@reclaimprotocol/agent 0.1.34 → 0.1.35

package/src/mcp/api/operations.gen.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:e2db795ab15c).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:de7373741e35).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -502,7 +502,7 @@ export const MCP_TOOLS = {
 		annotations: {"openWorldHint":false},
 	},
 	"CreateCallbackSubscription": {
-		description: "Register a callback subscription\n\nRegisters a destination for verification results on the organization\nthe presented `OrgToken` resolves to. The body is just `callbackUrl`\nand `events`. At least one subscription must exist for the org before a\nverification session can be created. Delivery is scoped by org: terminal\nresults are ECIES-encrypted to the org's eth public key when its\n`canEncryptResult` is enabled (see `PUT /orgs/{orgId}/keypair`), else\ndelivered as plaintext.\n",
+		description: "Register a callback subscription\n\nRegisters a destination for verification results on the organization\nthe presented `OrgToken` resolves to. At least one subscription must\nexist for the org before you can create a verification session.\nDelivery is scoped by org: terminal results are ECIES-encrypted to the\norg's eth public key when its `canEncryptResult` is enabled (see\n`PUT /orgs/{orgId}/keypair`), else delivered as plaintext.\n\nTo receive results at a URL, send `callbackUrl` and `events`. Builder\nPOSTs each delivery to that URL.\n\nTo read results without a public URL during local development, send\n`deliveryMode: \"pull\"`. Builder keeps the deliveries and you read them\nwith `GET /verifications/callback-events`. A pull subscription is a\n90-second lease: it receives events and satisfies the session-creation\ncheck only while the lease is unexpired. Send the same request about\nevery 30 seconds to renew it, and call\n`POST /verifications/callback-listener/release` when you stop. Production\nneeds a webhook subscription. An org has at most one pull subscription.\nIf it already exists, Builder renews it and returns it with status 200.\nIf the body includes `events`, they replace the subscription's events;\nif it omits them, the existing events are kept.\n",
 		inputSchema: toZod({
 			"type": "object",
 			"properties": {
@@ -519,83 +519,180 @@ export const MCP_TOOLS = {
 					}
 				},
 				"body": {
-					"type": "object",
-					"additionalProperties": false,
-					"description": "Body for `POST /verifications/callback-subscriptions`. The owning organization is resolved from the presented `OrgToken`; delivery is scoped to that org and encrypted to its credential when set.",
-					"required": [
-						"callbackUrl",
-						"events"
-					],
-					"properties": {
-						"callbackUrl": {
-							"type": "string",
-							"pattern": "^https?://",
-							"description": "Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys.",
-							"maxLength": 2000
+					"description": "Body for `POST /verifications/callback-subscriptions`. The owning organization is resolved from the presented `OrgToken`; delivery is scoped to that org and encrypted to its credential when set. Send `callbackUrl` for a webhook, or `deliveryMode: \"pull\"` for a subscription you read.",
+					"oneOf": [
+						{
+							"type": "object",
+							"additionalProperties": false,
+							"description": "A subscription that Builder POSTs each delivery to.",
+							"required": [
+								"callbackUrl",
+								"events"
+							],
+							"properties": {
+								"deliveryMode": {
+									"type": "string",
+									"description": "Omit it or send `webhook`.",
+									"enum": [
+										"webhook"
+									]
+								},
+								"callbackUrl": {
+									"type": "string",
+									"pattern": "^https?://",
+									"description": "Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys.",
+									"maxLength": 2000
+								},
+								"events": {
+									"type": "array",
+									"minItems": 1,
+									"maxItems": 51,
+									"items": {
+										"type": "string",
+										"description": "Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.",
+										"enum": [
+											"billing_required",
+											"session_pending",
+											"verification_client_opened",
+											"verification_client_ready",
+											"verification_client_warning",
+											"verification_client_visibility_shown",
+											"verification_client_visibility_hidden",
+											"verification_diagnostics_mode_changed",
+											"verification_cancelled",
+											"consent_viewed",
+											"consent_scrolled",
+											"consent_agreed",
+											"verification_browser_started",
+											"verification_browser_ready",
+											"verification_browser_reconnect_started",
+											"verification_browser_reconnected",
+											"verification_browser_failed",
+											"verification_provider_started",
+											"provider_config",
+											"provider_script_log",
+											"network_request_observed",
+											"verification_page_ready",
+											"verification_request_interceptor_ready",
+											"verification_provider_completed",
+											"auth_required",
+											"auth_submitted",
+											"auth_challenge_remains",
+											"auth_rejected",
+											"auth_submission_failed",
+											"auth_challenge_completed",
+											"auth_gate_not_detected",
+											"authenticated",
+											"user_interaction_started",
+											"user_input_started",
+											"user_interaction_summary",
+											"verification_inactivity_detected",
+											"request_matched",
+											"request_match_failed",
+											"request_claim_parameters_captured",
+											"request_claim_created",
+											"request_claim_retrying",
+											"request_claim_completed",
+											"request_claim_rejected",
+											"request_claim_failed",
+											"verification_proofs_completed",
+											"verification_result_submitting",
+											"verification_result_submission_failed",
+											"verification_success",
+											"verification_rejected",
+											"verification_error",
+											"session_expired"
+										]
+									}
+								}
+							}
 						},
-						"events": {
-							"type": "array",
-							"minItems": 1,
-							"maxItems": 51,
-							"items": {
-								"type": "string",
-								"description": "Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.",
-								"enum": [
-									"billing_required",
-									"session_pending",
-									"verification_client_opened",
-									"verification_client_ready",
-									"verification_client_warning",
-									"verification_client_visibility_shown",
-									"verification_client_visibility_hidden",
-									"verification_diagnostics_mode_changed",
-									"verification_cancelled",
-									"consent_viewed",
-									"consent_scrolled",
-									"consent_agreed",
-									"verification_browser_started",
-									"verification_browser_ready",
-									"verification_browser_reconnect_started",
-									"verification_browser_reconnected",
-									"verification_browser_failed",
-									"verification_provider_started",
-									"provider_config",
-									"provider_script_log",
-									"network_request_observed",
-									"verification_page_ready",
-									"verification_request_interceptor_ready",
-									"verification_provider_completed",
-									"auth_required",
-									"auth_submitted",
-									"auth_challenge_remains",
-									"auth_rejected",
-									"auth_submission_failed",
-									"auth_challenge_completed",
-									"auth_gate_not_detected",
-									"authenticated",
-									"user_interaction_started",
-									"user_input_started",
-									"user_interaction_summary",
-									"verification_inactivity_detected",
-									"request_matched",
-									"request_match_failed",
-									"request_claim_parameters_captured",
-									"request_claim_created",
-									"request_claim_retrying",
-									"request_claim_completed",
-									"request_claim_rejected",
-									"request_claim_failed",
-									"verification_proofs_completed",
-									"verification_result_submitting",
-									"verification_result_submission_failed",
-									"verification_success",
-									"verification_rejected",
-									"verification_error",
-									"session_expired"
-								]
+						{
+							"type": "object",
+							"additionalProperties": false,
+							"description": "A subscription whose deliveries wait for you to read them. It has no URL. An org has at most one.",
+							"required": [
+								"deliveryMode"
+							],
+							"properties": {
+								"deliveryMode": {
+									"type": "string",
+									"enum": [
+										"pull"
+									]
+								},
+								"callbackUrl": {
+									"description": "Not allowed. A pull subscription has no URL.",
+									"not": {
+
+									}
+								},
+								"events": {
+									"type": "array",
+									"description": "Events to keep. Defaults to every event.",
+									"minItems": 1,
+									"maxItems": 51,
+									"items": {
+										"type": "string",
+										"description": "Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.",
+										"enum": [
+											"billing_required",
+											"session_pending",
+											"verification_client_opened",
+											"verification_client_ready",
+											"verification_client_warning",
+											"verification_client_visibility_shown",
+											"verification_client_visibility_hidden",
+											"verification_diagnostics_mode_changed",
+											"verification_cancelled",
+											"consent_viewed",
+											"consent_scrolled",
+											"consent_agreed",
+											"verification_browser_started",
+											"verification_browser_ready",
+											"verification_browser_reconnect_started",
+											"verification_browser_reconnected",
+											"verification_browser_failed",
+											"verification_provider_started",
+											"provider_config",
+											"provider_script_log",
+											"network_request_observed",
+											"verification_page_ready",
+											"verification_request_interceptor_ready",
+											"verification_provider_completed",
+											"auth_required",
+											"auth_submitted",
+											"auth_challenge_remains",
+											"auth_rejected",
+											"auth_submission_failed",
+											"auth_challenge_completed",
+											"auth_gate_not_detected",
+											"authenticated",
+											"user_interaction_started",
+											"user_input_started",
+											"user_interaction_summary",
+											"verification_inactivity_detected",
+											"request_matched",
+											"request_match_failed",
+											"request_claim_parameters_captured",
+											"request_claim_created",
+											"request_claim_retrying",
+											"request_claim_completed",
+											"request_claim_rejected",
+											"request_claim_failed",
+											"verification_proofs_completed",
+											"verification_result_submitting",
+											"verification_result_submission_failed",
+											"verification_success",
+											"verification_rejected",
+											"verification_error",
+											"session_expired"
+										]
+									}
+								}
 							}
 						}
-					}
+					]
 				},
 				"orgToken": {
 					"type": "string",
@@ -681,83 +778,180 @@ export const MCP_TOOLS = {
 					}
 				},
 				"body": {
-					"type": "object",
-					"additionalProperties": false,
-					"description": "Body for `POST /orgs/{orgId}/callback-subscriptions`. The owning organization comes from the path; bearer-authenticated and gated on org membership. Delivery is scoped to the org and encrypted to its credential when set.",
-					"required": [
-						"callbackUrl",
-						"events"
-					],
-					"properties": {
-						"callbackUrl": {
-							"type": "string",
-							"pattern": "^https?://",
-							"description": "Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys.",
-							"maxLength": 2000
+					"description": "Body for `POST /orgs/{orgId}/callback-subscriptions`. The owning organization comes from the path; bearer-authenticated and gated on org membership. Delivery is scoped to the org and encrypted to its credential when set. Send `callbackUrl` for a webhook, or `deliveryMode: \"pull\"` for a subscription you read.",
+					"oneOf": [
+						{
+							"type": "object",
+							"additionalProperties": false,
+							"description": "A subscription that Builder POSTs each delivery to.",
+							"required": [
+								"callbackUrl",
+								"events"
+							],
+							"properties": {
+								"deliveryMode": {
+									"type": "string",
+									"description": "Omit it or send `webhook`.",
+									"enum": [
+										"webhook"
+									]
+								},
+								"callbackUrl": {
+									"type": "string",
+									"pattern": "^https?://",
+									"description": "Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys.",
+									"maxLength": 2000
+								},
+								"events": {
+									"type": "array",
+									"minItems": 1,
+									"maxItems": 51,
+									"items": {
+										"type": "string",
+										"description": "Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.",
+										"enum": [
+											"billing_required",
+											"session_pending",
+											"verification_client_opened",
+											"verification_client_ready",
+											"verification_client_warning",
+											"verification_client_visibility_shown",
+											"verification_client_visibility_hidden",
+											"verification_diagnostics_mode_changed",
+											"verification_cancelled",
+											"consent_viewed",
+											"consent_scrolled",
+											"consent_agreed",
+											"verification_browser_started",
+											"verification_browser_ready",
+											"verification_browser_reconnect_started",
+											"verification_browser_reconnected",
+											"verification_browser_failed",
+											"verification_provider_started",
+											"provider_config",
+											"provider_script_log",
+											"network_request_observed",
+											"verification_page_ready",
+											"verification_request_interceptor_ready",
+											"verification_provider_completed",
+											"auth_required",
+											"auth_submitted",
+											"auth_challenge_remains",
+											"auth_rejected",
+											"auth_submission_failed",
+											"auth_challenge_completed",
+											"auth_gate_not_detected",
+											"authenticated",
+											"user_interaction_started",
+											"user_input_started",
+											"user_interaction_summary",
+											"verification_inactivity_detected",
+											"request_matched",
+											"request_match_failed",
+											"request_claim_parameters_captured",
+											"request_claim_created",
+											"request_claim_retrying",
+											"request_claim_completed",
+											"request_claim_rejected",
+											"request_claim_failed",
+											"verification_proofs_completed",
+											"verification_result_submitting",
+											"verification_result_submission_failed",
+											"verification_success",
+											"verification_rejected",
+											"verification_error",
+											"session_expired"
+										]
+									}
+								}
+							}
 						},
-						"events": {
-							"type": "array",
-							"minItems": 1,
-							"maxItems": 51,
-							"items": {
-								"type": "string",
-								"description": "Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.",
-								"enum": [
-									"billing_required",
-									"session_pending",
-									"verification_client_opened",
-									"verification_client_ready",
-									"verification_client_warning",
-									"verification_client_visibility_shown",
-									"verification_client_visibility_hidden",
-									"verification_diagnostics_mode_changed",
-									"verification_cancelled",
-									"consent_viewed",
-									"consent_scrolled",
-									"consent_agreed",
-									"verification_browser_started",
-									"verification_browser_ready",
-									"verification_browser_reconnect_started",
-									"verification_browser_reconnected",
-									"verification_browser_failed",
-									"verification_provider_started",
-									"provider_config",
-									"provider_script_log",
-									"network_request_observed",
-									"verification_page_ready",
-									"verification_request_interceptor_ready",
-									"verification_provider_completed",
-									"auth_required",
-									"auth_submitted",
-									"auth_challenge_remains",
-									"auth_rejected",
-									"auth_submission_failed",
-									"auth_challenge_completed",
-									"auth_gate_not_detected",
-									"authenticated",
-									"user_interaction_started",
-									"user_input_started",
-									"user_interaction_summary",
-									"verification_inactivity_detected",
-									"request_matched",
-									"request_match_failed",
-									"request_claim_parameters_captured",
-									"request_claim_created",
-									"request_claim_retrying",
-									"request_claim_completed",
-									"request_claim_rejected",
-									"request_claim_failed",
-									"verification_proofs_completed",
-									"verification_result_submitting",
-									"verification_result_submission_failed",
-									"verification_success",
-									"verification_rejected",
-									"verification_error",
-									"session_expired"
-								]
+						{
+							"type": "object",
+							"additionalProperties": false,
+							"description": "A subscription whose deliveries wait for you to read them. It has no URL. An org has at most one.",
+							"required": [
+								"deliveryMode"
+							],
+							"properties": {
+								"deliveryMode": {
+									"type": "string",
+									"enum": [
+										"pull"
+									]
+								},
+								"callbackUrl": {
+									"description": "Not allowed. A pull subscription has no URL.",
+									"not": {
+
+									}
+								},
+								"events": {
+									"type": "array",
+									"description": "Events to keep. Defaults to every event.",
+									"minItems": 1,
+									"maxItems": 51,
+									"items": {
+										"type": "string",
+										"description": "Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.",
+										"enum": [
+											"billing_required",
+											"session_pending",
+											"verification_client_opened",
+											"verification_client_ready",
+											"verification_client_warning",
+											"verification_client_visibility_shown",
+											"verification_client_visibility_hidden",
+											"verification_diagnostics_mode_changed",
+											"verification_cancelled",
+											"consent_viewed",
+											"consent_scrolled",
+											"consent_agreed",
+											"verification_browser_started",
+											"verification_browser_ready",
+											"verification_browser_reconnect_started",
+											"verification_browser_reconnected",
+											"verification_browser_failed",
+											"verification_provider_started",
+											"provider_config",
+											"provider_script_log",
+											"network_request_observed",
+											"verification_page_ready",
+											"verification_request_interceptor_ready",
+											"verification_provider_completed",
+											"auth_required",
+											"auth_submitted",
+											"auth_challenge_remains",
+											"auth_rejected",
+											"auth_submission_failed",
+											"auth_challenge_completed",
+											"auth_gate_not_detected",
+											"authenticated",
+											"user_interaction_started",
+											"user_input_started",
+											"user_interaction_summary",
+											"verification_inactivity_detected",
+											"request_matched",
+											"request_match_failed",
+											"request_claim_parameters_captured",
+											"request_claim_created",
+											"request_claim_retrying",
+											"request_claim_completed",
+											"request_claim_rejected",
+											"request_claim_failed",
+											"verification_proofs_completed",
+											"verification_result_submitting",
+											"verification_result_submission_failed",
+											"verification_success",
+											"verification_rejected",
+											"verification_error",
+											"session_expired"
+										]
+									}
+								}
 							}
 						}
-					}
+					]
 				}
 			},
 			"required": [

package/src/mcp/instructions.ts

@@ -77,9 +77,9 @@ const TOPIC_SUMMARIES: Record<string, string> = {
 		+ 'providers, and going live.',
 	'discover': 'Reusing existing providers: finding, resolving, and '
 		+ 'creating a verification session.',
-	'integration': 'After start_integration: org key, callback, frontend and '
-		+ 'backend over the HTTP session API; `api=2` and result '
-		+ 'verification.',
+	'integration': 'After start_integration: org key, callback (local '
+		+ 'proxy_callback_events or deployed webhook), frontend and backend '
+		+ 'over the HTTP session API; `api=2` and result verification.',
 	'user-script': 'The navigation script (jsUserScripts): sign-in redirect, '
 		+ 'multi-page walk, test_user_script with keep.',
 	'interception': 'injectionType / interceptorType, live interception, the '

package/src/mcp/start.ts

@@ -31,6 +31,8 @@ import {
 	buildVerificationTools,
 	disposeAgentState,
 	readSession,
+	releaseAllListeners,
+	stopAllForwarders,
 } from './tools/index.ts'
 import { BUILDER_MODE_INSTRUCTIONS } from './instructions.ts'
 import { registerToolList } from './server.ts'
@@ -133,7 +135,7 @@ export async function startMcpServer() {
 	// the session can end without a single tool call: the developer closes their
 	// agent, the client kills the server, stdin drops. Nothing ran here before,
 	// which left a container up after the session that made it was gone.
-	if(agentToolsEnabled) {
+	if(agentToolsEnabled || !oldMode) {
 		installShutdownHooks(() => agentState)
 	}
 
@@ -160,11 +162,7 @@ function installShutdownHooks(state: () => AgentState | undefined): void {
 
 		shuttingDown = true
 		const current = state()
-		if(!current) {
-			process.exit(0)
-		}
-
-		LOGGER.info({ reason }, 'releasing the browser before exit')
+		LOGGER.info({ reason }, 'releasing resources before exit')
 		// Bounded: a wedged `docker stop` must not keep the process alive, but
 		// nor should we skip cleanup that would have finished in a second.
 		const timer = setTimeout(() => {
@@ -172,7 +170,11 @@ function installShutdownHooks(state: () => AgentState | undefined): void {
 			process.exit(0)
 		}, SHUTDOWN_GRACE_MS)
 		timer.unref()
-		void disposeAgentState(current)
+		void Promise.all([
+			stopAllForwarders(),
+			releaseAllListeners(),
+			current && disposeAgentState(current),
+		])
 			.catch((err: unknown) => {
 				LOGGER.warn({ err }, 'teardown failed')
 			})

package/src/mcp/tools/agent/build.ts

@@ -17,6 +17,7 @@ import { type RegisteredTool } from '../../server.ts'
 import { analyzeTool } from './analyze.ts'
 import { type AttachState, attachTool } from './attach.ts'
 import { type CaptureStore, captureTools, resetCaptures } from './capture.ts'
+import { checkAttestorTool } from './check-attestor.ts'
 import { listTabsTool } from './eval.ts'
 import { howItWorksTool } from './how-it-works.ts'
 import { liveViewTools } from './live-view.ts'
@@ -83,6 +84,7 @@ export function buildAgentTools(
 	}
 
 	tools.push(analyzeTool(state.captures))
+	tools.push(checkAttestorTool())
 	// navigate / eval_in_page / wait_for_page / get_cookies / list_requests /
 	// find_requests_containing / propose_provider / replay_request / run_proof —
 	// shared with the cloud loop, bound to each capture's local backend.