@reclaimprotocol/agent 0.1.5 → 0.1.6

package/src/mcp/tools/agent/shared.ts

@@ -0,0 +1,152 @@
+/**
+ * Build the shared authoring tools for the MCP, bound to a per-capture LOCAL
+ * backend: a Chrome tab over CDP + the in-process attestor SDK. The tool logic
+ * (navigate/inspect/propose/replay/prove) is authored once in `../../../
+ * authoring` with the shared `defineTool` primitive; this only supplies the
+ * MCP host — resolve the backend from `captureId` (the session handle from
+ * `start_capture`, since one capture bundles the tab, its requests, and its
+ * drafts) and the rich, credential-aware `run_proof` schema.
+ */
+import {
+	type AuthoringBackend,
+	authoringTools,
+	extendTool,
+} from '../../../authoring/index.ts'
+import { runAttestorProof } from '../../../proof/attestor.ts'
+import { replayProvider } from '../../../proof/replay.ts'
+import type { RegisteredTool } from '../../server.ts'
+import type { CaptureEntry, CaptureStore } from './capture.ts'
+import { shapeRichProofResult } from './proof.ts'
+
+/** The local backend for one capture: drive its tab over CDP, read its
+ *  captured requests, prove via the in-process attestor, replay by re-fetch. */
+function localBackend(entry: CaptureEntry): AuthoringBackend {
+	const { tabClient, session, drafts } = entry
+	// The per-tab CDP client is strongly typed to `keyof Commands`; the shared
+	// tools drive it with dynamic method/event names, so view it as string-keyed.
+	const client = tabClient as unknown as {
+		send: (method: string, params: object) => Promise<unknown>
+		once: (e: string, cb: () => void) => void
+		removeListener: (e: string, cb: () => void) => void
+	}
+
+	return {
+		capture: session,
+		drafts,
+		sendCdp: (method, params) => client.send(method, params ?? {}),
+		waitForEvent: (method, timeoutMs) => new Promise((resolve) => {
+			const onEvent = () => {
+				cleanup()
+				resolve('fired')
+			}
+
+			const timer = setTimeout(() => {
+				cleanup()
+				resolve('timeout')
+			}, timeoutMs)
+			const cleanup = () => {
+				clearTimeout(timer)
+				client.removeListener(method, onEvent)
+			}
+
+			client.once(method, onEvent)
+		}),
+		replay: async(draft, opts) => {
+			// Auth-bound check: re-fetch with the secrets dropped. replayProvider
+			// already does a live Node fetch, so empty secrets == anonymous.
+			const secrets = opts?.withoutSecrets ? {} : draft.secrets
+			const result = await replayProvider(draft.provider, secrets)
+			return {
+				status: result.status,
+				matchesOriginal: result.matchesOriginal,
+				bodySnippet: result.body.slice(0, 256),
+				...(result.hints !== undefined ? { hints: result.hints } : {}),
+			}
+		},
+		prove: async(draft, opts) => {
+			const result = await runAttestorProof(
+				draft.provider,
+				draft.secrets,
+				{
+					...(opts?.ownerAddress ? { ownerAddress: opts.ownerAddress } : {}),
+					...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
+				},
+			)
+			return shapeRichProofResult(result, {
+				provider: draft.provider,
+				hasSecrets: Object.keys(draft.secrets).length > 0,
+				...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
+			})
+		},
+	}
+}
+
+/** The MCP's rich, credential-aware `run_proof` schema, merged onto the shared
+ *  tool by the host below (the cloud's TEE signs in-enclave, so it needs none
+ *  of this). */
+const RUN_PROOF_EXTRAS = {
+	description:
+		'Run a full zkTLS proof of the drafted recipe through the Reclaim '
+		+ 'attestor SDK. Use only after replay_request looks right — attestor '
+		+ 'calls are expensive. Writes the full claim to '
+		+ '~/.reclaim/claims/<timestamp>.json and returns identifier + '
+		+ 'extractedParameters + claimPath + a prettified `claim` (request '
+		+ 'dropped, byte arrays as base64). With RECLAIM_AGENT_TRACE=1, also '
+		+ 'writes a per-call diagnostic dump (input provider, sentParams, full '
+		+ 'attestor log stream, result) and returns it as `runLogPath`. '
+		+ '`attestorUrl` overrides the default only when the dev supplies a '
+		+ 'specific alternative — do NOT invent backup URLs. `ownerAddress` '
+		+ '(the credential to sign with) is REQUIRED — call resolve_owner_key '
+		+ 'first. errorKind="missing-owner-key" means that address has no known '
+		+ 'private key; re-run resolve_owner_key or issue/import a credential.',
+	properties: {
+		ownerAddress: {
+			type: 'string',
+			pattern: '^0x[0-9a-fA-F]{40}$',
+			description:
+				'ETH address of the credential to sign the claim with. Get it '
+				+ 'from resolve_owner_key first. The private key is resolved '
+				+ 'locally (cache / env / .env) — never passed here.',
+		},
+		attestorUrl: { type: 'string' },
+	},
+	required: ['ownerAddress'],
+}
+
+/** The shared authoring tools mapped to the MCP's shape: resolve each call's
+ *  local backend from `args.captureId`, and widen the input schema — every tool
+ *  takes `captureId`; `run_proof` also gets the credential-aware contract. The
+ *  tools are authored plain in `../../../authoring`; this only wraps them with
+ *  `extendTool` (handlers untouched — loose arg parse keeps `captureId`). */
+export function sharedAuthoringTools(captures: CaptureStore): RegisteredTool[] {
+	const resolveBackend = (args: Record<string, unknown>): AuthoringBackend => {
+		const captureId = String(args.captureId)
+		const entry = captures.sessions.get(captureId)
+		if(!entry) {
+			throw new Error(
+				`no capture ${captureId} — call start_capture first `
+				+ '(it has been reset or never started).',
+			)
+		}
+
+		return localBackend(entry)
+	}
+
+	return authoringTools(resolveBackend).map((tool) => {
+		if(tool.definition.name === 'run_proof') {
+			return extendTool(tool, {
+				description: RUN_PROOF_EXTRAS.description,
+				properties: {
+					captureId: { type: 'string' },
+					...RUN_PROOF_EXTRAS.properties,
+				},
+				required: ['captureId', ...RUN_PROOF_EXTRAS.required],
+			})
+		}
+
+		return extendTool(tool, {
+			properties: { captureId: { type: 'string' } },
+			required: ['captureId'],
+		})
+	})
+}

package/src/old/client.ts

@@ -34,6 +34,15 @@ export interface RegisterProviderBody {
 	useProxy?: boolean
 	providerType?: 'PRIVATE' | 'PUBLIC'
 	requestData: unknown[]
+	/** Page-injection script (old-devtools name for the builder's
+	 *  `webSettings.jsUserScripts`). Top-level on register; nested under
+	 *  `providerConfig` on the config (add-version) body instead. */
+	customInjection?: string
+	/** Accepted at register too (unlike most `providerConfig` extras, which
+	 *  the register controller only reads on config/add-version). */
+	userAgent?: { ios?: string, android?: string }
+	/** Accepted at register too. */
+	pageTitle?: string
 }
 
 export interface UpdateProviderConfigBody {
@@ -42,6 +51,19 @@ export interface UpdateProviderConfigBody {
 	versionInfo: string
 }
 
+/** Body for `POST /api/providers/:providerId` (`updateProviderMetadata`) —
+ *  a genuine PARTIAL update on the PROVIDER document itself (name/
+ *  description/providerType/tags/isActive), distinct from both `register`
+ *  (creates the provider) and `config` (adds an immutable new version). Only
+ *  the fields present get changed; everything else is left untouched. */
+export interface UpdateProviderMetadataBody {
+	name?: string
+	description?: string
+	providerType?: 'PRIVATE' | 'PUBLIC'
+	tags?: string[]
+	isActive?: boolean
+}
+
 export interface MyProvidersQuery {
 	pageKey?: number
 	pageSize?: number
@@ -121,6 +143,40 @@ export class ReclaimOldClient {
 		)
 	}
 
+	/** Full `providerConfig` (loginUrl, customInjection, requestData, ...) for
+	 *  one version — the latest when `version` is omitted. Readable for ANY
+	 *  non-archived provider (not owner-restricted), same as the dashboard's
+	 *  edit-form prefill fetch. */
+	getProviderConfig(
+		providerId: string,
+		version?: string,
+	): Promise<unknown> {
+		return this.#request(
+			'GET',
+			`/providers/${encodeURIComponent(providerId)}/config`,
+			{
+				auth: true,
+				query: version ? { versionNumber: version } : undefined,
+			},
+		)
+	}
+
+	/** Partial update on the PROVIDER document itself — name/description/
+	 *  providerType/tags/isActive, after creation. The backend 403s if you
+	 *  don't own the provider (and aren't admin); other providerConfig-style
+	 *  fields sent here are simply ignored (this endpoint only reads the
+	 *  ones above from the body). */
+	updateProviderMetadata(
+		providerId: string,
+		body: UpdateProviderMetadataBody,
+	): Promise<unknown> {
+		return this.#request(
+			'POST',
+			`/providers/${encodeURIComponent(providerId)}`,
+			{ body, auth: true },
+		)
+	}
+
 	/** Analytics logs for a verification session, from the logs service (a
 	 *  DIFFERENT host than the devtools API — hence its own fetch, not
 	 *  `#request`). Attaches the caller identity when one is set; queried

package/src/old/login-cdp.ts

@@ -18,16 +18,39 @@ import { DEFAULT_LOGIN_URL, oldLoginUrl } from '../consts.ts'
  * `firebaseLocalStorage`) in case a build switches persistence. Returns the
  * token string, or null when the user has not finished logging in yet.
  *
+ * The CDP-launched Chrome reuses a PERSISTENT profile dir across runs, so a
+ * stale `firebase:authUser:*` entry from an earlier (now-expired, ~1h TTL)
+ * session is often still sitting in storage the instant the page loads —
+ * before the developer has clicked anything. Returning that immediately
+ * makes the poll "succeed" on tick one, closing the tab before the developer
+ * can sign in, and the captured token then fails backend verification. So
+ * every candidate's JWT `exp` claim is checked here (in-page, where `atob` is
+ * available) and stale ones are skipped — the loop keeps polling until a
+ * genuinely fresh token shows up from an interactive sign-in.
+ *
  * Evaluated in-page with `awaitPromise` so the async IndexedDB branch resolves.
  */
-const EXTRACT_TOKEN_JS = `(async () => {
+export const EXTRACT_TOKEN_JS = `(async () => {
+	const isFresh = (token) => {
+		try {
+			const payload = JSON.parse(
+				atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))
+			)
+			// No exp claim to check — don't block a token we can't evaluate.
+			if (typeof payload.exp !== 'number') return true
+			// 60s buffer so a token that's about to expire isn't treated as fresh.
+			return payload.exp * 1000 > Date.now() + 60000
+		} catch (e) {
+			return true
+		}
+	}
 	try {
 		for (let i = 0; i < localStorage.length; i++) {
 			const k = localStorage.key(i)
 			if (k && k.indexOf('firebase:authUser:') === 0) {
 				const v = JSON.parse(localStorage.getItem(k) || 'null')
 				const t = v && v.stsTokenManager && v.stsTokenManager.accessToken
-				if (t) return t
+				if (t && isFresh(t)) return t
 			}
 		}
 	} catch (e) {}
@@ -49,7 +72,9 @@ const EXTRACT_TOKEN_JS = `(async () => {
 					all.onsuccess = () => {
 						for (const row of (all.result || [])) {
 							const m = row && row.value && row.value.stsTokenManager
-							if (m && m.accessToken) { resolve(m.accessToken); return }
+							if (m && m.accessToken && isFresh(m.accessToken)) {
+								resolve(m.accessToken); return
+							}
 						}
 						resolve(null)
 					}
@@ -79,18 +104,11 @@ export async function captureFirebaseTokenViaCdp(opts: {
 	loginUrl?: string
 	timeoutMs?: number
 	pollMs?: number
-	/** Called every ~10s while waiting for the human to finish signing in, so
-	 *  MCP clients that track progress on this call can reset their own
-	 *  request timeout instead of giving up on a login that's still in
-	 *  flight (see `ToolContext` in `mcp/server.ts`). */
-	onProgress?: (message: string) => Promise<void>
 }): Promise<CdpLoginResult> {
 	const loginUrl =
 		opts.loginUrl || oldLoginUrl() || DEFAULT_LOGIN_URL
 	const timeoutMs = opts.timeoutMs ?? 180_000
 	const pollMs = opts.pollMs ?? 1000
-	const onProgress = opts.onProgress ?? (async() => {})
-	const progressIntervalMs = 10_000
 
 	const cfg = new ConfigStore().read()?.browser_agent
 	const mode = cfg?.attachMode ?? 'dedicated'
@@ -121,9 +139,7 @@ export async function captureFirebaseTokenViaCdp(opts: {
 	try {
 		const session = await handles.attachToTab(targetId)
 		const { Runtime } = session
-		const startedAt = Date.now()
-		const deadline = startedAt + timeoutMs
-		let lastProgressAt = startedAt
+		const deadline = Date.now() + timeoutMs
 		while(Date.now() < deadline) {
 			const r = await Runtime.evaluate({
 				expression: EXTRACT_TOKEN_JS,
@@ -135,16 +151,6 @@ export async function captureFirebaseTokenViaCdp(opts: {
 				return { token: value, closedBrowser: launchedByUs }
 			}
 
-			const now = Date.now()
-			if(now - lastProgressAt >= progressIntervalMs) {
-				lastProgressAt = now
-				const remainingSec = Math.round((deadline - now) / 1000)
-				await onProgress(
-					`Still waiting for sign-in at ${loginUrl} ` +
-					`(${remainingSec}s left before this call times out).`,
-				)
-			}
-
 			await new Promise((resolve) => setTimeout(resolve, pollMs))
 		}
 

package/src/old/sdk-client.ts

@@ -0,0 +1,105 @@
+import { Boom } from '@hapi/boom'
+import { NAME, VERSION } from '../pkg.ts'
+
+/**
+ * Default origin of the PUBLIC production read API that the Reclaim
+ * verification SDK/attestor itself calls at runtime to fetch a provider's
+ * recipe — a DIFFERENT service from the old-devtools dashboard backend
+ * (`ReclaimOldClient`, `devapi.reclaimprotocol.org`). Both endpoints below are
+ * unauthenticated reads (no `authenticateToken` middleware on this backend's
+ * routes), so this client needs no identity. Override with
+ * `RECLAIM_SDK_API_URL`.
+ */
+export const DEFAULT_SDK_API_URL = 'https://api.reclaimprotocol.org'
+
+/**
+ * Minimal read-only client for the public provider-info endpoints on the SDK
+ * backend (`reclaim-sdk-backend`). Two distinct reads, on purpose:
+ *
+ *   - `getProvider` (`GET /providers/:id`) — the full provider row merged
+ *     with its version's WHOLE providerConfig, `customInjection` included.
+ *   - `getProviderConfigs` (`GET /providers/:id/configs`) — the trimmed
+ *     recipe the attestor actually consumes at verification time: a fixed
+ *     field projection that explicitly OMITS `customInjection` and adds a
+ *     computed `isScriptRequestingClaim` flag instead.
+ *
+ * Errors are thrown as `@hapi/boom` so `remapErrorAsResponse` renders them
+ * the same way as every other tool in this package.
+ */
+export class ReclaimSdkClient {
+	readonly baseUrl: string
+	#fetch: typeof fetch
+
+	constructor(opts: { baseUrl?: string, fetch?: typeof fetch } = {}) {
+		this.baseUrl = (opts.baseUrl || DEFAULT_SDK_API_URL).replace(/\/+$/, '')
+		this.#fetch = opts.fetch ?? fetch
+	}
+
+	/** Full provider + providerConfig (includes `customInjection`). Latest
+	 *  version when `versionNumber` is omitted. */
+	getProvider(providerId: string, versionNumber?: string): Promise<unknown> {
+		return this.#get(
+			`/providers/${encodeURIComponent(providerId)}`,
+			versionNumber,
+		)
+	}
+
+	/** Trimmed runtime recipe (no `customInjection`; adds
+	 *  `isScriptRequestingClaim`). Latest version when `versionNumber` is
+	 *  omitted. */
+	getProviderConfigs(
+		providerId: string,
+		versionNumber?: string,
+	): Promise<unknown> {
+		return this.#get(
+			`/providers/${encodeURIComponent(providerId)}/configs`,
+			versionNumber,
+		)
+	}
+
+	async #get(path: string, versionNumber?: string): Promise<unknown> {
+		let url = `${this.baseUrl}/api${path}`
+		if(versionNumber) {
+			url += `?versionNumber=${encodeURIComponent(versionNumber)}`
+		}
+
+		const res = await this.#fetch(url, {
+			method: 'GET',
+			headers: {
+				Accept: 'application/json',
+				'User-Agent': `${NAME}/${VERSION}`,
+			},
+		})
+
+		let json: unknown
+		try {
+			json = await res.json()
+		} catch{
+			json = undefined
+		}
+
+		const failed =
+			!res.ok ||
+			(json !== undefined &&
+				typeof json === 'object' &&
+				(json as { isSuccess?: unknown }).isSuccess === false)
+		if(failed) {
+			const message =
+				(json && typeof json === 'object' &&
+					typeof (json as { message?: unknown }).message === 'string'
+					? (json as { message: string }).message
+					: undefined) || res.statusText || 'SDK backend request failed'
+			throw new Boom(message, {
+				statusCode: res.ok ? 502 : res.status,
+				data: {
+					status: res.status,
+					title: message,
+					detail: message,
+					body: json,
+				},
+			})
+		}
+
+		return json
+	}
+}

package/src/old/to-register.ts

@@ -1,4 +1,5 @@
 import type { ReclaimProvider } from '../provider/schema.ts'
+import type { AllowedJsRequest, DraftRequest } from '../provider/to-version.ts'
 import type {
 	RegisterProviderBody,
 	UpdateProviderConfigBody,
@@ -34,6 +35,30 @@ export interface OldProviderOpts {
 	/** Defaults to `true` when omitted. Register only (Provider-level flag). */
 	useProxy?: boolean
 	providerType?: 'PRIVATE' | 'PUBLIC'
+	/** Page-injection script — old-devtools' name for the builder's
+	 *  `webSettings.jsUserScripts`. Top-level on register, nested under
+	 *  `providerConfig` on config (add-version). The backend rejects a few
+	 *  deprecated injection APIs (e.g. `window.payloadData`) with a 400. */
+	customInjection?: string
+	/** Accepted at register too (unlike the four fields below, which the
+	 *  backend only accepts on config/add-version). */
+	userAgent?: { ios?: string, android?: string }
+	/** Accepted at register too. */
+	pageTitle?: string
+	/** Config (add-version) ONLY — the register endpoint hardcodes this to
+	 *  `[]` and ignores whatever is sent. Already old-backend-shaped: build
+	 *  fresh entries with {@link injectedRequestDataFrom}; a carried-forward
+	 *  value (read back from an existing version) passes through unchanged. */
+	allowedInjectedRequestData?: OldInjectedRequestData[]
+	/** Config (add-version) ONLY — the register endpoint never reads this
+	 *  field from the request body. */
+	stepsToFollow?: string
+	/** Config (add-version) ONLY — the register endpoint never reads this
+	 *  field from the request body. */
+	useIncognitoWebview?: boolean
+	/** Config (add-version) ONLY — the register endpoint never reads this
+	 *  field from the request body. Free-form JSON. */
+	extensionConfig?: unknown
 }
 
 interface OldResponseMatch {
@@ -63,8 +88,18 @@ interface OldRequestData {
 	bodySniff?: { enabled: boolean, template: string }
 }
 
-/** Build the single `requestData` entry shared by register + update. */
-function requestDataFromProvider(provider: ReclaimProvider): OldRequestData {
+/** One `allowedInjectedRequestData` entry — an `OldRequestData` plus the
+ *  pagination/optionality flags the old backend stores alongside it. */
+export interface OldInjectedRequestData extends OldRequestData {
+	required?: boolean
+	multiple?: boolean
+}
+
+/** Build the single `requestData` entry shared by register + update. Takes
+ *  the loose `DraftRequest` shape (not the full `ReclaimProvider`) so it can
+ *  build BOTH the top-level `requestData` and `allowedInjectedRequestData`
+ *  entries — a `ReclaimProvider` satisfies it structurally either way. */
+function requestDataFromProvider(provider: DraftRequest): OldRequestData {
 	const method = String(provider.method).toUpperCase()
 	if(method !== 'GET' && method !== 'POST') {
 		throw new Error(
@@ -87,14 +122,13 @@ function requestDataFromProvider(provider: ReclaimProvider): OldRequestData {
 		)
 	}
 
-	const responseMatches: OldResponseMatch[] = provider.responseMatches.map(
-		(m, i) => ({
+	const responseMatches: OldResponseMatch[] = (provider.responseMatches ?? [])
+		.map((m, i) => ({
 			value: m.value,
 			type: m.type ?? 'contains',
 			isOptional: false,
 			order: i,
-		}),
-	)
+		}))
 
 	// Old devtools wants `responseMatches` and `responseRedactions` as PARALLEL
 	// arrays — same shape the builder uses, so pass them through directly. We do
@@ -157,6 +191,22 @@ function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
 	return providers.map(requestDataFromProvider)
 }
 
+/** Translate fresh `allowedInjectedRequestData` drafts (the author's input
+ *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
+ *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  carried-forward value read back from an existing version is ALREADY in
+ *  this shape and should be passed straight through instead — don't run it
+ *  through this a second time. */
+export function injectedRequestDataFrom(
+	requests: AllowedJsRequest[],
+): OldInjectedRequestData[] {
+	return requests.map((req) => ({
+		...requestDataFromProvider(req),
+		required: req.required ?? true,
+		multiple: req.multiple ?? true,
+	}))
+}
+
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
  *  drafted request becomes a `requestData` entry; provider-level fields (name)
  *  come from the first draft. */
@@ -177,6 +227,21 @@ export function providerToRegisterBody(
 		body.description = opts.description
 	}
 
+	if(opts.customInjection !== undefined) {
+		body.customInjection = opts.customInjection
+	}
+
+	// Register also accepts these two (unlike allowedInjectedRequestData /
+	// stepsToFollow / useIncognitoWebview / extensionConfig, which the
+	// register controller never reads from the body at all).
+	if(opts.userAgent !== undefined) {
+		body.userAgent = opts.userAgent
+	}
+
+	if(opts.pageTitle !== undefined) {
+		body.pageTitle = opts.pageTitle
+	}
+
 	return body
 }
 
@@ -197,6 +262,33 @@ export function providerToConfigBody(
 		geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
 		requestData: requestDataFrom(providers),
 	}
+	if(opts.customInjection !== undefined) {
+		providerConfig.customInjection = opts.customInjection
+	}
+
+	if(opts.userAgent !== undefined) {
+		providerConfig.userAgent = opts.userAgent
+	}
+
+	if(opts.pageTitle !== undefined) {
+		providerConfig.pageTitle = opts.pageTitle
+	}
+
+	if(opts.allowedInjectedRequestData !== undefined) {
+		providerConfig.allowedInjectedRequestData = opts.allowedInjectedRequestData
+	}
+
+	if(opts.stepsToFollow !== undefined) {
+		providerConfig.stepsToFollow = opts.stepsToFollow
+	}
+
+	if(opts.useIncognitoWebview !== undefined) {
+		providerConfig.useIncognitoWebview = opts.useIncognitoWebview
+	}
+
+	if(opts.extensionConfig !== undefined) {
+		providerConfig.extensionConfig = opts.extensionConfig
+	}
 
 	return { providerConfig, version, versionInfo }
 }

package/src/old/tools/authenticate.ts

@@ -1,9 +1,5 @@
 import { agentDisabled } from '../../consts.ts'
-import {
-	defineTool,
-	type RegisteredTool,
-	type ToolContext,
-} from '../../mcp/server.ts'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
 import type { OldIdentity, ReclaimOldClient } from '../client.ts'
 import { persistIdentity, toEthUid } from '../identity.ts'
 import { captureFirebaseTokenViaCdp } from '../login-cdp.ts'
@@ -87,7 +83,7 @@ export function authenticateTool(client: ReclaimOldClient): RegisteredTool {
 				},
 			},
 		},
-		async({ token, ethAddress, loginUrl, timeoutMs, useBrowser }, ctx: ToolContext) => {
+		async({ token, ethAddress, loginUrl, timeoutMs, useBrowser }) => {
 			if(token && ethAddress) {
 				throw new Error(
 					'Provide only ONE of `token` or `ethAddress`, not both.',
@@ -140,11 +136,7 @@ export function authenticateTool(client: ReclaimOldClient): RegisteredTool {
 				)
 			}
 
-			const result = await captureFirebaseTokenViaCdp({
-				loginUrl,
-				timeoutMs,
-				onProgress: ctx.reportProgress,
-			})
+			const result = await captureFirebaseTokenViaCdp({ loginUrl, timeoutMs })
 			const identity: OldIdentity = { kind: 'bearer', token: result.token }
 			await validate(identity)
 			persistIdentity(identity)

package/src/old/tools/build.ts

@@ -1,23 +1,35 @@
 import type { RegisteredTool } from '../../mcp/server.ts'
 import type { ReclaimOldClient } from '../client.ts'
+import type { ReclaimSdkClient } from '../sdk-client.ts'
 import { authenticateTool } from './authenticate.ts'
+import { getProviderInfoTool } from './get-provider-info.ts'
+import { getProviderVersionConfigTool } from './get-version-config.ts'
 import { getMeProvidersTool } from './me-providers.ts'
 import { createVersionFromCaptureTool } from './publish.ts'
 import { sessionAnalyticsLogsTool } from './session-analytics-logs.ts'
+import { updateProviderMetadataTool } from './update-provider-metadata.ts'
 
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
  * list for `registerToolList`. These replace the builder credential + publish
  * tools and the (disabled) generated provider tools.
+ *
+ * `sdkClient` is a SEPARATE, unauthenticated client for the public
+ * production SDK backend (`api.reclaimprotocol.org`) — a different host from
+ * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
  */
 export function buildOldBackendTools(
 	client: ReclaimOldClient,
+	sdkClient: ReclaimSdkClient,
 ): RegisteredTool[] {
 	return [
 		authenticateTool(client),
 		createVersionFromCaptureTool(client),
 		getMeProvidersTool(client),
+		getProviderVersionConfigTool(client),
+		getProviderInfoTool(sdkClient),
+		updateProviderMetadataTool(client),
 		sessionAnalyticsLogsTool(client),
 	]
 }