@reclaimprotocol/agent 0.1.5 → 0.1.7

package/lib/mcp/tools/agent/proof.js

@@ -2,8 +2,7 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { agentTraceEnabled } from "../../../consts.js";
 import { reclaimHomeDirPath } from "../../../paths.js";
-import { runAttestorProof, tailLogs, warnsAndErrors, } from "../../../proof/attestor.js";
-import { defineTool } from "../../server.js";
+import { tailLogs, warnsAndErrors, } from "../../../proof/attestor.js";
 function claimsDir() {
     return join(reclaimHomeDirPath(), 'claims');
 }
@@ -73,138 +72,88 @@ function isLikelyByteArray(v) {
     }
     return true;
 }
-export function proofTool(secrets) {
-    return defineTool({
-        name: 'run_proof',
-        description: 'Run a full zkTLS proof through the Reclaim attestor SDK. ' +
-            'Use only after replay_request ' +
-            'returns matchesOriginal=true — attestor calls are expensive. ' +
-            'Writes the full claim to ' +
-            '~/.reclaim/claims/<timestamp>.json and ' +
-            'returns identifier + extractedParameters + ' +
-            'claimPath + a prettified `claim` field ' +
-            '(request dropped, byte arrays as base64) suitable ' +
-            'for displaying directly to the dev. ' +
-            'When the MCP server is started with ' +
-            '`RECLAIM_AGENT_TRACE=1`, ALSO writes ' +
-            'a per-call diagnostic dump (input provider, ' +
-            'sentParams the SDK saw post-substitution, ' +
-            'FULL attestor log stream, result) to ' +
-            '~/.reclaim/proof-runs/<timestamp>.json and ' +
-            'returns the path as `runLogPath`. ' +
-            '`attestorUrl` overrides the default attestor URL only when the dev ' +
-            'supplies a specific ' +
-            'alternative — do NOT invent backup URLs ' +
-            '(there is one live public attestor right now; ' +
-            'surface real errors to the dev instead of guessing). ' +
-            '`ownerAddress` (the credential to sign with) is REQUIRED — ' +
-            'call resolve_owner_key first to obtain it, then pass it here. ' +
-            'errorKind="missing-owner-key" means that address has no known ' +
-            'private key; re-run resolve_owner_key or issue/import a credential.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                provider: { type: 'object', properties: {} },
-                secretParamsRef: { type: 'string' },
-                attestorUrl: { type: 'string' },
-                ownerAddress: {
-                    type: 'string',
-                    pattern: '^0x[0-9a-fA-F]{40}$',
-                    description: 'ETH address of the credential to sign the claim with. ' +
-                        'Get it from resolve_owner_key first. The private key is ' +
-                        'resolved locally (cache / env / .env) — never passed here.',
-                },
-            },
-            required: ['provider', 'ownerAddress'],
-        },
-    }, async ({ provider, secretParamsRef, attestorUrl, ownerAddress }) => {
-        let resolved = {};
-        if (secretParamsRef !== undefined) {
-            const r = secrets.resolve(secretParamsRef);
-            if (!r) {
-                throw new Error(`unknown secretParamsRef "${secretParamsRef}" — ` +
-                    'the MCP server has restarted or reset_session was called. ' +
-                    'Re-run propose_provider to mint a fresh ref.');
-            }
-            resolved = r;
-        }
-        const result = await runAttestorProof(provider, resolved, { attestorUrl, ownerAddress });
-        // Persist the full claim to disk for the dev to inspect/share.
-        let claimPath;
-        if (result.proof !== undefined && result.proof !== null) {
-            try {
-                mkdirSync(claimsDir(), { recursive: true });
-                claimPath = join(claimsDir(), `${Date.now()}.json`);
-                writeFileSync(claimPath, JSON.stringify(result.proof, null, 2), 'utf8');
-            }
-            catch {
-                // Persistence is best-effort; don't fail the proof for it.
-                claimPath = undefined;
-            }
-        }
-        const out = {
-            verified: result.verified,
-            extractedValue: result.extractedValue,
-            extractedParameters: result.extractedParameters,
-        };
-        if (result.identifier !== undefined) {
-            out.identifier = result.identifier;
-        }
-        if (result.owner !== undefined) {
-            out.owner = result.owner;
-        }
-        if (claimPath !== undefined) {
-            out.claimPath = claimPath;
-        }
-        if (result.proof !== undefined && result.proof !== null) {
-            out.claim = prettifyClaim(result.proof);
-        }
-        if (result.error !== undefined) {
-            out.error = result.error;
-        }
-        if (result.errorKind !== undefined) {
-            out.errorKind = result.errorKind;
+/**
+ * The MCP's rich `run_proof` view: persist the full claim to disk, return
+ * identifier + extractedParameters + a prettified claim (request dropped, byte
+ * arrays as base64) + trimmed logs, and — under `RECLAIM_AGENT_TRACE=1` — a
+ * forensic run dump. This is the developer-facing shape; the cloud backend
+ * projects the same {@link ProofResult} to a lean summary instead.
+ */
+export function shapeRichProofResult(result, opts) {
+    // Persist the full claim to disk for the dev to inspect/share.
+    let claimPath;
+    if (result.proof !== undefined && result.proof !== null) {
+        try {
+            mkdirSync(claimsDir(), { recursive: true });
+            claimPath = join(claimsDir(), `${Date.now()}.json`);
+            writeFileSync(claimPath, JSON.stringify(result.proof, null, 2), 'utf8');
         }
-        // Trim the LLM-visible logs — full stream goes to runLogPath.
-        if (result.attestorLogs !== undefined && result.attestorLogs.length > 0) {
-            out.attestorLogs = result.verified
-                ? warnsAndErrors(result.attestorLogs)
-                : tailLogs(result.attestorLogs);
-            if (out.attestorLogs.length === 0) {
-                delete out.attestorLogs;
-            }
+        catch {
+            // Persistence is best-effort; don't fail the proof for it.
+            claimPath = undefined;
         }
-        if (result.sentParams !== undefined) {
-            out.sentParams = result.sentParams;
+    }
+    const out = {
+        verified: result.verified,
+        extractedValue: result.extractedValue,
+        extractedParameters: result.extractedParameters,
+    };
+    if (result.identifier !== undefined) {
+        out.identifier = result.identifier;
+    }
+    if (result.owner !== undefined) {
+        out.owner = result.owner;
+    }
+    if (claimPath !== undefined) {
+        out.claimPath = claimPath;
+    }
+    if (result.proof !== undefined && result.proof !== null) {
+        out.claim = prettifyClaim(result.proof);
+    }
+    if (result.error !== undefined) {
+        out.error = result.error;
+    }
+    if (result.errorKind !== undefined) {
+        out.errorKind = result.errorKind;
+    }
+    // Trim the LLM-visible logs — full stream goes to runLogPath.
+    if (result.attestorLogs !== undefined && result.attestorLogs.length > 0) {
+        out.attestorLogs = result.verified
+            ? warnsAndErrors(result.attestorLogs)
+            : tailLogs(result.attestorLogs);
+        if (out.attestorLogs.length === 0) {
+            delete out.attestorLogs;
         }
-        // Persist a diagnostic dump for forensics — gated behind
-        // RECLAIM_AGENT_TRACE=1 (matches the attestor logger capture).
-        // Off by default since happy-path runs don't need it; turn on
-        // when investigating proof failures and the file at runLogPath
-        // will carry the input provider, sentParams, full attestor log
-        // stream, and result.
-        if (agentTraceEnabled()) {
-            const runLogPath = writeProofRunDump({
-                provider,
-                hasSecretParamsRef: secretParamsRef !== undefined,
-                attestorUrl,
-                result: {
-                    verified: result.verified,
-                    error: result.error,
-                    errorKind: result.errorKind,
-                    extractedValue: result.extractedValue,
-                    extractedParameters: result.extractedParameters,
-                    identifier: result.identifier,
-                    owner: result.owner,
-                    sentParams: result.sentParams,
-                    attestorLogs: result.attestorLogs,
-                    claimPath,
-                },
-            });
-            if (runLogPath !== undefined) {
-                out.runLogPath = runLogPath;
-            }
+    }
+    if (result.sentParams !== undefined) {
+        out.sentParams = result.sentParams;
+    }
+    // Persist a diagnostic dump for forensics — gated behind
+    // RECLAIM_AGENT_TRACE=1 (matches the attestor logger capture). Off by
+    // default since happy-path runs don't need it; turn on when investigating
+    // proof failures and the file at runLogPath will carry the input provider,
+    // sentParams, full attestor log stream, and result.
+    if (agentTraceEnabled()) {
+        const runLogPath = writeProofRunDump({
+            provider: opts.provider,
+            hasSecretParamsRef: opts.hasSecrets,
+            attestorUrl: opts.attestorUrl,
+            result: {
+                verified: result.verified,
+                error: result.error,
+                errorKind: result.errorKind,
+                extractedValue: result.extractedValue,
+                extractedParameters: result.extractedParameters,
+                identifier: result.identifier,
+                owner: result.owner,
+                sentParams: result.sentParams,
+                attestorLogs: result.attestorLogs,
+                claimPath,
+            },
+        });
+        if (runLogPath !== undefined) {
+            out.runLogPath = runLogPath;
         }
-        return out;
-    });
+    }
+    return out;
 }

package/lib/mcp/tools/agent/propose.d.ts

@@ -1,9 +1,10 @@
-import { type RegisteredTool } from '../../server.ts';
-import type { CaptureStore } from './capture.ts';
-export interface SecretStore {
-    put: (values: Record<string, string>) => string;
-    resolve: (ref: string) => Record<string, string> | undefined;
-    clear: () => void;
-}
-export declare function makeSecretStore(): SecretStore;
-export declare function proposeTool(captures: CaptureStore, secrets: SecretStore): RegisteredTool;
+/**
+ * `propose_provider` — draft a provider (recipe + captured secrets) from ONE
+ * captured request, one match + redaction per target value. Authored once as a
+ * plain {@link RegisteredTool}; hosts pass their own backend resolver. The
+ * draft (recipe + real secret header values) is held server-side under an
+ * opaque `draftId`; the result carries only the secret-free provider.
+ */
+import { type ResolveBackend } from '../../../authoring/util.ts';
+import { type RegisteredTool } from '../../../tools/registry.ts';
+export declare function proposeTool(resolveBackend: ResolveBackend): RegisteredTool;

package/lib/mcp/tools/agent/propose.js

@@ -1,85 +1,108 @@
-import { randomUUID } from 'node:crypto';
+/**
+ * `propose_provider` — draft a provider (recipe + captured secrets) from ONE
+ * captured request, one match + redaction per target value. Authored once as a
+ * plain {@link RegisteredTool}; hosts pass their own backend resolver. The
+ * draft (recipe + real secret header values) is held server-side under an
+ * opaque `draftId`; the result carries only the secret-free provider.
+ */
+import { objectSchema } from "../../../authoring/util.js";
 import { draftProvider } from "../../../provider/draft.js";
 import { OPRF_MAX_BYTES } from "../../../provider/matcher.js";
 import { verificationWarnings } from "../../../provider/verification-checks.js";
-import { defineTool } from "../../server.js";
-export function makeSecretStore() {
-    const map = new Map();
-    return {
-        put: (values) => {
-            const id = `sref_${randomUUID()}`;
-            map.set(id, values);
-            return id;
-        },
-        resolve: (ref) => map.get(ref),
-        clear: () => map.clear(),
-    };
-}
-export function proposeTool(captures, secrets) {
+import { defineTool } from "../../../tools/registry.js";
+export function proposeTool(resolveBackend) {
     return defineTool({
         name: 'propose_provider',
-        description: 'Draft a Reclaim provider JSON from a captured request + ' +
-            'a target value. ' +
-            'Secret header values are stored server-side and replaced with an ' +
-            'opaque secretParamsRef ' +
-            'in the response — raw secret values never appear in tool output. ' +
-            "`hash` is opt-in: when set, the captured value is OPRF'd so " +
-            'the attestor never sees ' +
-            'cleartext. Skill should ask the dev first. `oprf-raw` ' +
-            'is the only variant that runs ' +
-            'without external deps; `oprf` needs gnark (Linux/macOS), ' +
-            '`oprf-mpc` needs a TEE attestor. ' +
-            'The response may include `verificationWarnings` — advisory ' +
-            'author-only decisions (e.g. a user-specific URL part needing ' +
-            'the {{context.<name>}}-vs-bare call). Surface each to the ' +
-            'dev verbatim and resolve before publishing.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                captureId: { type: 'string' },
-                requestId: { type: 'string' },
-                target: { type: 'string' },
-                name: { type: 'string' },
-                hash: { type: 'string', enum: ['oprf-raw', 'oprf', 'oprf-mpc'] },
+        description: 'Draft a provider from ONE captured request. Pass `targets` (an '
+            + 'array): one entry per value to extract, each with its `value` '
+            + '(verbatim) and a distinct `name` (its param). The provider gets '
+            + 'one match + redaction per target. Returns a draftId + recipe '
+            + '(never secrets). Prefer a SINGLE request holding ALL values. '
+            + 'Single-value shorthand: `target` + `name`. Per-target `hash` '
+            + 'OPRF-hashes that value.',
+        inputSchema: objectSchema({
+            requestId: { type: 'string' },
+            name: { type: 'string' },
+            targets: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        value: { type: 'string' },
+                        name: { type: 'string' },
+                        hash: {
+                            type: 'string',
+                            enum: ['oprf-raw', 'oprf', 'oprf-mpc'],
+                        },
+                    },
+                    required: ['value', 'name'],
+                },
             },
-            required: ['captureId', 'requestId', 'target', 'name'],
-        },
-    }, async ({ captureId, requestId, target, name, hash }) => {
-        if (hash !== undefined && target.length > OPRF_MAX_BYTES) {
-            throw new Error(`OPRF caps hashed values at ${OPRF_MAX_BYTES} bytes; ` +
-                `got ${target.length}-byte target ` +
-                `"${target}". Try a tighter target ` +
-                '(e.g. just the relevant substring) or call ' +
-                'propose_provider without `hash`.');
+            target: { type: 'string' },
+            hash: { type: 'string', enum: ['oprf-raw', 'oprf', 'oprf-mpc'] },
+        }, ['requestId', 'name']),
+    }, async (args) => {
+        const backend = resolveBackend(args);
+        const requestId = String(args.requestId);
+        const providerName = String(args.name);
+        const defaultHash = args.hash;
+        // Explicit multi-value `targets`, else the single `target` shorthand.
+        const raw = Array.isArray(args.targets) ? args.targets : [];
+        const targets = raw.length
+            ? raw.map((t) => {
+                const o = t;
+                return {
+                    value: String(o.value),
+                    name: String(o.name),
+                    ...(typeof o.hash === 'string'
+                        ? { hash: o.hash }
+                        : {}),
+                };
+            })
+            : typeof args.target === 'string'
+                ? [{
+                        value: args.target,
+                        name: providerName,
+                        ...(defaultHash ? { hash: defaultHash } : {}),
+                    }]
+                : [];
+        if (targets.length === 0) {
+            throw new Error('propose_provider needs a `target` value or a non-empty '
+                + '`targets` array');
         }
-        const session = captures.sessions.get(captureId);
-        if (!session) {
-            throw new Error(`no capture ${captureId}`);
+        for (const t of targets) {
+            if ((t.hash ?? defaultHash) !== undefined
+                && t.value.length > OPRF_MAX_BYTES) {
+                throw new Error(`OPRF caps hashed values at ${OPRF_MAX_BYTES} bytes; got `
+                    + `${t.value.length}-byte "${t.value}". Use a tighter `
+                    + 'target or drop `hash`.');
+            }
         }
-        const r = session.requests.get(requestId);
-        if (!r) {
-            throw new Error(`no request ${requestId}`);
+        const captured = backend.capture.requests.get(requestId);
+        if (!captured) {
+            throw new Error(`no captured request ${requestId}`);
         }
-        const body = session.bodies.get(requestId);
-        if (!body.available) {
-            throw new Error(`request body unavailable: ${body.reason}`);
+        if (!captured.responseBody) {
+            throw new Error(`request body unavailable for ${requestId}`);
         }
-        const reqWithBody = { ...r, responseBody: body.body };
-        const { provider, secretRefs } = draftProvider(reqWithBody, target, name, hash);
-        // Stash real secret values for later replay/proof.
-        const realSecrets = {};
+        const { provider, secretRefs, extractions } = draftProvider(captured, targets, providerName, defaultHash);
+        // Materialize the real secret header values for later replay/prove;
+        // they stay in the server-side draft, never in this result.
+        const secrets = {};
         for (const ref of secretRefs) {
-            const real = r.requestHeaders[ref.name];
+            const real = captured.requestHeaders[ref.name];
             if (real !== undefined) {
-                realSecrets[ref.name] = real;
+                secrets[ref.name] = real;
             }
         }
-        const secretParamsRef = secrets.put(realSecrets);
+        const draftId = backend.drafts.put({
+            provider, secretRefs, secrets, requestId, extractions,
+        });
         const warnings = verificationWarnings(provider);
         return {
+            draftId,
             provider,
             secretRefs,
-            secretParamsRef,
             ...(warnings.length ? { verificationWarnings: warnings } : {}),
         };
     });

package/lib/mcp/tools/agent/replay.d.ts

@@ -1,3 +1,10 @@
-import { type RegisteredTool } from '../../server.ts';
-import type { SecretStore } from './propose.ts';
-export declare function replayTool(secrets: SecretStore): RegisteredTool;
+/**
+ * `replay_request` — validate a drafted recipe before proving: confirm its
+ * selectors extract the target(s), and (with `withoutSecrets`) that the
+ * endpoint is auth-bound. Authored once as a plain {@link RegisteredTool}; the
+ * backend does the actual replay (MCP re-runs locally, cloud re-issues in the
+ * TEE pod).
+ */
+import { type ResolveBackend } from '../../../authoring/util.ts';
+import { type RegisteredTool } from '../../../tools/registry.ts';
+export declare function replayTool(resolveBackend: ResolveBackend): RegisteredTool;

package/lib/mcp/tools/agent/replay.js

@@ -1,41 +1,34 @@
-import { replayProvider } from "../../../proof/replay.js";
-import { defineTool } from "../../server.js";
-export function replayTool(secrets) {
+/**
+ * `replay_request` — validate a drafted recipe before proving: confirm its
+ * selectors extract the target(s), and (with `withoutSecrets`) that the
+ * endpoint is auth-bound. Authored once as a plain {@link RegisteredTool}; the
+ * backend does the actual replay (MCP re-runs locally, cloud re-issues in the
+ * TEE pod).
+ */
+import { objectSchema } from "../../../authoring/util.js";
+import { defineTool } from "../../../tools/registry.js";
+export function replayTool(resolveBackend) {
     return defineTool({
         name: 'replay_request',
-        description: 'Replay a drafted provider against the live endpoint ' +
-            'using Node fetch (no attestor). ' +
-            'Pre-flight gate before run_proof — ' +
-            'diagnoses CSRF / token-rotation / matcher-too-tight ' +
-            'issues with richer hints than the attestor would produce.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                provider: { type: 'object', properties: {} },
-                secretParamsRef: { type: 'string' },
-            },
-            required: ['provider'],
-        },
-    }, async ({ provider, secretParamsRef }) => {
-        let resolved = {};
-        if (secretParamsRef !== undefined) {
-            const r = secrets.resolve(secretParamsRef);
-            if (!r) {
-                throw new Error(`unknown secretParamsRef "${secretParamsRef}" — ` +
-                    'the MCP server has restarted or reset_session was called. ' +
-                    'Re-run propose_provider to mint a fresh ref.');
-            }
-            resolved = r;
+        description: 'Validate the drafted recipe before proving — confirm its selectors '
+            + 'extract the target value. Returns diagnostics; run before '
+            + 'proving. Set `withoutSecrets: true` for the AUTH-BOUND check: it '
+            + 're-issues the request with NO secrets/cookies (an anonymous '
+            + 'visitor). If the values still extract (valid:true), the endpoint '
+            + 'is PUBLIC and the proof would not bind to the user — reject it '
+            + 'and find an auth-bound request instead.',
+        inputSchema: objectSchema({
+            draftId: { type: 'string' },
+            withoutSecrets: { type: 'boolean' },
+        }, ['draftId']),
+    }, async (args) => {
+        const backend = resolveBackend(args);
+        const draft = backend.drafts.get(String(args.draftId));
+        if (!draft) {
+            throw new Error(`no draft ${String(args.draftId)}`);
         }
-        const result = await replayProvider(provider, resolved);
-        const out = {
-            status: result.status,
-            matchesOriginal: result.matchesOriginal,
-            bodySnippet: result.body.slice(0, 256),
-        };
-        if (result.hints !== undefined) {
-            out.hints = result.hints;
-        }
-        return out;
+        return backend.replay(draft, {
+            withoutSecrets: Boolean(args.withoutSecrets),
+        });
     });
 }

package/lib/mcp/tools/agent/session.d.ts

@@ -5,6 +5,4 @@ import type { CaptureStore } from './capture.ts';
 export declare function sessionTools(attachRef: {
     current?: AttachState;
     config: ConfigStore;
-}, captures: CaptureStore, secrets: {
-    clear: () => void;
-}): RegisteredTool[];
+}, captures: CaptureStore): RegisteredTool[];

package/lib/mcp/tools/agent/session.js

@@ -1,5 +1,5 @@
 import { defineTool } from "../../server.js";
-export function sessionTools(attachRef, captures, secrets) {
+export function sessionTools(attachRef, captures) {
     return [
         defineTool({
             name: 'get_session',
@@ -14,15 +14,15 @@ export function sessionTools(attachRef, captures, secrets) {
         })),
         defineTool({
             name: 'reset_session',
-            description: 'Stop all captures, drop in-memory secrets, and clear capture state.',
+            description: 'Stop all captures and clear capture state — drops every '
+                + 'session\'s drafts and their in-memory secrets.',
             inputSchema: { type: 'object', properties: {} },
         }, async () => {
-            for (const s of captures.sessions.values()) {
-                await s.stop().catch(() => { });
+            for (const entry of captures.sessions.values()) {
+                await entry.session.stop().catch(() => { });
             }
             captures.sessions.clear();
             delete captures.activeTab;
-            secrets.clear();
             return { reset: true };
         }),
     ];

package/lib/mcp/tools/agent/shared.d.ts

@@ -1,6 +1,8 @@
 import type { RegisteredTool } from '../../server.ts';
 import type { CaptureStore } from './capture.ts';
-/** The shared authoring tools as MCP `RegisteredTool`s: each resolves its
- *  capture's local backend from `args.captureId`; the schema carries
- *  `captureId` plus the rich `run_proof` contract. */
+/** The shared authoring tools mapped to the MCP's shape: resolve each call's
+ *  local backend from `args.captureId`, and widen the input schema — every tool
+ *  takes `captureId`; `run_proof` also gets the credential-aware contract. The
+ *  tools are authored plain in `../../../authoring`; this only wraps them with
+ *  `extendTool` (handlers untouched — loose arg parse keeps `captureId`). */
 export declare function sharedAuthoringTools(captures: CaptureStore): RegisteredTool[];

package/lib/mcp/tools/agent/shared.js

@@ -7,7 +7,7 @@
  * `start_capture`, since one capture bundles the tab, its requests, and its
  * drafts) and the rich, credential-aware `run_proof` schema.
  */
-import { buildAuthoringTools, } from "../../../authoring/index.js";
+import { authoringTools, extendTool, } from "../../../authoring/index.js";
 import { runAttestorProof } from "../../../proof/attestor.js";
 import { replayProvider } from "../../../proof/replay.js";
 import { shapeRichProofResult } from "./proof.js";
@@ -91,25 +91,35 @@ const RUN_PROOF_EXTRAS = {
     },
     required: ['ownerAddress'],
 };
-/** The shared authoring tools as MCP `RegisteredTool`s: each resolves its
- *  capture's local backend from `args.captureId`; the schema carries
- *  `captureId` plus the rich `run_proof` contract. */
+/** The shared authoring tools mapped to the MCP's shape: resolve each call's
+ *  local backend from `args.captureId`, and widen the input schema — every tool
+ *  takes `captureId`; `run_proof` also gets the credential-aware contract. The
+ *  tools are authored plain in `../../../authoring`; this only wraps them with
+ *  `extendTool` (handlers untouched — loose arg parse keeps `captureId`). */
 export function sharedAuthoringTools(captures) {
-    const host = {
-        resolveBackend: (args) => {
-            const captureId = String(args.captureId);
-            const entry = captures.sessions.get(captureId);
-            if (!entry) {
-                throw new Error(`no capture ${captureId} — call start_capture first `
-                    + '(it has been reset or never started).');
-            }
-            return localBackend(entry);
-        },
-        sessionSchema: {
+    const resolveBackend = (args) => {
+        const captureId = String(args.captureId);
+        const entry = captures.sessions.get(captureId);
+        if (!entry) {
+            throw new Error(`no capture ${captureId} — call start_capture first `
+                + '(it has been reset or never started).');
+        }
+        return localBackend(entry);
+    };
+    return authoringTools(resolveBackend).map((tool) => {
+        if (tool.definition.name === 'run_proof') {
+            return extendTool(tool, {
+                description: RUN_PROOF_EXTRAS.description,
+                properties: {
+                    captureId: { type: 'string' },
+                    ...RUN_PROOF_EXTRAS.properties,
+                },
+                required: ['captureId', ...RUN_PROOF_EXTRAS.required],
+            });
+        }
+        return extendTool(tool, {
             properties: { captureId: { type: 'string' } },
             required: ['captureId'],
-        },
-        toolExtras: { run_proof: RUN_PROOF_EXTRAS },
-    };
-    return buildAuthoringTools(host);
+        });
+    });
 }