@reclaimprotocol/agent 0.1.21 → 0.1.23

package/src/authoring/tools.ts

@@ -179,6 +179,118 @@ export function authoringTools(
 				return { ready: false }
 			},
 		),
+		defineTool<Record<string, unknown>>(
+			{
+				name: 'test_user_script',
+				description:
+					'Dry-run a USER SCRIPT — the same thing as the `jsUserScripts` / '
+					+ '`customInjection` field on a published provider: plain browser '
+					+ 'JS that runs before every page load, used to drive navigation '
+					+ 'for data gated behind login/routing — in the LIVE attached tab, '
+					+ 'BEFORE publishing. Installs `script` via CDP so it runs on the '
+					+ 'next navigation exactly like the real field would, then reports '
+					+ 'whether it ran and any errors it threw. Catches bugs (e.g. a '
+					+ 'listener registered with setTimeout that never fires because the '
+					+ "page was already past 'load' by the time it ran) before they "
+					+ 'surface in a real end-user session instead of after. If '
+					+ '`navigateUrl` is given, navigates there after installing, then '
+					+ 'removes the script again once the result is read (self-cleaning '
+					+ '— safe to call repeatedly). Without `navigateUrl` the script is '
+					+ 'left installed for you to navigate yourself (any way you like) '
+					+ 'then re-call this tool, or read '
+					+ '`window.__reclaimUserScriptResult` via eval_in_page — in that '
+					+ 'manual mode it is NOT auto-removed and keeps running on every '
+					+ 'later navigation until a follow-up call with `navigateUrl` '
+					+ 'removes it, so avoid stacking several manual-mode calls in a '
+					+ 'row.',
+				inputSchema: objectSchema(
+					{
+						script: { type: 'string' },
+						navigateUrl: { type: 'string' },
+						timeoutMs: { type: 'number' },
+					},
+					['script'],
+				),
+			},
+			async(args) => {
+				const backend = resolveBackend(args)
+				const script = String(args.script)
+				// The user's script is spliced in as a STRING and compiled at
+				// runtime via `new Function`, not as raw top-level source: a
+				// syntax error in it would otherwise fail to parse the entire
+				// wrapper (result init, error listener, and try/catch included),
+				// so the tool would report ran:false / errors:[] instead of the
+				// actual SyntaxError.
+				const wrapped = `
+					window.__reclaimUserScriptResult = { ran: false, errors: [] };
+					window.addEventListener('error', function(e) {
+						window.__reclaimUserScriptResult.errors.push(String(e.message));
+					});
+					try {
+						(new Function(${JSON.stringify(script)}))();
+						window.__reclaimUserScriptResult.ran = true;
+					} catch(e) {
+						window.__reclaimUserScriptResult.errors.push(
+							String((e && e.message) || e),
+						);
+					}
+				`
+				const installed = (await backend.sendCdp(
+					'Page.addScriptToEvaluateOnNewDocument', { source: wrapped },
+				)) as { identifier?: string }
+
+				if(typeof args.navigateUrl !== 'string') {
+					return {
+						installed: true,
+						note:
+							'Installed for the NEXT navigation only — it did not run on '
+							+ 'the current page, and stays installed (runs on every later '
+							+ 'navigation too) until a follow-up call with navigateUrl '
+							+ 'removes it. Navigate now (e.g. the navigate tool), then read '
+							+ 'window.__reclaimUserScriptResult via eval_in_page, or call '
+							+ 'test_user_script again with navigateUrl.',
+					}
+				}
+
+				try {
+					const timeoutMs = Number(args.timeoutMs) || 30_000
+					await backend.sendCdp('Page.enable')
+					const load = backend.waitForEvent('Page.loadEventFired', timeoutMs)
+					const nav = (await backend.sendCdp(
+						'Page.navigate', { url: String(args.navigateUrl) },
+					)) as { errorText?: string }
+					if(nav.errorText) {
+						return { installed: true, navigated: false, error: nav.errorText }
+					}
+
+					await load
+					const { value, error } = await evalInPage(
+						backend, 'window.__reclaimUserScriptResult',
+					)
+					if(error) {
+						return { installed: true, navigated: true, error }
+					}
+
+					const result =
+						value as { ran?: boolean, errors?: string[] } | undefined
+					return {
+						installed: true,
+						navigated: true,
+						ran: result?.ran ?? false,
+						errors: result?.errors ?? [],
+					}
+				} finally {
+					// One-shot test: remove it so it doesn't keep running (and
+					// potentially redirecting the tab) on every later navigation.
+					if(installed.identifier) {
+						await backend.sendCdp(
+							'Page.removeScriptToEvaluateOnNewDocument',
+							{ identifier: installed.identifier },
+						)
+					}
+				}
+			},
+		),
 		defineTool<Record<string, unknown>>(
 			{
 				name: 'get_cookies',
@@ -321,7 +433,13 @@ export function authoringTools(
 				name: 'run_proof',
 				description:
 					'Prove the drafted recipe (zkTLS). Only call after replay_request '
-					+ 'looks right. Returns the proof result.',
+					+ 'looks right. Returns the proof result. NOTE: unlike '
+					+ 'replay_request (which re-issues from inside the live attached '
+					+ 'browser tab), the ATTESTOR calls the target from its OWN '
+					+ 'network/IP, separate from the browser\'s. A request that '
+					+ 'replayed fine can still fail here for geo/IP-bound content '
+					+ '(country-locked pages, IP-allowlisted APIs) — if that happens, '
+					+ 'it\'s a property of the site, not a bug in the draft.',
 				inputSchema: objectSchema({ draftId: { type: 'string' } }, ['draftId']),
 			},
 			// The backend shapes its own result: the cloud returns a lean,

package/src/mcp/tools/agent/attach.ts

@@ -70,6 +70,11 @@ export function attachTool(
 						+ 'port), builder (quota-accounted Popcorn browser with a '
 						+ 'shareable live view), or custom (caller-supplied CDP '
 						+ 'websocket). '
+						+ 'For builder mode, orgId may be omitted: it auto-resolves to '
+						+ 'the account\'s only organization, or — if there is more '
+						+ 'than one — returns needsChoice with the full list so the '
+						+ 'caller can ask the developer which to use and re-call with '
+						+ 'that orgId. '
 						+ 'Builder and custom CDP credentials are held in memory and never '
 						+ 'returned.',
 			inputSchema: {
@@ -107,8 +112,42 @@ export function attachTool(
 				}
 			}
 
+			let orgId = parsed.orgId
+			if(mode === 'builder' && !orgId) {
+				assert(
+					builderClient,
+					badRequest('Builder browser service is unavailable'),
+				)
+				const { data } = await builderClient.call('ListOrgs', { query: {} })
+				const orgs = data.items ?? []
+				assert(
+					orgs.length,
+					badRequest(
+						'No organizations available for this account — create one '
+						+ 'first, or authenticate as a user who belongs to one.',
+					),
+				)
+				if(orgs.length > 1) {
+					return {
+						needsChoice: true,
+						message:
+							'This account belongs to more than one organization. Ask '
+							+ 'the developer which one to use, then re-call '
+							+ 'attach_browser with mode "builder" and that orgId.',
+						organizations: orgs.map((o) => ({
+							id: o.id,
+							name: o.name,
+							kind: o.kind,
+							status: o.status,
+						})),
+					}
+				}
+
+				orgId = orgs[0].id
+			}
+
 			const next = await connect(
-				mode, parsed, persisted, builderClient, dependencies,
+				mode, { ...parsed, orgId }, persisted, builderClient, dependencies,
 			)
 			try {
 				await beforeReplace?.()

package/src/mcp/tools/agent/propose.ts

@@ -23,18 +23,41 @@ export function proposeTool(resolveBackend: ResolveBackend): RegisteredTool {
 				+ 'one match + redaction per target. Returns a draftId + recipe '
 				+ '(never secrets). Prefer a SINGLE request holding ALL values. '
 				+ 'Single-value shorthand: `target` + `name`. Per-target `hash` '
-				+ 'OPRF-hashes that value.',
+				+ 'OPRF-hashes that value. BY DEFAULT each `name` is shortened to '
+				+ 'its last alphanumeric token, lowercased, to form the param key '
+				+ '(e.g. "employer_name" → "name") — pick names that stay distinct '
+				+ 'after shortening ("firstName"/"surname", not "first_name"/'
+				+ '"last_name"). Pass `shortenNames: false` to use each `name` '
+				+ 'VERBATIM as the param key instead — it becomes both a regex '
+				+ 'capture-group name and a paramValues key, so it must be a plain '
+				+ 'identifier (letters/digits/underscore, not starting with a '
+				+ 'digit); we recommend lower_snake_case (e.g. "employer_name"), '
+				+ 'but you choose the exact name.',
 			inputSchema: objectSchema(
 				{
 					requestId: { type: 'string' },
 					name: { type: 'string' },
+					shortenNames: {
+						type: 'boolean',
+						description:
+							'Default true: shorten each target `name` to its last '
+							+ 'alphanumeric token, lowercased, to form the param key. '
+							+ 'Set false to use `name` verbatim instead (must be a plain '
+							+ 'identifier — lower_snake_case recommended).',
+					},
 					targets: {
 						type: 'array',
 						items: {
 							type: 'object',
 							properties: {
 								value: { type: 'string' },
-								name: { type: 'string' },
+								name: {
+									type: 'string',
+									description:
+										'The param key, or the source of one — see '
+										+ '`shortenNames`. Must stay distinct from other targets\' '
+										+ 'names after whichever treatment applies.',
+								},
 								hash: {
 									type: 'string',
 									enum: ['oprf-raw', 'oprf', 'oprf-mpc'],
@@ -54,6 +77,9 @@ export function proposeTool(resolveBackend: ResolveBackend): RegisteredTool {
 			const requestId = String(args.requestId)
 			const providerName = String(args.name)
 			const defaultHash = args.hash as OprfMode | undefined
+			const shortenNames = typeof args.shortenNames === 'boolean'
+				? args.shortenNames
+				: true
 
 			// Explicit multi-value `targets`, else the single `target` shorthand.
 			const raw = Array.isArray(args.targets) ? args.targets : []
@@ -103,7 +129,7 @@ export function proposeTool(resolveBackend: ResolveBackend): RegisteredTool {
 			}
 
 			const { provider, secretRefs, extractions } = draftProvider(
-				captured, targets, providerName, defaultHash,
+				captured, targets, providerName, defaultHash, { shortenNames },
 			)
 			// Materialize the real secret header values for later replay/prove;
 			// they stay in the server-side draft, never in this result.

package/src/mcp/tools/agent/publish.ts

@@ -136,7 +136,6 @@ interface PublishArgs {
 	allowedJsRequests?: AllowedJsRequest[]
 	interceptorOptions?: {
 		interceptorType: 'HAWKEYE' | 'MSWJS' | 'CDP'
-		isDocumentRequestReplayEnabled?: boolean
 		interceptorSettings?: string
 	}
 }
@@ -268,17 +267,19 @@ export function createVersionFromCaptureTool(
 						type: 'object',
 						description:
 							'In-app interception settings, stored as ' +
-							'webSettings.clientOptions.inapp.interceptorOptions. ' +
-							'`isDocumentRequestReplayEnabled` is the INVERSE of ' +
-							'old-devtools\' `disableRequestReplay`: true replays the ' +
-							'main document request via the attestor (default false).',
+							'webSettings.clientOptions.inapp.interceptorOptions — only ' +
+							'needed for a genuine live-interception provider (a real ' +
+							'HAWKEYE/MSWJS script, not the standard capture→replay flow). ' +
+							'Document replay (webSettings.clientOptions.inapp' +
+							'.interceptorOptions.isDocumentRequestReplayEnabled) is ' +
+							'ALWAYS published disabled regardless of this field — there ' +
+							'is no way to enable it here.',
 						properties: {
 							interceptorType: {
 								type: 'string',
 								enum: ['HAWKEYE', 'MSWJS', 'CDP'],
 								description: 'How traffic interception is implemented.',
 							},
-							isDocumentRequestReplayEnabled: { type: 'boolean' },
 							interceptorSettings: {
 								type: 'string',
 								description:

package/src/mcp/tools/agent/shared.ts

@@ -13,7 +13,7 @@ import {
 	extendTool,
 } from '../../../authoring/index.ts'
 import { runAttestorProof } from '../../../proof/attestor.ts'
-import { replayProvider } from '../../../proof/replay.ts'
+import { replayProviderInPage } from '../../../proof/page-replay.ts'
 import type { OprfMode, ReclaimProvider } from '../../../provider/schema.ts'
 import type { RegisteredTool } from '../../server.ts'
 import type { CaptureEntry, CaptureStore } from './capture.ts'
@@ -51,14 +51,18 @@ function withLocalOprfMode(provider: ReclaimProvider): ReclaimProvider {
 }
 
 /** The local backend for one capture: drive its tab over CDP, read its
- *  captured requests, prove via the in-process attestor, replay by re-fetch. */
+ *  captured requests, prove via the in-process attestor, replay by re-fetching
+ *  FROM INSIDE the tab (real cookies/session — see proof/page-replay.ts). */
 function localBackend(entry: CaptureEntry): AuthoringBackend {
 	const { tabClient, session, drafts } = entry
+	const sendCdp = (method: string, params?: Record<string, unknown>) => {
+		return tabClient.send(method, params ?? {})
+	}
 
 	return {
 		capture: session,
 		drafts,
-		sendCdp: (method, params) => tabClient.send(method, params ?? {}),
+		sendCdp,
 		waitForEvent: (method, timeoutMs) => new Promise((resolve) => {
 			let stopListening = () => {}
 
@@ -79,10 +83,11 @@ function localBackend(entry: CaptureEntry): AuthoringBackend {
 			stopListening = tabClient.subscribeOnce(method, onEvent)
 		}),
 		replay: async(draft, opts) => {
-			// Auth-bound check: re-fetch with the secrets dropped. replayProvider
-			// already does a live Node fetch, so empty secrets == anonymous.
-			const secrets = opts?.withoutSecrets ? {} : draft.secrets
-			const result = await replayProvider(draft.provider, secrets)
+			// Replayed FROM INSIDE the attached tab (real cookies/session), not
+			// a detached Node fetch — see proof/page-replay.ts.
+			const result = await replayProviderInPage(
+				{ sendCdp }, draft.provider, draft.secrets, opts,
+			)
 			return {
 				status: result.status,
 				matchesOriginal: result.matchesOriginal,
@@ -127,7 +132,13 @@ const RUN_PROOF_EXTRAS = {
 		+ 'specific alternative — do NOT invent backup URLs. `ownerAddress` '
 		+ '(the credential to sign with) is REQUIRED — call resolve_owner_key '
 		+ 'first. errorKind="missing-owner-key" means that address has no known '
-		+ 'private key; re-run resolve_owner_key or issue/import a credential.',
+		+ 'private key; re-run resolve_owner_key or issue/import a credential. '
+		+ 'NOTE: unlike replay_request (which re-issues from inside the live '
+		+ 'attached browser tab), the ATTESTOR calls the target from its OWN '
+		+ 'network/IP, separate from the browser\'s. A request that replayed '
+		+ 'fine can still fail here for geo/IP-bound content (country-locked '
+		+ "pages, IP-allowlisted APIs) — if that happens, it's a property of "
+		+ 'the site, not a bug in the draft.',
 	properties: {
 		ownerAddress: {
 			type: 'string',