@beryl-so/cli 0.11.1 → 0.17.0

package/dist/local-exec.js

@@ -0,0 +1,176 @@
+import fs from "node:fs";
+import path from "node:path";
+import { startEmailPump } from "./email-pump.js";
+import { PlaywrightMissingError, runSpecLocally, } from "./local-run.js";
+// Client-side mirrors of the server's RUN_IMPORT_* caps: stay under them rather than
+// discover them as a 413/422.
+export const IMPORT_MAX_ERROR_LEN = 5000;
+export const IMPORT_MAX_FILE_BYTES = 14 * 1024 * 1024;
+export const IMPORT_MAX_TOTAL_BYTES = 180 * 1024 * 1024;
+export function toRunEntry(spec, outcome, runError, startedAt, ordinal, redact) {
+    // Mirrors the cloud runner's redact_result: the spec types the secret into the
+    // page, so error text and the DOM snapshot can echo it back — scrub before the
+    // bytes leave this machine. Frames and screenshots are pixels; nothing to scrub.
+    const scrub = (text) => (redact ? text.split(redact).join("***") : text);
+    const scrubBytes = (bytes) => redact && bytes.includes(redact)
+        ? Buffer.from(bytes.toString("utf8").split(redact).join("***"), "utf8")
+        : bytes;
+    const completedAt = new Date().toISOString();
+    const base = {
+        test_case_id: spec.id,
+        started_at: startedAt,
+        completed_at: completedAt,
+        frames: [],
+        frame_urls: [],
+        frame_durations_ms: [],
+        files: [],
+    };
+    if (!outcome) {
+        return {
+            ...base,
+            status: "errored",
+            phase: "main",
+            error_message: scrub(runError ?? "the spec did not run").slice(0, IMPORT_MAX_ERROR_LEN),
+        };
+    }
+    const result = outcome.results[0];
+    const status = result && (result.status === "passed" || result.status === "expected")
+        ? "passed"
+        : "failed";
+    const harvested = outcome.harvested;
+    const entry = {
+        ...base,
+        status,
+        phase: status === "failed" ? (harvested?.phase ?? "main") : "main",
+        ...(result?.error
+            ? { error_message: scrub(result.error).slice(0, IMPORT_MAX_ERROR_LEN) }
+            : {}),
+        ...(result?.duration_ms !== undefined ? { duration_ms: Math.max(0, result.duration_ms) } : {}),
+    };
+    if (!harvested)
+        return entry;
+    // A frame over the per-file cap would force dropping mid-list and shift the
+    // index-aligned url/duration sidecars — drop the whole filmstrip instead.
+    if (harvested.frames.every((f) => f.length <= IMPORT_MAX_FILE_BYTES)) {
+        harvested.frames.forEach((bytes, i) => {
+            const name = `r${ordinal}-frame-${String(i).padStart(3, "0")}.png`;
+            entry.frames.push(name);
+            entry.files.push({ name, bytes });
+        });
+        entry.frame_urls = harvested.frameUrls;
+        entry.frame_durations_ms = harvested.frameDurationsMs;
+    }
+    if (harvested.screenshot && harvested.screenshot.length <= IMPORT_MAX_FILE_BYTES) {
+        entry.screenshot = `r${ordinal}-screenshot.png`;
+        entry.files.push({ name: entry.screenshot, bytes: harvested.screenshot });
+    }
+    if (harvested.domSnapshot && harvested.domSnapshot.length <= IMPORT_MAX_FILE_BYTES) {
+        entry.dom_snapshot = `r${ordinal}-dom.html`;
+        entry.files.push({ name: entry.dom_snapshot, bytes: scrubBytes(harvested.domSnapshot) });
+    }
+    return entry;
+}
+export function buildImportForm(entries, opts) {
+    // Total-size budget: when a big suite would blow past the server's cap, shed whole
+    // filmstrips (largest droppable payload, replay-only) test by test — never
+    // mid-list, and never silently.
+    let total = entries.flatMap((e) => e.files).reduce((n, f) => n + f.bytes.length, 0);
+    for (const entry of entries) {
+        if (total <= IMPORT_MAX_TOTAL_BYTES)
+            break;
+        const frameBytes = entry.files
+            .filter((f) => entry.frames.includes(f.name))
+            .reduce((n, f) => n + f.bytes.length, 0);
+        if (frameBytes === 0)
+            continue;
+        entry.files = entry.files.filter((f) => !entry.frames.includes(f.name));
+        entry.frames = [];
+        entry.frame_urls = [];
+        entry.frame_durations_ms = [];
+        total -= frameBytes;
+        opts.onNote?.(`replay frames for test ${entry.test_case_id} dropped (upload size cap)`);
+    }
+    const manifest = {
+        environment_id: opts.environmentId ?? null,
+        target_url_override: opts.targetUrlOverride ?? null,
+        ...(opts.notifications !== undefined ? { notifications: opts.notifications } : {}),
+        started_at: opts.startedAt,
+        completed_at: opts.completedAt,
+        results: entries.map(({ files: _files, ...rest }) => rest),
+    };
+    const form = new FormData();
+    form.append("manifest", JSON.stringify(manifest));
+    for (const entry of entries) {
+        for (const file of entry.files) {
+            form.append("files", new Blob([new Uint8Array(file.bytes)]), file.name);
+        }
+    }
+    return form;
+}
+/**
+ * Run one rendered spec on this machine with its full service harness: mint a run
+ * inbox when the spec awaits email (deleted after, best-effort), write the
+ * inbox/login sidecars, pump `await_email` requests over the API while Playwright
+ * runs. The one local-execution seam shared by `runs local` and the local-verify
+ * `tests create`. {@link PlaywrightMissingError} propagates (environmental — the
+ * caller decides whether to offer an install); any other throw is captured as
+ * `runError` (the spec never ran: an errored result, not a crashed command).
+ */
+export async function executeLocalSpec(deps, opts) {
+    const { spec } = opts;
+    const inbox = spec.usesEmail
+        ? (await deps.client.post(`/workspaces/${deps.workspaceId}/inboxes`, {
+            ttl_hours: 1,
+            project_id: deps.projectId,
+        }))
+        : undefined;
+    try {
+        const outcome = await runSpecLocally({
+            spec: spec.content,
+            testName: spec.title,
+            dir: opts.dir,
+            harvest: opts.harvest,
+            redact: spec.usesLoginPassword ? opts.loginPassword : undefined,
+            setup: inbox || (spec.usesLoginPassword && opts.loginPassword !== undefined)
+                ? (runDir) => {
+                    if (inbox)
+                        fs.writeFileSync(path.join(runDir, "email-inbox.json"), JSON.stringify({ address: inbox.address }), "utf8");
+                    if (spec.usesLoginPassword && opts.loginPassword !== undefined)
+                        fs.writeFileSync(path.join(runDir, "run-config.json"), JSON.stringify({ login_password: opts.loginPassword }), "utf8");
+                }
+                : undefined,
+            during: (runDir) => {
+                const pump = inbox
+                    ? startEmailPump({
+                        sidecarPath: path.join(runDir, "email-inbox.json"),
+                        client: deps.client,
+                        workspaceId: deps.workspaceId,
+                        inboxId: inbox.id,
+                        since: inbox.created_at,
+                        onEvent: opts.onEvent,
+                    })
+                    : undefined;
+                const extra = opts.onSpawn?.(runDir);
+                return () => {
+                    extra?.();
+                    pump?.stop();
+                };
+            },
+        });
+        return { outcome };
+    }
+    catch (err) {
+        if (err instanceof PlaywrightMissingError)
+            throw err;
+        // The spec never ran (compile error, filtered away) — an errored result the
+        // caller records, not an aborted command.
+        return { runError: err instanceof Error ? err.message : String(err) };
+    }
+    finally {
+        if (inbox) {
+            await deps.client
+                .del(`/workspaces/${deps.workspaceId}/inboxes/${inbox.id}`)
+                .catch(() => undefined);
+        }
+    }
+}

package/dist/local-run.js

@@ -21,6 +21,13 @@ const ISOLATING_CONFIG = (testDir, artifactsDir) => `import { defineConfig } fro
     `  outputDir: ${JSON.stringify(artifactsDir)},\n` +
     `  fullyParallel: false,\n` +
     `});\n`;
+export function copyTextScrubbed(src, dest, redact) {
+    if (!redact) {
+        fs.copyFileSync(src, dest);
+        return;
+    }
+    fs.writeFileSync(dest, fs.readFileSync(src, "utf8").split(redact).join("***"));
+}
 const PASSING = new Set(["passed", "expected"]);
 const SKIPPED = new Set(["skipped"]);
 export class PlaywrightMissingError extends Error {
@@ -95,6 +102,105 @@ export function tally(results) {
 function parseReport(reportPath) {
     return parsePlaywrightReport(JSON.parse(fs.readFileSync(reportPath, "utf8")));
 }
+/** How many filmstrip frames the rendered spec will write — the step total a live
+ *  progress bar counts against. 0 when the spec was rendered without frame capture. */
+export function countPlannedFrames(spec) {
+    return spec.match(/frames\/step-\d+\.png/g)?.length ?? 0;
+}
+export function countWrittenFrames(runDir) {
+    try {
+        return fs
+            .readdirSync(path.join(runDir, "frames"))
+            .filter((f) => /^step-\d+\.png$/.test(f)).length;
+    }
+    catch {
+        return 0;
+    }
+}
+const readIfExists = (p) => {
+    try {
+        return fs.readFileSync(p);
+    }
+    catch {
+        return undefined;
+    }
+};
+function findFirstFile(base, test) {
+    let entries;
+    try {
+        entries = fs.readdirSync(base, { withFileTypes: true });
+    }
+    catch {
+        return undefined;
+    }
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        const full = path.join(base, entry.name);
+        if (entry.isFile() && test(entry.name))
+            return readIfExists(full);
+        if (entry.isDirectory()) {
+            const nested = findFirstFile(full, test);
+            if (nested)
+                return nested;
+        }
+    }
+    return undefined;
+}
+// Mirrors the cloud runner's workdir harvest (_harvest_frames/_harvest_frame_urls/
+// _harvest_frame_step_durations/_harvest_dom_snapshot/_harvest_phase): the same
+// sorted step-*.png order drives all three frame lists so they stay index-aligned.
+function harvestArtifacts(runDir, artifactsDir) {
+    const framesDir = path.join(runDir, "frames");
+    let framePaths = [];
+    try {
+        framePaths = fs
+            .readdirSync(framesDir)
+            .filter((f) => /^step-\d+\.png$/.test(f))
+            .sort()
+            .map((f) => path.join(framesDir, f));
+    }
+    catch {
+        // no frames dir — spec rendered without capture, or it never got that far
+    }
+    const frames = [];
+    const frameUrls = [];
+    const stamps = [];
+    for (const p of framePaths) {
+        const png = readIfExists(p);
+        if (!png)
+            continue;
+        frames.push(png);
+        frameUrls.push(readIfExists(p.replace(/\.png$/, ".url"))?.toString("utf8").trim() ?? "");
+        const raw = readIfExists(p.replace(/\.png$/, ".ts"))?.toString("utf8").trim();
+        const stamp = raw ? Number(raw) : NaN;
+        stamps.push(Number.isFinite(stamp) ? stamp : null);
+    }
+    const frameDurationsMs = stamps.map((stamp, i) => {
+        if (i === 0)
+            return 0;
+        const prev = stamps[i - 1];
+        return stamp !== null && prev !== null && prev !== undefined
+            ? Math.max(0, stamp - prev)
+            : null;
+    });
+    let phase = "main";
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(runDir, "phase.json"), "utf8"));
+        if (parsed.phase && ["setup", "main", "teardown"].includes(parsed.phase)) {
+            phase = parsed.phase;
+        }
+    }
+    catch {
+        // no phase sidecar — an unsectioned spec
+    }
+    return {
+        frames,
+        frameUrls,
+        frameDurationsMs,
+        screenshot: findFirstFile(artifactsDir, (n) => n.endsWith(".png")),
+        domSnapshot: readIfExists(path.join(runDir, "dom-snapshot.html")),
+        phase,
+    };
+}
 /**
  * Write `spec` next to the caller's project, run it with their local @playwright/test, and
  * parse the JSON report into a structured pass/fail summary. Artifacts + the spec + report land
@@ -109,6 +215,11 @@ export async function runSpecLocally(opts) {
     // /tmp finds no node_modules and every run dies with "Cannot find module '@playwright/test'".
     // A run dir under cwd walks up into the project's node_modules; it's always cleaned up.
     const runDir = fs.mkdtempSync(path.join(cwd, ".beryl-local-"));
+    // The spec's sidecar helpers (__vmInbox/__vmRunConfig) read files via require(),
+    // which dies with "require is not defined" when the surrounding project is
+    // "type": "module" (the spec then compiles as ESM). Scoping the run dir back to
+    // CommonJS matches the cloud workdir; node_modules resolution still walks up.
+    fs.writeFileSync(path.join(runDir, "package.json"), '{"type":"commonjs"}\n');
     // Where the user-facing outputs (artifacts, spec copy, report) go: --dir if asked, else the
     // ephemeral run dir.
     const outDir = opts.dir ? path.resolve(opts.dir) : runDir;
@@ -123,8 +234,19 @@ export async function runSpecLocally(opts) {
     const { command, args: base } = playwrightBase(cwd);
     const args = [...base, `--config=${configPath}`, "--reporter=json"];
     opts.onProgress?.(`Running ${command} ${base.join(" ")} on ${opts.testName}…`);
+    await opts.setup?.(runDir);
+    const stop = opts.during?.(runDir);
     const env = { ...process.env, PLAYWRIGHT_JSON_OUTPUT_NAME: reportPath };
-    const result = await runProcess(command, args, cwd, env);
+    // cwd is the RUN dir, not the project: the spec's relative writes (frames/,
+    // email-inbox.json, dom-snapshot.html, phase.json) must land where we harvest and
+    // clean up, exactly as the cloud runner keys them to its per-run workdir.
+    let result;
+    try {
+        result = await runProcess(command, args, runDir, env);
+    }
+    finally {
+        stop?.();
+    }
     if (looksLikePlaywrightMissing(result)) {
         cleanup();
         throw new PlaywrightMissingError(PLAYWRIGHT_INSTALL_HINT);
@@ -148,14 +270,25 @@ export async function runSpecLocally(opts) {
         cleanup();
         throw new Error(`Playwright ran no tests from the rendered spec.\n${detail}`);
     }
+    const harvested = opts.harvest ? harvestArtifacts(runDir, artifactsDir) : undefined;
     let keptSpec = specPath;
     let keptReport = reportPath;
     if (opts.dir) {
-        // Persist the exact spec + report next to the artifacts before the run dir is removed.
+        // Persist the exact spec + report next to the artifacts before the run dir is removed,
+        // plus the spec's relative writes (filmstrip frames, failure DOM) that live in it.
+        // Text files are scrubbed like the uploaded bytes; frames are pixels.
         keptSpec = path.join(outDir, "beryl-local.spec.ts");
         keptReport = path.join(outDir, "report.json");
         fs.copyFileSync(specPath, keptSpec);
-        fs.copyFileSync(reportPath, keptReport);
+        copyTextScrubbed(reportPath, keptReport, opts.redact);
+        const framesSrc = path.join(runDir, "frames");
+        if (fs.existsSync(framesSrc) && framesSrc !== path.join(outDir, "frames")) {
+            fs.cpSync(framesSrc, path.join(outDir, "frames"), { recursive: true, force: true });
+        }
+        const domSrc = path.join(runDir, "dom-snapshot.html");
+        if (fs.existsSync(domSrc) && domSrc !== path.join(outDir, "dom-snapshot.html")) {
+            copyTextScrubbed(domSrc, path.join(outDir, "dom-snapshot.html"), opts.redact);
+        }
     }
     else {
         // Without --dir the artifacts lived in the run dir we're about to delete, so their paths
@@ -165,5 +298,13 @@ export async function runSpecLocally(opts) {
     }
     cleanup();
     const { passed, failed } = tally(results);
-    return { passed, failed, results, directory: outDir, spec: keptSpec, report: keptReport };
+    return {
+        passed,
+        failed,
+        results,
+        directory: outDir,
+        spec: keptSpec,
+        report: keptReport,
+        ...(harvested ? { harvested } : {}),
+    };
 }

package/dist/output.js

@@ -16,6 +16,25 @@ export function statusColor(status) {
         return yellow(status);
     return status;
 }
+// Humans read "2h ago", not "2026-07-28T09:51:45.921815Z". Past a month the
+// relative form stops being informative, so it falls back to the plain date.
+export function timeAgo(value) {
+    if (!value)
+        return "";
+    const t = new Date(String(value)).getTime();
+    if (Number.isNaN(t))
+        return "";
+    const s = Math.max(0, (Date.now() - t) / 1000);
+    if (s < 60)
+        return "just now";
+    if (s < 3600)
+        return `${Math.floor(s / 60)}m ago`;
+    if (s < 86400)
+        return `${Math.floor(s / 3600)}h ago`;
+    if (s < 30 * 86400)
+        return `${Math.floor(s / 86400)}d ago`;
+    return new Date(t).toISOString().slice(0, 10);
+}
 const MAX_CELL = 60;
 function cell(value) {
     if (value === null || value === undefined)

package/dist/progress.js

@@ -0,0 +1,44 @@
+import { dim } from "./output.js";
+const BAR_WIDTH = 18;
+export function renderProgressLine(state) {
+    const stepFraction = state.stepTotal && state.stepTotal > 0
+        ? Math.min(1, (state.step ?? 0) / state.stepTotal)
+        : 0;
+    const fraction = state.total > 0 ? Math.min(1, (state.done + stepFraction) / state.total) : 0;
+    const filled = Math.round(fraction * BAR_WIDTH);
+    const bar = "█".repeat(filled) + "░".repeat(BAR_WIDTH - filled);
+    const pct = `${Math.round(fraction * 100)}%`.padStart(4);
+    const steps = state.stepTotal && state.stepTotal > 0
+        ? ` · step ${Math.min(state.step ?? 0, state.stepTotal)}/${state.stepTotal}`
+        : "";
+    const tally = state.failed > 0 ? ` · ✓${state.passed} ✗${state.failed}` : ` · ✓${state.passed}`;
+    return `[${bar}]${pct} · test ${Math.min(state.done + 1, state.total)}/${state.total}${tally} · ${state.title}${steps}`;
+}
+/** A single rewriting status line on a TTY; quiet elsewhere (the caller prints
+ *  per-test boundary lines instead, so MCP/CI logs stay readable). */
+export class ProgressBar {
+    stream;
+    lastLen = 0;
+    tty;
+    constructor(stream = process.stderr) {
+        this.stream = stream;
+        this.tty = Boolean(stream.isTTY);
+    }
+    get active() {
+        return this.tty;
+    }
+    update(state) {
+        if (!this.tty)
+            return;
+        const line = renderProgressLine(state);
+        const padded = line.padEnd(this.lastLen);
+        this.lastLen = line.length;
+        this.stream.write(`\r${dim(padded)}`);
+    }
+    clear() {
+        if (!this.tty || this.lastLen === 0)
+            return;
+        this.stream.write(`\r${" ".repeat(this.lastLen)}\r`);
+        this.lastLen = 0;
+    }
+}

package/dist/registry/index.js

@@ -1,7 +1,6 @@
 import { accountCommands } from "../commands/account.js";
 import { authCommands } from "../commands/auth.js";
 import { configCommands } from "../commands/config-vars.js";
-import { credentialCommands } from "../commands/credentials.js";
 import { environmentCommands } from "../commands/environments.js";
 import { explorationCommands } from "../commands/explorations.js";
 import { inboxCommands } from "../commands/inboxes.js";
@@ -62,7 +61,6 @@ export const commands = [
     ...explorationCommands,
     ...configCommands,
     ...slackCommands,
-    ...credentialCommands,
     ...inboxCommands,
     ...accountCommands,
     ...mcpCommands,

package/dist/schema.generated.js

@@ -863,6 +863,8 @@ export const ACTION_PLAN_SCHEMA = {
                             "not": {
                                 "enum": [
                                     "inbox_address",
+                                    "login_email",
+                                    "login_password",
                                     "timestamp",
                                     "unique",
                                     "uuid"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beryl-so/cli",
-  "version": "0.11.1",
+  "version": "0.17.0",
   "description": "Beryl on the command line — projects, runs, the exploring agent, and an MCP server over the same commands.",
   "license": "MIT",
   "type": "module",
@@ -27,13 +27,14 @@
     "prepublishOnly": "npm run typecheck && npm test && npm run build",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "dev": "tsx src/index.ts",
+    "dev": "BERYL_API_URL=http://localhost:8000 BERYL_CONFIG_DIR=/tmp/beryl-dev tsx src/index.ts",
     "docs": "tsx scripts/gen-docs.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "devDependencies": {
+    "@playwright/test": "^1.61.1",
     "@types/node": "^26.1.1",
     "tsx": "^4.23.1",
     "typescript": "^7.0.2",

package/dist/commands/credentials.js

@@ -1,178 +0,0 @@
-import { UsageError } from "../errors.js";
-import { dim, green, yellow } from "../output.js";
-import { arg, flagBool, flagStr } from "./util.js";
-const capturePath = (ws, p) => `/auth-capture/workspaces/${ws}/projects/${p}/sessions`;
-export const credentialCommands = [
-    {
-        name: "credentials list",
-        summary: "List the workspace's saved logins",
-        scope: "workspace",
-        groupSummary: "Manage saved logins Beryl reuses to test behind authentication, and attach them to projects.",
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            return { data: await ctx.client.get(`/workspaces/${ws}/credentials`) };
-        },
-    },
-    {
-        name: "credentials get",
-        summary: "Show one saved login (status and freshness — never the session itself)",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            return { data: await ctx.client.get(`/credentials/${arg(input, "credential-id")}`) };
-        },
-    },
-    {
-        name: "credentials projects",
-        summary: "List the projects using a saved login",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            return {
-                data: await ctx.client.get(`/credentials/${arg(input, "credential-id")}/projects`),
-            };
-        },
-    },
-    {
-        name: "credentials delete",
-        summary: "Delete a saved login",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        flags: [{ name: "force", type: "boolean", description: "Skip the confirmation prompt" }],
-        async run(ctx, input) {
-            const id = arg(input, "credential-id");
-            await ctx.confirm(`Delete credential ${id}?`, flagBool(input, "force"));
-            await ctx.client.del(`/credentials/${id}`);
-            return { human: "Deleted." };
-        },
-    },
-    {
-        name: "credentials attach",
-        summary: "Attach a saved login to a project",
-        scope: "project",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            const { projectId } = await ctx.requireProject(input);
-            return {
-                data: await ctx.client.put(`/projects/${projectId}/credential`, {
-                    credential_id: arg(input, "credential-id"),
-                }),
-            };
-        },
-    },
-    {
-        name: "credentials detach",
-        summary: "Detach the project's saved login",
-        scope: "project",
-        async run(ctx, input) {
-            const { projectId } = await ctx.requireProject(input);
-            await ctx.client.del(`/projects/${projectId}/credential`);
-            return { human: "Detached." };
-        },
-    },
-    {
-        name: "credentials recapture",
-        summary: "Start a re-capture for an expiring saved login (returns a live browser URL)",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            return {
-                data: await ctx.client.post(`/credentials/${arg(input, "credential-id")}/recaptures`),
-            };
-        },
-    },
-    {
-        name: "credentials capture",
-        summary: "Capture a login for the project interactively: log in once in a real browser",
-        description: "Opens a live cloud-browser session on the project's site. Log in there like a normal " +
-            "user, come back, and press Enter — Beryl captures the session (encrypted at rest, " +
-            "never shown to anyone) so the agent can test the authenticated app.",
-        scope: "project",
-        interactive: true,
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            const session = (await ctx.client.post(capturePath(workspaceId, projectId)));
-            ctx.err(`\nOpen this URL and log in to the site:\n\n  ${yellow(session.live_view_url)}\n`);
-            await ctx.prompt("Press Enter once you are fully logged in… ");
-            try {
-                await ctx.client.post(`${capturePath(workspaceId, projectId)}/${session.session_id}/capture`);
-            }
-            finally {
-                await ctx.client
-                    .del(`${capturePath(workspaceId, projectId)}/${session.session_id}`)
-                    .catch(() => { });
-            }
-            return { human: `${green("Login captured.")} ${dim("The agent can now test the gated app.")}` };
-        },
-    },
-    {
-        name: "auth-capture start",
-        summary: "Start a login-capture browser session for the project (non-interactive)",
-        scope: "project",
-        groupSummary: "Drive a browser session that captures a target-site login for Beryl to reuse.",
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            return { data: await ctx.client.post(capturePath(workspaceId, projectId)) };
-        },
-    },
-    {
-        name: "auth-capture login",
-        summary: "Log into the target site headlessly with credentials (no human at the browser)",
-        description: "Drives the login inside the capture session started by `auth-capture start`, so " +
-            "an agent can complete start → login → capture with zero human intervention. The " +
-            "credentials are sent to the server, typed into the target site over the wire, and " +
-            "never stored, logged, or returned — the captured session stays encrypted " +
-            "server-side. Follow with `auth-capture capture` to snapshot the authenticated session.",
-        scope: "project",
-        args: [
-            { name: "session-id", description: "Session id from auth-capture start", required: true },
-        ],
-        flags: [
-            { name: "username", type: "string", description: "Login username / email", required: true },
-            { name: "password", type: "string", description: "Login password", required: true },
-            {
-                name: "login-url",
-                type: "string",
-                description: "Explicit login page URL (defaults to the session's current page)",
-            },
-        ],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            const username = flagStr(input, "username");
-            const password = flagStr(input, "password");
-            if (!username || !password)
-                throw new UsageError("--username and --password are required");
-            await ctx.client.post(`${capturePath(workspaceId, projectId)}/${arg(input, "session-id")}/login`, { username, password, login_url: flagStr(input, "login-url") ?? null });
-            return { human: "Logged in." };
-        },
-    },
-    {
-        name: "auth-capture capture",
-        summary: "Capture the session after the user has logged in via the live-view URL",
-        scope: "project",
-        args: [{ name: "session-id", description: "Session id from auth-capture start", required: true }],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.post(`${capturePath(workspaceId, projectId)}/${arg(input, "session-id")}/capture`);
-            return { human: "Captured." };
-        },
-    },
-    {
-        name: "auth-capture refresh",
-        summary: "Capture a refreshed session for a project whose login is expiring",
-        scope: "project",
-        args: [{ name: "session-id", description: "Session id from auth-capture start", required: true }],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.post(`${capturePath(workspaceId, projectId)}/${arg(input, "session-id")}/capture-refresh`);
-            return { human: "Captured." };
-        },
-    },
-    {
-        name: "auth-capture release",
-        summary: "Release a login-capture browser session without capturing",
-        scope: "project",
-        args: [{ name: "session-id", description: "Session id from auth-capture start", required: true }],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.del(`${capturePath(workspaceId, projectId)}/${arg(input, "session-id")}`);
-            return { human: "Released." };
-        },
-    },
-];