@reclaimprotocol/agent 0.1.40 → 0.1.42

package/README.md

@@ -70,6 +70,38 @@ Defaults target the Builder backend, so **no env is needed for the common case**
 
 See [Backends](#backends) for the full env-var list.
 
+### Usage data
+
+The MCP server sends anonymous usage data to Builder so that Reclaim can see which tools developers use and where they get stuck.
+
+**What the server records**
+
+- When a session starts: the mode (Builder or devtools), whether the browser tools are on, your operating system family, your Node.js version, and the name and version of your MCP client, such as Claude Code.
+- For each tool call: the tool name, whether it succeeded, how long it took, and an error category such as `http_401`.
+- When you sign in.
+- For three tools only, the text you give them. `start_integration` records `goal` and `userRequest`. `propose_provider` records `userRequest`. `discover_resolve` records the domain and data points you search for. Don't put secrets or personal data in these fields.
+- A random client ID that the server saves in `~/.reclaim/config.json`. It isn't derived from your machine or account. After you sign in, Builder links earlier events from this client ID to your account.
+
+**What the server never records**
+
+- Any other tool argument.
+- Tool output, captured requests or responses, or file contents.
+- Error messages, tokens, keys, or cookies.
+
+**Where the data goes**
+
+Builder stores the events in its database. Builder forwards only a short list of event names and counts to Google Analytics, and never the text you typed.
+
+**Turn it off**
+
+Set `RECLAIM_TELEMETRY=0`, or set `DO_NOT_TRACK=1`, in the `env` block of your MCP client configuration. With either set, the server doesn't create a client ID and makes no analytics requests.
+
+```json
+"env": {
+  "RECLAIM_TELEMETRY": "0"
+}
+```
+
 ### Provider-authoring guide
 
 The MCP server is all you need — it ships a `how_it_works` tool that serves the capture → prove → publish guide **one topic at a time** (`overview`, `auth`, `browser`, `capture`, `draft`, `params`, `prove`, `publish`, `discover`, `user-script`, `interception`, `hash-validation`, `credentials`, `never-do`, `troubleshooting`). Call it with no arguments for the overview plus the topic index; every response repeats that index, so an agent that guessed wrong self-corrects without a second round-trip. Any MCP client can call it on demand; there's nothing extra to install.

package/lib/authoring/tools.js

@@ -394,7 +394,10 @@ export function authoringTools(resolveBackend) {
                 + 'of the site, not a bug in the draft. HTTP 403/406/429/503 or a '
                 + 'challenge page from the attestor while the replay succeeded '
                 + 'means the site blocks non-browser clients: copying headers or '
-                + 'cookies will not help, so try a different endpoint or stop.',
+                + 'cookies will not help. Try one other endpoint; if that is '
+                + 'blocked too, publish the version from the capture and have '
+                + 'the developer try a real verification '
+                + '(how_it_works({ topic: "prove" })). Do not keep retrying.',
             inputSchema: objectSchema({ draftId: { type: 'string' } }, ['draftId']),
             annotations: { openWorldHint: true, destructiveHint: false },
         }, 

package/lib/config/store.d.ts

@@ -16,6 +16,9 @@ export interface ReclaimAgentConfig {
  *   - `old_devtools`  — externally-supplied identity for OLD-devtools mode
  *                       (USE_OLD_DEVTOOLS); independent of `session`'s
  *                       builder token. Deletable with the rest of `src/old/`.
+ *   - `analytics`     — the random, anonymous client ID the usage data is
+ *                       sent under (see telemetry/telemetry.ts); holds no
+ *                       personal data
  *   - `org_keys`      — organization API keys saved by `issue_org_token`, so
  *                       the org-key tools work without the key in a transcript
  * Sections are persisted independently via `ConfigStore.write`, which
@@ -32,6 +35,10 @@ export interface ReclaimConfig {
     session?: CachedSession;
     old_devtools?: OldIdentity;
     org_keys?: SavedOrgKeys;
+    analytics?: {
+        clientId: string;
+        createdAt: string;
+    };
 }
 /** Organization API keys (`rorg_…`) saved by `issue_org_token`. */
 export interface SavedOrgKeys {

package/lib/consts.d.ts

@@ -59,6 +59,11 @@ export declare function chromePath(): string | undefined;
  *  deployments by setting `RECLAIM_AGENT_DISABLED=1`. Shared by mcp/start and
  *  the old-mode authenticate tool. */
 export declare function agentDisabled(): boolean;
+/**
+ * Whether the server may send anonymous usage data. Off when you set
+ * `RECLAIM_TELEMETRY=0` or the cross-tool `DO_NOT_TRACK=1` convention.
+ */
+export declare function telemetryEnabled(): boolean;
 /** Old-devtools backend base URL. */
 export declare function oldApiUrl(): string;
 /** Old-devtools analytics-logs service base URL (separate host). */

package/lib/consts.js

@@ -111,6 +111,16 @@ export function chromePath() {
 export function agentDisabled() {
     return process.env.RECLAIM_AGENT_DISABLED === '1';
 }
+/**
+ * Whether the server may send anonymous usage data. Off when you set
+ * `RECLAIM_TELEMETRY=0` or the cross-tool `DO_NOT_TRACK=1` convention.
+ */
+export function telemetryEnabled() {
+    const doNotTrack = process.env.DO_NOT_TRACK?.toLowerCase();
+    return process.env.RECLAIM_TELEMETRY !== '0'
+        && doNotTrack !== '1'
+        && doNotTrack !== 'true';
+}
 /** Old-devtools backend base URL. */
 export function oldApiUrl() {
     return process.env.RECLAIM_OLD_API_URL || DEFAULT_OLD_API_URL;

package/lib/mcp/api/operations.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:ecdb0ee6d82e).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:c3421d6bcf76).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -117,7 +117,11 @@ export const MCP_TOOLS = {
                             "enum": [
                                 "providers",
                                 "revenue",
-                                "usage"
+                                "usage",
+                                "goals",
+                                "tools",
+                                "agents",
+                                "funnel"
                             ]
                         }
                     }

package/lib/mcp/api/tools.js

@@ -2,6 +2,7 @@ import { unauthorized } from '@hapi/boom';
 import { ReclaimClient } from '@reclaimprotocol/client/api';
 import assert from 'node:assert';
 import { orgSecret } from "../../consts.js";
+import { startToolCall } from "../../telemetry/index.js";
 import { remapErrorAsResponse } from "../remap_errors.js";
 import { successResponse } from "../success-response.js";
 import { savedOrgKey } from "../tools/authenticate/org-key-store.js";
@@ -48,6 +49,7 @@ export function registerTools(server, client, orgClient = (orgToken) => new Recl
         // and generated names must stay disjoint (see start.ts), so a clash is a
         // bug to surface, not silently shadow.
         server.registerTool(toSnakeCase(opId), shape, async (input) => {
+            const call = startToolCall(toSnakeCase(opId), input);
             try {
                 if (!isRecord(input)) {
                     throw new Error(`Invalid generated MCP arguments for ${opId}`);
@@ -60,9 +62,11 @@ export function registerTools(server, client, orgClient = (orgToken) => new Recl
                     ? orgClient(orgTokenFor(toSnakeCase(opId), orgToken, args))
                     : client;
                 const result = await caller.call(opId, args);
+                call.end();
                 return successResponse(result.data);
             }
             catch (err) {
+                call.end(err);
                 return remapErrorAsResponse(err);
             }
         });

package/lib/mcp/server.js

@@ -1,3 +1,4 @@
+import { startToolCall } from "../telemetry/index.js";
 import { toZod } from "./api/to-zod.js";
 import { remapErrorAsResponse } from "./remap_errors.js";
 import { successResponse } from "./success-response.js";
@@ -19,10 +20,14 @@ export function registerToolList(server, tools) {
                 ? { annotations: tool.definition.annotations }
                 : {}),
         }, async (args) => {
+            const call = startToolCall(tool.definition.name, args);
             try {
-                return successResponse(await tool.handler(args));
+                const result = successResponse(await tool.handler(args));
+                call.end();
+                return result;
             }
             catch (err) {
+                call.end(err);
                 return remapErrorAsResponse(err);
             }
         });

package/lib/mcp/start.js

@@ -2,7 +2,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ReclaimClient } from '@reclaimprotocol/client/api';
 import { ConfigStore } from "../config/store.js";
-import { agentDisabled, apiToken, apiUrl, oldApiUrl, oldLogsUrl, resolveOldMode, sdkApiUrl, } from "../consts.js";
+import { agentDisabled, apiToken, apiUrl, oldApiUrl, oldLogsUrl, resolveOldMode, sdkApiUrl, telemetryEnabled, } from "../consts.js";
 import { LOGGER } from "../logger.js";
 import { ReclaimOldClient } from "../old/client.js";
 import { resolveInitialIdentity } from "../old/identity.js";
@@ -11,6 +11,7 @@ import { ReclaimSdkClient } from "../old/sdk-client.js";
 import { buildOldBackendTools } from "../old/tools/build.js";
 import { NAME, VERSION } from "../pkg.js";
 import { startZkFilesDownload } from "../proof/zk-files.js";
+import { currentTelemetry, installTelemetry, Telemetry } from "../telemetry/index.js";
 import { registerTools } from "./api/tools.js";
 import { buildAgentState, buildAgentTools, buildBuilderAuthenticationTools, buildBuilderOrganizationTools, buildCredentialTools, buildLocalCredentialTools, buildModeTools, buildVerificationTools, disposeAgentState, readSession, releaseAllListeners, sessionRefreshingFetch, stopAllForwarders, } from "./tools/index.js";
 import { BUILDER_MODE_INSTRUCTIONS } from "./instructions.js";
@@ -47,6 +48,12 @@ export async function startMcpServer() {
             }),
         headers: { 'User-Agent': `${NAME}/${VERSION}` },
     });
+    // Anonymous usage data. Installed before any tool registers so every tool
+    // call is covered. When the developer opts out, nothing is created.
+    const mode = oldMode ? 'devtools' : 'builder';
+    if (telemetryEnabled()) {
+        installTelemetry(new Telemetry({ client: builderClient, mode }));
+    }
     // Backend-mode toggle — available in both modes and regardless of whether
     // the agent tools are enabled, so a user can always switch either direction.
     registerToolList(server, buildModeTools(config, oldMode));
@@ -106,6 +113,18 @@ export async function startMcpServer() {
     if (agentToolsEnabled || !oldMode) {
         installShutdownHooks(() => agentState);
     }
+    // The client's name and version arrive in the `initialize` handshake, so
+    // the session starts only after it completes.
+    server.server.oninitialized = () => {
+        const telemetry = currentTelemetry();
+        telemetry?.setAgent(server.server.getClientVersion());
+        telemetry?.track('session_start', {
+            mode,
+            agentTools: agentToolsEnabled,
+            os: knownOs(process.platform),
+            nodeVersion: process.versions.node,
+        });
+    };
     const transport = new StdioServerTransport();
     await server.connect(transport);
     // Fetch the proof files in the background so the first proof doesn't wait
@@ -143,6 +162,7 @@ function installShutdownHooks(state) {
         void Promise.all([
             stopAllForwarders(),
             releaseAllListeners(),
+            currentTelemetry()?.close(),
             current && disposeAgentState(current),
         ])
             .catch((err) => {
@@ -159,3 +179,9 @@ function installShutdownHooks(state) {
     process.stdin.once('end', () => shutdown('stdin ended'));
     process.stdin.once('close', () => shutdown('stdin closed'));
 }
+/** Maps the platform to the values the analytics API accepts. */
+function knownOs(platform) {
+    return platform === 'darwin' || platform === 'linux' || platform === 'win32'
+        ? platform
+        : 'other';
+}

package/lib/mcp/tools/agent/proof.js

@@ -212,8 +212,10 @@ export function diagnoseBlockedClient(result, lastReplay, geoLocation) {
             + 'published version goes out from there too. Otherwise, try a '
             + 'different endpoint that returns the value, such as a JSON API the '
             + 'page calls (find_requests_containing), then propose and prove '
-            + 'that. If none works, stop and report to the developer that this '
-            + 'site blocks the attestor. Do not tweak headers.',
+            + 'that. If none works, stop retrying: publish the version from the '
+            + 'capture, unproven, and ask the developer to try a real '
+            + 'verification (how_it_works({ topic: "prove" })). Do not tweak '
+            + 'headers.',
     };
 }
 /** True when an attestor error embeds a response element (base64, from a

package/lib/mcp/tools/agent/propose.js

@@ -23,6 +23,13 @@ export function proposeTool(resolveBackend) {
         inputSchema: objectSchema({
             requestId: { type: 'string' },
             name: { type: 'string' },
+            userRequest: {
+                type: 'string',
+                maxLength: 500,
+                description: 'The developer\'s request in their own words, as they wrote it. '
+                    + 'Reclaim records this text to improve the product, so leave '
+                    + 'out secrets and personal data.',
+            },
             shortenNames: {
                 type: 'boolean',
                 description: 'Default true: shorten each target `name` to its last '

package/lib/mcp/tools/agent/publish.js

@@ -168,7 +168,10 @@ const BROWSER_REQUEST_ACTION_SCHEMA = {
 export function createVersionFromCaptureTool(client, attachRef, kept) {
     return defineTool({
         name: 'create_provider_version_from_capture',
-        description: 'Creates a new immutable provider version after `run_proof` succeeds. '
+        description: 'Creates a new immutable provider version after `run_proof` succeeds, '
+            + 'or from the captured draft when the site keeps answering replay or '
+            + 'proof with 403 past the retry budget in '
+            + 'how_it_works({ topic: "prove" }). '
             + 'Publishes the navigation script kept by `test_user_script` as '
             + '`jsUserScripts` unless `jsUserScripts` is passed. Pass exactly '
             + 'one `provider` or `providers` value returned by '

package/lib/mcp/tools/agent/replay.js

@@ -18,7 +18,9 @@ export function replayTool(resolveBackend) {
             + 'no cookies or auth headers, like an anonymous visitor. If the '
             + 'values still extract (`valid: true`), the endpoint is public and '
             + 'the proof would not bind to the user: choose an auth-bound '
-            + 'request instead.',
+            + 'request instead. A 403 that survives one retry and one '
+            + 'correction is a site defense, not a recipe bug: stop retrying '
+            + 'and publish from the capture (how_it_works({ topic: "prove" })).',
         inputSchema: objectSchema({
             draftId: { type: 'string' },
             withoutSecrets: { type: 'boolean' },

package/lib/mcp/tools/agent/start-integration.d.ts

@@ -1,6 +1,8 @@
 import { type RegisteredTool } from '../../server.ts';
 interface StartIntegrationArgs {
     goal: string;
+    /** Recorded by telemetry only; the plan ignores it. */
+    userRequest?: string;
     orgId?: string;
     providerIds?: string[];
 }

package/lib/mcp/tools/agent/start-integration.js

@@ -30,6 +30,13 @@ export function startIntegrationTool() {
                     description: 'What the developer\'s users prove, for example, "they have '
                         + 'a GitHub account with 100 followers".',
                 },
+                userRequest: {
+                    type: 'string',
+                    maxLength: 500,
+                    description: 'The developer\'s request in their own words, as they wrote it. '
+                        + 'Reclaim records this text to improve the product, so leave '
+                        + 'out secrets and personal data.',
+                },
                 orgId: {
                     type: 'string',
                     format: 'uuid',

package/lib/mcp/tools/authenticate/authenticate.js

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { createServer } from 'node:http';
 import * as oauth from 'openid-client';
+import { currentTelemetry } from "../../../telemetry/index.js";
 import { defineTool } from "../../server.js";
 import { authBaseFor, oauthRequestOptions, SCOPE, sessionFromTokens, } from "./oauth-config.js";
 import { readSession, writeSession } from "./session-cache.js";
@@ -181,6 +182,8 @@ async function beginSignIn(client, openBrowserFn) {
             });
             writeSession(session);
             client.setToken(session.token);
+            // Link this machine's earlier anonymous usage to the new account.
+            void currentTelemetry()?.signedIn();
             return { status: 'AUTHENTICATED', expiresAt: session.expiresAt };
         }
         catch (err) {

package/lib/telemetry/index.d.ts

@@ -0,0 +1,9 @@
+import type { Telemetry } from './telemetry.ts';
+export { startToolCall } from './tool-call.ts';
+export { Telemetry } from './telemetry.ts';
+/**
+ * Makes `telemetry` the instance the hooks report to. Until you call this,
+ * the hooks do nothing, which is how opt-out and tests stay silent.
+ */
+export declare function installTelemetry(telemetry: Telemetry | undefined): void;
+export declare function currentTelemetry(): Telemetry | undefined;

package/lib/telemetry/index.js

@@ -0,0 +1,13 @@
+export { startToolCall } from "./tool-call.js";
+export { Telemetry } from "./telemetry.js";
+let current;
+/**
+ * Makes `telemetry` the instance the hooks report to. Until you call this,
+ * the hooks do nothing, which is how opt-out and tests stay silent.
+ */
+export function installTelemetry(telemetry) {
+    current = telemetry;
+}
+export function currentTelemetry() {
+    return current;
+}

package/lib/telemetry/telemetry.d.ts

@@ -0,0 +1,54 @@
+import type { ReclaimClient } from '@reclaimprotocol/client/api';
+import type { IOperationArgs } from '@reclaimprotocol/client/openapi';
+import { ConfigStore } from '../config/store.ts';
+type TrackArgs = IOperationArgs<'TrackAnalyticsEvents'>;
+type Batch = TrackArgs['body'];
+type Event = Batch['events'][number];
+/** Backend mode, as the analytics API names it. */
+export type TelemetryMode = 'builder' | 'devtools';
+export interface TelemetryOptions {
+    client: ReclaimClient;
+    mode: TelemetryMode;
+    store?: ConfigStore;
+    /** How long to wait after the first queued event before sending. */
+    flushIntervalMs?: number;
+}
+/**
+ * Sends anonymous usage events to Builder. It never throws and never blocks
+ * a tool call: `track()` only queues, and a timer that doesn't keep the
+ * process alive sends the queue in the background. Failed batches are
+ * dropped, because usage data isn't worth retry loops in a tool server.
+ *
+ * Nothing is written to stdout. Stdio is the MCP transport.
+ */
+export declare class Telemetry {
+    #private;
+    readonly mode: TelemetryMode;
+    readonly clientId: string;
+    readonly sessionId: string;
+    constructor({ client, mode, store, flushIntervalMs, }: TelemetryOptions);
+    /** Records the MCP client (for example, Claude Code) that connected. */
+    setAgent(info: {
+        name: string;
+        version?: string;
+    } | undefined): void;
+    /** Queues an event. Synchronous, cheap, and safe to call anywhere. */
+    track<N extends Event['name']>(name: N, properties: Extract<Event, {
+        name: N;
+    }>['properties']): void;
+    /** Sends everything queued. Never rejects. */
+    flush(): Promise<void>;
+    /**
+     * Links this client's earlier anonymous events to the signed-in user.
+     * Needs a bearer token, so call it after sign-in.
+     */
+    identify(): Promise<void>;
+    /**
+     * Call when sign-in finishes. Sends the `login` event first so that
+     * `identify()` can attribute it to the user.
+     */
+    signedIn(): Promise<void>;
+    /** Sends what's left, waiting at most two seconds. */
+    close(): Promise<void>;
+}
+export {};

package/lib/telemetry/telemetry.js

@@ -0,0 +1,175 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _Telemetry_instances, _Telemetry_client, _Telemetry_flushIntervalMs, _Telemetry_queue, _Telemetry_timer, _Telemetry_agent, _Telemetry_sending, _Telemetry_schedule, _Telemetry_send;
+import { randomUUID } from 'node:crypto';
+import { ConfigStore } from "../config/store.js";
+import { LOGGER } from "../logger.js";
+import { VERSION } from "../pkg.js";
+/** The API accepts up to 50 events per request. */
+const MAX_BATCH = 50;
+/** Bounds memory while the backend is unreachable. Oldest events go first. */
+const MAX_QUEUE = 500;
+/** How long `close()` waits, so a slow network can't hold up exit. */
+const CLOSE_LIMIT_MS = 2000;
+/**
+ * Sends anonymous usage events to Builder. It never throws and never blocks
+ * a tool call: `track()` only queues, and a timer that doesn't keep the
+ * process alive sends the queue in the background. Failed batches are
+ * dropped, because usage data isn't worth retry loops in a tool server.
+ *
+ * Nothing is written to stdout. Stdio is the MCP transport.
+ */
+export class Telemetry {
+    constructor({ client, mode, store = new ConfigStore(), flushIntervalMs = 5000, }) {
+        _Telemetry_instances.add(this);
+        this.sessionId = String(Math.floor(Date.now() / 1000));
+        _Telemetry_client.set(this, void 0);
+        _Telemetry_flushIntervalMs.set(this, void 0);
+        _Telemetry_queue.set(this, []);
+        _Telemetry_timer.set(this, void 0);
+        _Telemetry_agent.set(this, void 0);
+        /** Serializes sends so batches go out in order. */
+        _Telemetry_sending.set(this, Promise.resolve());
+        __classPrivateFieldSet(this, _Telemetry_client, client, "f");
+        this.mode = mode;
+        __classPrivateFieldSet(this, _Telemetry_flushIntervalMs, flushIntervalMs, "f");
+        this.clientId = loadClientId(store);
+    }
+    /** Records the MCP client (for example, Claude Code) that connected. */
+    setAgent(info) {
+        if (info?.name) {
+            __classPrivateFieldSet(this, _Telemetry_agent, { name: info.name, version: info.version }, "f");
+        }
+    }
+    /** Queues an event. Synchronous, cheap, and safe to call anywhere. */
+    track(name, properties) {
+        try {
+            // The union is keyed by `name`; TypeScript can't correlate the two
+            // generic parameters, so build the event through the union type.
+            const event = {
+                id: randomUUID(),
+                name,
+                timestamp: new Date().toISOString(),
+                properties,
+            };
+            __classPrivateFieldGet(this, _Telemetry_queue, "f").push(event);
+            if (__classPrivateFieldGet(this, _Telemetry_queue, "f").length > MAX_QUEUE) {
+                __classPrivateFieldGet(this, _Telemetry_queue, "f").splice(0, __classPrivateFieldGet(this, _Telemetry_queue, "f").length - MAX_QUEUE);
+            }
+            __classPrivateFieldGet(this, _Telemetry_instances, "m", _Telemetry_schedule).call(this);
+        }
+        catch (err) {
+            LOGGER.debug({ err }, 'telemetry: track failed');
+        }
+    }
+    /** Sends everything queued. Never rejects. */
+    flush() {
+        clearTimeout(__classPrivateFieldGet(this, _Telemetry_timer, "f"));
+        __classPrivateFieldSet(this, _Telemetry_timer, undefined, "f");
+        const events = __classPrivateFieldGet(this, _Telemetry_queue, "f").splice(0);
+        if (!events.length) {
+            return __classPrivateFieldGet(this, _Telemetry_sending, "f");
+        }
+        __classPrivateFieldSet(this, _Telemetry_sending, __classPrivateFieldGet(this, _Telemetry_sending, "f").then(() => __classPrivateFieldGet(this, _Telemetry_instances, "m", _Telemetry_send).call(this, events)), "f");
+        return __classPrivateFieldGet(this, _Telemetry_sending, "f");
+    }
+    /**
+     * Links this client's earlier anonymous events to the signed-in user.
+     * Needs a bearer token, so call it after sign-in.
+     */
+    async identify() {
+        try {
+            await __classPrivateFieldGet(this, _Telemetry_client, "f").call('IdentifyAnalyticsClient', {
+                body: { clientId: this.clientId },
+            });
+        }
+        catch (err) {
+            LOGGER.debug({ err }, 'telemetry: identify failed');
+        }
+    }
+    /**
+     * Call when sign-in finishes. Sends the `login` event first so that
+     * `identify()` can attribute it to the user.
+     */
+    async signedIn() {
+        this.track('login', { method: 'oauth' });
+        await this.flush();
+        await this.identify();
+    }
+    /** Sends what's left, waiting at most two seconds. */
+    async close() {
+        let timer;
+        const limit = new Promise((resolve) => {
+            timer = setTimeout(resolve, CLOSE_LIMIT_MS);
+            timer.unref();
+        });
+        await Promise.race([this.flush(), limit]);
+        clearTimeout(timer);
+    }
+}
+_Telemetry_client = new WeakMap(), _Telemetry_flushIntervalMs = new WeakMap(), _Telemetry_queue = new WeakMap(), _Telemetry_timer = new WeakMap(), _Telemetry_agent = new WeakMap(), _Telemetry_sending = new WeakMap(), _Telemetry_instances = new WeakSet(), _Telemetry_schedule = function _Telemetry_schedule() {
+    if (__classPrivateFieldGet(this, _Telemetry_timer, "f")) {
+        return;
+    }
+    // Unref'd so a pending flush never keeps the process alive.
+    __classPrivateFieldSet(this, _Telemetry_timer, setTimeout(() => {
+        __classPrivateFieldSet(this, _Telemetry_timer, undefined, "f");
+        void this.flush();
+    }, __classPrivateFieldGet(this, _Telemetry_flushIntervalMs, "f")), "f");
+    __classPrivateFieldGet(this, _Telemetry_timer, "f").unref();
+}, _Telemetry_send = async function _Telemetry_send(events) {
+    for (let i = 0; i < events.length; i += MAX_BATCH) {
+        try {
+            await __classPrivateFieldGet(this, _Telemetry_client, "f").call('TrackAnalyticsEvents', {
+                body: {
+                    clientId: this.clientId,
+                    source: 'mcp',
+                    context: {
+                        sessionId: this.sessionId,
+                        ...(__classPrivateFieldGet(this, _Telemetry_agent, "f") ? { agent: __classPrivateFieldGet(this, _Telemetry_agent, "f") } : {}),
+                        app: { version: VERSION },
+                    },
+                    events: events.slice(i, i + MAX_BATCH),
+                },
+            });
+        }
+        catch (err) {
+            LOGGER.debug({ err }, 'telemetry: send failed; dropping batch');
+        }
+    }
+};
+/**
+ * Reads the anonymous client ID from the config file, or creates it. The ID
+ * is random and carries no information about the developer. The first time
+ * the server creates it, it tells the developer how to opt out.
+ */
+function loadClientId(store) {
+    try {
+        const existing = store.read()?.analytics?.clientId;
+        if (existing) {
+            return existing;
+        }
+        const clientId = randomUUID();
+        store.write({
+            analytics: { clientId, createdAt: new Date().toISOString() },
+        });
+        LOGGER.info('Reclaim records anonymous usage data to improve the product. '
+            + 'To turn it off, set RECLAIM_TELEMETRY=0 or DO_NOT_TRACK=1.');
+        return clientId;
+    }
+    catch (err) {
+        // An unwritable config file shouldn't disable the server. Use an ID
+        // that lasts for this process only.
+        LOGGER.debug({ err }, 'telemetry: could not persist client ID');
+        return randomUUID();
+    }
+}

package/lib/telemetry/tool-call.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Times a tool call and records it. Call `end()` once when the call
+ * finishes. It never throws, so it can't change the outcome of the call.
+ */
+export declare function startToolCall(tool: string, args: unknown): {
+    end(err?: unknown): void;
+};
+/**
+ * A category for the error, such as `http_401`. It's never the message,
+ * because messages can contain URLs, tokens, or file paths.
+ */
+export declare function errorCode(err: unknown): string;
+/**
+ * The only arguments Reclaim records, and only for these tools. They are the
+ * developer's own description of what they want to build, which tells us
+ * which providers to add. Every other argument is dropped here, so a new tool
+ * records nothing until you add it to this list on purpose.
+ */
+export declare function allowlistedInput(tool: string, args: unknown): {
+    userRequest: string | undefined;
+} | {
+    domain: string | undefined;
+    dataPoints: string[] | undefined;
+} | undefined;