@reclaimprotocol/agent 0.1.6 → 0.1.9

package/README.md

@@ -6,7 +6,9 @@ This package **is** the Reclaim MCP server (bin: `reclaim-mcp-server`). It depen
 
 ## Install
 
-**Prerequisites:** Node ≥ 22.18 and a local Chrome / Chromium / Edge (used for capture and the dashboard login). The first time you call `run_proof`, the agent downloads the ZK circuit files it needs (~280 MB) — so allow a moment for that first proof. The download is deferred to first proof on purpose (not an install step), so the MCP server itself starts immediately.
+**Prerequisites:** **Node ≥ 20** — **works best on a current LTS release (22 or 24)** — and a local Chrome / Chromium / Edge (used for capture and the dashboard login). The first time you call `run_proof`, the agent downloads the ZK circuit files it needs (~280 MB) — so allow a moment for that first proof. The download is deferred to first proof on purpose (not an install step), so the MCP server itself starts immediately.
+
+> **Any Node ≥ 20 works, including non-LTS lines like 25** however an LTS line (22 or 24) is *recommended*.
 
 It runs as a **stdio MCP server**. Point any MCP-capable agent at this command:
 
@@ -18,6 +20,17 @@ npx -y --package=@reclaimprotocol/agent reclaim-mcp-server
 
 ### Claude Code
 
+**Recommended — install the plugin from the marketplace** (bundles this MCP server; no `claude mcp add` and no `-p` collision to worry about — the server's `how_it_works` tool serves the authoring guide on demand):
+
+```
+/plugin marketplace add reclaimprotocol/builder
+/plugin install reclaim@reclaim
+```
+
+This is the preferred path — prefer it over the manual `claude mcp add` below unless you have a specific reason not to (e.g. you're pinning a local build).
+
+**Advanced / fallback — add the MCP server directly** (skip if you used the plugin above):
+
 ```bash
 # project scope → writes .mcp.json; add `-s user` for a global install
 claude mcp add reclaim -- npx -y --package=@reclaimprotocol/agent reclaim-mcp-server
@@ -36,6 +49,30 @@ claude mcp add reclaim -- npx -y --package=@reclaimprotocol/agent reclaim-mcp-se
 }
 ```
 
+### Claude Desktop (macOS / Windows app)
+
+Claude Desktop is the standalone consumer app — **separate from Claude Code**, and it does **not** support the plugin marketplace (`/plugin …` is Claude Code only). Configure the MCP server manually via its config file:
+
+- **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
+- **Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
+
+Edit it (via **Settings → Developer → Edit Config**, or open the file directly) and add:
+
+```json
+{
+  "mcpServers": {
+    "reclaim": {
+      "command": "npx",
+      "args": ["-y", "--package=@reclaimprotocol/agent", "reclaim-mcp-server"]
+    }
+  }
+}
+```
+
+Then **fully quit and reopen** Claude Desktop (a window close is not enough) so it re-reads the config and starts the server.
+
+> **Node must be on the app's PATH.** Claude Desktop launches the server as a subprocess using the environment it inherits at startup — it does **not** bundle Node. If the server shows as failed, either install Node ≥ 20 and relaunch, or set `"command"` to an **absolute path** to `npx`/`node` (find it with `which npx`), since GUI-launched apps sometimes get a minimal PATH. Chrome capture works the same as anywhere else — see [Chrome / CDP](#platform-notes).
+
 ### Cursor
 
 Add to `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project):
@@ -189,7 +226,7 @@ npm run download:zk-files --workspace=packages/agent
 
 ## Platform notes
 
-- **Node >=22.18** is required (declared in `engines`). The floor is 22.18 because the test suite and dev workflow run bare `.ts` files directly, and unflagged TypeScript type-stripping landed in Node 22.18.
+- **Node >=20** is required to run the published package (declared in `engines`) — it ships compiled `lib/*.js`, so no TypeScript type-stripping is needed at runtime. Any line ≥ 20 works, including non-LTS like 25: the one native addon that used to break this, `re2`, is an **optional** dependency as of `@reclaimprotocol/attestor-core` 5.0.8 and degrades to native `RegExp` when its binary is absent. (The other native dep, `koffi`, is N-API — ABI-independent, all-platform prebuilts — so it was never version-sensitive.) An LTS line (22/24) is recommended so `re2` is present for faster, ReDoS-safe matching. Working on the package **from a checkout** additionally needs **Node >=22.18**, because the test suite and dev workflow run bare `.ts` files directly and unflagged TypeScript type-stripping landed in 22.18.
 - **Chrome 136+ silently disables `--remote-debugging-port`** when launched against the default user profile. `dedicated` mode (the default) sidesteps this by always passing `--user-data-dir=~/.reclaim/chrome-profile`.
 
 ## Tests

package/lib/authoring/tools.js

@@ -81,7 +81,7 @@ export function authoringTools(resolveBackend) {
             inputSchema: objectSchema({ url: { type: 'string' }, timeoutMs: { type: 'number' } }, ['url']),
         }, async (args) => {
             const backend = resolveBackend(args);
-            const timeoutMs = Number(args.timeoutMs) || 30_000;
+            const timeoutMs = Number(args.timeoutMs) || 30000;
             await backend.sendCdp('Page.enable');
             // Start listening BEFORE navigating so the load event isn't missed.
             const load = backend.waitForEvent('Page.loadEventFired', timeoutMs);
@@ -107,7 +107,7 @@ export function authoringTools(resolveBackend) {
         }, async (args) => {
             const backend = resolveBackend(args);
             const expr = String(args.expression);
-            const deadline = Date.now() + (Number(args.timeoutMs) || 180_000);
+            const deadline = Date.now() + (Number(args.timeoutMs) || 180000);
             while (Date.now() < deadline) {
                 const { value } = await evalInPage(backend, expr);
                 if (value) {

package/lib/cdp/eviction.js

@@ -1,26 +1,38 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _BodyStore_store, _BodyStore_bytes, _BodyStore_opts;
 export class BodyStore {
-    #store = new Map(); // insertion order = LRU order
-    #bytes = 0;
-    #opts;
     constructor(opts) {
-        this.#opts = opts;
+        _BodyStore_store.set(this, new Map()); // insertion order = LRU order
+        _BodyStore_bytes.set(this, 0);
+        _BodyStore_opts.set(this, void 0);
+        __classPrivateFieldSet(this, _BodyStore_opts, opts, "f");
     }
     set(requestId, body) {
-        if (this.#store.has(requestId)) {
-            this.#bytes -= byteLen(this.#store.get(requestId));
-            this.#store.delete(requestId);
+        if (__classPrivateFieldGet(this, _BodyStore_store, "f").has(requestId)) {
+            __classPrivateFieldSet(this, _BodyStore_bytes, __classPrivateFieldGet(this, _BodyStore_bytes, "f") - byteLen(__classPrivateFieldGet(this, _BodyStore_store, "f").get(requestId)), "f");
+            __classPrivateFieldGet(this, _BodyStore_store, "f").delete(requestId);
         }
-        this.#store.set(requestId, body);
-        this.#bytes += byteLen(body);
-        while (this.#bytes > this.#opts.maxBytes && this.#store.size > 0) {
-            const oldestKey = this.#store.keys().next().value;
-            const oldestVal = this.#store.get(oldestKey);
-            this.#bytes -= byteLen(oldestVal);
-            this.#store.delete(oldestKey);
+        __classPrivateFieldGet(this, _BodyStore_store, "f").set(requestId, body);
+        __classPrivateFieldSet(this, _BodyStore_bytes, __classPrivateFieldGet(this, _BodyStore_bytes, "f") + byteLen(body), "f");
+        while (__classPrivateFieldGet(this, _BodyStore_bytes, "f") > __classPrivateFieldGet(this, _BodyStore_opts, "f").maxBytes && __classPrivateFieldGet(this, _BodyStore_store, "f").size > 0) {
+            const oldestKey = __classPrivateFieldGet(this, _BodyStore_store, "f").keys().next().value;
+            const oldestVal = __classPrivateFieldGet(this, _BodyStore_store, "f").get(oldestKey);
+            __classPrivateFieldSet(this, _BodyStore_bytes, __classPrivateFieldGet(this, _BodyStore_bytes, "f") - byteLen(oldestVal), "f");
+            __classPrivateFieldGet(this, _BodyStore_store, "f").delete(oldestKey);
         }
     }
     get(requestId) {
-        const body = this.#store.get(requestId);
+        const body = __classPrivateFieldGet(this, _BodyStore_store, "f").get(requestId);
         if (body === undefined) {
             return {
                 available: false,
@@ -28,11 +40,12 @@ export class BodyStore {
             };
         }
         // Refresh LRU position by re-inserting.
-        this.#store.delete(requestId);
-        this.#store.set(requestId, body);
+        __classPrivateFieldGet(this, _BodyStore_store, "f").delete(requestId);
+        __classPrivateFieldGet(this, _BodyStore_store, "f").set(requestId, body);
         return { available: true, body };
     }
 }
+_BodyStore_store = new WeakMap(), _BodyStore_bytes = new WeakMap(), _BodyStore_opts = new WeakMap();
 function byteLen(s) {
     return Buffer.byteLength(s, 'utf8');
 }

package/lib/cdp/launcher.js

@@ -85,7 +85,7 @@ export function launchChrome(opts) {
     });
     return child;
 }
-export async function waitForCdpReady(port, timeoutMs = 10_000) {
+export async function waitForCdpReady(port, timeoutMs = 10000) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
         try {

package/lib/config/store.js

@@ -1,3 +1,15 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ConfigStore_path;
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { reclaimHomeDirPath } from "../paths.js";
@@ -9,16 +21,16 @@ import { reclaimHomeDirPath } from "../paths.js";
  * own validation (token expiry, credential shape) on top.
  */
 export class ConfigStore {
-    #path;
     constructor(path = defaultConfigPath()) {
-        this.#path = path;
+        _ConfigStore_path.set(this, void 0);
+        __classPrivateFieldSet(this, _ConfigStore_path, path, "f");
     }
     read() {
-        if (!existsSync(this.#path)) {
+        if (!existsSync(__classPrivateFieldGet(this, _ConfigStore_path, "f"))) {
             return undefined;
         }
         try {
-            return JSON.parse(readFileSync(this.#path, 'utf8'));
+            return JSON.parse(readFileSync(__classPrivateFieldGet(this, _ConfigStore_path, "f"), 'utf8'));
         }
         catch {
             return undefined;
@@ -31,16 +43,17 @@ export class ConfigStore {
      */
     write(patch) {
         const next = { ...this.read(), ...patch, version: 1 };
-        const dir = dirname(this.#path);
+        const dir = dirname(__classPrivateFieldGet(this, _ConfigStore_path, "f"));
         mkdirSync(dir, { recursive: true, mode: 0o700 });
         chmodSync(dir, 0o700);
-        writeFileSync(this.#path, JSON.stringify(next, null, 2) + '\n', {
+        writeFileSync(__classPrivateFieldGet(this, _ConfigStore_path, "f"), JSON.stringify(next, null, 2) + '\n', {
             mode: 0o600,
         });
-        chmodSync(this.#path, 0o600);
+        chmodSync(__classPrivateFieldGet(this, _ConfigStore_path, "f"), 0o600);
         return next;
     }
 }
+_ConfigStore_path = new WeakMap();
 export function defaultConfigPath() {
     return join(reclaimHomeDirPath(), 'config.json');
 }

package/lib/mcp/tools/agent/attach.js

@@ -46,11 +46,11 @@ export function attachTool(state) {
             }
             catch {
                 launchChrome({ port: cfg.port, profileDir: defaultProfileDir() });
-                await waitForCdpReady(cfg.port, 10_000);
+                await waitForCdpReady(cfg.port, 10000);
             }
         }
         else {
-            await waitForCdpReady(cfg.port, 2_000).catch(() => {
+            await waitForCdpReady(cfg.port, 2000).catch(() => {
                 throw new Error(`attach mode: nothing answering CDP on port ${cfg.port}. ` +
                     'Chrome must be launched with BOTH ' +
                     `--remote-debugging-port=${cfg.port} AND ` +

package/lib/old/client.d.ts

@@ -44,6 +44,10 @@ export interface RegisterProviderBody {
     };
     /** Accepted at register too. */
     pageTitle?: string;
+    /** Accepted at register too — verified straight from the register
+     *  controller's destructure + its `providerConfig` write, both of which
+     *  include it alongside `pageTitle`/`userAgent`. */
+    stepsToFollow?: string;
 }
 export interface UpdateProviderConfigBody {
     providerConfig: Record<string, unknown>;

package/lib/old/client.js

@@ -1,3 +1,15 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ReclaimOldClient_instances, _ReclaimOldClient_identity, _ReclaimOldClient_fetch, _ReclaimOldClient_request, _ReclaimOldClient_authHeaderName, _ReclaimOldClient_authHeaderValue, _ReclaimOldClient_requireIdentity, _ReclaimOldClient_parseBody, _ReclaimOldClient_asBoom;
 import { Boom } from '@hapi/boom';
 import { NAME, VERSION } from "../pkg.js";
 /** Default origin of the OLD devtools backend. The client appends the
@@ -18,43 +30,42 @@ export const DEFAULT_OLD_LOGS_URL = 'https://logs.reclaimprotocol.org';
  * identically to builder-mode `ProblemError`s.
  */
 export class ReclaimOldClient {
-    baseUrl;
-    logsBaseUrl;
-    #identity;
-    #fetch;
     constructor(opts = {}) {
+        _ReclaimOldClient_instances.add(this);
+        _ReclaimOldClient_identity.set(this, void 0);
+        _ReclaimOldClient_fetch.set(this, void 0);
         this.baseUrl = (opts.baseUrl || DEFAULT_OLD_API_URL).replace(/\/+$/, '');
         this.logsBaseUrl = (opts.logsBaseUrl || DEFAULT_OLD_LOGS_URL)
             .replace(/\/+$/, '');
-        this.#identity = opts.identity;
-        this.#fetch = opts.fetch ?? fetch;
+        __classPrivateFieldSet(this, _ReclaimOldClient_identity, opts.identity, "f");
+        __classPrivateFieldSet(this, _ReclaimOldClient_fetch, opts.fetch ?? fetch, "f");
     }
     setIdentity(identity) {
-        this.#identity = identity;
+        __classPrivateFieldSet(this, _ReclaimOldClient_identity, identity, "f");
     }
     getIdentity() {
-        return this.#identity;
+        return __classPrivateFieldGet(this, _ReclaimOldClient_identity, "f");
     }
     /** Validate + provision a bearer identity. The backend creates the user
      *  row on first login, which is what makes later authed calls work. */
     loginWithToken() {
-        return this.#request('POST', '/users/login', { auth: true });
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'POST', '/users/login', { auth: true });
     }
     registerProvider(body) {
-        return this.#request('POST', '/providers/register', { body, auth: true });
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'POST', '/providers/register', { body, auth: true });
     }
     updateProviderConfig(providerId, body) {
-        return this.#request('POST', `/providers/${encodeURIComponent(providerId)}/config`, { body, auth: true });
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'POST', `/providers/${encodeURIComponent(providerId)}/config`, { body, auth: true });
     }
     listVersions(providerId) {
-        return this.#request('GET', `/providers/${encodeURIComponent(providerId)}/versions`, { auth: true });
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'GET', `/providers/${encodeURIComponent(providerId)}/versions`, { auth: true });
     }
     /** Full `providerConfig` (loginUrl, customInjection, requestData, ...) for
      *  one version — the latest when `version` is omitted. Readable for ANY
      *  non-archived provider (not owner-restricted), same as the dashboard's
      *  edit-form prefill fetch. */
     getProviderConfig(providerId, version) {
-        return this.#request('GET', `/providers/${encodeURIComponent(providerId)}/config`, {
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'GET', `/providers/${encodeURIComponent(providerId)}/config`, {
             auth: true,
             query: version ? { versionNumber: version } : undefined,
         });
@@ -65,7 +76,7 @@ export class ReclaimOldClient {
      *  fields sent here are simply ignored (this endpoint only reads the
      *  ones above from the body). */
     updateProviderMetadata(providerId, body) {
-        return this.#request('POST', `/providers/${encodeURIComponent(providerId)}`, { body, auth: true });
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'POST', `/providers/${encodeURIComponent(providerId)}`, { body, auth: true });
     }
     /** Analytics logs for a verification session, from the logs service (a
      *  DIFFERENT host than the devtools API — hence its own fetch, not
@@ -78,20 +89,20 @@ export class ReclaimOldClient {
             Accept: 'application/json',
             'User-Agent': `${NAME}/${VERSION}`,
         };
-        if (this.#identity) {
-            headers[this.#authHeaderName()] = this.#authHeaderValue();
+        if (__classPrivateFieldGet(this, _ReclaimOldClient_identity, "f")) {
+            headers[__classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_authHeaderName).call(this)] = __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_authHeaderValue).call(this);
         }
-        const res = await this.#fetch(url, { method: 'GET', headers });
-        const json = await this.#parseBody(res);
+        const res = await __classPrivateFieldGet(this, _ReclaimOldClient_fetch, "f").call(this, url, { method: 'GET', headers });
+        const json = await __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_parseBody).call(this, res);
         if (!res.ok) {
-            throw this.#asBoom(res, json);
+            throw __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_asBoom).call(this, res, json);
         }
         return json;
     }
     getMyProviders(query = {}) {
         // Every one of these query params is REQUIRED by the backend
         // validator (missing/invalid → 400), so default them all here.
-        return this.#request('GET', '/providers/user/paginated', {
+        return __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_request).call(this, 'GET', '/providers/user/paginated', {
             auth: true,
             query: {
                 pageKey: query.pageKey ?? 0,
@@ -104,88 +115,83 @@ export class ReclaimOldClient {
             },
         });
     }
-    async #request(method, path, opts = {}) {
-        let url = `${this.baseUrl}/api${path}`;
-        if (opts.query) {
-            const search = new URLSearchParams();
-            for (const [k, v] of Object.entries(opts.query)) {
-                if (v === undefined) {
-                    continue;
-                }
-                search.append(k, String(v));
-            }
-            const qs = search.toString();
-            if (qs) {
-                url += `?${qs}`;
+}
+_ReclaimOldClient_identity = new WeakMap(), _ReclaimOldClient_fetch = new WeakMap(), _ReclaimOldClient_instances = new WeakSet(), _ReclaimOldClient_request = async function _ReclaimOldClient_request(method, path, opts = {}) {
+    let url = `${this.baseUrl}/api${path}`;
+    if (opts.query) {
+        const search = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts.query)) {
+            if (v === undefined) {
+                continue;
             }
+            search.append(k, String(v));
         }
-        const headers = {
-            Accept: 'application/json',
-            'User-Agent': `${NAME}/${VERSION}`,
-        };
-        if (opts.auth) {
-            headers[this.#authHeaderName()] = this.#authHeaderValue();
+        const qs = search.toString();
+        if (qs) {
+            url += `?${qs}`;
         }
-        const init = { method, headers };
-        if (method !== 'GET' && method !== 'HEAD') {
-            init.body = JSON.stringify(opts.body ?? {});
-            headers['Content-Type'] = 'application/json';
-        }
-        const res = await this.#fetch(url, init);
-        const json = await this.#parseBody(res);
-        // Old API convention: { message, ...data, isSuccess }. Treat a non-2xx
-        // OR an explicit isSuccess:false as an error so a 200-with-failure
-        // body never slips through as success.
-        const failed = !res.ok ||
-            (json !== undefined &&
-                typeof json === 'object' &&
-                json.isSuccess === false);
-        if (failed) {
-            throw this.#asBoom(res, json);
-        }
-        return json;
-    }
-    #authHeaderName() {
-        const id = this.#requireIdentity();
-        return id.kind === 'bearer' ? 'Authorization' : 'x-eth-uid';
-    }
-    #authHeaderValue() {
-        const id = this.#requireIdentity();
-        return id.kind === 'bearer' ? `Bearer ${id.token}` : id.uid;
     }
-    #requireIdentity() {
-        if (!this.#identity) {
-            throw new Boom('Not authenticated against old devtools. Call reclaim_authenticate ' +
-                'with a dashboard token (or eth uid) first.', { statusCode: 401, data: { status: 401, detail: 'no identity set' } });
-        }
-        return this.#identity;
-    }
-    async #parseBody(res) {
-        if (res.status === 204 || res.headers.get('content-length') === '0') {
-            return undefined;
-        }
-        try {
-            return await res.json();
-        }
-        catch {
-            return undefined;
-        }
-    }
-    #asBoom(res, json) {
-        const message = (json && typeof json === 'object' &&
-            typeof json.message === 'string'
-            ? json.message
-            : undefined) || res.statusText || 'Old devtools request failed';
-        // Shape `data` like a ProblemDetails so remapErrorAsResponse can render
-        // `${message}: ${data.detail}` and expose the raw body as structured.
-        return new Boom(message, {
-            statusCode: res.ok ? 502 : res.status,
-            data: {
-                status: res.status,
-                title: message,
-                detail: message,
-                body: json,
-            },
-        });
-    }
-}
+    const headers = {
+        Accept: 'application/json',
+        'User-Agent': `${NAME}/${VERSION}`,
+    };
+    if (opts.auth) {
+        headers[__classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_authHeaderName).call(this)] = __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_authHeaderValue).call(this);
+    }
+    const init = { method, headers };
+    if (method !== 'GET' && method !== 'HEAD') {
+        init.body = JSON.stringify(opts.body ?? {});
+        headers['Content-Type'] = 'application/json';
+    }
+    const res = await __classPrivateFieldGet(this, _ReclaimOldClient_fetch, "f").call(this, url, init);
+    const json = await __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_parseBody).call(this, res);
+    // Old API convention: { message, ...data, isSuccess }. Treat a non-2xx
+    // OR an explicit isSuccess:false as an error so a 200-with-failure
+    // body never slips through as success.
+    const failed = !res.ok ||
+        (json !== undefined &&
+            typeof json === 'object' &&
+            json.isSuccess === false);
+    if (failed) {
+        throw __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_asBoom).call(this, res, json);
+    }
+    return json;
+}, _ReclaimOldClient_authHeaderName = function _ReclaimOldClient_authHeaderName() {
+    const id = __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_requireIdentity).call(this);
+    return id.kind === 'bearer' ? 'Authorization' : 'x-eth-uid';
+}, _ReclaimOldClient_authHeaderValue = function _ReclaimOldClient_authHeaderValue() {
+    const id = __classPrivateFieldGet(this, _ReclaimOldClient_instances, "m", _ReclaimOldClient_requireIdentity).call(this);
+    return id.kind === 'bearer' ? `Bearer ${id.token}` : id.uid;
+}, _ReclaimOldClient_requireIdentity = function _ReclaimOldClient_requireIdentity() {
+    if (!__classPrivateFieldGet(this, _ReclaimOldClient_identity, "f")) {
+        throw new Boom('Not authenticated against old devtools. Call reclaim_authenticate ' +
+            'with a dashboard token (or eth uid) first.', { statusCode: 401, data: { status: 401, detail: 'no identity set' } });
+    }
+    return __classPrivateFieldGet(this, _ReclaimOldClient_identity, "f");
+}, _ReclaimOldClient_parseBody = async function _ReclaimOldClient_parseBody(res) {
+    if (res.status === 204 || res.headers.get('content-length') === '0') {
+        return undefined;
+    }
+    try {
+        return await res.json();
+    }
+    catch {
+        return undefined;
+    }
+}, _ReclaimOldClient_asBoom = function _ReclaimOldClient_asBoom(res, json) {
+    const message = (json && typeof json === 'object' &&
+        typeof json.message === 'string'
+        ? json.message
+        : undefined) || res.statusText || 'Old devtools request failed';
+    // Shape `data` like a ProblemDetails so remapErrorAsResponse can render
+    // `${message}: ${data.detail}` and expose the raw body as structured.
+    return new Boom(message, {
+        statusCode: res.ok ? 502 : res.status,
+        data: {
+            status: res.status,
+            title: message,
+            detail: message,
+            body: json,
+        },
+    });
+};

package/lib/old/login-cdp.js

@@ -88,7 +88,7 @@ export const EXTRACT_TOKEN_JS = `(async () => {
  */
 export async function captureFirebaseTokenViaCdp(opts) {
     const loginUrl = opts.loginUrl || oldLoginUrl() || DEFAULT_LOGIN_URL;
-    const timeoutMs = opts.timeoutMs ?? 180_000;
+    const timeoutMs = opts.timeoutMs ?? 180000;
     const pollMs = opts.pollMs ?? 1000;
     const cfg = new ConfigStore().read()?.browser_agent;
     const mode = cfg?.attachMode ?? 'dedicated';
@@ -105,7 +105,7 @@ export async function captureFirebaseTokenViaCdp(opts) {
                 '--user-data-dir, or switch to dedicated mode (attach_chrome).');
         }
         launchChrome({ port, profileDir: defaultProfileDir() });
-        await waitForCdpReady(port, 10_000);
+        await waitForCdpReady(port, 10000);
         launchedByUs = true;
     }
     const handles = await connectCdp(port);

package/lib/old/sdk-client.js

@@ -1,3 +1,15 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ReclaimSdkClient_instances, _ReclaimSdkClient_fetch, _ReclaimSdkClient_get;
 import { Boom } from '@hapi/boom';
 import { NAME, VERSION } from "../pkg.js";
 /**
@@ -25,61 +37,61 @@ export const DEFAULT_SDK_API_URL = 'https://api.reclaimprotocol.org';
  * the same way as every other tool in this package.
  */
 export class ReclaimSdkClient {
-    baseUrl;
-    #fetch;
     constructor(opts = {}) {
+        _ReclaimSdkClient_instances.add(this);
+        _ReclaimSdkClient_fetch.set(this, void 0);
         this.baseUrl = (opts.baseUrl || DEFAULT_SDK_API_URL).replace(/\/+$/, '');
-        this.#fetch = opts.fetch ?? fetch;
+        __classPrivateFieldSet(this, _ReclaimSdkClient_fetch, opts.fetch ?? fetch, "f");
     }
     /** Full provider + providerConfig (includes `customInjection`). Latest
      *  version when `versionNumber` is omitted. */
     getProvider(providerId, versionNumber) {
-        return this.#get(`/providers/${encodeURIComponent(providerId)}`, versionNumber);
+        return __classPrivateFieldGet(this, _ReclaimSdkClient_instances, "m", _ReclaimSdkClient_get).call(this, `/providers/${encodeURIComponent(providerId)}`, versionNumber);
     }
     /** Trimmed runtime recipe (no `customInjection`; adds
      *  `isScriptRequestingClaim`). Latest version when `versionNumber` is
      *  omitted. */
     getProviderConfigs(providerId, versionNumber) {
-        return this.#get(`/providers/${encodeURIComponent(providerId)}/configs`, versionNumber);
+        return __classPrivateFieldGet(this, _ReclaimSdkClient_instances, "m", _ReclaimSdkClient_get).call(this, `/providers/${encodeURIComponent(providerId)}/configs`, versionNumber);
     }
-    async #get(path, versionNumber) {
-        let url = `${this.baseUrl}/api${path}`;
-        if (versionNumber) {
-            url += `?versionNumber=${encodeURIComponent(versionNumber)}`;
-        }
-        const res = await this.#fetch(url, {
-            method: 'GET',
-            headers: {
-                Accept: 'application/json',
-                'User-Agent': `${NAME}/${VERSION}`,
+}
+_ReclaimSdkClient_fetch = new WeakMap(), _ReclaimSdkClient_instances = new WeakSet(), _ReclaimSdkClient_get = async function _ReclaimSdkClient_get(path, versionNumber) {
+    let url = `${this.baseUrl}/api${path}`;
+    if (versionNumber) {
+        url += `?versionNumber=${encodeURIComponent(versionNumber)}`;
+    }
+    const res = await __classPrivateFieldGet(this, _ReclaimSdkClient_fetch, "f").call(this, url, {
+        method: 'GET',
+        headers: {
+            Accept: 'application/json',
+            'User-Agent': `${NAME}/${VERSION}`,
+        },
+    });
+    let json;
+    try {
+        json = await res.json();
+    }
+    catch {
+        json = undefined;
+    }
+    const failed = !res.ok ||
+        (json !== undefined &&
+            typeof json === 'object' &&
+            json.isSuccess === false);
+    if (failed) {
+        const message = (json && typeof json === 'object' &&
+            typeof json.message === 'string'
+            ? json.message
+            : undefined) || res.statusText || 'SDK backend request failed';
+        throw new Boom(message, {
+            statusCode: res.ok ? 502 : res.status,
+            data: {
+                status: res.status,
+                title: message,
+                detail: message,
+                body: json,
             },
         });
-        let json;
-        try {
-            json = await res.json();
-        }
-        catch {
-            json = undefined;
-        }
-        const failed = !res.ok ||
-            (json !== undefined &&
-                typeof json === 'object' &&
-                json.isSuccess === false);
-        if (failed) {
-            const message = (json && typeof json === 'object' &&
-                typeof json.message === 'string'
-                ? json.message
-                : undefined) || res.statusText || 'SDK backend request failed';
-            throw new Boom(message, {
-                statusCode: res.ok ? 502 : res.status,
-                data: {
-                    status: res.status,
-                    title: message,
-                    detail: message,
-                    body: json,
-                },
-            });
-        }
-        return json;
     }
-}
+    return json;
+};

package/lib/old/to-register.d.ts

@@ -41,8 +41,8 @@ export interface OldProviderOpts {
      *  fresh entries with {@link injectedRequestDataFrom}; a carried-forward
      *  value (read back from an existing version) passes through unchanged. */
     allowedInjectedRequestData?: OldInjectedRequestData[];
-    /** Config (add-version) ONLY — the register endpoint never reads this
-     *  field from the request body. */
+    /** Accepted at register too (verified from the register controller's
+     *  destructure + providerConfig write — same as `userAgent`/`pageTitle`). */
     stepsToFollow?: string;
     /** Config (add-version) ONLY — the register endpoint never reads this
      *  field from the request body. */

package/lib/old/to-register.js

@@ -114,15 +114,18 @@ export function providerToRegisterBody(providers, opts) {
     if (opts.customInjection !== undefined) {
         body.customInjection = opts.customInjection;
     }
-    // Register also accepts these two (unlike allowedInjectedRequestData /
-    // stepsToFollow / useIncognitoWebview / extensionConfig, which the
-    // register controller never reads from the body at all).
+    // Register also accepts these three (unlike allowedInjectedRequestData /
+    // useIncognitoWebview / extensionConfig, which the register controller
+    // never reads from the body at all).
     if (opts.userAgent !== undefined) {
         body.userAgent = opts.userAgent;
     }
     if (opts.pageTitle !== undefined) {
         body.pageTitle = opts.pageTitle;
     }
+    if (opts.stepsToFollow !== undefined) {
+        body.stepsToFollow = opts.stepsToFollow;
+    }
     return body;
 }
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to

package/lib/old/tools/publish.js

@@ -7,9 +7,9 @@ const DEFAULT_VERSION_INFO = 'Updated from MCP browser capture';
 /** Fields with no partial-patch equivalent on this backend: a version always
  *  replaces the WHOLE `providerConfig`, so omitting one of these on
  *  add-version must carry forward the current value rather than publish it
- *  blank. `allowedInjectedRequestData` is handled alongside these (see
- *  `resolveInjectedRequests`) since it needs translation when freshly
- *  authored, unlike these — which pass through unchanged either way. */
+ *  blank. `allowedInjectedRequestData` is handled alongside these (further
+ *  down, inline) since it needs translation when freshly authored, unlike
+ *  these — which pass through unchanged either way. */
 const PRESERVABLE_KEYS = [
     'customInjection',
     'userAgent',
@@ -30,12 +30,22 @@ function extractProviderConfig(resp) {
     return undefined;
 }
 /** Prefer the caller's explicit value; otherwise fall back to `current`'s
- *  value (if any) and record `fieldName` as carried forward. */
+ *  value (if any) and record `fieldName` as carried forward.
+ *
+ *  `current === null` is treated the SAME as `undefined` (nothing to carry),
+ *  not as a real value to preserve. These are all optional fields with no
+ *  Prisma default — a version where one was never set reads back as
+ *  `null`, not a missing key, because Prisma normalizes an absent optional
+ *  field to `null` on read. Carrying that `null` "forward" would falsely
+ *  claim the field was preserved when really nothing was ever there — it
+ *  most likely means an EARLIER version already lost it (e.g. published
+ *  before this field had carry-forward support at all), not that this call
+ *  is doing anything wrong. */
 function resolveField(explicit, current, fieldName, carried) {
     if (explicit !== undefined) {
         return explicit;
     }
-    if (current !== undefined) {
+    if (current !== undefined && current !== null) {
         carried.push(fieldName);
         return current;
     }
@@ -108,10 +118,16 @@ export function createVersionFromCaptureTool(client) {
             '`useIncognitoWebview`, `extensionConfig` that you OMIT is carried ' +
             'forward unchanged from the currently-published version (so ' +
             're-publishing requestData never wipes a working login script or ' +
-            'other config someone set via the dashboard). Pass an explicit ' +
-            'value (`""`, `[]`, `false`, ...) to intentionally clear one of ' +
-            'them instead, or call get_provider_version_config first to see ' +
-            'exactly what is live today before deciding what to change. ' +
+            'other config someone set via the dashboard). This can only carry ' +
+            'forward what the CURRENT version actually has — if an earlier ' +
+            'version already lost a field (e.g. published before this tool ' +
+            'carried it forward at all), there is nothing left to preserve and ' +
+            'the result legitimately comes back empty/null for that field; ' +
+            'that is not this call failing to carry it forward. Pass an ' +
+            'explicit value (`""`, `[]`, `false`, ...) to intentionally clear ' +
+            'one of them instead, or call get_provider_version_config FIRST ' +
+            'to see exactly what is live today, rather than assuming this ' +
+            'call recovered something that may already be gone. ' +
             '`allowedInjectedRequestData`/`useIncognitoWebview`/' +
             '`extensionConfig` only take effect on add-version — the register ' +
             'endpoint (no `providerId`) ignores them. \n\n' +
@@ -241,7 +257,7 @@ export function createVersionFromCaptureTool(client) {
                 stepsToFollow: {
                     type: 'string',
                     description: 'Free-text setup/manual-verification steps shown to the ' +
-                        'dev/verifier. Add-version ONLY.',
+                        'dev/verifier. Accepted on register too.',
                 },
                 useIncognitoWebview: {
                     type: 'boolean',
@@ -320,6 +336,9 @@ export function createVersionFromCaptureTool(client) {
             if (args.pageTitle !== undefined) {
                 opts.pageTitle = args.pageTitle;
             }
+            if (args.stepsToFollow !== undefined) {
+                opts.stepsToFollow = args.stepsToFollow;
+            }
             const body = providerToRegisterBody(providers, opts);
             return withNotes(await client.registerProvider(body));
         }

package/lib/proof/zk-files.js

@@ -24,10 +24,10 @@ let inFlight;
  * so a stray write to fd 1 mid-session would corrupt the protocol.
  */
 export function ensureZkFiles() {
-    inFlight ??= download().catch((err) => {
+    inFlight ?? (inFlight = download().catch((err) => {
         inFlight = undefined;
         throw err;
-    });
+    }));
     return inFlight;
 }
 async function download() {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.6",
+	"version": "0.1.9",
 	"description": "Reclaim Protocol agent — SDK, CLI, and MCP server in one package. SDK + CLI talk to the builder backend; MCP server adds Chrome CDP capture, provider synthesis, replay, and zkTLS proof.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -44,7 +44,7 @@
 		"README.md"
 	],
 	"engines": {
-		"node": ">=22.18"
+		"node": ">=20"
 	},
 	"repository": {
 		"url": "https://github.com/reclaimprotocol/builder",
@@ -83,7 +83,7 @@
 	"dependencies": {
 		"@hapi/boom": "^9.1.4",
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"@reclaimprotocol/attestor-core": "^5.0.7",
+		"@reclaimprotocol/attestor-core": "^5.0.8",
 		"@reclaimprotocol/client": "*",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",

package/src/old/client.ts

@@ -43,6 +43,10 @@ export interface RegisterProviderBody {
 	userAgent?: { ios?: string, android?: string }
 	/** Accepted at register too. */
 	pageTitle?: string
+	/** Accepted at register too — verified straight from the register
+	 *  controller's destructure + its `providerConfig` write, both of which
+	 *  include it alongside `pageTitle`/`userAgent`. */
+	stepsToFollow?: string
 }
 
 export interface UpdateProviderConfigBody {

package/src/old/to-register.ts

@@ -50,8 +50,8 @@ export interface OldProviderOpts {
 	 *  fresh entries with {@link injectedRequestDataFrom}; a carried-forward
 	 *  value (read back from an existing version) passes through unchanged. */
 	allowedInjectedRequestData?: OldInjectedRequestData[]
-	/** Config (add-version) ONLY — the register endpoint never reads this
-	 *  field from the request body. */
+	/** Accepted at register too (verified from the register controller's
+	 *  destructure + providerConfig write — same as `userAgent`/`pageTitle`). */
 	stepsToFollow?: string
 	/** Config (add-version) ONLY — the register endpoint never reads this
 	 *  field from the request body. */
@@ -231,9 +231,9 @@ export function providerToRegisterBody(
 		body.customInjection = opts.customInjection
 	}
 
-	// Register also accepts these two (unlike allowedInjectedRequestData /
-	// stepsToFollow / useIncognitoWebview / extensionConfig, which the
-	// register controller never reads from the body at all).
+	// Register also accepts these three (unlike allowedInjectedRequestData /
+	// useIncognitoWebview / extensionConfig, which the register controller
+	// never reads from the body at all).
 	if(opts.userAgent !== undefined) {
 		body.userAgent = opts.userAgent
 	}
@@ -242,6 +242,10 @@ export function providerToRegisterBody(
 		body.pageTitle = opts.pageTitle
 	}
 
+	if(opts.stepsToFollow !== undefined) {
+		body.stepsToFollow = opts.stepsToFollow
+	}
+
 	return body
 }
 

package/src/old/tools/publish.ts

@@ -23,9 +23,9 @@ const DEFAULT_VERSION_INFO = 'Updated from MCP browser capture'
 /** Fields with no partial-patch equivalent on this backend: a version always
  *  replaces the WHOLE `providerConfig`, so omitting one of these on
  *  add-version must carry forward the current value rather than publish it
- *  blank. `allowedInjectedRequestData` is handled alongside these (see
- *  `resolveInjectedRequests`) since it needs translation when freshly
- *  authored, unlike these — which pass through unchanged either way. */
+ *  blank. `allowedInjectedRequestData` is handled alongside these (further
+ *  down, inline) since it needs translation when freshly authored, unlike
+ *  these — which pass through unchanged either way. */
 const PRESERVABLE_KEYS = [
 	'customInjection',
 	'userAgent',
@@ -51,7 +51,17 @@ function extractProviderConfig(
 }
 
 /** Prefer the caller's explicit value; otherwise fall back to `current`'s
- *  value (if any) and record `fieldName` as carried forward. */
+ *  value (if any) and record `fieldName` as carried forward.
+ *
+ *  `current === null` is treated the SAME as `undefined` (nothing to carry),
+ *  not as a real value to preserve. These are all optional fields with no
+ *  Prisma default — a version where one was never set reads back as
+ *  `null`, not a missing key, because Prisma normalizes an absent optional
+ *  field to `null` on read. Carrying that `null` "forward" would falsely
+ *  claim the field was preserved when really nothing was ever there — it
+ *  most likely means an EARLIER version already lost it (e.g. published
+ *  before this field had carry-forward support at all), not that this call
+ *  is doing anything wrong. */
 function resolveField<T>(
 	explicit: T | undefined,
 	current: unknown,
@@ -62,7 +72,7 @@ function resolveField<T>(
 		return explicit
 	}
 
-	if(current !== undefined) {
+	if(current !== undefined && current !== null) {
 		carried.push(fieldName)
 		return current as T
 	}
@@ -163,10 +173,16 @@ export function createVersionFromCaptureTool(
 				'`useIncognitoWebview`, `extensionConfig` that you OMIT is carried ' +
 				'forward unchanged from the currently-published version (so ' +
 				're-publishing requestData never wipes a working login script or ' +
-				'other config someone set via the dashboard). Pass an explicit ' +
-				'value (`""`, `[]`, `false`, ...) to intentionally clear one of ' +
-				'them instead, or call get_provider_version_config first to see ' +
-				'exactly what is live today before deciding what to change. ' +
+				'other config someone set via the dashboard). This can only carry ' +
+				'forward what the CURRENT version actually has — if an earlier ' +
+				'version already lost a field (e.g. published before this tool ' +
+				'carried it forward at all), there is nothing left to preserve and ' +
+				'the result legitimately comes back empty/null for that field; ' +
+				'that is not this call failing to carry it forward. Pass an ' +
+				'explicit value (`""`, `[]`, `false`, ...) to intentionally clear ' +
+				'one of them instead, or call get_provider_version_config FIRST ' +
+				'to see exactly what is live today, rather than assuming this ' +
+				'call recovered something that may already be gone. ' +
 				'`allowedInjectedRequestData`/`useIncognitoWebview`/' +
 				'`extensionConfig` only take effect on add-version — the register ' +
 				'endpoint (no `providerId`) ignores them. \n\n' +
@@ -308,7 +324,7 @@ export function createVersionFromCaptureTool(
 						type: 'string',
 						description:
 							'Free-text setup/manual-verification steps shown to the ' +
-							'dev/verifier. Add-version ONLY.',
+							'dev/verifier. Accepted on register too.',
 					},
 					useIncognitoWebview: {
 						type: 'boolean',
@@ -415,6 +431,10 @@ export function createVersionFromCaptureTool(
 					opts.pageTitle = args.pageTitle
 				}
 
+				if(args.stepsToFollow !== undefined) {
+					opts.stepsToFollow = args.stepsToFollow
+				}
+
 				const body = providerToRegisterBody(providers, opts)
 				return withNotes(await client.registerProvider(body))
 			}