@reclaimprotocol/agent 0.1.26 → 0.1.27

package/lib/live/tunnel.d.ts

@@ -2,13 +2,6 @@ import { type CloudflaredBinary } from './cloudflared.ts';
 export interface Tunnel {
     /** The public HTTPS origin Cloudflare assigned. */
     url: string;
-    /** Whether the tunnel was carrying traffic before {@link READY_TIMEOUT_MS}
-     *  elapsed. False means it may still be propagating rather than broken — say
-     *  so rather than treating the share as failed. */
-    ready: boolean;
-    /** cloudflared's own last words, for when `ready` is false and someone has
-     *  to work out why. Absent when the tunnel came up normally. */
-    diagnostics?: string;
     /** Terminate the tunnel. Safe to call more than once. */
     stop: () => Promise<void>;
     /** Which cloudflared ran, and whether we had to fetch it. */
@@ -21,6 +14,12 @@ export interface Tunnel {
  * Rejects with an actionable message when `cloudflared` is not installed,
  * exits early, or never reports a hostname.
  */
-export declare function startTunnel(port: number, { autoInstall }?: {
+export declare function startTunnel(port: number, { autoInstall, probePath, readyPollMs, readyTimeoutMs, }?: {
     autoInstall?: boolean;
+    /** Public path that must answer before the tunnel is returned. */
+    probePath?: string;
+    /** Test-only timing override. */
+    readyPollMs?: number;
+    /** Test-only timing override. */
+    readyTimeoutMs?: number;
 }): Promise<Tunnel>;

package/lib/live/tunnel.js

@@ -25,56 +25,42 @@ import { resolveCloudflared } from "./cloudflared.js";
 const URL_TIMEOUT_MS = 30000;
 /** After the hostname is printed, Cloudflare needs a moment before the edge
  *  routes to it — measured at ~3s. Wait for it so the caller never hands out a
- *  URL that errors, but don't fail the share if it's slow. */
+ *  URL that errors. */
 const READY_TIMEOUT_MS = 20000;
 const READY_POLL_MS = 1000;
+const STOP_TIMEOUT_MS = 5000;
 /** `https://<something>.trycloudflare.com`, as printed on cloudflared's log
  *  stream. Anchored to the scheme so a hostname inside prose can't match. */
 const QUICK_TUNNEL_URL = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
-/**
- * cloudflared says this once per edge connection it establishes, and until it
- * does, the hostname resolves but routes nowhere.
- *
- * This is the signal to trust, because it is LOCAL. Asking whether we can fetch
- * the public URL ourselves conflates two questions — is the tunnel up, and does
- * this machine have egress to Cloudflare's edge — and reports "not ready" when
- * only the second fails. Observed: a tunnel printed its hostname and registered
- * nothing for 12s, which is indistinguishable from a blocked fetch unless you
- * read cloudflared's own account of it.
- */
-const REGISTERED = /Registered tunnel connection|connIndex=/i;
 /** Tail of cloudflared's log kept for error messages. */
 const LOG_TAIL_BYTES = 4096;
 /**
  * Wait until the tunnel is actually carrying traffic.
  *
- * Two independent signals, either of which is proof:
- *  - cloudflared reported an edge registration (see {@link REGISTERED}). Local,
- *    so it works regardless of this machine's own egress.
- *  - the public origin answered. ANY HTTP response counts, including a 404:
- *    the live-view server 404s unknown paths, so a status code at all proves
- *    the hop is live. Kept as a second opinion in case a cloudflared release
- *    rewords its log.
+ * A cloudflared "Registered tunnel connection" log is not enough: Cloudflare
+ * can report one while the assigned hostname still returns DNS NXDOMAIN. The
+ * public viewer itself must return a successful response.
  */
-async function waitUntilRouted(url, isRegistered) {
-    const deadline = Date.now() + READY_TIMEOUT_MS;
+async function waitUntilRouted(url, { isRunning, pollMs, timeoutMs, }) {
+    const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
-        if (isRegistered()) {
-            return true;
+        if (!isRunning()) {
+            return false;
         }
         try {
-            await fetch(url, {
+            const response = await fetch(url, {
                 method: 'GET',
                 redirect: 'manual',
-                signal: AbortSignal.timeout(READY_POLL_MS * 2),
+                signal: AbortSignal.timeout(pollMs * 2),
             });
-            return true;
-        }
-        catch {
-            await new Promise((r) => setTimeout(r, READY_POLL_MS));
+            if (response.ok) {
+                return true;
+            }
         }
+        catch { }
+        await new Promise((r) => setTimeout(r, pollMs));
     }
-    return isRegistered();
+    return false;
 }
 /**
  * Open a quick tunnel to `http://127.0.0.1:<port>` and resolve once
@@ -83,7 +69,7 @@ async function waitUntilRouted(url, isRegistered) {
  * Rejects with an actionable message when `cloudflared` is not installed,
  * exits early, or never reports a hostname.
  */
-export async function startTunnel(port, { autoInstall = true } = {}) {
+export async function startTunnel(port, { autoInstall = true, probePath = '/', readyPollMs = READY_POLL_MS, readyTimeoutMs = READY_TIMEOUT_MS, } = {}) {
     // Resolves an existing cloudflared, or fetches one on first use. Throws
     // with an actionable message when neither is possible.
     const binary = await resolveCloudflared({ autoInstall });
@@ -92,20 +78,12 @@ export async function startTunnel(port, { autoInstall = true } = {}) {
         '--no-autoupdate',
         '--url', `http://127.0.0.1:${port}`,
     ], { stdio: ['ignore', 'pipe', 'pipe'] });
-    const stop = async () => {
-        if (!child.killed) {
-            child.kill('SIGTERM');
-        }
-    };
+    const exited = new Promise((resolve) => {
+        child.once('exit', () => resolve());
+    });
+    let stopPromise;
+    const stop = () => stopPromise ?? (stopPromise = stopChild());
     return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            void stop();
-            reject(new Error('cloudflared did not report a tunnel hostname within '
-                + `${URL_TIMEOUT_MS / 1000}s. Check network egress to Cloudflare, `
-                + 'or run `cloudflared tunnel --url http://127.0.0.1:'
-                + `${port}` + '` by hand to see its output.'));
-        }, URL_TIMEOUT_MS);
-        let registered = false;
         let tail = '';
         let settled = false;
         const finish = (fn) => {
@@ -116,27 +94,42 @@ export async function startTunnel(port, { autoInstall = true } = {}) {
             clearTimeout(timer);
             fn();
         };
+        const timer = setTimeout(() => {
+            finish(() => {
+                void stop().then(() => reject(new Error('cloudflared did not report a tunnel hostname within '
+                    + `${URL_TIMEOUT_MS / 1000}s. Check network egress to `
+                    + 'Cloudflare, or run `cloudflared tunnel --url '
+                    + `http://127.0.0.1:${port}` + '` by hand to see its output.')));
+            });
+        }, URL_TIMEOUT_MS);
         // cloudflared logs the assigned hostname to stderr, not stdout. Watch
         // both so a future version that switches streams still works.
         const onChunk = (chunk) => {
             const text = chunk.toString();
-            // Keep watching after the hostname: registration lands a beat later, and
-            // on a bad run it never lands at all, which is the case worth reporting.
+            // Keep watching after the hostname so a readiness failure can include
+            // cloudflared's account of what happened.
             tail = (tail + text).slice(-LOG_TAIL_BYTES);
-            if (REGISTERED.test(text)) {
-                registered = true;
-            }
             const match = QUICK_TUNNEL_URL.exec(text);
             if (match) {
                 const url = match[0];
                 finish(() => {
-                    void waitUntilRouted(url, () => registered).then((ready) => {
+                    const probeUrl = new URL(probePath, `${url}/`).toString();
+                    void waitUntilRouted(probeUrl, {
+                        isRunning: () => child.exitCode === null
+                            && child.signalCode === null,
+                        pollMs: readyPollMs,
+                        timeoutMs: readyTimeoutMs,
+                    }).then(async (ready) => {
                         if (ready) {
-                            resolve({ url, ready, stop, binary });
+                            resolve({ url, stop, binary });
                             return;
                         }
-                        LOGGER.warn({ url, tail }, 'tunnel never registered with an edge; returning anyway');
-                        resolve({ url, ready, stop, binary, diagnostics: tail });
+                        await stop();
+                        LOGGER.warn({ url, tail }, 'tunnel public URL never became reachable');
+                        reject(new Error('cloudflared created a hostname, but the public viewer did '
+                            + `not become reachable within ${readyTimeoutMs / 1000}s. `
+                            + 'Retry share_browser_view. cloudflared output:\n'
+                            + tail));
                     });
                 });
             }
@@ -157,4 +150,24 @@ export async function startTunnel(port, { autoInstall = true } = {}) {
                 + 'hostname.')));
         });
     });
+    async function stopChild() {
+        if (child.exitCode !== null || child.signalCode !== null) {
+            return;
+        }
+        let timeout;
+        const timedOut = new Promise((resolve) => {
+            timeout = setTimeout(resolve, STOP_TIMEOUT_MS);
+        });
+        child.kill('SIGTERM');
+        await Promise.race([
+            exited,
+            timedOut,
+        ]);
+        clearTimeout(timeout);
+        if (child.exitCode !== null || child.signalCode !== null) {
+            return;
+        }
+        child.kill('SIGKILL');
+        await exited;
+    }
 }

package/lib/mcp/api/operations.gen.d.ts

@@ -111,6 +111,10 @@ export declare const MCP_TOOLS: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
     };
+    ImportDevtoolsProvider: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+    };
     IssueOrgToken: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;

package/lib/mcp/api/operations.gen.js

@@ -1812,6 +1812,46 @@ export const MCP_TOOLS = {
             "additionalProperties": false
         }),
     },
+    "ImportDevtoolsProvider": {
+        description: "Import a provider from devtools\n\nImport the latest version of a public provider from the legacy devtools\nservice. Use this when moving an existing provider to Builder instead\nof recreating it.\n\nThe import preserves the legacy provider UUID. The server reads the\ncurrent configuration from\n`https://api.reclaimprotocol.org/api/providers/{providerId}` and\ntranslates it to the Builder schema.\n\nIf the provider already exists in the seeded anonymous catalog, the\nimport assigns that record to the target organization and adds the\nimported version idempotently. A provider owned by another Builder\norganization returns `409`.\n",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "body": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "orgId",
+                        "providerId"
+                    ],
+                    "properties": {
+                        "orgId": {
+                            "type": "string",
+                            "format": "uuid"
+                        },
+                        "providerId": {
+                            "type": "string",
+                            "format": "uuid"
+                        }
+                    }
+                }
+            },
+            "required": [
+                "params",
+                "query",
+                "body"
+            ],
+            "additionalProperties": false
+        }),
+    },
     "IssueOrgToken": {
         description: "Issue a new organization API key\n\nIssues a fresh per-organization API key (`rorg_…`). The caller must be an active **OWNER** of the organization. An org may hold several keys; issuing a new one does **not** invalidate existing keys (revoke those explicitly). The plaintext key is returned **only once** in this response (the server stores only its HMAC); treat it like a password.",
         inputSchema: toZod({

package/lib/mcp/instructions.js

@@ -61,6 +61,8 @@ const SHARED_TOPIC_FILES = {
 const TOPIC_SUMMARIES = {
     'overview': 'Terminology, your stance, and the whole loop at a glance.',
     'auth': 'Signing in to the backend, and which token authorizes what.',
+    'devtools-migration': 'Importing a public legacy provider with the same '
+        + 'UUID.',
     'browser': 'Choosing a browser source (local Chrome, the Reclaim runtime in '
         + 'Docker, a remote Popcorn browser, or a custom CDP endpoint), '
         + 'geolocation, live view, and launch troubleshooting.',

package/lib/mcp/tools/agent/live-view.js

@@ -83,7 +83,9 @@ export function liveViewTools(attachRef, shareRef) {
             const viewerPort = attached.viewerPort;
             assert(viewerPort, badRequest('This browser reports no live-view port. Re-attach with mode '
                 + '"container".'));
-            const tunnel = await startTunnel(viewerPort);
+            const tunnel = await startTunnel(viewerPort, {
+                probePath: '/liveview.html?magnify=1',
+            });
             // The path is the runtime's own viewer page; `magnify=1` is what makes
             // it lay out for the device that opens it.
             const url = `${tunnel.url}/liveview.html?magnify=1`;
@@ -97,30 +99,11 @@ export function liveViewTools(attachRef, shareRef) {
                 ...(share.tunnel.binary.source === 'downloaded'
                     ? { cloudflaredInstalled: true }
                     : {}),
-                ...(share.tunnel.ready
-                    ? {}
-                    : {
-                        propagating: true,
-                        // cloudflared's own last words. Without them, "the URL does
-                        // not connect" is unactionable: the tunnel, the local server
-                        // and this machine's egress all look identical from outside.
-                        ...(share.tunnel.diagnostics
-                            ? { cloudflaredLog: share.tunnel.diagnostics }
-                            : {}),
-                    }),
                 _notes: [
                     ...(share.tunnel.binary.source === 'downloaded'
                         ? ['cloudflared was not installed, so it was downloaded once '
                                 + 'to ~/.reclaim/bin. Mention that; later shares reuse it.']
                         : []),
-                    ...(share.tunnel.ready
-                        ? []
-                        : ['The tunnel never confirmed a connection to Cloudflare, so '
-                                + 'the URL may not resolve yet. Give it ~10s and reload '
-                                + 'first. If it still fails, say so and offer to retry '
-                                + '(stop_browser_view then share_browser_view) — a quick '
-                                + 'tunnel does sometimes fail to register. '
-                                + '`cloudflaredLog` has its output if it keeps happening.']),
                     'Relay `url` to the developer verbatim, on its own line.',
                     'The URL is a credential: it needs no login, and anyone with it '
                         + 'can see this browser and act in it as the signed-in user.',

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.26",
+	"version": "0.1.27",
 	"description": "Reclaim Protocol tools for AI coding agents. Reclaim lets your app verify data points about its users, such as a follower count, an account balance, or an order history. This package is the Reclaim MCP server: it gives your agent the tools to find, build, test, and fix data verification providers by capturing and replaying browser requests, drafting provider recipes, running zkTLS proofs, and publishing provider versions.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -83,7 +83,7 @@
 		"@modelcontextprotocol/sdk": "^1.29.0",
 		"@noble/hashes": "^2.2.0",
 		"@reclaimprotocol/attestor-core": "^5.0.8",
-		"@reclaimprotocol/client": "0.1.26",
+		"@reclaimprotocol/client": "0.1.27",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/skill/SKILL.builder.md

@@ -49,6 +49,22 @@ immediately with a `code` and `attachUrl` — it does NOT poll.
 The 2-day token is cached in `~/.reclaim/config.json` and reused on later runs
 (`RECLAIM_API_TOKEN` in the server env overrides it).
 
+<!-- topic: devtools-migration -->
+## Import providers from devtools
+
+Use these operations only when the developer is migrating an existing legacy
+integration. Prefer Builder for new integrations.
+
+### Import from devtools
+
+1. Get the target `orgId` with `list_orgs`.
+2. Ask the developer for the legacy provider UUID.
+3. Call `import_devtools_provider(orgId, providerId)`.
+4. Use the returned provider UUID for all Builder operations. Import preserves
+   the UUID and latest legacy semantic version. It claims an anonymous catalog
+   seed idempotently, but never moves a provider from another Builder org. The
+   server reads the public devtools API; no legacy token is required.
+
 <!-- topic: browser -->
 <!-- common: browser -->
 

package/skill/builder-mode.md

@@ -9,9 +9,9 @@ call a provider a "verification."**
 
 **Read the guide before authoring.** `how_it_works({ topic })` serves it, one
 topic at a time — call `how_it_works({})` for the topic index. Topics:
-`overview`, `auth`, `browser`, `capture`, `draft`, `params`, `prove`, `publish`,
-`discover`, `user-script`, `interception`, `hash-validation`, `credentials`,
-`never-do`, `troubleshooting`.
+`overview`, `auth`, `devtools-migration`, `browser`, `capture`, `draft`,
+`params`, `prove`, `publish`, `discover`, `user-script`, `interception`,
+`hash-validation`, `credentials`, `never-do`, `troubleshooting`.
 
 **Authentication:** try `get_me` first. On 401, `authenticate({})` returns a
 device-pairing `code` + `attachUrl` — give the user the URL, then poll

package/src/live/tunnel.ts

@@ -26,40 +26,21 @@ import { type CloudflaredBinary, resolveCloudflared } from './cloudflared.ts'
 const URL_TIMEOUT_MS = 30_000
 /** After the hostname is printed, Cloudflare needs a moment before the edge
  *  routes to it — measured at ~3s. Wait for it so the caller never hands out a
- *  URL that errors, but don't fail the share if it's slow. */
+ *  URL that errors. */
 const READY_TIMEOUT_MS = 20_000
 const READY_POLL_MS = 1_000
+const STOP_TIMEOUT_MS = 5_000
 
 /** `https://<something>.trycloudflare.com`, as printed on cloudflared's log
  *  stream. Anchored to the scheme so a hostname inside prose can't match. */
 const QUICK_TUNNEL_URL = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i
 
-/**
- * cloudflared says this once per edge connection it establishes, and until it
- * does, the hostname resolves but routes nowhere.
- *
- * This is the signal to trust, because it is LOCAL. Asking whether we can fetch
- * the public URL ourselves conflates two questions — is the tunnel up, and does
- * this machine have egress to Cloudflare's edge — and reports "not ready" when
- * only the second fails. Observed: a tunnel printed its hostname and registered
- * nothing for 12s, which is indistinguishable from a blocked fetch unless you
- * read cloudflared's own account of it.
- */
-const REGISTERED = /Registered tunnel connection|connIndex=/i
-
 /** Tail of cloudflared's log kept for error messages. */
 const LOG_TAIL_BYTES = 4096
 
 export interface Tunnel {
 	/** The public HTTPS origin Cloudflare assigned. */
 	url: string
-	/** Whether the tunnel was carrying traffic before {@link READY_TIMEOUT_MS}
-	 *  elapsed. False means it may still be propagating rather than broken — say
-	 *  so rather than treating the share as failed. */
-	ready: boolean
-	/** cloudflared's own last words, for when `ready` is false and someone has
-	 *  to work out why. Absent when the tunnel came up normally. */
-	diagnostics?: string
 	/** Terminate the tunnel. Safe to call more than once. */
 	stop: () => Promise<void>
 	/** Which cloudflared ran, and whether we had to fetch it. */
@@ -69,37 +50,43 @@ export interface Tunnel {
 /**
  * Wait until the tunnel is actually carrying traffic.
  *
- * Two independent signals, either of which is proof:
- *  - cloudflared reported an edge registration (see {@link REGISTERED}). Local,
- *    so it works regardless of this machine's own egress.
- *  - the public origin answered. ANY HTTP response counts, including a 404:
- *    the live-view server 404s unknown paths, so a status code at all proves
- *    the hop is live. Kept as a second opinion in case a cloudflared release
- *    rewords its log.
+ * A cloudflared "Registered tunnel connection" log is not enough: Cloudflare
+ * can report one while the assigned hostname still returns DNS NXDOMAIN. The
+ * public viewer itself must return a successful response.
  */
 async function waitUntilRouted(
 	url: string,
-	isRegistered: () => boolean,
+	{
+		isRunning,
+		pollMs,
+		timeoutMs,
+	}: {
+		isRunning: () => boolean
+		pollMs: number
+		timeoutMs: number
+	},
 ): Promise<boolean> {
-	const deadline = Date.now() + READY_TIMEOUT_MS
+	const deadline = Date.now() + timeoutMs
 	while(Date.now() < deadline) {
-		if(isRegistered()) {
-			return true
+		if(!isRunning()) {
+			return false
 		}
 
 		try {
-			await fetch(url, {
+			const response = await fetch(url, {
 				method: 'GET',
 				redirect: 'manual',
-				signal: AbortSignal.timeout(READY_POLL_MS * 2),
+				signal: AbortSignal.timeout(pollMs * 2),
 			})
-			return true
-		} catch{
-			await new Promise((r) => setTimeout(r, READY_POLL_MS))
-		}
+			if(response.ok) {
+				return true
+			}
+		} catch{}
+
+		await new Promise((r) => setTimeout(r, pollMs))
 	}
 
-	return isRegistered()
+	return false
 }
 
 /**
@@ -111,7 +98,20 @@ async function waitUntilRouted(
  */
 export async function startTunnel(
 	port: number,
-	{ autoInstall = true }: { autoInstall?: boolean } = {},
+	{
+		autoInstall = true,
+		probePath = '/',
+		readyPollMs = READY_POLL_MS,
+		readyTimeoutMs = READY_TIMEOUT_MS,
+	}: {
+		autoInstall?: boolean
+		/** Public path that must answer before the tunnel is returned. */
+		probePath?: string
+		/** Test-only timing override. */
+		readyPollMs?: number
+		/** Test-only timing override. */
+		readyTimeoutMs?: number
+	} = {},
 ): Promise<Tunnel> {
 	// Resolves an existing cloudflared, or fetches one on first use. Throws
 	// with an actionable message when neither is possible.
@@ -121,25 +121,14 @@ export async function startTunnel(
 		'--no-autoupdate',
 		'--url', `http://127.0.0.1:${port}`,
 	], { stdio: ['ignore', 'pipe', 'pipe'] })
+	const exited = new Promise<void>((resolve) => {
+		child.once('exit', () => resolve())
+	})
 
-	const stop = async() => {
-		if(!child.killed) {
-			child.kill('SIGTERM')
-		}
-	}
+	let stopPromise: Promise<void> | undefined
+	const stop = () => stopPromise ??= stopChild()
 
 	return new Promise<Tunnel>((resolve, reject) => {
-		const timer = setTimeout(() => {
-			void stop()
-			reject(new Error(
-				'cloudflared did not report a tunnel hostname within '
-				+ `${URL_TIMEOUT_MS / 1000}s. Check network egress to Cloudflare, `
-				+ 'or run `cloudflared tunnel --url http://127.0.0.1:'
-				+ `${port}` + '` by hand to see its output.',
-			))
-		}, URL_TIMEOUT_MS)
-
-		let registered = false
 		let tail = ''
 		let settled = false
 		const finish = (fn: () => void) => {
@@ -152,30 +141,50 @@ export async function startTunnel(
 			fn()
 		}
 
+		const timer = setTimeout(() => {
+			finish(() => {
+				void stop().then(() => reject(new Error(
+					'cloudflared did not report a tunnel hostname within '
+					+ `${URL_TIMEOUT_MS / 1000}s. Check network egress to `
+					+ 'Cloudflare, or run `cloudflared tunnel --url '
+					+ `http://127.0.0.1:${port}` + '` by hand to see its output.',
+				)))
+			})
+		}, URL_TIMEOUT_MS)
+
 		// cloudflared logs the assigned hostname to stderr, not stdout. Watch
 		// both so a future version that switches streams still works.
 		const onChunk = (chunk: Buffer) => {
 			const text = chunk.toString()
-			// Keep watching after the hostname: registration lands a beat later, and
-			// on a bad run it never lands at all, which is the case worth reporting.
+			// Keep watching after the hostname so a readiness failure can include
+			// cloudflared's account of what happened.
 			tail = (tail + text).slice(-LOG_TAIL_BYTES)
-			if(REGISTERED.test(text)) {
-				registered = true
-			}
 
 			const match = QUICK_TUNNEL_URL.exec(text)
 			if(match) {
 				const url = match[0]
 				finish(() => {
-					void waitUntilRouted(url, () => registered).then((ready) => {
+					const probeUrl = new URL(probePath, `${url}/`).toString()
+					void waitUntilRouted(probeUrl, {
+						isRunning: () => child.exitCode === null
+							&& child.signalCode === null,
+						pollMs: readyPollMs,
+						timeoutMs: readyTimeoutMs,
+					}).then(async(ready) => {
 						if(ready) {
-							resolve({ url, ready, stop, binary })
+							resolve({ url, stop, binary })
 							return
 						}
 
+						await stop()
 						LOGGER.warn({ url, tail },
-							'tunnel never registered with an edge; returning anyway')
-						resolve({ url, ready, stop, binary, diagnostics: tail })
+							'tunnel public URL never became reachable')
+						reject(new Error(
+							'cloudflared created a hostname, but the public viewer did '
+							+ `not become reachable within ${readyTimeoutMs / 1000}s. `
+							+ 'Retry share_browser_view. cloudflared output:\n'
+							+ tail,
+						))
 					})
 				})
 			}
@@ -205,4 +214,27 @@ export async function startTunnel(
 			)))
 		})
 	})
+
+	async function stopChild() {
+		if(child.exitCode !== null || child.signalCode !== null) {
+			return
+		}
+
+		let timeout: NodeJS.Timeout | undefined
+		const timedOut = new Promise<void>((resolve) => {
+			timeout = setTimeout(resolve, STOP_TIMEOUT_MS)
+		})
+		child.kill('SIGTERM')
+		await Promise.race([
+			exited,
+			timedOut,
+		])
+		clearTimeout(timeout)
+		if(child.exitCode !== null || child.signalCode !== null) {
+			return
+		}
+
+		child.kill('SIGKILL')
+		await exited
+	}
 }

package/src/mcp/api/operations.gen.ts

@@ -1886,6 +1886,50 @@ export const MCP_TOOLS = {
 			"additionalProperties": false
 		}),
 	},
+	"ImportDevtoolsProvider": {
+		description: "Import a provider from devtools\n\nImport the latest version of a public provider from the legacy devtools\nservice. Use this when moving an existing provider to Builder instead\nof recreating it.\n\nThe import preserves the legacy provider UUID. The server reads the\ncurrent configuration from\n`https://api.reclaimprotocol.org/api/providers/{providerId}` and\ntranslates it to the Builder schema.\n\nIf the provider already exists in the seeded anonymous catalog, the\nimport assigns that record to the target organization and adds the\nimported version idempotently. A provider owned by another Builder\norganization returns `409`.\n",
+		inputSchema: toZod({
+			"type": "object",
+			"properties": {
+				"params": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"query": {
+					"type": "object",
+					"properties": {
+
+					}
+				},
+				"body": {
+					"type": "object",
+					"additionalProperties": false,
+					"required": [
+						"orgId",
+						"providerId"
+					],
+					"properties": {
+						"orgId": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"providerId": {
+							"type": "string",
+							"format": "uuid"
+						}
+					}
+				}
+			},
+			"required": [
+				"params",
+				"query",
+				"body"
+			],
+			"additionalProperties": false
+		}),
+	},
 	"IssueOrgToken": {
 		description: "Issue a new organization API key\n\nIssues a fresh per-organization API key (`rorg_…`). The caller must be an active **OWNER** of the organization. An org may hold several keys; issuing a new one does **not** invalidate existing keys (revoke those explicitly). The plaintext key is returned **only once** in this response (the server stores only its HMAC); treat it like a password.",
 		inputSchema: toZod({

package/src/mcp/instructions.ts

@@ -71,6 +71,8 @@ const SHARED_TOPIC_FILES: Record<string, string> = {
 const TOPIC_SUMMARIES: Record<string, string> = {
 	'overview': 'Terminology, your stance, and the whole loop at a glance.',
 	'auth': 'Signing in to the backend, and which token authorizes what.',
+	'devtools-migration': 'Importing a public legacy provider with the same '
+		+ 'UUID.',
 	'browser': 'Choosing a browser source (local Chrome, the Reclaim runtime in '
 		+ 'Docker, a remote Popcorn browser, or a custom CDP endpoint), '
 		+ 'geolocation, live view, and launch troubleshooting.',

package/src/mcp/tools/agent/live-view.ts

@@ -113,7 +113,9 @@ export function liveViewTools(
 					+ '"container".',
 				))
 
-				const tunnel = await startTunnel(viewerPort)
+				const tunnel = await startTunnel(viewerPort, {
+					probePath: '/liveview.html?magnify=1',
+				})
 				// The path is the runtime's own viewer page; `magnify=1` is what makes
 				// it lay out for the device that opens it.
 				const url = `${tunnel.url}/liveview.html?magnify=1`
@@ -128,30 +130,11 @@ export function liveViewTools(
 					...(share.tunnel.binary.source === 'downloaded'
 						? { cloudflaredInstalled: true }
 						: {}),
-					...(share.tunnel.ready
-						? {}
-						: {
-							propagating: true,
-							// cloudflared's own last words. Without them, "the URL does
-							// not connect" is unactionable: the tunnel, the local server
-							// and this machine's egress all look identical from outside.
-							...(share.tunnel.diagnostics
-								? { cloudflaredLog: share.tunnel.diagnostics }
-								: {}),
-						}),
 					_notes: [
 						...(share.tunnel.binary.source === 'downloaded'
 							? ['cloudflared was not installed, so it was downloaded once '
 								+ 'to ~/.reclaim/bin. Mention that; later shares reuse it.']
 							: []),
-						...(share.tunnel.ready
-							? []
-							: ['The tunnel never confirmed a connection to Cloudflare, so '
-								+ 'the URL may not resolve yet. Give it ~10s and reload '
-								+ 'first. If it still fails, say so and offer to retry '
-								+ '(stop_browser_view then share_browser_view) — a quick '
-								+ 'tunnel does sometimes fail to register. '
-								+ '`cloudflaredLog` has its output if it keeps happening.']),
 						'Relay `url` to the developer verbatim, on its own line.',
 						'The URL is a credential: it needs no login, and anyone with it '
 						+ 'can see this browser and act in it as the signed-in user.',