they\'re done with it.');
+        }
         // Let the dev know how/when the script runs (and the window.Reclaim gap).
         if (args.jsUserScripts?.trim()) {
             notes.push('jsUserScripts will run in the Builder verification client before ' +

package/lib/mcp/tools/authenticate/authenticate.js

@@ -170,8 +170,9 @@ async function exchangeCode(authBase, opts) {
             client_id: opts.clientId,
         }).toString(),
     });
-    assert(res.ok, new Error(`Token exchange failed (${res.status}): ${await res.text()}`));
-    const json = (await res.json());
+    const body = await res.text();
+    assert(res.ok, new Error(`Token exchange failed (${res.status}): ${body}`));
+    const json = JSON.parse(body);
     assert(json.access_token, new Error('Token exchange returned no access_token.'));
     return {
         access_token: json.access_token,

package/lib/old/tools/build.d.ts

@@ -1,4 +1,5 @@
 import type { RegisteredTool } from '../../mcp/server.ts';
+import type { AttachState } from '../../mcp/tools/agent/attach.ts';
 import type { ReclaimOldClient } from '../client.ts';
 import type { ReclaimSdkClient } from '../sdk-client.ts';
 /**
@@ -10,5 +11,11 @@ import type { ReclaimSdkClient } from '../sdk-client.ts';
  * `sdkClient` is a SEPARATE, unauthenticated client for the public
  * production SDK backend (`api.reclaimprotocol.org`) — a different host from
  * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
+ *
+ * `attachRef` is the SAME attach state `buildAgentTools` was given (see
+ * `mcp/start.ts`) — passing it lets the publish tool remind the caller about
+ * a still-open browser session after a successful publish.
  */
-export declare function buildOldBackendTools(client: ReclaimOldClient, sdkClient: ReclaimSdkClient): RegisteredTool[];
+export declare function buildOldBackendTools(client: ReclaimOldClient, sdkClient: ReclaimSdkClient, attachRef?: {
+    current?: AttachState;
+}): RegisteredTool[];

package/lib/old/tools/build.js

@@ -19,11 +19,15 @@ import { verifySdkSetupTool } from "./verify-sdk-setup.js";
  * `sdkClient` is a SEPARATE, unauthenticated client for the public
  * production SDK backend (`api.reclaimprotocol.org`) — a different host from
  * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
+ *
+ * `attachRef` is the SAME attach state `buildAgentTools` was given (see
+ * `mcp/start.ts`) — passing it lets the publish tool remind the caller about
+ * a still-open browser session after a successful publish.
  */
-export function buildOldBackendTools(client, sdkClient) {
+export function buildOldBackendTools(client, sdkClient, attachRef) {
     return [
         authenticateTool(client),
-        createVersionFromCaptureTool(client),
+        createVersionFromCaptureTool(client, attachRef),
         getMeProvidersTool(client),
         getProviderInfoTool(sdkClient),
         updateProviderMetadataTool(client),

package/lib/old/tools/publish.d.ts

@@ -1,4 +1,5 @@
 import { type RegisteredTool } from '../../mcp/server.ts';
+import type { AttachState } from '../../mcp/tools/agent/attach.ts';
 import type { ReclaimOldClient } from '../client.ts';
 /**
  * Publish a drafted provider to the OLD devtools backend. Keeps the builder
@@ -12,5 +13,13 @@ import type { ReclaimOldClient } from '../client.ts';
  *     highest existing version).
  *
  * Get a `providerId` from `get_me_providers`.
+ *
+ * `attachRef`, when given, is checked after a successful publish: if a
+ * browser is still attached, a `_notes` entry reminds the caller to confirm
+ * with the developer before closing it (see `dispose_browser`) rather than
+ * closing it unprompted — the developer may still want the session for
+ * further edits.
  */
-export declare function createVersionFromCaptureTool(client: ReclaimOldClient): RegisteredTool;
+export declare function createVersionFromCaptureTool(client: ReclaimOldClient, attachRef?: {
+    current?: AttachState;
+}): RegisteredTool;

package/lib/old/tools/publish.js

@@ -46,8 +46,14 @@ function rethrowOwnershipError(err, providerId) {
  *     highest existing version).
  *
  * Get a `providerId` from `get_me_providers`.
+ *
+ * `attachRef`, when given, is checked after a successful publish: if a
+ * browser is still attached, a `_notes` entry reminds the caller to confirm
+ * with the developer before closing it (see `dispose_browser`) rather than
+ * closing it unprompted — the developer may still want the session for
+ * further edits.
  */
-export function createVersionFromCaptureTool(client) {
+export function createVersionFromCaptureTool(client, attachRef) {
     return defineTool({
         name: 'create_provider_version_from_capture',
         description: 'Publish drafted ReclaimProvider(s) to the devtools backend. ' +
@@ -93,7 +99,11 @@ export function createVersionFromCaptureTool(client) {
             'default include), `urlType` (REGEX/CONSTANT/TEMPLATE, default ' +
             'derived from {{placeholders}}), and `isOptional` on each ' +
             'responseMatch (default false). \n\n' +
-            'Captured requests must be GET/POST. OPRF redactions are supported.',
+            'Captured requests must be GET/POST. OPRF redactions are supported. ' +
+            'On success, if a browser is still attached, the response\'s ' +
+            '`_notes` reminds you to confirm with the developer before ' +
+            'calling `dispose_browser` — never close it unprompted, they ' +
+            'may want it for further edits.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -427,6 +437,20 @@ export function createVersionFromCaptureTool(client) {
         // Non-blocking advisory per request — never alters or blocks the
         // publish; the author keeps full control. Attaches under `_notes`.
         const notes = matchRedactionWarnings(providers.map((p, i) => countsFor(`Request ${i + 1}`, p)));
+        // A browser session left attached after a successful publish is
+        // easy to forget about — surface it so the caller asks the
+        // developer before closing it (a builder-mode session is
+        // quota-accounted and otherwise just sits until its TTL expires).
+        const attached = attachRef?.current;
+        if (attached) {
+            notes.push(`A "${attached.mode}" browser session is still attached` +
+                (attached.browserSessionId
+                    ? ` (browserSessionId: ${attached.browserSessionId})`
+                    : '') +
+                '. Ask the developer whether they want to keep it open for ' +
+                'further edits — only call dispose_browser once they confirm ' +
+                'they\'re done with it.');
+        }
         const withNotes = (result) => {
             if (notes.length && result && typeof result === 'object') {
                 return { ...result, _notes: notes };

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.20",
+	"version": "0.1.22",
 	"description": "Reclaim Protocol's tools for agents — Reclaim Protocol lets your app verify **data points** about its users — a follower count, an account balance, an order history. This package gives your AI coding agent the tools to **find, build, test and fix the _data verification providers_** (the recipes that verify a data point) by inspecting and replaying captured requests, checking sessions, evaluate proofs, publishing updates, and much more.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -83,7 +83,7 @@
 		"@modelcontextprotocol/sdk": "^1.29.0",
 		"@noble/hashes": "^2.2.0",
 		"@reclaimprotocol/attestor-core": "^5.0.8",
-		"@reclaimprotocol/client": "0.1.20",
+		"@reclaimprotocol/client": "0.1.22",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/skill/SKILL.builder.md

@@ -173,6 +173,10 @@ The value of any parameter marked secret is not included in the final proof, omi
 
     When done, tell the developer the version is live (PRIVATE) or submitted for review (PUBLIC), and that they can integrate using the `providerId`.
 
+    - **If a browser is still attached**, `create_provider_version_from_capture`'s response carries a `_notes` reminder about it. Surface that to the dev and ask whether they want to keep the session open for further edits — only call `dispose_browser` once they confirm they're done. Never close it unprompted; a `builder`-mode session is quota-accounted, but the dev may still be mid-workflow. Closing remote browsers
+    soon is also important to avoid wasting resources. So as best
+    practise, close remote browser session when not needed anymore.
+
 <!-- common: concerns-section -->
 
 ## Things to never do

package/skill/SKILL.common.md

@@ -17,8 +17,8 @@ You drive the browser through the capture → draft → replay → prove loop us
 1. **Attach.** Call `attach_browser`. If it returns `needsChoice: true`, ask the dev which browser source they want:
    - `dedicated` — agent auto-launches Chrome with a dedicated profile under `~/.reclaim/chrome-profile`. Easiest local path; works out of the box.
    - `attach` — connect to a Chrome the dev is already running. **Important Chrome 136+ gotcha:** the dev's Chrome must be launched with BOTH `--remote-debugging-port=9222` AND `--user-data-dir=<some-non-default-path>`. Since Chrome 136 (May 2025), the debug-port flag is silently ignored when the default user profile is in use. If `attach` fails, tell them this verbatim and offer to switch to `dedicated`.
-   - `builder` — allocate a quota-accounted remote Popcorn browser. Obtain an `orgId` with `list_builder_organizations` in old-devtools mode or the generated `list_orgs` tool in Builder mode. If Builder answers 401, authenticate with `authenticate_builder` in old-devtools mode or the existing `authenticate` flow in Builder mode, then retry. Return the `liveViewUrl` to the dev so they can share it with the volunteer operating the browser. This works in both publishing modes and consumes one VERIFICATION-pool use under the chosen organization's normal plan restrictions.
-   - `custom` — connect to a `ws://` or `wss://` CDP URL supplied by the dev. The URL is a credential: never repeat it, log it, or persist it. An optional `liveViewUrl` may be returned and shared.
+   - `builder` — allocate a quota-accounted remote Popcorn browser. If Builder answers 401, authenticate with `authenticate_builder` in old-devtools mode or the existing `authenticate` flow in Builder mode, then retry. You can omit `orgId` and call `attach_browser` directly: it auto-resolves to the account's only organization, or — if the account belongs to more than one — comes back with `needsChoice: true` and an `organizations` list; **ask the dev which one to use** (don't guess or default to the first) and re-call `attach_browser` with that `orgId`. (`list_builder_organizations` in old-devtools mode / `list_orgs` in Builder mode still work directly if you want the list up front instead.) Return the FULL `liveViewUrl` to the dev verbatim — on its own line, never abbreviated, elided, or wrapped in prose that truncates it — so it stays one clean, copy-pasteable string; they'll share it with the volunteer operating the browser. This works in both publishing modes and consumes one VERIFICATION-pool use under the chosen organization's normal plan restrictions.
+   - `custom` — connect to a `ws://` or `wss://` CDP URL supplied by the dev. The URL is a credential: never repeat it, log it, or persist it. An optional `liveViewUrl` may be returned — if so, share it FULL and verbatim, same as `builder` above.
 
    Re-call with the chosen `mode` and its required fields.
 

package/skill/SKILL.old.md

@@ -141,6 +141,8 @@ A secret value CAN be used in the URL, geoLocation, request body, response match
 
     When done, tell the developer the version is live (PRIVATE) or submitted for review (PUBLIC), and that they can integrate using the `providerId`.
 
+    - **If a browser is still attached**, `create_provider_version_from_capture`'s response carries a `_notes` reminder about it. Surface that to the dev and ask whether they want to keep the session open for further edits — only call `dispose_browser` once they confirm they're done. Never close it unprompted; a `builder`-mode session is quota-accounted, but the dev may still be mid-workflow.
+
 <!-- common: concerns-section -->
 
 ## Things to never do

package/src/mcp/remap_errors.ts

@@ -20,9 +20,10 @@ export const remapErrorAsResponse = (
 		}
 	}
 
+	const data = (err as Boom<ProblemDetails>).data
 	return {
 		isError: true as const,
-		structuredContent: (err as Boom<ProblemDetails>).data,
+		...(data ? { structuredContent: data } : {}),
 		content: [{ type: 'text' as const, text }],
 	}
 }

package/src/mcp/start.ts

@@ -19,6 +19,7 @@ import { buildOldBackendTools } from '../old/tools/build.ts'
 import { NAME, VERSION } from '../pkg.ts'
 import { registerTools } from './api/tools.ts'
 import {
+	buildAgentState,
 	buildAgentTools,
 	buildBuilderAuthenticationTools,
 	buildBuilderOrganizationTools,
@@ -73,14 +74,23 @@ export async function startMcpServer() {
 			identity: resolveInitialIdentity(),
 		})
 		const sdkClient = new ReclaimSdkClient({ baseUrl: sdkApiUrl() })
+		// Shared with buildAgentTools below so the old-mode publish tool can see
+		// the live attach state (e.g. to flag a still-open browser session).
+		const agentState = buildAgentState()
 
 		registerToolList(server, buildBuilderAuthenticationTools(builderClient))
 		registerToolList(server, buildBuilderOrganizationTools(builderClient))
 		registerToolList(server, buildLocalCredentialTools())
-		registerToolList(server, buildOldBackendTools(oldClient, sdkClient))
+		registerToolList(
+			server,
+			buildOldBackendTools(oldClient, sdkClient, agentState.attach),
+		)
 		if(agentToolsEnabled) {
 			// No builder client → no builder publish tool (old mode has its own).
-			registerToolList(server, buildAgentTools(undefined, builderClient))
+			registerToolList(
+				server,
+				buildAgentTools(undefined, builderClient, agentState),
+			)
 		}
 		// NOTE: registerTools() is intentionally NOT called — generated tools off.
 	} else {

package/src/mcp/tools/agent/attach.ts

@@ -70,6 +70,11 @@ export function attachTool(
 						+ 'port), builder (quota-accounted Popcorn browser with a '
 						+ 'shareable live view), or custom (caller-supplied CDP '
 						+ 'websocket). '
+						+ 'For builder mode, orgId may be omitted: it auto-resolves to '
+						+ 'the account\'s only organization, or — if there is more '
+						+ 'than one — returns needsChoice with the full list so the '
+						+ 'caller can ask the developer which to use and re-call with '
+						+ 'that orgId. '
 						+ 'Builder and custom CDP credentials are held in memory and never '
 						+ 'returned.',
 			inputSchema: {
@@ -107,8 +112,42 @@ export function attachTool(
 				}
 			}
 
+			let orgId = parsed.orgId
+			if(mode === 'builder' && !orgId) {
+				assert(
+					builderClient,
+					badRequest('Builder browser service is unavailable'),
+				)
+				const { data } = await builderClient.call('ListOrgs', { query: {} })
+				const orgs = data.items ?? []
+				assert(
+					orgs.length,
+					badRequest(
+						'No organizations available for this account — create one '
+						+ 'first, or authenticate as a user who belongs to one.',
+					),
+				)
+				if(orgs.length > 1) {
+					return {
+						needsChoice: true,
+						message:
+							'This account belongs to more than one organization. Ask '
+							+ 'the developer which one to use, then re-call '
+							+ 'attach_browser with mode "builder" and that orgId.',
+						organizations: orgs.map((o) => ({
+							id: o.id,
+							name: o.name,
+							kind: o.kind,
+							status: o.status,
+						})),
+					}
+				}
+
+				orgId = orgs[0].id
+			}
+
 			const next = await connect(
-				mode, parsed, persisted, builderClient, dependencies,
+				mode, { ...parsed, orgId }, persisted, builderClient, dependencies,
 			)
 			try {
 				await beforeReplace?.()

package/src/mcp/tools/agent/build.ts

@@ -28,7 +28,11 @@ export interface AgentState {
 	captures: CaptureStore
 }
 
-function buildAgentState(): AgentState {
+/** Exported so a mode (e.g. old-devtools) that supplies its own publish tool
+ *  can build the attach/capture state up front and share the SAME instance
+ *  with `buildAgentTools` — letting that publish tool see the live attach
+ *  state (e.g. to remind the caller about a still-open browser session). */
+export function buildAgentState(): AgentState {
 	return {
 		attach: { config: new ConfigStore() },
 		captures: { sessions: new Map() },
@@ -39,12 +43,15 @@ function buildAgentState(): AgentState {
  *  `registerToolList`.
  *  Pass `client` to include the builder `create_provider_version_from_capture`;
  *  omit it (e.g. OLD-devtools mode) to register only the backend-independent
- *  capture/proof tools — old mode supplies its own publish tool. */
+ *  capture/proof tools — old mode supplies its own publish tool.
+ *  Pass `externalState` to share attach/capture state with tools registered
+ *  elsewhere (e.g. old mode's publish tool) instead of building a fresh one. */
 export function buildAgentTools(
 	client?: ReclaimClient,
 	builderClient: ReclaimClient | undefined = client,
+	externalState?: AgentState,
 ): RegisteredTool[] {
-	const state = buildAgentState()
+	const state = externalState ?? buildAgentState()
 	ensureAttestorCrypto()
 	const tools: RegisteredTool[] = []
 	// Stateless docs tool — serve the mode-specific authoring guide to any
@@ -75,7 +82,7 @@ export function buildAgentTools(
 	}
 
 	if(client) {
-		tools.push(createVersionFromCaptureTool(client))
+		tools.push(createVersionFromCaptureTool(client, state.attach))
 	}
 
 	return tools

package/src/mcp/tools/agent/index.ts

@@ -1,4 +1,4 @@
 // Barrel for the agent tool group (Chrome CDP capture, provider synthesis,
 // replay, zkTLS proof). Import from here, not the individual files.
-export { buildAgentTools } from './build.ts'
+export { buildAgentState, buildAgentTools } from './build.ts'
 export type { AgentState } from './build.ts'

package/src/mcp/tools/agent/publish.ts

@@ -12,6 +12,7 @@ import {
 	providerToCreateVersionRequest,
 } from '../../../provider/to-version.ts'
 import { defineTool, type RegisteredTool } from '../../server.ts'
+import type { AttachState } from './attach.ts'
 
 /** Schemas shared by the top-level `provider`/`providers` and the lighter
  *  `allowedJsRequests` drafts — keeps the request shape from drifting between
@@ -142,6 +143,7 @@ interface PublishArgs {
 
 export function createVersionFromCaptureTool(
 	client: ReclaimClient,
+	attachRef?: { current?: AttachState },
 ): RegisteredTool {
 	return defineTool<PublishArgs>(
 		{
@@ -172,7 +174,11 @@ export function createVersionFromCaptureTool(
 				'sessions (verification matches those values exactly; a missing ' +
 				'field is a 400 at session create). ' +
 				'Refine types/descriptions via `update_provider_version` while ' +
-				'still on draft.',
+				'still on draft. ' +
+				'On success, if a browser is still attached, the response\'s ' +
+				'`_notes` reminds you to confirm with the developer before ' +
+				'calling `dispose_browser` — never close it unprompted, they ' +
+				'may want it for further edits.',
 			inputSchema: {
 				type: 'object',
 				properties: {
@@ -328,6 +334,23 @@ export function createVersionFromCaptureTool(
 			]
 			notes.push(...matchRedactionWarnings(requestCounts))
 
+			// A browser session left attached after a successful publish is easy
+			// to forget about — surface it so the caller asks the developer
+			// before closing it (a builder-mode session is quota-accounted and
+			// otherwise just sits until its TTL expires).
+			const attached = attachRef?.current
+			if(attached) {
+				notes.push(
+					`A "${attached.mode}" browser session is still attached` +
+					(attached.browserSessionId
+						? ` (browserSessionId: ${attached.browserSessionId})`
+						: '') +
+					'. Ask the developer whether they want to keep it open for ' +
+					'further edits — only call dispose_browser once they confirm ' +
+					'they\'re done with it.',
+				)
+			}
+
 			// Let the dev know how/when the script runs (and the window.Reclaim gap).
 			if(args.jsUserScripts?.trim()) {
 				notes.push(

package/src/mcp/tools/authenticate/authenticate.ts

@@ -233,12 +233,10 @@ async function exchangeCode(
 			client_id: opts.clientId,
 		}).toString(),
 	})
-	assert(
-		res.ok,
-		new Error(`Token exchange failed (${res.status}): ${await res.text()}`),
-	)
+	const body = await res.text()
+	assert(res.ok, new Error(`Token exchange failed (${res.status}): ${body}`))
 
-	const json = (await res.json()) as {
+	const json = JSON.parse(body) as {
 		access_token?: string
 		expires_in?: number
 	}

package/src/old/tools/build.ts

@@ -1,4 +1,5 @@
 import type { RegisteredTool } from '../../mcp/server.ts'
+import type { AttachState } from '../../mcp/tools/agent/attach.ts'
 import type { ReclaimOldClient } from '../client.ts'
 import type { ReclaimSdkClient } from '../sdk-client.ts'
 import { authenticateTool } from './authenticate.ts'
@@ -23,14 +24,19 @@ import { verifySdkSetupTool } from './verify-sdk-setup.ts'
  * `sdkClient` is a SEPARATE, unauthenticated client for the public
  * production SDK backend (`api.reclaimprotocol.org`) — a different host from
  * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
+ *
+ * `attachRef` is the SAME attach state `buildAgentTools` was given (see
+ * `mcp/start.ts`) — passing it lets the publish tool remind the caller about
+ * a still-open browser session after a successful publish.
  */
 export function buildOldBackendTools(
 	client: ReclaimOldClient,
 	sdkClient: ReclaimSdkClient,
+	attachRef?: { current?: AttachState },
 ): RegisteredTool[] {
 	return [
 		authenticateTool(client),
-		createVersionFromCaptureTool(client),
+		createVersionFromCaptureTool(client, attachRef),
 		getMeProvidersTool(client),
 		getProviderInfoTool(sdkClient),
 		updateProviderMetadataTool(client),

package/src/old/tools/publish.ts

@@ -1,5 +1,6 @@
 import { Boom, isBoom } from '@hapi/boom'
 import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { AttachState } from '../../mcp/tools/agent/attach.ts'
 import { INJECTION_GUIDE } from '../../provider/injection-doc.ts'
 import {
 	countsFor,
@@ -70,9 +71,16 @@ function rethrowOwnershipError(err: unknown, providerId: string): never {
  *     highest existing version).
  *
  * Get a `providerId` from `get_me_providers`.
+ *
+ * `attachRef`, when given, is checked after a successful publish: if a
+ * browser is still attached, a `_notes` entry reminds the caller to confirm
+ * with the developer before closing it (see `dispose_browser`) rather than
+ * closing it unprompted — the developer may still want the session for
+ * further edits.
  */
 export function createVersionFromCaptureTool(
 	client: ReclaimOldClient,
+	attachRef?: { current?: AttachState },
 ): RegisteredTool {
 	return defineTool<{
 		provider?: ReclaimProvider
@@ -139,7 +147,11 @@ export function createVersionFromCaptureTool(
 				'default include), `urlType` (REGEX/CONSTANT/TEMPLATE, default ' +
 				'derived from {{placeholders}}), and `isOptional` on each ' +
 				'responseMatch (default false). \n\n' +
-				'Captured requests must be GET/POST. OPRF redactions are supported.',
+				'Captured requests must be GET/POST. OPRF redactions are supported. ' +
+					'On success, if a browser is still attached, the response\'s ' +
+					'`_notes` reminds you to confirm with the developer before ' +
+					'calling `dispose_browser` — never close it unprompted, they ' +
+					'may want it for further edits.',
 			inputSchema: {
 				type: 'object',
 				properties: {
@@ -507,6 +519,23 @@ export function createVersionFromCaptureTool(
 				providers.map((p, i) => countsFor(`Request ${i + 1}`, p)),
 			)
 
+			// A browser session left attached after a successful publish is
+			// easy to forget about — surface it so the caller asks the
+			// developer before closing it (a builder-mode session is
+			// quota-accounted and otherwise just sits until its TTL expires).
+			const attached = attachRef?.current
+			if(attached) {
+				notes.push(
+					`A "${attached.mode}" browser session is still attached` +
+					(attached.browserSessionId
+						? ` (browserSessionId: ${attached.browserSessionId})`
+						: '') +
+					'. Ask the developer whether they want to keep it open for ' +
+					'further edits — only call dispose_browser once they confirm ' +
+					'they\'re done with it.',
+				)
+			}
+
 			const withNotes = (result: unknown) => {
 				if(notes.length && result && typeof result === 'object') {
 					return { ...result, _notes: notes }