@opencode/browse 0.0.6-dev.17 → 0.0.6-dev.19

package/dist/{cli-b4sbkefj.mjs → cli-22fe7etn.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
-  extensionProtocolVersion,
-  extensionProtocolAdvice,
   dataRoot,
   fromCheckout,
   cliCommand,
   devExtension,
   installCommand,
-  autoUpdateStatus
-} from "./main-g5mke6rn.mjs";
+  autoUpdateStatus,
+  extensionProtocolVersion,
+  extensionProtocolAdvice
+} from "./main-yd50d95g.mjs";
 import {
   defaultPort2,
   isValidSessionId2,
@@ -27,44 +27,45 @@ import {
   ensureExtensionConnected,
   stoppedRelayStatus,
   statusCollections
-} from "./main-3qpkwaa7.mjs";
+} from "./main-8a245rm1.mjs";
+import"./main-75rdz6bc.mjs";
 import {
   opencodeBrowserVersion2,
   opencodeBrowserBuildId2
-} from "./main-y7c1atbf.mjs";
+} from "./main-ts9jjqs8.mjs";
 import {
-  addSecret,
-  listSecrets,
-  removeSecret,
+  updateJson2,
+  formatUpdateNotice2,
+  updateNotice2
+} from "./main-2wrztakb.mjs";
+import {
+  settingKeys,
+  formatSettings,
+  ensureSessionExists,
   readClient,
   socketPath,
   connect,
   pair,
   unpair,
-  settingKeys,
-  formatSettings
-} from "./main-e4stqtf2.mjs";
+  addSecret,
+  listSecrets,
+  removeSecret
+} from "./main-90enpn5q.mjs";
 import {
   defaultJournalBaseDir,
   readJournalEntries,
   formatJournalEntry
-} from "./main-kvmxefp1.mjs";
-import {
-  updateJson2,
-  formatUpdateNotice2,
-  updateNotice2
-} from "./main-4p2p9eey.mjs";
-import"./main-4bht27ry.mjs";
+} from "./main-knahxbey.mjs";
 
 // src/cli.ts
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Config, Console, Effect as Effect3, FileSystem as FileSystem3, Layer as Layer2, Option as Option2, Predicate as Predicate2, Result, Schema as Schema3 } from "effect";
-import { Argument, CliError, Command, Flag } from "effect/cli";
-import path from "node:path";
-import process from "node:process";
+import { Console as Console9, Effect as Effect11, Layer as Layer2 } from "effect";
+import { CliError, Command as Command8 } from "effect/cli";
+import path6 from "node:path";
+import process3 from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-// src/cli-output.ts
+// src/cli/output.ts
 import { writeSync } from "node:fs";
 var ExitCode = { ok: 0, failure: 1, usage: 2, auth: 3, host: 4 };
 var failure = (command, code, message, options = {}) => ({
@@ -102,10 +103,15 @@ var writeStdout = (text, fd = 1) => {
 var printJson = (value) => writeStdout(`${JSON.stringify(value, null, 2)}
 `);
 
+// src/cli/browser.ts
+import { Console as Console2, Effect as Effect4, FileSystem as FileSystem3, Option as Option3, Result } from "effect";
+import { Argument, Command, Flag as Flag2 } from "effect/cli";
+import path from "node:path";
+
 // src/doctor.ts
 import { Effect as Effect2, FileSystem as FileSystem2, Path as Path2, Schema as Schema2 } from "effect";
 
-// src/session-store.ts
+// src/session-manager/store.ts
 import { Context, Effect, FileSystem, Layer, Option, Path, Predicate, Schema } from "effect";
 class SessionStoreError extends Schema.TaggedError()("SessionStore.SessionStoreError", {
   message: Schema.String,
@@ -211,10 +217,9 @@ var createDoctorReport = Effect2.fn("Doctor.createReport")(function* (options) {
     }
   })));
   const fileExists = (relativePath) => fs.exists(path.join(options.packageRoot, relativePath)).pipe(Effect2.orElseSucceed(() => false));
-  const [packageResult, distCliExists, distMcpExists, currentResult] = yield* Effect2.all([
+  const [packageResult, distCliExists, currentResult] = yield* Effect2.all([
     probe(readPackageInfo),
     fileExists("dist/cli.mjs"),
-    fileExists("dist/cli.mjs"),
     probe(store.read)
   ]);
   const expectedExtensionVersion = packageResult.ok ? { ok: true, value: extensionManifestVersion(packageResult.value.version) } : packageResult;
@@ -248,7 +253,7 @@ var createDoctorReport = Effect2.fn("Doctor.createReport")(function* (options) {
     return session.connected && session.id !== current;
   });
   const artifacts = [
-    { path: "dist/cli.mjs", exists: distCliExists && distMcpExists }
+    { path: "dist/cli.mjs", exists: distCliExists }
   ];
   const checks = buildDoctorChecks({
     packageResult,
@@ -601,8 +606,10 @@ function formatTargetSummary(target, options = {}) {
   return `${target.type} ${target.id}${tab}${session}${owner}${health} ${target.url || "about:blank"}`;
 }
 
-// src/cli.ts
-var packageRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+// src/cli/context.ts
+import { Config, Console, Effect as Effect3, Option as Option2, Predicate as Predicate2 } from "effect";
+import { Flag } from "effect/cli";
+import process from "node:process";
 var sessionIdConfig = Config.option(Config.String("OPENCODE_BROWSER_SESSION"));
 var agentSessionIdConfig = Config.option(Config.String("OPENCODE_SESSION_ID"));
 var targetUrlConfig = Config.option(Config.String("OPENCODE_BROWSER_TARGET_URL"));
@@ -624,7 +631,11 @@ var failExit = Effect3.sync(() => {
 var exitWith = (code) => Effect3.sync(() => {
   process.exitCode = code;
 });
-var hostErrorTags = new Set(["RelayClient.RelayUnreachable", "RelayLifecycle.RelayStartFailed", "RelayLifecycle.ExtensionDisconnected"]);
+var hostErrorTags = new Set([
+  "RelayClient.RelayUnreachable",
+  "RelayLifecycle.RelayStartFailed",
+  "RelayLifecycle.ExtensionDisconnected"
+]);
 function exitCodeForError(error) {
   if (error instanceof RelayRejected && error.code === "browser-unavailable")
     return ExitCode.host;
@@ -685,10 +696,9 @@ function decodeCliOperands(operands) {
     return decodeURIComponent(operand.slice(encodedCliOperandPrefix.length));
   });
 }
-var readExecuteFile = Effect3.fnUntraced(function* (filePath) {
-  const fs = yield* FileSystem3.FileSystem;
-  return yield* fs.readFileString(path.resolve(filePath)).pipe(Effect3.mapError((cause) => new Error(`read execute file ${filePath}: ${cause.reason.message}`, { cause })));
-});
+function formatSessionContinuation(sessionId) {
+  return `Session: ${sessionId}. Continue with --session ${sessionId}.`;
+}
 var ensureCliRelay = Effect3.fnUntraced(function* () {
   const relay = yield* Service;
   const readiness = yield* ensureRelay({ relay });
@@ -725,16 +735,10 @@ var resolvePositionalOrFlagSessionId = Effect3.fnUntraced(function* (id, session
     environment: Option2.getOrUndefined(yield* sessionIdConfig)
   }));
 });
-var ensureSessionExists = Effect3.fnUntraced(function* (id) {
+var ensureSessionExists2 = Effect3.fnUntraced(function* (id) {
   const relay = yield* Service;
   yield* ensureCliRelay();
-  const sessions = yield* relay.sessions;
-  const exists = sessions.some((session) => {
-    return session.id === id;
-  });
-  if (!exists) {
-    return yield* Effect3.fail(new Error(`Session not found: ${id}`));
-  }
+  yield* ensureSessionExists(relay, id);
 });
 var recordingTarget = Effect3.fnUntraced(function* (options) {
   const sessionId = Option2.getOrUndefined(options.session);
@@ -756,6 +760,229 @@ var parseRecordingModeOption = Effect3.fnUntraced(function* (value) {
   }
   return yield* Effect3.fail(new Error("Recording mode must be auto, tab-capture, or cdp"));
 });
+var networkSession = Effect3.fnUntraced(function* (session) {
+  return yield* resolveSelectedSessionId(Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig));
+});
+
+// src/cli/registry.ts
+var entries = [];
+function registerCliCommand(order, build) {
+  entries.push({
+    order,
+    build
+  });
+}
+function buildRegisteredCliCommands(ctx) {
+  return [...entries].sort((left, right) => left.order - right.order).map((entry) => entry.build(ctx));
+}
+
+// src/cli/browser.ts
+var tabsCleanup = Command.make("cleanup", {
+  idleMinutes: Flag2.Int("idle-minutes").pipe(Flag2.optional, Flag2.withDescription("Close agent tabs idle at least this long; 0 closes every eligible agent tab (default: the extension's setting, 10; still 10 when it is set to never)")),
+  json: jsonFlag
+}, Effect4.fn("Cli.tabsCleanup")(function* ({ idleMinutes, json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.tabsCleanup(Option3.getOrUndefined(idleMinutes));
+  if (json)
+    return yield* emitJson(result);
+  if (!result.closed.length)
+    return yield* Console2.log("No idle agent tabs to close.");
+  for (const tab of result.closed)
+    yield* Console2.log(`Closed ${tab.title} (idle ${tab.idleMinutes}m)`);
+})).pipe(Command.withDescription("Close tabs agents opened that nobody has used for a while"));
+var tabs = Command.make("tabs").pipe(Command.withDescription("Manage the tabs agents open"), Command.withSubcommands([tabsCleanup]));
+var printSettings = (settings) => Effect4.forEach(formatSettings(settings), (line) => Console2.log(line), { discard: true });
+var settingsGet = Command.make("get", { json: jsonFlag }, Effect4.fn("Cli.settingsGet")(function* ({ json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.settingsGet;
+  if (json)
+    return yield* emitJson(result);
+  yield* printSettings(result.settings);
+  yield* Console2.log(result.note);
+})).pipe(Command.withDescription("Show each setting's value, the value in effect, and any relay environment variable overriding it"));
+var settingsSet = Command.make("set", {
+  assignments: Argument.String("key=value").pipe(Argument.variadic({ min: 1 }), Argument.withDescription(`Settings to change: ${settingKeys.join(", ")}`)),
+  json: jsonFlag
+}, Effect4.fn("Cli.settingsSet")(function* ({ assignments, json }) {
+  const changes = {};
+  for (const assignment of assignments) {
+    const index = assignment.indexOf("=");
+    if (index <= 0)
+      return yield* Effect4.fail(new Error(`Expected key=value, got "${assignment}". Settings: ${settingKeys.join(", ")}.`));
+    changes[assignment.slice(0, index)] = assignment.slice(index + 1);
+  }
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const result = yield* relay.settingsSet(changes);
+  if (json)
+    return yield* emitJson(result);
+  yield* Console2.log(result.message);
+  yield* printSettings(result.settings);
+})).pipe(Command.withDescription("Change settings (validated strictly; the extension's options page updates live)"));
+var settings = Command.make("settings").pipe(Command.withDescription("Read or change the user's settings (the extension's options page). Security switches are environment-only"), Command.withSubcommands([settingsGet, settingsSet]));
+var status = Command.make("status", {
+  json: jsonFlag
+}, Effect4.fn("Cli.status")(function* ({ json }) {
+  const relay = yield* Service;
+  const store = yield* Service2;
+  const [relayResult, update] = yield* Effect4.all([Effect4.result(relay.version), Effect4.promise(() => updateNotice2())], { concurrency: 2 });
+  const updateLine = update ? formatUpdateNotice2(update) : undefined;
+  if (Result.isFailure(relayResult)) {
+    if (!(relayResult.failure instanceof RelayUnreachable)) {
+      if (json) {
+        yield* emitJson({
+          endpoint: relay.endpoint,
+          relay: { running: false, error: relayResult.failure.message },
+          extension: null,
+          sessions: [],
+          targets: [],
+          update: updateJson2(update)
+        });
+      }
+      yield* stderrLine(`Relay status failed: ${relayResult.failure.message}`);
+      yield* exitWith(ExitCode.host);
+      return;
+    }
+    const stopped = stoppedRelayStatus(relay.endpoint);
+    if (json) {
+      yield* emitJson({ ...stopped, update: updateJson2(update), autoUpdate: autoUpdateStatus() });
+      yield* stderrLine(`relay is not running at ${relay.endpoint}`);
+    } else {
+      yield* Console2.log(`Relay: stopped (${relay.endpoint})`);
+      yield* Console2.log(`Run \`${cliCommand("execute")}\` (or any relay-backed command) to start it automatically.`);
+      if (updateLine)
+        yield* Console2.log(updateLine);
+    }
+    yield* exitWith(ExitCode.host);
+    return;
+  }
+  const version = relayResult.success;
+  const buildProblem = relayBuildProblem(version);
+  const [extensionStatus, current] = yield* Effect4.all([relay.extensionStatus, store.read]);
+  const collections = statusCollections(extensionStatus);
+  const [sessions, targets] = collections ? [collections.sessions, collections.targets] : yield* Effect4.all([relay.sessions, relay.targets]);
+  if (json) {
+    yield* emitJson({
+      endpoint: relay.endpoint,
+      relay: {
+        running: true,
+        version: version.version,
+        buildId: version.buildId ?? null,
+        stale: buildProblem !== undefined
+      },
+      extension: extensionStatus,
+      currentSession: current ?? null,
+      sessions,
+      targets,
+      update: updateJson2(update),
+      autoUpdate: autoUpdateStatus()
+    });
+    if (buildProblem) {
+      yield* stderrLine(buildProblem);
+      yield* failExit;
+    }
+    return;
+  }
+  if (updateLine)
+    yield* Console2.log(updateLine);
+  yield* Console2.log(`Relay: ${relay.endpoint} (${version.version})`);
+  if (buildProblem) {
+    yield* Console2.log(`Warning: ${buildProblem}`);
+  }
+  yield* Console2.log(`Extension: ${extensionStatus.connected ? "connected" : "disconnected"}${extensionStatus.version ? ` (${extensionStatus.version})` : ""}`);
+  if ((extensionStatus.rejectedConnections ?? 0) > 0) {
+    yield* Console2.log(`Warning: ${extensionStatus.rejectedConnections} competing browser/profile connection attempt(s) rejected; the active connection was preserved. Use Browse in one browser/profile at a time.`);
+  }
+  if (extensionStatus.nextStep)
+    yield* Console2.log(extensionStatus.nextStep);
+  else if ((extensionStatus.pairingFailures ?? 0) > 0 && !extensionStatus.connected) {
+    yield* Console2.log(`Warning: ${extensionStatus.pairingFailures} extension connection(s) failed pairing. Update the extension, or run \`${cliCommand("pair")}\` and enter the code on its status page.`);
+  }
+  if ((extensionStatus.processFaults?.suppressed ?? 0) > 0) {
+    const faults = extensionStatus.processFaults;
+    yield* Console2.log(`Warning: the relay survived ${faults.suppressed} Playwright fault(s)${faults.lastAt ? `, last at ${faults.lastAt}` : ""}${faults.lastMessage ? `: ${faults.lastMessage}` : ""}. See the relay log.`);
+  }
+  if (extensionStatus.protocolVersion !== undefined && extensionStatus.protocolVersion !== null) {
+    const compatibility = extensionStatus.protocolCompatible === false ? "incompatible" : "compatible";
+    const legacy = extensionStatus.protocolLegacy === true ? ", inferred from legacy hello" : "";
+    yield* Console2.log(`Extension protocol: ${extensionStatus.protocolVersion} (${compatibility}${legacy})`);
+    if (extensionStatus.protocolCompatible === false && !extensionStatus.nextStep)
+      yield* Console2.log(extensionProtocolAdvice(extensionStatus.protocolVersion, { install: installCommand() }));
+  }
+  yield* Console2.log(`Active targets: ${extensionStatus.activeTargets}`);
+  if (extensionStatus.childTargets !== undefined) {
+    yield* Console2.log(`Child targets: ${extensionStatus.childTargets}`);
+  }
+  if (extensionStatus.cdpClients !== undefined) {
+    yield* Console2.log(`CDP clients: ${extensionStatus.cdpClients}`);
+  }
+  yield* Console2.log(`Current session: ${current ?? "none"}`);
+  if (sessions.length === 0) {
+    yield* Console2.log("Sessions: none");
+  } else {
+    yield* Console2.log("Sessions:");
+    const activeSessions = sessions.filter((item) => item.id === current || item.connected || item.pageUrl !== null || item.stateKeys.length > 0 || item.readOnly);
+    const idleSessions = sessions.filter((item) => !activeSessions.includes(item));
+    const shownSessions = activeSessions.length > 0 ? activeSessions : idleSessions.slice(0, 5);
+    const omittedIdleCount = activeSessions.length > 0 ? idleSessions.length : Math.max(0, idleSessions.length - shownSessions.length);
+    yield* Effect4.forEach(shownSessions, (item) => {
+      const marker = item.id === current ? "*" : " ";
+      return Console2.log(`${marker} ${item.id} ${item.pageUrl ?? "no page yet"}`);
+    });
+    if (omittedIdleCount > 0) {
+      yield* Console2.log(`  (${omittedIdleCount} idle session(s) with no page omitted; run ${cliCommand("session list")} to view all)`);
+    }
+  }
+  if (targets.length === 0) {
+    yield* Console2.log("Targets: none");
+  } else {
+    yield* Console2.log("Targets:");
+    yield* Effect4.forEach(targets, (target, index) => {
+      return Console2.log(`- [${index}] ${formatTargetSummary(target, { includeSession: true })}`);
+    });
+  }
+  if (buildProblem) {
+    yield* failExit;
+  }
+})).pipe(Command.withDescription("Show relay, extension, and target status"));
+var mcp = Command.make("mcp", {}, Effect4.fn("Cli.mcp")(function* () {
+  const { runMcpServer } = yield* Effect4.promise(() => import("./mcp-p0mcjvq9.mjs"));
+  yield* runMcpServer;
+})).pipe(Command.withDescription("Run the Browse MCP server over stdio"));
+registerCliCommand(400, () => tabs);
+registerCliCommand(410, () => settings);
+registerCliCommand(500, () => status);
+registerCliCommand(810, ({ packageRoot }) => Command.make("doctor", {
+  json: jsonFlag
+}, Effect4.fn("Cli.doctor")(function* ({ json }) {
+  const update = yield* Effect4.promise(() => updateNotice2());
+  const report = yield* createDoctorReport({ packageRoot, update: updateJson2(update) });
+  if (json) {
+    yield* emitJson(report);
+  } else {
+    yield* Console2.log(formatDoctorReport(report));
+  }
+  if (report.status === "fail") {
+    yield* failExit;
+  }
+})).pipe(Command.withDescription("Diagnose the local Browse install and runtime")));
+registerCliCommand(820, ({ packageRoot }) => Command.make("skill", {}, Effect4.fn("Cli.skill")(function* () {
+  const fs = yield* FileSystem3.FileSystem;
+  const text = yield* fs.readFileString(path.join(packageRoot, "skills", "browse", "SKILL.md")).pipe(Effect4.mapError((cause) => new Error("read opencode-browser skill", { cause })));
+  yield* Console2.log(text.trimEnd());
+})).pipe(Command.withDescription("Print the Browse agent skill text")));
+registerCliCommand(900, () => mcp);
+
+// src/cli/execute.ts
+import { Console as Console3, Effect as Effect5, FileSystem as FileSystem4, Option as Option4, Predicate as Predicate3, Result as Result2, Schema as Schema3 } from "effect";
+import { Argument as Argument2, Command as Command2, Flag as Flag3 } from "effect/cli";
+import path2 from "node:path";
+var readExecuteFile = Effect5.fnUntraced(function* (filePath) {
+  const fs = yield* FileSystem4.FileSystem;
+  return yield* fs.readFileString(path2.resolve(filePath)).pipe(Effect5.mapError((cause) => new Error(`read execute file ${filePath}: ${cause.reason.message}`, { cause })));
+});
 function formatExecuteLogs(logs) {
   return [
     "Console logs:",
@@ -801,73 +1028,59 @@ function executeJsonEnvelope(result) {
     session: result.session
   };
 }
-function formatSessionContinuation(sessionId) {
-  return `Session: ${sessionId}. Continue with --session ${sessionId}.`;
-}
 function errorJsonEnvelope(error) {
-  const tag = Predicate2.isObject(error) && Predicate2.hasProperty(error, "_tag") && Predicate2.isString(error._tag) ? error._tag : "Error";
+  const tag = Predicate3.isObject(error) && Predicate3.hasProperty(error, "_tag") && Predicate3.isString(error._tag) ? error._tag : "Error";
   const message = error instanceof Error ? error.message : String(error);
   const errorValue = Object.assign({ message }, { _tag: tag });
-  return { ok: false, isError: true, text: message, value: null, valueUnavailable: true, error: errorValue, logs: [], warnings: [] };
+  return {
+    ok: false,
+    isError: true,
+    text: message,
+    value: null,
+    valueUnavailable: true,
+    error: errorValue,
+    logs: [],
+    warnings: []
+  };
 }
-var serve = Command.make("serve", {}, Effect3.fn("Cli.serve")(function* () {
-  const [{ startRelay }, { parseAdditionalExtensionOrigins }] = yield* Effect3.promise(() => Promise.all([import("./relay-ns525pms.mjs"), import("./relay-helpers-pjcbxs7p.mjs")]));
-  const port = yield* portConfig;
-  const additionalExtensionOrigins = parseAdditionalExtensionOrigins(yield* extensionOriginsConfig);
-  yield* Effect3.scoped(Effect3.gen(function* () {
-    const relay = yield* startRelay({ port, additionalExtensionOrigins });
-    yield* Console.log(`Browse relay listening at ${relay.url}`);
-    yield* Console.log(`Browse connects automatically while the browser runs. Run \`${cliCommand("status")}\` to check.`);
-    yield* Effect3.never;
-  }));
-})).pipe(Command.withDescription("Start the local Browse relay"));
-var relayRestart = Command.make("restart", {
-  force: Flag.Boolean("force").pipe(Flag.withDefault(false), Flag.withDescription("End network captures and recordings (discarding them) and disconnect raw CDP clients instead of refusing to restart"))
-}, Effect3.fn("Cli.relayRestart")(function* ({ force }) {
-  const relay = yield* Service;
-  yield* Console.error("Restarting the relay leaves browser tabs open but resets in-memory JavaScript state.");
-  const readiness = yield* restartRelay({ relay, clientKind: "cli", force });
-  yield* Console.log(`${readiness.started ? "Started" : "Reused concurrent replacement"} Browse relay at ${relay.endpoint} (${readiness.version.buildId})`);
-})).pipe(Command.withDescription("Explicitly drain and restart the managed relay using this installation"));
-var relay = Command.make("relay").pipe(Command.withDescription("Manage the local relay lifecycle"), Command.withSubcommands([relayRestart]));
-var execute = Command.make("execute", {
-  code: Argument.String("code").pipe(Argument.variadic({ min: 0 })),
-  file: Flag.String("file").pipe(Flag.optional, Flag.withDescription("Read execute code from a file")),
+var execute = Command2.make("execute", {
+  code: Argument2.String("code").pipe(Argument2.variadic({ min: 0 })),
+  file: Flag3.String("file").pipe(Flag3.optional, Flag3.withDescription("Read execute code from a file")),
   session: sessionFlag("Continue an existing Browse session; defaults to the OpenCode agent's session"),
-  rm: Flag.Boolean("rm").pipe(Flag.withDefault(false), Flag.withDescription("Use a fresh one-shot session and close its tabs afterward")),
-  timeoutMs: Flag.Int("timeout-ms").pipe(Flag.optional, Flag.withDescription("Overall script timeout in milliseconds (paused during handoff); defaults to 60000, 0 disables")),
-  targetUrl: Flag.String("target-url").pipe(Flag.optional, Flag.withDescription("Use the attached page whose URL contains this text")),
-  targetIndex: Flag.Int("target-index").pipe(Flag.optional, Flag.withDescription("Use the attached page at this zero-based index")),
-  json: Flag.Boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Print a machine-readable result envelope: { ok, isError, text, value, valueUnavailable, error?, logs, warnings, diagnostic?, aftermath, session }"))
-}, Effect3.fn("Cli.execute")(function* ({ code, file, session, rm, timeoutMs, targetUrl, targetIndex, json }) {
-  const run = Effect3.gen(function* () {
+  rm: Flag3.Boolean("rm").pipe(Flag3.withDefault(false), Flag3.withDescription("Use a fresh one-shot session and close its tabs afterward")),
+  timeoutMs: Flag3.Int("timeout-ms").pipe(Flag3.optional, Flag3.withDescription("Overall script timeout in milliseconds (paused during handoff); defaults to 60000, 0 disables")),
+  targetUrl: Flag3.String("target-url").pipe(Flag3.optional, Flag3.withDescription("Use the attached page whose URL contains this text")),
+  targetIndex: Flag3.Int("target-index").pipe(Flag3.optional, Flag3.withDescription("Use the attached page at this zero-based index")),
+  json: Flag3.Boolean("json").pipe(Flag3.withDefault(false), Flag3.withDescription("Print a machine-readable result envelope: { ok, isError, text, value, valueUnavailable, error?, logs, warnings, diagnostic?, aftermath, session }"))
+}, Effect5.fn("Cli.execute")(function* ({ code, file, session, rm, timeoutMs, targetUrl, targetIndex, json }) {
+  const run = Effect5.gen(function* () {
     const relay = yield* Service;
-    const filePath = Option2.getOrUndefined(file);
+    const filePath = Option4.getOrUndefined(file);
     if (code.length > 0 && filePath) {
-      return yield* Effect3.fail(new Error("Use either positional code or --file, not both"));
+      return yield* Effect5.fail(new Error("Use either positional code or --file, not both"));
     }
     if (code.length === 0 && !filePath) {
-      return yield* Effect3.fail(new Error("Execute requires positional code or --file <path>"));
+      return yield* Effect5.fail(new Error("Execute requires positional code or --file <path>"));
     }
-    const timeoutMsValue = Option2.getOrUndefined(timeoutMs);
+    const timeoutMsValue = Option4.getOrUndefined(timeoutMs);
     if (timeoutMsValue !== undefined && timeoutMsValue < 0) {
-      return yield* Effect3.fail(new Error("Timeout must be a non-negative integer"));
+      return yield* Effect5.fail(new Error("Timeout must be a non-negative integer"));
     }
     const executeCode = filePath ? yield* readExecuteFile(filePath) : code.join(" ");
-    const explicitSessionId = Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig);
+    const explicitSessionId = Option4.getOrUndefined(session) ?? Option4.getOrUndefined(yield* sessionIdConfig);
     if (rm && explicitSessionId) {
-      return yield* Effect3.fail(new Error("Use --rm without --session or OPENCODE_BROWSER_SESSION"));
+      return yield* Effect5.fail(new Error("Use --rm without --session or OPENCODE_BROWSER_SESSION"));
     }
-    const agentWorkSessionId = agentDefaultSessionId(Option2.getOrUndefined(yield* agentSessionIdConfig));
+    const agentWorkSessionId = agentDefaultSessionId(Option4.getOrUndefined(yield* agentSessionIdConfig));
     const workSessionId = explicitSessionId ?? (rm ? undefined : agentWorkSessionId);
     yield* ensureCliRelayAndExtension(workSessionId);
-    const targetUrlValue = Option2.getOrUndefined(targetUrl) ?? Option2.getOrUndefined(yield* targetUrlConfig);
-    const targetIndexValue = Option2.getOrUndefined(targetIndex) ?? Option2.getOrUndefined(yield* targetIndexConfig);
+    const targetUrlValue = Option4.getOrUndefined(targetUrl) ?? Option4.getOrUndefined(yield* targetUrlConfig);
+    const targetIndexValue = Option4.getOrUndefined(targetIndex) ?? Option4.getOrUndefined(yield* targetIndexConfig);
     if (targetIndexValue !== undefined && targetIndexValue < 0) {
-      return yield* Effect3.fail(new Error("Target index must be a non-negative integer"));
+      return yield* Effect5.fail(new Error("Target index must be a non-negative integer"));
     }
     if (targetUrlValue && targetIndexValue !== undefined) {
-      return yield* Effect3.fail(new Error("Use only one target selector: --target-url/OPENCODE_BROWSER_TARGET_URL or --target-index/OPENCODE_BROWSER_TARGET_INDEX"));
+      return yield* Effect5.fail(new Error("Use only one target selector: --target-url/OPENCODE_BROWSER_TARGET_URL or --target-index/OPENCODE_BROWSER_TARGET_INDEX"));
     }
     const result = yield* relay.execute({
       ...workSessionId ? { sessionId: workSessionId } : {},
@@ -883,33 +1096,33 @@ var execute = Command.make("execute", {
       } : {}
     });
     if (!explicitSessionId && !rm) {
-      yield* Console.error(formatSessionContinuation(result.session.id));
+      yield* Console3.error(formatSessionContinuation(result.session.id));
     }
     return result;
   });
   if (json) {
-    const outcome = yield* Effect3.result(run);
-    const envelope = Result.isFailure(outcome) ? errorJsonEnvelope(outcome.failure) : executeJsonEnvelope(outcome.success);
+    const outcome = yield* Effect5.result(run);
+    const envelope = Result2.isFailure(outcome) ? errorJsonEnvelope(outcome.failure) : executeJsonEnvelope(outcome.success);
     yield* emitJson(envelope);
     if (!envelope.ok) {
       yield* stderrLine(envelope.error?.message ?? envelope.text);
-      yield* exitWith(Result.isFailure(outcome) ? exitCodeForError(outcome.failure) : ExitCode.failure);
+      yield* exitWith(Result2.isFailure(outcome) ? exitCodeForError(outcome.failure) : ExitCode.failure);
     }
     return;
   }
-  const outcome = yield* Effect3.result(run);
-  if (Result.isFailure(outcome)) {
-    yield* Console.error(outcome.failure.message);
+  const outcome = yield* Effect5.result(run);
+  if (Result2.isFailure(outcome)) {
+    yield* Console3.error(outcome.failure.message);
     yield* exitWith(exitCodeForError(outcome.failure));
     return;
   }
   const result = outcome.success;
-  const print = result.isError ? Console.error : Console.log;
+  const print = result.isError ? Console3.error : Console3.log;
   yield* print(result.text);
   if (result.logs.length > 0) {
     yield* print(formatExecuteLogs(result.logs));
   }
-  yield* Effect3.forEach(result.warnings ?? [], (warning) => print(`Warning: ${warning}`));
+  yield* Effect5.forEach(result.warnings ?? [], (warning) => print(`Warning: ${warning}`));
   if (result.diagnostic) {
     yield* print(`Diagnostic: ${result.diagnostic}`);
   }
@@ -920,321 +1133,177 @@ var execute = Command.make("execute", {
   if (result.isError) {
     yield* failExit;
   }
-})).pipe(Command.withDescription("Execute Playwright code against the attached browser"));
-var sessionNew = Command.make("new", {
-  name: Argument.String("name").pipe(Argument.optional, Argument.withDescription("Optional lowercase session id")),
-  readOnly: Flag.Boolean("read-only").pipe(Flag.withDefault(false), Flag.withDescription("Create a read-only session: the relay rejects input-dispatching CDP so scripts can inspect but not click or type")),
-  allowOrigin: Flag.String("allow-origin").pipe(Flag.atLeast(0), Flag.withDescription("Only let this session's tabs load these hosts or origins (repeatable or comma-separated): example.com, *.example.com, https://app.example.com, http://localhost:3000"))
-}, Effect3.fn("Cli.sessionNew")(function* ({ name, readOnly, allowOrigin }) {
+})).pipe(Command2.withDescription("Execute Playwright code against the attached browser"));
+registerCliCommand(200, () => execute);
+
+// src/cli/network.ts
+import { Console as Console4, Effect as Effect6, Option as Option5 } from "effect";
+import { Command as Command3, Flag as Flag4 } from "effect/cli";
+import path3 from "node:path";
+var parseNetworkContent = Effect6.fnUntraced(function* (content) {
+  const value = Option5.getOrUndefined(content);
+  if (value === undefined || value === "embed" || value === "omit")
+    return value;
+  return yield* Effect6.fail(new Error("Network content must be embed or omit"));
+});
+function formatNetworkStatus(status) {
+  if (!status.active)
+    return status.ended ? `Network capture: inactive (the last one ended because ${status.ended})` : "Network capture: inactive";
+  return `Network capture: active entries=${status.entryCount} responses=${status.responseCount} failures=${status.failureCount} bodyBytes=${status.capturedBodyBytes} truncated=${status.truncatedBodyCount} dropped=${status.droppedEntryCount} startedAt=${status.startedAt ?? "unknown"}${status.endsAt ? ` endsAt=${status.endsAt}` : ""}`;
+}
+function formatNetworkResult(result) {
+  const output = result.outputPath ? ` output=${result.outputPath}` : "";
+  const profile = result.authProfile ? ` secrets=${result.authProfile.name}(${result.authProfile.slotCount})` : "";
+  return `Network capture stopped: entries=${result.entryCount} responses=${result.responseCount} failures=${result.failureCount} bodyBytes=${result.capturedBodyBytes} truncated=${result.truncatedBodyCount} dropped=${result.droppedEntryCount}${output}${profile}`;
+}
+var networkStart = Command3.make("start", {
+  session: sessionFlag("Capture the default page for this Browse session"),
+  urlFilter: Flag4.String("url").pipe(Flag4.optional, Flag4.withDescription("Capture only requests whose URL contains this text")),
+  resourceTypes: Flag4.String("resource-type").pipe(Flag4.atMost(50), Flag4.withDescription("Capture this Playwright resource type; repeat for multiple types")),
+  content: Flag4.String("content").pipe(Flag4.optional, Flag4.withDescription("Response and request body mode: embed (default) or omit")),
+  maxBodyBytes: Flag4.Int("max-body-bytes").pipe(Flag4.optional, Flag4.withDescription("Maximum captured bytes per body, defaults to 1000000")),
+  maxTotalBodyBytes: Flag4.Int("max-total-body-bytes").pipe(Flag4.optional, Flag4.withDescription("Maximum captured body bytes for the whole capture, defaults to 25000000")),
+  maxEntries: Flag4.Int("max-entries").pipe(Flag4.optional, Flag4.withDescription("Maximum request entries, defaults to 1000")),
+  maxDuration: Flag4.Int("max-duration-ms").pipe(Flag4.optional, Flag4.withDescription("End the capture by itself (discarding it) after this long, defaults to 1800000 (30 minutes)")),
+  json: jsonFlag
+}, Effect6.fn("Cli.networkStart")(function* ({
+  session,
+  urlFilter,
+  resourceTypes,
+  content,
+  maxBodyBytes,
+  maxTotalBodyBytes,
+  maxEntries,
+  maxDuration,
+  json
+}) {
   const relay = yield* Service;
-  yield* ensureCliRelay();
-  const store = yield* Service2;
-  const result = yield* relay.sessionNew(Option2.getOrUndefined(name), {
-    ...readOnly ? { readOnly: true } : {},
-    ...allowOrigin.length > 0 ? { allowedOrigins: allowOrigin } : {}
+  yield* ensureCliRelayAndExtension();
+  const sessionId = yield* networkSession(session);
+  const contentValue = yield* parseNetworkContent(content);
+  const result = yield* relay.networkStart({
+    sessionId,
+    ...Option5.isSome(urlFilter) ? { urlFilter: urlFilter.value } : {},
+    ...resourceTypes.length === 0 ? {} : { resourceTypes },
+    ...contentValue === undefined ? {} : { content: contentValue },
+    ...Option5.isSome(maxBodyBytes) ? { maxBodyBytes: maxBodyBytes.value } : {},
+    ...Option5.isSome(maxTotalBodyBytes) ? { maxTotalBodyBytes: maxTotalBodyBytes.value } : {},
+    ...Option5.isSome(maxEntries) ? { maxEntries: maxEntries.value } : {},
+    ...Option5.isSome(maxDuration) ? { maxDurationMs: maxDuration.value } : {}
   });
-  yield* store.write(result.id);
-  yield* Console.log(result.id);
-})).pipe(Command.withDescription("Create a Browse session and make it current"));
-var sessionList = Command.make("list", {
+  yield* printOr(json, result, formatNetworkStatus(result));
+})).pipe(Command3.withDescription("Start session-scoped network capture"));
+var networkStatus = Command3.make("status", {
+  session: sessionFlag(),
   json: jsonFlag
-}, Effect3.fn("Cli.sessionList")(function* ({ json }) {
+}, Effect6.fn("Cli.networkStatus")(function* ({ session, json }) {
   const relay = yield* Service;
+  const sessionId = yield* networkSession(session);
   yield* ensureCliRelay();
-  const store = yield* Service2;
-  const sessions = yield* relay.sessions;
-  const current = yield* store.read;
-  if (json) {
-    yield* emitJson({ current: current ?? undefined, sessions });
-    return;
-  }
-  if (sessions.length === 0) {
-    yield* Console.log("No sessions");
-    return;
+  const result = yield* relay.networkStatus({ sessionId });
+  yield* printOr(json, result, formatNetworkStatus(result));
+})).pipe(Command3.withDescription("Show session-scoped network capture status"));
+var networkStop = Command3.make("stop", {
+  session: sessionFlag(),
+  output: Flag4.String("output").pipe(Flag4.optional, Flag4.withAlias("o"), Flag4.withDescription("Write a credential-redacted HAR artifact to this path")),
+  secrets: Flag4.String("secrets").pipe(Flag4.optional, Flag4.withDescription("Store captured credentials under this reusable profile name")),
+  json: jsonFlag
+}, Effect6.fn("Cli.networkStop")(function* ({ session, output, secrets, json }) {
+  const relay = yield* Service;
+  const outputValue = Option5.getOrUndefined(output);
+  const secretsValue = Option5.getOrUndefined(secrets);
+  if (!outputValue && !secretsValue) {
+    return yield* Effect6.fail(new Error("network stop requires --output, --secrets, or both"));
   }
-  yield* Effect3.forEach(sessions, (item) => {
-    const marker = item.id === current ? "*" : " ";
-    const page = item.pageUrl ?? "no page yet";
-    const keys = item.stateKeys.length ? ` state=${item.stateKeys.join(",")}` : "";
-    const readOnly = item.readOnly ? " read-only" : "";
-    const allowed = item.allowedOrigins ? ` allow=${item.allowedOrigins.join(",")}` : "";
-    return Console.log(`${marker} ${item.id} ${page}${keys}${readOnly}${allowed}`);
+  const sessionId = yield* networkSession(session);
+  yield* ensureCliRelay();
+  const result = yield* relay.networkStop({
+    sessionId,
+    ...outputValue ? { outputPath: path3.resolve(outputValue) } : {},
+    ...secretsValue ? { secrets: secretsValue } : {}
   });
-})).pipe(Command.withDescription("List Browse sessions"));
-var sessionCurrent = Command.make("current", {}, Effect3.fn("Cli.sessionCurrent")(function* () {
-  const store = yield* Service2;
-  const current = yield* store.read;
-  yield* Console.log(current ?? "none");
-})).pipe(Command.withDescription("Print the current default session"));
-var sessionUse = Command.make("use", {
-  id: Argument.String("id")
-}, Effect3.fn("Cli.sessionUse")(function* ({ id }) {
-  const store = yield* Service2;
-  yield* ensureSessionExists(id);
-  yield* store.write(id);
-  yield* Console.log(id);
-})).pipe(Command.withDescription("Set the current default session"));
-var sessionReset = Command.make("reset", {
-  id: Argument.String("id").pipe(Argument.optional),
-  session: sessionFlag("Reset this Browse session id")
-}, Effect3.fn("Cli.sessionReset")(function* ({ id, session }) {
+  yield* printOr(json, result, formatNetworkResult(result));
+})).pipe(Command3.withDescription("Stop capture and write a redacted artifact or reusable secret profile"));
+var networkCancel = Command3.make("cancel", { session: sessionFlag() }, Effect6.fn("Cli.networkCancel")(function* ({ session }) {
   const relay = yield* Service;
-  const sessionId = yield* resolvePositionalOrFlagSessionId(id, session);
+  const sessionId = yield* networkSession(session);
   yield* ensureCliRelay();
-  const reset = yield* relay.sessionReset(sessionId);
-  if (reset.stopped)
-    yield* Console.error(`Stopped first: ${describeStop(reset.stopped)}`);
-  yield* Console.log(reset.session.id);
-})).pipe(Command.withDescription("Reset a Browse session state and page"));
-var sessionAdopt = Command.make("adopt", {
-  session: sessionFlag("Adopt into this Browse session, creating it when it does not exist yet; omit to create a fresh readable id"),
-  targetUrl: Flag.String("target-url").pipe(Flag.optional, Flag.withDescription("Adopt the attached page whose URL contains this text")),
-  targetIndex: Flag.Int("target-index").pipe(Flag.optional, Flag.withDescription("Adopt the attached page at this zero-based target index")),
-  tabId: tabIdFlag("Adopt the user's shared tab with this Chrome tab id (the tab= value in status)")
-}, Effect3.fn("Cli.sessionAdopt")(function* ({ session, targetUrl, targetIndex, tabId }) {
-  const relay = yield* Service;
-  const explicitSessionId = Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig);
-  yield* ensureCliRelayAndExtension(explicitSessionId);
-  const targetUrlValue = Option2.getOrUndefined(targetUrl);
-  const targetIndexValue = Option2.getOrUndefined(targetIndex);
-  if (targetIndexValue !== undefined && targetIndexValue < 0) {
-    return yield* Effect3.fail(new Error("Target index must be a non-negative integer"));
-  }
-  const tabIdValue = Option2.getOrUndefined(tabId);
-  if ([targetUrlValue, targetIndexValue, tabIdValue].filter((value) => value !== undefined).length > 1) {
-    return yield* Effect3.fail(new Error("Use only one target selector: --target-url, --target-index, or --tab-id"));
-  }
-  const targetSelection = targetUrlValue ? { urlIncludes: targetUrlValue } : targetIndexValue !== undefined ? { index: targetIndexValue } : undefined;
-  const result = yield* relay.sessionAdopt({
-    ...explicitSessionId ? { sessionId: explicitSessionId } : {},
-    createIfMissing: true,
-    ...targetSelection ? { targetSelection } : {},
-    ...tabIdValue === undefined ? {} : { tabId: tabIdValue }
-  });
-  yield* Console.log(`${result.session.created ? "Created and adopted" : "Adopted"} session '${result.session.id}' default page: ${result.adoptedUrl}`);
-  if (result.session.created) {
-    yield* Console.error(formatSessionContinuation(result.session.id));
-  }
-})).pipe(Command.withDescription("Make an attached tab the session's default page"));
-function describeStop(stopped) {
-  return [
-    stopped.execute ? "a running execute" : undefined,
-    stopped.handoff ? "a pending handoff" : undefined
-  ].filter(Boolean).join(" and ") + (stopped.forced ? " (the script did not stop in time and was abandoned with its state)" : "");
-}
-var sessionDelete = Command.make("delete", {
-  id: Argument.String("id").pipe(Argument.optional),
-  session: sessionFlag("Delete this Browse session id")
-}, Effect3.fn("Cli.sessionDelete")(function* ({ id, session }) {
-  const relay = yield* Service;
-  const store = yield* Service2;
-  const sessionId = yield* resolvePositionalOrFlagSessionId(id, session);
-  yield* ensureCliRelay();
-  const deleted = yield* relay.sessionDelete(sessionId);
-  if (deleted.stopped)
-    yield* Console.error(`Stopped first: ${describeStop(deleted.stopped)}`);
-  const current = yield* store.read;
-  if (current === sessionId) {
-    yield* store.clear;
-  }
-  yield* Console.log(sessionId);
-})).pipe(Command.withDescription("Delete a Browse session"));
-var sessionAllow = Command.make("allow", {
-  session: sessionFlag(),
-  origins: Argument.String("origins").pipe(Argument.variadic({ min: 0 }), Argument.withDescription("Hosts or origins the session's tabs may load: example.com, *.example.com, https://app.example.com, http://localhost:3000")),
-  clear: Flag.Boolean("clear").pipe(Flag.withDefault(false), Flag.withDescription("Remove the allowlist: the session may load any site again")),
-  json: jsonFlag
-}, Effect3.fn("Cli.sessionAllow")(function* ({ session, origins, clear, json }) {
-  const relay = yield* Service;
-  yield* ensureCliRelay();
-  if (!clear && origins.length === 0) {
-    return yield* Effect3.fail(new Error("session allow needs origins, or --clear to remove the allowlist"));
-  }
-  const id = yield* resolvePositionalOrFlagSessionId(Option2.none(), session);
-  const result = yield* relay.sessionAllowlist(id, clear ? [] : origins);
-  if (json) {
-    yield* emitJson(result);
-    return;
-  }
-  yield* Console.log(result.allowedOrigins ? `${result.id} may load: ${result.allowedOrigins.join(", ")}` : `${result.id} may load any site`);
-})).pipe(Command.withDescription("Set the domain allowlist of a session (the current one by default)"));
-var session = Command.make("session").pipe(Command.withDescription("Manage Browse sessions"), Command.withSubcommands([sessionNew, sessionList, sessionCurrent, sessionUse, sessionReset, sessionAdopt, sessionDelete, sessionAllow]));
-var status = Command.make("status", {
-  json: jsonFlag
-}, Effect3.fn("Cli.status")(function* ({ json }) {
-  const relay = yield* Service;
-  const store = yield* Service2;
-  const [relayResult, update] = yield* Effect3.all([Effect3.result(relay.version), Effect3.promise(() => updateNotice2())], { concurrency: 2 });
-  const updateLine = update ? formatUpdateNotice2(update) : undefined;
-  if (Result.isFailure(relayResult)) {
-    if (!(relayResult.failure instanceof RelayUnreachable)) {
-      if (json) {
-        yield* emitJson({
-          endpoint: relay.endpoint,
-          relay: { running: false, error: relayResult.failure.message },
-          extension: null,
-          sessions: [],
-          targets: [],
-          update: updateJson2(update)
-        });
-      }
-      yield* stderrLine(`Relay status failed: ${relayResult.failure.message}`);
-      yield* exitWith(ExitCode.host);
-      return;
-    }
-    const stopped = stoppedRelayStatus(relay.endpoint);
-    if (json) {
-      yield* emitJson({ ...stopped, update: updateJson2(update), autoUpdate: autoUpdateStatus() });
-      yield* stderrLine(`relay is not running at ${relay.endpoint}`);
-    } else {
-      yield* Console.log(`Relay: stopped (${relay.endpoint})`);
-      yield* Console.log(`Run \`${cliCommand("execute")}\` (or any relay-backed command) to start it automatically.`);
-      if (updateLine)
-        yield* Console.log(updateLine);
-    }
-    yield* exitWith(ExitCode.host);
-    return;
-  }
-  const version = relayResult.success;
-  const buildProblem = relayBuildProblem(version);
-  const [extensionStatus, current] = yield* Effect3.all([relay.extensionStatus, store.read]);
-  const collections = statusCollections(extensionStatus);
-  const [sessions, targets] = collections ? [collections.sessions, collections.targets] : yield* Effect3.all([relay.sessions, relay.targets]);
-  if (json) {
-    yield* emitJson({
-      endpoint: relay.endpoint,
-      relay: { running: true, version: version.version, buildId: version.buildId ?? null, stale: buildProblem !== undefined },
-      extension: extensionStatus,
-      currentSession: current ?? null,
-      sessions,
-      targets,
-      update: updateJson2(update),
-      autoUpdate: autoUpdateStatus()
-    });
-    if (buildProblem) {
-      yield* stderrLine(buildProblem);
-      yield* failExit;
-    }
-    return;
-  }
-  if (updateLine)
-    yield* Console.log(updateLine);
-  yield* Console.log(`Relay: ${relay.endpoint} (${version.version})`);
-  if (buildProblem) {
-    yield* Console.log(`Warning: ${buildProblem}`);
-  }
-  yield* Console.log(`Extension: ${extensionStatus.connected ? "connected" : "disconnected"}${extensionStatus.version ? ` (${extensionStatus.version})` : ""}`);
-  if ((extensionStatus.rejectedConnections ?? 0) > 0) {
-    yield* Console.log(`Warning: ${extensionStatus.rejectedConnections} competing browser/profile connection attempt(s) rejected; the active connection was preserved. Use Browse in one browser/profile at a time.`);
-  }
-  if (extensionStatus.nextStep)
-    yield* Console.log(extensionStatus.nextStep);
-  else if ((extensionStatus.pairingFailures ?? 0) > 0 && !extensionStatus.connected) {
-    yield* Console.log(`Warning: ${extensionStatus.pairingFailures} extension connection(s) failed pairing. Update the extension, or run \`${cliCommand("pair")}\` and enter the code on its status page.`);
-  }
-  if ((extensionStatus.processFaults?.suppressed ?? 0) > 0) {
-    const faults = extensionStatus.processFaults;
-    yield* Console.log(`Warning: the relay survived ${faults.suppressed} Playwright fault(s)${faults.lastAt ? `, last at ${faults.lastAt}` : ""}${faults.lastMessage ? `: ${faults.lastMessage}` : ""}. See the relay log.`);
-  }
-  if (extensionStatus.protocolVersion !== undefined && extensionStatus.protocolVersion !== null) {
-    const compatibility = extensionStatus.protocolCompatible === false ? "incompatible" : "compatible";
-    const legacy = extensionStatus.protocolLegacy === true ? ", inferred from legacy hello" : "";
-    yield* Console.log(`Extension protocol: ${extensionStatus.protocolVersion} (${compatibility}${legacy})`);
-    if (extensionStatus.protocolCompatible === false && !extensionStatus.nextStep)
-      yield* Console.log(extensionProtocolAdvice(extensionStatus.protocolVersion, { install: installCommand() }));
-  }
-  yield* Console.log(`Active targets: ${extensionStatus.activeTargets}`);
-  if (extensionStatus.childTargets !== undefined) {
-    yield* Console.log(`Child targets: ${extensionStatus.childTargets}`);
-  }
-  if (extensionStatus.cdpClients !== undefined) {
-    yield* Console.log(`CDP clients: ${extensionStatus.cdpClients}`);
-  }
-  yield* Console.log(`Current session: ${current ?? "none"}`);
-  if (sessions.length === 0) {
-    yield* Console.log("Sessions: none");
-  } else {
-    yield* Console.log("Sessions:");
-    const activeSessions = sessions.filter((item) => item.id === current || item.connected || item.pageUrl !== null || item.stateKeys.length > 0 || item.readOnly);
-    const idleSessions = sessions.filter((item) => !activeSessions.includes(item));
-    const shownSessions = activeSessions.length > 0 ? activeSessions : idleSessions.slice(0, 5);
-    const omittedIdleCount = activeSessions.length > 0 ? idleSessions.length : Math.max(0, idleSessions.length - shownSessions.length);
-    yield* Effect3.forEach(shownSessions, (item) => {
-      const marker = item.id === current ? "*" : " ";
-      return Console.log(`${marker} ${item.id} ${item.pageUrl ?? "no page yet"}`);
-    });
-    if (omittedIdleCount > 0) {
-      yield* Console.log(`  (${omittedIdleCount} idle session(s) with no page omitted; run ${cliCommand("session list")} to view all)`);
-    }
-  }
-  if (targets.length === 0) {
-    yield* Console.log("Targets: none");
-  } else {
-    yield* Console.log("Targets:");
-    yield* Effect3.forEach(targets, (target, index) => {
-      return Console.log(`- [${index}] ${formatTargetSummary(target, { includeSession: true })}`);
-    });
-  }
-  if (buildProblem) {
-    yield* failExit;
-  }
-})).pipe(Command.withDescription("Show relay, extension, and target status"));
-var recordingStart = Command.make("start", {
-  outputPath: Argument.String("output-path").pipe(Argument.withDescription("Path to write the recording artifact; tabCapture requires .webm, CDP accepts .webm or .mp4")),
+  const result = yield* relay.networkCancel({ sessionId });
+  yield* Console4.log(result.cancelled ? "Network capture cancelled" : "Network capture was not active");
+})).pipe(Command3.withDescription("Cancel capture without writing an artifact"));
+var network = Command3.make("network").pipe(Command3.withDescription("Capture authenticated network exchanges for direct client derivation"), Command3.withSubcommands([networkStart, networkStatus, networkStop, networkCancel]));
+registerCliCommand(600, () => network);
+
+// src/cli/recording.ts
+import { Console as Console5, Effect as Effect7, Option as Option6 } from "effect";
+import { Argument as Argument3, Command as Command4, Flag as Flag5 } from "effect/cli";
+import path4 from "node:path";
+var recordingStart = Command4.make("start", {
+  outputPath: Argument3.String("output-path").pipe(Argument3.withDescription("Path to write the recording artifact; tabCapture requires .webm, CDP accepts .webm or .mp4")),
   session: sessionFlag("Record the page for this Browse or CDP session id"),
   tabId: tabIdFlag("Record this attached Chrome tab id"),
-  mode: Flag.String("mode").pipe(Flag.optional, Flag.withDescription("Recording mode: auto, tab-capture, or cdp. auto uses CDP for relay-owned tabs and tabCapture for user-owned tabs")),
-  audio: Flag.Boolean("audio").pipe(Flag.withDefault(false), Flag.withDescription("Include tab audio")),
-  frameRate: Flag.Int("frame-rate").pipe(Flag.optional, Flag.withDescription("Output frame rate, integer 1..60; defaults to 30 for tab-capture and 60 for CDP")),
-  maxDurationMs: Flag.Int("max-duration-ms").pipe(Flag.optional, Flag.withDescription("Auto-stop guard in milliseconds, defaults to 900000")),
-  cursor: Flag.Boolean("cursor").pipe(Flag.withDefault(false), Flag.withDescription("Draw the ghost cursor in the recording (off by default: only the page is recorded)")),
+  mode: Flag5.String("mode").pipe(Flag5.optional, Flag5.withDescription("Recording mode: auto, tab-capture, or cdp. auto uses CDP for relay-owned tabs and tabCapture for user-owned tabs")),
+  audio: Flag5.Boolean("audio").pipe(Flag5.withDefault(false), Flag5.withDescription("Include tab audio")),
+  frameRate: Flag5.Int("frame-rate").pipe(Flag5.optional, Flag5.withDescription("Output frame rate, integer 1..60; defaults to 30 for tab-capture and 60 for CDP")),
+  maxDurationMs: Flag5.Int("max-duration-ms").pipe(Flag5.optional, Flag5.withDescription("Auto-stop guard in milliseconds, defaults to 900000")),
+  cursor: Flag5.Boolean("cursor").pipe(Flag5.withDefault(false), Flag5.withDescription("Draw the ghost cursor in the recording (off by default: only the page is recorded)")),
   json: jsonFlag
-}, Effect3.fn("Cli.recordingStart")(function* ({ outputPath, session, tabId, mode, audio, frameRate, maxDurationMs, cursor, json }) {
-  if (Option2.isSome(frameRate) && (frameRate.value < 1 || frameRate.value > 60)) {
-    return yield* Effect3.fail(new Error("Recording frameRate must be an integer from 1 to 60"));
+}, Effect7.fn("Cli.recordingStart")(function* ({
+  outputPath,
+  session,
+  tabId,
+  mode,
+  audio,
+  frameRate,
+  maxDurationMs,
+  cursor,
+  json
+}) {
+  if (Option6.isSome(frameRate) && (frameRate.value < 1 || frameRate.value > 60)) {
+    return yield* Effect7.fail(new Error("Recording frameRate must be an integer from 1 to 60"));
   }
   const relay = yield* Service;
   yield* ensureCliRelayAndExtension();
   const target = yield* recordingTarget({ session, tabId });
-  const modeValue = yield* parseRecordingModeOption(Option2.getOrUndefined(mode));
-  const resolvedOutputPath = path.resolve(outputPath);
+  const modeValue = yield* parseRecordingModeOption(Option6.getOrUndefined(mode));
+  const resolvedOutputPath = path4.resolve(outputPath);
   const result = yield* relay.recordingStart({
     ...target,
     outputPath: resolvedOutputPath,
     ...modeValue === undefined ? {} : { mode: modeValue },
     audio,
-    ...Option2.isSome(frameRate) ? { frameRate: frameRate.value } : {},
-    ...Option2.isSome(maxDurationMs) ? { maxDurationMs: maxDurationMs.value } : {},
+    ...Option6.isSome(frameRate) ? { frameRate: frameRate.value } : {},
+    ...Option6.isSome(maxDurationMs) ? { maxDurationMs: maxDurationMs.value } : {},
     ...cursor ? { cursor } : {}
   });
   if (!result.success) {
-    return yield* Effect3.fail(new Error(result.error ?? "Failed to start recording"));
+    return yield* Effect7.fail(new Error(result.error ?? "Failed to start recording"));
   }
   yield* printOr(json, result, `Recording started: ${result.path ?? resolvedOutputPath} tab=${result.tabId ?? "unknown"} mode=${result.mode ?? "tab-capture"} artifact=${result.artifactType ?? "webm"} mime=${result.mimeType ?? "video/webm"} fps=${result.frameRate ?? "unknown"}`);
-})).pipe(Command.withDescription("Start recording an attached tab"));
-var recordingStop = Command.make("stop", {
+})).pipe(Command4.withDescription("Start recording an attached tab"));
+var recordingStop = Command4.make("stop", {
   session: sessionFlag("Stop recording for this CDP session id"),
   tabId: tabIdFlag("Stop recording for this Chrome tab id"),
   json: jsonFlag
-}, Effect3.fn("Cli.recordingStop")(function* ({ session, tabId, json }) {
+}, Effect7.fn("Cli.recordingStop")(function* ({ session, tabId, json }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const target = yield* recordingTarget({ session, tabId });
   const result = yield* relay.recordingStop(target);
   if (!result.success) {
-    return yield* Effect3.fail(new Error(result.error ?? "Failed to stop recording"));
+    return yield* Effect7.fail(new Error(result.error ?? "Failed to stop recording"));
   }
   if (json)
     return yield* emitJson(result);
   const frames = result.frameCount === undefined ? "" : `, frames=${result.frameCount}`;
-  yield* Console.log(`Recording saved: ${result.path ?? "unknown"} (${result.size ?? 0} bytes, ${result.duration ?? 0}ms, mode=${result.mode ?? "tab-capture"}, artifact=${result.artifactType ?? "webm"}${frames})`);
-  yield* Console.log(formatRecordingQuality(result.quality));
-})).pipe(Command.withDescription("Stop recording and write the artifact"));
-var recordingStatus = Command.make("status", {
+  yield* Console5.log(`Recording saved: ${result.path ?? "unknown"} (${result.size ?? 0} bytes, ${result.duration ?? 0}ms, mode=${result.mode ?? "tab-capture"}, artifact=${result.artifactType ?? "webm"}${frames})`);
+  yield* Console5.log(formatRecordingQuality(result.quality));
+})).pipe(Command4.withDescription("Stop recording and write the artifact"));
+var recordingStatus = Command4.make("status", {
   session: sessionFlag("Check recording for this CDP session id"),
   tabId: tabIdFlag("Check recording for this Chrome tab id"),
   json: jsonFlag
-}, Effect3.fn("Cli.recordingStatus")(function* ({ session, tabId, json }) {
+}, Effect7.fn("Cli.recordingStatus")(function* ({ session, tabId, json }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const target = yield* recordingTarget({ session, tabId });
@@ -1244,175 +1313,129 @@ var recordingStatus = Command.make("status", {
     return;
   }
   if (!result.isRecording) {
-    yield* Console.log("Recording: inactive");
+    yield* Console5.log("Recording: inactive");
     return;
   }
   const frames = result.frameCount === undefined ? "" : ` frameCount=${result.frameCount}`;
-  yield* Console.log(`Recording: active tab=${result.tabId ?? "unknown"} mode=${result.mode ?? "tab-capture"} artifact=${result.artifactType ?? "webm"} path=${result.path ?? "unknown"} size=${result.size ?? 0}${frames} startedAt=${result.startedAt ?? "unknown"}`);
-  yield* Console.log(formatRecordingQuality(result.quality));
-})).pipe(Command.withDescription("Check current recording status"));
-var recordingCancel = Command.make("cancel", {
+  yield* Console5.log(`Recording: active tab=${result.tabId ?? "unknown"} mode=${result.mode ?? "tab-capture"} artifact=${result.artifactType ?? "webm"} path=${result.path ?? "unknown"} size=${result.size ?? 0}${frames} startedAt=${result.startedAt ?? "unknown"}`);
+  yield* Console5.log(formatRecordingQuality(result.quality));
+})).pipe(Command4.withDescription("Check current recording status"));
+var recordingCancel = Command4.make("cancel", {
   session: sessionFlag("Cancel recording for this CDP session id"),
   tabId: tabIdFlag("Cancel recording for this Chrome tab id")
-}, Effect3.fn("Cli.recordingCancel")(function* ({ session, tabId }) {
+}, Effect7.fn("Cli.recordingCancel")(function* ({ session, tabId }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const target = yield* recordingTarget({ session, tabId });
   const result = yield* relay.recordingCancel(target);
   if (!result.success) {
-    return yield* Effect3.fail(new Error(result.error ?? "Failed to cancel recording"));
+    return yield* Effect7.fail(new Error(result.error ?? "Failed to cancel recording"));
   }
-  yield* Console.log("Recording cancelled");
-})).pipe(Command.withDescription("Cancel recording without writing a file"));
-var recording = Command.make("recording").pipe(Command.withDescription("Record an attached tab to WebM or MP4"), Command.withSubcommands([recordingStart, recordingStop, recordingStatus, recordingCancel]));
-var flightRecorderStart = Command.make("start", {
+  yield* Console5.log("Recording cancelled");
+})).pipe(Command4.withDescription("Cancel recording without writing a file"));
+var recording = Command4.make("recording").pipe(Command4.withDescription("Record an attached tab to WebM or MP4"), Command4.withSubcommands([recordingStart, recordingStop, recordingStatus, recordingCancel]));
+var flightRecorderStart = Command4.make("start", {
   session: sessionFlag("Buffer the tab owned by this session"),
   tabId: tabIdFlag("Buffer this attached Chrome tab id"),
-  retentionMs: Flag.Int("retention-ms").pipe(Flag.optional, Flag.withDescription("Ring-buffer duration in milliseconds (1000..120000; default 60000)")),
-  frameRate: Flag.Int("frame-rate").pipe(Flag.optional, Flag.withDescription("Output frame rate from 1 to 60")),
-  cursor: Flag.Boolean("cursor").pipe(Flag.withDefault(false), Flag.withDescription("Draw the ghost cursor in the buffered video (off by default)")),
+  retentionMs: Flag5.Int("retention-ms").pipe(Flag5.optional, Flag5.withDescription("Ring-buffer duration in milliseconds (1000..120000; default 60000)")),
+  frameRate: Flag5.Int("frame-rate").pipe(Flag5.optional, Flag5.withDescription("Output frame rate from 1 to 60")),
+  cursor: Flag5.Boolean("cursor").pipe(Flag5.withDefault(false), Flag5.withDescription("Draw the ghost cursor in the buffered video (off by default)")),
   json: jsonFlag
-}, Effect3.fn("Cli.flightRecorderStart")(function* ({ session, tabId, retentionMs, frameRate, cursor, json }) {
+}, Effect7.fn("Cli.flightRecorderStart")(function* ({ session, tabId, retentionMs, frameRate, cursor, json }) {
   const relay = yield* Service;
   yield* ensureCliRelayAndExtension();
   const target = yield* recordingTarget({ session, tabId });
   const result = yield* relay.flightRecorderStart({
     ...target,
-    ...Option2.isSome(retentionMs) ? { retentionMs: retentionMs.value } : {},
-    ...Option2.isSome(frameRate) ? { frameRate: frameRate.value } : {},
+    ...Option6.isSome(retentionMs) ? { retentionMs: retentionMs.value } : {},
+    ...Option6.isSome(frameRate) ? { frameRate: frameRate.value } : {},
     ...cursor ? { cursor } : {}
   });
   yield* printOr(json, result, `Flight recorder buffering tab ${result.tabId}; retention=${result.retentionMs}ms`);
-})).pipe(Command.withDescription("Start a rolling in-memory video buffer"));
-var flightRecorderStatus = Command.make("status", {
+})).pipe(Command4.withDescription("Start a rolling in-memory video buffer"));
+var flightRecorderStatus = Command4.make("status", {
   session: sessionFlag(),
   tabId: tabIdFlag(),
   json: jsonFlag
-}, Effect3.fn("Cli.flightRecorderStatus")(function* ({ session, tabId, json }) {
+}, Effect7.fn("Cli.flightRecorderStatus")(function* ({ session, tabId, json }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const result = yield* relay.flightRecorderStatus(yield* recordingTarget({ session, tabId }));
   if (json)
     return yield* emitJson(result);
   if (!result.active)
-    return yield* Console.log("Flight recorder inactive");
-  yield* Console.log(`Flight recorder tab=${result.tabId} frames=${result.bufferedFrames} retained=${result.retainedDurationMs}ms bytes=${result.bufferedBytes}`);
-})).pipe(Command.withDescription("Show rolling flight-recorder status"));
-var flightRecorderSaveLast = Command.make("save-last", {
-  outputPath: Argument.String("output-path").pipe(Argument.withDescription("Fresh .webm or .mp4 artifact path")),
+    return yield* Console5.log("Flight recorder inactive");
+  yield* Console5.log(`Flight recorder tab=${result.tabId} frames=${result.bufferedFrames} retained=${result.retainedDurationMs}ms bytes=${result.bufferedBytes}`);
+})).pipe(Command4.withDescription("Show rolling flight-recorder status"));
+var flightRecorderSaveLast = Command4.make("save-last", {
+  outputPath: Argument3.String("output-path").pipe(Argument3.withDescription("Fresh .webm or .mp4 artifact path")),
   session: sessionFlag(),
   tabId: tabIdFlag(),
-  durationMs: Flag.Int("duration-ms").pipe(Flag.optional, Flag.withDescription("How much recent history to save; defaults to 30 seconds")),
+  durationMs: Flag5.Int("duration-ms").pipe(Flag5.optional, Flag5.withDescription("How much recent history to save; defaults to 30 seconds")),
   json: jsonFlag
-}, Effect3.fn("Cli.flightRecorderSaveLast")(function* ({ outputPath, session, tabId, durationMs, json }) {
+}, Effect7.fn("Cli.flightRecorderSaveLast")(function* ({ outputPath, session, tabId, durationMs, json }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const result = yield* relay.flightRecorderSaveLast({
     ...yield* recordingTarget({ session, tabId }),
-    outputPath: path.resolve(outputPath),
-    ...Option2.isSome(durationMs) ? { durationMs: durationMs.value } : {}
+    outputPath: path4.resolve(outputPath),
+    ...Option6.isSome(durationMs) ? { durationMs: durationMs.value } : {}
   });
   yield* printOr(json, result, `Saved ${result.durationMs}ms flight recorder clip (${result.frameCount} frames) to ${result.path}`);
-})).pipe(Command.withDescription("Save the most recent buffered video without stopping the recorder"));
-var flightRecorderCancel = Command.make("cancel", {
+})).pipe(Command4.withDescription("Save the most recent buffered video without stopping the recorder"));
+var flightRecorderCancel = Command4.make("cancel", {
   session: sessionFlag(),
   tabId: tabIdFlag()
-}, Effect3.fn("Cli.flightRecorderCancel")(function* ({ session, tabId }) {
+}, Effect7.fn("Cli.flightRecorderCancel")(function* ({ session, tabId }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const result = yield* relay.flightRecorderCancel(yield* recordingTarget({ session, tabId }));
-  yield* Console.log(result.cancelled ? "Flight recorder stopped" : "No active flight recorder");
-})).pipe(Command.withDescription("Stop and discard the rolling video buffer"));
-var flightRecorder = Command.make("flight-recorder").pipe(Command.withDescription("Keep and save a rolling buffer of recent browser video"), Command.withSubcommands([flightRecorderStart, flightRecorderStatus, flightRecorderSaveLast, flightRecorderCancel]));
-var networkSession = Effect3.fnUntraced(function* (session) {
-  return yield* resolveSelectedSessionId(Option2.getOrUndefined(session) ?? Option2.getOrUndefined(yield* sessionIdConfig));
-});
-var parseNetworkContent = Effect3.fnUntraced(function* (content) {
-  const value = Option2.getOrUndefined(content);
-  if (value === undefined || value === "embed" || value === "omit")
-    return value;
-  return yield* Effect3.fail(new Error("Network content must be embed or omit"));
-});
-function formatNetworkStatus(status) {
-  if (!status.active)
-    return status.ended ? `Network capture: inactive (the last one ended because ${status.ended})` : "Network capture: inactive";
-  return `Network capture: active entries=${status.entryCount} responses=${status.responseCount} failures=${status.failureCount} bodyBytes=${status.capturedBodyBytes} truncated=${status.truncatedBodyCount} dropped=${status.droppedEntryCount} startedAt=${status.startedAt ?? "unknown"}${status.endsAt ? ` endsAt=${status.endsAt}` : ""}`;
-}
-function formatNetworkResult(result) {
-  const output = result.outputPath ? ` output=${result.outputPath}` : "";
-  const profile = result.authProfile ? ` secrets=${result.authProfile.name}(${result.authProfile.slotCount})` : "";
-  return `Network capture stopped: entries=${result.entryCount} responses=${result.responseCount} failures=${result.failureCount} bodyBytes=${result.capturedBodyBytes} truncated=${result.truncatedBodyCount} dropped=${result.droppedEntryCount}${output}${profile}`;
-}
-var networkStart = Command.make("start", {
-  session: sessionFlag("Capture the default page for this Browse session"),
-  urlFilter: Flag.String("url").pipe(Flag.optional, Flag.withDescription("Capture only requests whose URL contains this text")),
-  resourceTypes: Flag.String("resource-type").pipe(Flag.atMost(50), Flag.withDescription("Capture this Playwright resource type; repeat for multiple types")),
-  content: Flag.String("content").pipe(Flag.optional, Flag.withDescription("Response and request body mode: embed (default) or omit")),
-  maxBodyBytes: Flag.Int("max-body-bytes").pipe(Flag.optional, Flag.withDescription("Maximum captured bytes per body, defaults to 1000000")),
-  maxTotalBodyBytes: Flag.Int("max-total-body-bytes").pipe(Flag.optional, Flag.withDescription("Maximum captured body bytes for the whole capture, defaults to 25000000")),
-  maxEntries: Flag.Int("max-entries").pipe(Flag.optional, Flag.withDescription("Maximum request entries, defaults to 1000")),
-  maxDuration: Flag.Int("max-duration-ms").pipe(Flag.optional, Flag.withDescription("End the capture by itself (discarding it) after this long, defaults to 1800000 (30 minutes)")),
-  json: jsonFlag
-}, Effect3.fn("Cli.networkStart")(function* ({ session, urlFilter, resourceTypes, content, maxBodyBytes, maxTotalBodyBytes, maxEntries, maxDuration, json }) {
-  const relay = yield* Service;
-  yield* ensureCliRelayAndExtension();
-  const sessionId = yield* networkSession(session);
-  const contentValue = yield* parseNetworkContent(content);
-  const result = yield* relay.networkStart({
-    sessionId,
-    ...Option2.isSome(urlFilter) ? { urlFilter: urlFilter.value } : {},
-    ...resourceTypes.length === 0 ? {} : { resourceTypes },
-    ...contentValue === undefined ? {} : { content: contentValue },
-    ...Option2.isSome(maxBodyBytes) ? { maxBodyBytes: maxBodyBytes.value } : {},
-    ...Option2.isSome(maxTotalBodyBytes) ? { maxTotalBodyBytes: maxTotalBodyBytes.value } : {},
-    ...Option2.isSome(maxEntries) ? { maxEntries: maxEntries.value } : {},
-    ...Option2.isSome(maxDuration) ? { maxDurationMs: maxDuration.value } : {}
-  });
-  yield* printOr(json, result, formatNetworkStatus(result));
-})).pipe(Command.withDescription("Start session-scoped network capture"));
-var networkStatus = Command.make("status", {
-  session: sessionFlag(),
-  json: jsonFlag
-}, Effect3.fn("Cli.networkStatus")(function* ({ session, json }) {
-  const relay = yield* Service;
-  const sessionId = yield* networkSession(session);
-  yield* ensureCliRelay();
-  const result = yield* relay.networkStatus({ sessionId });
-  yield* printOr(json, result, formatNetworkStatus(result));
-})).pipe(Command.withDescription("Show session-scoped network capture status"));
-var networkStop = Command.make("stop", {
-  session: sessionFlag(),
-  output: Flag.String("output").pipe(Flag.optional, Flag.withAlias("o"), Flag.withDescription("Write a credential-redacted HAR artifact to this path")),
-  secrets: Flag.String("secrets").pipe(Flag.optional, Flag.withDescription("Store captured credentials under this reusable profile name")),
-  json: jsonFlag
-}, Effect3.fn("Cli.networkStop")(function* ({ session, output, secrets, json }) {
-  const relay = yield* Service;
-  const outputValue = Option2.getOrUndefined(output);
-  const secretsValue = Option2.getOrUndefined(secrets);
-  if (!outputValue && !secretsValue) {
-    return yield* Effect3.fail(new Error("network stop requires --output, --secrets, or both"));
-  }
-  const sessionId = yield* networkSession(session);
-  yield* ensureCliRelay();
-  const result = yield* relay.networkStop({
-    sessionId,
-    ...outputValue ? { outputPath: path.resolve(outputValue) } : {},
-    ...secretsValue ? { secrets: secretsValue } : {}
-  });
-  yield* printOr(json, result, formatNetworkResult(result));
-})).pipe(Command.withDescription("Stop capture and write a redacted artifact or reusable secret profile"));
-var networkCancel = Command.make("cancel", { session: sessionFlag() }, Effect3.fn("Cli.networkCancel")(function* ({ session }) {
+  yield* Console5.log(result.cancelled ? "Flight recorder stopped" : "No active flight recorder");
+})).pipe(Command4.withDescription("Stop and discard the rolling video buffer"));
+var flightRecorder = Command4.make("flight-recorder").pipe(Command4.withDescription("Keep and save a rolling buffer of recent browser video"), Command4.withSubcommands([
+  flightRecorderStart,
+  flightRecorderStatus,
+  flightRecorderSaveLast,
+  flightRecorderCancel
+]));
+registerCliCommand(700, () => recording);
+registerCliCommand(710, () => flightRecorder);
+
+// src/cli/relay.ts
+import { Console as Console6, Effect as Effect8 } from "effect";
+import { Command as Command5, Flag as Flag6 } from "effect/cli";
+var serve = Command5.make("serve", {}, Effect8.fn("Cli.serve")(function* () {
+  const [{ startRelay }, { parseAdditionalExtensionOrigins }] = yield* Effect8.promise(() => Promise.all([import("./relay-tfvn856e.mjs"), import("./helpers-rta4d2as.mjs")]));
+  const port = yield* portConfig;
+  const additionalExtensionOrigins = parseAdditionalExtensionOrigins(yield* extensionOriginsConfig);
+  yield* Effect8.scoped(Effect8.gen(function* () {
+    const relay = yield* startRelay({ port, additionalExtensionOrigins });
+    yield* Console6.log(`Browse relay listening at ${relay.url}`);
+    yield* Console6.log(`Browse connects automatically while the browser runs. Run \`${cliCommand("status")}\` to check.`);
+    yield* Effect8.never;
+  }));
+})).pipe(Command5.withDescription("Start the local Browse relay"));
+var relayRestart = Command5.make("restart", {
+  force: Flag6.Boolean("force").pipe(Flag6.withDefault(false), Flag6.withDescription("End network captures and recordings (discarding them) and disconnect raw CDP clients instead of refusing to restart"))
+}, Effect8.fn("Cli.relayRestart")(function* ({ force }) {
   const relay = yield* Service;
-  const sessionId = yield* networkSession(session);
-  yield* ensureCliRelay();
-  const result = yield* relay.networkCancel({ sessionId });
-  yield* Console.log(result.cancelled ? "Network capture cancelled" : "Network capture was not active");
-})).pipe(Command.withDescription("Cancel capture without writing an artifact"));
-var network = Command.make("network").pipe(Command.withDescription("Capture authenticated network exchanges for direct client derivation"), Command.withSubcommands([networkStart, networkStatus, networkStop, networkCancel]));
-var secretsStatus = Command.make("status", {
-  name: Argument.String("name"),
+  yield* Console6.error("Restarting the relay leaves browser tabs open but resets in-memory JavaScript state.");
+  const readiness = yield* restartRelay({ relay, clientKind: "cli", force });
+  yield* Console6.log(`${readiness.started ? "Started" : "Reused concurrent replacement"} Browse relay at ${relay.endpoint} (${readiness.version.buildId})`);
+})).pipe(Command5.withDescription("Explicitly drain and restart the managed relay using this installation"));
+var relay = Command5.make("relay").pipe(Command5.withDescription("Manage the local relay lifecycle"), Command5.withSubcommands([relayRestart]));
+registerCliCommand(100, () => serve);
+registerCliCommand(110, () => relay);
+
+// src/cli/secrets.ts
+import { Console as Console7, Effect as Effect9, Option as Option7 } from "effect";
+import { Argument as Argument4, Command as Command6, Flag as Flag7 } from "effect/cli";
+import path5 from "node:path";
+import process2 from "node:process";
+var secretsStatus = Command6.make("status", {
+  name: Argument4.String("name"),
   json: jsonFlag
-}, Effect3.fn("Cli.secretsStatus")(function* ({ name, json }) {
+}, Effect9.fn("Cli.secretsStatus")(function* ({ name, json }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const result = yield* relay.authStatus({ name });
@@ -1420,60 +1443,60 @@ var secretsStatus = Command.make("status", {
     yield* emitJson(result);
     return;
   }
-  yield* Console.log(`Secrets profile ${result.name}: slots=${result.slotCount} updatedAt=${result.updatedAt}`);
-  yield* Effect3.forEach(result.slots, (slot) => Console.log(`- ${slot.ref} sources=${slot.sources.join(",")} expired=${slot.expired}${slot.expiresAt ? ` expiresAt=${slot.expiresAt}` : ""}`));
-})).pipe(Command.withDescription("Show secret profile metadata without revealing values"));
-var secretsRefresh = Command.make("refresh", {
-  name: Argument.String("name"),
+  yield* Console7.log(`Secrets profile ${result.name}: slots=${result.slotCount} updatedAt=${result.updatedAt}`);
+  yield* Effect9.forEach(result.slots, (slot) => Console7.log(`- ${slot.ref} sources=${slot.sources.join(",")} expired=${slot.expired}${slot.expiresAt ? ` expiresAt=${slot.expiresAt}` : ""}`));
+})).pipe(Command6.withDescription("Show secret profile metadata without revealing values"));
+var secretsRefresh = Command6.make("refresh", {
+  name: Argument4.String("name"),
   session: sessionFlag(),
-  urlFilter: Flag.String("url").pipe(Flag.optional, Flag.withDescription("Observe credentials only on matching request URLs")),
-  timeoutMs: Flag.Int("timeout-ms").pipe(Flag.optional, Flag.withDescription("Page reload timeout, defaults to 30000")),
+  urlFilter: Flag7.String("url").pipe(Flag7.optional, Flag7.withDescription("Observe credentials only on matching request URLs")),
+  timeoutMs: Flag7.Int("timeout-ms").pipe(Flag7.optional, Flag7.withDescription("Page reload timeout, defaults to 30000")),
   json: jsonFlag
-}, Effect3.fn("Cli.secretsRefresh")(function* ({ name, session, urlFilter, timeoutMs, json }) {
+}, Effect9.fn("Cli.secretsRefresh")(function* ({ name, session, urlFilter, timeoutMs, json }) {
   const relay = yield* Service;
   yield* ensureCliRelayAndExtension();
   const sessionId = yield* networkSession(session);
   const result = yield* relay.authRefresh({
     sessionId,
     name,
-    ...Option2.isSome(urlFilter) ? { urlFilter: urlFilter.value } : {},
-    ...Option2.isSome(timeoutMs) ? { timeoutMs: timeoutMs.value } : {}
+    ...Option7.isSome(urlFilter) ? { urlFilter: urlFilter.value } : {},
+    ...Option7.isSome(timeoutMs) ? { timeoutMs: timeoutMs.value } : {}
   });
   yield* printOr(json, result, `Secrets profile ${name} refreshed: observed=${result.observedSecretRefs.length} changed=${result.updatedSecretRefs.length}`);
-})).pipe(Command.withDescription("Reload a session page and refresh a profile while preserving stable references"));
-var secretsRun = Command.make("run", {
-  name: Argument.String("name"),
-  command: Argument.String("command").pipe(Argument.variadic({ min: 1 })),
-  cwd: Flag.String("cwd").pipe(Flag.optional, Flag.withDescription("Child process working directory")),
-  timeoutMs: Flag.Int("timeout-ms").pipe(Flag.optional, Flag.withDescription("Child timeout in milliseconds, defaults to 120000"))
-}, Effect3.fn("Cli.secretsRun")(function* ({ name, command, cwd, timeoutMs }) {
+})).pipe(Command6.withDescription("Reload a session page and refresh a profile while preserving stable references"));
+var secretsRun = Command6.make("run", {
+  name: Argument4.String("name"),
+  command: Argument4.String("command").pipe(Argument4.variadic({ min: 1 })),
+  cwd: Flag7.String("cwd").pipe(Flag7.optional, Flag7.withDescription("Child process working directory")),
+  timeoutMs: Flag7.Int("timeout-ms").pipe(Flag7.optional, Flag7.withDescription("Child timeout in milliseconds, defaults to 120000"))
+}, Effect9.fn("Cli.secretsRun")(function* ({ name, command, cwd, timeoutMs }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
   const [executable, ...args] = decodeCliOperands(command);
   if (!executable)
-    return yield* Effect3.fail(new Error("secrets run requires a command after --"));
+    return yield* Effect9.fail(new Error("secrets run requires a command after --"));
   const result = yield* relay.authRun({
     name,
     command: executable,
     args,
-    cwd: path.resolve(Option2.getOrElse(cwd, () => process.cwd())),
-    ...Option2.isSome(timeoutMs) ? { timeoutMs: timeoutMs.value } : {}
+    cwd: path5.resolve(Option7.getOrElse(cwd, () => process2.cwd())),
+    ...Option7.isSome(timeoutMs) ? { timeoutMs: timeoutMs.value } : {}
   });
-  yield* Effect3.sync(() => {
+  yield* Effect9.sync(() => {
     if (result.stdout)
-      process.stdout.write(result.stdout);
+      process2.stdout.write(result.stdout);
     if (result.stderr)
-      process.stderr.write(result.stderr);
+      process2.stderr.write(result.stderr);
     if (result.stdoutTruncated || result.stderrTruncated)
-      process.stderr.write(`
+      process2.stderr.write(`
 Browse truncated child output.
 `);
     if (result.exitCode !== 0)
-      process.exitCode = result.exitCode;
+      process2.exitCode = result.exitCode;
   });
-})).pipe(Command.withDescription("Run a command with profile values injected as BC_SECRET_* environment variables"));
+})).pipe(Command6.withDescription("Run a command with profile values injected as BC_SECRET_* environment variables"));
 function readSecretValue(prompt) {
-  const input = process.stdin;
+  const input = process2.stdin;
   if (!input.isTTY) {
     return new Promise((resolve, reject) => {
       const chunks = [];
@@ -1483,13 +1506,13 @@ function readSecretValue(prompt) {
     });
   }
   return new Promise((resolve, reject) => {
-    process.stderr.write(prompt);
+    process2.stderr.write(prompt);
     let value = "";
     const finish = (result) => {
       input.setRawMode(false);
       input.pause();
       input.off("data", onData);
-      process.stderr.write(`
+      process2.stderr.write(`
 `);
       if (result instanceof Error)
         reject(result);
@@ -1514,44 +1537,49 @@ function readSecretValue(prompt) {
     input.on("data", onData);
   });
 }
-var secretsAdd = Command.make("add", {
-  name: Argument.String("name").pipe(Argument.withDescription('Secret name agents use: secrets.type(locator, "name")')),
-  origin: Flag.String("origin").pipe(Flag.atLeast(1), Flag.withDescription("Origin the secret may be typed on (repeatable): https://example.com, *.example.com (https), http://localhost:3000")),
-  totp: Flag.Boolean("totp").pipe(Flag.withDefault(false), Flag.withDescription("The value is a TOTP seed (base32 or otpauth:// URI); typing it types the current code. Storing the seed beside the password makes 2FA one factor")),
+var secretsAdd = Command6.make("add", {
+  name: Argument4.String("name").pipe(Argument4.withDescription('Secret name agents use: secrets.type(locator, "name")')),
+  origin: Flag7.String("origin").pipe(Flag7.atLeast(1), Flag7.withDescription("Origin the secret may be typed on (repeatable): https://example.com, *.example.com (https), http://localhost:3000")),
+  totp: Flag7.Boolean("totp").pipe(Flag7.withDefault(false), Flag7.withDescription("The value is a TOTP seed (base32 or otpauth:// URI); typing it types the current code. Storing the seed beside the password makes 2FA one factor")),
   json: jsonFlag
-}, Effect3.fn("Cli.secretsAdd")(function* ({ name, origin, totp, json }) {
-  const value = yield* Effect3.tryPromise({
+}, Effect9.fn("Cli.secretsAdd")(function* ({ name, origin, totp, json }) {
+  const value = yield* Effect9.tryPromise({
     try: () => readSecretValue(totp ? `TOTP seed for ${name} (hidden): ` : `Value for ${name} (hidden): `),
     catch: (cause) => cause instanceof Error ? cause : new Error("Could not read the secret value")
   });
-  const result = yield* addSecret({ name, value, allowedOrigins: origin, kind: totp ? "totp" : "password" });
+  const result = yield* addSecret({
+    name,
+    value,
+    allowedOrigins: origin,
+    kind: totp ? "totp" : "password"
+  });
   if (json) {
     yield* emitJson(result);
     return;
   }
-  yield* Console.log(`Saved ${result.kind} secret ${result.name}; it can be typed on ${result.allowedOrigins.join(", ")}`);
+  yield* Console7.log(`Saved ${result.kind} secret ${result.name}; it can be typed on ${result.allowedOrigins.join(", ")}`);
   if (totp)
-    yield* Console.error("Note: with the TOTP seed stored here, anyone who can use these secrets has both factors. Prefer handing 2FA to a person when you can.");
-})).pipe(Command.withDescription("Store a secret agents can type only on its origins (value from stdin or a hidden prompt)"));
-var secretsList = Command.make("list", { json: jsonFlag }, Effect3.fn("Cli.secretsList")(function* ({ json }) {
+    yield* Console7.error("Note: with the TOTP seed stored here, anyone who can use these secrets has both factors. Prefer handing 2FA to a person when you can.");
+})).pipe(Command6.withDescription("Store a secret agents can type only on its origins (value from stdin or a hidden prompt)"));
+var secretsList = Command6.make("list", { json: jsonFlag }, Effect9.fn("Cli.secretsList")(function* ({ json }) {
   const secrets = yield* listSecrets();
   if (json) {
     yield* emitJson({ secrets });
     return;
   }
   if (secrets.length === 0) {
-    yield* Console.log("No site secrets");
+    yield* Console7.log("No site secrets");
     return;
   }
-  yield* Effect3.forEach(secrets, (secret) => Console.log(`${secret.name} ${secret.kind} ${secret.allowedOrigins.join(",")}`));
-})).pipe(Command.withDescription("List site secrets (names, kinds and origins, never values)"));
-var secretsRemove = Command.make("remove", { name: Argument.String("name") }, Effect3.fn("Cli.secretsRemove")(function* ({ name }) {
+  yield* Effect9.forEach(secrets, (secret) => Console7.log(`${secret.name} ${secret.kind} ${secret.allowedOrigins.join(",")}`));
+})).pipe(Command6.withDescription("List site secrets (names, kinds and origins, never values)"));
+var secretsRemove = Command6.make("remove", { name: Argument4.String("name") }, Effect9.fn("Cli.secretsRemove")(function* ({ name }) {
   const removed = yield* removeSecret(name);
-  yield* Console.log(removed ? `Removed ${name}` : `No secret named ${name}`);
-})).pipe(Command.withDescription("Delete a site secret"));
-var secrets = Command.make("secrets").pipe(Command.withDescription("Site secrets agents can type without seeing them, and captured credential profiles"), Command.withSubcommands([secretsAdd, secretsList, secretsRemove, secretsStatus, secretsRefresh, secretsRun]));
-var deadboltConnect = Command.make("connect", { json: jsonFlag }, Effect3.fn("Cli.deadboltConnect")(function* ({ json }) {
-  const paired = yield* Effect3.tryPromise({
+  yield* Console7.log(removed ? `Removed ${name}` : `No secret named ${name}`);
+})).pipe(Command6.withDescription("Delete a site secret"));
+var secrets = Command6.make("secrets").pipe(Command6.withDescription("Site secrets agents can type without seeing them, and captured credential profiles"), Command6.withSubcommands([secretsAdd, secretsList, secretsRemove, secretsStatus, secretsRefresh, secretsRun]));
+var deadboltConnect = Command6.make("connect", { json: jsonFlag }, Effect9.fn("Cli.deadboltConnect")(function* ({ json }) {
+  const paired = yield* Effect9.tryPromise({
     try: () => pair(),
     catch: (cause) => cause instanceof Error ? cause : new Error("Could not connect to Deadbolt")
   });
@@ -1559,138 +1587,237 @@ var deadboltConnect = Command.make("connect", { json: jsonFlag }, Effect3.fn("Cl
     yield* emitJson({ connected: true, id: paired.id });
     return;
   }
-  yield* Console.log(`Connected Browse to Deadbolt as client ${paired.id}.`);
-  yield* Console.log("Agents can use only the logins you allow, in Deadbolt: deadbolt agents allow <site> (narrow with --login, --fields, --expires), or deadbolt agents allow --all for every login");
-})).pipe(Command.withDescription("Pair Browse with Deadbolt (runs `deadbolt agents add-client browse`, which asks you to confirm) and store its client token (0600)"));
-var deadboltDisconnect = Command.make("disconnect", {}, Effect3.fn("Cli.deadboltDisconnect")(function* () {
-  const result = yield* Effect3.try({
+  yield* Console7.log(`Connected Browse to Deadbolt as client ${paired.id}.`);
+  yield* Console7.log("Agents can use only the logins you allow, in Deadbolt: deadbolt agents allow <site> (narrow with --login, --fields, --expires), or deadbolt agents allow --all for every login");
+})).pipe(Command6.withDescription("Pair Browse with Deadbolt (runs `deadbolt agents add-client browse`, which asks you to confirm) and store its client token (0600)"));
+var deadboltDisconnect = Command6.make("disconnect", {}, Effect9.fn("Cli.deadboltDisconnect")(function* () {
+  const result = yield* Effect9.try({
     try: () => unpair(),
     catch: (cause) => cause instanceof Error ? cause : new Error("Could not disconnect from Deadbolt")
   });
   if (!result.removed) {
-    yield* Console.log("Browse isn't connected to Deadbolt");
+    yield* Console7.log("Browse isn't connected to Deadbolt");
     return;
   }
-  yield* Console.log(result.revoked ? "Disconnected: the client is removed in Deadbolt and its token deleted here." : "Deleted the client token here. Deadbolt didn't confirm removing the client: check `deadbolt agents clients`.");
-})).pipe(Command.withDescription("Remove Browse's Deadbolt client (in Deadbolt and here)"));
-var deadboltStatus = Command.make("status", { json: jsonFlag }, Effect3.fn("Cli.deadboltStatus")(function* ({ json }) {
+  yield* Console7.log(result.revoked ? "Disconnected: the client is removed in Deadbolt and its token deleted here." : "Deleted the client token here. Deadbolt didn't confirm removing the client: check `deadbolt agents clients`.");
+})).pipe(Command6.withDescription("Remove Browse's Deadbolt client (in Deadbolt and here)"));
+var deadboltStatus = Command6.make("status", { json: jsonFlag }, Effect9.fn("Cli.deadboltStatus")(function* ({ json }) {
   const client = readClient();
   const socket = socketPath();
-  const status = client ? yield* Effect3.promise(() => connect({ client, socket }).status().then((value) => ({ reachable: true, ...value }), (error) => ({ reachable: false, error: error instanceof Error ? error.message : String(error) }))) : undefined;
-  const report = { connected: client !== undefined, ...client ? { id: client.id } : {}, socket, ...status ? { deadbolt: status } : {} };
+  const status = client ? yield* Effect9.promise(() => connect({ client, socket }).status().then((value) => ({ reachable: true, ...value }), (error) => ({
+    reachable: false,
+    error: error instanceof Error ? error.message : String(error)
+  }))) : undefined;
+  const report = {
+    connected: client !== undefined,
+    ...client ? { id: client.id } : {},
+    socket,
+    ...status ? { deadbolt: status } : {}
+  };
   if (json) {
     yield* emitJson(report);
     return;
   }
   if (!client) {
-    yield* Console.log("Not connected to Deadbolt. Run `opencode-browser deadbolt connect`.");
+    yield* Console7.log("Not connected to Deadbolt. Run `opencode-browser deadbolt connect`.");
     return;
   }
-  yield* Console.log(`Connected as Deadbolt client ${client.id}; socket ${socket}`);
+  yield* Console7.log(`Connected as Deadbolt client ${client.id}; socket ${socket}`);
   if (status && status.reachable)
-    yield* Console.log(`Deadbolt ${status.version ?? ""} (protocol ${status.protocol}) is ${status.unlocked ? "unlocked" : "locked: agent sign-ins are paused until you unlock it"}`);
+    yield* Console7.log(`Deadbolt ${status.version ?? ""} (protocol ${status.protocol}) is ${status.unlocked ? "unlocked" : "locked: agent sign-ins are paused until you unlock it"}`);
   else if (status)
-    yield* Console.log(`Deadbolt isn't reachable: ${status.error}`);
-})).pipe(Command.withDescription("Show whether Browse is paired with Deadbolt and whether Deadbolt is reachable and unlocked"));
-var deadbolt = Command.make("deadbolt").pipe(Command.withDescription("Let agents sign in with the Deadbolt logins you grant them, without seeing any value"), Command.withSubcommands([deadboltConnect, deadboltDisconnect, deadboltStatus]));
-var journal = Command.make("journal", {
-  session: sessionFlag("Show the journal for this Browse session id"),
-  limit: Flag.Int("limit").pipe(Flag.optional, Flag.withDescription("Number of most recent entries to show, defaults to 20")),
-  json: jsonFlag
-}, Effect3.fn("Cli.journal")(function* ({ session, limit, json }) {
-  const sessionId = yield* networkSession(session);
-  const entries = yield* Effect3.tryPromise({
-    try: () => readJournalEntries({ baseDir: defaultJournalBaseDir(), sessionId, limit: Option2.getOrUndefined(limit) ?? 20 }),
-    catch: (cause) => new Error(`read session journal for ${sessionId}`, { cause })
+    yield* Console7.log(`Deadbolt isn't reachable: ${status.error}`);
+})).pipe(Command6.withDescription("Show whether Browse is paired with Deadbolt and whether Deadbolt is reachable and unlocked"));
+var deadbolt = Command6.make("deadbolt").pipe(Command6.withDescription("Let agents sign in with the Deadbolt logins you grant them, without seeing any value"), Command6.withSubcommands([deadboltConnect, deadboltDisconnect, deadboltStatus]));
+registerCliCommand(610, () => secrets);
+registerCliCommand(620, () => deadbolt);
+
+// src/cli/session.ts
+import { Console as Console8, Effect as Effect10, Option as Option8 } from "effect";
+import { Argument as Argument5, Command as Command7, Flag as Flag8 } from "effect/cli";
+function describeStop(stopped) {
+  return [stopped.execute ? "a running execute" : undefined, stopped.handoff ? "a pending handoff" : undefined].filter(Boolean).join(" and ") + (stopped.forced ? " (the script did not stop in time and was abandoned with its state)" : "");
+}
+var sessionNew = Command7.make("new", {
+  name: Argument5.String("name").pipe(Argument5.optional, Argument5.withDescription("Optional lowercase session id")),
+  readOnly: Flag8.Boolean("read-only").pipe(Flag8.withDefault(false), Flag8.withDescription("Create a read-only session: the relay rejects input-dispatching CDP so scripts can inspect but not click or type")),
+  allowOrigin: Flag8.String("allow-origin").pipe(Flag8.atLeast(0), Flag8.withDescription("Only let this session's tabs load these hosts or origins (repeatable or comma-separated): example.com, *.example.com, https://app.example.com, http://localhost:3000"))
+}, Effect10.fn("Cli.sessionNew")(function* ({ name, readOnly, allowOrigin }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const store = yield* Service2;
+  const result = yield* relay.sessionNew(Option8.getOrUndefined(name), {
+    ...readOnly ? { readOnly: true } : {},
+    ...allowOrigin.length > 0 ? { allowedOrigins: allowOrigin } : {}
   });
+  yield* store.write(result.id);
+  yield* Console8.log(result.id);
+})).pipe(Command7.withDescription("Create a Browse session and make it current"));
+var sessionList = Command7.make("list", {
+  json: jsonFlag
+}, Effect10.fn("Cli.sessionList")(function* ({ json }) {
+  const relay = yield* Service;
+  yield* ensureCliRelay();
+  const store = yield* Service2;
+  const sessions = yield* relay.sessions;
+  const current = yield* store.read;
   if (json) {
-    yield* emitJson({ session: sessionId, entries });
+    yield* emitJson({ current: current ?? undefined, sessions });
     return;
   }
-  if (entries.length === 0) {
-    yield* Console.log(`No journal entries for session ${sessionId}`);
+  if (sessions.length === 0) {
+    yield* Console8.log("No sessions");
     return;
   }
-  yield* Console.log(`Journal for ${sessionId} (last ${entries.length}):`);
-  yield* Effect3.forEach(entries, (entry) => {
-    return Console.log(formatJournalEntry(entry));
+  yield* Effect10.forEach(sessions, (item) => {
+    const marker = item.id === current ? "*" : " ";
+    const page = item.pageUrl ?? "no page yet";
+    const keys = item.stateKeys.length ? ` state=${item.stateKeys.join(",")}` : "";
+    const readOnly = item.readOnly ? " read-only" : "";
+    const allowed = item.allowedOrigins ? ` allow=${item.allowedOrigins.join(",")}` : "";
+    return Console8.log(`${marker} ${item.id} ${page}${keys}${readOnly}${allowed}`);
   });
-})).pipe(Command.withDescription("Show what agents did in a Browse session"));
-var doctor = Command.make("doctor", {
-  json: jsonFlag
-}, Effect3.fn("Cli.doctor")(function* ({ json }) {
-  const update = yield* Effect3.promise(() => updateNotice2());
-  const report = yield* createDoctorReport({ packageRoot, update: updateJson2(update) });
-  if (json) {
-    yield* emitJson(report);
-  } else {
-    yield* Console.log(formatDoctorReport(report));
+})).pipe(Command7.withDescription("List Browse sessions"));
+var sessionCurrent = Command7.make("current", {}, Effect10.fn("Cli.sessionCurrent")(function* () {
+  const store = yield* Service2;
+  const current = yield* store.read;
+  yield* Console8.log(current ?? "none");
+})).pipe(Command7.withDescription("Print the current default session"));
+var sessionUse = Command7.make("use", {
+  id: Argument5.String("id")
+}, Effect10.fn("Cli.sessionUse")(function* ({ id }) {
+  const store = yield* Service2;
+  yield* ensureSessionExists2(id);
+  yield* store.write(id);
+  yield* Console8.log(id);
+})).pipe(Command7.withDescription("Set the current default session"));
+var sessionReset = Command7.make("reset", {
+  id: Argument5.String("id").pipe(Argument5.optional),
+  session: sessionFlag("Reset this Browse session id")
+}, Effect10.fn("Cli.sessionReset")(function* ({ id, session }) {
+  const relay = yield* Service;
+  const sessionId = yield* resolvePositionalOrFlagSessionId(id, session);
+  yield* ensureCliRelay();
+  const reset = yield* relay.sessionReset(sessionId);
+  if (reset.stopped)
+    yield* Console8.error(`Stopped first: ${describeStop(reset.stopped)}`);
+  yield* Console8.log(reset.session.id);
+})).pipe(Command7.withDescription("Reset a Browse session state and page"));
+var sessionAdopt = Command7.make("adopt", {
+  session: sessionFlag("Adopt into this Browse session, creating it when it does not exist yet; omit to create a fresh readable id"),
+  targetUrl: Flag8.String("target-url").pipe(Flag8.optional, Flag8.withDescription("Adopt the attached page whose URL contains this text")),
+  targetIndex: Flag8.Int("target-index").pipe(Flag8.optional, Flag8.withDescription("Adopt the attached page at this zero-based target index")),
+  tabId: tabIdFlag("Adopt the user's shared tab with this Chrome tab id (the tab= value in status)")
+}, Effect10.fn("Cli.sessionAdopt")(function* ({ session, targetUrl, targetIndex, tabId }) {
+  const relay = yield* Service;
+  const explicitSessionId = Option8.getOrUndefined(session) ?? Option8.getOrUndefined(yield* sessionIdConfig);
+  yield* ensureCliRelayAndExtension(explicitSessionId);
+  const targetUrlValue = Option8.getOrUndefined(targetUrl);
+  const targetIndexValue = Option8.getOrUndefined(targetIndex);
+  if (targetIndexValue !== undefined && targetIndexValue < 0) {
+    return yield* Effect10.fail(new Error("Target index must be a non-negative integer"));
   }
-  if (report.status === "fail") {
-    yield* failExit;
+  const tabIdValue = Option8.getOrUndefined(tabId);
+  if ([targetUrlValue, targetIndexValue, tabIdValue].filter((value) => value !== undefined).length > 1) {
+    return yield* Effect10.fail(new Error("Use only one target selector: --target-url, --target-index, or --tab-id"));
   }
-})).pipe(Command.withDescription("Diagnose the local Browse install and runtime"));
-var skill = Command.make("skill", {}, Effect3.fn("Cli.skill")(function* () {
-  const fs = yield* FileSystem3.FileSystem;
-  const text = yield* fs.readFileString(path.join(packageRoot, "skills", "browse", "SKILL.md")).pipe(Effect3.mapError((cause) => new Error("read opencode-browser skill", { cause })));
-  yield* Console.log(text.trimEnd());
-})).pipe(Command.withDescription("Print the Browse agent skill text"));
-var tabsCleanup = Command.make("cleanup", {
-  idleMinutes: Flag.Int("idle-minutes").pipe(Flag.optional, Flag.withDescription("Close agent tabs idle at least this long; 0 closes every eligible agent tab (default: the extension's setting, 10; still 10 when it is set to never)")),
-  json: jsonFlag
-}, Effect3.fn("Cli.tabsCleanup")(function* ({ idleMinutes, json }) {
+  const targetSelection = targetUrlValue ? { urlIncludes: targetUrlValue } : targetIndexValue !== undefined ? { index: targetIndexValue } : undefined;
+  const result = yield* relay.sessionAdopt({
+    ...explicitSessionId ? { sessionId: explicitSessionId } : {},
+    createIfMissing: true,
+    ...targetSelection ? { targetSelection } : {},
+    ...tabIdValue === undefined ? {} : { tabId: tabIdValue }
+  });
+  yield* Console8.log(`${result.session.created ? "Created and adopted" : "Adopted"} session '${result.session.id}' default page: ${result.adoptedUrl}`);
+  if (result.session.created) {
+    yield* Console8.error(formatSessionContinuation(result.session.id));
+  }
+})).pipe(Command7.withDescription("Make an attached tab the session's default page"));
+var sessionDelete = Command7.make("delete", {
+  id: Argument5.String("id").pipe(Argument5.optional),
+  session: sessionFlag("Delete this Browse session id")
+}, Effect10.fn("Cli.sessionDelete")(function* ({ id, session }) {
   const relay = yield* Service;
+  const store = yield* Service2;
+  const sessionId = yield* resolvePositionalOrFlagSessionId(id, session);
   yield* ensureCliRelay();
-  const result = yield* relay.tabsCleanup(Option2.getOrUndefined(idleMinutes));
-  if (json)
-    return yield* emitJson(result);
-  if (!result.closed.length)
-    return yield* Console.log("No idle agent tabs to close.");
-  for (const tab of result.closed)
-    yield* Console.log(`Closed ${tab.title} (idle ${tab.idleMinutes}m)`);
-})).pipe(Command.withDescription("Close tabs agents opened that nobody has used for a while"));
-var tabs = Command.make("tabs").pipe(Command.withDescription("Manage the tabs agents open"), Command.withSubcommands([tabsCleanup]));
-var printSettings = (settings) => Effect3.forEach(formatSettings(settings), (line) => Console.log(line), { discard: true });
-var settingsGet = Command.make("get", { json: jsonFlag }, Effect3.fn("Cli.settingsGet")(function* ({ json }) {
+  const deleted = yield* relay.sessionDelete(sessionId);
+  if (deleted.stopped)
+    yield* Console8.error(`Stopped first: ${describeStop(deleted.stopped)}`);
+  const current = yield* store.read;
+  if (current === sessionId) {
+    yield* store.clear;
+  }
+  yield* Console8.log(sessionId);
+})).pipe(Command7.withDescription("Delete a Browse session"));
+var sessionAllow = Command7.make("allow", {
+  session: sessionFlag(),
+  origins: Argument5.String("origins").pipe(Argument5.variadic({ min: 0 }), Argument5.withDescription("Hosts or origins the session's tabs may load: example.com, *.example.com, https://app.example.com, http://localhost:3000")),
+  clear: Flag8.Boolean("clear").pipe(Flag8.withDefault(false), Flag8.withDescription("Remove the allowlist: the session may load any site again")),
+  json: jsonFlag
+}, Effect10.fn("Cli.sessionAllow")(function* ({ session, origins, clear, json }) {
   const relay = yield* Service;
   yield* ensureCliRelay();
-  const result = yield* relay.settingsGet;
-  if (json)
-    return yield* emitJson(result);
-  yield* printSettings(result.settings);
-  yield* Console.log(result.note);
-})).pipe(Command.withDescription("Show each setting's value, the value in effect, and any relay environment variable overriding it"));
-var settingsSet = Command.make("set", {
-  assignments: Argument.String("key=value").pipe(Argument.variadic({ min: 1 }), Argument.withDescription(`Settings to change: ${settingKeys.join(", ")}`)),
+  if (!clear && origins.length === 0) {
+    return yield* Effect10.fail(new Error("session allow needs origins, or --clear to remove the allowlist"));
+  }
+  const id = yield* resolvePositionalOrFlagSessionId(Option8.none(), session);
+  const result = yield* relay.sessionAllowlist(id, clear ? [] : origins);
+  if (json) {
+    yield* emitJson(result);
+    return;
+  }
+  yield* Console8.log(result.allowedOrigins ? `${result.id} may load: ${result.allowedOrigins.join(", ")}` : `${result.id} may load any site`);
+})).pipe(Command7.withDescription("Set the domain allowlist of a session (the current one by default)"));
+var session = Command7.make("session").pipe(Command7.withDescription("Manage Browse sessions"), Command7.withSubcommands([
+  sessionNew,
+  sessionList,
+  sessionCurrent,
+  sessionUse,
+  sessionReset,
+  sessionAdopt,
+  sessionDelete,
+  sessionAllow
+]));
+var journal = Command7.make("journal", {
+  session: sessionFlag("Show the journal for this Browse session id"),
+  limit: Flag8.Int("limit").pipe(Flag8.optional, Flag8.withDescription("Number of most recent entries to show, defaults to 20")),
   json: jsonFlag
-}, Effect3.fn("Cli.settingsSet")(function* ({ assignments, json }) {
-  const changes = {};
-  for (const assignment of assignments) {
-    const index = assignment.indexOf("=");
-    if (index <= 0)
-      return yield* Effect3.fail(new Error(`Expected key=value, got "${assignment}". Settings: ${settingKeys.join(", ")}.`));
-    changes[assignment.slice(0, index)] = assignment.slice(index + 1);
+}, Effect10.fn("Cli.journal")(function* ({ session, limit, json }) {
+  const sessionId = yield* networkSession(session);
+  const entries = yield* Effect10.tryPromise({
+    try: () => readJournalEntries({
+      baseDir: defaultJournalBaseDir(),
+      sessionId,
+      limit: Option8.getOrUndefined(limit) ?? 20
+    }),
+    catch: (cause) => new Error(`read session journal for ${sessionId}`, { cause })
+  });
+  if (json) {
+    yield* emitJson({ session: sessionId, entries });
+    return;
   }
-  const relay = yield* Service;
-  yield* ensureCliRelay();
-  const result = yield* relay.settingsSet(changes);
-  if (json)
-    return yield* emitJson(result);
-  yield* Console.log(result.message);
-  yield* printSettings(result.settings);
-})).pipe(Command.withDescription("Change settings (validated strictly; the extension's options page updates live)"));
-var settings = Command.make("settings").pipe(Command.withDescription("Read or change the user's settings (the extension's options page). Security switches are environment-only"), Command.withSubcommands([settingsGet, settingsSet]));
-var mcp = Command.make("mcp", {}, Effect3.fn("Cli.mcp")(function* () {
-  const { runMcpServer } = yield* Effect3.promise(() => import("./mcp-2smdsn8z.mjs"));
-  yield* runMcpServer;
-})).pipe(Command.withDescription("Run the Browse MCP server over stdio"));
-var opencodeBrowser = Command.make("opencode-browser").pipe(Command.withDescription("Control the user's existing browser through the Browse extension"), Command.withSubcommands([serve, relay, execute, session, tabs, settings, status, network, secrets, deadbolt, recording, flightRecorder, journal, doctor, skill, mcp]));
+  if (entries.length === 0) {
+    yield* Console8.log(`No journal entries for session ${sessionId}`);
+    return;
+  }
+  yield* Console8.log(`Journal for ${sessionId} (last ${entries.length}):`);
+  yield* Effect10.forEach(entries, (entry) => {
+    return Console8.log(formatJournalEntry(entry));
+  });
+})).pipe(Command7.withDescription("Show what agents did in a Browse session"));
+registerCliCommand(300, () => session);
+registerCliCommand(800, () => journal);
+
+// src/cli.ts
+var packageRoot = path6.dirname(path6.dirname(fileURLToPath(import.meta.url)));
+var opencodeBrowser = Command8.make("opencode-browser").pipe(Command8.withDescription("Control the user's existing browser through the Browse extension"), Command8.withSubcommands(buildRegisteredCliCommands({ packageRoot })));
 var mainLayer = Layer2.mergeAll(layerFetch, layer).pipe(Layer2.provideMerge(NodeServices.layer));
-function runCli(rawArgs = process.argv.slice(2)) {
+function runCli(rawArgs = process3.argv.slice(2)) {
   const cliArgs = hoistJsonFlag(rawArgs);
   const subcommand = cliArgs.argv.find((arg) => !arg.startsWith("-"));
   const commandName = subcommand ? `opencode-browser ${subcommand}` : "opencode-browser";
-  const reportUsageError = (error) => Effect3.gen(function* () {
+  const reportUsageError = (error) => Effect11.gen(function* () {
     const errors = error._tag === "ShowHelp" ? error.errors : [error];
     if (errors.length === 0)
       return;
@@ -1701,23 +1828,23 @@ function runCli(rawArgs = process.argv.slice(2)) {
     }
     yield* exitWith(ExitCode.usage);
   });
-  const reportFailure = (error) => Effect3.gen(function* () {
+  const reportFailure = (error) => Effect11.gen(function* () {
     const message = error instanceof Error ? error.message : String(error);
     const exitCode = exitCodeForError(error);
     if (cliArgs.json) {
       yield* emitJson(failure(commandName, exitCode === ExitCode.host ? "relay_unavailable" : "error", message, { exitCode }));
       yield* stderrLine(message);
     } else {
-      yield* Console.error(message);
+      yield* Console9.error(message);
     }
     yield* exitWith(exitCode);
   });
   const silent = () => {};
   const askedForHelp = cliArgs.argv.some((arg) => arg === "--help" || arg === "-h");
   const quietJson = cliArgs.json && !askedForHelp;
-  Command.runWith(opencodeBrowser, { version: opencodeBrowserVersion2, renderErrors: !quietJson })(normalizeCliArguments(cliArgs.argv)).pipe(quietJson ? Effect3.provideService(Console.Console, { ...globalThis.console, log: silent }) : (effect) => effect, Effect3.catchIf(CliError.isCliError, reportUsageError), Effect3.catch(reportFailure), Effect3.provide(mainLayer), NodeRuntime.runMain);
+  Command8.runWith(opencodeBrowser, { version: opencodeBrowserVersion2, renderErrors: !quietJson })(normalizeCliArguments(cliArgs.argv)).pipe(quietJson ? Effect11.provideService(Console9.Console, { ...globalThis.console, log: silent }) : (effect) => effect, Effect11.catchIf(CliError.isCliError, reportUsageError), Effect11.catch(reportFailure), Effect11.provide(mainLayer), NodeRuntime.runMain);
 }
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (process3.argv[1] && import.meta.url === pathToFileURL(process3.argv[1]).href) {
   runCli();
 }
 export {