@reclaimprotocol/agent 0.1.38 → 0.1.39

package/lib/mcp/tools/agent/example-app.js

@@ -10,12 +10,13 @@
 import { badGateway, badRequest, conflict } from '@hapi/boom';
 import assert from 'node:assert';
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { mkdir, mkdtemp, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, isAbsolute, join } from 'node:path';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { mkdir, realpath, rm, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, sep } from 'node:path';
 import { defineTool } from "../../server.js";
 const REPO = 'reclaimprotocol/builder-example';
-const BACKEND_PACKAGE = join('packages', 'backend', 'package.json');
+/** GitHub tree paths are always `/`-separated, on every OS. */
+const BACKEND_PACKAGE = 'packages/backend/package.json';
 const CLIENT_PACKAGE = '@reclaimprotocol/client';
 /** The example is ~50 small files; anything far past that isn't it. */
 const MAX_FILES = 500;
@@ -44,8 +45,9 @@ export function exampleAppTool(fetchFn = fetch) {
             },
         },
         annotations: { openWorldHint: true, destructiveHint: false },
-    }, async ({ projectDir }) => {
-        assert(isAbsolute(projectDir), badRequest('`projectDir` must be an absolute path.'));
+    }, async (args) => {
+        assert(isAbsolute(args.projectDir), badRequest('`projectDir` must be an absolute path.'));
+        const projectDir = await realpath(args.projectDir);
         const commit = await latestCommit();
         const files = await listFiles(commit);
         const clientVersion = await latestClientVersion();
@@ -58,6 +60,9 @@ export function exampleAppTool(fetchFn = fetch) {
                     : bytes,
             };
         }));
+        for (const { path } of staged) {
+            assertNoSymlinks(projectDir, path);
+        }
         const conflicts = staged
             .filter(({ path, bytes }) => {
             const dest = join(projectDir, path);
@@ -67,21 +72,8 @@ export function exampleAppTool(fetchFn = fetch) {
         assert(!conflicts.length, conflict('These files already exist with different content: '
             + `${conflicts.join(', ')}. Ask the developer whether to use `
             + 'another directory or move them.'));
-        // Stage inside projectDir, so the moves below stay on one filesystem.
-        const tmp = await mkdtemp(join(projectDir, '.reclaim-example-'));
-        try {
-            for (const { path, bytes } of staged) {
-                await mkdir(dirname(join(tmp, path)), { recursive: true });
-                await writeFile(join(tmp, path), bytes);
-            }
-            for (const { path } of staged) {
-                const dest = join(projectDir, path);
-                await mkdir(dirname(dest), { recursive: true });
-                await rename(join(tmp, path), dest);
-            }
-        }
-        finally {
-            await rm(tmp, { recursive: true, force: true });
+        for (const { path, bytes } of staged) {
+            await installFile(projectDir, path, bytes);
         }
         return {
             projectDir,
@@ -142,7 +134,7 @@ export function exampleAppTool(fetchFn = fetch) {
         return bytes;
     }
     async function latestClientVersion() {
-        const res = await fetchFn(`https://registry.npmjs.org/${CLIENT_PACKAGE.replace('/', '%2f')}/latest`);
+        const res = await fetchFn(`https://registry.npmjs.org/${encodeURIComponent(CLIENT_PACKAGE)}/latest`);
         assert(res.ok, badGateway(`npm ${CLIENT_PACKAGE}: HTTP ${res.status}`));
         const body = await res.json();
         assert(typeof body === 'object' && body !== null && 'version' in body
@@ -151,6 +143,58 @@ export function exampleAppTool(fetchFn = fetch) {
         return body.version;
     }
 }
+/**
+ * Write one file under `root` without following a symlink out of it or
+ * replacing anything: each parent is created one level at a time and must be
+ * a real directory, the file is created exclusively (`wx` fails on any path
+ * that appeared since the conflict scan, symlinks included), and its real
+ * path is checked to still be inside `root` afterwards. A file already there
+ * with the same bytes (a re-run) is left as is.
+ */
+async function installFile(root, path, bytes) {
+    const parts = path.split('/');
+    let dir = root;
+    for (const part of parts.slice(0, -1)) {
+        dir = join(dir, part);
+        await mkdir(dir).catch((err) => {
+            if (!isEexist(err)) {
+                throw err;
+            }
+        });
+        assertNoSymlinks(root, relative(root, dir));
+    }
+    const dest = join(dir, parts.at(-1));
+    try {
+        await writeFile(dest, bytes, { flag: 'wx' });
+    }
+    catch (err) {
+        if (!isEexist(err)) {
+            throw err;
+        }
+        assertNoSymlinks(root, path);
+        assert(readFileSync(dest).equals(bytes), conflict(`${path} appeared with different content; nothing replaced`));
+        return;
+    }
+    const real = await realpath(dest);
+    if (!real.startsWith(root + sep)) {
+        await rm(dest, { force: true });
+        throw badRequest(`${path} resolved outside the workspace; removed it`);
+    }
+}
+function isEexist(err) {
+    return err instanceof Error && 'code' in err && err.code === 'EEXIST';
+}
+/** Throws when `path`, or any of its existing parents under `root`, is a
+ *  symlink: writing through one would land outside the workspace. */
+function assertNoSymlinks(root, path) {
+    let current = root;
+    for (const part of path.split(/[\\/]/)) {
+        current += sep + part;
+        const stat = lstatSync(current, { throwIfNoEntry: false });
+        assert(!stat?.isSymbolicLink(), badRequest(`${current} is a symlink; the example app is only written to `
+            + 'real directories inside the workspace'));
+    }
+}
 /** The backend's package.json with the client range set to `^version`. */
 function withClientVersion(bytes, version) {
     const text = bytes.toString('utf8');

package/lib/provider/draft.js

@@ -80,10 +80,11 @@ export function assertPortableMatches(matches, redactions, targets) {
     // proving an email's domain substring. Reject it regardless of the declared
     // targets (the local part is usually not itself a target, so the value scan
     // below wouldn't catch it). Strip params + named groups + regex escapes
-    // first, then look for `localpart@` as a surviving literal.
+    // first, then look for `localpart@` as a surviving literal. A placeholder
+    // never contains a brace, and `[^{}]` keeps the scan linear on `{{{{…`.
     const EMAIL_LOCAL_BAKED = /[A-Za-z0-9._%+-]{3,}@/;
     const deregex = (s) => s
-        .replace(/\{\{[^}]*\}\}/g, '')
+        .replace(/\{\{[^{}]*\}\}/g, '')
         .replace(/\(\?<[^>]*>[^)]*\)/g, '')
         .replace(/\\(.)/g, '$1');
     const scanEmail = (text, where) => {
@@ -110,7 +111,7 @@ export function assertPortableMatches(matches, redactions, targets) {
     if (!guarded.length) {
         return;
     }
-    const stripParams = (s) => s.replace(/\{\{[^}]*\}\}/g, '');
+    const stripParams = (s) => s.replace(/\{\{[^{}]*\}\}/g, '');
     const scan = (text, where, own) => {
         const bare = stripParams(text);
         for (const v of guarded) {

package/lib/provider/matcher.js

@@ -572,7 +572,7 @@ function stableOpeningTail(openTag) {
  *  content (the JSON body the attestor exposes when a jsonPath is paired with
  *  the script's xPath); otherwise undefined. */
 function scriptJsonContent(markup) {
-    const match = /^<script\b[^>]*>([\s\S]*)<\/script>\s*$/i.exec(markup);
+    const match = /^<script\b[^>]*>([\s\S]*)<\/script\b[^>]*>\s*$/i.exec(markup);
     if (!match) {
         return undefined;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.38",
+	"version": "0.1.39",
 	"description": "Reclaim Protocol tools for AI coding agents. Reclaim lets your app verify data points about its users, such as a follower count, an account balance, or an order history. This package is the Reclaim MCP server: it gives your agent the tools to find, build, test, and fix data verification providers by capturing and replaying browser requests, drafting provider recipes, running zkTLS proofs, and publishing provider versions.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -84,7 +84,7 @@
 		"@noble/hashes": "^2.2.0",
 		"@puppeteer/browsers": "3.2.4",
 		"@reclaimprotocol/attestor-core": "^5.1.6",
-		"@reclaimprotocol/client": "0.1.38",
+		"@reclaimprotocol/client": "0.1.39",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/samples/demo-server/package.json

@@ -8,6 +8,7 @@
   "dependencies": {
     "@reclaimprotocol/js-sdk": "^5.8.1",
     "dotenv": "^16.4.5",
-    "express": "^4.21.2"
+    "express": "^4.21.2",
+    "express-rate-limit": "^8.7.1"
   }
 }

package/samples/demo-server/server.js

@@ -1,4 +1,5 @@
 import express from "express";
+import { rateLimit } from "express-rate-limit";
 import "dotenv/config";
 import { ReclaimProofRequest, verifyProof } from "@reclaimprotocol/js-sdk";
 import { randomUUID } from "node:crypto";
@@ -9,8 +10,12 @@ const providerId = __PROVIDER_ID__;
 // Left unpinned by default — set this if you need to pin a specific version.
 const providerVersion = __PROVIDER_VERSION__;
 
-app.set("trust proxy", true);
+// One proxy hop (ngrok or a load balancer), so the rate limit below keys on
+// the client's address rather than the proxy's.
+app.set("trust proxy", 1);
 app.use(express.json({ limit: "2mb" }));
+// Every route verifies or creates something; cap each client's request rate.
+app.use(rateLimit({ windowMs: 60_000, limit: 60 }));
 
 app.get("/health", (_req, res) => {
   res.json({ ok: true });

package/src/mcp/tools/agent/example-app.ts

@@ -10,19 +10,14 @@
 import { badGateway, badRequest, conflict } from '@hapi/boom'
 import assert from 'node:assert'
 import { createHash } from 'node:crypto'
-import { existsSync, readFileSync } from 'node:fs'
-import {
-	mkdir,
-	mkdtemp,
-	rename,
-	rm,
-	writeFile
-} from 'node:fs/promises'
-import { dirname, isAbsolute, join } from 'node:path'
+import { existsSync, lstatSync, readFileSync } from 'node:fs'
+import { mkdir, realpath, rm, writeFile } from 'node:fs/promises'
+import { isAbsolute, join, relative, sep } from 'node:path'
 import { defineTool, type RegisteredTool } from '../../server.ts'
 
 const REPO = 'reclaimprotocol/builder-example'
-const BACKEND_PACKAGE = join('packages', 'backend', 'package.json')
+/** GitHub tree paths are always `/`-separated, on every OS. */
+const BACKEND_PACKAGE = 'packages/backend/package.json'
 const CLIENT_PACKAGE = '@reclaimprotocol/client'
 /** The example is ~50 small files; anything far past that isn't it. */
 const MAX_FILES = 500
@@ -56,11 +51,12 @@ export function exampleAppTool(fetchFn: typeof fetch = fetch): RegisteredTool {
 			},
 			annotations: { openWorldHint: true, destructiveHint: false },
 		},
-		async({ projectDir }) => {
+		async(args) => {
 			assert(
-				isAbsolute(projectDir),
+				isAbsolute(args.projectDir),
 				badRequest('`projectDir` must be an absolute path.'),
 			)
+			const projectDir = await realpath(args.projectDir)
 			const commit = await latestCommit()
 			const files = await listFiles(commit)
 			const clientVersion = await latestClientVersion()
@@ -73,6 +69,10 @@ export function exampleAppTool(fetchFn: typeof fetch = fetch): RegisteredTool {
 						: bytes,
 				}
 			}))
+			for(const { path } of staged) {
+				assertNoSymlinks(projectDir, path)
+			}
+
 			const conflicts = staged
 				.filter(({ path, bytes }) => {
 					const dest = join(projectDir, path)
@@ -88,21 +88,8 @@ export function exampleAppTool(fetchFn: typeof fetch = fetch): RegisteredTool {
 				),
 			)
 
-			// Stage inside projectDir, so the moves below stay on one filesystem.
-			const tmp = await mkdtemp(join(projectDir, '.reclaim-example-'))
-			try {
-				for(const { path, bytes } of staged) {
-					await mkdir(dirname(join(tmp, path)), { recursive: true })
-					await writeFile(join(tmp, path), bytes)
-				}
-
-				for(const { path } of staged) {
-					const dest = join(projectDir, path)
-					await mkdir(dirname(dest), { recursive: true })
-					await rename(join(tmp, path), dest)
-				}
-			} finally {
-				await rm(tmp, { recursive: true, force: true })
+			for(const { path, bytes } of staged) {
+				await installFile(projectDir, path, bytes)
 			}
 
 			return {
@@ -190,7 +177,7 @@ export function exampleAppTool(fetchFn: typeof fetch = fetch): RegisteredTool {
 
 	async function latestClientVersion() {
 		const res = await fetchFn(
-			`https://registry.npmjs.org/${CLIENT_PACKAGE.replace('/', '%2f')}/latest`,
+			`https://registry.npmjs.org/${encodeURIComponent(CLIENT_PACKAGE)}/latest`,
 		)
 		assert(res.ok, badGateway(`npm ${CLIENT_PACKAGE}: HTTP ${res.status}`))
 		const body: unknown = await res.json()
@@ -204,6 +191,71 @@ export function exampleAppTool(fetchFn: typeof fetch = fetch): RegisteredTool {
 	}
 }
 
+/**
+ * Write one file under `root` without following a symlink out of it or
+ * replacing anything: each parent is created one level at a time and must be
+ * a real directory, the file is created exclusively (`wx` fails on any path
+ * that appeared since the conflict scan, symlinks included), and its real
+ * path is checked to still be inside `root` afterwards. A file already there
+ * with the same bytes (a re-run) is left as is.
+ */
+async function installFile(root: string, path: string, bytes: Buffer) {
+	const parts = path.split('/')
+	let dir = root
+	for(const part of parts.slice(0, -1)) {
+		dir = join(dir, part)
+		await mkdir(dir).catch((err: unknown) => {
+			if(!isEexist(err)) {
+				throw err
+			}
+		})
+		assertNoSymlinks(root, relative(root, dir))
+	}
+
+	const dest = join(dir, parts.at(-1)!)
+	try {
+		await writeFile(dest, bytes, { flag: 'wx' })
+	} catch(err) {
+		if(!isEexist(err)) {
+			throw err
+		}
+
+		assertNoSymlinks(root, path)
+		assert(
+			readFileSync(dest).equals(bytes),
+			conflict(`${path} appeared with different content; nothing replaced`),
+		)
+		return
+	}
+
+	const real = await realpath(dest)
+	if(!real.startsWith(root + sep)) {
+		await rm(dest, { force: true })
+		throw badRequest(`${path} resolved outside the workspace; removed it`)
+	}
+}
+
+function isEexist(err: unknown) {
+	return err instanceof Error && 'code' in err && err.code === 'EEXIST'
+}
+
+/** Throws when `path`, or any of its existing parents under `root`, is a
+ *  symlink: writing through one would land outside the workspace. */
+function assertNoSymlinks(root: string, path: string) {
+	let current = root
+	for(const part of path.split(/[\\/]/)) {
+		current += sep + part
+		const stat = lstatSync(current, { throwIfNoEntry: false })
+		assert(
+			!stat?.isSymbolicLink(),
+			badRequest(
+				`${current} is a symlink; the example app is only written to `
+				+ 'real directories inside the workspace',
+			),
+		)
+	}
+}
+
 /** The backend's package.json with the client range set to `^version`. */
 function withClientVersion(bytes: Buffer, version: string) {
 	const text = bytes.toString('utf8')

package/src/provider/draft.ts

@@ -132,10 +132,11 @@ export function assertPortableMatches(
 	// proving an email's domain substring. Reject it regardless of the declared
 	// targets (the local part is usually not itself a target, so the value scan
 	// below wouldn't catch it). Strip params + named groups + regex escapes
-	// first, then look for `localpart@` as a surviving literal.
+	// first, then look for `localpart@` as a surviving literal. A placeholder
+	// never contains a brace, and `[^{}]` keeps the scan linear on `{{{{…`.
 	const EMAIL_LOCAL_BAKED = /[A-Za-z0-9._%+-]{3,}@/
 	const deregex = (s: string): string => s
-		.replace(/\{\{[^}]*\}\}/g, '')
+		.replace(/\{\{[^{}]*\}\}/g, '')
 		.replace(/\(\?<[^>]*>[^)]*\)/g, '')
 		.replace(/\\(.)/g, '$1')
 	const scanEmail = (text: string, where: string) => {
@@ -168,7 +169,7 @@ export function assertPortableMatches(
 		return
 	}
 
-	const stripParams = (s: string): string => s.replace(/\{\{[^}]*\}\}/g, '')
+	const stripParams = (s: string): string => s.replace(/\{\{[^{}]*\}\}/g, '')
 	const scan = (text: string, where: string, own: string | null) => {
 		const bare = stripParams(text)
 		for(const v of guarded) {

package/src/provider/matcher.ts

@@ -789,7 +789,7 @@ function stableOpeningTail(openTag: string): string {
  *  content (the JSON body the attestor exposes when a jsonPath is paired with
  *  the script's xPath); otherwise undefined. */
 function scriptJsonContent(markup: string): string | undefined {
-	const match = /^<script\b[^>]*>([\s\S]*)<\/script>\s*$/i.exec(markup)
+	const match = /^<script\b[^>]*>([\s\S]*)<\/script\b[^>]*>\s*$/i.exec(markup)
 	if(!match) {
 		return undefined
 	}