@reclaimprotocol/agent 0.1.22 → 0.1.23

package/lib/mcp/tools/mode/mode.js

@@ -1,6 +1,18 @@
 import { defaultConfigPath } from "../../../config/store.js";
 import { oldModeSource } from "../../../consts.js";
 import { defineTool } from "../../server.js";
+/** Whether `config`'s cached builder session token is present and not yet
+ *  expired. Mirrors `readSession`'s check, but against the CALLER's
+ *  `ConfigStore` instance (not always the default `~/.reclaim/config.json`
+ *  path) so this stays test-isolatable and consistent with the rest of this
+ *  tool's config reads. */
+function hasValidBuilderSession(config) {
+    const session = config.read()?.session;
+    if (!session?.token || !session.expiresAt) {
+        return false;
+    }
+    return new Date(session.expiresAt) > new Date();
+}
 /**
  * The `set_devtools_mode` / `get_devtools_mode` tools: persist which backend
  * the MCP server targets (`old` devtools vs the `builder`), and
@@ -54,15 +66,34 @@ export function buildModeTools(config, currentOldMode) {
                 + 'backend). Also reports WHY that mode is in effect (source: '
                 + 'a USE_OLD_DEVTOOLS env override, the persisted config, or '
                 + 'the default) and which mode is persisted for the next '
-                + 'start. Use set_devtools_mode to change it.',
+                + 'start. Use set_devtools_mode to change it. Also reports '
+                + 'AUTH status for BOTH auth systems — builderAuthenticated (the '
+                + 'Builder OAuth login). In BUILDER mode this is the only login '
+                + 'that exists and covers everything, including org listing '
+                + '(list_orgs) and remote-browser allocation. In OLD-DEVTOOLS '
+                + 'mode it is a SEPARATE, additional login (authenticate_builder) '
+                + 'needed only for two Builder-exclusive features: remote-browser '
+                + '(Popcorn) allocation and org listing (list_builder_organizations '
+                + '— old-devtools has no generated org tool of its own). '
+                + 'oldDevtoolsAuthenticated (the OLD-mode reclaim_authenticate) is '
+                + 'required separately for create_provider_version_from_capture '
+                + 'and get_me_providers, and only exists/matters in old-devtools '
+                + 'mode. Both are presence checks, not '
+                + 'validity checks — a stale old-devtools token still reports '
+                + 'true here; a real publish/list call will surface staleness '
+                + 'with a clear error pointing back at reclaim_authenticate.',
             inputSchema: { type: 'object', properties: {} },
         }, async () => {
             const persisted = config.read()?.mode;
+            const oldIdentity = config.read()?.old_devtools;
             return {
                 mode: current,
                 source: oldModeSource(persisted),
                 persistedMode: persisted ?? null,
                 configPath: defaultConfigPath(),
+                builderAuthenticated: hasValidBuilderSession(config),
+                oldDevtoolsAuthenticated: !!oldIdentity,
+                oldDevtoolsIdentityKind: oldIdentity?.kind ?? null,
             };
         }),
     ];

package/lib/old/client.d.ts

@@ -48,6 +48,15 @@ export interface RegisterProviderBody {
      *  controller's destructure + its `providerConfig` write, both of which
      *  include it alongside `pageTitle`/`userAgent`. */
     stepsToFollow?: string;
+    /** Interception mechanism (`NONE` = standard replay flow, the default;
+     *  `HAWKEYE`/`MSWJS`/`XHOOK` = JS-context interception; `CDP` = browser-
+     *  level). Column default is `HAWKEYE` when omitted entirely — unlike
+     *  `stepsToFollow` etc. above, whether the register endpoint actually
+     *  PERSISTS this field is UNVERIFIED (no source access to confirm); sent
+     *  here on the chance it does, but the publish tool always follows up
+     *  with a config (add-version) call regardless, which is confirmed to
+     *  persist it. */
+    injectionType?: 'NONE' | 'MSWJS' | 'XHOOK' | 'CDP' | 'HAWKEYE';
 }
 export interface UpdateProviderConfigBody {
     providerConfig: Record<string, unknown>;

package/lib/old/client.js

@@ -202,10 +202,28 @@ _ReclaimOldClient_identity = new WeakMap(), _ReclaimOldClient_fetch = new WeakMa
         return undefined;
     }
 }, _ReclaimOldClient_asBoom = function _ReclaimOldClient_asBoom(res, json) {
-    const message = (json && typeof json === 'object' &&
+    const rawMessage = (json && typeof json === 'object' &&
         typeof json.message === 'string'
         ? json.message
         : undefined) || res.statusText || 'Old devtools request failed';
+    // An identity ALREADY SET (as opposed to `#requireIdentity`'s "never
+    // authenticated" case, which never reaches the backend) plus either a
+    // 401/403 OR a message that itself names token verification means the
+    // backend rejected a token we had — i.e. it's stale/invalid, not merely
+    // absent. The message check matters because this backend does NOT
+    // reliably use 401/403 for it — confirmed live: an actually-expired
+    // Firebase token surfaced as "Error while verifying token" with a
+    // status this narrow check (401/403-only) missed entirely, silently
+    // skipping the enrichment. The backend's own message gives no hint of
+    // the fix, and nothing else distinguishes this from Builder auth, so
+    // append repo-side guidance rather than replacing the raw detail.
+    const staleAuth = !!__classPrivateFieldGet(this, _ReclaimOldClient_identity, "f") && (res.status === 401 || res.status === 403 ||
+        /verify.{0,20}token|token.{0,20}verif/i.test(rawMessage));
+    const message = staleAuth
+        ? `${rawMessage} — your old-devtools login looks stale or invalid `
+            + '(this is separate from Builder auth). Re-run reclaim_authenticate '
+            + 'to refresh it, then retry.'
+        : rawMessage;
     // Shape `data` like a ProblemDetails so remapErrorAsResponse can render
     // `${message}: ${data.detail}` and expose the raw body as structured.
     return new Boom(message, {

package/lib/old/to-register.d.ts

@@ -51,13 +51,24 @@ export interface OldProviderOpts {
      *  field from the request body. Free-form JSON. */
     extensionConfig?: unknown;
     /** Provider-level `disableRequestReplay` (HAWKEYE document replay skip).
-     *  Config (add-version) ONLY: the register endpoint hardcodes it to false
-     *  — the publish tool follows a register up with an add-version call to
-     *  apply it for new providers (see `old/tools/publish.ts`). NOTE the
-     *  builder backend has NO equivalent; its inverse is
-     *  `webSettings.clientOptions.inapp.interceptorOptions
-     *  .isDocumentRequestReplayEnabled`. */
+     *  The publish tool always forces this `true` — there is no author-facing
+     *  way to enable document replay. Config (add-version) ONLY: the register
+     *  endpoint hardcodes it to false regardless of what's sent, so the
+     *  publish tool always follows a register up with an add-version call to
+     *  actually apply it (see `old/tools/publish.ts`). The builder backend's
+     *  inverse-named equivalent, `webSettings.clientOptions.inapp
+     *  .interceptorOptions.isDocumentRequestReplayEnabled`, is likewise always
+     *  force-disabled by `providerToCreateVersionRequest`. */
     disableRequestReplay?: boolean;
+    /** Interception mechanism — `NONE` (the publish tool's default) for the
+     *  standard capture→replay flow; `HAWKEYE`/`MSWJS`/`XHOOK`/`CDP` for a
+     *  genuine live-interception provider. Old-devtools calls this
+     *  `injectionType`; builder's equivalent is `webSettings.clientOptions
+     *  .inapp.interceptorOptions.interceptorType` (no `NONE` value there —
+     *  omitting the whole object is builder's no-interception signal
+     *  instead). See `old/client.ts`'s `RegisterProviderBody.injectionType`
+     *  doc for the register-persistence caveat. */
+    injectionType?: 'NONE' | 'MSWJS' | 'XHOOK' | 'CDP' | 'HAWKEYE';
 }
 interface OldResponseMatch {
     value: string;

package/lib/old/to-register.js

@@ -133,6 +133,9 @@ export function providerToRegisterBody(providers, opts) {
     if (opts.stepsToFollow !== undefined) {
         body.stepsToFollow = opts.stepsToFollow;
     }
+    if (opts.injectionType !== undefined) {
+        body.injectionType = opts.injectionType;
+    }
     return body;
 }
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
@@ -173,6 +176,9 @@ export function providerToConfigBody(providers, opts, version, versionInfo) {
     if (opts.disableRequestReplay !== undefined) {
         providerConfig.disableRequestReplay = opts.disableRequestReplay;
     }
+    if (opts.injectionType !== undefined) {
+        providerConfig.injectionType = opts.injectionType;
+    }
     return { providerConfig, version, versionInfo };
 }
 /**

package/lib/old/tools/me-providers.js

@@ -13,7 +13,9 @@ export function getMeProvidersTool(client) {
             'first). Returns provider metadata including each `providerId` — ' +
             'pass one back to create_provider_version_from_capture to publish a ' +
             'new version of that provider instead of creating a duplicate. ' +
-            'Requires reclaim_authenticate first.',
+            'Requires reclaim_authenticate (old-devtools login) first — this ' +
+            'is separate from authenticate_builder/Builder auth, which does ' +
+            'not authorize this call. Check status with get_devtools_mode.',
         inputSchema: {
             type: 'object',
             properties: {

package/lib/old/tools/publish.js

@@ -57,6 +57,9 @@ export function createVersionFromCaptureTool(client, attachRef) {
     return defineTool({
         name: 'create_provider_version_from_capture',
         description: 'Publish drafted ReclaimProvider(s) to the devtools backend. ' +
+            'Requires its OWN old-devtools login via reclaim_authenticate — ' +
+            'separate from authenticate_builder/Builder auth, which does not ' +
+            'authorize this call. Check status with get_devtools_mode. \n\n' +
             'Pass the `provider` object from propose_provider VERBATIM and the ' +
             '`initialUrl` the user landed on (the login/landing page, NOT the ' +
             'API url). \n\n' +
@@ -74,8 +77,9 @@ export function createVersionFromCaptureTool(client, attachRef) {
             "PUBLIC provider you don't own, omit `providerId` to register your " +
             'own copy (you cannot edit someone else\'s provider here). \n\n' +
             'For data gated behind login/navigation, pass `customInjection` — a ' +
-            'page-injection script (the devtools name for the builder\'s ' +
-            'jsUserScripts) that drives the page to where the request fires. \n\n' +
+            'USER SCRIPT (same concept as the builder\'s `jsUserScripts` — ' +
+            'devtools just calls the field `customInjection`) that drives the ' +
+            'page to where the request fires. \n\n' +
             'BY DESIGN, this backend only ever CREATES A NEW VERSION (POST) — ' +
             'there is no partial-patch/edit endpoint, and this tool does NOT ' +
             'read or carry anything forward from the previous version. Every ' +
@@ -91,15 +95,20 @@ export function createVersionFromCaptureTool(client, attachRef) {
             'values plus your change) back into this call. ' +
             '`allowedInjectedRequestData`/`useIncognitoWebview`/' +
             '`extensionConfig` only take effect on add-version — the register ' +
-            'endpoint (no `providerId`) ignores them. `disableRequestReplay` ' +
-            'is also add-version-only, but when it is true the tool follows ' +
-            'a register up with an add-version call automatically so it takes ' +
-            'effect on new providers too. Per-request fields you may set on ' +
+            'endpoint (no `providerId`) ignores them, so on a fresh register ' +
+            'this tool automatically follows up with an add-version call that ' +
+            'applies them (also where document replay gets force-disabled — ' +
+            'see below). Per-request fields you may set on ' +
             '`provider`/`providers`: `credentials` (omit/same-origin/include, ' +
             'default include), `urlType` (REGEX/CONSTANT/TEMPLATE, default ' +
             'derived from {{placeholders}}), and `isOptional` on each ' +
             'responseMatch (default false). \n\n' +
             'Captured requests must be GET/POST. OPRF redactions are supported. ' +
+            'Document replay — the HAWKEYE-level flag controlling whether the ' +
+            'page\'s own document/navigation request gets genuinely re-sent ' +
+            'through the interceptor at verification time — is ALWAYS ' +
+            'published disabled (`disableRequestReplay: true`); there is no ' +
+            'way to enable it here. ' +
             'On success, if a browser is still attached, the response\'s ' +
             '`_notes` reminds you to confirm with the developer before ' +
             'calling `dispose_browser` — never close it unprompted, they ' +
@@ -388,13 +397,24 @@ export function createVersionFromCaptureTool(client, attachRef) {
                     description: 'Free-form JSON passed through to the client. Add-version ' +
                         'ONLY.',
                 },
-                disableRequestReplay: {
-                    type: 'boolean',
-                    description: 'Skip replaying the main document request (HAWKEYE ' +
-                        'provider-level flag). Honored on add-version; for a ' +
-                        'provider (no `providerId`) the register endpoint ignores ' +
-                        'it, so when true the tool automatically follows the ' +
-                        'register up with an add-version call that applies it.',
+                injectionType: {
+                    type: 'string',
+                    enum: ['NONE', 'MSWJS', 'XHOOK', 'CDP', 'HAWKEYE'],
+                    description: 'Interception mechanism for this version. Omit to leave it ' +
+                        'unset — the devtools backend\'s own column default ' +
+                        '(`HAWKEYE`) applies, which is inert and harmless for the ' +
+                        'standard capture→replay flow with no interceptor script ' +
+                        'installed. Only set this to `HAWKEYE`/`MSWJS`/`XHOOK` ' +
+                        'when you are ALSO supplying a `customInjection` script ' +
+                        'that calls ' +
+                        '`window.reclaimInterceptor.addResponseMiddleware(...)` for ' +
+                        'genuine live interception, or set `NONE` explicitly if you ' +
+                        'want to be certain no interception is configured — see ' +
+                        'injection-api.md\'s "Recognizing this on a provider you ' +
+                        'didn\'t author" section for what these values actually do. ' +
+                        'Builder calls the equivalent concept `interceptorType` (no ' +
+                        '`NONE` there — omitting the whole `interceptorOptions` ' +
+                        'object is its no-interception signal instead).',
                 },
             },
             required: ['initialUrl'],
@@ -429,7 +449,13 @@ export function createVersionFromCaptureTool(client, attachRef) {
             stepsToFollow: args.stepsToFollow,
             useIncognitoWebview: args.useIncognitoWebview,
             extensionConfig: args.extensionConfig,
-            disableRequestReplay: args.disableRequestReplay,
+            // Author-settable, no forced default — the backend's own HAWKEYE
+            // column default applies when omitted, same as before this field
+            // existed at all.
+            injectionType: args.injectionType,
+            // Always disabled — see the tool description above; there is no
+            // author-facing way to enable document replay.
+            disableRequestReplay: true,
             allowedInjectedRequestData: args.allowedInjectedRequestData
                 ? injectedRequestDataFrom(args.allowedInjectedRequestData)
                 : undefined
@@ -468,11 +494,12 @@ export function createVersionFromCaptureTool(client, attachRef) {
                     'every page load (before navigating to initialUrl), matching ' +
                     'the builder\'s jsUserScripts.');
             }
-            // disableRequestReplay is honored ONLY on add-version, so a
-            // register can't set it — when true we immediately follow the
-            // register with an add-version call (which also lands any other
-            // register-ignored fields).
-            const followUp = args.disableRequestReplay === true;
+            // disableRequestReplay is honored ONLY on add-version, and it's now
+            // always forced true — so every register is immediately followed by
+            // an add-version call that actually applies it (which also lands
+            // an explicit injectionType, when passed — unverified whether
+            // register persists it — and any other register-ignored fields the
+            // caller passed).
             const REGISTER_IGNORED_KEYS = [
                 'allowedInjectedRequestData',
                 'useIncognitoWebview',
@@ -484,34 +511,51 @@ export function createVersionFromCaptureTool(client, attachRef) {
                 notes.push(`${ignoredOnRegister.join(', ')} ` +
                     `${ignoredOnRegister.length > 1 ? 'are' : 'is'} ` +
                     'ignored on register (no providerId) — the devtools backend only ' +
-                    'reads them when adding a version. ' +
-                    (followUp
-                        ? 'They were applied by the follow-up version the tool ' +
-                            'created to set disableRequestReplay.'
-                        : 'Publish once to create the provider, then call this ' +
-                            'again WITH the returned providerId to set them.'));
+                    'reads them when adding a version. They were applied by the ' +
+                    'automatic follow-up version this tool always creates to ' +
+                    'force-disable document replay.');
             }
             const body = providerToRegisterBody(providers, opts);
             const registered = await client.registerProvider(body);
-            if (followUp) {
-                const newProviderId = extractProviderId(registered);
-                if (newProviderId) {
+            const newProviderId = extractProviderId(registered);
+            if (newProviderId) {
+                // The provider already exists as of the register call above —
+                // a failure past this point must NOT reject the tool and
+                // discard `registered`/`newProviderId`, or a retry without
+                // `providerId` would register a DUPLICATE provider. Catch and
+                // warn instead, telling the caller to resume WITH this
+                // providerId.
+                try {
                     const versionsResp = await client.listVersions(newProviderId);
                     const followVersion = bumpPatchString(extractVersions(versionsResp));
-                    const configBody = providerToConfigBody(providers, { ...opts, disableRequestReplay: true }, followVersion, DEFAULT_VERSION_INFO);
+                    const configBody = providerToConfigBody(providers, opts, followVersion, DEFAULT_VERSION_INFO);
                     await client.updateProviderConfig(newProviderId, configBody);
-                    notes.push('disableRequestReplay is ignored by the register endpoint — ' +
-                        `applied it via a follow-up version (${followVersion}) on ` +
-                        'the new provider, which also lands any register-ignored ' +
-                        'fields you passed.');
+                    notes.push(`Created an automatic follow-up version (${followVersion}) to ` +
+                        'force-disable document replay (disableRequestReplay)' +
+                        (opts.injectionType !== undefined
+                            ? ` and set injectionType (${opts.injectionType})`
+                            : '') +
+                        ' — the register endpoint ignores/may ignore those fields, so ' +
+                        'every fresh register gets one. It also landed any other ' +
+                        'register-ignored fields you passed.');
                 }
-                else {
-                    notes.push('Could not apply disableRequestReplay: the register ' +
-                        'response did not include the new providerId. Call this ' +
-                        'tool again WITH `providerId` and `disableRequestReplay: ' +
-                        'true` to set it.');
+                catch (err) {
+                    const detail = isBoom(err) ? err.message : String(err);
+                    notes.push(`Provider ${newProviderId} WAS created, but the automatic ` +
+                        `follow-up version (to force-disable document replay${opts.injectionType !== undefined
+                            ? ' and set injectionType'
+                            : ''}) failed: ${detail}. Do NOT retry without providerId — that ` +
+                        'would register a duplicate. Instead, re-run ' +
+                        'create_provider_version_from_capture WITH ' +
+                        `providerId: "${newProviderId}" to add the follow-up version.`);
                 }
             }
+            else {
+                notes.push('Could not force-disable document replay: the ' +
+                    'register response did not include the new providerId. Call ' +
+                    'this tool again WITH `providerId` to create a version that ' +
+                    'applies them.');
+            }
             return withNotes(registered);
         }
         // New version of an existing provider — pick the next patch above

package/lib/proof/page-replay.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Replay a drafted provider's AUTHENTICATED request FROM INSIDE the live
+ * attached browser tab, over CDP `Runtime.evaluate` — so cookies/session are
+ * always the real browser's, for every browser source the MCP can attach to
+ * (local Chrome, remote Popcorn, or a caller-supplied custom CDP endpoint all
+ * funnel through one `AuthoringBackend.sendCdp`). Ports the pattern already
+ * proven in the cloud/Popcorn authoring backend
+ * (`packages/app/src/author/backend.ts` `pageFetch`/`authenticatedFetch`),
+ * adapted to the MCP's single-page `sendCdp(method, params)` (no separate
+ * `pageSession` argument). The ANONYMOUS auth-bound check does NOT go through
+ * the page — see `replayProviderInPage`'s doc comment below for why.
+ */
+import type { ReclaimProvider } from '../provider/schema.ts';
+import { type ReplayResult } from './replay.ts';
+/** Everything this module needs from an `AuthoringBackend` — just the raw CDP
+ *  seam, so callers can pass a minimal object instead of a full backend. */
+export interface PageReplayTarget {
+    sendCdp(method: string, params?: Record<string, unknown>): Promise<unknown>;
+}
+/**
+ * Replay `provider` and judge the response. Without `withoutSecrets`, replays
+ * as the logged-in session — run FROM INSIDE the live tab
+ * (`authenticatedPageFetch`) so cookies are the real browser's, which a
+ * detached call could never reproduce without manually re-deriving them.
+ * WITH `withoutSecrets` (the auth-bound check — "does this still work with
+ * no credentials, i.e. is it actually public"), replay instead through the
+ * detached Node-side `replayProvider`: the whole point of that check is to
+ * prove NO secret rides along, and the live page's own global `fetch` can't
+ * give that guarantee — a site (or a script installed via test_user_script)
+ * can wrap `fetch` and re-attach a token from localStorage/a service worker
+ * even under `credentials:'omit'`. A fresh, page-uninvolved fetch has no
+ * such surface.
+ */
+export declare function replayProviderInPage(backend: PageReplayTarget, provider: ReclaimProvider, secrets: Record<string, string>, opts?: {
+    withoutSecrets?: boolean;
+}): Promise<ReplayResult>;

package/lib/proof/page-replay.js

@@ -0,0 +1,76 @@
+import { buildReplayRequest, evaluateReplay, replayProvider } from "./replay.js";
+/** Run `fetch(...)` for `provider`'s (already-templated) request inside the
+ *  attached tab, via `Runtime.evaluate`. `credentials` selects the visitor:
+ *  `'omit'` = anonymous (the auth-bound check), `'include'` = the logged-in
+ *  user (the reproducibility gate). Same-origin only — the tab is already on
+ *  the target site; a cross-origin/CORS failure comes back as `error`. */
+async function pageFetch(backend, provider, credentials, extraSecrets) {
+    const req = buildReplayRequest(provider, extraSecrets);
+    const expression = `(async () => {
+		try {
+			const r = await fetch(${JSON.stringify(req.url)}, {
+				method: ${JSON.stringify(req.method)},
+				headers: ${JSON.stringify(req.headers)},
+				credentials: ${JSON.stringify(credentials)},${req.body !== undefined
+        ? `\n\t\t\t\tbody: ${JSON.stringify(req.body)},`
+        : ''}
+			})
+			return { status: r.status, body: await r.text() }
+		} catch(e) { return { error: String((e && e.message) || e) } }
+	})()`;
+    try {
+        const res = (await backend.sendCdp('Runtime.evaluate', {
+            expression,
+            awaitPromise: true,
+            returnByValue: true,
+        }));
+        if (res.exceptionDetails) {
+            return {
+                error: res.exceptionDetails.exception?.description
+                    ?? res.exceptionDetails.text
+                    ?? 'page fetch evaluation error',
+            };
+        }
+        return res.result?.value ?? { error: 'page fetch returned no value' };
+    }
+    catch (err) {
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** Authenticated re-issue for the reproducibility gate. Cookies ride along
+ *  via `credentials: 'include'` (a `Cookie` header can't be set from
+ *  `fetch()` — it's a forbidden header name), so only NON-cookie secrets
+ *  (Authorization, X-* tokens) are injected explicitly. */
+function authenticatedPageFetch(backend, provider, secrets) {
+    const extra = {};
+    for (const [k, v] of Object.entries(secrets)) {
+        if (k.toLowerCase() !== 'cookie') {
+            extra[k] = v;
+        }
+    }
+    return pageFetch(backend, provider, 'include', extra);
+}
+/**
+ * Replay `provider` and judge the response. Without `withoutSecrets`, replays
+ * as the logged-in session — run FROM INSIDE the live tab
+ * (`authenticatedPageFetch`) so cookies are the real browser's, which a
+ * detached call could never reproduce without manually re-deriving them.
+ * WITH `withoutSecrets` (the auth-bound check — "does this still work with
+ * no credentials, i.e. is it actually public"), replay instead through the
+ * detached Node-side `replayProvider`: the whole point of that check is to
+ * prove NO secret rides along, and the live page's own global `fetch` can't
+ * give that guarantee — a site (or a script installed via test_user_script)
+ * can wrap `fetch` and re-attach a token from localStorage/a service worker
+ * even under `credentials:'omit'`. A fresh, page-uninvolved fetch has no
+ * such surface.
+ */
+export async function replayProviderInPage(backend, provider, secrets, opts) {
+    if (opts?.withoutSecrets) {
+        return replayProvider(provider, {});
+    }
+    const result = await authenticatedPageFetch(backend, provider, secrets);
+    if (result.error !== undefined || result.status === undefined) {
+        throw new Error(`in-browser replay failed: ${result.error ?? 'no response'}`);
+    }
+    return evaluateReplay(result.status, result.body ?? '', provider);
+}

package/lib/proof/replay.d.ts

@@ -5,4 +5,32 @@ export interface ReplayResult {
     matchesOriginal: boolean;
     hints?: string[];
 }
+/** Expand `{{name}}` placeholders from `paramValues`. Matches the attestor
+ *  SDK's behavior so replay and proof both hit the same final URL. */
+export declare function expandTemplate(s: string, params: Record<string, string> | undefined): string;
+/** Build the request the wire replay actually sends: `{{name}}` placeholders
+ *  in the URL/headers/body expanded from `provider.paramValues`, secrets
+ *  layered onto the public headers. Shared by every replay transport (Node
+ *  `fetch` here, or a `fetch` run inside the live browser tab) so they all
+ *  send the identical request. */
+export interface ReplayRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+}
+export declare function buildReplayRequest(provider: ReclaimProvider, secrets: Record<string, string>): ReplayRequest;
+/**
+ * Judge a replayed response against `provider`'s matchers — the part of
+ * replay that's identical regardless of HOW the request was sent (detached
+ * Node `fetch` or a live in-browser `fetch`). Separated from the actual
+ * network call so both transports share one evaluation.
+ */
+export declare function evaluateReplay(status: number, body: string, provider: ReclaimProvider): ReplayResult;
+/** Detached Node-side replay: sends the request directly from this process,
+ *  NOT from any attached browser tab — its cookies/secrets are exactly the
+ *  `secrets` passed in, never a real browser session. Used by tests and by
+ *  any caller with no live browser to replay through (the MCP's authoring
+ *  backend instead runs the SAME request inside the attached tab — see
+ *  `proof/page-replay.ts` — so replay reflects real session cookies). */
 export declare function replayProvider(provider: ReclaimProvider, secrets: Record<string, string>): Promise<ReplayResult>;

package/lib/proof/replay.js

@@ -1,6 +1,6 @@
 /** Expand `{{name}}` placeholders from `paramValues`. Matches the attestor
  *  SDK's behavior so replay and proof both hit the same final URL. */
-function expandTemplate(s, params) {
+export function expandTemplate(s, params) {
     if (!params) {
         return s;
     }
@@ -9,7 +9,7 @@ function expandTemplate(s, params) {
         return v !== undefined ? v : match;
     });
 }
-export async function replayProvider(provider, secrets) {
+export function buildReplayRequest(provider, secrets) {
     const params = provider.paramValues;
     const url = expandTemplate(provider.url, params);
     const expandedHeaders = {};
@@ -17,21 +17,29 @@ export async function replayProvider(provider, secrets) {
         expandedHeaders[k] = expandTemplate(v, params);
     }
     const headers = { ...expandedHeaders, ...secrets };
-    const fetchInit = {
+    const body = provider.body !== undefined
+        ? expandTemplate(provider.body, params)
+        : undefined;
+    return {
+        url,
         method: provider.method,
         headers,
-        redirect: 'manual',
+        ...(body !== undefined ? { body } : {}),
     };
-    if (provider.body !== undefined) {
-        fetchInit.body = expandTemplate(provider.body, params);
-    }
-    const res = await fetch(url, fetchInit);
-    const body = await res.text();
+}
+/**
+ * Judge a replayed response against `provider`'s matchers — the part of
+ * replay that's identical regardless of HOW the request was sent (detached
+ * Node `fetch` or a live in-browser `fetch`). Separated from the actual
+ * network call so both transports share one evaluation.
+ */
+export function evaluateReplay(status, body, provider) {
+    const params = provider.paramValues;
     const hints = [];
-    if (res.status === 401 || res.status === 403) {
+    if (status === 401 || status === 403) {
         hints.push('auth/permission failed');
     }
-    if (res.status >= 500) {
+    if (status >= 500) {
         hints.push('upstream server error');
     }
     for (const m of provider.responseMatches) {
@@ -45,22 +53,35 @@ export async function replayProvider(provider, secrets) {
             value: expandTemplate(m.value, params),
         };
         if (!matchesBody(body, expanded)) {
-            if (res.status >= 200 && res.status < 300) {
+            if (status >= 200 && status < 300) {
                 hints.push(`matcher ${expanded.type} did not match — ` +
                     'value may have changed or matcher is too tight');
             }
-            const result = {
-                status: res.status,
-                body,
-                matchesOriginal: false,
-            };
+            const result = { status, body, matchesOriginal: false };
             if (hints.length > 0) {
                 result.hints = hints;
             }
             return result;
         }
     }
-    return { status: res.status, body, matchesOriginal: res.status < 400 };
+    return { status, body, matchesOriginal: status < 400 };
+}
+/** Detached Node-side replay: sends the request directly from this process,
+ *  NOT from any attached browser tab — its cookies/secrets are exactly the
+ *  `secrets` passed in, never a real browser session. Used by tests and by
+ *  any caller with no live browser to replay through (the MCP's authoring
+ *  backend instead runs the SAME request inside the attached tab — see
+ *  `proof/page-replay.ts` — so replay reflects real session cookies). */
+export async function replayProvider(provider, secrets) {
+    const req = buildReplayRequest(provider, secrets);
+    const res = await fetch(req.url, {
+        method: req.method,
+        headers: req.headers,
+        redirect: 'manual',
+        ...(req.body !== undefined ? { body: req.body } : {}),
+    });
+    const body = await res.text();
+    return evaluateReplay(res.status, body, provider);
 }
 function matchesBody(body, m) {
     if (m.type === 'regex') {

package/lib/provider/draft.d.ts

@@ -57,4 +57,6 @@ export declare function assertNoOprfUrlConflict(url: string, targets: DraftTarge
  *  header (same class of problem as {@link assertNoOprfUrlConflict} for
  *  OPRF-hashed targets, which has no such budget at all). */
 export declare function assertNoSecretUrlConflict(url: string, secrets: Record<string, string>, writeRedactionMode?: ReclaimProvider['writeRedactionMode']): void;
-export declare function draftProvider(req: CapturedRequest, targets: DraftTarget[], name: string, hash?: OprfMode): DraftResult;
+export declare function draftProvider(req: CapturedRequest, targets: DraftTarget[], name: string, hash?: OprfMode, opts?: {
+    shortenNames?: boolean;
+}): DraftResult;