@opencode/browse 0.0.3-dev.2 → 0.0.6-dev.17

package/dist/cli-b4sbkefj.mjs

@@ -0,0 +1,1725 @@
+#!/usr/bin/env node
+import {
+  extensionProtocolVersion,
+  extensionProtocolAdvice,
+  dataRoot,
+  fromCheckout,
+  cliCommand,
+  devExtension,
+  installCommand,
+  autoUpdateStatus
+} from "./main-g5mke6rn.mjs";
+import {
+  defaultPort2,
+  isValidSessionId2,
+  portConfig,
+  extensionOriginsConfig,
+  endpointForPort,
+  RelayUnreachable,
+  RelayRejected,
+  Service,
+  layerFetch,
+  shouldWaitForExtensionReconnect,
+  relayBuildProblem,
+  ensureRelay,
+  restartRelay,
+  extensionReconnectWaitMs,
+  ensureExtensionConnected,
+  stoppedRelayStatus,
+  statusCollections
+} from "./main-3qpkwaa7.mjs";
+import {
+  opencodeBrowserVersion2,
+  opencodeBrowserBuildId2
+} from "./main-y7c1atbf.mjs";
+import {
+  addSecret,
+  listSecrets,
+  removeSecret,
+  readClient,
+  socketPath,
+  connect,
+  pair,
+  unpair,
+  settingKeys,
+  formatSettings
+} from "./main-e4stqtf2.mjs";
+import {
+  defaultJournalBaseDir,
+  readJournalEntries,
+  formatJournalEntry
+} from "./main-kvmxefp1.mjs";
+import {
+  updateJson2,
+  formatUpdateNotice2,
+  updateNotice2
+} from "./main-4p2p9eey.mjs";
+import"./main-4bht27ry.mjs";
+
+// src/cli.ts
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { Config, Console, Effect as Effect3, FileSystem as FileSystem3, Layer as Layer2, Option as Option2, Predicate as Predicate2, Result, Schema as Schema3 } from "effect";
+import { Argument, CliError, Command, Flag } from "effect/cli";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// src/cli-output.ts
+import { writeSync } from "node:fs";
+var ExitCode = { ok: 0, failure: 1, usage: 2, auth: 3, host: 4 };
+var failure = (command, code, message, options = {}) => ({
+  ok: false,
+  command,
+  checkedAt: new Date().toISOString(),
+  error: {
+    code,
+    message,
+    ...options.hint ? { hint: options.hint } : {},
+    exitCode: options.exitCode ?? ExitCode.failure
+  }
+});
+var takeJsonFlag = (argv) => ({
+  json: argv.includes("--json"),
+  argv: argv.filter((arg) => arg !== "--json")
+});
+var pause = new Int32Array(new SharedArrayBuffer(4));
+var writeStdout = (text, fd = 1) => {
+  const buffer = Buffer.from(text);
+  let offset = 0;
+  while (offset < buffer.length) {
+    try {
+      offset += writeSync(fd, buffer, offset, buffer.length - offset);
+    } catch (error) {
+      const code = error.code;
+      if (code === "EPIPE")
+        return;
+      if (code !== "EAGAIN")
+        throw error;
+      Atomics.wait(pause, 0, 0, 2);
+    }
+  }
+};
+var printJson = (value) => writeStdout(`${JSON.stringify(value, null, 2)}
+`);
+
+// src/doctor.ts
+import { Effect as Effect2, FileSystem as FileSystem2, Path as Path2, Schema as Schema2 } from "effect";
+
+// src/session-store.ts
+import { Context, Effect, FileSystem, Layer, Option, Path, Predicate, Schema } from "effect";
+class SessionStoreError extends Schema.TaggedError()("SessionStore.SessionStoreError", {
+  message: Schema.String,
+  operation: Schema.String,
+  cause: Schema.Defect()
+}) {
+}
+var StoreFile = Schema.Struct({
+  id: Schema.optionalKey(Schema.String),
+  endpoints: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
+    id: Schema.String
+  })))
+});
+
+class Service2 extends Context.Service()("opencode-browser-cli/SessionStore") {
+}
+var defaultFilePath = () => {
+  return `${dataRoot()}/session.json`;
+};
+var make = Effect.fn("SessionStore.make")(function* (options) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const filePath = options?.filePath ?? defaultFilePath();
+  const port = yield* portConfig.pipe(Effect.mapError((cause) => new SessionStoreError({
+    message: `Invalid OPENCODE_BROWSER_PORT configuration: ${cause.message}`,
+    operation: "configure",
+    cause
+  })));
+  const endpoint = options?.endpoint ?? endpointForPort(port);
+  const defaultEndpoint = endpointForPort(defaultPort2);
+  const storeError = (operation) => (cause) => new SessionStoreError({
+    message: `Could not ${operation} the current session file at ${filePath}`,
+    operation,
+    cause
+  });
+  const readStore = fs.readFileString(filePath).pipe(Effect.map(Option.some), Effect.catchTag("PlatformError", (error) => Predicate.isTagged(error.reason, "NotFound") ? Effect.succeed(Option.none()) : Effect.fail(error)), Effect.mapError(storeError("read")), Effect.flatMap(Option.match({
+    onNone: () => Effect.succeed({}),
+    onSome: (text) => Effect.try({
+      try: () => JSON.parse(text),
+      catch: (cause) => cause
+    }).pipe(Effect.flatMap(Schema.decodeUnknownEffect(StoreFile)), Effect.mapError(storeError("decode")))
+  })));
+  const currentEntries = (store) => {
+    const entries = { ...store.endpoints ?? {} };
+    if (store.id && entries[defaultEndpoint] === undefined) {
+      entries[defaultEndpoint] = { id: store.id };
+    }
+    return entries;
+  };
+  const writeStore = (entries) => fs.makeDirectory(path.dirname(filePath), { recursive: true, mode: 448 }).pipe(Effect.andThen(fs.writeFileString(filePath, `${JSON.stringify({ endpoints: entries }, null, 2)}
+`, { mode: 384 })), Effect.andThen(fs.chmod(filePath, 384)), Effect.mapError(storeError("write")));
+  const read = readStore.pipe(Effect.map((store) => currentEntries(store)[endpoint]?.id));
+  const write = (id) => readStore.pipe(Effect.flatMap((store) => {
+    const entries = currentEntries(store);
+    entries[endpoint] = { id };
+    return writeStore(entries);
+  }));
+  const clear = readStore.pipe(Effect.flatMap((store) => {
+    const entries = currentEntries(store);
+    delete entries[endpoint];
+    return writeStore(entries);
+  }));
+  return Service2.of({ endpoint, filePath, read, write, clear });
+});
+var layer = Layer.effect(Service2, make());
+
+// src/doctor.ts
+var PackageMetadata = Schema2.Struct({
+  name: Schema2.String,
+  version: Schema2.String,
+  bin: Schema2.optionalKey(Schema2.Record(Schema2.String, Schema2.String))
+});
+function extensionManifestVersion(version) {
+  const match = /^(\d+\.\d+\.\d+)(?:-dev\.(\d+)(?:\.\d+)?)?/.exec(version);
+  if (!match)
+    return version;
+  return match[2] ? `${match[1]}.${match[2]}` : match[1];
+}
+var probe = (effect) => effect.pipe(Effect2.match({
+  onFailure: (error) => ({ ok: false, error: errorMessage(error) }),
+  onSuccess: (value) => ({ ok: true, value })
+}));
+var errorMessage = (error) => {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+};
+var createDoctorReport = Effect2.fn("Doctor.createReport")(function* (options) {
+  const relay = yield* Service;
+  const store = yield* Service2;
+  const fs = yield* FileSystem2.FileSystem;
+  const path = yield* Path2.Path;
+  const readJsonFile = (relativePath, schema) => fs.readFileString(path.join(options.packageRoot, relativePath)).pipe(Effect2.mapError((cause) => new Error(`read ${relativePath}: ${cause.reason.message}`)), Effect2.flatMap((text) => Effect2.try({
+    try: () => JSON.parse(text),
+    catch: () => new Error(`parse ${relativePath}: invalid JSON`)
+  })), Effect2.flatMap((value) => Schema2.decodeUnknownEffect(schema)(value).pipe(Effect2.mapError((cause) => new Error(`decode ${relativePath}: ${cause.message}`)))));
+  const readPackageInfo = readJsonFile("package.json", PackageMetadata).pipe(Effect2.map((metadata) => ({
+    name: metadata.name,
+    version: metadata.version,
+    bin: {
+      opencodeBrowser: metadata.bin?.["opencode-browser"] ?? null
+    }
+  })));
+  const fileExists = (relativePath) => fs.exists(path.join(options.packageRoot, relativePath)).pipe(Effect2.orElseSucceed(() => false));
+  const [packageResult, distCliExists, distMcpExists, currentResult] = yield* Effect2.all([
+    probe(readPackageInfo),
+    fileExists("dist/cli.mjs"),
+    fileExists("dist/cli.mjs"),
+    probe(store.read)
+  ]);
+  const expectedExtensionVersion = packageResult.ok ? { ok: true, value: extensionManifestVersion(packageResult.value.version) } : packageResult;
+  const relayResult = yield* probe(relay.version);
+  const relayBuildMatches = relayResult.ok ? relayResult.value.buildId ? relayBuildProblem(relayResult.value, opencodeBrowserBuildId2) === undefined : null : null;
+  const [extensionResult, targetsResult, sessionsResult] = relayResult.ok ? yield* Effect2.all([
+    probe(relay.extensionStatus),
+    probe(relay.targets),
+    probe(relay.sessions)
+  ]) : [
+    { ok: false, error: relayResult.error },
+    { ok: false, error: relayResult.error },
+    { ok: false, error: relayResult.error }
+  ];
+  const expectedVersion = expectedExtensionVersion.ok ? expectedExtensionVersion.value : null;
+  const extensionVersion = extensionResult.ok ? extensionResult.value.version : null;
+  const extensionVersionMatches = extensionResult.ok && extensionVersion && expectedVersion ? extensionVersion === expectedVersion : null;
+  const current = currentResult.ok ? currentResult.value ?? null : null;
+  const targets = targetsResult.ok ? targetsResult.value : [];
+  const sessions = sessionsResult.ok ? sessionsResult.value : [];
+  const staleCurrent = Boolean(current && sessionsResult.ok && !sessions.some((session) => {
+    return session.id === current;
+  }));
+  const relayOwnedTargets = targets.filter((target) => {
+    return target.owner === "relay";
+  });
+  const unhealthyTargets = targets.filter((target) => {
+    return target.crashed === true || target.url.startsWith("chrome-error://");
+  });
+  const possibleLeakedSessions = sessions.filter((session) => {
+    return session.connected && session.id !== current;
+  });
+  const artifacts = [
+    { path: "dist/cli.mjs", exists: distCliExists && distMcpExists }
+  ];
+  const checks = buildDoctorChecks({
+    packageResult,
+    relayResult,
+    extensionResult,
+    expectedExtensionVersion,
+    artifacts,
+    currentResult,
+    staleCurrent,
+    relayOwnedTargets,
+    unhealthyTargets,
+    possibleLeakedSessions,
+    targetsResult,
+    sessionsResult,
+    update: options.update ?? null
+  });
+  const report = {
+    status: summarizeCheckStatus(checks),
+    endpoint: relay.endpoint,
+    cli: { version: opencodeBrowserVersion2, buildId: opencodeBrowserBuildId2 },
+    package: {
+      path: path.join(options.packageRoot, "package.json"),
+      name: packageResult.ok ? packageResult.value.name : null,
+      version: packageResult.ok ? packageResult.value.version : null,
+      bin: {
+        opencodeBrowser: packageResult.ok ? Boolean(packageResult.value.bin.opencodeBrowser) : false
+      },
+      error: packageResult.ok ? null : packageResult.error
+    },
+    relay: {
+      reachable: relayResult.ok,
+      version: relayResult.ok ? relayResult.value.version : null,
+      buildId: relayResult.ok ? relayResult.value.buildId ?? null : null,
+      buildMatches: relayBuildMatches,
+      error: relayResult.ok ? null : relayResult.error
+    },
+    extension: {
+      connected: extensionResult.ok ? extensionResult.value.connected : null,
+      version: extensionVersion,
+      expectedVersion,
+      versionMatches: extensionVersionMatches,
+      protocolVersion: extensionResult.ok ? extensionResult.value.protocolVersion ?? null : null,
+      expectedProtocolVersion: extensionProtocolVersion,
+      protocolCompatible: extensionResult.ok ? extensionResult.value.protocolCompatible ?? null : null,
+      protocolLegacy: extensionResult.ok ? extensionResult.value.protocolLegacy ?? null : null,
+      rejectedConnections: extensionResult.ok ? extensionResult.value.rejectedConnections ?? null : null,
+      error: extensionResult.ok ? null : extensionResult.error
+    },
+    targets: {
+      active: extensionResult.ok ? extensionResult.value.activeTargets : null,
+      child: extensionResult.ok ? extensionResult.value.childTargets ?? null : null,
+      relayOwned: relayOwnedTargets,
+      unhealthy: unhealthyTargets,
+      all: targets,
+      error: targetsResult.ok ? null : targetsResult.error
+    },
+    sessions: {
+      current,
+      staleCurrent,
+      possibleLeaked: possibleLeakedSessions,
+      all: sessions,
+      error: sessionsResult.ok ? currentResult.ok ? null : currentResult.error : sessionsResult.error
+    },
+    artifacts,
+    update: options.update ?? null,
+    checks,
+    recommendations: buildDoctorRecommendations({
+      update: options.update ?? null,
+      relayResult,
+      extensionResult,
+      artifacts,
+      staleCurrent,
+      current,
+      unhealthyTargets
+    })
+  };
+  return report;
+});
+function buildDoctorChecks(options) {
+  const packageBinChecks = options.packageResult.ok ? [
+    {
+      id: "bin-opencode-browser",
+      label: "opencode-browser bin",
+      status: options.packageResult.value.bin.opencodeBrowser ? "ok" : "fail",
+      message: options.packageResult.value.bin.opencodeBrowser ?? "missing from package.json bin"
+    }
+  ] : [];
+  const artifactChecks = options.artifacts.map((artifact) => {
+    return {
+      id: `artifact-${artifact.path}`,
+      label: artifact.path,
+      status: artifact.exists ? "ok" : "warn",
+      message: artifact.exists ? artifact.version ? `exists (${artifact.version})` : "exists" : "missing"
+    };
+  });
+  return [
+    {
+      id: "package-metadata",
+      label: "package metadata",
+      status: options.packageResult.ok ? "ok" : "fail",
+      message: options.packageResult.ok ? `${options.packageResult.value.name} ${options.packageResult.value.version}` : options.packageResult.error
+    },
+    ...packageBinChecks,
+    {
+      id: "relay-http",
+      label: "relay HTTP endpoint",
+      status: options.relayResult.ok ? "ok" : "fail",
+      message: options.relayResult.ok ? `reachable (${options.relayResult.value.version})` : options.relayResult.error
+    },
+    relayBuildCheck({ relayResult: options.relayResult, cliBuildId: opencodeBrowserBuildId2 }),
+    {
+      id: "extension-connected",
+      label: "extension connection",
+      status: options.extensionResult.ok && options.extensionResult.value.connected ? "ok" : "fail",
+      message: options.extensionResult.ok ? options.extensionResult.value.connected ? `connected${options.extensionResult.value.version ? ` (${options.extensionResult.value.version})` : ""}` : "disconnected" : options.extensionResult.error
+    },
+    extensionVersionCheck({
+      extensionResult: options.extensionResult,
+      expectedExtensionVersion: options.expectedExtensionVersion
+    }),
+    extensionProtocolCheck(options.extensionResult),
+    ...options.extensionResult.ok && options.extensionResult.value.rejectedConnections !== undefined ? [{
+      id: "extension-connection-conflicts",
+      label: "competing browser connections",
+      status: options.extensionResult.value.rejectedConnections > 0 ? "warn" : "ok",
+      message: options.extensionResult.value.rejectedConnections > 0 ? `${options.extensionResult.value.rejectedConnections} connection attempt(s) rejected; the active browser connection was preserved` : "none observed on this connection"
+    }] : [],
+    ...options.extensionResult.ok && options.extensionResult.value.pairingState ? [{
+      id: "extension-pairing",
+      label: "extension pairing",
+      status: options.extensionResult.value.connected ? "ok" : "warn",
+      message: options.extensionResult.value.pairingState
+    }] : options.extensionResult.ok && options.extensionResult.value.pairingFailures !== undefined ? [{
+      id: "extension-pairing",
+      label: "extension pairing",
+      status: options.extensionResult.value.pairingFailures > 0 && !options.extensionResult.value.connected ? "warn" : "ok",
+      message: options.extensionResult.value.pairingFailures > 0 ? `${options.extensionResult.value.pairingFailures} connection(s) failed pairing${options.extensionResult.value.connected ? "; a paired extension is connected" : `; update the extension, or run \`${cliCommand("pair")}\` and enter the code on its status page`}` : "no failed pairing attempts"
+    }] : [],
+    ...options.extensionResult.ok && options.extensionResult.value.processFaults !== undefined ? [{
+      id: "relay-process-faults",
+      label: "relay Playwright faults",
+      status: options.extensionResult.value.processFaults.suppressed > 0 ? "warn" : "ok",
+      message: options.extensionResult.value.processFaults.suppressed > 0 ? `${options.extensionResult.value.processFaults.suppressed} uncaught Playwright fault(s) caught and survived${options.extensionResult.value.processFaults.lastMessage ? `; last: ${options.extensionResult.value.processFaults.lastMessage}` : ""}` : "none since the relay started"
+    }] : [],
+    {
+      id: "targets-readable",
+      label: "targets readable",
+      status: options.targetsResult.ok ? "ok" : "fail",
+      message: options.targetsResult.ok ? `${options.targetsResult.value.length} active root target(s)` : options.targetsResult.error
+    },
+    unhealthyTargetsCheck({
+      targetsResult: options.targetsResult,
+      unhealthyTargets: options.unhealthyTargets
+    }),
+    {
+      id: "sessions-readable",
+      label: "sessions readable",
+      status: options.sessionsResult.ok ? "ok" : "fail",
+      message: options.sessionsResult.ok ? `${options.sessionsResult.value.length} session(s)` : options.sessionsResult.error
+    },
+    {
+      id: "current-session-file",
+      label: "current session file",
+      status: options.currentResult.ok ? "ok" : "warn",
+      message: options.currentResult.ok ? options.currentResult.value ?? "none" : options.currentResult.error
+    },
+    {
+      id: "current-session-stale",
+      label: "current session membership",
+      status: options.staleCurrent ? "warn" : "ok",
+      message: options.staleCurrent ? "current session is not present in relay sessions" : "current session is valid or unset"
+    },
+    {
+      id: "relay-owned-targets",
+      label: "relay-owned active targets",
+      status: "ok",
+      message: options.relayOwnedTargets.length ? `${options.relayOwnedTargets.length} persistent relay-owned target(s)` : "none"
+    },
+    {
+      id: "possible-leaked-sessions",
+      label: "connected non-current sessions",
+      status: "ok",
+      message: options.possibleLeakedSessions.length ? `${options.possibleLeakedSessions.length} connected non-current session(s)` : "none"
+    },
+    ...artifactChecks,
+    ...options.update ? [{
+      id: "update",
+      label: "update",
+      status: "ok",
+      message: `available: ${options.update.summary}`
+    }] : []
+  ];
+}
+var makeDoctorCheck = (id, label) => (status, message) => ({
+  id,
+  label,
+  status,
+  message
+});
+function unhealthyTargetsCheck(options) {
+  const check = makeDoctorCheck("unhealthy-targets", "crashed or browser-error targets");
+  if (!options.targetsResult.ok) {
+    return check("warn", `target health unknown: ${options.targetsResult.error}`);
+  }
+  return check(options.unhealthyTargets.length ? "warn" : "ok", options.unhealthyTargets.length ? `${options.unhealthyTargets.length} unhealthy target(s)` : "none");
+}
+function relayBuildCheck(options) {
+  const check = makeDoctorCheck("relay-build", "relay build");
+  if (!options.relayResult.ok) {
+    return check("warn", "relay unreachable; cannot compare builds");
+  }
+  const relayBuildId = options.relayResult.value.buildId;
+  if (!relayBuildId) {
+    return check("warn", "running relay does not report a build id");
+  }
+  const matches = relayBuildId === options.cliBuildId;
+  return check(matches ? "ok" : "warn", matches ? `matches CLI build (${options.cliBuildId})` : `runtime ${relayBuildId} does not match CLI ${options.cliBuildId}`);
+}
+function extensionVersionCheck(options) {
+  const check = makeDoctorCheck("extension-version", "extension version");
+  if (!options.extensionResult.ok) {
+    return check("warn", options.extensionResult.error);
+  }
+  if (!options.extensionResult.value.connected) {
+    return check("warn", "extension disconnected; cannot compare runtime version");
+  }
+  if (!options.expectedExtensionVersion.ok) {
+    return check("warn", `could not read this CLI's version: ${options.expectedExtensionVersion.error}`);
+  }
+  const runtimeVersion = options.extensionResult.value.version;
+  if (!runtimeVersion) {
+    return check("warn", "extension did not report a version");
+  }
+  return check("ok", runtimeVersion === options.expectedExtensionVersion.value ? `matches this CLI (${options.expectedExtensionVersion.value})` : `extension ${runtimeVersion} differs from this CLI's ${options.expectedExtensionVersion.value}; protocol compatibility determines support`);
+}
+function extensionProtocolCheck(extensionResult) {
+  const check = makeDoctorCheck("extension-protocol", "extension protocol");
+  if (!extensionResult.ok) {
+    return check("warn", extensionResult.error);
+  }
+  const protocolVersion = extensionResult.value.protocolVersion;
+  const protocolCompatible = extensionResult.value.protocolCompatible;
+  if (protocolCompatible === false) {
+    return check("fail", `runtime ${protocolVersion ?? "unknown"} is incompatible with relay ${extensionProtocolVersion}`);
+  }
+  if (extensionResult.value.protocolLegacy === true) {
+    return check("warn", `legacy extension does not report its protocol; relay infers ${protocolVersion ?? "unknown"}`);
+  }
+  if (protocolVersion === undefined || protocolVersion === null) {
+    return check("warn", "extension protocol is unknown");
+  }
+  return check("ok", `runtime ${protocolVersion} is compatible with relay ${extensionProtocolVersion}`);
+}
+function buildDoctorRecommendations(options) {
+  const relayRecommendations = options.relayResult.ok ? [] : [
+    `Run a relay-backed command to start the detached relay automatically; use \`${cliCommand("serve")}\` only for foreground debugging.`
+  ];
+  const relayBuildRecommendations = options.relayResult.ok ? [relayBuildProblem(options.relayResult.value)].filter((message) => message !== undefined) : [];
+  const extensionRecommendations = options.relayResult.ok && options.extensionResult.ok && !options.extensionResult.value.connected ? options.extensionResult.value.nextStep ? [options.extensionResult.value.nextStep] : options.extensionResult.value.protocolCompatible === false ? [extensionProtocolAdvice(options.extensionResult.value.protocolVersion, { install: installCommand() })] : [fromCheckout() || devExtension() ? `Run \`${installCommand()}\` and load the extension it points to (Load unpacked on your browser's extensions page).` : `Run \`${installCommand()}\`, and install Browse from the Chrome Web Store page it opens.`] : [];
+  const artifactRecommendations = options.artifacts.some((artifact) => {
+    return !artifact.exists;
+  }) ? [`Rebuild or reinstall the missing files with \`${installCommand()}\`.`] : [];
+  const connectionConflictRecommendations = options.extensionResult.ok && (options.extensionResult.value.rejectedConnections ?? 0) > 0 ? ["Keep Browse enabled in one browser/profile. To switch, disable it in the current browser before connecting the other; new sessions do not change the active browser."] : [];
+  const staleSessionRecommendations = options.staleCurrent && options.current ? [
+    `Current session ${options.current} is stale; run \`${cliCommand("session new")}\` or \`${cliCommand("session use <id>")}\` after the relay is running.`
+  ] : [];
+  const unhealthyTargetRecommendations = options.unhealthyTargets.length ? [
+    "A target is crashed or showing a browser error page. Run the owning session once to trigger relay-owned recovery, or reset/re-adopt a user-owned tab."
+  ] : [];
+  return [
+    ...options.update ? [options.update.notice] : [],
+    ...relayRecommendations,
+    ...relayBuildRecommendations,
+    ...extensionRecommendations,
+    ...connectionConflictRecommendations,
+    ...artifactRecommendations,
+    ...staleSessionRecommendations,
+    ...unhealthyTargetRecommendations
+  ];
+}
+function summarizeCheckStatus(checks) {
+  if (checks.some((check) => {
+    return check.status === "fail";
+  })) {
+    return "fail";
+  }
+  if (checks.some((check) => {
+    return check.status === "warn";
+  })) {
+    return "warn";
+  }
+  return "ok";
+}
+function formatDoctorReport(report) {
+  const lines = [
+    "Browse doctor",
+    `Status: ${report.status}`,
+    `Endpoint: ${report.endpoint}`,
+    `CLI: ${report.cli.version} (${report.cli.buildId})`,
+    `Package: ${report.package.name && report.package.version ? `${report.package.name} ${report.package.version}` : report.package.error ?? "unknown"}`,
+    `Relay: ${report.relay.reachable ? `reachable (${report.relay.version ?? "unknown"}, ${report.relay.buildId ?? "unknown build"})` : `unreachable (${report.relay.error ?? "unknown error"})`}`,
+    `Extension: ${formatExtensionSummary(report)}`,
+    `Targets: active=${formatNullableNumber(report.targets.active)} child=${formatNullableNumber(report.targets.child)} relay-owned=${report.targets.relayOwned.length} unhealthy=${report.targets.unhealthy.length}`,
+    `Sessions: current=${report.sessions.current ?? "none"} total=${report.sessions.all.length} connected=${report.sessions.all.filter((session) => {
+      return session.connected;
+    }).length}`,
+    "",
+    "Checks:",
+    ...report.checks.map((check) => {
+      return `[${check.status}] ${check.label}: ${check.message}`;
+    })
+  ];
+  const targetLines = report.targets.relayOwned.map((target) => {
+    return `- ${formatTargetSummary(target)}`;
+  });
+  const unhealthyTargetLines = report.targets.unhealthy.map((target) => {
+    return `- ${formatTargetSummary(target)}`;
+  });
+  const sessionLines = report.sessions.possibleLeaked.map((session) => {
+    return `- ${session.id} ${session.pageUrl ?? "no page yet"}`;
+  });
+  const details = [
+    ...targetLines.length ? ["", "Relay-owned targets:", ...targetLines] : [],
+    ...unhealthyTargetLines.length ? ["", "Unhealthy targets:", ...unhealthyTargetLines] : [],
+    ...sessionLines.length ? ["", "Connected non-current sessions:", ...sessionLines] : [],
+    ...report.recommendations.length ? ["", "Next steps:", ...report.recommendations.map((item) => {
+      return `- ${item}`;
+    })] : []
+  ];
+  return [...lines, ...details].join(`
+`);
+}
+function formatExtensionSummary(report) {
+  if (report.extension.connected === null) {
+    return `unknown (${report.extension.error ?? "relay unreachable"})`;
+  }
+  const version = report.extension.version ? ` (${report.extension.version})` : "";
+  const protocol = report.extension.protocolVersion === null ? "" : `, protocol ${report.extension.protocolVersion} ${report.extension.protocolCompatible === false ? "incompatible" : "compatible"}`;
+  const match = report.extension.versionMatches === null ? "" : report.extension.versionMatches ? ", matches the CLI's version" : ", differs from the CLI's version";
+  return `${report.extension.connected ? "connected" : "disconnected"}${version}${protocol}${match}`;
+}
+function formatNullableNumber(value) {
+  return value === null ? "unknown" : String(value);
+}
+function formatTargetSummary(target, options = {}) {
+  const tab = target.tabId === undefined ? "" : ` tab=${target.tabId}`;
+  const session = options.includeSession && target.opencodeBrowserSessionId ? ` session=${target.opencodeBrowserSessionId}` : "";
+  const owner = target.owner ? ` owner=${target.owner}` : "";
+  const health = `${target.crashed ? " crashed=true" : ""}${target.protectedUi ? " protected-ui=true" : ""}`;
+  return `${target.type} ${target.id}${tab}${session}${owner}${health} ${target.url || "about:blank"}`;
+}
+
+// src/cli.ts
+var packageRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+var sessionIdConfig = Config.option(Config.String("OPENCODE_BROWSER_SESSION"));
+var agentSessionIdConfig = Config.option(Config.String("OPENCODE_SESSION_ID"));
+var targetUrlConfig = Config.option(Config.String("OPENCODE_BROWSER_TARGET_URL"));
+var targetIndexConfig = Config.option(Config.Int("OPENCODE_BROWSER_TARGET_INDEX"));
+var encodedCliOperandsMarker = "bc-cli-operands:v1";
+var encodedCliOperandPrefix = "bc-cli-operand:";
+var jsonFlag = Flag.Boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Print machine-readable JSON"));
+var sessionFlag = (description) => {
+  const flag = Flag.String("session").pipe(Flag.optional, Flag.withAlias("s"));
+  return description ? flag.pipe(Flag.withDescription(description)) : flag;
+};
+var tabIdFlag = (description) => {
+  const flag = Flag.Int("tab-id").pipe(Flag.optional);
+  return description ? flag.pipe(Flag.withDescription(description)) : flag;
+};
+var failExit = Effect3.sync(() => {
+  process.exitCode = ExitCode.failure;
+});
+var exitWith = (code) => Effect3.sync(() => {
+  process.exitCode = code;
+});
+var hostErrorTags = new Set(["RelayClient.RelayUnreachable", "RelayLifecycle.RelayStartFailed", "RelayLifecycle.ExtensionDisconnected"]);
+function exitCodeForError(error) {
+  if (error instanceof RelayRejected && error.code === "browser-unavailable")
+    return ExitCode.host;
+  const tag = Predicate2.isObject(error) && Predicate2.hasProperty(error, "_tag") ? error._tag : undefined;
+  return Predicate2.isString(tag) && hostErrorTags.has(tag) ? ExitCode.host : ExitCode.failure;
+}
+function hoistJsonFlag(args) {
+  const delimiter = args.indexOf("--");
+  const { json, argv } = takeJsonFlag(delimiter === -1 ? args : args.slice(0, delimiter));
+  if (!json)
+    return { json, argv: args };
+  return { json, argv: [...argv, "--json", ...delimiter === -1 ? [] : args.slice(delimiter)] };
+}
+var stderrLine = (message) => Effect3.sync(() => {
+  process.stderr.write(`opencode-browser: ${message.split(`
+`)[0].slice(0, 300)}
+`);
+});
+var emitJson = (value) => Effect3.sync(() => printJson(value));
+var printOr = (json, value, text) => json ? emitJson(value) : Console.log(text);
+function agentDefaultSessionId(agentSessionId) {
+  const id = agentSessionId ? `oc-${agentSessionId.toLowerCase()}` : undefined;
+  return id && isValidSessionId2(id) ? id : undefined;
+}
+function resolveExplicitSessionSelector(options) {
+  if (options.positional && options.flag) {
+    throw new Error("Use either a positional session id or --session, not both");
+  }
+  return options.flag ?? options.positional ?? options.environment;
+}
+function formatRecordingQuality(quality) {
+  if (!quality)
+    return "Capture quality: unavailable (tab capture or older relay).";
+  return [
+    `Capture: ${quality.width}×${quality.height}, output ${quality.frameRate} fps; source surface ${quality.sourceWidth ?? "?"}×${quality.sourceHeight ?? "?"} CSS px`,
+    `Source frames: ${quality.sourceFrameCount} received (${quality.achievedSourceFrameRate.toFixed(1)}/s), ${quality.encodedSourceFrameCount} retained (${quality.achievedEncodedSourceFrameRate.toFixed(1)}/s), ${quality.coalescedFrameCount} coalesced, ${quality.droppedFrameCount} dropped`,
+    quality.screenshotFallback ? "WARNING: no compositor frames arrived; this video holds a single stop-time screenshot." : "Source counts are compositor events, not a measurement of distinct motion. Inspect the video before sharing."
+  ].join(`
+`);
+}
+function normalizeCliArguments(args) {
+  const delimiter = args.indexOf("--");
+  const secretsRun = args.findIndex((argument, index) => argument === "secrets" && args[index + 1] === "run");
+  if (delimiter === -1 || secretsRun === -1 || secretsRun > delimiter)
+    return args;
+  return [
+    ...args.slice(0, delimiter),
+    encodedCliOperandsMarker,
+    ...args.slice(delimiter + 1).map((operand) => `${encodedCliOperandPrefix}${encodeURIComponent(operand)}`)
+  ];
+}
+function decodeCliOperands(operands) {
+  if (operands[0] !== encodedCliOperandsMarker)
+    return operands;
+  return operands.slice(1).map((operand) => {
+    if (!operand.startsWith(encodedCliOperandPrefix))
+      throw new Error("Invalid encoded secrets run operand");
+    return decodeURIComponent(operand.slice(encodedCliOperandPrefix.length));
+  });
+}
+var readExecuteFile = Effect3.fnUntraced(function* (filePath) {
+  const fs = yield* FileSystem3.FileSystem;
+  return yield* fs.readFileString(path.resolve(filePath)).pipe(Effect3.mapError((cause) => new Error(`read execute file ${filePath}: ${cause.reason.message}`, { cause })));
+});
+var ensureCliRelay = Effect3.fnUntraced(function* () {
+  const relay = yield* Service;
+  const readiness = yield* ensureRelay({ relay });
+  if (readiness.started) {
+    yield* Console.error(`Started Browse relay at ${relay.endpoint}`);
+  }
+  if (readiness.buildProblem) {
+    return yield* Effect3.fail(new Error(readiness.buildProblem));
+  }
+  return readiness;
+});
+var ensureCliRelayAndExtension = Effect3.fnUntraced(function* (sessionId) {
+  const relay = yield* Service;
+  const readiness = yield* ensureCliRelay();
+  yield* ensureExtensionConnected({
+    relay,
+    sessionId,
+    waitForReconnect: shouldWaitForExtensionReconnect(readiness),
+    onWait: Console.error(`Waiting up to ${extensionReconnectWaitMs / 1000}s for the Browse extension to reconnect`)
+  });
+});
+var resolveSelectedSessionId = Effect3.fnUntraced(function* (explicitSessionId) {
+  const store = yield* Service2;
+  const sessionId = explicitSessionId ?? (yield* store.read);
+  if (!sessionId) {
+    return yield* Effect3.fail(new Error("No session provided and no current Browse session exists"));
+  }
+  return sessionId;
+});
+var resolvePositionalOrFlagSessionId = Effect3.fnUntraced(function* (id, session) {
+  return yield* resolveSelectedSessionId(resolveExplicitSessionSelector({
+    positional: Option2.getOrUndefined(id),
+    flag: Option2.getOrUndefined(session),
+    environment: Option2.getOrUndefined(yield* sessionIdConfig)
+  }));
+});
+var ensureSessionExists = Effect3.fnUntraced(function* (id) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const sessions = yield* relay.sessions;
+  const exists = sessions.some((session) => {
+    return session.id === id;
+  });
+  if (!exists) {
+    return yield* Effect3.fail(new Error(`Session not found: ${id}`));
+  }
+});
+var recordingTarget = Effect3.fnUntraced(function* (options) {
+  const sessionId = Option2.getOrUndefined(options.session);
+  const tabId = Option2.getOrUndefined(options.tabId);
+  if (sessionId && tabId !== undefined) {
+    return yield* Effect3.fail(new Error("Use only one recording target selector: --session or --tab-id"));
+  }
+  return {
+    ...sessionId ? { sessionId } : {},
+    ...tabId === undefined ? {} : { tabId }
+  };
+});
+var parseRecordingModeOption = Effect3.fnUntraced(function* (value) {
+  if (value === undefined) {
+    return;
+  }
+  if (value === "auto" || value === "tab-capture" || value === "cdp") {
+    return value;
+  }
+  return yield* Effect3.fail(new Error("Recording mode must be auto, tab-capture, or cdp"));
+});
+function formatExecuteLogs(logs) {
+  return [
+    "Console logs:",
+    ...logs.map((log) => {
+      const location = log.location?.url ? ` ${log.location.url}:${log.location.lineNumber}:${log.location.columnNumber}` : "";
+      return `[${log.source}:${log.type}]${location} ${log.text}`;
+    })
+  ].join(`
+`);
+}
+function formatAftermath(aftermath) {
+  const parts = [];
+  if (aftermath.startUrl !== aftermath.endUrl) {
+    parts.push(`Page: ${aftermath.startUrl ?? "none"} -> ${aftermath.endUrl ?? "none"}`);
+  }
+  if (aftermath.navigations.length > 1) {
+    parts.push(`navigations=${aftermath.navigations.length}`);
+  }
+  if (aftermath.pageErrorCount > 0) {
+    parts.push(`pageErrors=${aftermath.pageErrorCount}`);
+  }
+  if (aftermath.handoffs > 0) {
+    parts.push(`handoffs=${aftermath.handoffs}`);
+  }
+  return parts.length > 0 ? parts.join(" ") : null;
+}
+var ScriptErrorEnvelope = Schema3.TaggedStruct("ScriptError", {
+  message: Schema3.String
+});
+function executeJsonEnvelope(result) {
+  const hasStructuredValue = Object.hasOwn(result, "value") && result.value !== undefined;
+  return {
+    ok: !result.isError,
+    isError: result.isError,
+    text: result.text,
+    value: hasStructuredValue ? result.value : null,
+    valueUnavailable: !hasStructuredValue,
+    ...result.isError ? { error: ScriptErrorEnvelope.make({ message: result.text }) } : {},
+    logs: result.logs,
+    warnings: result.warnings ?? [],
+    ...result.diagnostic ? { diagnostic: result.diagnostic } : {},
+    ...result.aftermath ? { aftermath: result.aftermath } : {},
+    session: result.session
+  };
+}
+function formatSessionContinuation(sessionId) {
+  return `Session: ${sessionId}. Continue with --session ${sessionId}.`;
+}
+function errorJsonEnvelope(error) {
+  const tag = Predicate2.isObject(error) && Predicate2.hasProperty(error, "_tag") && Predicate2.isString(error._tag) ? error._tag : "Error";
+  const message = error instanceof Error ? error.message : String(error);
+  const errorValue = Object.assign({ message }, { _tag: tag });
+  return { ok: false, isError: true, text: message, value: null, valueUnavailable: true, error: errorValue, logs: [], warnings: [] };
+}
+var serve = Command.make("serve", {}, Effect3.fn("Cli.serve")(function* () {
+  const [{ startRelay }, { parseAdditionalExtensionOrigins }] = yield* Effect3.promise(() => Promise.all([import("./relay-ns525pms.mjs"), import("./relay-helpers-pjcbxs7p.mjs")]));
+  const port = yield* portConfig;
+  const additionalExtensionOrigins = parseAdditionalExtensionOrigins(yield* extensionOriginsConfig);
+  yield* Effect3.scoped(Effect3.gen(function* () {
+    const relay = yield* startRelay({ port, additionalExtensionOrigins });
+    yield* Console.log(`Browse relay listening at ${relay.url}`);
+    yield* Console.log(`Browse connects automatically while the browser runs. Run \`${cliCommand("status")}\` to check.`);
+    yield* Effect3.never;
+  }));
+})).pipe(Command.withDescription("Start the local Browse relay"));
+var relayRestart = Command.make("restart", {
+  force: Flag.Boolean("force").pipe(Flag.withDefault(false), Flag.withDescription("End network captures and recordings (discarding them) and disconnect raw CDP clients instead of refusing to restart"))
+}, Effect3.fn("Cli.relayRestart")(function* ({ force }) {
+  const relay = yield* Service;
+  yield* Console.error("Restarting the relay leaves browser tabs open but resets in-memory JavaScript state.");
+  const readiness = yield* restartRelay({ relay, clientKind: "cli", force });
+  yield* Console.log(`${readiness.started ? "Started" : "Reused concurrent replacement"} Browse relay at ${relay.endpoint} (${readiness.version.buildId})`);
+})).pipe(Command.withDescription("Explicitly drain and restart the managed relay using this installation"));
+var relay = Command.make("relay").pipe(Command.withDescription("Manage the local relay lifecycle"), Command.withSubcommands([relayRestart]));
+var execute = Command.make("execute", {
+  code: Argument.String("code").pipe(Argument.variadic({ min: 0 })),
+  file: Flag.String("file").pipe(Flag.optional, Flag.withDescription("Read execute code from a file")),
+  session: sessionFlag("Continue an existing Browse session; defaults to the OpenCode agent's session"),
+  rm: Flag.Boolean("rm").pipe(Flag.withDefault(false), Flag.withDescription("Use a fresh one-shot session and close its tabs afterward")),
+  timeoutMs: Flag.Int("timeout-ms").pipe(Flag.optional, Flag.withDescription("Overall script timeout in milliseconds (paused during handoff); defaults to 60000, 0 disables")),
+  targetUrl: Flag.String("target-url").pipe(Flag.optional, Flag.withDescription("Use the attached page whose URL contains this text")),
+  targetIndex: Flag.Int("target-index").pipe(Flag.optional, Flag.withDescription("Use the attached page at this zero-based index")),
+  json: Flag.Boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Print a machine-readable result envelope: { ok, isError, text, value, valueUnavailable, error?, logs, warnings, diagnostic?, aftermath, session }"))
+}, Effect3.fn("Cli.execute")(function* ({ code, file, session, rm, timeoutMs, targetUrl, targetIndex, json }) {
+  const run = Effect3.gen(function* () {
+    const relay = yield* Service;
+    const filePath = Option2.getOrUndefined(file);
+    if (code.length > 0 && filePath) {
+      return yield* Effect3.fail(new Error("Use either positional code or --file, not both"));
+    }
+    if (code.length === 0 && !filePath) {
+      return yield* Effect3.fail(new Error("Execute requires positional code or --file <path>"));
+    }
+    const timeoutMsValue = Option2.getOrUndefined(timeoutMs);
+    if (timeoutMsValue !== undefined && timeoutMsValue < 0) {
+      return yield* Effect3.fail(new Error("Timeout must be a non-negative integer"));
+    }
+    const executeCode = filePath ? yield* readExecuteFile(filePath) : code.join(" ");
+    const explicitSessionId = Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig);
+    if (rm && explicitSessionId) {
+      return yield* Effect3.fail(new Error("Use --rm without --session or OPENCODE_BROWSER_SESSION"));
+    }
+    const agentWorkSessionId = agentDefaultSessionId(Option2.getOrUndefined(yield* agentSessionIdConfig));
+    const workSessionId = explicitSessionId ?? (rm ? undefined : agentWorkSessionId);
+    yield* ensureCliRelayAndExtension(workSessionId);
+    const targetUrlValue = Option2.getOrUndefined(targetUrl) ?? Option2.getOrUndefined(yield* targetUrlConfig);
+    const targetIndexValue = Option2.getOrUndefined(targetIndex) ?? Option2.getOrUndefined(yield* targetIndexConfig);
+    if (targetIndexValue !== undefined && targetIndexValue < 0) {
+      return yield* Effect3.fail(new Error("Target index must be a non-negative integer"));
+    }
+    if (targetUrlValue && targetIndexValue !== undefined) {
+      return yield* Effect3.fail(new Error("Use only one target selector: --target-url/OPENCODE_BROWSER_TARGET_URL or --target-index/OPENCODE_BROWSER_TARGET_INDEX"));
+    }
+    const result = yield* relay.execute({
+      ...workSessionId ? { sessionId: workSessionId } : {},
+      code: executeCode,
+      createIfMissing: !explicitSessionId || explicitSessionId === agentWorkSessionId,
+      ...rm ? { removeAfterExecute: true } : {},
+      ...timeoutMsValue === undefined ? {} : { timeoutMs: timeoutMsValue },
+      ...targetUrlValue || targetIndexValue !== undefined ? {
+        targetSelection: {
+          ...targetUrlValue ? { urlIncludes: targetUrlValue } : {},
+          ...targetIndexValue !== undefined ? { index: targetIndexValue } : {}
+        }
+      } : {}
+    });
+    if (!explicitSessionId && !rm) {
+      yield* Console.error(formatSessionContinuation(result.session.id));
+    }
+    return result;
+  });
+  if (json) {
+    const outcome = yield* Effect3.result(run);
+    const envelope = Result.isFailure(outcome) ? errorJsonEnvelope(outcome.failure) : executeJsonEnvelope(outcome.success);
+    yield* emitJson(envelope);
+    if (!envelope.ok) {
+      yield* stderrLine(envelope.error?.message ?? envelope.text);
+      yield* exitWith(Result.isFailure(outcome) ? exitCodeForError(outcome.failure) : ExitCode.failure);
+    }
+    return;
+  }
+  const outcome = yield* Effect3.result(run);
+  if (Result.isFailure(outcome)) {
+    yield* Console.error(outcome.failure.message);
+    yield* exitWith(exitCodeForError(outcome.failure));
+    return;
+  }
+  const result = outcome.success;
+  const print = result.isError ? Console.error : Console.log;
+  yield* print(result.text);
+  if (result.logs.length > 0) {
+    yield* print(formatExecuteLogs(result.logs));
+  }
+  yield* Effect3.forEach(result.warnings ?? [], (warning) => print(`Warning: ${warning}`));
+  if (result.diagnostic) {
+    yield* print(`Diagnostic: ${result.diagnostic}`);
+  }
+  const aftermath = result.aftermath ? formatAftermath(result.aftermath) : null;
+  if (aftermath) {
+    yield* print(aftermath);
+  }
+  if (result.isError) {
+    yield* failExit;
+  }
+})).pipe(Command.withDescription("Execute Playwright code against the attached browser"));
+var sessionNew = Command.make("new", {
+  name: Argument.String("name").pipe(Argument.optional, Argument.withDescription("Optional lowercase session id")),
+  readOnly: Flag.Boolean("read-only").pipe(Flag.withDefault(false), Flag.withDescription("Create a read-only session: the relay rejects input-dispatching CDP so scripts can inspect but not click or type")),
+  allowOrigin: Flag.String("allow-origin").pipe(Flag.atLeast(0), Flag.withDescription("Only let this session's tabs load these hosts or origins (repeatable or comma-separated): example.com, *.example.com, https://app.example.com, http://localhost:3000"))
+}, Effect3.fn("Cli.sessionNew")(function* ({ name, readOnly, allowOrigin }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const store = yield* Service2;
+  const result = yield* relay.sessionNew(Option2.getOrUndefined(name), {
+    ...readOnly ? { readOnly: true } : {},
+    ...allowOrigin.length > 0 ? { allowedOrigins: allowOrigin } : {}
+  });
+  yield* store.write(result.id);
+  yield* Console.log(result.id);
+})).pipe(Command.withDescription("Create a Browse session and make it current"));
+var sessionList = Command.make("list", {
+  json: jsonFlag
+}, Effect3.fn("Cli.sessionList")(function* ({ json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const store = yield* Service2;
+  const sessions = yield* relay.sessions;
+  const current = yield* store.read;
+  if (json) {
+    yield* emitJson({ current: current ?? undefined, sessions });
+    return;
+  }
+  if (sessions.length === 0) {
+    yield* Console.log("No sessions");
+    return;
+  }
+  yield* Effect3.forEach(sessions, (item) => {
+    const marker = item.id === current ? "*" : " ";
+    const page = item.pageUrl ?? "no page yet";
+    const keys = item.stateKeys.length ? ` state=${item.stateKeys.join(",")}` : "";
+    const readOnly = item.readOnly ? " read-only" : "";
+    const allowed = item.allowedOrigins ? ` allow=${item.allowedOrigins.join(",")}` : "";
+    return Console.log(`${marker} ${item.id} ${page}${keys}${readOnly}${allowed}`);
+  });
+})).pipe(Command.withDescription("List Browse sessions"));
+var sessionCurrent = Command.make("current", {}, Effect3.fn("Cli.sessionCurrent")(function* () {
+  const store = yield* Service2;
+  const current = yield* store.read;
+  yield* Console.log(current ?? "none");
+})).pipe(Command.withDescription("Print the current default session"));
+var sessionUse = Command.make("use", {
+  id: Argument.String("id")
+}, Effect3.fn("Cli.sessionUse")(function* ({ id }) {
+  const store = yield* Service2;
+  yield* ensureSessionExists(id);
+  yield* store.write(id);
+  yield* Console.log(id);
+})).pipe(Command.withDescription("Set the current default session"));
+var sessionReset = Command.make("reset", {
+  id: Argument.String("id").pipe(Argument.optional),
+  session: sessionFlag("Reset this Browse session id")
+}, Effect3.fn("Cli.sessionReset")(function* ({ id, session }) {
+  const relay = yield* Service;
+  const sessionId = yield* resolvePositionalOrFlagSessionId(id, session);
+  yield* ensureCliRelay();
+  const reset = yield* relay.sessionReset(sessionId);
+  if (reset.stopped)
+    yield* Console.error(`Stopped first: ${describeStop(reset.stopped)}`);
+  yield* Console.log(reset.session.id);
+})).pipe(Command.withDescription("Reset a Browse session state and page"));
+var sessionAdopt = Command.make("adopt", {
+  session: sessionFlag("Adopt into this Browse session, creating it when it does not exist yet; omit to create a fresh readable id"),
+  targetUrl: Flag.String("target-url").pipe(Flag.optional, Flag.withDescription("Adopt the attached page whose URL contains this text")),
+  targetIndex: Flag.Int("target-index").pipe(Flag.optional, Flag.withDescription("Adopt the attached page at this zero-based target index")),
+  tabId: tabIdFlag("Adopt the user's shared tab with this Chrome tab id (the tab= value in status)")
+}, Effect3.fn("Cli.sessionAdopt")(function* ({ session, targetUrl, targetIndex, tabId }) {
+  const relay = yield* Service;
+  const explicitSessionId = Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig);
+  yield* ensureCliRelayAndExtension(explicitSessionId);
+  const targetUrlValue = Option2.getOrUndefined(targetUrl);
+  const targetIndexValue = Option2.getOrUndefined(targetIndex);
+  if (targetIndexValue !== undefined && targetIndexValue < 0) {
+    return yield* Effect3.fail(new Error("Target index must be a non-negative integer"));
+  }
+  const tabIdValue = Option2.getOrUndefined(tabId);
+  if ([targetUrlValue, targetIndexValue, tabIdValue].filter((value) => value !== undefined).length > 1) {
+    return yield* Effect3.fail(new Error("Use only one target selector: --target-url, --target-index, or --tab-id"));
+  }
+  const targetSelection = targetUrlValue ? { urlIncludes: targetUrlValue } : targetIndexValue !== undefined ? { index: targetIndexValue } : undefined;
+  const result = yield* relay.sessionAdopt({
+    ...explicitSessionId ? { sessionId: explicitSessionId } : {},
+    createIfMissing: true,
+    ...targetSelection ? { targetSelection } : {},
+    ...tabIdValue === undefined ? {} : { tabId: tabIdValue }
+  });
+  yield* Console.log(`${result.session.created ? "Created and adopted" : "Adopted"} session '${result.session.id}' default page: ${result.adoptedUrl}`);
+  if (result.session.created) {
+    yield* Console.error(formatSessionContinuation(result.session.id));
+  }
+})).pipe(Command.withDescription("Make an attached tab the session's default page"));
+function describeStop(stopped) {
+  return [
+    stopped.execute ? "a running execute" : undefined,
+    stopped.handoff ? "a pending handoff" : undefined
+  ].filter(Boolean).join(" and ") + (stopped.forced ? " (the script did not stop in time and was abandoned with its state)" : "");
+}
+var sessionDelete = Command.make("delete", {
+  id: Argument.String("id").pipe(Argument.optional),
+  session: sessionFlag("Delete this Browse session id")
+}, Effect3.fn("Cli.sessionDelete")(function* ({ id, session }) {
+  const relay = yield* Service;
+  const store = yield* Service2;
+  const sessionId = yield* resolvePositionalOrFlagSessionId(id, session);
+  yield* ensureCliRelay();
+  const deleted = yield* relay.sessionDelete(sessionId);
+  if (deleted.stopped)
+    yield* Console.error(`Stopped first: ${describeStop(deleted.stopped)}`);
+  const current = yield* store.read;
+  if (current === sessionId) {
+    yield* store.clear;
+  }
+  yield* Console.log(sessionId);
+})).pipe(Command.withDescription("Delete a Browse session"));
+var sessionAllow = Command.make("allow", {
+  session: sessionFlag(),
+  origins: Argument.String("origins").pipe(Argument.variadic({ min: 0 }), Argument.withDescription("Hosts or origins the session's tabs may load: example.com, *.example.com, https://app.example.com, http://localhost:3000")),
+  clear: Flag.Boolean("clear").pipe(Flag.withDefault(false), Flag.withDescription("Remove the allowlist: the session may load any site again")),
+  json: jsonFlag
+}, Effect3.fn("Cli.sessionAllow")(function* ({ session, origins, clear, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  if (!clear && origins.length === 0) {
+    return yield* Effect3.fail(new Error("session allow needs origins, or --clear to remove the allowlist"));
+  }
+  const id = yield* resolvePositionalOrFlagSessionId(Option2.none(), session);
+  const result = yield* relay.sessionAllowlist(id, clear ? [] : origins);
+  if (json) {
+    yield* emitJson(result);
+    return;
+  }
+  yield* Console.log(result.allowedOrigins ? `${result.id} may load: ${result.allowedOrigins.join(", ")}` : `${result.id} may load any site`);
+})).pipe(Command.withDescription("Set the domain allowlist of a session (the current one by default)"));
+var session = Command.make("session").pipe(Command.withDescription("Manage Browse sessions"), Command.withSubcommands([sessionNew, sessionList, sessionCurrent, sessionUse, sessionReset, sessionAdopt, sessionDelete, sessionAllow]));
+var status = Command.make("status", {
+  json: jsonFlag
+}, Effect3.fn("Cli.status")(function* ({ json }) {
+  const relay = yield* Service;
+  const store = yield* Service2;
+  const [relayResult, update] = yield* Effect3.all([Effect3.result(relay.version), Effect3.promise(() => updateNotice2())], { concurrency: 2 });
+  const updateLine = update ? formatUpdateNotice2(update) : undefined;
+  if (Result.isFailure(relayResult)) {
+    if (!(relayResult.failure instanceof RelayUnreachable)) {
+      if (json) {
+        yield* emitJson({
+          endpoint: relay.endpoint,
+          relay: { running: false, error: relayResult.failure.message },
+          extension: null,
+          sessions: [],
+          targets: [],
+          update: updateJson2(update)
+        });
+      }
+      yield* stderrLine(`Relay status failed: ${relayResult.failure.message}`);
+      yield* exitWith(ExitCode.host);
+      return;
+    }
+    const stopped = stoppedRelayStatus(relay.endpoint);
+    if (json) {
+      yield* emitJson({ ...stopped, update: updateJson2(update), autoUpdate: autoUpdateStatus() });
+      yield* stderrLine(`relay is not running at ${relay.endpoint}`);
+    } else {
+      yield* Console.log(`Relay: stopped (${relay.endpoint})`);
+      yield* Console.log(`Run \`${cliCommand("execute")}\` (or any relay-backed command) to start it automatically.`);
+      if (updateLine)
+        yield* Console.log(updateLine);
+    }
+    yield* exitWith(ExitCode.host);
+    return;
+  }
+  const version = relayResult.success;
+  const buildProblem = relayBuildProblem(version);
+  const [extensionStatus, current] = yield* Effect3.all([relay.extensionStatus, store.read]);
+  const collections = statusCollections(extensionStatus);
+  const [sessions, targets] = collections ? [collections.sessions, collections.targets] : yield* Effect3.all([relay.sessions, relay.targets]);
+  if (json) {
+    yield* emitJson({
+      endpoint: relay.endpoint,
+      relay: { running: true, version: version.version, buildId: version.buildId ?? null, stale: buildProblem !== undefined },
+      extension: extensionStatus,
+      currentSession: current ?? null,
+      sessions,
+      targets,
+      update: updateJson2(update),
+      autoUpdate: autoUpdateStatus()
+    });
+    if (buildProblem) {
+      yield* stderrLine(buildProblem);
+      yield* failExit;
+    }
+    return;
+  }
+  if (updateLine)
+    yield* Console.log(updateLine);
+  yield* Console.log(`Relay: ${relay.endpoint} (${version.version})`);
+  if (buildProblem) {
+    yield* Console.log(`Warning: ${buildProblem}`);
+  }
+  yield* Console.log(`Extension: ${extensionStatus.connected ? "connected" : "disconnected"}${extensionStatus.version ? ` (${extensionStatus.version})` : ""}`);
+  if ((extensionStatus.rejectedConnections ?? 0) > 0) {
+    yield* Console.log(`Warning: ${extensionStatus.rejectedConnections} competing browser/profile connection attempt(s) rejected; the active connection was preserved. Use Browse in one browser/profile at a time.`);
+  }
+  if (extensionStatus.nextStep)
+    yield* Console.log(extensionStatus.nextStep);
+  else if ((extensionStatus.pairingFailures ?? 0) > 0 && !extensionStatus.connected) {
+    yield* Console.log(`Warning: ${extensionStatus.pairingFailures} extension connection(s) failed pairing. Update the extension, or run \`${cliCommand("pair")}\` and enter the code on its status page.`);
+  }
+  if ((extensionStatus.processFaults?.suppressed ?? 0) > 0) {
+    const faults = extensionStatus.processFaults;
+    yield* Console.log(`Warning: the relay survived ${faults.suppressed} Playwright fault(s)${faults.lastAt ? `, last at ${faults.lastAt}` : ""}${faults.lastMessage ? `: ${faults.lastMessage}` : ""}. See the relay log.`);
+  }
+  if (extensionStatus.protocolVersion !== undefined && extensionStatus.protocolVersion !== null) {
+    const compatibility = extensionStatus.protocolCompatible === false ? "incompatible" : "compatible";
+    const legacy = extensionStatus.protocolLegacy === true ? ", inferred from legacy hello" : "";
+    yield* Console.log(`Extension protocol: ${extensionStatus.protocolVersion} (${compatibility}${legacy})`);
+    if (extensionStatus.protocolCompatible === false && !extensionStatus.nextStep)
+      yield* Console.log(extensionProtocolAdvice(extensionStatus.protocolVersion, { install: installCommand() }));
+  }
+  yield* Console.log(`Active targets: ${extensionStatus.activeTargets}`);
+  if (extensionStatus.childTargets !== undefined) {
+    yield* Console.log(`Child targets: ${extensionStatus.childTargets}`);
+  }
+  if (extensionStatus.cdpClients !== undefined) {
+    yield* Console.log(`CDP clients: ${extensionStatus.cdpClients}`);
+  }
+  yield* Console.log(`Current session: ${current ?? "none"}`);
+  if (sessions.length === 0) {
+    yield* Console.log("Sessions: none");
+  } else {
+    yield* Console.log("Sessions:");
+    const activeSessions = sessions.filter((item) => item.id === current || item.connected || item.pageUrl !== null || item.stateKeys.length > 0 || item.readOnly);
+    const idleSessions = sessions.filter((item) => !activeSessions.includes(item));
+    const shownSessions = activeSessions.length > 0 ? activeSessions : idleSessions.slice(0, 5);
+    const omittedIdleCount = activeSessions.length > 0 ? idleSessions.length : Math.max(0, idleSessions.length - shownSessions.length);
+    yield* Effect3.forEach(shownSessions, (item) => {
+      const marker = item.id === current ? "*" : " ";
+      return Console.log(`${marker} ${item.id} ${item.pageUrl ?? "no page yet"}`);
+    });
+    if (omittedIdleCount > 0) {
+      yield* Console.log(`  (${omittedIdleCount} idle session(s) with no page omitted; run ${cliCommand("session list")} to view all)`);
+    }
+  }
+  if (targets.length === 0) {
+    yield* Console.log("Targets: none");
+  } else {
+    yield* Console.log("Targets:");
+    yield* Effect3.forEach(targets, (target, index) => {
+      return Console.log(`- [${index}] ${formatTargetSummary(target, { includeSession: true })}`);
+    });
+  }
+  if (buildProblem) {
+    yield* failExit;
+  }
+})).pipe(Command.withDescription("Show relay, extension, and target status"));
+var recordingStart = Command.make("start", {
+  outputPath: Argument.String("output-path").pipe(Argument.withDescription("Path to write the recording artifact; tabCapture requires .webm, CDP accepts .webm or .mp4")),
+  session: sessionFlag("Record the page for this Browse or CDP session id"),
+  tabId: tabIdFlag("Record this attached Chrome tab id"),
+  mode: Flag.String("mode").pipe(Flag.optional, Flag.withDescription("Recording mode: auto, tab-capture, or cdp. auto uses CDP for relay-owned tabs and tabCapture for user-owned tabs")),
+  audio: Flag.Boolean("audio").pipe(Flag.withDefault(false), Flag.withDescription("Include tab audio")),
+  frameRate: Flag.Int("frame-rate").pipe(Flag.optional, Flag.withDescription("Output frame rate, integer 1..60; defaults to 30 for tab-capture and 60 for CDP")),
+  maxDurationMs: Flag.Int("max-duration-ms").pipe(Flag.optional, Flag.withDescription("Auto-stop guard in milliseconds, defaults to 900000")),
+  cursor: Flag.Boolean("cursor").pipe(Flag.withDefault(false), Flag.withDescription("Draw the ghost cursor in the recording (off by default: only the page is recorded)")),
+  json: jsonFlag
+}, Effect3.fn("Cli.recordingStart")(function* ({ outputPath, session, tabId, mode, audio, frameRate, maxDurationMs, cursor, json }) {
+  if (Option2.isSome(frameRate) && (frameRate.value < 1 || frameRate.value > 60)) {
+    return yield* Effect3.fail(new Error("Recording frameRate must be an integer from 1 to 60"));
+  }
+  const relay = yield* Service;
+  yield* ensureCliRelayAndExtension();
+  const target = yield* recordingTarget({ session, tabId });
+  const modeValue = yield* parseRecordingModeOption(Option2.getOrUndefined(mode));
+  const resolvedOutputPath = path.resolve(outputPath);
+  const result = yield* relay.recordingStart({
+    ...target,
+    outputPath: resolvedOutputPath,
+    ...modeValue === undefined ? {} : { mode: modeValue },
+    audio,
+    ...Option2.isSome(frameRate) ? { frameRate: frameRate.value } : {},
+    ...Option2.isSome(maxDurationMs) ? { maxDurationMs: maxDurationMs.value } : {},
+    ...cursor ? { cursor } : {}
+  });
+  if (!result.success) {
+    return yield* Effect3.fail(new Error(result.error ?? "Failed to start recording"));
+  }
+  yield* printOr(json, result, `Recording started: ${result.path ?? resolvedOutputPath} tab=${result.tabId ?? "unknown"} mode=${result.mode ?? "tab-capture"} artifact=${result.artifactType ?? "webm"} mime=${result.mimeType ?? "video/webm"} fps=${result.frameRate ?? "unknown"}`);
+})).pipe(Command.withDescription("Start recording an attached tab"));
+var recordingStop = Command.make("stop", {
+  session: sessionFlag("Stop recording for this CDP session id"),
+  tabId: tabIdFlag("Stop recording for this Chrome tab id"),
+  json: jsonFlag
+}, Effect3.fn("Cli.recordingStop")(function* ({ session, tabId, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const target = yield* recordingTarget({ session, tabId });
+  const result = yield* relay.recordingStop(target);
+  if (!result.success) {
+    return yield* Effect3.fail(new Error(result.error ?? "Failed to stop recording"));
+  }
+  if (json)
+    return yield* emitJson(result);
+  const frames = result.frameCount === undefined ? "" : `, frames=${result.frameCount}`;
+  yield* Console.log(`Recording saved: ${result.path ?? "unknown"} (${result.size ?? 0} bytes, ${result.duration ?? 0}ms, mode=${result.mode ?? "tab-capture"}, artifact=${result.artifactType ?? "webm"}${frames})`);
+  yield* Console.log(formatRecordingQuality(result.quality));
+})).pipe(Command.withDescription("Stop recording and write the artifact"));
+var recordingStatus = Command.make("status", {
+  session: sessionFlag("Check recording for this CDP session id"),
+  tabId: tabIdFlag("Check recording for this Chrome tab id"),
+  json: jsonFlag
+}, Effect3.fn("Cli.recordingStatus")(function* ({ session, tabId, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const target = yield* recordingTarget({ session, tabId });
+  const result = yield* relay.recordingStatus(target);
+  if (json) {
+    yield* emitJson(result);
+    return;
+  }
+  if (!result.isRecording) {
+    yield* Console.log("Recording: inactive");
+    return;
+  }
+  const frames = result.frameCount === undefined ? "" : ` frameCount=${result.frameCount}`;
+  yield* Console.log(`Recording: active tab=${result.tabId ?? "unknown"} mode=${result.mode ?? "tab-capture"} artifact=${result.artifactType ?? "webm"} path=${result.path ?? "unknown"} size=${result.size ?? 0}${frames} startedAt=${result.startedAt ?? "unknown"}`);
+  yield* Console.log(formatRecordingQuality(result.quality));
+})).pipe(Command.withDescription("Check current recording status"));
+var recordingCancel = Command.make("cancel", {
+  session: sessionFlag("Cancel recording for this CDP session id"),
+  tabId: tabIdFlag("Cancel recording for this Chrome tab id")
+}, Effect3.fn("Cli.recordingCancel")(function* ({ session, tabId }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const target = yield* recordingTarget({ session, tabId });
+  const result = yield* relay.recordingCancel(target);
+  if (!result.success) {
+    return yield* Effect3.fail(new Error(result.error ?? "Failed to cancel recording"));
+  }
+  yield* Console.log("Recording cancelled");
+})).pipe(Command.withDescription("Cancel recording without writing a file"));
+var recording = Command.make("recording").pipe(Command.withDescription("Record an attached tab to WebM or MP4"), Command.withSubcommands([recordingStart, recordingStop, recordingStatus, recordingCancel]));
+var flightRecorderStart = Command.make("start", {
+  session: sessionFlag("Buffer the tab owned by this session"),
+  tabId: tabIdFlag("Buffer this attached Chrome tab id"),
+  retentionMs: Flag.Int("retention-ms").pipe(Flag.optional, Flag.withDescription("Ring-buffer duration in milliseconds (1000..120000; default 60000)")),
+  frameRate: Flag.Int("frame-rate").pipe(Flag.optional, Flag.withDescription("Output frame rate from 1 to 60")),
+  cursor: Flag.Boolean("cursor").pipe(Flag.withDefault(false), Flag.withDescription("Draw the ghost cursor in the buffered video (off by default)")),
+  json: jsonFlag
+}, Effect3.fn("Cli.flightRecorderStart")(function* ({ session, tabId, retentionMs, frameRate, cursor, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelayAndExtension();
+  const target = yield* recordingTarget({ session, tabId });
+  const result = yield* relay.flightRecorderStart({
+    ...target,
+    ...Option2.isSome(retentionMs) ? { retentionMs: retentionMs.value } : {},
+    ...Option2.isSome(frameRate) ? { frameRate: frameRate.value } : {},
+    ...cursor ? { cursor } : {}
+  });
+  yield* printOr(json, result, `Flight recorder buffering tab ${result.tabId}; retention=${result.retentionMs}ms`);
+})).pipe(Command.withDescription("Start a rolling in-memory video buffer"));
+var flightRecorderStatus = Command.make("status", {
+  session: sessionFlag(),
+  tabId: tabIdFlag(),
+  json: jsonFlag
+}, Effect3.fn("Cli.flightRecorderStatus")(function* ({ session, tabId, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.flightRecorderStatus(yield* recordingTarget({ session, tabId }));
+  if (json)
+    return yield* emitJson(result);
+  if (!result.active)
+    return yield* Console.log("Flight recorder inactive");
+  yield* Console.log(`Flight recorder tab=${result.tabId} frames=${result.bufferedFrames} retained=${result.retainedDurationMs}ms bytes=${result.bufferedBytes}`);
+})).pipe(Command.withDescription("Show rolling flight-recorder status"));
+var flightRecorderSaveLast = Command.make("save-last", {
+  outputPath: Argument.String("output-path").pipe(Argument.withDescription("Fresh .webm or .mp4 artifact path")),
+  session: sessionFlag(),
+  tabId: tabIdFlag(),
+  durationMs: Flag.Int("duration-ms").pipe(Flag.optional, Flag.withDescription("How much recent history to save; defaults to 30 seconds")),
+  json: jsonFlag
+}, Effect3.fn("Cli.flightRecorderSaveLast")(function* ({ outputPath, session, tabId, durationMs, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.flightRecorderSaveLast({
+    ...yield* recordingTarget({ session, tabId }),
+    outputPath: path.resolve(outputPath),
+    ...Option2.isSome(durationMs) ? { durationMs: durationMs.value } : {}
+  });
+  yield* printOr(json, result, `Saved ${result.durationMs}ms flight recorder clip (${result.frameCount} frames) to ${result.path}`);
+})).pipe(Command.withDescription("Save the most recent buffered video without stopping the recorder"));
+var flightRecorderCancel = Command.make("cancel", {
+  session: sessionFlag(),
+  tabId: tabIdFlag()
+}, Effect3.fn("Cli.flightRecorderCancel")(function* ({ session, tabId }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.flightRecorderCancel(yield* recordingTarget({ session, tabId }));
+  yield* Console.log(result.cancelled ? "Flight recorder stopped" : "No active flight recorder");
+})).pipe(Command.withDescription("Stop and discard the rolling video buffer"));
+var flightRecorder = Command.make("flight-recorder").pipe(Command.withDescription("Keep and save a rolling buffer of recent browser video"), Command.withSubcommands([flightRecorderStart, flightRecorderStatus, flightRecorderSaveLast, flightRecorderCancel]));
+var networkSession = Effect3.fnUntraced(function* (session) {
+  return yield* resolveSelectedSessionId(Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig));
+});
+var parseNetworkContent = Effect3.fnUntraced(function* (content) {
+  const value = Option2.getOrUndefined(content);
+  if (value === undefined || value === "embed" || value === "omit")
+    return value;
+  return yield* Effect3.fail(new Error("Network content must be embed or omit"));
+});
+function formatNetworkStatus(status) {
+  if (!status.active)
+    return status.ended ? `Network capture: inactive (the last one ended because ${status.ended})` : "Network capture: inactive";
+  return `Network capture: active entries=${status.entryCount} responses=${status.responseCount} failures=${status.failureCount} bodyBytes=${status.capturedBodyBytes} truncated=${status.truncatedBodyCount} dropped=${status.droppedEntryCount} startedAt=${status.startedAt ?? "unknown"}${status.endsAt ? ` endsAt=${status.endsAt}` : ""}`;
+}
+function formatNetworkResult(result) {
+  const output = result.outputPath ? ` output=${result.outputPath}` : "";
+  const profile = result.authProfile ? ` secrets=${result.authProfile.name}(${result.authProfile.slotCount})` : "";
+  return `Network capture stopped: entries=${result.entryCount} responses=${result.responseCount} failures=${result.failureCount} bodyBytes=${result.capturedBodyBytes} truncated=${result.truncatedBodyCount} dropped=${result.droppedEntryCount}${output}${profile}`;
+}
+var networkStart = Command.make("start", {
+  session: sessionFlag("Capture the default page for this Browse session"),
+  urlFilter: Flag.String("url").pipe(Flag.optional, Flag.withDescription("Capture only requests whose URL contains this text")),
+  resourceTypes: Flag.String("resource-type").pipe(Flag.atMost(50), Flag.withDescription("Capture this Playwright resource type; repeat for multiple types")),
+  content: Flag.String("content").pipe(Flag.optional, Flag.withDescription("Response and request body mode: embed (default) or omit")),
+  maxBodyBytes: Flag.Int("max-body-bytes").pipe(Flag.optional, Flag.withDescription("Maximum captured bytes per body, defaults to 1000000")),
+  maxTotalBodyBytes: Flag.Int("max-total-body-bytes").pipe(Flag.optional, Flag.withDescription("Maximum captured body bytes for the whole capture, defaults to 25000000")),
+  maxEntries: Flag.Int("max-entries").pipe(Flag.optional, Flag.withDescription("Maximum request entries, defaults to 1000")),
+  maxDuration: Flag.Int("max-duration-ms").pipe(Flag.optional, Flag.withDescription("End the capture by itself (discarding it) after this long, defaults to 1800000 (30 minutes)")),
+  json: jsonFlag
+}, Effect3.fn("Cli.networkStart")(function* ({ session, urlFilter, resourceTypes, content, maxBodyBytes, maxTotalBodyBytes, maxEntries, maxDuration, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelayAndExtension();
+  const sessionId = yield* networkSession(session);
+  const contentValue = yield* parseNetworkContent(content);
+  const result = yield* relay.networkStart({
+    sessionId,
+    ...Option2.isSome(urlFilter) ? { urlFilter: urlFilter.value } : {},
+    ...resourceTypes.length === 0 ? {} : { resourceTypes },
+    ...contentValue === undefined ? {} : { content: contentValue },
+    ...Option2.isSome(maxBodyBytes) ? { maxBodyBytes: maxBodyBytes.value } : {},
+    ...Option2.isSome(maxTotalBodyBytes) ? { maxTotalBodyBytes: maxTotalBodyBytes.value } : {},
+    ...Option2.isSome(maxEntries) ? { maxEntries: maxEntries.value } : {},
+    ...Option2.isSome(maxDuration) ? { maxDurationMs: maxDuration.value } : {}
+  });
+  yield* printOr(json, result, formatNetworkStatus(result));
+})).pipe(Command.withDescription("Start session-scoped network capture"));
+var networkStatus = Command.make("status", {
+  session: sessionFlag(),
+  json: jsonFlag
+}, Effect3.fn("Cli.networkStatus")(function* ({ session, json }) {
+  const relay = yield* Service;
+  const sessionId = yield* networkSession(session);
+  yield* ensureCliRelay();
+  const result = yield* relay.networkStatus({ sessionId });
+  yield* printOr(json, result, formatNetworkStatus(result));
+})).pipe(Command.withDescription("Show session-scoped network capture status"));
+var networkStop = Command.make("stop", {
+  session: sessionFlag(),
+  output: Flag.String("output").pipe(Flag.optional, Flag.withAlias("o"), Flag.withDescription("Write a credential-redacted HAR artifact to this path")),
+  secrets: Flag.String("secrets").pipe(Flag.optional, Flag.withDescription("Store captured credentials under this reusable profile name")),
+  json: jsonFlag
+}, Effect3.fn("Cli.networkStop")(function* ({ session, output, secrets, json }) {
+  const relay = yield* Service;
+  const outputValue = Option2.getOrUndefined(output);
+  const secretsValue = Option2.getOrUndefined(secrets);
+  if (!outputValue && !secretsValue) {
+    return yield* Effect3.fail(new Error("network stop requires --output, --secrets, or both"));
+  }
+  const sessionId = yield* networkSession(session);
+  yield* ensureCliRelay();
+  const result = yield* relay.networkStop({
+    sessionId,
+    ...outputValue ? { outputPath: path.resolve(outputValue) } : {},
+    ...secretsValue ? { secrets: secretsValue } : {}
+  });
+  yield* printOr(json, result, formatNetworkResult(result));
+})).pipe(Command.withDescription("Stop capture and write a redacted artifact or reusable secret profile"));
+var networkCancel = Command.make("cancel", { session: sessionFlag() }, Effect3.fn("Cli.networkCancel")(function* ({ session }) {
+  const relay = yield* Service;
+  const sessionId = yield* networkSession(session);
+  yield* ensureCliRelay();
+  const result = yield* relay.networkCancel({ sessionId });
+  yield* Console.log(result.cancelled ? "Network capture cancelled" : "Network capture was not active");
+})).pipe(Command.withDescription("Cancel capture without writing an artifact"));
+var network = Command.make("network").pipe(Command.withDescription("Capture authenticated network exchanges for direct client derivation"), Command.withSubcommands([networkStart, networkStatus, networkStop, networkCancel]));
+var secretsStatus = Command.make("status", {
+  name: Argument.String("name"),
+  json: jsonFlag
+}, Effect3.fn("Cli.secretsStatus")(function* ({ name, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.authStatus({ name });
+  if (json) {
+    yield* emitJson(result);
+    return;
+  }
+  yield* Console.log(`Secrets profile ${result.name}: slots=${result.slotCount} updatedAt=${result.updatedAt}`);
+  yield* Effect3.forEach(result.slots, (slot) => Console.log(`- ${slot.ref} sources=${slot.sources.join(",")} expired=${slot.expired}${slot.expiresAt ? ` expiresAt=${slot.expiresAt}` : ""}`));
+})).pipe(Command.withDescription("Show secret profile metadata without revealing values"));
+var secretsRefresh = Command.make("refresh", {
+  name: Argument.String("name"),
+  session: sessionFlag(),
+  urlFilter: Flag.String("url").pipe(Flag.optional, Flag.withDescription("Observe credentials only on matching request URLs")),
+  timeoutMs: Flag.Int("timeout-ms").pipe(Flag.optional, Flag.withDescription("Page reload timeout, defaults to 30000")),
+  json: jsonFlag
+}, Effect3.fn("Cli.secretsRefresh")(function* ({ name, session, urlFilter, timeoutMs, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelayAndExtension();
+  const sessionId = yield* networkSession(session);
+  const result = yield* relay.authRefresh({
+    sessionId,
+    name,
+    ...Option2.isSome(urlFilter) ? { urlFilter: urlFilter.value } : {},
+    ...Option2.isSome(timeoutMs) ? { timeoutMs: timeoutMs.value } : {}
+  });
+  yield* printOr(json, result, `Secrets profile ${name} refreshed: observed=${result.observedSecretRefs.length} changed=${result.updatedSecretRefs.length}`);
+})).pipe(Command.withDescription("Reload a session page and refresh a profile while preserving stable references"));
+var secretsRun = Command.make("run", {
+  name: Argument.String("name"),
+  command: Argument.String("command").pipe(Argument.variadic({ min: 1 })),
+  cwd: Flag.String("cwd").pipe(Flag.optional, Flag.withDescription("Child process working directory")),
+  timeoutMs: Flag.Int("timeout-ms").pipe(Flag.optional, Flag.withDescription("Child timeout in milliseconds, defaults to 120000"))
+}, Effect3.fn("Cli.secretsRun")(function* ({ name, command, cwd, timeoutMs }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const [executable, ...args] = decodeCliOperands(command);
+  if (!executable)
+    return yield* Effect3.fail(new Error("secrets run requires a command after --"));
+  const result = yield* relay.authRun({
+    name,
+    command: executable,
+    args,
+    cwd: path.resolve(Option2.getOrElse(cwd, () => process.cwd())),
+    ...Option2.isSome(timeoutMs) ? { timeoutMs: timeoutMs.value } : {}
+  });
+  yield* Effect3.sync(() => {
+    if (result.stdout)
+      process.stdout.write(result.stdout);
+    if (result.stderr)
+      process.stderr.write(result.stderr);
+    if (result.stdoutTruncated || result.stderrTruncated)
+      process.stderr.write(`
+Browse truncated child output.
+`);
+    if (result.exitCode !== 0)
+      process.exitCode = result.exitCode;
+  });
+})).pipe(Command.withDescription("Run a command with profile values injected as BC_SECRET_* environment variables"));
+function readSecretValue(prompt) {
+  const input = process.stdin;
+  if (!input.isTTY) {
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      input.on("data", (chunk) => chunks.push(chunk));
+      input.once("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+      input.once("error", reject);
+    });
+  }
+  return new Promise((resolve, reject) => {
+    process.stderr.write(prompt);
+    let value = "";
+    const finish = (result) => {
+      input.setRawMode(false);
+      input.pause();
+      input.off("data", onData);
+      process.stderr.write(`
+`);
+      if (result instanceof Error)
+        reject(result);
+      else
+        resolve(result);
+    };
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === "\r" || char === `
+`)
+          return finish(value);
+        if (char === "\x03")
+          return finish(new Error("Cancelled"));
+        if (char === "" || char === "\b")
+          value = value.slice(0, -1);
+        else
+          value += char;
+      }
+    };
+    input.setRawMode(true);
+    input.resume();
+    input.on("data", onData);
+  });
+}
+var secretsAdd = Command.make("add", {
+  name: Argument.String("name").pipe(Argument.withDescription('Secret name agents use: secrets.type(locator, "name")')),
+  origin: Flag.String("origin").pipe(Flag.atLeast(1), Flag.withDescription("Origin the secret may be typed on (repeatable): https://example.com, *.example.com (https), http://localhost:3000")),
+  totp: Flag.Boolean("totp").pipe(Flag.withDefault(false), Flag.withDescription("The value is a TOTP seed (base32 or otpauth:// URI); typing it types the current code. Storing the seed beside the password makes 2FA one factor")),
+  json: jsonFlag
+}, Effect3.fn("Cli.secretsAdd")(function* ({ name, origin, totp, json }) {
+  const value = yield* Effect3.tryPromise({
+    try: () => readSecretValue(totp ? `TOTP seed for ${name} (hidden): ` : `Value for ${name} (hidden): `),
+    catch: (cause) => cause instanceof Error ? cause : new Error("Could not read the secret value")
+  });
+  const result = yield* addSecret({ name, value, allowedOrigins: origin, kind: totp ? "totp" : "password" });
+  if (json) {
+    yield* emitJson(result);
+    return;
+  }
+  yield* Console.log(`Saved ${result.kind} secret ${result.name}; it can be typed on ${result.allowedOrigins.join(", ")}`);
+  if (totp)
+    yield* Console.error("Note: with the TOTP seed stored here, anyone who can use these secrets has both factors. Prefer handing 2FA to a person when you can.");
+})).pipe(Command.withDescription("Store a secret agents can type only on its origins (value from stdin or a hidden prompt)"));
+var secretsList = Command.make("list", { json: jsonFlag }, Effect3.fn("Cli.secretsList")(function* ({ json }) {
+  const secrets = yield* listSecrets();
+  if (json) {
+    yield* emitJson({ secrets });
+    return;
+  }
+  if (secrets.length === 0) {
+    yield* Console.log("No site secrets");
+    return;
+  }
+  yield* Effect3.forEach(secrets, (secret) => Console.log(`${secret.name} ${secret.kind} ${secret.allowedOrigins.join(",")}`));
+})).pipe(Command.withDescription("List site secrets (names, kinds and origins, never values)"));
+var secretsRemove = Command.make("remove", { name: Argument.String("name") }, Effect3.fn("Cli.secretsRemove")(function* ({ name }) {
+  const removed = yield* removeSecret(name);
+  yield* Console.log(removed ? `Removed ${name}` : `No secret named ${name}`);
+})).pipe(Command.withDescription("Delete a site secret"));
+var secrets = Command.make("secrets").pipe(Command.withDescription("Site secrets agents can type without seeing them, and captured credential profiles"), Command.withSubcommands([secretsAdd, secretsList, secretsRemove, secretsStatus, secretsRefresh, secretsRun]));
+var deadboltConnect = Command.make("connect", { json: jsonFlag }, Effect3.fn("Cli.deadboltConnect")(function* ({ json }) {
+  const paired = yield* Effect3.tryPromise({
+    try: () => pair(),
+    catch: (cause) => cause instanceof Error ? cause : new Error("Could not connect to Deadbolt")
+  });
+  if (json) {
+    yield* emitJson({ connected: true, id: paired.id });
+    return;
+  }
+  yield* Console.log(`Connected Browse to Deadbolt as client ${paired.id}.`);
+  yield* Console.log("Agents can use only the logins you allow, in Deadbolt: deadbolt agents allow <site> (narrow with --login, --fields, --expires), or deadbolt agents allow --all for every login");
+})).pipe(Command.withDescription("Pair Browse with Deadbolt (runs `deadbolt agents add-client browse`, which asks you to confirm) and store its client token (0600)"));
+var deadboltDisconnect = Command.make("disconnect", {}, Effect3.fn("Cli.deadboltDisconnect")(function* () {
+  const result = yield* Effect3.try({
+    try: () => unpair(),
+    catch: (cause) => cause instanceof Error ? cause : new Error("Could not disconnect from Deadbolt")
+  });
+  if (!result.removed) {
+    yield* Console.log("Browse isn't connected to Deadbolt");
+    return;
+  }
+  yield* Console.log(result.revoked ? "Disconnected: the client is removed in Deadbolt and its token deleted here." : "Deleted the client token here. Deadbolt didn't confirm removing the client: check `deadbolt agents clients`.");
+})).pipe(Command.withDescription("Remove Browse's Deadbolt client (in Deadbolt and here)"));
+var deadboltStatus = Command.make("status", { json: jsonFlag }, Effect3.fn("Cli.deadboltStatus")(function* ({ json }) {
+  const client = readClient();
+  const socket = socketPath();
+  const status = client ? yield* Effect3.promise(() => connect({ client, socket }).status().then((value) => ({ reachable: true, ...value }), (error) => ({ reachable: false, error: error instanceof Error ? error.message : String(error) }))) : undefined;
+  const report = { connected: client !== undefined, ...client ? { id: client.id } : {}, socket, ...status ? { deadbolt: status } : {} };
+  if (json) {
+    yield* emitJson(report);
+    return;
+  }
+  if (!client) {
+    yield* Console.log("Not connected to Deadbolt. Run `opencode-browser deadbolt connect`.");
+    return;
+  }
+  yield* Console.log(`Connected as Deadbolt client ${client.id}; socket ${socket}`);
+  if (status && status.reachable)
+    yield* Console.log(`Deadbolt ${status.version ?? ""} (protocol ${status.protocol}) is ${status.unlocked ? "unlocked" : "locked: agent sign-ins are paused until you unlock it"}`);
+  else if (status)
+    yield* Console.log(`Deadbolt isn't reachable: ${status.error}`);
+})).pipe(Command.withDescription("Show whether Browse is paired with Deadbolt and whether Deadbolt is reachable and unlocked"));
+var deadbolt = Command.make("deadbolt").pipe(Command.withDescription("Let agents sign in with the Deadbolt logins you grant them, without seeing any value"), Command.withSubcommands([deadboltConnect, deadboltDisconnect, deadboltStatus]));
+var journal = Command.make("journal", {
+  session: sessionFlag("Show the journal for this Browse session id"),
+  limit: Flag.Int("limit").pipe(Flag.optional, Flag.withDescription("Number of most recent entries to show, defaults to 20")),
+  json: jsonFlag
+}, Effect3.fn("Cli.journal")(function* ({ session, limit, json }) {
+  const sessionId = yield* networkSession(session);
+  const entries = yield* Effect3.tryPromise({
+    try: () => readJournalEntries({ baseDir: defaultJournalBaseDir(), sessionId, limit: Option2.getOrUndefined(limit) ?? 20 }),
+    catch: (cause) => new Error(`read session journal for ${sessionId}`, { cause })
+  });
+  if (json) {
+    yield* emitJson({ session: sessionId, entries });
+    return;
+  }
+  if (entries.length === 0) {
+    yield* Console.log(`No journal entries for session ${sessionId}`);
+    return;
+  }
+  yield* Console.log(`Journal for ${sessionId} (last ${entries.length}):`);
+  yield* Effect3.forEach(entries, (entry) => {
+    return Console.log(formatJournalEntry(entry));
+  });
+})).pipe(Command.withDescription("Show what agents did in a Browse session"));
+var doctor = Command.make("doctor", {
+  json: jsonFlag
+}, Effect3.fn("Cli.doctor")(function* ({ json }) {
+  const update = yield* Effect3.promise(() => updateNotice2());
+  const report = yield* createDoctorReport({ packageRoot, update: updateJson2(update) });
+  if (json) {
+    yield* emitJson(report);
+  } else {
+    yield* Console.log(formatDoctorReport(report));
+  }
+  if (report.status === "fail") {
+    yield* failExit;
+  }
+})).pipe(Command.withDescription("Diagnose the local Browse install and runtime"));
+var skill = Command.make("skill", {}, Effect3.fn("Cli.skill")(function* () {
+  const fs = yield* FileSystem3.FileSystem;
+  const text = yield* fs.readFileString(path.join(packageRoot, "skills", "browse", "SKILL.md")).pipe(Effect3.mapError((cause) => new Error("read opencode-browser skill", { cause })));
+  yield* Console.log(text.trimEnd());
+})).pipe(Command.withDescription("Print the Browse agent skill text"));
+var tabsCleanup = Command.make("cleanup", {
+  idleMinutes: Flag.Int("idle-minutes").pipe(Flag.optional, Flag.withDescription("Close agent tabs idle at least this long; 0 closes every eligible agent tab (default: the extension's setting, 10; still 10 when it is set to never)")),
+  json: jsonFlag
+}, Effect3.fn("Cli.tabsCleanup")(function* ({ idleMinutes, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.tabsCleanup(Option2.getOrUndefined(idleMinutes));
+  if (json)
+    return yield* emitJson(result);
+  if (!result.closed.length)
+    return yield* Console.log("No idle agent tabs to close.");
+  for (const tab of result.closed)
+    yield* Console.log(`Closed ${tab.title} (idle ${tab.idleMinutes}m)`);
+})).pipe(Command.withDescription("Close tabs agents opened that nobody has used for a while"));
+var tabs = Command.make("tabs").pipe(Command.withDescription("Manage the tabs agents open"), Command.withSubcommands([tabsCleanup]));
+var printSettings = (settings) => Effect3.forEach(formatSettings(settings), (line) => Console.log(line), { discard: true });
+var settingsGet = Command.make("get", { json: jsonFlag }, Effect3.fn("Cli.settingsGet")(function* ({ json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.settingsGet;
+  if (json)
+    return yield* emitJson(result);
+  yield* printSettings(result.settings);
+  yield* Console.log(result.note);
+})).pipe(Command.withDescription("Show each setting's value, the value in effect, and any relay environment variable overriding it"));
+var settingsSet = Command.make("set", {
+  assignments: Argument.String("key=value").pipe(Argument.variadic({ min: 1 }), Argument.withDescription(`Settings to change: ${settingKeys.join(", ")}`)),
+  json: jsonFlag
+}, Effect3.fn("Cli.settingsSet")(function* ({ assignments, json }) {
+  const changes = {};
+  for (const assignment of assignments) {
+    const index = assignment.indexOf("=");
+    if (index <= 0)
+      return yield* Effect3.fail(new Error(`Expected key=value, got "${assignment}". Settings: ${settingKeys.join(", ")}.`));
+    changes[assignment.slice(0, index)] = assignment.slice(index + 1);
+  }
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.settingsSet(changes);
+  if (json)
+    return yield* emitJson(result);
+  yield* Console.log(result.message);
+  yield* printSettings(result.settings);
+})).pipe(Command.withDescription("Change settings (validated strictly; the extension's options page updates live)"));
+var settings = Command.make("settings").pipe(Command.withDescription("Read or change the user's settings (the extension's options page). Security switches are environment-only"), Command.withSubcommands([settingsGet, settingsSet]));
+var mcp = Command.make("mcp", {}, Effect3.fn("Cli.mcp")(function* () {
+  const { runMcpServer } = yield* Effect3.promise(() => import("./mcp-2smdsn8z.mjs"));
+  yield* runMcpServer;
+})).pipe(Command.withDescription("Run the Browse MCP server over stdio"));
+var opencodeBrowser = Command.make("opencode-browser").pipe(Command.withDescription("Control the user's existing browser through the Browse extension"), Command.withSubcommands([serve, relay, execute, session, tabs, settings, status, network, secrets, deadbolt, recording, flightRecorder, journal, doctor, skill, mcp]));
+var mainLayer = Layer2.mergeAll(layerFetch, layer).pipe(Layer2.provideMerge(NodeServices.layer));
+function runCli(rawArgs = process.argv.slice(2)) {
+  const cliArgs = hoistJsonFlag(rawArgs);
+  const subcommand = cliArgs.argv.find((arg) => !arg.startsWith("-"));
+  const commandName = subcommand ? `opencode-browser ${subcommand}` : "opencode-browser";
+  const reportUsageError = (error) => Effect3.gen(function* () {
+    const errors = error._tag === "ShowHelp" ? error.errors : [error];
+    if (errors.length === 0)
+      return;
+    const message = errors.map((e) => e.message).join("; ");
+    if (cliArgs.json) {
+      yield* emitJson(failure(commandName, "usage", message, { exitCode: ExitCode.usage }));
+      yield* stderrLine(message);
+    }
+    yield* exitWith(ExitCode.usage);
+  });
+  const reportFailure = (error) => Effect3.gen(function* () {
+    const message = error instanceof Error ? error.message : String(error);
+    const exitCode = exitCodeForError(error);
+    if (cliArgs.json) {
+      yield* emitJson(failure(commandName, exitCode === ExitCode.host ? "relay_unavailable" : "error", message, { exitCode }));
+      yield* stderrLine(message);
+    } else {
+      yield* Console.error(message);
+    }
+    yield* exitWith(exitCode);
+  });
+  const silent = () => {};
+  const askedForHelp = cliArgs.argv.some((arg) => arg === "--help" || arg === "-h");
+  const quietJson = cliArgs.json && !askedForHelp;
+  Command.runWith(opencodeBrowser, { version: opencodeBrowserVersion2, renderErrors: !quietJson })(normalizeCliArguments(cliArgs.argv)).pipe(quietJson ? Effect3.provideService(Console.Console, { ...globalThis.console, log: silent }) : (effect) => effect, Effect3.catchIf(CliError.isCliError, reportUsageError), Effect3.catch(reportFailure), Effect3.provide(mainLayer), NodeRuntime.runMain);
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runCli();
+}
+export {
+  runCli
+};