@runalabs/rill-cli 0.1.10 → 0.1.11

package/README.md

@@ -148,7 +148,8 @@ Use `rill --help` or `<command> --help` for supported flags.
 | `rill doctor` | Check prerequisites, API compatibility, and authentication. |
 | `rill record start [options]` | Start a managed or attached browser recording. |
 | `rill record stop <recording-id>` | Finalize and upload; supports `--no-wait` and `--no-feedback`. |
-| `rill record status <recording-id>` | Read local state, falling back to remote state if the local session is unavailable. |
+| `rill record status <recording-id>` | Read the remote encoding job first; otherwise check local capture state with a remote fallback. |
+| `rill record retry <recording-id>` | Resume a retained remote capture or retry a failed encode; supports `--no-wait`. |
 | `rill record cancel <recording-id>` | Abandon a run created by this credential and release its remote quota reservation. |
 | `rill upload <video-file>` | Upload video-only evidence; supports `--title` and `--no-wait`. |
 | `rill inspect <share-url>` | Read bounded context without login. |
@@ -185,14 +186,15 @@ Check the exit status first, then structured fields. Known codes include `authen
 
 - **Doctor fails:** read the failed check's recovery field. Correct the credential, API connectivity, or executable path before recording.
 - **Quota exceeded:** inspect `error.details.quota.type` and `blockingRecordingId` when present. Check the blocking recording; cancel only an abandoned run. Review storage and daily allowance in Billing.
-- **Upload interrupted or processing timed out:** keep the recording ID and local artifacts. Check the dashboard for remote readiness. `record status` prefers local state and can report local `ready` without a share URL; this does not prove remote playback readiness.
+- **Remote upload interrupted or encoding failed:** keep the recording ID and local capture files. Run `rill record status <recording-id>`, then `rill record retry <recording-id>` with the original credential before capture expiry. Retry resumes accepted chunks or requeues the encode without repeating browser actions. A `ready` result needs a share URL before you return it as evidence.
 - **Duration limit reached:** local capture finalizes automatically, but `record stop` is still needed to upload.
-- **Local session missing:** `record status` falls back to remote state. `drafts list` locates local directories, which may be incomplete. There is no `drafts resume` command.
+- **Terminal closed:** after upload acceptance, the server finishes independently; retrieve the result with `record status`. Before acceptance, retry from the original machine while its captured frames remain available.
+- **Local session missing:** `record status` checks for a remote encoding job before falling back to local or remote recording state. `drafts list` locates local directories, which may be incomplete. There is no `drafts resume` command.
 - **Share cannot be inspected:** open the complete URL in a browser; ask the owner for a current link if needed.
 
 A failed local startup automatically attempts to cancel the remote reservation it just created. `record cancel` changes remote state and does not stop the local browser; finish local capture before abandoning the remote reservation.
 
-When finalized artifacts survive, retain `recording.webm` and `diagnostics-v1.ndjson.gz` in the recording's draft directory. `rill upload <path-to-recording.webm>` is a video-only fallback: it creates a new recording and does not restore the original diagnostics. Successful stop with readiness removes that run's local artifact directory.
+For `--encoding local`, when finalized artifacts survive, retain `recording.webm` and `diagnostics-v1.ndjson.gz` in the recording's draft directory. `rill upload <path-to-recording.webm>` is a video-only fallback: it creates a new recording and does not restore the original diagnostics. Successful stop with readiness removes that run's local artifact directory.
 
 `drafts purge` deletes local draft directories older than 24 hours by modification time, without a confirmation prompt. Recover needed evidence before purging.
 
@@ -203,7 +205,7 @@ When finalized artifacts survive, retain `recording.webm` and `diagnostics-v1.nd
 | `RILL_TOKEN` | Agent credential; overrides the keychain. |
 | `RILL_API_URL` | API origin; defaults to `https://userill.dev`. Global `--api-url` takes precedence. |
 | `RILL_CHROME_PATH` | Chrome or Chromium executable path. |
-| `RILL_FFMPEG` | ffmpeg executable; defaults to `ffmpeg` on `PATH`. |
+| `RILL_FFMPEG` | FFmpeg executable for `--encoding local`; defaults to `ffmpeg` on `PATH`. |
 | `RILL_HOME` | Recorder state directory; defaults to `~/.rill`. |
 | `RILL_SOCKET` | Recorder socket; defaults to `recorder.sock` inside `RILL_HOME`. |
 | `RILL_TEMP` | Artifact root; defaults to `rill-recordings` inside the system temporary directory. |
@@ -264,8 +266,25 @@ Use `--json` for a machine-readable result (`--pretty` also enables JSON formatt
 Provider token usage is retained internally and omitted from customer output.
 `rill run status <run-id>` and `rill run cancel <run-id>` support the same output options.
 
-### Remote encoding
+## Remote encoding
 
 Since 0.1.10, `record start` uses remote encoding by default. Chrome stays local, including access to localhost; FFmpeg is required only for `record start --encoding local`. For local encoding, install FFmpeg with `brew install ffmpeg` on macOS or `sudo apt install ffmpeg` on Debian/Ubuntu, then run `doctor --encoding local`. Remote encoding adds no charge and consumes no cloud-run credits; existing recording allowances still apply. Captures are limited to ten minutes and 1 GiB of raw frames, with three pending jobs per workspace. Busy recordings can reach the byte limit sooner.
 
-`record stop` uploads frames and waits for playback. `record stop ID --no-wait` returns after upload acceptance; processing continues if the terminal closes. Use `record status ID` to retrieve progress and the share link, or `record retry ID` to resume an interrupted upload or retry encoding without repeating browser actions. Failed raw captures expire after 24 hours. Remote encoding uses no cloud-run credits and adds no charge.
+`record stop` uploads frames and waits for playback. `record stop ID --no-wait` returns after upload acceptance; processing continues if the terminal closes. Use `record status ID` to retrieve progress and the share link, or `record retry ID` to resume an interrupted upload or retry encoding without repeating browser actions. Raw captures are removed after successful publication. Recoverable captures expire after 24 hours: local retention starts at capture start, server retention at upload initialization. Keep the original credential and local files until upload acceptance; `expiresAt` reports the server deadline once a job exists.
+
+```sh
+rill record stop <recording-id> --no-wait
+rill record status <recording-id>
+# If upload or encoding failed, retry the same recording:
+rill record retry <recording-id>
+```
+
+Progress runs through `uploading` → `queued` → `encoding` → `processing` → `ready`. Waiting for capacity is normal; do not repeat the browser journey merely because a job is queued. Long or busy recordings can take several minutes to upload and encode.
+
+### Anonymous local recordings and account connection
+
+`rill record start` can begin without sign-in when the server supports anonymous access. The CLI stores the identity in the OS credential store and uses local encoding. Anonymous access includes three successful recordings, at most five minutes and 250 MB each; each recording and its unlisted share link expires seven days after creation. Failed uploads do not consume the successful-recording allowance. Source and service rate limits also apply.
+
+Run `rill connect --email you@example.com` to authorize account access or keep your anonymous recordings. Open the displayed link, sign in, and enter the code yourself. Approval allows creation and reading of your existing and new recordings for 90 days, with automatic renewal of one-hour access tokens. Revoke the connection in Rill's Credentials page to stop access and renewal. Deletion and changes to existing sharing settings are not included.
+
+Use `rill record list` to list accessible recordings and `rill inspect <recording-id>` for private recording details. `rill inspect <share-url>` continues to work without account access. The existing `rill login` and `RILL_TOKEN` flows remain supported. Local credential storage requires macOS Keychain or Linux Secret Service.

package/dist/cli.js

@@ -14673,6 +14673,9 @@ var ControlPlaneClient = class {
     const body = await readFile(filePath);
     return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
   }
+  listRecordings() {
+    return this.request("/api/recordings");
+  }
   createDeviceAuthorization(input) {
     return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
   }
@@ -14680,6 +14683,7 @@ var ControlPlaneClient = class {
     return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
   }
   inspect(shareUrl) {
+    if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
     const url2 = new URL(shareUrl);
     const slug = url2.pathname.split("/").filter(Boolean).at(-1);
     if (!slug) throw new Error("The share URL does not contain a slug.");
@@ -14692,8 +14696,9 @@ var ControlPlaneClient = class {
     const headers = new Headers(init.headers);
     if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
     if (authenticated) {
-      if (!this.token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
-      headers.set("Authorization", `Bearer ${this.token}`);
+      const token = typeof this.token === "function" ? await this.token() : this.token;
+      if (!token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
+      headers.set("Authorization", `Bearer ${token}`);
     }
     const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
     const value = await response.json().catch(() => null);
@@ -14766,10 +14771,10 @@ async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
 
 // src/cli.ts
 import { spawn as spawn6 } from "child_process";
+import { hostname as hostname4 } from "os";
 import { Command } from "commander";
-import { hostname as hostname3 } from "os";
 import { basename, dirname as dirname2 } from "path";
-import { readdir as readdir2, rm as rm4, stat as stat3 } from "fs/promises";
+import { readdir as readdir2, rm as rm5, stat as stat4 } from "fs/promises";
 
 // ../recorder/src/client.ts
 import { request } from "http";
@@ -15399,34 +15404,34 @@ var RecordingSession = class _RecordingSession {
       this.consoleEvents.push(event);
       pushTimeline({ offsetMs: event.offsetMs, type: "exception", label: event.text.slice(0, 160), severity: "error" });
     });
-    this.page.on("request", (request2) => {
+    this.page.on("request", (request3) => {
       if (this.diagnosticsPaused) return;
       if (this.networkEvents.length >= 5e3) {
         this.truncated = true;
         return;
       }
       const started = offset();
-      this.requestStart.set(request2, started);
-      const event = { id: `net_${this.networkEvents.length + 1}`, offsetMs: started, method: request2.method(), url: sanitizeUrl(request2.url()), resourceType: request2.resourceType() };
-      if (captureNetworkBodies && request2.postData()) {
-        const redacted = redactBody(request2.postData(), request2.headers()["content-type"]);
+      this.requestStart.set(request3, started);
+      const event = { id: `net_${this.networkEvents.length + 1}`, offsetMs: started, method: request3.method(), url: sanitizeUrl(request3.url()), resourceType: request3.resourceType() };
+      if (captureNetworkBodies && request3.postData()) {
+        const redacted = redactBody(request3.postData(), request3.headers()["content-type"]);
         event.requestBody = redacted.body;
         event.bodyOmittedReason = redacted.omittedReason;
         if (redacted.body) this.bodyBytes += Buffer.byteLength(redacted.body);
       }
       this.networkEvents.push(event);
-      this.requestEvents.set(request2, event);
+      this.requestEvents.set(request3, event);
     });
     this.page.on("response", (response) => this.updateResponse(response));
-    this.page.on("requestfailed", (request2) => {
-      const event = this.requestEvents.get(request2);
+    this.page.on("requestfailed", (request3) => {
+      const event = this.requestEvents.get(request3);
       if (!event) return;
-      event.failureReason = request2.failure()?.errorText ?? "request_failed";
-      event.durationMs = Math.max(0, offset() - (this.requestStart.get(request2) ?? offset()));
+      event.failureReason = request3.failure()?.errorText ?? "request_failed";
+      event.durationMs = Math.max(0, offset() - (this.requestStart.get(request3) ?? offset()));
       pushTimeline({ offsetMs: event.offsetMs, type: "network", label: `${event.method} ${event.url} \u2192 ${event.failureReason}`, severity: "error" });
     });
-    this.page.on("requestfinished", async (request2) => {
-      const response = await request2.response();
+    this.page.on("requestfinished", async (request3) => {
+      const response = await request3.response();
       if (response) await this.captureResponseBody(response);
     });
   }
@@ -15546,7 +15551,7 @@ async function runDaemon() {
   await unlink(socketPath).catch((error51) => {
     if (error51.code !== "ENOENT") throw error51;
   });
-  const server = createServer2((request2, response) => void route(request2, response));
+  const server = createServer2((request3, response) => void route(request3, response));
   server.listen(socketPath, () => process.platform !== "win32" && import("fs/promises").then(({ chmod }) => chmod(socketPath, 384)));
   const idleTimer = setInterval(() => {
     void (async () => {
@@ -15565,14 +15570,14 @@ async function runDaemon() {
   process.once("SIGTERM", close);
   process.once("SIGINT", close);
 }
-async function route(request2, response) {
+async function route(request3, response) {
   lastActivity = Date.now();
-  const url2 = new URL(request2.url ?? "/", "http://daemon.local");
-  if (request2.method === "GET" && url2.pathname === "/health") return json2(response, 200, { ok: true, pid: process.pid });
-  if (request2.method === "POST" && url2.pathname === "/sessions") {
+  const url2 = new URL(request3.url ?? "/", "http://daemon.local");
+  if (request3.method === "GET" && url2.pathname === "/health") return json2(response, 200, { ok: true, pid: process.pid });
+  if (request3.method === "POST" && url2.pathname === "/sessions") {
     if ([...sessions.values()].filter((entry) => entry.state === "recording").length >= 2) return json2(response, 429, { error: { code: "quota_exceeded", message: "This recorder already has two active sessions." } });
     try {
-      const input = await readJson(request2);
+      const input = await readJson(request3);
       if (!/^rec_[a-zA-Z0-9_-]+$/.test(input.recordingId)) return json2(response, 400, { error: { code: "validation_failed", message: "recordingId is required." } });
       const outputDirectory = join7(recordingTempRoot(), input.recordingId);
       const session = await RecordingSession.start({ ...input, outputDirectory });
@@ -15591,8 +15596,8 @@ async function route(request2, response) {
   if (match) {
     const entry = sessions.get(decodeURIComponent(match[1]));
     if (!entry) return json2(response, 404, { error: { code: "recording_not_found", message: "The local recording session was not found." } });
-    if (request2.method === "GET" && !match[2]) return json2(response, 200, serializeEntry(entry));
-    if (request2.method === "POST" && match[2] === "stop") {
+    if (request3.method === "GET" && !match[2]) return json2(response, 200, serializeEntry(entry));
+    if (request3.method === "POST" && match[2] === "stop") {
       if (entry.state === "ready") return json2(response, 200, serializeEntry(entry));
       await finalizeEntry(entry, "agent_request");
       return json2(response, entry.result ? 200 : 500, serializeEntry(entry));
@@ -15633,10 +15638,10 @@ async function persistState() {
 `, { mode: 384 });
   await rename(temporary, daemonStatePath());
 }
-async function readJson(request2) {
+async function readJson(request3) {
   const chunks = [];
   let size = 0;
-  for await (const chunk of request2) {
+  for await (const chunk of request3) {
     const buffer = Buffer.from(chunk);
     size += buffer.length;
     if (size > 1e6) throw new Error("Request body exceeds 1 MB.");
@@ -15689,6 +15694,153 @@ function cliFailureCode(error51) {
   return message.match(/^([a-z][a-z0-9_]{0,79}):/)?.[1] ?? "unexpected_error";
 }
 
+// src/agent-session.ts
+import { hostname as hostname3, homedir as homedir2 } from "os";
+import { mkdir as mkdir5, rm as rm4, stat as stat3 } from "fs/promises";
+import { join as join8 } from "path";
+import { createHash, randomBytes } from "crypto";
+var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
+var AgentAuthError = class extends Error {
+  constructor(code, message) {
+    super(`${code}: ${message}`);
+    this.code = code;
+  }
+};
+function parseAuthorization(value) {
+  if (!value?.startsWith("{")) return null;
+  const saved = JSON.parse(value);
+  if (saved.version !== 1 || typeof saved.anonymous !== "boolean") throw new Error("Saved Rill authorization is invalid. Run rill connect --email <your-email>.");
+  return saved;
+}
+async function request2(apiUrl, path, body, form = false) {
+  const url2 = new URL(apiUrl);
+  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)) throw new Error("Agent authentication requires HTTPS.");
+  const response = await fetch(`${apiUrl}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3),
+    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
+    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
+  });
+  const value = await response.json();
+  if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
+  return value;
+}
+function withTokens(saved, tokens) {
+  return {
+    ...saved,
+    accessToken: tokens.access_token,
+    accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
+    ...tokens.identity_assertion ? { identityAssertion: tokens.identity_assertion, assertionExpires: tokens.assertion_expires } : {}
+  };
+}
+var save = (apiUrl, value) => saveCredential(apiUrl, JSON.stringify(value));
+var pending = /* @__PURE__ */ new Map();
+async function loadAgentCredential(apiUrl) {
+  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+  const inFlight = pending.get(apiUrl);
+  if (inFlight) return inFlight;
+  const promise2 = (async () => {
+    const raw = await loadStoredCredential(apiUrl);
+    const saved = parseAuthorization(raw);
+    if (!saved) return raw;
+    if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
+    if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
+    if (!saved.identityAssertion) throw new Error("Connection is awaiting approval. Run rill connect --email <your-email>.");
+    const tokens = await request2(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
+    await save(apiUrl, withTokens(saved, tokens));
+    return tokens.access_token;
+  })();
+  pending.set(apiUrl, promise2);
+  try {
+    return await promise2;
+  } finally {
+    pending.delete(apiUrl);
+  }
+}
+async function ensureAnonymousCredential(apiUrl) {
+  const root = join8(homedir2(), ".rill", "auth-locks");
+  await mkdir5(root, { recursive: true, mode: 448 });
+  const lock = join8(root, createHash("sha256").update(apiUrl).digest("hex"));
+  const deadline = Date.now() + 3e4;
+  while (true) {
+    try {
+      await mkdir5(lock, { mode: 448 });
+      break;
+    } catch (error51) {
+      if (error51.code !== "EEXIST") throw error51;
+      const info = await stat3(lock).catch(() => null);
+      if (info && Date.now() - info.mtimeMs > 12e4) {
+        await rm4(lock, { recursive: true, force: true });
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
+      await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+  }
+  try {
+    return await createAnonymousCredential(apiUrl);
+  } finally {
+    await rm4(lock, { recursive: true, force: true });
+  }
+}
+async function createAnonymousCredential(apiUrl) {
+  const existing = await loadAgentCredential(apiUrl);
+  if (existing) return existing;
+  const stored = parseAuthorization(await loadStoredCredential(apiUrl));
+  const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
+  await save(apiUrl, initial);
+  const registered = await request2(apiUrl, "/agent/identity", { type: "anonymous", analytics_enabled: process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1", registration_token: initial.registrationToken, name: `${hostname3()} \xB7 ${process.platform}` });
+  const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
+  await save(apiUrl, saved);
+  process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
+  return await loadAgentCredential(apiUrl);
+}
+async function connectAgent(apiUrl, email3) {
+  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
+  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  let claim;
+  if (saved?.claimToken && saved.anonymous) {
+    try {
+      const result = await request2(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
+      claim = result.claim_attempt;
+    } catch (error51) {
+      if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
+    }
+  }
+  if (!claim) {
+    await save(apiUrl, saved ?? { version: 1, anonymous: true });
+    const result = await request2(apiUrl, "/agent/identity", { type: "service_auth", login_hint: email3, name: `${hostname3()} \xB7 ${process.platform}` });
+    saved = { version: 1, anonymous: true, claimToken: result.claim_token };
+    await save(apiUrl, saved);
+    claim = result.claim;
+  }
+  process.stderr.write(`Open ${claim.verification_uri}
+Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
+`);
+  const deadline = Date.now() + claim.expires_in * 1e3;
+  let interval = claim.interval;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
+    try {
+      const tokens = await request2(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
+      const connected = withTokens({ version: 1, anonymous: false }, tokens);
+      await save(apiUrl, connected);
+      return { status: "authenticated", expiresAt: connected.assertionExpires, apiUrl };
+    } catch (error51) {
+      if (error51 instanceof AgentAuthError && error51.code === "expired_token") throw new AgentAuthError("expired_token", "The approval attempt expired. Run rill connect again to request a fresh code using the same saved claim token.");
+      if (error51 instanceof AgentAuthError && error51.code === "authorization_pending") continue;
+      if (error51 instanceof AgentAuthError && error51.code === "slow_down") {
+        interval += 5;
+        continue;
+      }
+      throw error51;
+    }
+  }
+  throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again to restart the approval attempt using the same saved claim token.");
+}
+
 // src/keychain.ts
 import { spawn as spawn4 } from "child_process";
 var service = "rill";
@@ -15703,15 +15855,20 @@ async function saveCredential(apiUrl, token) {
   }
   throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
 }
-async function loadCredential(apiUrl) {
-  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+function loadCredential(apiUrl) {
+  return loadAgentCredential(apiUrl);
+}
+async function loadStoredCredential(apiUrl) {
   try {
-    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim();
-    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim();
-  } catch {
-    return null;
+    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
+    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
+  } catch (error51) {
+    const code = error51.exitCode;
+    if (process.platform === "darwin" && code === 44) return null;
+    if (process.platform === "linux" && code === 1 && !error51.message.trim()) return null;
+    throw new Error("Cannot read the OS credential store. Unlock your keychain or enable Secret Service; your identity has not been replaced.");
   }
-  return null;
+  throw new Error("Local authorization requires macOS Keychain or Linux Secret Service.");
 }
 function run(command, args, input) {
   return new Promise((resolve, reject) => {
@@ -15721,7 +15878,7 @@ function run(command, args, input) {
     child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
     child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
     child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(new Error(Buffer.concat(stderr).toString("utf8").trim() || `${command} exited with ${code}.`)));
+    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(Object.assign(new Error(Buffer.concat(stderr).toString("utf8").trim()), { exitCode: code })));
     if (input) child.stdin.end(input);
     else child.stdin.end();
   });
@@ -15855,7 +16012,7 @@ async function runDoctor(apiUrl, overrides = {}) {
   } else {
     const token = await dependencies.loadCredential(apiUrl);
     if (!token) {
-      checks.push({ name: "authentication", status: "fail", message: "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
+      checks.push({ name: "authentication", status: health.anonymousAccess ? "warn" : "fail", message: health.anonymousAccess ? "The first recording will create an anonymous identity in your OS credential store. Anonymous recordings expire after seven days." : "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
     } else {
       try {
         const session = await dependencies.agentSession(apiUrl, token);
@@ -15873,10 +16030,10 @@ async function runDoctor(apiUrl, overrides = {}) {
     checks.push({ name: "ffmpeg", status: "skip", message: "Remote encoding does not require local FFmpeg." });
     try {
       const token = await dependencies.loadCredential(apiUrl);
-      if (!token || !(await dependencies.encodingCapabilities(apiUrl, token)).enabled) throw new Error("Remote encoding is not enabled for this workspace.");
-      checks.push({ name: "encoding", status: "pass", message: "Remote encoding is enabled." });
+      if (!(token ? (await dependencies.encodingCapabilities(apiUrl, token)).enabled : health?.anonymousAccess && health.anonymousRemoteEncoding)) throw new Error("Remote encoding is not enabled for this workspace.");
+      checks.push({ name: "encoding", status: "pass", message: token ? "Remote encoding is enabled." : "Remote encoding is available for the first anonymous recording." });
     } catch (error51) {
-      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Use --encoding local until your workspace joins the private trial." });
+      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Remote encoding must be enabled on the server before using the default recording workflow." });
     }
   }
   return { schemaVersion: 1, status: checks.some((check2) => check2.status === "fail") ? "error" : "ok", apiUrl, checks, ...runFeedbackFields(feedbackEnabled) };
@@ -15990,10 +16147,10 @@ function controlPlaneUrl(environmentUrl) {
 async function removeLocalCapture(id) {
   await ensureDaemon(process.argv[1]);
   const local = await recordingStatus(id).catch(() => null);
-  if (local?.result?.frameDirectory) await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
 }
-function watchEncoding(apiUrl, id, token) {
-  const child = spawn6(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env, RILL_TOKEN: token } });
+function watchEncoding(apiUrl, id) {
+  const child = spawn6(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env } });
   child.on("error", () => void 0);
   child.unref();
 }
@@ -16009,8 +16166,9 @@ program.command("doctor").description("Validate Rill prerequisites before record
 });
 async function authorize(quiet = false) {
   const options = program.opts();
+  if (parseAuthorization(await loadStoredCredential(options.apiUrl))?.anonymous) throw new Error("Use rill connect --email <your-email> to keep and claim this anonymous identity before using account access.");
   const client = new ControlPlaneClient(options.apiUrl, null);
-  const authorization = await client.createDeviceAuthorization({ deviceName: `${hostname3()} \xB7 ${process.platform}` });
+  const authorization = await client.createDeviceAuthorization({ deviceName: `${hostname4()} \xB7 ${process.platform}` });
   process.stderr.write(`Open ${authorization.verificationUri} and enter ${authorization.userCode}
 `);
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
@@ -16029,7 +16187,11 @@ async function authorize(quiet = false) {
   }
   throw new Error("Device authorization expired.");
 }
-program.command("login").description("Authorize Rill once.").action(async () => {
+program.command("connect").description("Connect this agent once, with renewable account access.").requiredOption("--email <email>", "Email of the Rill account approving access").action(async (input) => {
+  const options = program.opts();
+  emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email) }, options.pretty);
+});
+program.command("login").description("Authorize Rill using the existing device login flow.").action(async () => {
   await authorize();
 });
 var record2 = program.command("record").description("Run a cloud browser from a URL and prompt, or manage a local recording.").argument("[url]").option("-p, --prompt <prompt>").option("--expectation <text>").option("--account <name>", "Saved website test account").option("--id <uuid>", "Retry a submission with the same run ID").option("--no-wait").action(async (url2, commandOptions) => {
@@ -16059,15 +16221,15 @@ var record2 = program.command("record").description("Run a cloud browser from a
 var cloudRun = program.command("run").description("Retrieve or cancel a cloud run.");
 for (const action of ["status", "cancel"]) cloudRun.command(action).argument("<run-id>").action(async (id) => {
   const options = program.opts();
-  const client = new ControlPlaneClient(options.apiUrl, await loadCredential(options.apiUrl));
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const run2 = await (action === "status" ? client.cloudRun(id) : client.cancelCloudRun(id));
   if (options.json || options.pretty) emit(customerRun(run2), options.pretty);
   else process.stdout.write(formatCloudRun(run2));
 });
 record2.command("start").option("--encoding <mode>", "remote or local", "remote").option("--url <url>").option("--title <title>").option("--description <description>", "").option("--headed").option("--cdp-url <url>").option("--width <pixels>", "", "1280").option("--height <pixels>", "", "720").option("--max-duration <seconds>", "", "600").action(async (commandOptions) => {
   const options = program.opts();
-  const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  await ensureAnonymousCredential(options.apiUrl);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await withRunFeedback(() => client.agentSession(), async (rememberRecording) => {
     if (!["local", "remote"].includes(commandOptions.encoding)) throw new Error("Encoding must be remote or local.");
     if (commandOptions.encoding === "remote" && !(await client.encodingCapabilities()).enabled) throw new Error("Remote encoding is unavailable for this workspace. Use --encoding local.");
@@ -16079,7 +16241,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
     const local = await startRecordingWithCompensation(remote, {
       startLocal: async () => {
         await ensureDaemon(process.argv[1]);
-        return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Number(commandOptions.maxDuration), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
+        return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
       },
       cancelRemote: (recordingId, reason) => client.cancelRecording(recordingId, reason)
     });
@@ -16090,7 +16252,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
       headed: Boolean(commandOptions.headed),
       attached: Boolean(commandOptions.cdpUrl)
     }).catch(() => void 0);
-    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, bodyCaptureEnabled: remote.bodyCaptureEnabled, maxDurationSeconds: Number(commandOptions.maxDuration) };
+    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
   });
   emit(result, options.pretty);
 });
@@ -16099,8 +16261,7 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
   await ensureDaemon(process.argv[1]);
   const local = await stopRecording(recordingId);
   if (!local.result) throw new Error(local.error ?? "The recorder did not produce an artifact.");
-  const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const stopped = await client.markRecordingStopped(recordingId, {
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
@@ -16112,11 +16273,11 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     const accepted = await submitFrameCapture(client, recordingId, local.result.frameDirectory);
     const result2 = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
     emit({ schemaVersion: 1, ...result2, ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
-    if (result2.status === "ready") await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
-    else watchEncoding(options.apiUrl, recordingId, token);
+    if (result2.status === "ready") await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+    else watchEncoding(options.apiUrl, recordingId);
     return;
   }
-  const video = await stat3(local.result.videoPath);
+  const video = await stat4(local.result.videoPath);
   const provisioned = await client.provisionVideo(recordingId, { sizeBytes: video.size, filename: basename(local.result.videoPath), uploadKind: "recorded_browser" });
   await Promise.all([client.uploadVideo(provisioned.uploadUrl, local.result.videoPath), client.uploadDiagnostics(recordingId, local.result.diagnosticsPath, local.result.diagnostics)]);
   const remote = commandOptions.wait === false || record2.opts().wait === false ? null : await client.waitUntilPlayable(recordingId);
@@ -16126,17 +16287,18 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     recordingId,
     status: remote ? "ready" : "processing",
     shareUrl: remote?.shareUrl ?? null,
+    expiresAt: remote?.expires_at ?? null,
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
     diagnostics: local.result.diagnostics,
     ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false)
   };
   emit(result, options.pretty);
-  if (remote) await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (remote) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
 });
 record2.command("retry").argument("<recording-id>").option("--no-wait").action(async (recordingId, commandOptions) => {
   const options = program.opts();
-  const client = new ControlPlaneClient(options.apiUrl, await loadCredential(options.apiUrl));
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const current = await client.encodingStatus(recordingId).catch((error51) => {
     if (error51 instanceof ControlPlaneError && error51.code === "recording_not_found") return null;
     throw error51;
@@ -16154,17 +16316,17 @@ record2.command("retry").argument("<recording-id>").option("--no-wait").action(a
   const result = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
   emit({ schemaVersion: 1, ...result }, options.pretty);
   if (result.status === "ready") await removeLocalCapture(recordingId);
-  else watchEncoding(options.apiUrl, recordingId, await loadCredential(options.apiUrl));
+  else watchEncoding(options.apiUrl, recordingId);
 });
 program.command("encoding-watch", { hidden: true }).argument("<recording-id>").action(async (id) => {
   if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) throw new Error("Invalid recording ID");
   const options = program.opts();
-  const client = new ControlPlaneClient(options.apiUrl, await loadCredential(options.apiUrl));
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await waitForEncoding(client, id, 864e5);
   if (result.status === "ready") {
     await ensureDaemon(process.argv[1]);
     const local = await recordingStatus(id).catch(() => null);
-    if (local?.result?.frameDirectory) await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
+    if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
   }
 });
 var feedback = program.command("feedback").description("Submit a short Rill product review for a recorded run.");
@@ -16174,7 +16336,7 @@ feedback.command("submit").argument("[recording-id]", "Omit only when setup fail
   if (![commandOptions.helped, commandOptions.friction, commandOptions.improvement].some((value) => value.trim())) throw new Error("validation_failed: Include at least one short feedback answer.");
   const options = program.opts();
   const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   await client.submitRecordingFeedback(recordingId ?? null, {
     outcome: commandOptions.outcome,
     whatHelped: commandOptions.helped,
@@ -16183,10 +16345,14 @@ feedback.command("submit").argument("[recording-id]", "Omit only when setup fail
   });
   emit(feedbackSubmissionReceipt(recordingId ?? null), options.pretty);
 });
+record2.command("list").description("List recordings visible to this connection.").action(async () => {
+  const options = program.opts();
+  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).listRecordings(), options.pretty);
+});
 record2.command("status").argument("<recording-id>").action(async (recordingId) => {
   const options = program.opts();
   const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   try {
     const encoding = await client.encodingStatus(recordingId);
     const remote = encoding.status === "ready" ? await client.recordingStatus(recordingId) : {};
@@ -16208,24 +16374,24 @@ record2.command("status").argument("<recording-id>").action(async (recordingId)
 record2.command("cancel").argument("<recording-id>").description("Cancel an active recording and release its remote quota slot.").action(async (recordingId) => {
   const options = program.opts();
   const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   emit(await client.cancelRecording(recordingId), options.pretty);
 });
 program.command("upload").argument("<video-file>").option("--title <title>").option("--no-wait").action(async (videoFile, commandOptions) => {
   const options = program.opts();
-  const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
-  const file2 = await stat3(videoFile);
+  await ensureAnonymousCredential(options.apiUrl);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  const file2 = await stat4(videoFile);
   const recording = await client.createRecording({ title: commandOptions.title ?? basename(videoFile), sourceUrl: null });
   const upload = await client.provisionVideo(recording.recordingId, { sizeBytes: file2.size, filename: basename(videoFile), uploadKind: "existing_video" });
   await client.uploadVideo(upload.uploadUrl, videoFile);
   const remote = commandOptions.wait === false ? null : await client.waitUntilPlayable(recording.recordingId);
   if (remote) process.stderr.write("\n");
-  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, diagnosticsAvailable: false }, options.pretty);
+  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, expiresAt: remote?.expires_at ?? recording.expiresAt ?? null, diagnosticsAvailable: false }, options.pretty);
 });
 program.command("inspect").argument("<share-url>").action(async (shareUrl) => {
   const options = program.opts();
-  emit(await new ControlPlaneClient(options.apiUrl, null).inspect(shareUrl), options.pretty);
+  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).inspect(shareUrl), options.pretty);
 });
 var drafts = program.command("drafts");
 drafts.command("list").action(async () => {
@@ -16241,9 +16407,9 @@ drafts.command("purge").action(async () => {
   let purged = 0;
   for (const name of names) {
     const path = `${root}/${name}`;
-    const metadata = await stat3(path);
+    const metadata = await stat4(path);
     if (Date.now() - metadata.mtimeMs > 24 * 60 * 60 * 1e3) {
-      await rm4(path, { recursive: true, force: true });
+      await rm5(path, { recursive: true, force: true });
       purged += 1;
     }
   }
@@ -16255,7 +16421,7 @@ program.hook("preAction", async (_command, actionCommand) => {
   const options = program.opts();
   const token = await loadCredential(options.apiUrl).catch(() => null);
   if (!token) return;
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   await startCliTelemetry(client, command);
 });
 async function startCliTelemetry(client, command) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runalabs/rill-cli",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Record, inspect, and share agent-controlled browser runs with Rill.",
   "license": "Apache-2.0",
   "repository": {