Build an AI guest-messaging agent for Airbnb with Claude

curl -X POST https://api.repull.dev/v1/connect/airbnb \
  -H "Authorization: Bearer $REPULL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"redirectUrl": "https://example.com/done", "accessType": "messaging"}'

curl "https://api.repull.dev/v1/conversations?limit=5" \
  -H "Authorization: Bearer $REPULL_API_KEY"

claude mcp add repull \
  --env REPULL_API_KEY=sk_live_YOUR_KEY \
  -- npx -y @repull/mcp

{
  "mcpServers": {
    "repull": {
      "command": "npx",
      "args": ["-y", "@repull/mcp"],
      "env": { "REPULL_API_KEY": "sk_live_YOUR_KEY" }
    }
  }
}

Guest writes on Airbnb
  → Repull sends reservation.message.received to your server (signed)
  → your server loads the conversation and reservation from Repull
  → Claude returns { action: "reply" | "handoff", message, reason }
  → reply: POST it to the conversation  ·  handoff: alert a human

mkdir guest-agent && cd guest-agent
npm init -y && npm pkg set type=module
npm install express @anthropic-ai/sdk zod
npm install -D tsx typescript @types/express @types/node

REPULL_API_KEY=sk_live_...
REPULL_WEBHOOK_SECRET=whsec_...   # from step 3
ANTHROPIC_API_KEY=sk-ant-...

{
  "42399": {
    "name": "Sable Loft",
    "checkIn": "4:00 pm, self check-in with keypad (code sent on arrival day)",
    "checkOut": "10:00 am",
    "wifi": "Network SableLoft, password on the fridge",
    "parking": "One free spot, P2 level, space 14",
    "earlyCheckIn": "Possible from 2 pm if the night before is empty; ask the host",
    "pets": "Not allowed",
    "neighbourhood": "Grocery store 5 minutes' walk; hot springs 10 minutes' drive"
  }
}

curl -X POST https://api.repull.dev/v1/webhooks \
  -H "Authorization: Bearer $REPULL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://YOUR-TUNNEL.example.com/webhooks/repull",
    "events": ["reservation.message.received"],
    "description": "guest agent"
  }'

import express from "express";
import crypto from "node:crypto";
import fs from "node:fs";
import Anthropic from "@anthropic-ai/sdk";
import { z } from "zod";
import { zodOutputFormat } from "@anthropic-ai/sdk/helpers/zod";

const REPULL = "https://api.repull.dev";
const listings: Record<string, Record<string, string>> = JSON.parse(
  fs.readFileSync("listings.json", "utf8"),
);
const anthropic = new Anthropic(); // reads ANTHROPIC_API_KEY
const seen = new Set<string>(); // use your database in production

// --- 1. Verify Repull's signature: HMAC-SHA256 over "<t>.<raw body>" ---
function verify(raw: Buffer, header: string | undefined): boolean {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false; // 5-minute window
  const expected = crypto
    .createHmac("sha256", process.env.REPULL_WEBHOOK_SECRET!)
    .update(`${parts.t}.${raw.toString("utf8")}`)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1 ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

async function repull(path: string, init: RequestInit = {}) {
  const res = await fetch(`${REPULL}${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${process.env.REPULL_API_KEY}`,
      "Content-Type": "application/json",
      ...(init.headers as Record<string, string>),
    },
  });
  const body = await res.json();
  if (!res.ok) {
    throw Object.assign(new Error(body?.error?.message ?? res.statusText), { status: res.status, body });
  }
  return body;
}

// --- 2. What Claude must return ---
const Decision = z.object({
  action: z.enum(["reply", "handoff"]),
  message: z.string().describe("The reply to send to the guest. Empty when handing off."),
  reason: z.string().describe("One line for the host: why this action."),
});

const SYSTEM = `You answer guests of a short-term rental on the host's behalf.
Answer ONLY from the house facts and reservation details you are given.
If the answer is not in them, or the guest asks for a refund, a discount, a date change,
reports damage, a safety issue, or is upset: choose "handoff".
Write like a friendly, brief host. Match the guest's language.
Never include links, email addresses or phone numbers: the channel may refuse the message.`;

async function handle(event: any) {
  const { threadId, reservationId, listingId, body } = event.data;

  // Load context: the newest 30 messages (oldest first for the prompt) and the reservation.
  const thread = await repull(`/v1/conversations/${threadId}/messages?limit=30&order=desc`);
  const transcript = thread.data
    .reverse()
    .map((m: any) => `${m.direction === "inbound" ? "Guest" : "Host"}: ${m.body ?? ""}`)
    .join("\n");

  const reservation = reservationId ? await repull(`/v1/reservations/${reservationId}`) : null;
  const facts = listings[String(reservation?.listingId ?? listingId)];

  const prompt = [
    `House facts:\n${JSON.stringify(facts ?? "none provided", null, 2)}`,
    reservation
      ? `Reservation: ${reservation.guestName}, ${reservation.checkIn} to ${reservation.checkOut}, status ${reservation.status}, via ${reservation.platform}.`
      : "No reservation yet (this is an inquiry).",
    `Conversation so far:\n${transcript || "(no earlier messages)"}`,
    `Newest guest message:\n${body}`,
  ].join("\n\n");

  const response = await anthropic.messages.parse({
    model: "claude-opus-5-5",
    max_tokens: 4000,
    output_config: { effort: "low", format: zodOutputFormat(Decision) },
    system: SYSTEM,
    messages: [{ role: "user", content: prompt }],
  });

  const decision = response.parsed_output;
  if (response.stop_reason === "refusal" || !decision || decision.action === "handoff" || !facts) {
    console.log(`HANDOFF thread ${threadId}: ${decision?.reason ?? "no decision"}`);
    return; // notify the host here: Slack, SMS, email
  }

  // --- 3. Reply on the same conversation. The Idempotency-Key makes a retry safe. ---
  try {
    const sent = await repull(`/v1/conversations/${threadId}/messages`, {
      method: "POST",
      headers: { "Idempotency-Key": `agent-${event.eventId}` },
      body: JSON.stringify({ message: decision.message }),
    });
    console.log(`REPLIED thread ${threadId} (message ${sent.id ?? "?"}): ${decision.message}`);
  } catch (err: any) {
    // e.g. 422 message_not_sent: the channel refused it. Hand off instead of retrying blindly.
    console.log(`SEND FAILED thread ${threadId}: ${err.status} ${err.body?.error?.code}`);
  }
}

const GUEST_SIDE = new Set(["guest", "booker", "cotraveler"]);

const app = express();
app.post("/webhooks/repull", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.body, req.header("X-Repull-Signature"))) {
    res.sendStatus(401);
    return;
  }
  const event = JSON.parse(req.body.toString("utf8"));
  res.sendStatus(200); // acknowledge first; Repull retries anything that isn't 2xx

  if (event.event !== "reservation.message.received") return;
  if (!GUEST_SIDE.has(event.data?.from?.type)) return; // never answer the host, the channel or support
  if (seen.has(event.eventId)) return; // eventId is stable across retries and replays
  seen.add(event.eventId);

  handle(event).catch((e) => console.error(`agent error: ${e.status ?? ""} ${e.message}`));
});

app.listen(3000, () => console.log("guest agent on :3000"));

npx tsx --env-file=.env agent.ts

curl -X POST https://api.repull.dev/v1/webhooks/$WEBHOOK_ID/test/reservation.message.received \
  -H "Authorization: Bearer $REPULL_API_KEY"