@runalabs/rill-cli 0.1.11 → 0.1.13

package/dist/cli.js

@@ -5,9 +5,503 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/agent-session.ts
+import { hostname, homedir } from "os";
+import { mkdir, rm, stat } from "fs/promises";
+import { join } from "path";
+import { createHash, randomBytes } from "crypto";
+
+// src/recording-guidance.ts
+function cliCommand(apiUrl, ...args) {
+  const quote = (value) => /^[a-zA-Z0-9_./:@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+  return ["rill", "--api-url", apiUrl, ...args].map(quote).join(" ");
+}
+var transportRecovery = "Use macOS or Linux for browser recording. On Windows, use RILL_TOKEN with rill upload <video-file> for video-only sharing; diagnostics are not imported. RILL_SOCKET does not enable Windows named-pipe or TCP support in this release.";
+function recorderTransportCheck(platform = process.platform) {
+  return platform === "win32" ? { name: "recorder_transport", status: "fail", message: "The local recorder transport does not support Windows.", recovery: transportRecovery } : { name: "recorder_transport", status: "pass", message: "The local recorder uses a Unix-domain socket." };
+}
+function assertRecorderTransport(platform = process.platform) {
+  const check2 = recorderTransportCheck(platform);
+  if (check2.status === "fail") throw Object.assign(new Error(`unsupported_platform: ${check2.message}`), { code: "unsupported_platform", recovery: check2.recovery });
+}
+function recordingNextStep(apiUrl, recordingId, status, options = {}) {
+  if (status === "uploading" && options.resumableFrames) return { nextCommand: cliCommand(apiUrl, "record", "retry", recordingId, "--no-wait"), message: "Frame upload is incomplete. If the uploader is still running, let it finish. If it exited or was interrupted, run nextCommand to resume missing parts and finalize the upload. Do not start a second uploader while the first is active." };
+  if (status === "captured") return { nextCommand: cliCommand(apiUrl, "record", "stop", recordingId, "--no-wait"), message: "Captured locally; upload required. This is not a playable share yet." };
+  if (["uploading", "queued", "encoding", "processing", "finalizing"].includes(status)) return { nextCommand: cliCommand(apiUrl, "record", "status", recordingId), message: "Finalizing recordings hold a concurrency slot. Wait for ready; cancel only if abandoning the recording." };
+  return {};
+}
+function browserAttachment(cdpUrl) {
+  return {
+    protocol: "cdp",
+    cdpUrl,
+    playwrightMethod: "chromium.connectOverCDP",
+    instructions: "Attach to this endpoint and use the existing browser context. A browser tool must explicitly support CDP attachment; do not drive a separate browser. Disconnect the automation client without closing the recorded browser, then run record stop.",
+    shellFallback: "See the shell-only Playwright example in the Rill CLI README; install playwright-core in a temporary directory outside the project."
+  };
+}
+
+// src/agent-session.ts
+var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
+var AgentAuthError = class extends Error {
+  constructor(code, message) {
+    super(`${code}: ${message}`);
+    this.code = code;
+  }
+};
+function parseAuthorization(value) {
+  if (!value?.startsWith("{")) return null;
+  const saved = JSON.parse(value);
+  if (saved.version !== 1 || typeof saved.anonymous !== "boolean") throw new Error("Saved Rill authorization is invalid. Run rill connect --email <your-email>.");
+  return saved;
+}
+async function request(apiUrl, path, body, form = false) {
+  const url2 = new URL(apiUrl);
+  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)) throw new Error("Agent authentication requires HTTPS.");
+  const response = await fetch(`${apiUrl}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3),
+    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
+    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
+  });
+  const value = await response.json();
+  if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
+  return value;
+}
+function withTokens(saved, tokens) {
+  return {
+    ...saved,
+    accessToken: tokens.access_token,
+    accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
+    ...tokens.identity_assertion ? { identityAssertion: tokens.identity_assertion, assertionExpires: tokens.assertion_expires } : {}
+  };
+}
+var save = (apiUrl, value) => saveCredential(apiUrl, JSON.stringify(value));
+var pending = /* @__PURE__ */ new Map();
+async function loadAgentCredential(apiUrl) {
+  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+  const inFlight = pending.get(apiUrl);
+  if (inFlight) return inFlight;
+  const promise2 = withAuthorizationLock(apiUrl, () => readAgentCredential(apiUrl));
+  pending.set(apiUrl, promise2);
+  try {
+    return await promise2;
+  } finally {
+    pending.delete(apiUrl);
+  }
+}
+async function readAgentCredential(apiUrl) {
+  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+  const raw = await loadStoredCredential(apiUrl);
+  const saved = parseAuthorization(raw);
+  if (!saved) return raw;
+  if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
+  if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
+  if (!saved.identityAssertion) throw new Error(saved.connection ? `Connection is ${saved.connection.status}. Run ${cliCommand(apiUrl, "connect", "status", saved.connection.id)}.` : "Connection is awaiting approval. Run rill connect --email <your-email>.");
+  const tokens = await request(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
+  await save(apiUrl, withTokens(saved, tokens));
+  return tokens.access_token;
+}
+async function ensureAnonymousCredential(apiUrl) {
+  return withAuthorizationLock(apiUrl, () => createAnonymousCredential(apiUrl));
+}
+async function withAuthorizationLock(apiUrl, action) {
+  const root = join(homedir(), ".rill", "auth-locks");
+  await mkdir(root, { recursive: true, mode: 448 });
+  const lock = join(root, createHash("sha256").update(apiUrl).digest("hex"));
+  const deadline = Date.now() + 3e4;
+  while (true) {
+    try {
+      await mkdir(lock, { mode: 448 });
+      break;
+    } catch (error51) {
+      if (error51.code !== "EEXIST") throw error51;
+      const info = await stat(lock).catch(() => null);
+      if (info && Date.now() - info.mtimeMs > 12e4) {
+        await rm(lock, { recursive: true, force: true });
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
+      await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+async function createAnonymousCredential(apiUrl) {
+  const existing = await readAgentCredential(apiUrl);
+  if (existing) return existing;
+  const stored = parseAuthorization(await loadStoredCredential(apiUrl));
+  const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
+  await save(apiUrl, initial);
+  const registered = await request(apiUrl, "/agent/identity", { type: "anonymous", analytics_enabled: process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1", registration_token: initial.registrationToken, name: `${hostname()} \xB7 ${process.platform}` });
+  const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
+  await save(apiUrl, saved);
+  process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
+  return await readAgentCredential(apiUrl);
+}
+async function connectAgent(apiUrl, email3, options = {}) {
+  let result = await withAuthorizationLock(apiUrl, () => beginConnection(apiUrl, email3));
+  if (options.wait === false) return result;
+  while (result.status === "pending") {
+    await new Promise((resolve) => setTimeout(resolve, result.retryAfterSeconds * 1e3));
+    result = await pollConnection(apiUrl, result.authorizationId);
+  }
+  if (result.status === "expired") throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again using the same saved identity.");
+  if (result.status === "denied") throw new AgentAuthError("access_denied", "Connection request was denied or revoked. Run rill connect again only when ready to request approval.");
+  return result;
+}
+async function beginConnection(apiUrl, email3) {
+  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
+  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  if (saved?.connection?.status === "pending" && saved.connection.expiresAt > Date.now()) {
+    if (saved.connection.email !== email3) throw new Error("A connection for another email is pending. Let it expire before starting a different connection.");
+    process.stderr.write(`Open ${saved.connection.verificationUri}
+Sign in as ${email3} and enter ${saved.connection.userCode}. Approve only the request you started.
+`);
+    return connectionView(apiUrl, saved);
+  }
+  let claim;
+  if (saved?.claimToken && saved.anonymous) {
+    try {
+      const result = await request(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
+      claim = result.claim_attempt;
+    } catch (error51) {
+      if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
+    }
+  }
+  if (!claim) {
+    await save(apiUrl, saved ?? { version: 1, anonymous: true });
+    const result = await request(apiUrl, "/agent/identity", { type: "service_auth", login_hint: email3, name: `${hostname()} \xB7 ${process.platform}` });
+    saved = { version: 1, anonymous: true, claimToken: result.claim_token };
+    await save(apiUrl, saved);
+    claim = result.claim;
+  }
+  process.stderr.write(`Open ${claim.verification_uri}
+Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
+`);
+  saved = { ...saved, connection: {
+    id: randomBytes(16).toString("hex"),
+    email: email3,
+    verificationUri: claim.verification_uri,
+    userCode: claim.user_code,
+    expiresAt: Date.now() + claim.expires_in * 1e3,
+    interval: claim.interval,
+    nextPollAt: Date.now() + claim.interval * 1e3,
+    status: "pending"
+  } };
+  await save(apiUrl, saved);
+  return connectionView(apiUrl, saved);
+}
+function connectionView(apiUrl, saved) {
+  const connection = saved.connection;
+  return {
+    status: connection.status,
+    authorizationId: connection.id,
+    apiUrl,
+    expiresAt: connection.status === "authenticated" ? saved.assertionExpires : new Date(connection.expiresAt).toISOString(),
+    retryAfterSeconds: connection.status === "pending" ? Math.max(0, Math.ceil((connection.nextPollAt - Date.now()) / 1e3)) : 0,
+    ...connection.status === "pending" ? {
+      verificationUri: connection.verificationUri,
+      userCode: connection.userCode,
+      nextCommand: cliCommand(apiUrl, "connect", "status", connection.id)
+    } : connection.status === "authenticated" ? {} : { nextCommand: cliCommand(apiUrl, "connect", "--email", connection.email) }
+  };
+}
+async function pollConnection(apiUrl, authorizationId) {
+  return withAuthorizationLock(apiUrl, () => pollSavedConnection(apiUrl, authorizationId));
+}
+async function pollSavedConnection(apiUrl, authorizationId) {
+  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before polling a local connection.");
+  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  if (!saved?.connection || saved.connection.id !== authorizationId) throw new AgentAuthError("authorization_not_found", "No matching saved connection for this API URL. Use the latest connect response.");
+  const connection = saved.connection;
+  if (connection.status !== "pending") return connectionView(apiUrl, saved);
+  if (Date.now() >= connection.expiresAt) {
+    connection.status = "expired";
+    await save(apiUrl, saved);
+    return connectionView(apiUrl, saved);
+  }
+  if (Date.now() < connection.nextPollAt) return connectionView(apiUrl, saved);
+  connection.nextPollAt = Date.now() + connection.interval * 1e3;
+  await save(apiUrl, saved);
+  try {
+    const tokens = await request(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
+    saved = withTokens({ version: 1, anonymous: false, connection: { ...connection, status: "authenticated", userCode: "" } }, tokens);
+  } catch (error51) {
+    if (!(error51 instanceof AgentAuthError)) throw error51;
+    if (error51.code === "expired_token" || error51.code === "claim_expired") connection.status = "expired";
+    else if (error51.code === "access_denied" || error51.code === "claim_revoked") connection.status = "denied";
+    else if (error51.code === "slow_down") {
+      connection.interval += 5;
+      connection.nextPollAt = Date.now() + connection.interval * 1e3;
+    } else if (error51.code !== "authorization_pending") throw error51;
+  }
+  await save(apiUrl, saved);
+  return connectionView(apiUrl, saved);
+}
+
+// src/keychain.ts
+import { spawn } from "child_process";
+var service = "rill";
+async function saveCredential(apiUrl, token) {
+  if (process.platform === "darwin") {
+    await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
+    return;
+  }
+  if (process.platform === "linux") {
+    await run("secret-tool", ["store", "--label=Rill agent credential", "service", service, "api-url", apiUrl], token);
+    return;
+  }
+  throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
+}
+function loadCredential(apiUrl) {
+  return loadAgentCredential(apiUrl);
+}
+async function loadStoredCredential(apiUrl) {
+  try {
+    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
+    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
+  } catch (error51) {
+    const code = error51.exitCode;
+    if (process.platform === "darwin" && code === 44) return null;
+    if (process.platform === "linux" && code === 1 && !error51.message.trim()) return null;
+    throw new Error("Cannot read the OS credential store. Unlock your keychain or enable Secret Service; your identity has not been replaced.");
+  }
+  throw new Error("Local authorization requires macOS Keychain or Linux Secret Service.");
+}
+function run(command, args, input) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+    child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(Object.assign(new Error(Buffer.concat(stderr).toString("utf8").trim()), { exitCode: code })));
+    if (input) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+
+// src/control-plane.ts
+import { createReadStream } from "fs";
+import { readFile, stat as stat2 } from "fs/promises";
+import { Upload } from "tus-js-client";
+var ControlPlaneError = class extends Error {
+  constructor(code, message, recovery, details, httpStatus) {
+    super(`${code}: ${message}${recovery ? `: ${recovery}` : ""}`);
+    this.code = code;
+    this.recovery = recovery;
+    this.details = details;
+    this.httpStatus = httpStatus;
+    this.name = "ControlPlaneError";
+  }
+};
+var ControlPlaneHttpError = class extends Error {
+  constructor(httpStatus) {
+    super(`Request failed (${httpStatus}).`);
+    this.httpStatus = httpStatus;
+    this.name = "ControlPlaneHttpError";
+  }
+};
+var ControlPlaneClient = class {
+  constructor(apiUrl, token) {
+    this.apiUrl = apiUrl;
+    this.token = token;
+  }
+  recordingStatusCommand(id) {
+    return cliCommand(this.apiUrl, "record", "status", id);
+  }
+  encodingCapabilities() {
+    return this.request("/api/encoding/capabilities");
+  }
+  beginEncoding(id, manifest) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}`, { method: "POST", body: JSON.stringify(manifest) });
+  }
+  encodingStatus(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}`);
+  }
+  uploadEncodingPart(id, part, bytes) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/parts/${part}`, { method: "PUT", headers: { "Content-Type": "application/octet-stream", "Content-Length": String(bytes.length) }, body: new Uint8Array(bytes), signal: AbortSignal.timeout(12e4) });
+  }
+  completeEncoding(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/complete`, { method: "POST" });
+  }
+  retryEncoding(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/retry`, { method: "POST" });
+  }
+  createCloudRun(input) {
+    return this.request("/api/cloud/runs", { method: "POST", body: JSON.stringify(input) });
+  }
+  cloudRun(id) {
+    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}`);
+  }
+  cancelCloudRun(id) {
+    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
+  }
+  health() {
+    return this.request("/api/health", {}, false);
+  }
+  agentSession() {
+    return this.request("/api/agent/session", { signal: AbortSignal.timeout(5e3) });
+  }
+  reportCliCommand(input) {
+    return this.request("/api/analytics/cli-command", { method: "POST", body: JSON.stringify(input) });
+  }
+  createRecording(input) {
+    return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
+  }
+  markRecordingStarted(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/local-started`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  markRecordingStopped(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/local-stopped`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  submitRecordingFeedback(recordingId, input) {
+    return this.request(recordingId ? `/api/recordings/${recordingId}/feedback` : "/api/feedback", {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  provisionVideo(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/video-upload`, { method: "POST", body: JSON.stringify(input) });
+  }
+  recordingStatus(recordingId) {
+    return this.request(`/api/recordings/${recordingId}`);
+  }
+  cancelRecording(recordingId, reason = "cancelled_by_agent") {
+    return this.request(`/api/recordings/${recordingId}/cancel`, {
+      method: "POST",
+      body: JSON.stringify({ reason })
+    });
+  }
+  async waitUntilPlayable(recordingId, timeoutMs = 10 * 6e4) {
+    const deadline = Date.now() + timeoutMs;
+    let intervalMs = 1e3;
+    while (Date.now() < deadline) {
+      const recording = await this.recordingStatus(recordingId);
+      if (recording.status === "ready" && recording.shareUrl) {
+        return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
+      }
+      if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
+      process.stderr.write("\rUpload complete; waiting for playable video.          ");
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
+    }
+    throw new ControlPlaneError("processing_pending", "Upload complete; the recording is not playable yet.", `Run ${cliCommand(this.apiUrl, "record", "status", recordingId)} to continue checking.`, { recordingId, nextCommand: cliCommand(this.apiUrl, "record", "status", recordingId) });
+  }
+  async uploadVideo(uploadUrl, filePath) {
+    const file2 = await stat2(filePath);
+    if (uploadUrl.startsWith(this.apiUrl)) {
+      const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
+      if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
+      process.stderr.write("Upload complete; playback processing may continue.\n");
+      return;
+    }
+    await new Promise((resolve, reject) => {
+      const upload = new Upload(createReadStream(filePath), {
+        uploadUrl,
+        uploadSize: file2.size,
+        retryDelays: [0, 1e3, 3e3, 5e3, 1e4],
+        removeFingerprintOnSuccess: true,
+        onError: reject,
+        onSuccess: () => resolve(),
+        onProgress: (sent, total) => process.stderr.write(`\ruploading ${Math.round(sent / total * 100)}%`)
+      });
+      upload.start();
+    });
+    process.stderr.write("\nUpload complete; playback processing may continue.\n");
+  }
+  async uploadDiagnostics(recordingId, filePath, summary) {
+    const body = await readFile(filePath);
+    return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
+  }
+  listRecordings() {
+    return this.request("/api/recordings");
+  }
+  createDeviceAuthorization(input) {
+    return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
+  }
+  pollDeviceAuthorization(deviceCode) {
+    return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
+  }
+  inspect(shareUrl, cursor) {
+    if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
+    const url2 = new URL(shareUrl);
+    const slug = url2.pathname.split("/").filter(Boolean).at(-1);
+    if (!slug) throw new Error("The share URL does not contain a slug.");
+    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`, { headers: { Accept: "application/json" } }).then(async (response) => {
+      if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
+      return response.json();
+    });
+  }
+  reviewPath(shareUrl) {
+    const url2 = new URL(shareUrl);
+    if (url2.origin !== new URL(this.apiUrl).origin) throw new Error("The share URL must match --api-url before sending agent credentials.");
+    const match = /^\/s\/([^/]+)\/?$/.exec(url2.pathname);
+    if (!match) throw new Error("Expected a Rill /s/<slug> review link.");
+    return `/api/review/shares/${encodeURIComponent(decodeURIComponent(match[1]))}`;
+  }
+  reply(shareUrl, discussionId, body, requestId) {
+    return this.request(`${this.reviewPath(shareUrl)}/discussions/${encodeURIComponent(discussionId)}/replies`, { method: "POST", body: JSON.stringify({ body, requestId }) });
+  }
+  editReply(shareUrl, commentId, body) {
+    return this.request(`${this.reviewPath(shareUrl)}/comments/${encodeURIComponent(commentId)}`, { method: "PATCH", body: JSON.stringify({ body }) });
+  }
+  async request(path, init = {}, authenticated = true) {
+    const headers = new Headers(init.headers);
+    if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+    if (authenticated) {
+      const token = typeof this.token === "function" ? await this.token() : this.token;
+      if (!token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
+    const value = await response.json().catch(() => null);
+    if (!response.ok && value?.error?.code && value.error.message) {
+      const quota = value.error.details?.quota;
+      const blockingId = quota?.blockingRecordingId;
+      const concurrency = quota?.type === "credential_concurrency" || quota?.type === "workspace_concurrency";
+      const recovery = value.error.code === "quota_exceeded" && concurrency && blockingId ? `Run ${cliCommand(this.apiUrl, "record", "status", blockingId)}. Uploading and processing recordings hold a concurrency slot: wait for ready. If captured locally, run record stop to upload. Cancel only an abandoned recording.` : value.error.recovery;
+      throw new ControlPlaneError(value.error.code, value.error.message, recovery, value.error.details, response.status);
+    }
+    if (!response.ok) throw new ControlPlaneHttpError(response.status);
+    return value;
+  }
+};
+
+// src/whoami.ts
+async function whoami(apiUrl) {
+  const token = await loadCredential(apiUrl);
+  if (!token) return { schemaVersion: 1, status: "not_connected", authenticated: false, apiUrl };
+  const session = await new ControlPlaneClient(apiUrl, token).agentSession();
+  return {
+    schemaVersion: 1,
+    status: session.anonymous ? "anonymous" : "connected",
+    authenticated: true,
+    apiUrl,
+    anonymous: Boolean(session.anonymous),
+    email: session.email ?? null,
+    workspaceId: session.workspaceId ?? null,
+    scopes: session.scopes,
+    expiresAt: session.expiresAt
+  };
+}
+
 // src/remote-encoding.ts
 import { open, readFile as readFile2 } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -142,7 +636,7 @@ __export(external_exports, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   includes: () => _includes,
   instanceof: () => _instanceof,
@@ -1553,7 +2047,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   html5Email: () => html5Email,
   httpProtocol: () => httpProtocol,
   idnEmail: () => idnEmail,
@@ -1631,7 +2125,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
@@ -12503,7 +12997,7 @@ __export(schemas_exports2, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -13123,7 +13617,7 @@ var ZodCustomStringFormat = /* @__PURE__ */ $constructor("ZodCustomStringFormat"
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -14464,251 +14958,79 @@ function convertSchema(schema, ctx) {
       extraMeta[key] = schema[key];
     }
   }
-  if (Object.keys(extraMeta).length > 0) {
-    ctx.registry.add(baseSchema, extraMeta);
-  }
-  if (schema.description) {
-    baseSchema = baseSchema.describe(schema.description);
-  }
-  return baseSchema;
-}
-function fromJSONSchema(schema, params) {
-  if (typeof schema === "boolean") {
-    return schema ? z.any() : z.never();
-  }
-  let normalized;
-  try {
-    normalized = JSON.parse(JSON.stringify(schema));
-  } catch {
-    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
-  }
-  const version2 = detectVersion(normalized, params?.defaultTarget);
-  const defs = normalized.$defs || normalized.definitions || {};
-  const ctx = {
-    version: version2,
-    defs,
-    refs: /* @__PURE__ */ new Map(),
-    processing: /* @__PURE__ */ new Set(),
-    rootSchema: normalized,
-    registry: params?.registry ?? globalRegistry
-  };
-  return convertSchema(normalized, ctx);
-}
-
-// ../../node_modules/zod/v4/classic/coerce.js
-var coerce_exports = {};
-__export(coerce_exports, {
-  bigint: () => bigint3,
-  boolean: () => boolean3,
-  date: () => date4,
-  number: () => number3,
-  string: () => string3
-});
-function string3(params) {
-  return _coercedString(ZodString, params);
-}
-function number3(params) {
-  return _coercedNumber(ZodNumber, params);
-}
-function boolean3(params) {
-  return _coercedBoolean(ZodBoolean, params);
-}
-function bigint3(params) {
-  return _coercedBigint(ZodBigInt, params);
-}
-function date4(params) {
-  return _coercedDate(ZodDate, params);
-}
-
-// ../../node_modules/zod/v4/classic/external.js
-config(en_default());
-
-// ../contracts/src/encoding.ts
-var ENCODING_PART_BYTES = 4 * 1024 * 1024;
-var ENCODING_MAX_BYTES = 1024 * 1024 * 1024;
-var frameManifestSchema = external_exports.object({
-  version: external_exports.literal(1),
-  durationSeconds: external_exports.number().positive().max(600),
-  width: external_exports.number().int().min(320).max(3840),
-  height: external_exports.number().int().min(240).max(2160),
-  frames: external_exports.array(external_exports.object({ timestamp: external_exports.number().nonnegative().finite(), size: external_exports.number().int().positive().max(ENCODING_PART_BYTES) }).strict()).min(1).max(36e3)
-}).strict().superRefine((m, ctx) => {
-  if (m.frames.reduce((n, f) => n + f.size, 0) > ENCODING_MAX_BYTES) ctx.addIssue({ code: "custom", message: "Frame upload exceeds the trial byte limit." });
-  for (let i = 1; i < m.frames.length; i++) if (m.frames[i].timestamp < m.frames[i - 1].timestamp) ctx.addIssue({ code: "custom", message: "Frame timestamps must be ordered." });
-  if (m.frames.at(-1).timestamp - m.frames[0].timestamp > m.durationSeconds + 1) ctx.addIssue({ code: "custom", message: "Frame timestamps exceed capture duration." });
-});
-
-// src/control-plane.ts
-import { createReadStream } from "fs";
-import { readFile, stat } from "fs/promises";
-import { Upload } from "tus-js-client";
-var ControlPlaneError = class extends Error {
-  constructor(code, message, recovery, details, httpStatus) {
-    super(`${code}: ${message}${recovery ? `: ${recovery}` : ""}`);
-    this.code = code;
-    this.recovery = recovery;
-    this.details = details;
-    this.httpStatus = httpStatus;
-    this.name = "ControlPlaneError";
-  }
-};
-var ControlPlaneHttpError = class extends Error {
-  constructor(httpStatus) {
-    super(`Request failed (${httpStatus}).`);
-    this.httpStatus = httpStatus;
-    this.name = "ControlPlaneHttpError";
-  }
-};
-var ControlPlaneClient = class {
-  constructor(apiUrl, token) {
-    this.apiUrl = apiUrl;
-    this.token = token;
-  }
-  encodingCapabilities() {
-    return this.request("/api/encoding/capabilities");
-  }
-  beginEncoding(id, manifest) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}`, { method: "POST", body: JSON.stringify(manifest) });
-  }
-  encodingStatus(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}`);
-  }
-  uploadEncodingPart(id, part, bytes) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/parts/${part}`, { method: "PUT", headers: { "Content-Type": "application/octet-stream", "Content-Length": String(bytes.length) }, body: new Uint8Array(bytes), signal: AbortSignal.timeout(12e4) });
-  }
-  completeEncoding(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/complete`, { method: "POST" });
-  }
-  retryEncoding(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/retry`, { method: "POST" });
-  }
-  createCloudRun(input) {
-    return this.request("/api/cloud/runs", { method: "POST", body: JSON.stringify(input) });
-  }
-  cloudRun(id) {
-    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}`);
-  }
-  cancelCloudRun(id) {
-    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
-  }
-  health() {
-    return this.request("/api/health", {}, false);
-  }
-  agentSession() {
-    return this.request("/api/agent/session", { signal: AbortSignal.timeout(5e3) });
-  }
-  reportCliCommand(input) {
-    return this.request("/api/analytics/cli-command", { method: "POST", body: JSON.stringify(input) });
-  }
-  createRecording(input) {
-    return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
-  }
-  markRecordingStarted(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/local-started`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  markRecordingStopped(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/local-stopped`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  submitRecordingFeedback(recordingId, input) {
-    return this.request(recordingId ? `/api/recordings/${recordingId}/feedback` : "/api/feedback", {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  provisionVideo(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/video-upload`, { method: "POST", body: JSON.stringify(input) });
-  }
-  recordingStatus(recordingId) {
-    return this.request(`/api/recordings/${recordingId}`);
-  }
-  cancelRecording(recordingId, reason = "cancelled_by_agent") {
-    return this.request(`/api/recordings/${recordingId}/cancel`, {
-      method: "POST",
-      body: JSON.stringify({ reason })
-    });
-  }
-  async waitUntilPlayable(recordingId, timeoutMs = 10 * 6e4) {
-    const deadline = Date.now() + timeoutMs;
-    let intervalMs = 1e3;
-    while (Date.now() < deadline) {
-      const recording = await this.recordingStatus(recordingId);
-      if (recording.status === "ready" && recording.shareUrl) {
-        return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
-      }
-      if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
-      process.stderr.write(`\rprocessing ${recording.status.padEnd(12)}`);
-      await new Promise((resolve) => setTimeout(resolve, intervalMs));
-      intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
-    }
-    throw new Error("processing_failed: Timed out waiting for the recording to become playable. Run `rill record status <recording-id>` to continue checking.");
-  }
-  async uploadVideo(uploadUrl, filePath) {
-    const file2 = await stat(filePath);
-    if (uploadUrl.startsWith(this.apiUrl)) {
-      const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
-      if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
-      return;
-    }
-    await new Promise((resolve, reject) => {
-      const upload = new Upload(createReadStream(filePath), {
-        uploadUrl,
-        uploadSize: file2.size,
-        retryDelays: [0, 1e3, 3e3, 5e3, 1e4],
-        removeFingerprintOnSuccess: true,
-        onError: reject,
-        onSuccess: () => resolve(),
-        onProgress: (sent, total) => process.stderr.write(`\ruploading ${Math.round(sent / total * 100)}%`)
-      });
-      upload.start();
-    });
-    process.stderr.write("\n");
-  }
-  async uploadDiagnostics(recordingId, filePath, summary) {
-    const body = await readFile(filePath);
-    return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
-  }
-  listRecordings() {
-    return this.request("/api/recordings");
-  }
-  createDeviceAuthorization(input) {
-    return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
-  }
-  pollDeviceAuthorization(deviceCode) {
-    return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
-  }
-  inspect(shareUrl) {
-    if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
-    const url2 = new URL(shareUrl);
-    const slug = url2.pathname.split("/").filter(Boolean).at(-1);
-    if (!slug) throw new Error("The share URL does not contain a slug.");
-    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context`, { headers: { Accept: "application/json" } }).then(async (response) => {
-      if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
-      return response.json();
-    });
-  }
-  async request(path, init = {}, authenticated = true) {
-    const headers = new Headers(init.headers);
-    if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-    if (authenticated) {
-      const token = typeof this.token === "function" ? await this.token() : this.token;
-      if (!token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
-      headers.set("Authorization", `Bearer ${token}`);
-    }
-    const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
-    const value = await response.json().catch(() => null);
-    if (!response.ok && value?.error?.code && value.error.message) {
-      throw new ControlPlaneError(value.error.code, value.error.message, value.error.recovery, value.error.details, response.status);
-    }
-    if (!response.ok) throw new ControlPlaneHttpError(response.status);
-    return value;
+  if (Object.keys(extraMeta).length > 0) {
+    ctx.registry.add(baseSchema, extraMeta);
   }
-};
+  if (schema.description) {
+    baseSchema = baseSchema.describe(schema.description);
+  }
+  return baseSchema;
+}
+function fromJSONSchema(schema, params) {
+  if (typeof schema === "boolean") {
+    return schema ? z.any() : z.never();
+  }
+  let normalized;
+  try {
+    normalized = JSON.parse(JSON.stringify(schema));
+  } catch {
+    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
+  }
+  const version2 = detectVersion(normalized, params?.defaultTarget);
+  const defs = normalized.$defs || normalized.definitions || {};
+  const ctx = {
+    version: version2,
+    defs,
+    refs: /* @__PURE__ */ new Map(),
+    processing: /* @__PURE__ */ new Set(),
+    rootSchema: normalized,
+    registry: params?.registry ?? globalRegistry
+  };
+  return convertSchema(normalized, ctx);
+}
+
+// ../../node_modules/zod/v4/classic/coerce.js
+var coerce_exports = {};
+__export(coerce_exports, {
+  bigint: () => bigint3,
+  boolean: () => boolean3,
+  date: () => date4,
+  number: () => number3,
+  string: () => string3
+});
+function string3(params) {
+  return _coercedString(ZodString, params);
+}
+function number3(params) {
+  return _coercedNumber(ZodNumber, params);
+}
+function boolean3(params) {
+  return _coercedBoolean(ZodBoolean, params);
+}
+function bigint3(params) {
+  return _coercedBigint(ZodBigInt, params);
+}
+function date4(params) {
+  return _coercedDate(ZodDate, params);
+}
+
+// ../../node_modules/zod/v4/classic/external.js
+config(en_default());
+
+// ../contracts/src/encoding.ts
+var ENCODING_PART_BYTES = 4 * 1024 * 1024;
+var ENCODING_MAX_BYTES = 1024 * 1024 * 1024;
+var frameManifestSchema = external_exports.object({
+  version: external_exports.literal(1),
+  durationSeconds: external_exports.number().positive().max(600),
+  width: external_exports.number().int().min(320).max(3840),
+  height: external_exports.number().int().min(240).max(2160),
+  frames: external_exports.array(external_exports.object({ timestamp: external_exports.number().nonnegative().finite(), size: external_exports.number().int().positive().max(ENCODING_PART_BYTES) }).strict()).min(1).max(36e3)
+}).strict().superRefine((m, ctx) => {
+  if (m.frames.reduce((n, f) => n + f.size, 0) > ENCODING_MAX_BYTES) ctx.addIssue({ code: "custom", message: "Frame upload exceeds the trial byte limit." });
+  for (let i = 1; i < m.frames.length; i++) if (m.frames[i].timestamp < m.frames[i - 1].timestamp) ctx.addIssue({ code: "custom", message: "Frame timestamps must be ordered." });
+  if (m.frames.at(-1).timestamp - m.frames[0].timestamp > m.durationSeconds + 1) ctx.addIssue({ code: "custom", message: "Frame timestamps exceed capture duration." });
+});
 
 // src/remote-encoding.ts
 async function withFrameUploadRetry(upload, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
@@ -14728,14 +15050,14 @@ Frame upload interrupted; retrying in ${delay / 1e3}s.
   }
 }
 async function submitFrameCapture(client, id, directory) {
-  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join(directory, "capture-manifest.json"), "utf8")));
+  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join2(directory, "capture-manifest.json"), "utf8")));
   let status = await client.beginEncoding(id, manifest);
   if (status.status === "failed") status = await client.retryEncoding(id);
   if (status.status !== "uploading") {
     if (["expired", "cancelled"].includes(status.status)) throw new Error(`Capture ${status.status}; it cannot be retried.`);
     return status;
   }
-  const file2 = await open(join(directory, "frames.bin"), "r");
+  const file2 = await open(join2(directory, "frames.bin"), "r");
   try {
     const total = manifest.frames.reduce((n, f) => n + f.size, 0);
     if ((await file2.stat()).size !== total) throw new Error("Capture bytes do not match the manifest.");
@@ -14755,6 +15077,7 @@ async function submitFrameCapture(client, id, directory) {
   } finally {
     await file2.close();
   }
+  process.stderr.write("\nFrame upload complete; submitting for encoding.\n");
   return client.completeEncoding(id);
 }
 async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
@@ -14766,7 +15089,7 @@ async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
     process.stderr.write(`\r${status.status.padEnd(20)}`);
     await new Promise((r) => setTimeout(r, 2e3));
   }
-  throw new Error(`Encoding continues remotely. Check rill record status ${id}.`);
+  throw new ControlPlaneError("processing_pending", "Encoding continues remotely.", `Run ${client.recordingStatusCommand(id)}.`, { recordingId: id, nextCommand: client.recordingStatusCommand(id) });
 }
 
 // src/cli.ts
@@ -14777,16 +15100,16 @@ import { basename, dirname as dirname2 } from "path";
 import { readdir as readdir2, rm as rm5, stat as stat4 } from "fs/promises";
 
 // ../recorder/src/client.ts
-import { request } from "http";
-import { spawn } from "child_process";
+import { request as request2 } from "http";
+import { spawn as spawn2 } from "child_process";
 
 // ../recorder/src/paths.ts
-import { homedir, tmpdir } from "os";
-import { join as join2 } from "path";
-var rillDirectory = () => process.env.RILL_HOME ?? join2(homedir(), ".rill");
-var daemonSocketPath = () => process.env.RILL_SOCKET ?? join2(rillDirectory(), "recorder-v2.sock");
-var daemonStatePath = () => join2(rillDirectory(), "sessions-v2.json");
-var recordingTempRoot = () => process.env.RILL_TEMP ?? join2(tmpdir(), "rill-recordings");
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join3 } from "path";
+var rillDirectory = () => process.env.RILL_HOME ?? join3(homedir2(), ".rill");
+var daemonSocketPath = () => process.env.RILL_SOCKET ?? join3(rillDirectory(), "recorder-v2.sock");
+var daemonStatePath = () => join3(rillDirectory(), "sessions-v2.json");
+var recordingTempRoot = () => process.env.RILL_TEMP ?? join3(tmpdir(), "rill-recordings");
 
 // ../recorder/src/client.ts
 async function ensureDaemon(cliEntryPath) {
@@ -14795,7 +15118,7 @@ async function ensureDaemon(cliEntryPath) {
     return;
   } catch {
   }
-  const child = spawn(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
+  const child = spawn2(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
   child.unref();
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline) {
@@ -14820,7 +15143,7 @@ function recordingStatus(recordingId) {
 function callDaemon(method, path, body) {
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
-    const outgoing = request({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
+    const outgoing = request2({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
       const chunks = [];
       incoming.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
       incoming.on("end", () => {
@@ -14840,17 +15163,17 @@ function callDaemon(method, path, body) {
 }
 
 // ../recorder/src/retention.ts
-import { readdir, readFile as readFile3, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { readdir, readFile as readFile3, rm as rm2 } from "fs/promises";
+import { join as join4 } from "path";
 async function purgeExpiredRemoteCaptures(root, now = Date.now()) {
   const removed = [];
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
-    const directory = join3(root, id);
+    const directory = join4(root, id);
     try {
-      const marker = JSON.parse(await readFile3(join3(directory, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile3(join4(directory, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt !== "number" || marker.expiresAt > now) continue;
-      await rm(directory, { recursive: true, force: true });
+      await rm2(directory, { recursive: true, force: true });
       removed.push(id);
     } catch {
     }
@@ -14861,7 +15184,7 @@ async function hasRetainedRemoteCaptures(root) {
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
     try {
-      const marker = JSON.parse(await readFile3(join3(root, id, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile3(join4(root, id, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt === "number" && Number.isFinite(marker.expiresAt)) return true;
     } catch {
     }
@@ -14871,8 +15194,8 @@ async function hasRetainedRemoteCaptures(root) {
 
 // ../recorder/src/daemon.ts
 import { createServer as createServer2 } from "http";
-import { mkdir as mkdir4, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat2 } from "fs/promises";
-import { dirname, join as join7 } from "path";
+import { mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat3 } from "fs/promises";
+import { dirname, join as join8 } from "path";
 
 // ../contracts/src/recording.ts
 var cursorAppearanceSchema = external_exports.object({
@@ -15033,10 +15356,10 @@ async function attachCursorOverlay(page, cdp, input) {
 
 // ../recorder/src/session.ts
 import { chromium } from "playwright-core";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { createServer } from "net";
-import { mkdir as mkdir3, mkdtemp, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join6 } from "path";
+import { mkdir as mkdir4, mkdtemp, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { join as join7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // ../recorder/src/bundle.ts
@@ -15116,9 +15439,9 @@ function redactJson(value, depth = 0) {
 }
 
 // ../recorder/src/encoding.ts
-import { open as open2, writeFile, mkdir } from "fs/promises";
-import { spawn as spawn2 } from "child_process";
-import { join as join4 } from "path";
+import { open as open2, writeFile, mkdir as mkdir2 } from "fs/promises";
+import { spawn as spawn3 } from "child_process";
+import { join as join5 } from "path";
 var active = 0;
 var waiting = [];
 function encodingConcurrency() {
@@ -15148,11 +15471,11 @@ async function encodeFrames(directory, manifest, output, signal) {
       lines.push(`file 'frame-${String(i).padStart(6, "0")}.jpg'`, `duration ${Math.max(1 / 60, duration3).toFixed(6)}`);
     }
     lines.push(`file 'frame-${String(manifest.frames.length - 1).padStart(6, "0")}.jpg'`);
-    await writeFile(join4(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
+    await writeFile(join5(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
     const threads = Number(process.env.RILL_FFMPEG_THREADS ?? 1);
     if (!Number.isInteger(threads) || threads < 1 || threads > 16) throw new Error("Invalid RILL_FFMPEG_THREADS");
     await new Promise((resolve, reject) => {
-      const child = spawn2(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
+      const child = spawn3(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
       let stderr = "";
       child.stderr.on("data", (chunk) => {
         stderr = (stderr + String(chunk)).slice(-2e3);
@@ -15177,8 +15500,8 @@ async function encodeFrames(directory, manifest, output, signal) {
 }
 
 // ../recorder/src/screencast.ts
-import { mkdir as mkdir2, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
+import { join as join6 } from "path";
 var ScreencastRecorder = class {
   constructor(session, directory, width, height) {
     this.session = session;
@@ -15193,7 +15516,7 @@ var ScreencastRecorder = class {
   frameBytes = 0;
   captureError;
   async start() {
-    await mkdir2(this.directory, { recursive: true, mode: 448 });
+    await mkdir3(this.directory, { recursive: true, mode: 448 });
     this.session.on("Page.screencastFrame", (payload) => {
       const bytes = Buffer.from(payload.data, "base64");
       if (this.frameCounter >= 36e3 || this.frameBytes + bytes.length > ENCODING_MAX_BYTES || bytes.length > ENCODING_PART_BYTES) {
@@ -15202,7 +15525,7 @@ var ScreencastRecorder = class {
         return;
       }
       this.frameBytes += bytes.length;
-      const path = join5(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
+      const path = join6(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
       this.frameCounter += 1;
       const write = writeFile2(path, bytes, { mode: 384 }).then(() => {
         this.frames.push({ path, timestamp: payload.metadata.timestamp ?? Date.now() / 1e3 });
@@ -15226,7 +15549,7 @@ var ScreencastRecorder = class {
     if (!this.frames.length) throw new Error("No video frames were captured.");
     const ordered = this.frames.toSorted((a, b) => a.timestamp - b.timestamp);
     const frames = [];
-    const bundle = await open3(join5(this.directory, "frames.bin"), "w", 384);
+    const bundle = await open3(join6(this.directory, "frames.bin"), "w", 384);
     try {
       for (const frame of ordered) {
         const bytes = await readFile4(frame.path);
@@ -15237,7 +15560,7 @@ var ScreencastRecorder = class {
       await bundle.close();
     }
     const manifest = frameManifestSchema.parse({ version: 1, durationSeconds: Math.min(600, expectedDurationSeconds), width: this.width, height: this.height, frames });
-    await writeFile2(join5(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
+    await writeFile2(join6(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
     if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath);
     return { frameCount: this.frames.length, outputPath };
   }
@@ -15286,11 +15609,11 @@ var RecordingSession = class _RecordingSession {
   static async start(options) {
     const width = options.width ?? 1280;
     const height = options.height ?? 720;
-    await mkdir3(options.outputDirectory, { recursive: true, mode: 448 });
-    if (options.encoding === "remote") await writeFile3(join6(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
+    await mkdir4(options.outputDirectory, { recursive: true, mode: 448 });
+    if (options.encoding === "remote") await writeFile3(join7(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
     const runtime = options.cdpUrl ? await connectAttached(options.cdpUrl, options.outputDirectory) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer });
     const cdpSession = await runtime.context.newCDPSession(runtime.page);
-    const screencast = new ScreencastRecorder(cdpSession, join6(options.outputDirectory, "frames"), width, height);
+    const screencast = new ScreencastRecorder(cdpSession, join7(options.outputDirectory, "frames"), width, height);
     const session = new _RecordingSession(options, { ...runtime, screencast });
     try {
       await session.attachDiagnostics(options.captureNetworkBodies ?? false);
@@ -15322,8 +15645,8 @@ var RecordingSession = class _RecordingSession {
     if (this.maxTimer) clearTimeout(this.maxTimer);
     const durationSeconds = Math.max(0.1, (Date.now() - this.startedAt.getTime()) / 1e3);
     const outputDirectory = this.outputDirectory;
-    const videoPath = join6(outputDirectory, "recording.webm");
-    const diagnosticsPath = join6(outputDirectory, "diagnostics-v1.ndjson.gz");
+    const videoPath = join7(outputDirectory, "recording.webm");
+    const diagnosticsPath = join7(outputDirectory, "diagnostics-v1.ndjson.gz");
     const bundle = {
       schemaVersion: 1,
       capturePolicyVersion: "safe-default-v1",
@@ -15346,13 +15669,13 @@ var RecordingSession = class _RecordingSession {
       if (this.browserProcess) {
         await this.browser.close().catch(() => void 0);
         await terminateBrowser(this.browserProcess);
-        if (this.profileDirectory) await rm2(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+        if (this.profileDirectory) await rm3(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
       }
     }
     const consoleErrors = this.consoleEvents.filter((event) => event.severity === "error").length;
     const failedRequests = this.networkEvents.filter((event) => event.failureReason).length;
     const httpErrors = this.networkEvents.filter((event) => (event.status ?? 0) >= 400).length;
-    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join6(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
+    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join7(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
   }
   captureNetworkBodies = false;
   encoding = "local";
@@ -15464,7 +15787,7 @@ var RecordingSession = class _RecordingSession {
 };
 async function launchManaged(options) {
   const port = await getAvailablePort();
-  const profileDirectory = await mkdtemp(join6(tmpdir2(), "rill-chrome-"));
+  const profileDirectory = await mkdtemp(join7(tmpdir2(), "rill-chrome-"));
   const executable = findChromeExecutable();
   const args = [
     `--remote-debugging-port=${port}`,
@@ -15482,7 +15805,7 @@ async function launchManaged(options) {
     "about:blank"
   ];
   const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key))) : process.env;
-  const browserProcess = spawn3(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
+  const browserProcess = spawn4(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
   const cdpUrl = `http://127.0.0.1:${port}`;
   try {
     await waitForCdp(cdpUrl, browserProcess);
@@ -15493,7 +15816,7 @@ async function launchManaged(options) {
     return { cdpUrl, browser, context, page, browserProcess, profileDirectory };
   } catch (error51) {
     await terminateBrowser(browserProcess);
-    await rm2(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+    await rm3(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
     throw error51;
   }
 }
@@ -15544,8 +15867,8 @@ var sessions = /* @__PURE__ */ new Map();
 var lastActivity = Date.now();
 async function runDaemon() {
   const socketPath = daemonSocketPath();
-  await mkdir4(dirname(socketPath), { recursive: true, mode: 448 });
-  await mkdir4(recordingTempRoot(), { recursive: true, mode: 448 });
+  await mkdir5(dirname(socketPath), { recursive: true, mode: 448 });
+  await mkdir5(recordingTempRoot(), { recursive: true, mode: 448 });
   await restoreRecoverableSessions();
   await purgeExpiredCaptures();
   await unlink(socketPath).catch((error51) => {
@@ -15579,7 +15902,7 @@ async function route(request3, response) {
     try {
       const input = await readJson(request3);
       if (!/^rec_[a-zA-Z0-9_-]+$/.test(input.recordingId)) return json2(response, 400, { error: { code: "validation_failed", message: "recordingId is required." } });
-      const outputDirectory = join7(recordingTempRoot(), input.recordingId);
+      const outputDirectory = join8(recordingTempRoot(), input.recordingId);
       const session = await RecordingSession.start({ ...input, outputDirectory });
       const status = session.status();
       const entry = { session, base: { recordingId: status.recordingId, cdpUrl: status.cdpUrl, startedAt: status.startedAt }, state: "recording" };
@@ -15657,7 +15980,7 @@ async function purgeExpiredCaptures() {
   const removed = await purgeExpiredRemoteCaptures(recordingTempRoot());
   for (const id of removed) sessions.delete(id);
   let changed = removed.length > 0;
-  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat2(entry.result.frameDirectory).catch(() => null)) {
+  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat3(entry.result.frameDirectory).catch(() => null)) {
     sessions.delete(id);
     changed = true;
   }
@@ -15694,196 +16017,6 @@ function cliFailureCode(error51) {
   return message.match(/^([a-z][a-z0-9_]{0,79}):/)?.[1] ?? "unexpected_error";
 }
 
-// src/agent-session.ts
-import { hostname as hostname3, homedir as homedir2 } from "os";
-import { mkdir as mkdir5, rm as rm4, stat as stat3 } from "fs/promises";
-import { join as join8 } from "path";
-import { createHash, randomBytes } from "crypto";
-var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
-var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
-var AgentAuthError = class extends Error {
-  constructor(code, message) {
-    super(`${code}: ${message}`);
-    this.code = code;
-  }
-};
-function parseAuthorization(value) {
-  if (!value?.startsWith("{")) return null;
-  const saved = JSON.parse(value);
-  if (saved.version !== 1 || typeof saved.anonymous !== "boolean") throw new Error("Saved Rill authorization is invalid. Run rill connect --email <your-email>.");
-  return saved;
-}
-async function request2(apiUrl, path, body, form = false) {
-  const url2 = new URL(apiUrl);
-  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)) throw new Error("Agent authentication requires HTTPS.");
-  const response = await fetch(`${apiUrl}${path}`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(15e3),
-    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
-    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
-  });
-  const value = await response.json();
-  if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
-  return value;
-}
-function withTokens(saved, tokens) {
-  return {
-    ...saved,
-    accessToken: tokens.access_token,
-    accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
-    ...tokens.identity_assertion ? { identityAssertion: tokens.identity_assertion, assertionExpires: tokens.assertion_expires } : {}
-  };
-}
-var save = (apiUrl, value) => saveCredential(apiUrl, JSON.stringify(value));
-var pending = /* @__PURE__ */ new Map();
-async function loadAgentCredential(apiUrl) {
-  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
-  const inFlight = pending.get(apiUrl);
-  if (inFlight) return inFlight;
-  const promise2 = (async () => {
-    const raw = await loadStoredCredential(apiUrl);
-    const saved = parseAuthorization(raw);
-    if (!saved) return raw;
-    if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
-    if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
-    if (!saved.identityAssertion) throw new Error("Connection is awaiting approval. Run rill connect --email <your-email>.");
-    const tokens = await request2(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
-    await save(apiUrl, withTokens(saved, tokens));
-    return tokens.access_token;
-  })();
-  pending.set(apiUrl, promise2);
-  try {
-    return await promise2;
-  } finally {
-    pending.delete(apiUrl);
-  }
-}
-async function ensureAnonymousCredential(apiUrl) {
-  const root = join8(homedir2(), ".rill", "auth-locks");
-  await mkdir5(root, { recursive: true, mode: 448 });
-  const lock = join8(root, createHash("sha256").update(apiUrl).digest("hex"));
-  const deadline = Date.now() + 3e4;
-  while (true) {
-    try {
-      await mkdir5(lock, { mode: 448 });
-      break;
-    } catch (error51) {
-      if (error51.code !== "EEXIST") throw error51;
-      const info = await stat3(lock).catch(() => null);
-      if (info && Date.now() - info.mtimeMs > 12e4) {
-        await rm4(lock, { recursive: true, force: true });
-        continue;
-      }
-      if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
-      await new Promise((resolve) => setTimeout(resolve, 200));
-    }
-  }
-  try {
-    return await createAnonymousCredential(apiUrl);
-  } finally {
-    await rm4(lock, { recursive: true, force: true });
-  }
-}
-async function createAnonymousCredential(apiUrl) {
-  const existing = await loadAgentCredential(apiUrl);
-  if (existing) return existing;
-  const stored = parseAuthorization(await loadStoredCredential(apiUrl));
-  const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
-  await save(apiUrl, initial);
-  const registered = await request2(apiUrl, "/agent/identity", { type: "anonymous", analytics_enabled: process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1", registration_token: initial.registrationToken, name: `${hostname3()} \xB7 ${process.platform}` });
-  const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
-  await save(apiUrl, saved);
-  process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
-  return await loadAgentCredential(apiUrl);
-}
-async function connectAgent(apiUrl, email3) {
-  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
-  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
-  let claim;
-  if (saved?.claimToken && saved.anonymous) {
-    try {
-      const result = await request2(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
-      claim = result.claim_attempt;
-    } catch (error51) {
-      if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
-    }
-  }
-  if (!claim) {
-    await save(apiUrl, saved ?? { version: 1, anonymous: true });
-    const result = await request2(apiUrl, "/agent/identity", { type: "service_auth", login_hint: email3, name: `${hostname3()} \xB7 ${process.platform}` });
-    saved = { version: 1, anonymous: true, claimToken: result.claim_token };
-    await save(apiUrl, saved);
-    claim = result.claim;
-  }
-  process.stderr.write(`Open ${claim.verification_uri}
-Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
-`);
-  const deadline = Date.now() + claim.expires_in * 1e3;
-  let interval = claim.interval;
-  while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
-    try {
-      const tokens = await request2(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
-      const connected = withTokens({ version: 1, anonymous: false }, tokens);
-      await save(apiUrl, connected);
-      return { status: "authenticated", expiresAt: connected.assertionExpires, apiUrl };
-    } catch (error51) {
-      if (error51 instanceof AgentAuthError && error51.code === "expired_token") throw new AgentAuthError("expired_token", "The approval attempt expired. Run rill connect again to request a fresh code using the same saved claim token.");
-      if (error51 instanceof AgentAuthError && error51.code === "authorization_pending") continue;
-      if (error51 instanceof AgentAuthError && error51.code === "slow_down") {
-        interval += 5;
-        continue;
-      }
-      throw error51;
-    }
-  }
-  throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again to restart the approval attempt using the same saved claim token.");
-}
-
-// src/keychain.ts
-import { spawn as spawn4 } from "child_process";
-var service = "rill";
-async function saveCredential(apiUrl, token) {
-  if (process.platform === "darwin") {
-    await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
-    return;
-  }
-  if (process.platform === "linux") {
-    await run("secret-tool", ["store", "--label=Rill agent credential", "service", service, "api-url", apiUrl], token);
-    return;
-  }
-  throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
-}
-function loadCredential(apiUrl) {
-  return loadAgentCredential(apiUrl);
-}
-async function loadStoredCredential(apiUrl) {
-  try {
-    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
-    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
-  } catch (error51) {
-    const code = error51.exitCode;
-    if (process.platform === "darwin" && code === 44) return null;
-    if (process.platform === "linux" && code === 1 && !error51.message.trim()) return null;
-    throw new Error("Cannot read the OS credential store. Unlock your keychain or enable Secret Service; your identity has not been replaced.");
-  }
-  throw new Error("Local authorization requires macOS Keychain or Linux Secret Service.");
-}
-function run(command, args, input) {
-  return new Promise((resolve, reject) => {
-    const child = spawn4(command, args, { stdio: ["pipe", "pipe", "pipe"] });
-    const stdout = [];
-    const stderr = [];
-    child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
-    child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
-    child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(Object.assign(new Error(Buffer.concat(stderr).toString("utf8").trim()), { exitCode: code })));
-    if (input) child.stdin.end(input);
-    else child.stdin.end();
-  });
-}
-
 // src/output.ts
 function emit(value, pretty = false) {
   process.stdout.write(`${JSON.stringify(value, null, pretty ? 2 : void 0)}
@@ -15892,7 +16025,7 @@ function emit(value, pretty = false) {
 function failureValue(error51) {
   const message = error51 instanceof Error ? error51.message : String(error51);
   const [candidate] = message.split(":", 1);
-  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "scope_denied", "quota_exceeded", "browser_unavailable", "recording_not_found", "upload_interrupted", "processing_failed", "share_revoked", "validation_failed"]);
+  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "authorization_not_found", "expired_token", "access_denied", "unsupported_platform", "scope_denied", "quota_exceeded", "browser_unavailable", "recording_not_found", "upload_interrupted", "processing_pending", "processing_failed", "share_revoked", "validation_failed"]);
   const structured = error51 && typeof error51 === "object" ? error51 : {};
   const code = structured.code && knownCodes.has(structured.code) ? structured.code : knownCodes.has(candidate) ? candidate : "internal_error";
   return { error: { code, message, ...structured.recovery ? { recovery: structured.recovery } : {}, ...structured.details ? { details: structured.details } : {} } };
@@ -15968,6 +16101,7 @@ var CLI_VERSION = packageJson.version;
 
 // src/doctor.ts
 var defaultDependencies = {
+  platform: process.platform,
   encoding: "remote",
   encodingCapabilities: (apiUrl, token) => new ControlPlaneClient(apiUrl, token).encodingCapabilities(),
   nodeVersion: process.version,
@@ -15983,6 +16117,7 @@ async function runDoctor(apiUrl, overrides = {}) {
   const dependencies = { ...defaultDependencies, ...overrides };
   const checks = [];
   let feedbackEnabled = false;
+  checks.push(recorderTransportCheck(dependencies.platform));
   if (compareVersions(normalizeVersion(dependencies.nodeVersion), "22.0.0") >= 0) {
     checks.push({ name: "node", status: "pass", message: `Node.js ${dependencies.nodeVersion} is supported.`, version: dependencies.nodeVersion });
   } else {
@@ -16010,8 +16145,16 @@ async function runDoctor(apiUrl, overrides = {}) {
   if (!health) {
     checks.push({ name: "authentication", status: "skip", message: "Authentication was not checked because the API is unreachable.", recovery: `Restore API reachability, then run \`rill --api-url ${apiUrl} doctor\` again.` });
   } else {
-    const token = await dependencies.loadCredential(apiUrl);
-    if (!token) {
+    let token = null;
+    let credentialError;
+    try {
+      token = await dependencies.loadCredential(apiUrl);
+    } catch (error51) {
+      credentialError = error51;
+    }
+    if (credentialError) {
+      checks.push({ name: "authentication", status: "fail", message: errorMessage(credentialError), recovery: "Unlock the OS credential store, or use RILL_TOKEN. Windows local recording remains unsupported." });
+    } else if (!token) {
       checks.push({ name: "authentication", status: health.anonymousAccess ? "warn" : "fail", message: health.anonymousAccess ? "The first recording will create an anonymous identity in your OS credential store. Anonymous recordings expire after seven days." : "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
     } else {
       try {
@@ -16124,16 +16267,21 @@ async function startRecordingWithCompensation(remote, dependencies) {
     throw startupError;
   }
 }
-async function remoteAwareRecordingStatus(recordingId, dependencies) {
+async function remoteAwareRecordingStatus(recordingId, dependencies, apiUrl = "https://userill.dev") {
+  const remote = await dependencies.remoteStatus(recordingId);
+  const remoteView = {
+    ...remote,
+    recordingId: typeof remote.recordingId === "string" ? remote.recordingId : remote.id ?? recordingId,
+    source: "remote",
+    ...recordingNextStep(apiUrl, recordingId, String(remote.status))
+  };
+  if (["uploading", "processing", "ready", "failed", "expired", "cancelled"].includes(String(remote.status))) return remoteView;
   try {
-    return { ...await dependencies.localStatus(recordingId), source: "local" };
+    const local = await dependencies.localStatus(recordingId);
+    const status = local.status === "ready" ? "captured" : local.status;
+    return { ...local, status, source: "local", ...recordingNextStep(apiUrl, recordingId, String(status)) };
   } catch {
-    const remote = await dependencies.remoteStatus(recordingId);
-    return {
-      ...remote,
-      recordingId: typeof remote.recordingId === "string" ? remote.recordingId : remote.id ?? recordingId,
-      source: "remote"
-    };
+    return remoteView;
   }
 }
 
@@ -16187,9 +16335,22 @@ async function authorize(quiet = false) {
   }
   throw new Error("Device authorization expired.");
 }
-program.command("connect").description("Connect this agent once, with renewable account access.").requiredOption("--email <email>", "Email of the Rill account approving access").action(async (input) => {
+program.command("whoami").description("Show the current verified agent identity without starting sign-in.").action(async () => {
+  const options = program.opts();
+  const identity = await whoami(options.apiUrl);
+  emit(identity, options.pretty);
+  if (!identity.authenticated) process.exitCode = 1;
+});
+var connect = program.command("connect").description("Connect this agent once, with renewable account access.").option("--email <email>", "Email of the Rill account approving access").option("--no-wait", "Return approval instructions immediately; poll with connect status").action(async (input) => {
+  if (!input.email) throw new Error("validation_failed: Supply --email <email> to start a connection.");
   const options = program.opts();
-  emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email) }, options.pretty);
+  emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email, { wait: input.wait }) }, options.pretty);
+});
+connect.command("status").argument("<authorization-id>").description("Poll a saved connection once without starting another approval.").action(async (id) => {
+  const options = program.opts();
+  const result = await pollConnection(options.apiUrl, id);
+  emit({ schemaVersion: 1, ...result }, options.pretty);
+  if (result.status === "expired" || result.status === "denied") process.exitCode = 1;
 });
 program.command("login").description("Authorize Rill using the existing device login flow.").action(async () => {
   await authorize();
@@ -16228,6 +16389,7 @@ for (const action of ["status", "cancel"]) cloudRun.command(action).argument("<r
 });
 record2.command("start").option("--encoding <mode>", "remote or local", "remote").option("--url <url>").option("--title <title>").option("--description <description>", "").option("--headed").option("--cdp-url <url>").option("--width <pixels>", "", "1280").option("--height <pixels>", "", "720").option("--max-duration <seconds>", "", "600").action(async (commandOptions) => {
   const options = program.opts();
+  assertRecorderTransport();
   await ensureAnonymousCredential(options.apiUrl);
   const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await withRunFeedback(() => client.agentSession(), async (rememberRecording) => {
@@ -16252,7 +16414,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
       headed: Boolean(commandOptions.headed),
       attached: Boolean(commandOptions.cdpUrl)
     }).catch(() => void 0);
-    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
+    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, browserAttachment: browserAttachment(local.cdpUrl), bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
   });
   emit(result, options.pretty);
 });
@@ -16272,7 +16434,7 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     await client.uploadDiagnostics(recordingId, local.result.diagnosticsPath, local.result.diagnostics);
     const accepted = await submitFrameCapture(client, recordingId, local.result.frameDirectory);
     const result2 = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
-    emit({ schemaVersion: 1, ...result2, ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
+    emit({ schemaVersion: 1, ...result2, ...recordingNextStep(options.apiUrl, recordingId, result2.status, { resumableFrames: true }), ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
     if (result2.status === "ready") await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
     else watchEncoding(options.apiUrl, recordingId);
     return;
@@ -16291,6 +16453,7 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
     diagnostics: local.result.diagnostics,
+    ...recordingNextStep(options.apiUrl, recordingId, remote ? "ready" : "processing"),
     ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false)
   };
   emit(result, options.pretty);
@@ -16314,7 +16477,7 @@ record2.command("retry").argument("<recording-id>").option("--no-wait").action(a
   if (!accepted) throw new Error("Encoding job is unavailable.");
   if (["expired", "cancelled"].includes(accepted.status)) throw new Error(`Recording ${accepted.status}.`);
   const result = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
-  emit({ schemaVersion: 1, ...result }, options.pretty);
+  emit({ schemaVersion: 1, ...result, ...recordingNextStep(options.apiUrl, recordingId, result.status, { resumableFrames: true }) }, options.pretty);
   if (result.status === "ready") await removeLocalCapture(recordingId);
   else watchEncoding(options.apiUrl, recordingId);
 });
@@ -16356,11 +16519,11 @@ record2.command("status").argument("<recording-id>").action(async (recordingId)
   try {
     const encoding = await client.encodingStatus(recordingId);
     const remote = encoding.status === "ready" ? await client.recordingStatus(recordingId) : {};
-    emit({ schemaVersion: 1, ...encoding, ...remote, recordingId, source: "remote" }, options.pretty);
+    emit({ schemaVersion: 1, ...encoding, ...remote, recordingId, source: "remote", ...recordingNextStep(options.apiUrl, recordingId, encoding.status, { resumableFrames: true }) }, options.pretty);
     if (encoding.status === "ready") await removeLocalCapture(recordingId);
     return;
   } catch (error51) {
-    if (!(error51 instanceof Error) || !error51.message.includes("recording_not_found")) throw error51;
+    if (!(error51 instanceof ControlPlaneError) || error51.code !== "recording_not_found") throw error51;
   }
   const status = await remoteAwareRecordingStatus(recordingId, {
     localStatus: async (id) => {
@@ -16368,7 +16531,7 @@ record2.command("status").argument("<recording-id>").action(async (recordingId)
       return recordingStatus(id);
     },
     remoteStatus: (id) => client.recordingStatus(id)
-  });
+  }, options.apiUrl);
   emit({ schemaVersion: 1, ...status }, options.pretty);
 });
 record2.command("cancel").argument("<recording-id>").description("Cancel an active recording and release its remote quota slot.").action(async (recordingId) => {
@@ -16387,11 +16550,25 @@ program.command("upload").argument("<video-file>").option("--title <title>").opt
   await client.uploadVideo(upload.uploadUrl, videoFile);
   const remote = commandOptions.wait === false ? null : await client.waitUntilPlayable(recording.recordingId);
   if (remote) process.stderr.write("\n");
-  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, expiresAt: remote?.expires_at ?? recording.expiresAt ?? null, diagnosticsAvailable: false }, options.pretty);
+  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, expiresAt: remote?.expires_at ?? recording.expiresAt ?? null, diagnosticsAvailable: false, ...recordingNextStep(options.apiUrl, recording.recordingId, remote ? "ready" : "processing") }, options.pretty);
+});
+program.command("inspect").argument("<share-url>").option("--cursor <cursor>", "Read the next page of discussions").action(async (shareUrl, commandOptions) => {
+  const options = program.opts();
+  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).inspect(shareUrl, commandOptions.cursor), options.pretty);
+});
+var comments = program.command("comments").description("Reply to pinned review discussions.");
+comments.command("reply").argument("<share-url>").requiredOption("--discussion <id>").requiredOption("--body <text>").option("--request-id <uuid>", "Reuse on retry to prevent duplicate replies").action(async (shareUrl, input) => {
+  const options = program.opts();
+  const requestId = input.requestId ?? crypto.randomUUID();
+  process.stderr.write(`Reply request ID: ${requestId} (reuse with --request-id when retrying)
+`);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  emit(await client.reply(shareUrl, input.discussion, input.body, requestId), options.pretty);
 });
-program.command("inspect").argument("<share-url>").action(async (shareUrl) => {
+comments.command("edit").argument("<share-url>").requiredOption("--comment <id>").requiredOption("--body <text>").action(async (shareUrl, input) => {
   const options = program.opts();
-  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).inspect(shareUrl), options.pretty);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  emit(await client.editReply(shareUrl, input.comment, input.body), options.pretty);
 });
 var drafts = program.command("drafts");
 drafts.command("list").action(async () => {
@@ -16416,6 +16593,7 @@ drafts.command("purge").action(async () => {
   emit({ schemaVersion: 1, purged }, options.pretty);
 });
 program.hook("preAction", async (_command, actionCommand) => {
+  if (commandPath(actionCommand).join(" ") === "record start") assertRecorderTransport();
   const command = cliCommandCategory(commandPath(actionCommand));
   if (!command) return;
   const options = program.opts();