@reclaimprotocol/agent 0.1.4 → 0.1.6

package/lib/mcp/tools/agent/propose.js

@@ -1,85 +1,108 @@
-import { randomUUID } from 'node:crypto';
+/**
+ * `propose_provider` — draft a provider (recipe + captured secrets) from ONE
+ * captured request, one match + redaction per target value. Authored once as a
+ * plain {@link RegisteredTool}; hosts pass their own backend resolver. The
+ * draft (recipe + real secret header values) is held server-side under an
+ * opaque `draftId`; the result carries only the secret-free provider.
+ */
+import { objectSchema } from "../../../authoring/util.js";
 import { draftProvider } from "../../../provider/draft.js";
 import { OPRF_MAX_BYTES } from "../../../provider/matcher.js";
 import { verificationWarnings } from "../../../provider/verification-checks.js";
-import { defineTool } from "../../server.js";
-export function makeSecretStore() {
-    const map = new Map();
-    return {
-        put: (values) => {
-            const id = `sref_${randomUUID()}`;
-            map.set(id, values);
-            return id;
-        },
-        resolve: (ref) => map.get(ref),
-        clear: () => map.clear(),
-    };
-}
-export function proposeTool(captures, secrets) {
+import { defineTool } from "../../../tools/registry.js";
+export function proposeTool(resolveBackend) {
     return defineTool({
         name: 'propose_provider',
-        description: 'Draft a Reclaim provider JSON from a captured request + ' +
-            'a target value. ' +
-            'Secret header values are stored server-side and replaced with an ' +
-            'opaque secretParamsRef ' +
-            'in the response — raw secret values never appear in tool output. ' +
-            "`hash` is opt-in: when set, the captured value is OPRF'd so " +
-            'the attestor never sees ' +
-            'cleartext. Skill should ask the dev first. `oprf-raw` ' +
-            'is the only variant that runs ' +
-            'without external deps; `oprf` needs gnark (Linux/macOS), ' +
-            '`oprf-mpc` needs a TEE attestor. ' +
-            'The response may include `verificationWarnings` — advisory ' +
-            'author-only decisions (e.g. a user-specific URL part needing ' +
-            'the {{context.<name>}}-vs-bare call). Surface each to the ' +
-            'dev verbatim and resolve before publishing.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                captureId: { type: 'string' },
-                requestId: { type: 'string' },
-                target: { type: 'string' },
-                name: { type: 'string' },
-                hash: { type: 'string', enum: ['oprf-raw', 'oprf', 'oprf-mpc'] },
+        description: 'Draft a provider from ONE captured request. Pass `targets` (an '
+            + 'array): one entry per value to extract, each with its `value` '
+            + '(verbatim) and a distinct `name` (its param). The provider gets '
+            + 'one match + redaction per target. Returns a draftId + recipe '
+            + '(never secrets). Prefer a SINGLE request holding ALL values. '
+            + 'Single-value shorthand: `target` + `name`. Per-target `hash` '
+            + 'OPRF-hashes that value.',
+        inputSchema: objectSchema({
+            requestId: { type: 'string' },
+            name: { type: 'string' },
+            targets: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        value: { type: 'string' },
+                        name: { type: 'string' },
+                        hash: {
+                            type: 'string',
+                            enum: ['oprf-raw', 'oprf', 'oprf-mpc'],
+                        },
+                    },
+                    required: ['value', 'name'],
+                },
             },
-            required: ['captureId', 'requestId', 'target', 'name'],
-        },
-    }, async ({ captureId, requestId, target, name, hash }) => {
-        if (hash !== undefined && target.length > OPRF_MAX_BYTES) {
-            throw new Error(`OPRF caps hashed values at ${OPRF_MAX_BYTES} bytes; ` +
-                `got ${target.length}-byte target ` +
-                `"${target}". Try a tighter target ` +
-                '(e.g. just the relevant substring) or call ' +
-                'propose_provider without `hash`.');
+            target: { type: 'string' },
+            hash: { type: 'string', enum: ['oprf-raw', 'oprf', 'oprf-mpc'] },
+        }, ['requestId', 'name']),
+    }, async (args) => {
+        const backend = resolveBackend(args);
+        const requestId = String(args.requestId);
+        const providerName = String(args.name);
+        const defaultHash = args.hash;
+        // Explicit multi-value `targets`, else the single `target` shorthand.
+        const raw = Array.isArray(args.targets) ? args.targets : [];
+        const targets = raw.length
+            ? raw.map((t) => {
+                const o = t;
+                return {
+                    value: String(o.value),
+                    name: String(o.name),
+                    ...(typeof o.hash === 'string'
+                        ? { hash: o.hash }
+                        : {}),
+                };
+            })
+            : typeof args.target === 'string'
+                ? [{
+                        value: args.target,
+                        name: providerName,
+                        ...(defaultHash ? { hash: defaultHash } : {}),
+                    }]
+                : [];
+        if (targets.length === 0) {
+            throw new Error('propose_provider needs a `target` value or a non-empty '
+                + '`targets` array');
         }
-        const session = captures.sessions.get(captureId);
-        if (!session) {
-            throw new Error(`no capture ${captureId}`);
+        for (const t of targets) {
+            if ((t.hash ?? defaultHash) !== undefined
+                && t.value.length > OPRF_MAX_BYTES) {
+                throw new Error(`OPRF caps hashed values at ${OPRF_MAX_BYTES} bytes; got `
+                    + `${t.value.length}-byte "${t.value}". Use a tighter `
+                    + 'target or drop `hash`.');
+            }
         }
-        const r = session.requests.get(requestId);
-        if (!r) {
-            throw new Error(`no request ${requestId}`);
+        const captured = backend.capture.requests.get(requestId);
+        if (!captured) {
+            throw new Error(`no captured request ${requestId}`);
         }
-        const body = session.bodies.get(requestId);
-        if (!body.available) {
-            throw new Error(`request body unavailable: ${body.reason}`);
+        if (!captured.responseBody) {
+            throw new Error(`request body unavailable for ${requestId}`);
         }
-        const reqWithBody = { ...r, responseBody: body.body };
-        const { provider, secretRefs } = draftProvider(reqWithBody, target, name, hash);
-        // Stash real secret values for later replay/proof.
-        const realSecrets = {};
+        const { provider, secretRefs, extractions } = draftProvider(captured, targets, providerName, defaultHash);
+        // Materialize the real secret header values for later replay/prove;
+        // they stay in the server-side draft, never in this result.
+        const secrets = {};
         for (const ref of secretRefs) {
-            const real = r.requestHeaders[ref.name];
+            const real = captured.requestHeaders[ref.name];
             if (real !== undefined) {
-                realSecrets[ref.name] = real;
+                secrets[ref.name] = real;
             }
         }
-        const secretParamsRef = secrets.put(realSecrets);
+        const draftId = backend.drafts.put({
+            provider, secretRefs, secrets, requestId, extractions,
+        });
         const warnings = verificationWarnings(provider);
         return {
+            draftId,
             provider,
             secretRefs,
-            secretParamsRef,
             ...(warnings.length ? { verificationWarnings: warnings } : {}),
         };
     });

package/lib/mcp/tools/agent/publish.js

@@ -89,7 +89,7 @@ const ALLOWED_JS_REQUEST_SCHEMA = {
 export function createVersionFromCaptureTool(client) {
     return defineTool({
         name: 'create_provider_version_from_capture',
-        description: 'Persist drafted ReclaimProvider(s) as a verification version. ' +
+        description: 'Persist drafted ReclaimProvider(s) as a provider version. ' +
             'Call this after run_proof succeeds, passing the `provider` ' +
             'object(s) from propose_provider VERBATIM. This tool builds the ' +
             'body (the requests[] array, webSettings, etc.) for you — do NOT ' +
@@ -120,7 +120,7 @@ export function createVersionFromCaptureTool(client) {
             properties: {
                 providerId: {
                     type: 'string',
-                    description: 'UUID of the verification to publish the version on.',
+                    description: 'UUID of the provider to publish the version on.',
                 },
                 provider: PROVIDER_SCHEMA,
                 providers: {

package/lib/mcp/tools/agent/replay.d.ts

@@ -1,3 +1,10 @@
-import { type RegisteredTool } from '../../server.ts';
-import type { SecretStore } from './propose.ts';
-export declare function replayTool(secrets: SecretStore): RegisteredTool;
+/**
+ * `replay_request` — validate a drafted recipe before proving: confirm its
+ * selectors extract the target(s), and (with `withoutSecrets`) that the
+ * endpoint is auth-bound. Authored once as a plain {@link RegisteredTool}; the
+ * backend does the actual replay (MCP re-runs locally, cloud re-issues in the
+ * TEE pod).
+ */
+import { type ResolveBackend } from '../../../authoring/util.ts';
+import { type RegisteredTool } from '../../../tools/registry.ts';
+export declare function replayTool(resolveBackend: ResolveBackend): RegisteredTool;

package/lib/mcp/tools/agent/replay.js

@@ -1,41 +1,34 @@
-import { replayProvider } from "../../../proof/replay.js";
-import { defineTool } from "../../server.js";
-export function replayTool(secrets) {
+/**
+ * `replay_request` — validate a drafted recipe before proving: confirm its
+ * selectors extract the target(s), and (with `withoutSecrets`) that the
+ * endpoint is auth-bound. Authored once as a plain {@link RegisteredTool}; the
+ * backend does the actual replay (MCP re-runs locally, cloud re-issues in the
+ * TEE pod).
+ */
+import { objectSchema } from "../../../authoring/util.js";
+import { defineTool } from "../../../tools/registry.js";
+export function replayTool(resolveBackend) {
     return defineTool({
         name: 'replay_request',
-        description: 'Replay a drafted provider against the live endpoint ' +
-            'using Node fetch (no attestor). ' +
-            'Pre-flight gate before run_proof — ' +
-            'diagnoses CSRF / token-rotation / matcher-too-tight ' +
-            'issues with richer hints than the attestor would produce.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                provider: { type: 'object', properties: {} },
-                secretParamsRef: { type: 'string' },
-            },
-            required: ['provider'],
-        },
-    }, async ({ provider, secretParamsRef }) => {
-        let resolved = {};
-        if (secretParamsRef !== undefined) {
-            const r = secrets.resolve(secretParamsRef);
-            if (!r) {
-                throw new Error(`unknown secretParamsRef "${secretParamsRef}" — ` +
-                    'the MCP server has restarted or reset_session was called. ' +
-                    'Re-run propose_provider to mint a fresh ref.');
-            }
-            resolved = r;
+        description: 'Validate the drafted recipe before proving — confirm its selectors '
+            + 'extract the target value. Returns diagnostics; run before '
+            + 'proving. Set `withoutSecrets: true` for the AUTH-BOUND check: it '
+            + 're-issues the request with NO secrets/cookies (an anonymous '
+            + 'visitor). If the values still extract (valid:true), the endpoint '
+            + 'is PUBLIC and the proof would not bind to the user — reject it '
+            + 'and find an auth-bound request instead.',
+        inputSchema: objectSchema({
+            draftId: { type: 'string' },
+            withoutSecrets: { type: 'boolean' },
+        }, ['draftId']),
+    }, async (args) => {
+        const backend = resolveBackend(args);
+        const draft = backend.drafts.get(String(args.draftId));
+        if (!draft) {
+            throw new Error(`no draft ${String(args.draftId)}`);
         }
-        const result = await replayProvider(provider, resolved);
-        const out = {
-            status: result.status,
-            matchesOriginal: result.matchesOriginal,
-            bodySnippet: result.body.slice(0, 256),
-        };
-        if (result.hints !== undefined) {
-            out.hints = result.hints;
-        }
-        return out;
+        return backend.replay(draft, {
+            withoutSecrets: Boolean(args.withoutSecrets),
+        });
     });
 }

package/lib/mcp/tools/agent/session.d.ts

@@ -5,6 +5,4 @@ import type { CaptureStore } from './capture.ts';
 export declare function sessionTools(attachRef: {
     current?: AttachState;
     config: ConfigStore;
-}, captures: CaptureStore, secrets: {
-    clear: () => void;
-}): RegisteredTool[];
+}, captures: CaptureStore): RegisteredTool[];

package/lib/mcp/tools/agent/session.js

@@ -1,5 +1,5 @@
 import { defineTool } from "../../server.js";
-export function sessionTools(attachRef, captures, secrets) {
+export function sessionTools(attachRef, captures) {
     return [
         defineTool({
             name: 'get_session',
@@ -14,15 +14,15 @@ export function sessionTools(attachRef, captures, secrets) {
         })),
         defineTool({
             name: 'reset_session',
-            description: 'Stop all captures, drop in-memory secrets, and clear capture state.',
+            description: 'Stop all captures and clear capture state — drops every '
+                + 'session\'s drafts and their in-memory secrets.',
             inputSchema: { type: 'object', properties: {} },
         }, async () => {
-            for (const s of captures.sessions.values()) {
-                await s.stop().catch(() => { });
+            for (const entry of captures.sessions.values()) {
+                await entry.session.stop().catch(() => { });
             }
             captures.sessions.clear();
             delete captures.activeTab;
-            secrets.clear();
             return { reset: true };
         }),
     ];

package/lib/mcp/tools/agent/shared.d.ts

@@ -0,0 +1,8 @@
+import type { RegisteredTool } from '../../server.ts';
+import type { CaptureStore } from './capture.ts';
+/** The shared authoring tools mapped to the MCP's shape: resolve each call's
+ *  local backend from `args.captureId`, and widen the input schema — every tool
+ *  takes `captureId`; `run_proof` also gets the credential-aware contract. The
+ *  tools are authored plain in `../../../authoring`; this only wraps them with
+ *  `extendTool` (handlers untouched — loose arg parse keeps `captureId`). */
+export declare function sharedAuthoringTools(captures: CaptureStore): RegisteredTool[];

package/lib/mcp/tools/agent/shared.js

@@ -0,0 +1,125 @@
+/**
+ * Build the shared authoring tools for the MCP, bound to a per-capture LOCAL
+ * backend: a Chrome tab over CDP + the in-process attestor SDK. The tool logic
+ * (navigate/inspect/propose/replay/prove) is authored once in `../../../
+ * authoring` with the shared `defineTool` primitive; this only supplies the
+ * MCP host — resolve the backend from `captureId` (the session handle from
+ * `start_capture`, since one capture bundles the tab, its requests, and its
+ * drafts) and the rich, credential-aware `run_proof` schema.
+ */
+import { authoringTools, extendTool, } from "../../../authoring/index.js";
+import { runAttestorProof } from "../../../proof/attestor.js";
+import { replayProvider } from "../../../proof/replay.js";
+import { shapeRichProofResult } from "./proof.js";
+/** The local backend for one capture: drive its tab over CDP, read its
+ *  captured requests, prove via the in-process attestor, replay by re-fetch. */
+function localBackend(entry) {
+    const { tabClient, session, drafts } = entry;
+    // The per-tab CDP client is strongly typed to `keyof Commands`; the shared
+    // tools drive it with dynamic method/event names, so view it as string-keyed.
+    const client = tabClient;
+    return {
+        capture: session,
+        drafts,
+        sendCdp: (method, params) => client.send(method, params ?? {}),
+        waitForEvent: (method, timeoutMs) => new Promise((resolve) => {
+            const onEvent = () => {
+                cleanup();
+                resolve('fired');
+            };
+            const timer = setTimeout(() => {
+                cleanup();
+                resolve('timeout');
+            }, timeoutMs);
+            const cleanup = () => {
+                clearTimeout(timer);
+                client.removeListener(method, onEvent);
+            };
+            client.once(method, onEvent);
+        }),
+        replay: async (draft, opts) => {
+            // Auth-bound check: re-fetch with the secrets dropped. replayProvider
+            // already does a live Node fetch, so empty secrets == anonymous.
+            const secrets = opts?.withoutSecrets ? {} : draft.secrets;
+            const result = await replayProvider(draft.provider, secrets);
+            return {
+                status: result.status,
+                matchesOriginal: result.matchesOriginal,
+                bodySnippet: result.body.slice(0, 256),
+                ...(result.hints !== undefined ? { hints: result.hints } : {}),
+            };
+        },
+        prove: async (draft, opts) => {
+            const result = await runAttestorProof(draft.provider, draft.secrets, {
+                ...(opts?.ownerAddress ? { ownerAddress: opts.ownerAddress } : {}),
+                ...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
+            });
+            return shapeRichProofResult(result, {
+                provider: draft.provider,
+                hasSecrets: Object.keys(draft.secrets).length > 0,
+                ...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
+            });
+        },
+    };
+}
+/** The MCP's rich, credential-aware `run_proof` schema, merged onto the shared
+ *  tool by the host below (the cloud's TEE signs in-enclave, so it needs none
+ *  of this). */
+const RUN_PROOF_EXTRAS = {
+    description: 'Run a full zkTLS proof of the drafted recipe through the Reclaim '
+        + 'attestor SDK. Use only after replay_request looks right — attestor '
+        + 'calls are expensive. Writes the full claim to '
+        + '~/.reclaim/claims/<timestamp>.json and returns identifier + '
+        + 'extractedParameters + claimPath + a prettified `claim` (request '
+        + 'dropped, byte arrays as base64). With RECLAIM_AGENT_TRACE=1, also '
+        + 'writes a per-call diagnostic dump (input provider, sentParams, full '
+        + 'attestor log stream, result) and returns it as `runLogPath`. '
+        + '`attestorUrl` overrides the default only when the dev supplies a '
+        + 'specific alternative — do NOT invent backup URLs. `ownerAddress` '
+        + '(the credential to sign with) is REQUIRED — call resolve_owner_key '
+        + 'first. errorKind="missing-owner-key" means that address has no known '
+        + 'private key; re-run resolve_owner_key or issue/import a credential.',
+    properties: {
+        ownerAddress: {
+            type: 'string',
+            pattern: '^0x[0-9a-fA-F]{40}$',
+            description: 'ETH address of the credential to sign the claim with. Get it '
+                + 'from resolve_owner_key first. The private key is resolved '
+                + 'locally (cache / env / .env) — never passed here.',
+        },
+        attestorUrl: { type: 'string' },
+    },
+    required: ['ownerAddress'],
+};
+/** The shared authoring tools mapped to the MCP's shape: resolve each call's
+ *  local backend from `args.captureId`, and widen the input schema — every tool
+ *  takes `captureId`; `run_proof` also gets the credential-aware contract. The
+ *  tools are authored plain in `../../../authoring`; this only wraps them with
+ *  `extendTool` (handlers untouched — loose arg parse keeps `captureId`). */
+export function sharedAuthoringTools(captures) {
+    const resolveBackend = (args) => {
+        const captureId = String(args.captureId);
+        const entry = captures.sessions.get(captureId);
+        if (!entry) {
+            throw new Error(`no capture ${captureId} — call start_capture first `
+                + '(it has been reset or never started).');
+        }
+        return localBackend(entry);
+    };
+    return authoringTools(resolveBackend).map((tool) => {
+        if (tool.definition.name === 'run_proof') {
+            return extendTool(tool, {
+                description: RUN_PROOF_EXTRAS.description,
+                properties: {
+                    captureId: { type: 'string' },
+                    ...RUN_PROOF_EXTRAS.properties,
+                },
+                required: ['captureId', ...RUN_PROOF_EXTRAS.required],
+            });
+        }
+        return extendTool(tool, {
+            properties: { captureId: { type: 'string' } },
+            required: ['captureId'],
+        });
+    });
+}

package/lib/old/client.d.ts

@@ -32,12 +32,36 @@ export interface RegisterProviderBody {
     useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
     requestData: unknown[];
+    /** Page-injection script (old-devtools name for the builder's
+     *  `webSettings.jsUserScripts`). Top-level on register; nested under
+     *  `providerConfig` on the config (add-version) body instead. */
+    customInjection?: string;
+    /** Accepted at register too (unlike most `providerConfig` extras, which
+     *  the register controller only reads on config/add-version). */
+    userAgent?: {
+        ios?: string;
+        android?: string;
+    };
+    /** Accepted at register too. */
+    pageTitle?: string;
 }
 export interface UpdateProviderConfigBody {
     providerConfig: Record<string, unknown>;
     version: string;
     versionInfo: string;
 }
+/** Body for `POST /api/providers/:providerId` (`updateProviderMetadata`) —
+ *  a genuine PARTIAL update on the PROVIDER document itself (name/
+ *  description/providerType/tags/isActive), distinct from both `register`
+ *  (creates the provider) and `config` (adds an immutable new version). Only
+ *  the fields present get changed; everything else is left untouched. */
+export interface UpdateProviderMetadataBody {
+    name?: string;
+    description?: string;
+    providerType?: 'PRIVATE' | 'PUBLIC';
+    tags?: string[];
+    isActive?: boolean;
+}
 export interface MyProvidersQuery {
     pageKey?: number;
     pageSize?: number;
@@ -71,6 +95,17 @@ export declare class ReclaimOldClient {
     registerProvider(body: RegisterProviderBody): Promise<unknown>;
     updateProviderConfig(providerId: string, body: UpdateProviderConfigBody): Promise<unknown>;
     listVersions(providerId: string): Promise<unknown>;
+    /** Full `providerConfig` (loginUrl, customInjection, requestData, ...) for
+     *  one version — the latest when `version` is omitted. Readable for ANY
+     *  non-archived provider (not owner-restricted), same as the dashboard's
+     *  edit-form prefill fetch. */
+    getProviderConfig(providerId: string, version?: string): Promise<unknown>;
+    /** Partial update on the PROVIDER document itself — name/description/
+     *  providerType/tags/isActive, after creation. The backend 403s if you
+     *  don't own the provider (and aren't admin); other providerConfig-style
+     *  fields sent here are simply ignored (this endpoint only reads the
+     *  ones above from the body). */
+    updateProviderMetadata(providerId: string, body: UpdateProviderMetadataBody): Promise<unknown>;
     /** Analytics logs for a verification session, from the logs service (a
      *  DIFFERENT host than the devtools API — hence its own fetch, not
      *  `#request`). Attaches the caller identity when one is set; queried

package/lib/old/client.js

@@ -49,6 +49,24 @@ export class ReclaimOldClient {
     listVersions(providerId) {
         return this.#request('GET', `/providers/${encodeURIComponent(providerId)}/versions`, { auth: true });
     }
+    /** Full `providerConfig` (loginUrl, customInjection, requestData, ...) for
+     *  one version — the latest when `version` is omitted. Readable for ANY
+     *  non-archived provider (not owner-restricted), same as the dashboard's
+     *  edit-form prefill fetch. */
+    getProviderConfig(providerId, version) {
+        return this.#request('GET', `/providers/${encodeURIComponent(providerId)}/config`, {
+            auth: true,
+            query: version ? { versionNumber: version } : undefined,
+        });
+    }
+    /** Partial update on the PROVIDER document itself — name/description/
+     *  providerType/tags/isActive, after creation. The backend 403s if you
+     *  don't own the provider (and aren't admin); other providerConfig-style
+     *  fields sent here are simply ignored (this endpoint only reads the
+     *  ones above from the body). */
+    updateProviderMetadata(providerId, body) {
+        return this.#request('POST', `/providers/${encodeURIComponent(providerId)}`, { body, auth: true });
+    }
     /** Analytics logs for a verification session, from the logs service (a
      *  DIFFERENT host than the devtools API — hence its own fetch, not
      *  `#request`). Attaches the caller identity when one is set; queried

package/lib/old/login-cdp.d.ts

@@ -1,3 +1,27 @@
+/**
+ * Read the Firebase ID token the dashboard persisted after login.
+ *
+ * The frontend uses `browserLocalPersistence`, which the Firebase JS SDK
+ * implements on `localStorage` under a `firebase:authUser:<apiKey>:[DEFAULT]`
+ * key whose JSON value carries `stsTokenManager.accessToken`. We scan for any
+ * such key (so we never hard-code the project apiKey) and fall back to the
+ * IndexedDB persistence layout (`firebaseLocalStorageDb` /
+ * `firebaseLocalStorage`) in case a build switches persistence. Returns the
+ * token string, or null when the user has not finished logging in yet.
+ *
+ * The CDP-launched Chrome reuses a PERSISTENT profile dir across runs, so a
+ * stale `firebase:authUser:*` entry from an earlier (now-expired, ~1h TTL)
+ * session is often still sitting in storage the instant the page loads —
+ * before the developer has clicked anything. Returning that immediately
+ * makes the poll "succeed" on tick one, closing the tab before the developer
+ * can sign in, and the captured token then fails backend verification. So
+ * every candidate's JWT `exp` claim is checked here (in-page, where `atob` is
+ * available) and stale ones are skipped — the loop keeps polling until a
+ * genuinely fresh token shows up from an interactive sign-in.
+ *
+ * Evaluated in-page with `awaitPromise` so the async IndexedDB branch resolves.
+ */
+export declare const EXTRACT_TOKEN_JS = "(async () => {\n\tconst isFresh = (token) => {\n\t\ttry {\n\t\t\tconst payload = JSON.parse(\n\t\t\t\tatob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))\n\t\t\t)\n\t\t\t// No exp claim to check \u2014 don't block a token we can't evaluate.\n\t\t\tif (typeof payload.exp !== 'number') return true\n\t\t\t// 60s buffer so a token that's about to expire isn't treated as fresh.\n\t\t\treturn payload.exp * 1000 > Date.now() + 60000\n\t\t} catch (e) {\n\t\t\treturn true\n\t\t}\n\t}\n\ttry {\n\t\tfor (let i = 0; i < localStorage.length; i++) {\n\t\t\tconst k = localStorage.key(i)\n\t\t\tif (k && k.indexOf('firebase:authUser:') === 0) {\n\t\t\t\tconst v = JSON.parse(localStorage.getItem(k) || 'null')\n\t\t\t\tconst t = v && v.stsTokenManager && v.stsTokenManager.accessToken\n\t\t\t\tif (t && isFresh(t)) return t\n\t\t\t}\n\t\t}\n\t} catch (e) {}\n\ttry {\n\t\treturn await new Promise((resolve) => {\n\t\t\tconst req = indexedDB.open('firebaseLocalStorageDb')\n\t\t\treq.onerror = () => resolve(null)\n\t\t\treq.onsuccess = () => {\n\t\t\t\ttry {\n\t\t\t\t\tconst db = req.result\n\t\t\t\t\tif (!db.objectStoreNames.contains('firebaseLocalStorage')) {\n\t\t\t\t\t\tresolve(null); return\n\t\t\t\t\t}\n\t\t\t\t\tconst store = db\n\t\t\t\t\t\t.transaction('firebaseLocalStorage', 'readonly')\n\t\t\t\t\t\t.objectStore('firebaseLocalStorage')\n\t\t\t\t\tconst all = store.getAll()\n\t\t\t\t\tall.onerror = () => resolve(null)\n\t\t\t\t\tall.onsuccess = () => {\n\t\t\t\t\t\tfor (const row of (all.result || [])) {\n\t\t\t\t\t\t\tconst m = row && row.value && row.value.stsTokenManager\n\t\t\t\t\t\t\tif (m && m.accessToken && isFresh(m.accessToken)) {\n\t\t\t\t\t\t\t\tresolve(m.accessToken); return\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tresolve(null)\n\t\t\t\t\t}\n\t\t\t\t} catch (e) { resolve(null) }\n\t\t\t}\n\t\t})\n\t} catch (e) { return null }\n})()";
 export interface CdpLoginResult {
     token: string;
     /** True when we launched (and then closed) a dedicated Chrome just for

package/lib/old/login-cdp.js

@@ -13,16 +13,39 @@ import { DEFAULT_LOGIN_URL, oldLoginUrl } from "../consts.js";
  * `firebaseLocalStorage`) in case a build switches persistence. Returns the
  * token string, or null when the user has not finished logging in yet.
  *
+ * The CDP-launched Chrome reuses a PERSISTENT profile dir across runs, so a
+ * stale `firebase:authUser:*` entry from an earlier (now-expired, ~1h TTL)
+ * session is often still sitting in storage the instant the page loads —
+ * before the developer has clicked anything. Returning that immediately
+ * makes the poll "succeed" on tick one, closing the tab before the developer
+ * can sign in, and the captured token then fails backend verification. So
+ * every candidate's JWT `exp` claim is checked here (in-page, where `atob` is
+ * available) and stale ones are skipped — the loop keeps polling until a
+ * genuinely fresh token shows up from an interactive sign-in.
+ *
  * Evaluated in-page with `awaitPromise` so the async IndexedDB branch resolves.
  */
-const EXTRACT_TOKEN_JS = `(async () => {
+export const EXTRACT_TOKEN_JS = `(async () => {
+	const isFresh = (token) => {
+		try {
+			const payload = JSON.parse(
+				atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))
+			)
+			// No exp claim to check — don't block a token we can't evaluate.
+			if (typeof payload.exp !== 'number') return true
+			// 60s buffer so a token that's about to expire isn't treated as fresh.
+			return payload.exp * 1000 > Date.now() + 60000
+		} catch (e) {
+			return true
+		}
+	}
 	try {
 		for (let i = 0; i < localStorage.length; i++) {
 			const k = localStorage.key(i)
 			if (k && k.indexOf('firebase:authUser:') === 0) {
 				const v = JSON.parse(localStorage.getItem(k) || 'null')
 				const t = v && v.stsTokenManager && v.stsTokenManager.accessToken
-				if (t) return t
+				if (t && isFresh(t)) return t
 			}
 		}
 	} catch (e) {}
@@ -44,7 +67,9 @@ const EXTRACT_TOKEN_JS = `(async () => {
 					all.onsuccess = () => {
 						for (const row of (all.result || [])) {
 							const m = row && row.value && row.value.stsTokenManager
-							if (m && m.accessToken) { resolve(m.accessToken); return }
+							if (m && m.accessToken && isFresh(m.accessToken)) {
+								resolve(m.accessToken); return
+							}
 						}
 						resolve(null)
 					}