@runalabs/rill-cli 0.1.12 → 0.1.14

package/dist/cli.js

@@ -5,11 +5,128 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/windows-credentials.ts
+import { spawn } from "child_process";
+import { createHash, randomUUID } from "crypto";
+import { homedir } from "os";
+import { join, win32 } from "path";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
+var script = String.raw`$ErrorActionPreference='Stop'; try {
+  Add-Type -AssemblyName System.Security
+  $inputData=[Console]::In.ReadToEnd() | ConvertFrom-Json
+  $bytes=[Convert]::FromBase64String($inputData.data)
+  $entropy=[Convert]::FromBase64String($inputData.entropy)
+  if ($inputData.operation -eq 'protect') {
+    $result=[System.Security.Cryptography.ProtectedData]::Protect($bytes,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+  } elseif ($inputData.operation -eq 'unprotect') {
+    $result=[System.Security.Cryptography.ProtectedData]::Unprotect($bytes,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+  } else { throw 'Invalid operation' }
+  [Console]::Out.Write([Convert]::ToBase64String($result))
+} catch { [Console]::Error.Write('Windows credential protection failed.'); exit 1 }`;
+var transformWindowsSecret = async (operation, data, entropy) => {
+  if (process.platform !== "win32") throw new Error("Windows credential protection requires Windows.");
+  return new Promise((resolve, reject) => {
+    const executable = win32.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    const child = spawn(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    let output = "";
+    let failed = false;
+    const fail2 = () => {
+      if (failed) return;
+      failed = true;
+      child.kill();
+      reject(new Error("Cannot access Windows protected credentials. Your saved identity has not been replaced."));
+    };
+    const timer = setTimeout(fail2, 15e3);
+    child.stdout.on("data", (chunk) => {
+      output += chunk.toString("ascii");
+      if (output.length > 256 * 1024) fail2();
+    });
+    child.stderr.resume();
+    child.once("error", fail2);
+    child.stdin.once("error", fail2);
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failed) return;
+      if (code !== 0 || !output || !/^[A-Za-z0-9+/]+={0,2}$/.test(output)) {
+        fail2();
+        return;
+      }
+      resolve(Buffer.from(output, "base64"));
+    });
+    child.stdin.end(JSON.stringify({ operation, data: data.toString("base64"), entropy: entropy.toString("base64") }));
+  });
+};
+var credentialRoot = () => join(process.env.RILL_HOME ?? join(homedir(), ".rill"), "windows-credentials");
+var key = (apiUrl) => createHash("sha256").update(apiUrl).digest();
+async function saveWindowsCredential(apiUrl, value, root = credentialRoot(), transform2 = transformWindowsSecret) {
+  if (!value || Buffer.byteLength(value) > 64 * 1024) throw new Error("The Windows credential is empty or too large.");
+  const entropy = key(apiUrl), protectedBytes = await transform2("protect", Buffer.from(value, "utf8"), entropy);
+  if (!protectedBytes.length || protectedBytes.length > 192 * 1024) throw new Error("Windows credential protection returned invalid data.");
+  await mkdir(root, { recursive: true, mode: 448 });
+  const path = join(root, entropy.toString("hex") + ".dpapi"), temporary = path + "." + randomUUID() + ".tmp";
+  try {
+    await writeFile(temporary, JSON.stringify({ version: 1, ciphertext: protectedBytes.toString("base64") }), { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function loadWindowsCredential(apiUrl, root = credentialRoot(), transform2 = transformWindowsSecret) {
+  const entropy = key(apiUrl), path = join(root, entropy.toString("hex") + ".dpapi");
+  try {
+    const info = await stat(path);
+    if (!info.isFile() || info.size > 256 * 1024) throw new Error("Invalid credential file.");
+    const stored = JSON.parse(await readFile(path, "utf8"));
+    if (stored.version !== 1 || typeof stored.ciphertext !== "string" || !stored.ciphertext || !/^[A-Za-z0-9+/]+={0,2}$/.test(stored.ciphertext)) throw new Error("Invalid protected credential.");
+    const plain = await transform2("unprotect", Buffer.from(stored.ciphertext, "base64"), entropy);
+    if (!plain.length || plain.length > 64 * 1024) throw new Error("Invalid credential size.");
+    return plain.toString("utf8");
+  } catch (error51) {
+    if (error51.code === "ENOENT") return null;
+    throw new Error("Cannot read Windows protected credentials. Your saved identity has not been replaced.");
+  }
+}
+
+// src/agent-session.ts
+import { hostname, homedir as homedir2 } from "os";
+import { mkdir as mkdir2, rm as rm2, stat as stat2 } from "fs/promises";
+import { join as join2 } from "path";
+import { createHash as createHash2, randomBytes } from "crypto";
+
+// src/recording-guidance.ts
+function cliCommandForPlatform(platform, apiUrl, ...args) {
+  const quote = (value) => /^[a-zA-Z0-9_./:@=-]+$/.test(value) ? value : platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
+  return ["rill", "--api-url", apiUrl, ...args].map(quote).join(" ");
+}
+function cliCommand(apiUrl, ...args) {
+  return cliCommandForPlatform(process.platform, apiUrl, ...args);
+}
+var transportRecovery = "Unset RILL_SOCKET on Windows so Rill can use its authenticated named pipe. Use RILL_HOME to choose a separate recorder identity directory.";
+function recorderTransportCheck(platform = process.platform, socketOverride = process.env.RILL_SOCKET) {
+  if (platform === "win32" && socketOverride) return { name: "recorder_transport", status: "fail", message: "Windows requires the authenticated recorder pipe.", recovery: transportRecovery };
+  return { name: "recorder_transport", status: "pass", message: platform === "win32" ? "The local recorder uses an authenticated Windows named pipe." : "The local recorder uses a Unix-domain socket." };
+}
+function assertRecorderTransport(platform = process.platform, socketOverride = process.env.RILL_SOCKET) {
+  const check2 = recorderTransportCheck(platform, socketOverride);
+  if (check2.status === "fail") throw Object.assign(new Error(`unsupported_platform: ${check2.message}`), { code: "unsupported_platform", recovery: check2.recovery });
+}
+function recordingNextStep(apiUrl, recordingId, status, options = {}) {
+  if (status === "uploading" && options.resumableFrames) return { nextCommand: cliCommand(apiUrl, "record", "retry", recordingId, "--no-wait"), message: "Frame upload is incomplete. If the uploader is still running, let it finish. If it exited or was interrupted, run nextCommand to resume missing parts and finalize the upload. Do not start a second uploader while the first is active." };
+  if (status === "captured") return { nextCommand: cliCommand(apiUrl, "record", "stop", recordingId, "--no-wait"), message: "Captured locally; upload required. This is not a playable share yet." };
+  if (["uploading", "queued", "encoding", "processing", "finalizing"].includes(status)) return { nextCommand: cliCommand(apiUrl, "record", "status", recordingId), message: "Finalizing recordings hold a concurrency slot. Wait for ready; cancel only if abandoning the recording." };
+  return {};
+}
+function browserAttachment(cdpUrl) {
+  return {
+    protocol: "cdp",
+    cdpUrl,
+    playwrightMethod: "chromium.connectOverCDP",
+    instructions: "Attach to this endpoint and use the existing browser context. A browser tool must explicitly support CDP attachment; do not drive a separate browser. Disconnect the automation client without closing the recorded browser, then run record stop.",
+    shellFallback: "See the shell-only Playwright example in the Rill CLI README; install playwright-core in a temporary directory outside the project."
+  };
+}
+
 // src/agent-session.ts
-import { hostname, homedir } from "os";
-import { mkdir, rm, stat } from "fs/promises";
-import { join } from "path";
-import { createHash, randomBytes } from "crypto";
 var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
 var AgentAuthError = class extends Error {
@@ -17,6 +134,7 @@ var AgentAuthError = class extends Error {
     super(`${code}: ${message}`);
     this.code = code;
   }
+  code;
 };
 function parseAuthorization(value) {
   if (!value?.startsWith("{")) return null;
@@ -32,7 +150,7 @@ async function request(apiUrl, path, body, form = false) {
     redirect: "error",
     signal: AbortSignal.timeout(15e3),
     headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
-    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
+    body: form ? new URLSearchParams(Object.entries(body).map(([key2, value2]) => [key2, String(value2)])) : JSON.stringify(body)
   });
   const value = await response.json();
   if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
@@ -52,17 +170,7 @@ async function loadAgentCredential(apiUrl) {
   if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
   const inFlight = pending.get(apiUrl);
   if (inFlight) return inFlight;
-  const promise2 = (async () => {
-    const raw = await loadStoredCredential(apiUrl);
-    const saved = parseAuthorization(raw);
-    if (!saved) return raw;
-    if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
-    if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
-    if (!saved.identityAssertion) throw new Error("Connection is awaiting approval. Run rill connect --email <your-email>.");
-    const tokens = await request(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
-    await save(apiUrl, withTokens(saved, tokens));
-    return tokens.access_token;
-  })();
+  const promise2 = withAuthorizationLock(apiUrl, () => readAgentCredential(apiUrl));
   pending.set(apiUrl, promise2);
   try {
     return await promise2;
@@ -70,20 +178,35 @@ async function loadAgentCredential(apiUrl) {
     pending.delete(apiUrl);
   }
 }
+async function readAgentCredential(apiUrl) {
+  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+  const raw = await loadStoredCredential(apiUrl);
+  const saved = parseAuthorization(raw);
+  if (!saved) return raw;
+  if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
+  if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
+  if (!saved.identityAssertion) throw new Error(saved.connection ? `Connection is ${saved.connection.status}. Run ${cliCommand(apiUrl, "connect", "status", saved.connection.id)}.` : "Connection is awaiting approval. Run rill connect --email <your-email>.");
+  const tokens = await request(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
+  await save(apiUrl, withTokens(saved, tokens));
+  return tokens.access_token;
+}
 async function ensureAnonymousCredential(apiUrl) {
-  const root = join(homedir(), ".rill", "auth-locks");
-  await mkdir(root, { recursive: true, mode: 448 });
-  const lock = join(root, createHash("sha256").update(apiUrl).digest("hex"));
+  return withAuthorizationLock(apiUrl, () => createAnonymousCredential(apiUrl));
+}
+async function withAuthorizationLock(apiUrl, action) {
+  const root = join2(homedir2(), ".rill", "auth-locks");
+  await mkdir2(root, { recursive: true, mode: 448 });
+  const lock = join2(root, createHash2("sha256").update(apiUrl).digest("hex"));
   const deadline = Date.now() + 3e4;
   while (true) {
     try {
-      await mkdir(lock, { mode: 448 });
+      await mkdir2(lock, { mode: 448 });
       break;
     } catch (error51) {
       if (error51.code !== "EEXIST") throw error51;
-      const info = await stat(lock).catch(() => null);
+      const info = await stat2(lock).catch(() => null);
       if (info && Date.now() - info.mtimeMs > 12e4) {
-        await rm(lock, { recursive: true, force: true });
+        await rm2(lock, { recursive: true, force: true });
         continue;
       }
       if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
@@ -91,13 +214,13 @@ async function ensureAnonymousCredential(apiUrl) {
     }
   }
   try {
-    return await createAnonymousCredential(apiUrl);
+    return await action();
   } finally {
-    await rm(lock, { recursive: true, force: true });
+    await rm2(lock, { recursive: true, force: true });
   }
 }
 async function createAnonymousCredential(apiUrl) {
-  const existing = await loadAgentCredential(apiUrl);
+  const existing = await readAgentCredential(apiUrl);
   if (existing) return existing;
   const stored = parseAuthorization(await loadStoredCredential(apiUrl));
   const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
@@ -106,11 +229,29 @@ async function createAnonymousCredential(apiUrl) {
   const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
   await save(apiUrl, saved);
   process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
-  return await loadAgentCredential(apiUrl);
+  return await readAgentCredential(apiUrl);
 }
-async function connectAgent(apiUrl, email3) {
+async function connectAgent(apiUrl, email3, options = {}) {
+  let result = await withAuthorizationLock(apiUrl, () => beginConnection(apiUrl, email3));
+  if (options.wait === false) return result;
+  while (result.status === "pending") {
+    await new Promise((resolve) => setTimeout(resolve, result.retryAfterSeconds * 1e3));
+    result = await pollConnection(apiUrl, result.authorizationId);
+  }
+  if (result.status === "expired") throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again using the same saved identity.");
+  if (result.status === "denied") throw new AgentAuthError("access_denied", "Connection request was denied or revoked. Run rill connect again only when ready to request approval.");
+  return result;
+}
+async function beginConnection(apiUrl, email3) {
   if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
   let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  if (saved?.connection?.status === "pending" && saved.connection.expiresAt > Date.now()) {
+    if (saved.connection.email !== email3) throw new Error("A connection for another email is pending. Let it expire before starting a different connection.");
+    process.stderr.write(`Open ${saved.connection.verificationUri}
+Sign in as ${email3} and enter ${saved.connection.userCode}. Approve only the request you started.
+`);
+    return connectionView(apiUrl, saved);
+  }
   let claim;
   if (saved?.claimToken && saved.anonymous) {
     try {
@@ -130,32 +271,72 @@ async function connectAgent(apiUrl, email3) {
   process.stderr.write(`Open ${claim.verification_uri}
 Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
 `);
-  const deadline = Date.now() + claim.expires_in * 1e3;
-  let interval = claim.interval;
-  while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
-    try {
-      const tokens = await request(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
-      const connected = withTokens({ version: 1, anonymous: false }, tokens);
-      await save(apiUrl, connected);
-      return { status: "authenticated", expiresAt: connected.assertionExpires, apiUrl };
-    } catch (error51) {
-      if (error51 instanceof AgentAuthError && error51.code === "expired_token") throw new AgentAuthError("expired_token", "The approval attempt expired. Run rill connect again to request a fresh code using the same saved claim token.");
-      if (error51 instanceof AgentAuthError && error51.code === "authorization_pending") continue;
-      if (error51 instanceof AgentAuthError && error51.code === "slow_down") {
-        interval += 5;
-        continue;
-      }
-      throw error51;
-    }
+  saved = { ...saved, connection: {
+    id: randomBytes(16).toString("hex"),
+    email: email3,
+    verificationUri: claim.verification_uri,
+    userCode: claim.user_code,
+    expiresAt: Date.now() + claim.expires_in * 1e3,
+    interval: claim.interval,
+    nextPollAt: Date.now() + claim.interval * 1e3,
+    status: "pending"
+  } };
+  await save(apiUrl, saved);
+  return connectionView(apiUrl, saved);
+}
+function connectionView(apiUrl, saved) {
+  const connection = saved.connection;
+  return {
+    status: connection.status,
+    authorizationId: connection.id,
+    apiUrl,
+    expiresAt: connection.status === "authenticated" ? saved.assertionExpires : new Date(connection.expiresAt).toISOString(),
+    retryAfterSeconds: connection.status === "pending" ? Math.max(0, Math.ceil((connection.nextPollAt - Date.now()) / 1e3)) : 0,
+    ...connection.status === "pending" ? {
+      verificationUri: connection.verificationUri,
+      userCode: connection.userCode,
+      nextCommand: cliCommand(apiUrl, "connect", "status", connection.id)
+    } : connection.status === "authenticated" ? {} : { nextCommand: cliCommand(apiUrl, "connect", "--email", connection.email) }
+  };
+}
+async function pollConnection(apiUrl, authorizationId) {
+  return withAuthorizationLock(apiUrl, () => pollSavedConnection(apiUrl, authorizationId));
+}
+async function pollSavedConnection(apiUrl, authorizationId) {
+  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before polling a local connection.");
+  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  if (!saved?.connection || saved.connection.id !== authorizationId) throw new AgentAuthError("authorization_not_found", "No matching saved connection for this API URL. Use the latest connect response.");
+  const connection = saved.connection;
+  if (connection.status !== "pending") return connectionView(apiUrl, saved);
+  if (Date.now() >= connection.expiresAt) {
+    connection.status = "expired";
+    await save(apiUrl, saved);
+    return connectionView(apiUrl, saved);
+  }
+  if (Date.now() < connection.nextPollAt) return connectionView(apiUrl, saved);
+  connection.nextPollAt = Date.now() + connection.interval * 1e3;
+  await save(apiUrl, saved);
+  try {
+    const tokens = await request(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
+    saved = withTokens({ version: 1, anonymous: false, connection: { ...connection, status: "authenticated", userCode: "" } }, tokens);
+  } catch (error51) {
+    if (!(error51 instanceof AgentAuthError)) throw error51;
+    if (error51.code === "expired_token" || error51.code === "claim_expired") connection.status = "expired";
+    else if (error51.code === "access_denied" || error51.code === "claim_revoked") connection.status = "denied";
+    else if (error51.code === "slow_down") {
+      connection.interval += 5;
+      connection.nextPollAt = Date.now() + connection.interval * 1e3;
+    } else if (error51.code !== "authorization_pending") throw error51;
   }
-  throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again to restart the approval attempt using the same saved claim token.");
+  await save(apiUrl, saved);
+  return connectionView(apiUrl, saved);
 }
 
 // src/keychain.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 var service = "rill";
 async function saveCredential(apiUrl, token) {
+  if (process.platform === "win32") return saveWindowsCredential(apiUrl, token);
   if (process.platform === "darwin") {
     await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
     return;
@@ -170,6 +351,7 @@ function loadCredential(apiUrl) {
   return loadAgentCredential(apiUrl);
 }
 async function loadStoredCredential(apiUrl) {
+  if (process.platform === "win32") return loadWindowsCredential(apiUrl);
   try {
     if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
     if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
@@ -183,7 +365,7 @@ async function loadStoredCredential(apiUrl) {
 }
 function run(command, args, input) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    const child = spawn2(command, args, { stdio: ["pipe", "pipe", "pipe"] });
     const stdout = [];
     const stderr = [];
     child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
@@ -197,7 +379,7 @@ function run(command, args, input) {
 
 // src/control-plane.ts
 import { createReadStream } from "fs";
-import { readFile, stat as stat2 } from "fs/promises";
+import { readFile as readFile2, stat as stat3 } from "fs/promises";
 import { Upload } from "tus-js-client";
 var ControlPlaneError = class extends Error {
   constructor(code, message, recovery, details, httpStatus) {
@@ -208,6 +390,10 @@ var ControlPlaneError = class extends Error {
     this.httpStatus = httpStatus;
     this.name = "ControlPlaneError";
   }
+  code;
+  recovery;
+  details;
+  httpStatus;
 };
 var ControlPlaneHttpError = class extends Error {
   constructor(httpStatus) {
@@ -215,12 +401,18 @@ var ControlPlaneHttpError = class extends Error {
     this.httpStatus = httpStatus;
     this.name = "ControlPlaneHttpError";
   }
+  httpStatus;
 };
 var ControlPlaneClient = class {
   constructor(apiUrl, token) {
     this.apiUrl = apiUrl;
     this.token = token;
   }
+  apiUrl;
+  token;
+  recordingStatusCommand(id) {
+    return cliCommand(this.apiUrl, "record", "status", id);
+  }
   encodingCapabilities() {
     return this.request("/api/encoding/capabilities");
   }
@@ -299,17 +491,18 @@ var ControlPlaneClient = class {
         return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
       }
       if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
-      process.stderr.write(`\rprocessing ${recording.status.padEnd(12)}`);
+      process.stderr.write("\rUpload complete; waiting for playable video.          ");
       await new Promise((resolve) => setTimeout(resolve, intervalMs));
       intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
     }
-    throw new Error("processing_failed: Timed out waiting for the recording to become playable. Run `rill record status <recording-id>` to continue checking.");
+    throw new ControlPlaneError("processing_pending", "Upload complete; the recording is not playable yet.", `Run ${cliCommand(this.apiUrl, "record", "status", recordingId)} to continue checking.`, { recordingId, nextCommand: cliCommand(this.apiUrl, "record", "status", recordingId) });
   }
   async uploadVideo(uploadUrl, filePath) {
-    const file2 = await stat2(filePath);
+    const file2 = await stat3(filePath);
     if (uploadUrl.startsWith(this.apiUrl)) {
       const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
       if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
+      process.stderr.write("Upload complete; playback processing may continue.\n");
       return;
     }
     await new Promise((resolve, reject) => {
@@ -324,10 +517,10 @@ var ControlPlaneClient = class {
       });
       upload.start();
     });
-    process.stderr.write("\n");
+    process.stderr.write("\nUpload complete; playback processing may continue.\n");
   }
   async uploadDiagnostics(recordingId, filePath, summary) {
-    const body = await readFile(filePath);
+    const body = await readFile2(filePath);
     return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
   }
   listRecordings() {
@@ -339,18 +532,49 @@ var ControlPlaneClient = class {
   pollDeviceAuthorization(deviceCode) {
     return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
   }
-  inspect(shareUrl) {
+  async inspect(shareUrl, cursor) {
     if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
     const url2 = new URL(shareUrl);
     const slug = url2.pathname.split("/").filter(Boolean).at(-1);
     if (!slug) throw new Error("The share URL does not contain a slug.");
-    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context`, { headers: { Accept: "application/json" } }).then(async (response) => {
+    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`, { headers: await this.reviewHeaders(url2.origin) }).then(async (response) => {
       if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
       return response.json();
     });
   }
+  async reviewHeaders(origin) {
+    const headers = new Headers({ Accept: "application/json" });
+    if (origin !== new URL(this.apiUrl).origin) return headers;
+    const token = typeof this.token === "function" ? await this.token() : this.token;
+    if (token) headers.set("Authorization", `Bearer ${token}`);
+    this.identifyAgent(headers);
+    const id = process.env.RILL_AGENT_ID;
+    if (id && /^[a-zA-Z0-9_-]{8,80}$/.test(id)) headers.set("x-rill-agent-id", id);
+    if (id && process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1") headers.set("x-rill-analytics", "1");
+    return headers;
+  }
+  identifyAgent(headers) {
+    if (process.env.DO_NOT_TRACK === "1" || process.env.RILL_ANONYMOUS_ANALYTICS === "0") headers.set("x-rill-analytics", "0");
+    const client = process.env.RILL_AGENT_CLIENT || (process.env.CODEX_THREAD_ID ? "Codex" : process.env.CLAUDECODE ? "Claude" : process.env.CURSOR_TRACE_ID ? "Cursor" : void 0);
+    if (client) headers.set("x-rill-agent-client", client.replace(/[\x00-\x1f\x7f]/g, "").slice(0, 80));
+    if (process.env.RILL_AGENT_NAME) headers.set("x-rill-agent-name", process.env.RILL_AGENT_NAME.replace(/[\x00-\x1f\x7f]/g, "").slice(0, 48));
+  }
+  reviewPath(shareUrl) {
+    const url2 = new URL(shareUrl);
+    if (url2.origin !== new URL(this.apiUrl).origin) throw new Error("The share URL must match --api-url before sending agent credentials.");
+    const match = /^\/s\/([^/]+)\/?$/.exec(url2.pathname);
+    if (!match) throw new Error("Expected a Rill /s/<slug> review link.");
+    return `/api/review/shares/${encodeURIComponent(decodeURIComponent(match[1]))}`;
+  }
+  reply(shareUrl, discussionId, body, requestId) {
+    return this.request(`${this.reviewPath(shareUrl)}/discussions/${encodeURIComponent(discussionId)}/replies`, { method: "POST", body: JSON.stringify({ body, requestId }) });
+  }
+  editReply(shareUrl, commentId, body) {
+    return this.request(`${this.reviewPath(shareUrl)}/comments/${encodeURIComponent(commentId)}`, { method: "PATCH", body: JSON.stringify({ body }) });
+  }
   async request(path, init = {}, authenticated = true) {
     const headers = new Headers(init.headers);
+    if (authenticated) this.identifyAgent(headers);
     if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
     if (authenticated) {
       const token = typeof this.token === "function" ? await this.token() : this.token;
@@ -360,7 +584,11 @@ var ControlPlaneClient = class {
     const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
     const value = await response.json().catch(() => null);
     if (!response.ok && value?.error?.code && value.error.message) {
-      throw new ControlPlaneError(value.error.code, value.error.message, value.error.recovery, value.error.details, response.status);
+      const quota = value.error.details?.quota;
+      const blockingId = quota?.blockingRecordingId;
+      const concurrency = quota?.type === "credential_concurrency" || quota?.type === "workspace_concurrency";
+      const recovery = value.error.code === "quota_exceeded" && concurrency && blockingId ? `Run ${cliCommand(this.apiUrl, "record", "status", blockingId)}. Uploading and processing recordings hold a concurrency slot: wait for ready. If captured locally, run record stop to upload. Cancel only an abandoned recording.` : value.error.recovery;
+      throw new ControlPlaneError(value.error.code, value.error.message, recovery, value.error.details, response.status);
     }
     if (!response.ok) throw new ControlPlaneHttpError(response.status);
     return value;
@@ -386,8 +614,8 @@ async function whoami(apiUrl) {
 }
 
 // src/remote-encoding.ts
-import { open, readFile as readFile2 } from "fs/promises";
-import { join as join2 } from "path";
+import { open, readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -1111,9 +1339,9 @@ function floatSafeRemainder(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object2, key, getter) {
+function defineLazy(object2, key2, getter) {
   let value = void 0;
-  Object.defineProperty(object2, key, {
+  Object.defineProperty(object2, key2, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -1125,7 +1353,7 @@ function defineLazy(object2, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object2, key, {
+      Object.defineProperty(object2, key2, {
         value: v
         // configurable: true,
       });
@@ -1158,11 +1386,11 @@ function cloneDef(schema) {
 function getElementAtPath(obj, path) {
   if (!path)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
-  const promises = keys.map((key) => promisesObj[key]);
+  const promises = keys.map((key2) => promisesObj[key2]);
   return Promise.all(promises).then((results) => {
     const resolvedObj = {};
     for (let i = 0; i < keys.length; i++) {
@@ -1234,8 +1462,8 @@ function shallowClone(o) {
 }
 function numKeys(data) {
   let keyCount = 0;
-  for (const key in data) {
-    if (Object.prototype.hasOwnProperty.call(data, key)) {
+  for (const key2 in data) {
+    if (Object.prototype.hasOwnProperty.call(data, key2)) {
       keyCount++;
     }
   }
@@ -1385,13 +1613,13 @@ function pick(schema, mask) {
   const def = mergeDefs(schema._zod.def, {
     get shape() {
       const newShape = {};
-      for (const key in mask) {
-        if (!(key in currDef.shape)) {
-          throw new Error(`Unrecognized key: "${key}"`);
+      for (const key2 in mask) {
+        if (!(key2 in currDef.shape)) {
+          throw new Error(`Unrecognized key: "${key2}"`);
         }
-        if (!mask[key])
+        if (!mask[key2])
           continue;
-        newShape[key] = currDef.shape[key];
+        newShape[key2] = currDef.shape[key2];
       }
       assignProp(this, "shape", newShape);
       return newShape;
@@ -1410,13 +1638,13 @@ function omit(schema, mask) {
   const def = mergeDefs(schema._zod.def, {
     get shape() {
       const newShape = { ...schema._zod.def.shape };
-      for (const key in mask) {
-        if (!(key in currDef.shape)) {
-          throw new Error(`Unrecognized key: "${key}"`);
+      for (const key2 in mask) {
+        if (!(key2 in currDef.shape)) {
+          throw new Error(`Unrecognized key: "${key2}"`);
         }
-        if (!mask[key])
+        if (!mask[key2])
           continue;
-        delete newShape[key];
+        delete newShape[key2];
       }
       assignProp(this, "shape", newShape);
       return newShape;
@@ -1433,8 +1661,8 @@ function extend(schema, shape) {
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
     const existingShape = schema._zod.def.shape;
-    for (const key in shape) {
-      if (Object.getOwnPropertyDescriptor(existingShape, key) !== void 0) {
+    for (const key2 in shape) {
+      if (Object.getOwnPropertyDescriptor(existingShape, key2) !== void 0) {
         throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.");
       }
     }
@@ -1490,23 +1718,23 @@ function partial(Class2, schema, mask) {
       const oldShape = schema._zod.def.shape;
       const shape = { ...oldShape };
       if (mask) {
-        for (const key in mask) {
-          if (!(key in oldShape)) {
-            throw new Error(`Unrecognized key: "${key}"`);
+        for (const key2 in mask) {
+          if (!(key2 in oldShape)) {
+            throw new Error(`Unrecognized key: "${key2}"`);
           }
-          if (!mask[key])
+          if (!mask[key2])
             continue;
-          shape[key] = Class2 ? new Class2({
+          shape[key2] = Class2 ? new Class2({
             type: "optional",
-            innerType: oldShape[key]
-          }) : oldShape[key];
+            innerType: oldShape[key2]
+          }) : oldShape[key2];
         }
       } else {
-        for (const key in oldShape) {
-          shape[key] = Class2 ? new Class2({
+        for (const key2 in oldShape) {
+          shape[key2] = Class2 ? new Class2({
             type: "optional",
-            innerType: oldShape[key]
-          }) : oldShape[key];
+            innerType: oldShape[key2]
+          }) : oldShape[key2];
         }
       }
       assignProp(this, "shape", shape);
@@ -1522,22 +1750,22 @@ function required(Class2, schema, mask) {
       const oldShape = schema._zod.def.shape;
       const shape = { ...oldShape };
       if (mask) {
-        for (const key in mask) {
-          if (!(key in shape)) {
-            throw new Error(`Unrecognized key: "${key}"`);
+        for (const key2 in mask) {
+          if (!(key2 in shape)) {
+            throw new Error(`Unrecognized key: "${key2}"`);
           }
-          if (!mask[key])
+          if (!mask[key2])
             continue;
-          shape[key] = new Class2({
+          shape[key2] = new Class2({
             type: "nonoptional",
-            innerType: oldShape[key]
+            innerType: oldShape[key2]
           });
         }
       } else {
-        for (const key in oldShape) {
-          shape[key] = new Class2({
+        for (const key2 in oldShape) {
+          shape[key2] = new Class2({
             type: "nonoptional",
-            innerType: oldShape[key]
+            innerType: oldShape[key2]
           });
         }
       }
@@ -3318,13 +3546,13 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     return payload;
   };
 });
-function handlePropertyResult(result, final, key, input, isOptionalIn, isOptionalOut) {
-  const isPresent = key in input;
+function handlePropertyResult(result, final, key2, input, isOptionalIn, isOptionalOut) {
+  const isPresent = key2 in input;
   if (result.issues.length) {
     if (isOptionalIn && isOptionalOut && !isPresent) {
       return;
     }
-    final.issues.push(...prefixIssues(key, result.issues));
+    final.issues.push(...prefixIssues(key2, result.issues));
   }
   if (!isPresent && !isOptionalIn) {
     if (!result.issues.length) {
@@ -3332,17 +3560,17 @@ function handlePropertyResult(result, final, key, input, isOptionalIn, isOptiona
         code: "invalid_type",
         expected: "nonoptional",
         input: void 0,
-        path: [key]
+        path: [key2]
       });
     }
     return;
   }
   if (result.value === void 0) {
     if (isPresent) {
-      final.value[key] = void 0;
+      final.value[key2] = void 0;
     }
   } else {
-    final.value[key] = result.value;
+    final.value[key2] = result.value;
   }
 }
 function normalizeDef(def) {
@@ -3368,20 +3596,20 @@ function handleCatchall(proms, input, payload, ctx, def, inst) {
   const t = _catchall.def.type;
   const isOptionalIn = _catchall.optin === "optional";
   const isOptionalOut = _catchall.optout === "optional";
-  for (const key in input) {
-    if (key === "__proto__")
+  for (const key2 in input) {
+    if (key2 === "__proto__")
       continue;
-    if (keySet.has(key))
+    if (keySet.has(key2))
       continue;
     if (t === "never") {
-      unrecognized.push(key);
+      unrecognized.push(key2);
       continue;
     }
-    const r = _catchall.run({ value: input[key], issues: [] }, ctx);
+    const r = _catchall.run({ value: input[key2], issues: [] }, ctx);
     if (r instanceof Promise) {
-      proms.push(r.then((r2) => handlePropertyResult(r2, payload, key, input, isOptionalIn, isOptionalOut)));
+      proms.push(r.then((r2) => handlePropertyResult(r2, payload, key2, input, isOptionalIn, isOptionalOut)));
     } else {
-      handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);
+      handlePropertyResult(r, payload, key2, input, isOptionalIn, isOptionalOut);
     }
   }
   if (unrecognized.length) {
@@ -3417,12 +3645,12 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   defineLazy(inst._zod, "propValues", () => {
     const shape = def.shape;
     const propValues = {};
-    for (const key in shape) {
-      const field = shape[key]._zod;
+    for (const key2 in shape) {
+      const field = shape[key2]._zod;
       if (field.values) {
-        propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());
+        propValues[key2] ?? (propValues[key2] = /* @__PURE__ */ new Set());
         for (const v of field.values)
-          propValues[key].add(v);
+          propValues[key2].add(v);
       }
     }
     return propValues;
@@ -3445,15 +3673,15 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     payload.value = {};
     const proms = [];
     const shape = value.shape;
-    for (const key of value.keys) {
-      const el = shape[key];
+    for (const key2 of value.keys) {
+      const el = shape[key2];
       const isOptionalIn = el._zod.optin === "optional";
       const isOptionalOut = el._zod.optout === "optional";
-      const r = el._zod.run({ value: input[key], issues: [] }, ctx);
+      const r = el._zod.run({ value: input[key2], issues: [] }, ctx);
       if (r instanceof Promise) {
-        proms.push(r.then((r2) => handlePropertyResult(r2, payload, key, input, isOptionalIn, isOptionalOut)));
+        proms.push(r.then((r2) => handlePropertyResult(r2, payload, key2, input, isOptionalIn, isOptionalOut)));
       } else {
-        handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);
+        handlePropertyResult(r, payload, key2, input, isOptionalIn, isOptionalOut);
       }
     }
     if (!catchall) {
@@ -3469,24 +3697,24 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   const generateFastpass = (shape) => {
     const doc = new Doc(["shape", "payload", "ctx"]);
     const normalized = _normalized.value;
-    const parseStr = (key) => {
-      const k = esc(key);
+    const parseStr = (key2) => {
+      const k = esc(key2);
       return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
     };
     doc.write(`const input = payload.value;`);
     const ids = /* @__PURE__ */ Object.create(null);
     let counter = 0;
-    for (const key of normalized.keys) {
-      ids[key] = `key_${counter++}`;
+    for (const key2 of normalized.keys) {
+      ids[key2] = `key_${counter++}`;
     }
     doc.write(`const newResult = {};`);
-    for (const key of normalized.keys) {
-      const id = ids[key];
-      const k = esc(key);
-      const schema = shape[key];
+    for (const key2 of normalized.keys) {
+      const id = ids[key2];
+      const k = esc(key2);
+      const schema = shape[key2];
       const isOptionalIn = schema?._zod?.optin === "optional";
       const isOptionalOut = schema?._zod?.optout === "optional";
-      doc.write(`const ${id} = ${parseStr(key)};`);
+      doc.write(`const ${id} = ${parseStr(key2)};`);
       if (isOptionalIn && isOptionalOut) {
         doc.write(`
         if (${id}.issues.length) {
@@ -3798,17 +4026,17 @@ function mergeValues(a, b) {
   }
   if (isPlainObject(a) && isPlainObject(b)) {
     const bKeys = Object.keys(b);
-    const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
+    const sharedKeys = Object.keys(a).filter((key2) => bKeys.indexOf(key2) !== -1);
     const newObj = { ...a, ...b };
-    for (const key of sharedKeys) {
-      const sharedValue = mergeValues(a[key], b[key]);
+    for (const key2 of sharedKeys) {
+      const sharedValue = mergeValues(a[key2], b[key2]);
       if (!sharedValue.valid) {
         return {
           valid: false,
-          mergeErrorPath: [key, ...sharedValue.mergeErrorPath]
+          mergeErrorPath: [key2, ...sharedValue.mergeErrorPath]
         };
       }
-      newObj[key] = sharedValue.data;
+      newObj[key2] = sharedValue.data;
     }
     return { valid: true, data: newObj };
   }
@@ -3943,9 +4171,9 @@ var $ZodTuple = /* @__PURE__ */ $constructor("$ZodTuple", (inst, def) => {
     return handleTupleResults(itemResults, payload, items, input, optoutStart);
   };
 });
-function getTupleOptStart(items, key) {
+function getTupleOptStart(items, key2) {
   for (let i = items.length - 1; i >= 0; i--) {
-    if (items[i]._zod[key] !== "optional")
+    if (items[i]._zod[key2] !== "optional")
       return i + 1;
   }
   return 0;
@@ -3996,10 +4224,10 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
     if (values) {
       payload.value = {};
       const recordKeys = /* @__PURE__ */ new Set();
-      for (const key of values) {
-        if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
-          recordKeys.add(typeof key === "number" ? key.toString() : key);
-          const keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+      for (const key2 of values) {
+        if (typeof key2 === "string" || typeof key2 === "number" || typeof key2 === "symbol") {
+          recordKeys.add(typeof key2 === "number" ? key2.toString() : key2);
+          const keyResult = def.keyType._zod.run({ value: key2, issues: [] }, ctx);
           if (keyResult instanceof Promise) {
             throw new Error("Async schemas not supported in object keys currently");
           }
@@ -4008,34 +4236,34 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
               code: "invalid_key",
               origin: "record",
               issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
-              input: key,
-              path: [key],
+              input: key2,
+              path: [key2],
               inst
             });
             continue;
           }
           const outKey = keyResult.value;
-          const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+          const result = def.valueType._zod.run({ value: input[key2], issues: [] }, ctx);
           if (result instanceof Promise) {
             proms.push(result.then((result2) => {
               if (result2.issues.length) {
-                payload.issues.push(...prefixIssues(key, result2.issues));
+                payload.issues.push(...prefixIssues(key2, result2.issues));
               }
               payload.value[outKey] = result2.value;
             }));
           } else {
             if (result.issues.length) {
-              payload.issues.push(...prefixIssues(key, result.issues));
+              payload.issues.push(...prefixIssues(key2, result.issues));
             }
             payload.value[outKey] = result.value;
           }
         }
       }
       let unrecognized;
-      for (const key in input) {
-        if (!recordKeys.has(key)) {
+      for (const key2 in input) {
+        if (!recordKeys.has(key2)) {
           unrecognized = unrecognized ?? [];
-          unrecognized.push(key);
+          unrecognized.push(key2);
         }
       }
       if (unrecognized && unrecognized.length > 0) {
@@ -4048,18 +4276,18 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
       }
     } else {
       payload.value = {};
-      for (const key of Reflect.ownKeys(input)) {
-        if (key === "__proto__")
+      for (const key2 of Reflect.ownKeys(input)) {
+        if (key2 === "__proto__")
           continue;
-        if (!Object.prototype.propertyIsEnumerable.call(input, key))
+        if (!Object.prototype.propertyIsEnumerable.call(input, key2))
           continue;
-        let keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+        let keyResult = def.keyType._zod.run({ value: key2, issues: [] }, ctx);
         if (keyResult instanceof Promise) {
           throw new Error("Async schemas not supported in object keys currently");
         }
-        const checkNumericKey = typeof key === "string" && number.test(key) && keyResult.issues.length;
+        const checkNumericKey = typeof key2 === "string" && number.test(key2) && keyResult.issues.length;
         if (checkNumericKey) {
-          const retryResult = def.keyType._zod.run({ value: Number(key), issues: [] }, ctx);
+          const retryResult = def.keyType._zod.run({ value: Number(key2), issues: [] }, ctx);
           if (retryResult instanceof Promise) {
             throw new Error("Async schemas not supported in object keys currently");
           }
@@ -4069,30 +4297,30 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
         }
         if (keyResult.issues.length) {
           if (def.mode === "loose") {
-            payload.value[key] = input[key];
+            payload.value[key2] = input[key2];
           } else {
             payload.issues.push({
               code: "invalid_key",
               origin: "record",
               issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
-              input: key,
-              path: [key],
+              input: key2,
+              path: [key2],
               inst
             });
           }
           continue;
         }
-        const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+        const result = def.valueType._zod.run({ value: input[key2], issues: [] }, ctx);
         if (result instanceof Promise) {
           proms.push(result.then((result2) => {
             if (result2.issues.length) {
-              payload.issues.push(...prefixIssues(key, result2.issues));
+              payload.issues.push(...prefixIssues(key2, result2.issues));
             }
             payload.value[keyResult.value] = result2.value;
           }));
         } else {
           if (result.issues.length) {
-            payload.issues.push(...prefixIssues(key, result.issues));
+            payload.issues.push(...prefixIssues(key2, result.issues));
           }
           payload.value[keyResult.value] = result.value;
         }
@@ -4119,15 +4347,15 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
     }
     const proms = [];
     payload.value = /* @__PURE__ */ new Map();
-    for (const [key, value] of input) {
-      const keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+    for (const [key2, value] of input) {
+      const keyResult = def.keyType._zod.run({ value: key2, issues: [] }, ctx);
       const valueResult = def.valueType._zod.run({ value, issues: [] }, ctx);
       if (keyResult instanceof Promise || valueResult instanceof Promise) {
         proms.push(Promise.all([keyResult, valueResult]).then(([keyResult2, valueResult2]) => {
-          handleMapResult(keyResult2, valueResult2, payload, key, input, inst, ctx);
+          handleMapResult(keyResult2, valueResult2, payload, key2, input, inst, ctx);
         }));
       } else {
-        handleMapResult(keyResult, valueResult, payload, key, input, inst, ctx);
+        handleMapResult(keyResult, valueResult, payload, key2, input, inst, ctx);
       }
     }
     if (proms.length)
@@ -4135,10 +4363,10 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
     return payload;
   };
 });
-function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
+function handleMapResult(keyResult, valueResult, final, key2, input, inst, ctx) {
   if (keyResult.issues.length) {
-    if (propertyKeyTypes.has(typeof key)) {
-      final.issues.push(...prefixIssues(key, keyResult.issues));
+    if (propertyKeyTypes.has(typeof key2)) {
+      final.issues.push(...prefixIssues(key2, keyResult.issues));
     } else {
       final.issues.push({
         code: "invalid_key",
@@ -4150,15 +4378,15 @@ function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
     }
   }
   if (valueResult.issues.length) {
-    if (propertyKeyTypes.has(typeof key)) {
-      final.issues.push(...prefixIssues(key, valueResult.issues));
+    if (propertyKeyTypes.has(typeof key2)) {
+      final.issues.push(...prefixIssues(key2, valueResult.issues));
     } else {
       final.issues.push({
         origin: "map",
         code: "invalid_element",
         input,
         inst,
-        key,
+        key: key2,
         issues: valueResult.issues.map((iss) => finalizeIssue(iss, ctx, config()))
       });
     }
@@ -11919,8 +12147,8 @@ function extractDefs(ctx, schema) {
     if (defId)
       seen.defId = defId;
     const schema2 = seen.schema;
-    for (const key in schema2) {
-      delete schema2[key];
+    for (const key2 in schema2) {
+      delete schema2[key2];
     }
     schema2.$ref = ref;
   };
@@ -11989,20 +12217,20 @@ function finalize(ctx, schema) {
       Object.assign(schema2, _cached);
       const isParentRef = zodSchema._zod.parent === ref;
       if (isParentRef) {
-        for (const key in schema2) {
-          if (key === "$ref" || key === "allOf")
+        for (const key2 in schema2) {
+          if (key2 === "$ref" || key2 === "allOf")
             continue;
-          if (!(key in _cached)) {
-            delete schema2[key];
+          if (!(key2 in _cached)) {
+            delete schema2[key2];
           }
         }
       }
       if (refSchema.$ref && refSeen.def) {
-        for (const key in schema2) {
-          if (key === "$ref" || key === "allOf")
+        for (const key2 in schema2) {
+          if (key2 === "$ref" || key2 === "allOf")
             continue;
-          if (key in refSeen.def && JSON.stringify(schema2[key]) === JSON.stringify(refSeen.def[key])) {
-            delete schema2[key];
+          if (key2 in refSeen.def && JSON.stringify(schema2[key2]) === JSON.stringify(refSeen.def[key2])) {
+            delete schema2[key2];
           }
         }
       }
@@ -12014,11 +12242,11 @@ function finalize(ctx, schema) {
       if (parentSeen?.schema.$ref) {
         schema2.$ref = parentSeen.schema.$ref;
         if (parentSeen.def) {
-          for (const key in schema2) {
-            if (key === "$ref" || key === "allOf")
+          for (const key2 in schema2) {
+            if (key2 === "$ref" || key2 === "allOf")
               continue;
-            if (key in parentSeen.def && JSON.stringify(schema2[key]) === JSON.stringify(parentSeen.def[key])) {
-              delete schema2[key];
+            if (key2 in parentSeen.def && JSON.stringify(schema2[key2]) === JSON.stringify(parentSeen.def[key2])) {
+              delete schema2[key2];
             }
           }
         }
@@ -12119,8 +12347,8 @@ function isTransforming(_schema, _ctx) {
     return isTransforming(def.in, ctx) || isTransforming(def.out, ctx);
   }
   if (def.type === "object") {
-    for (const key in def.shape) {
-      if (isTransforming(def.shape[key], ctx))
+    for (const key2 in def.shape) {
+      if (isTransforming(def.shape[key2], ctx))
         return true;
     }
     return false;
@@ -12409,15 +12637,15 @@ var objectProcessor = (schema, ctx, _json, params) => {
   json3.type = "object";
   json3.properties = {};
   const shape = def.shape;
-  for (const key in shape) {
-    json3.properties[key] = process2(shape[key], ctx, {
+  for (const key2 in shape) {
+    json3.properties[key2] = process2(shape[key2], ctx, {
       ...params,
-      path: [...params.path, "properties", key]
+      path: [...params.path, "properties", key2]
     });
   }
   const allKeys = new Set(Object.keys(shape));
-  const requiredKeys = new Set([...allKeys].filter((key) => {
-    const v = def.shape[key]._zod;
+  const requiredKeys = new Set([...allKeys].filter((key2) => {
+    const v = def.shape[key2]._zod;
     if (ctx.io === "input") {
       return v.optin === void 0;
     } else {
@@ -12683,9 +12911,9 @@ function toJSONSchema(input, params) {
     };
     ctx2.external = external;
     for (const entry of registry2._idmap.entries()) {
-      const [key, schema] = entry;
+      const [key2, schema] = entry;
       extractDefs(ctx2, schema);
-      schemas[key] = finalize(ctx2, schema);
+      schemas[key2] = finalize(ctx2, schema);
     }
     if (Object.keys(defs).length > 0) {
       const defsSegment = ctx2.target === "draft-2020-12" ? "$defs" : "definitions";
@@ -13091,14 +13319,14 @@ function _installLazyMethods(inst, group, methods) {
   if (installed.has(group))
     return;
   installed.add(group);
-  for (const key in methods) {
-    const fn = methods[key];
-    Object.defineProperty(proto, key, {
+  for (const key2 in methods) {
+    const fn = methods[key2];
+    Object.defineProperty(proto, key2, {
       configurable: true,
       enumerable: false,
       get() {
         const bound = fn.bind(this);
-        Object.defineProperty(this, key, {
+        Object.defineProperty(this, key2, {
           configurable: true,
           writable: true,
           enumerable: true,
@@ -13107,7 +13335,7 @@ function _installLazyMethods(inst, group, methods) {
         return bound;
       },
       set(v) {
-        Object.defineProperty(this, key, {
+        Object.defineProperty(this, key2, {
           configurable: true,
           writable: true,
           enumerable: true,
@@ -14495,11 +14723,11 @@ function resolveRef(ref, ctx) {
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
   if (path[0] === defsKey) {
-    const key = path[1];
-    if (!key || !ctx.defs[key]) {
+    const key2 = path[1];
+    if (!key2 || !ctx.defs[key2]) {
       throw new Error(`Reference not found: ${ref}`);
     }
-    return ctx.defs[key];
+    return ctx.defs[key2];
   }
   throw new Error(`Reference not found: ${ref}`);
 }
@@ -14685,9 +14913,9 @@ function convertBaseSchema(schema, ctx) {
       const shape = {};
       const properties = schema.properties || {};
       const requiredSet = new Set(schema.required || []);
-      for (const [key, propSchema] of Object.entries(properties)) {
+      for (const [key2, propSchema] of Object.entries(properties)) {
         const propZodSchema = convertSchema(propSchema, ctx);
-        shape[key] = requiredSet.has(key) ? propZodSchema : propZodSchema.optional();
+        shape[key2] = requiredSet.has(key2) ? propZodSchema : propZodSchema.optional();
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
@@ -14828,20 +15056,20 @@ function convertSchema(schema, ctx) {
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
-  for (const key of coreMetadataKeys) {
-    if (key in schema) {
-      extraMeta[key] = schema[key];
+  for (const key2 of coreMetadataKeys) {
+    if (key2 in schema) {
+      extraMeta[key2] = schema[key2];
     }
   }
   const contentMetadataKeys = ["contentEncoding", "contentMediaType", "contentSchema"];
-  for (const key of contentMetadataKeys) {
-    if (key in schema) {
-      extraMeta[key] = schema[key];
+  for (const key2 of contentMetadataKeys) {
+    if (key2 in schema) {
+      extraMeta[key2] = schema[key2];
     }
   }
-  for (const key of Object.keys(schema)) {
-    if (!RECOGNIZED_KEYS.has(key)) {
-      extraMeta[key] = schema[key];
+  for (const key2 of Object.keys(schema)) {
+    if (!RECOGNIZED_KEYS.has(key2)) {
+      extraMeta[key2] = schema[key2];
     }
   }
   if (Object.keys(extraMeta).length > 0) {
@@ -14936,18 +15164,28 @@ Frame upload interrupted; retrying in ${delay / 1e3}s.
   }
 }
 async function submitFrameCapture(client, id, directory) {
-  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join2(directory, "capture-manifest.json"), "utf8")));
+  const manifest = frameManifestSchema.parse(JSON.parse(await readFile3(join3(directory, "capture-manifest.json"), "utf8")));
   let status = await client.beginEncoding(id, manifest);
   if (status.status === "failed") status = await client.retryEncoding(id);
   if (status.status !== "uploading") {
     if (["expired", "cancelled"].includes(status.status)) throw new Error(`Capture ${status.status}; it cannot be retried.`);
     return status;
   }
-  const file2 = await open(join2(directory, "frames.bin"), "r");
+  const file2 = await open(join3(directory, "frames.bin"), "r");
   try {
     const total = manifest.frames.reduce((n, f) => n + f.size, 0);
     if ((await file2.stat()).size !== total) throw new Error("Capture bytes do not match the manifest.");
     const uploaded = new Set(status.uploadedParts);
+    let acceptedBytes = [...uploaded].reduce((sum, part) => sum + (Number.isInteger(part) && part >= 0 && part < Math.ceil(total / ENCODING_PART_BYTES) ? Math.min(ENCODING_PART_BYTES, total - part * ENCODING_PART_BYTES) : 0), 0);
+    let transferredBytes = 0;
+    const startedAt = Date.now();
+    const progress = () => {
+      const seconds = (Date.now() - startedAt) / 1e3;
+      const rate = seconds > 0 ? transferredBytes / seconds : 0;
+      const remaining = rate > 0 ? ` \xB7 about ${Math.ceil((total - acceptedBytes) / rate)}s left` : "";
+      process.stderr.write(`\ruploading frames ${Math.floor(acceptedBytes / total * 100)}% \xB7 ${(acceptedBytes / 1048576).toFixed(2)}/${(total / 1048576).toFixed(2)} MiB${rate > 0 ? ` \xB7 ${(rate / 1048576).toFixed(2)} MiB/s` : ""}${remaining}`);
+    };
+    progress();
     for (let part = 0; part < Math.ceil(total / ENCODING_PART_BYTES); part++) {
       if (uploaded.has(part)) continue;
       const bytes = Buffer.alloc(Math.min(ENCODING_PART_BYTES, total - part * ENCODING_PART_BYTES));
@@ -14958,11 +15196,14 @@ async function submitFrameCapture(client, id, directory) {
         offset += r.bytesRead;
       }
       await withFrameUploadRetry(() => client.uploadEncodingPart(id, part, bytes));
-      process.stderr.write(`\ruploading frames ${Math.round(Math.min(total, (part + 1) * ENCODING_PART_BYTES) / total * 100)}%`);
+      acceptedBytes += bytes.length;
+      transferredBytes += bytes.length;
+      progress();
     }
   } finally {
     await file2.close();
   }
+  process.stderr.write("\nFrame upload complete; submitting for encoding.\n");
   return client.completeEncoding(id);
 }
 async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
@@ -14974,39 +15215,133 @@ async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
     process.stderr.write(`\r${status.status.padEnd(20)}`);
     await new Promise((r) => setTimeout(r, 2e3));
   }
-  throw new Error(`Encoding continues remotely. Check rill record status ${id}.`);
+  throw new ControlPlaneError("processing_pending", "Encoding continues remotely.", `Run ${client.recordingStatusCommand(id)}.`, { recordingId: id, nextCommand: client.recordingStatusCommand(id) });
 }
 
 // src/cli.ts
-import { spawn as spawn6 } from "child_process";
-import { hostname as hostname4 } from "os";
+import { spawn as spawn8 } from "child_process";
+import { hostname as hostname4, tmpdir as tmpdir3 } from "os";
 import { Command } from "commander";
-import { basename, dirname as dirname2 } from "path";
-import { readdir as readdir2, rm as rm5, stat as stat4 } from "fs/promises";
+import { basename, dirname as dirname2, join as join11 } from "path";
+import { readdir as readdir2, rm as rm7, stat as stat5 } from "fs/promises";
 
-// ../recorder/src/client.ts
-import { request as request2 } from "http";
-import { spawn as spawn2 } from "child_process";
+// ../recorder/src/windows-ipc.ts
+import { spawn as spawn3 } from "child_process";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { link, lstat, mkdir as mkdir3, readFile as readFile4, rm as rm3, writeFile as writeFile2 } from "fs/promises";
+import { join as join5, win32 as win322 } from "path";
 
 // ../recorder/src/paths.ts
-import { homedir as homedir2, tmpdir } from "os";
-import { join as join3 } from "path";
-var rillDirectory = () => process.env.RILL_HOME ?? join3(homedir2(), ".rill");
-var daemonSocketPath = () => process.env.RILL_SOCKET ?? join3(rillDirectory(), "recorder-v2.sock");
-var daemonStatePath = () => join3(rillDirectory(), "sessions-v2.json");
-var recordingTempRoot = () => process.env.RILL_TEMP ?? join3(tmpdir(), "rill-recordings");
+import { homedir as homedir3, tmpdir } from "os";
+import { join as join4 } from "path";
+var rillDirectory = () => process.env.RILL_HOME ?? join4(homedir3(), ".rill");
+var daemonSocketPath = () => process.env.RILL_SOCKET ?? join4(rillDirectory(), "recorder-v2.sock");
+var daemonStatePath = () => join4(rillDirectory(), "sessions-v2.json");
+var recordingTempRoot = () => process.env.RILL_TEMP ?? join4(tmpdir(), "rill-recordings");
+
+// ../recorder/src/windows-ipc.ts
+var aclScript = String.raw`$ErrorActionPreference='Stop';try {
+ $path=([Console]::In.ReadToEnd() | ConvertFrom-Json).path
+ $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User
+ $acl=[System.Security.AccessControl.DirectorySecurity]::new()
+ $acl.SetOwner($sid)
+ $acl.SetAccessRuleProtection($true,$false)
+ $rule=[System.Security.AccessControl.FileSystemAccessRule]::new($sid,[System.Security.AccessControl.FileSystemRights]::FullControl,[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)
+ $acl.AddAccessRule($rule)
+ ([System.IO.DirectoryInfo]::new($path)).SetAccessControl($acl)
+ [Console]::Out.Write('secured')
+}catch{[Console]::Error.Write('Recorder directory protection failed.');exit 1}`;
+async function secureWindowsIpcDirectory(path) {
+  if (process.platform !== "win32") throw new Error("Windows IPC directory protection requires Windows.");
+  await new Promise((resolve, reject) => {
+    const executable = win322.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    const child = spawn3(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", aclScript], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    let output = "", failed = false;
+    const fail2 = () => {
+      if (failed) return;
+      failed = true;
+      child.kill();
+      reject(new Error("Cannot secure the Windows recorder directory. Recording has not started."));
+    };
+    const timer = setTimeout(fail2, 15e3);
+    child.once("error", fail2);
+    child.stdin.once("error", fail2);
+    child.stderr.resume();
+    child.stdout.on("data", (chunk) => {
+      output += chunk.toString("ascii");
+      if (output.length > 1024) fail2();
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failed) return;
+      if (code !== 0 || output !== "secured") {
+        fail2();
+        return;
+      }
+      resolve();
+    });
+    child.stdin.end(JSON.stringify({ path }));
+  });
+}
+function validWindowsIpcIdentity(value) {
+  const v = value;
+  return v?.version === 1 && typeof v.pipe === "string" && /^\\\\\.\\pipe\\rill-v3-[a-f0-9]{64}$/.test(v.pipe) && typeof v.token === "string" && /^[a-f0-9]{64}$/.test(v.token);
+}
+function acceptsWindowsIpcToken(expected, header) {
+  if (typeof header !== "string" || !/^Bearer [a-f0-9]{64}$/.test(header)) return false;
+  const supplied = header.slice(7);
+  return supplied.length === expected.length && timingSafeEqual(Buffer.from(supplied), Buffer.from(expected));
+}
+async function windowsIpcIdentity(directory = join5(rillDirectory(), "windows-ipc-v3"), secure = secureWindowsIpcDirectory) {
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  if ((await lstat(directory)).isSymbolicLink()) throw new Error("Recorder directory cannot be a symbolic link.");
+  await secure(directory);
+  const path = join5(directory, "identity.json");
+  const load = async () => {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw new Error("Invalid recorder identity.");
+    const value = JSON.parse(await readFile4(path, "utf8"));
+    if (!validWindowsIpcIdentity(value)) throw new Error("Invalid recorder identity.");
+    return value;
+  };
+  try {
+    return await load();
+  } catch (e) {
+    if (e.code !== "ENOENT") throw new Error("Cannot read the protected recorder identity.");
+  }
+  const identity = { version: 1, pipe: "\\\\.\\pipe\\rill-v3-" + randomBytes2(32).toString("hex"), token: randomBytes2(32).toString("hex") };
+  const temporary = join5(directory, randomBytes2(16).toString("hex") + ".tmp");
+  try {
+    await writeFile2(temporary, JSON.stringify(identity), { mode: 384, flag: "wx" });
+    try {
+      await link(temporary, path);
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+    return await load();
+  } finally {
+    await rm3(temporary, { force: true });
+  }
+}
 
 // ../recorder/src/client.ts
+import { request as request2 } from "http";
+import { spawn as spawn4 } from "child_process";
 async function ensureDaemon(cliEntryPath) {
   try {
     await callDaemon("GET", "/health");
     return;
   } catch {
   }
-  const child = spawn2(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
+  const child = spawn4(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env, windowsHide: true });
+  let startupError;
+  child.once("error", () => {
+    startupError = new Error("The local recorder process could not be launched.");
+  });
   child.unref();
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline) {
+    if (startupError) throw startupError;
     try {
       await callDaemon("GET", "/health");
       return;
@@ -15025,10 +15360,16 @@ function stopRecording(recordingId) {
 function recordingStatus(recordingId) {
   return callDaemon("GET", `/sessions/${encodeURIComponent(recordingId)}`);
 }
-function callDaemon(method, path, body) {
+var windowsIdentityPromise;
+async function callDaemon(method, path, body) {
+  if (process.platform === "win32" && process.env.RILL_SOCKET) throw new Error("RILL_SOCKET overrides are not supported by authenticated Windows IPC. Unset it before recording.");
+  const identity = process.platform === "win32" ? await (windowsIdentityPromise ??= windowsIpcIdentity().catch((error51) => {
+    windowsIdentityPromise = void 0;
+    throw error51;
+  })) : void 0;
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
-    const outgoing = request2({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
+    const outgoing = request2({ socketPath: identity?.pipe ?? daemonSocketPath(), method, path, headers: { ...payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : {}, ...identity ? { Authorization: "Bearer " + identity.token } : {} } }, (incoming) => {
       const chunks = [];
       incoming.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
       incoming.on("end", () => {
@@ -15041,6 +15382,7 @@ function callDaemon(method, path, body) {
         }
       });
     });
+    outgoing.setTimeout(path === "/health" ? 2e3 : 12e4, () => outgoing.destroy(new Error("Local recorder request timed out.")));
     outgoing.once("error", reject);
     if (payload) outgoing.write(payload);
     outgoing.end();
@@ -15048,17 +15390,17 @@ function callDaemon(method, path, body) {
 }
 
 // ../recorder/src/retention.ts
-import { readdir, readFile as readFile3, rm as rm2 } from "fs/promises";
-import { join as join4 } from "path";
+import { readdir, readFile as readFile5, rm as rm4 } from "fs/promises";
+import { join as join6 } from "path";
 async function purgeExpiredRemoteCaptures(root, now = Date.now()) {
   const removed = [];
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
-    const directory = join4(root, id);
+    const directory = join6(root, id);
     try {
-      const marker = JSON.parse(await readFile3(join4(directory, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile5(join6(directory, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt !== "number" || marker.expiresAt > now) continue;
-      await rm2(directory, { recursive: true, force: true });
+      await rm4(directory, { recursive: true, force: true });
       removed.push(id);
     } catch {
     }
@@ -15069,7 +15411,7 @@ async function hasRetainedRemoteCaptures(root) {
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
     try {
-      const marker = JSON.parse(await readFile3(join4(root, id, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile5(join6(root, id, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt === "number" && Number.isFinite(marker.expiresAt)) return true;
     } catch {
     }
@@ -15079,8 +15421,189 @@ async function hasRetainedRemoteCaptures(root) {
 
 // ../recorder/src/daemon.ts
 import { createServer as createServer2 } from "http";
-import { mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat3 } from "fs/promises";
-import { dirname, join as join8 } from "path";
+import { mkdir as mkdir7, readFile as readFile7, unlink, writeFile as writeFile6, rename as rename2, stat as stat4, chmod } from "fs/promises";
+import { dirname, join as join10 } from "path";
+
+// ../contracts/src/cloud-blocklist.ts
+var blockedCloudDomains = [
+  // Torrent indexes and unofficial software-download destinations.
+  // Explicit domains only: do not block legitimate torrent clients or all downloads.
+  "yasdl.com",
+  "soft98.ir",
+  "downloadha.com",
+  "patoghu.com",
+  "thepiratebay.org",
+  "1337x.to",
+  "yts.mx",
+  "eztvx.to",
+  "fitgirl-repacks.site",
+  "dodi-repacks.site",
+  // Search and reference
+  "google.com",
+  "google.co.uk",
+  "google.co.in",
+  "google.com.ng",
+  "google.ca",
+  "google.com.au",
+  "google.de",
+  "google.fr",
+  "google.co.jp",
+  "google.com.br",
+  "google.es",
+  "bing.com",
+  "yahoo.com",
+  "duckduckgo.com",
+  "baidu.com",
+  "yandex.com",
+  "yandex.ru",
+  "wikipedia.org",
+  "quora.com",
+  // Social networks and media
+  "reddit.com",
+  "redd.it",
+  "facebook.com",
+  "fb.com",
+  "instagram.com",
+  "threads.net",
+  "threads.com",
+  "twitter.com",
+  "x.com",
+  "t.co",
+  "linkedin.com",
+  "tiktok.com",
+  "pinterest.com",
+  "snapchat.com",
+  "youtube.com",
+  "youtu.be",
+  "twitch.tv",
+  "discord.com",
+  "discord.gg",
+  "telegram.org",
+  "t.me",
+  "whatsapp.com",
+  // Shopping and marketplaces
+  "amazon.com",
+  "amazon.co.uk",
+  "amazon.ca",
+  "amazon.de",
+  "amazon.fr",
+  "amazon.in",
+  "amazon.co.jp",
+  "amazon.com.au",
+  "amazon.it",
+  "amazon.es",
+  "ebay.com",
+  "ebay.co.uk",
+  "etsy.com",
+  "walmart.com",
+  "target.com",
+  "aliexpress.com",
+  "alibaba.com",
+  "temu.com",
+  "shein.com",
+  "craigslist.org",
+  "facebookmarketplace.com",
+  "bestbuy.com",
+  "costco.com",
+  "homedepot.com",
+  "wayfair.com",
+  "mercadolibre.com",
+  "shopee.com",
+  "lazada.com",
+  "jiji.ng",
+  "jumia.com.ng",
+  "konga.com",
+  "propertypro.ng",
+  "property24.com",
+  // Travel, property, jobs and business directories
+  "airbnb.com",
+  "airbnb.co.uk",
+  "airbnb.ca",
+  "airbnb.com.au",
+  "airbnb.fr",
+  "airbnb.de",
+  "booking.com",
+  "expedia.com",
+  "tripadvisor.com",
+  "agoda.com",
+  "hotels.com",
+  "kayak.com",
+  "skyscanner.net",
+  "zillow.com",
+  "realtor.com",
+  "rightmove.co.uk",
+  "zoopla.co.uk",
+  "indeed.com",
+  "glassdoor.com",
+  "yelp.com",
+  "yellowpages.com",
+  "trustpilot.com",
+  "crunchbase.com",
+  "g2.com",
+  "capterra.com",
+  "clutch.co",
+  "zoominfo.com",
+  "apollo.io",
+  "monster.com",
+  "ziprecruiter.com",
+  "seek.com.au",
+  "naukri.com",
+  "redfin.com",
+  "trulia.com",
+  "apartments.com",
+  "realtor.ca",
+  "realestate.com.au",
+  "vrbo.com",
+  "trip.com",
+  "trivago.com",
+  "hostelworld.com"
+];
+var blockedCloudTargetMessage = "This website is not supported for cloud runs. Use your own website or app instead.";
+function isBlockedCloudTarget(value) {
+  try {
+    const hostname5 = new URL(value).hostname.toLowerCase().replace(/\.+$/, "");
+    return blockedCloudDomains.some((domain2) => hostname5 === domain2 || hostname5.endsWith(`.${domain2}`));
+  } catch {
+    return false;
+  }
+}
+
+// ../contracts/src/cloud-run.ts
+var publicTarget = external_exports.string().url().max(2048).refine((value) => {
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    return false;
+  }
+  return ["http:", "https:"].includes(u.protocol) && !u.username && !u.password && !u.port && !u.hash && u.hostname.includes(".") && !/^[0-9.]+$/.test(u.hostname) && !u.hostname.endsWith(".exe.xyz") && !u.hostname.endsWith(".local") && !u.hostname.endsWith(".internal") && !u.hostname.endsWith(".localhost");
+}, "Use a public HTTP(S) URL without credentials, fragments, or a custom port.");
+var cloudRunTarget = publicTarget.refine((value) => !isBlockedCloudTarget(value), blockedCloudTargetMessage);
+var interactionFields = {
+  mode: external_exports.enum(["browse", "interact"]).optional(),
+  interactionConfirmed: external_exports.boolean().optional(),
+  // Legacy payload compatibility only; Interact automatically permits API destinations.
+  allowedWriteOrigins: external_exports.array(cloudRunTarget.refine((v) => new URL(v).origin === v, "Use an exact origin.")).max(5).optional()
+};
+var sideEffectSchema = external_exports.object({
+  action: external_exports.enum(["fill", "check", "select", "press", "click"]),
+  page: external_exports.string().max(2048),
+  target: external_exports.string().max(160),
+  status: external_exports.enum(["performed", "unknown"])
+}).strict();
+var interactionReportFields = {
+  mode: external_exports.enum(["browse", "interact"]).optional(),
+  sideEffects: external_exports.array(sideEffectSchema).max(30).optional(),
+  cleanup: external_exports.literal("not_attempted").optional()
+};
+var cloudSubmission = external_exports.object({ ...interactionFields, id: external_exports.string().uuid(), url: cloudRunTarget, prompt: external_exports.string().trim().min(1).max(2e3), expectation: external_exports.string().trim().min(1).max(1e3).optional(), account: external_exports.string().regex(/^[a-z0-9-]{1,60}$/).optional() }).strict();
+var siteAccountSchema = external_exports.object({
+  name: external_exports.string().regex(/^[a-z0-9-]{1,60}$/),
+  origin: publicTarget.refine((v) => new URL(v).protocol === "https:" && new URL(v).origin === v, "Use an exact HTTPS origin."),
+  loginUrl: publicTarget.refine((v) => new URL(v).protocol === "https:").optional(),
+  username: external_exports.string().min(1).max(320),
+  password: external_exports.string().min(1).max(1e3)
+}).strict().refine((v) => !v.loginUrl || new URL(v.loginUrl).origin === v.origin, "Login must use the saved website origin.");
 
 // ../contracts/src/recording.ts
 var cursorAppearanceSchema = external_exports.object({
@@ -15121,6 +15644,7 @@ var recordingSchema = external_exports.object({
   })
 });
 var agentOutcomeSchema = external_exports.object({
+  ...interactionReportFields,
   outcome: external_exports.enum(["walkthrough", "passed", "failed", "inconclusive"]),
   summary: external_exports.string().min(1).max(1e3),
   evidence: external_exports.string().max(1e3)
@@ -15208,15 +15732,15 @@ async function attachCursorOverlay(page, cdp, input) {
   const appearance = cursorAppearanceSchema.parse(input ?? {});
   if (!appearance.enabled) return async () => {
   };
-  const key = `__rillCursor_${crypto.randomUUID().replaceAll("-", "")}`;
-  const source = `(${installCursorOverlay.toString()})(${JSON.stringify({ ...appearance, key })})`;
+  const key2 = `__rillCursor_${crypto.randomUUID().replaceAll("-", "")}`;
+  const source = `(${installCursorOverlay.toString()})(${JSON.stringify({ ...appearance, key: key2 })})`;
   await cdp.send("Page.enable");
   const { identifier } = await cdp.send("Page.addScriptToEvaluateOnNewDocument", { source });
   let stopped = false;
-  const removeFromFrame = (frame) => frame.evaluate((key2) => {
-    const cleanup2 = window[key2];
+  const removeFromFrame = (frame) => frame.evaluate((key3) => {
+    const cleanup2 = window[key3];
     if (typeof cleanup2 === "function") cleanup2();
-  }, key).catch(() => void 0);
+  }, key2).catch(() => void 0);
   const onNavigation = (frame) => {
     if (stopped) return;
     void frame.evaluate(source).then(() => {
@@ -15241,10 +15765,10 @@ async function attachCursorOverlay(page, cdp, input) {
 
 // ../recorder/src/session.ts
 import { chromium } from "playwright-core";
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { createServer } from "net";
-import { mkdir as mkdir4, mkdtemp, rm as rm3, writeFile as writeFile3 } from "fs/promises";
-import { join as join7 } from "path";
+import { mkdir as mkdir6, mkdtemp, rm as rm5, writeFile as writeFile5 } from "fs/promises";
+import { join as join9 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // ../recorder/src/bundle.ts
@@ -15270,11 +15794,16 @@ async function writeBundle(bundle, outputPath) {
 
 // ../recorder/src/environment.ts
 import { existsSync } from "fs";
-function findChromeExecutable() {
-  if (process.env.RILL_CHROME_PATH) return process.env.RILL_CHROME_PATH;
-  if (process.platform === "darwin") return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
+import { win32 as win323 } from "path";
+function findChromeExecutable(platform = process.platform, env = process.env, exists = existsSync) {
+  if (env.RILL_CHROME_PATH) return env.RILL_CHROME_PATH;
+  if (platform === "darwin") return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
+  if (platform === "win32") {
+    const candidates2 = [env.PROGRAMFILES ?? env.ProgramFiles, env["PROGRAMFILES(X86)"] ?? env["ProgramFiles(x86)"], env.LOCALAPPDATA].filter((root) => Boolean(root)).map((root) => win323.join(root, "Google", "Chrome", "Application", "chrome.exe"));
+    return candidates2.find(exists) ?? win323.join(env.PROGRAMFILES ?? env.ProgramFiles ?? "C:\\Program Files", "Google", "Chrome", "Application", "chrome.exe");
+  }
   const candidates = ["/usr/bin/google-chrome", "/usr/bin/google-chrome-stable", "/usr/bin/chromium", "/usr/bin/chromium-browser"];
-  return candidates.find((candidate) => existsSync(candidate)) ?? "google-chrome";
+  return candidates.find(exists) ?? "google-chrome";
 }
 
 // ../recorder/src/redaction.ts
@@ -15286,7 +15815,7 @@ function sanitizeUrl(input) {
     url2.username = "";
     url2.password = "";
     url2.hash = "";
-    for (const key of [...url2.searchParams.keys()]) url2.searchParams.set(key, "[REDACTED]");
+    for (const key2 of [...url2.searchParams.keys()]) url2.searchParams.set(key2, "[REDACTED]");
     return url2.toString();
   } catch {
     return "[invalid-url]";
@@ -15317,16 +15846,16 @@ function redactJson(value, depth = 0) {
   if (depth > 12) return "[TRUNCATED]";
   if (Array.isArray(value)) return value.slice(0, 100).map((item) => redactJson(item, depth + 1));
   if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).slice(0, 200).map(([key, child]) => [key, secretKeyPattern.test(key) ? "[REDACTED]" : redactJson(child, depth + 1)]));
+    return Object.fromEntries(Object.entries(value).slice(0, 200).map(([key2, child]) => [key2, secretKeyPattern.test(key2) ? "[REDACTED]" : redactJson(child, depth + 1)]));
   }
   if (typeof value === "string") return redactText(value, 8e3);
   return value;
 }
 
 // ../recorder/src/encoding.ts
-import { open as open2, writeFile, mkdir as mkdir2 } from "fs/promises";
-import { spawn as spawn3 } from "child_process";
-import { join as join5 } from "path";
+import { open as open2, writeFile as writeFile3, mkdir as mkdir4 } from "fs/promises";
+import { spawn as spawn5 } from "child_process";
+import { join as join7 } from "path";
 var active = 0;
 var waiting = [];
 function encodingConcurrency() {
@@ -15334,8 +15863,22 @@ function encodingConcurrency() {
   if (!Number.isInteger(n) || n < 1 || n > 8) throw new Error("Invalid RILL_ENCODING_CONCURRENCY");
   return n;
 }
-async function withEncodingSlot(work) {
-  if (active >= encodingConcurrency()) await new Promise((resolve) => waiting.push(resolve));
+async function withEncodingSlot(work, signal) {
+  signal?.throwIfAborted();
+  if (active >= encodingConcurrency()) await new Promise((resolve, reject) => {
+    const granted = () => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    };
+    const abort = () => {
+      const i = waiting.indexOf(granted);
+      if (i >= 0) waiting.splice(i, 1);
+      reject(new Error("encoding_aborted"));
+    };
+    waiting.push(granted);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+  });
   else active++;
   try {
     return await work();
@@ -15356,11 +15899,15 @@ async function encodeFrames(directory, manifest, output, signal) {
       lines.push(`file 'frame-${String(i).padStart(6, "0")}.jpg'`, `duration ${Math.max(1 / 60, duration3).toFixed(6)}`);
     }
     lines.push(`file 'frame-${String(manifest.frames.length - 1).padStart(6, "0")}.jpg'`);
-    await writeFile(join5(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
+    await writeFile3(join7(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
     const threads = Number(process.env.RILL_FFMPEG_THREADS ?? 1);
     if (!Number.isInteger(threads) || threads < 1 || threads > 16) throw new Error("Invalid RILL_FFMPEG_THREADS");
+    signal?.throwIfAborted();
+    const dimensions = `scale=${manifest.width}:${manifest.height}:force_original_aspect_ratio=decrease,pad=${manifest.width}:${manifest.height}:(ow-iw)/2:(oh-ih)/2,setsar=1`;
+    const filters = output.endsWith(".mp4") ? `${dimensions},fps=30,tpad=stop_mode=clone:stop_duration=1` : dimensions;
+    const codec2 = output.endsWith(".mp4") ? ["-c:v", "libx264", "-preset", "veryfast", "-crf", "23", "-movflags", "+faststart", "-fps_mode", "cfr", "-t", String(Math.min(60, manifest.durationSeconds))] : ["-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-b:v", "0", "-crf", "32"];
     await new Promise((resolve, reject) => {
-      const child = spawn3(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
+      const child = spawn5(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-vf", filters, ...codec2, "-threads", String(threads), "-y", output], { cwd: directory, windowsHide: true, stdio: ["ignore", "ignore", "pipe"] });
       let stderr = "";
       child.stderr.on("data", (chunk) => {
         stderr = (stderr + String(chunk)).slice(-2e3);
@@ -15368,6 +15915,7 @@ async function encodeFrames(directory, manifest, output, signal) {
       const abort = () => child.kill("SIGKILL");
       const timer = setTimeout(abort, 20 * 6e4);
       signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted) abort();
       const clean = () => {
         clearTimeout(timer);
         signal?.removeEventListener("abort", abort);
@@ -15381,12 +15929,12 @@ async function encodeFrames(directory, manifest, output, signal) {
         code === 0 ? resolve() : reject(new Error(`ffmpeg failed (${code}): ${stderr}`));
       });
     });
-  });
+  }, signal);
 }
 
 // ../recorder/src/screencast.ts
-import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
-import { join as join6 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile6, open as open3 } from "fs/promises";
+import { join as join8 } from "path";
 var ScreencastRecorder = class {
   constructor(session, directory, width, height) {
     this.session = session;
@@ -15394,6 +15942,10 @@ var ScreencastRecorder = class {
     this.width = width;
     this.height = height;
   }
+  session;
+  directory;
+  width;
+  height;
   frames = [];
   pendingWrites = /* @__PURE__ */ new Set();
   started = false;
@@ -15401,7 +15953,7 @@ var ScreencastRecorder = class {
   frameBytes = 0;
   captureError;
   async start() {
-    await mkdir3(this.directory, { recursive: true, mode: 448 });
+    await mkdir5(this.directory, { recursive: true, mode: 448 });
     this.session.on("Page.screencastFrame", (payload) => {
       const bytes = Buffer.from(payload.data, "base64");
       if (this.frameCounter >= 36e3 || this.frameBytes + bytes.length > ENCODING_MAX_BYTES || bytes.length > ENCODING_PART_BYTES) {
@@ -15410,9 +15962,9 @@ var ScreencastRecorder = class {
         return;
       }
       this.frameBytes += bytes.length;
-      const path = join6(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
+      const path = join8(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
       this.frameCounter += 1;
-      const write = writeFile2(path, bytes, { mode: 384 }).then(() => {
+      const write = writeFile4(path, bytes, { mode: 384 }).then(() => {
         this.frames.push({ path, timestamp: payload.metadata.timestamp ?? Date.now() / 1e3 });
       }).catch((error51) => {
         this.captureError = error51 instanceof Error ? error51 : new Error(String(error51));
@@ -15426,7 +15978,7 @@ var ScreencastRecorder = class {
     await this.session.send("Page.startScreencast", { format: "jpeg", quality: 82, maxWidth: this.width, maxHeight: this.height, everyNthFrame: 1 });
     this.started = true;
   }
-  async stop(outputPath, expectedDurationSeconds, captureOnly = false) {
+  async stop(outputPath, expectedDurationSeconds, captureOnly = false, signal) {
     if (this.started) await this.session.send("Page.stopScreencast").catch(() => void 0);
     await new Promise((resolve) => setTimeout(resolve, 120));
     await Promise.all(this.pendingWrites);
@@ -15434,10 +15986,10 @@ var ScreencastRecorder = class {
     if (!this.frames.length) throw new Error("No video frames were captured.");
     const ordered = this.frames.toSorted((a, b) => a.timestamp - b.timestamp);
     const frames = [];
-    const bundle = await open3(join6(this.directory, "frames.bin"), "w", 384);
+    const bundle = await open3(join8(this.directory, "frames.bin"), "w", 384);
     try {
       for (const frame of ordered) {
-        const bytes = await readFile4(frame.path);
+        const bytes = await readFile6(frame.path);
         await bundle.writeFile(bytes);
         frames.push({ timestamp: frame.timestamp, size: bytes.length });
       }
@@ -15445,8 +15997,8 @@ var ScreencastRecorder = class {
       await bundle.close();
     }
     const manifest = frameManifestSchema.parse({ version: 1, durationSeconds: Math.min(600, expectedDurationSeconds), width: this.width, height: this.height, frames });
-    await writeFile2(join6(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
-    if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath);
+    await writeFile4(join8(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
+    if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath, signal);
     return { frameCount: this.frames.length, outputPath };
   }
 };
@@ -15470,6 +16022,7 @@ var RecordingSession = class _RecordingSession {
   requestEvents = /* @__PURE__ */ new Map();
   stopPromise;
   maxTimer;
+  maxDurationSeconds;
   removeCursorOverlay;
   diagnosticsPaused = false;
   secretValues = [];
@@ -15480,7 +16033,10 @@ var RecordingSession = class _RecordingSession {
   bodyBytes = 0;
   truncated = false;
   constructor(options, runtime) {
+    this.maxDurationSeconds = options.maxDurationSeconds ?? 600;
     this.encoding = options.encoding ?? "local";
+    this.videoFormat = options.videoFormat ?? "webm";
+    this.captureSignal = options.signal;
     this.recordingId = options.recordingId;
     this.cdpUrl = runtime.cdpUrl;
     this.browser = runtime.browser;
@@ -15494,15 +16050,17 @@ var RecordingSession = class _RecordingSession {
   static async start(options) {
     const width = options.width ?? 1280;
     const height = options.height ?? 720;
-    await mkdir4(options.outputDirectory, { recursive: true, mode: 448 });
-    if (options.encoding === "remote") await writeFile3(join7(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
-    const runtime = options.cdpUrl ? await connectAttached(options.cdpUrl, options.outputDirectory) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer });
+    await mkdir6(options.outputDirectory, { recursive: true, mode: 448 });
+    if (options.encoding === "remote") await writeFile5(join9(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
+    const runtime = options.cdpUrl ? await connectAttached(options.cdpUrl, options.outputDirectory) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer, blockServiceWorkers: options.blockServiceWorkers });
     const cdpSession = await runtime.context.newCDPSession(runtime.page);
-    const screencast = new ScreencastRecorder(cdpSession, join7(options.outputDirectory, "frames"), width, height);
+    const screencast = new ScreencastRecorder(cdpSession, join9(options.outputDirectory, "frames"), width, height);
     const session = new _RecordingSession(options, { ...runtime, screencast });
     try {
       await session.attachDiagnostics(options.captureNetworkBodies ?? false);
-      session.removeCursorOverlay = await attachCursorOverlay(runtime.page, cdpSession, options.cursorAppearance);
+      if (!options.hideCursor) session.removeCursorOverlay = await attachCursorOverlay(runtime.page, cdpSession, options.cursorAppearance);
+      await options.beforeCapture?.(runtime.page);
+      session.startedAt = /* @__PURE__ */ new Date();
       await screencast.start();
       if (options.url) await session.page.goto(options.url, { waitUntil: "domcontentloaded" });
     } catch (error51) {
@@ -15511,7 +16069,7 @@ var RecordingSession = class _RecordingSession {
     }
     session.maxTimer = setTimeout(() => {
       void session.stop("max_duration").catch(() => void 0);
-    }, (options.maxDurationSeconds ?? 600) * 1e3);
+    }, Math.max(0, session.startedAt.getTime() + session.maxDurationSeconds * 1e3 - Date.now()));
     return session;
   }
   // In-process agents share this connection so exposed diagnostic bindings are
@@ -15520,7 +16078,17 @@ var RecordingSession = class _RecordingSession {
     return this.page;
   }
   status() {
-    return { recordingId: this.recordingId, cdpUrl: this.cdpUrl, startedAt: this.startedAt.toISOString(), status: this.stopPromise ? "finalizing" : "recording" };
+    const elapsedSeconds = Math.max(0, (Date.now() - this.startedAt.getTime()) / 1e3);
+    return {
+      recordingId: this.recordingId,
+      cdpUrl: this.cdpUrl,
+      startedAt: this.startedAt.toISOString(),
+      maxDurationSeconds: this.maxDurationSeconds,
+      elapsedSeconds,
+      remainingSeconds: this.stopPromise ? 0 : Math.max(0, this.maxDurationSeconds - elapsedSeconds),
+      stopsAt: new Date(this.startedAt.getTime() + this.maxDurationSeconds * 1e3).toISOString(),
+      status: this.stopPromise ? "finalizing" : "recording"
+    };
   }
   async stop(reason = "agent_request") {
     this.stopPromise ??= this.finalize(reason);
@@ -15530,8 +16098,8 @@ var RecordingSession = class _RecordingSession {
     if (this.maxTimer) clearTimeout(this.maxTimer);
     const durationSeconds = Math.max(0.1, (Date.now() - this.startedAt.getTime()) / 1e3);
     const outputDirectory = this.outputDirectory;
-    const videoPath = join7(outputDirectory, "recording.webm");
-    const diagnosticsPath = join7(outputDirectory, "diagnostics-v1.ndjson.gz");
+    const videoPath = join9(outputDirectory, `recording.${this.videoFormat}`);
+    const diagnosticsPath = join9(outputDirectory, "diagnostics-v1.ndjson.gz");
     const bundle = {
       schemaVersion: 1,
       capturePolicyVersion: "safe-default-v1",
@@ -15548,21 +16116,23 @@ var RecordingSession = class _RecordingSession {
     try {
       const safeBundle = JSON.parse(this.secretValues.reduce((text, secret) => text.split(JSON.stringify(secret).slice(1, -1)).join("[redacted]"), JSON.stringify(bundle)));
       await writeBundle(safeBundle, diagnosticsPath);
-      await this.screencast.stop(videoPath, durationSeconds, this.encoding === "remote");
+      await this.screencast.stop(videoPath, durationSeconds, this.encoding === "remote", this.captureSignal);
     } finally {
       await this.removeCursorOverlay?.();
       if (this.browserProcess) {
         await this.browser.close().catch(() => void 0);
         await terminateBrowser(this.browserProcess);
-        if (this.profileDirectory) await rm3(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+        if (this.profileDirectory) await rm5(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
       }
     }
     const consoleErrors = this.consoleEvents.filter((event) => event.severity === "error").length;
     const failedRequests = this.networkEvents.filter((event) => event.failureReason).length;
     const httpErrors = this.networkEvents.filter((event) => (event.status ?? 0) >= 400).length;
-    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join7(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
+    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join9(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
   }
   captureNetworkBodies = false;
+  captureSignal;
+  videoFormat = "webm";
   encoding = "local";
   outputDirectory = "";
   async attachDiagnostics(captureNetworkBodies) {
@@ -15672,7 +16242,7 @@ var RecordingSession = class _RecordingSession {
 };
 async function launchManaged(options) {
   const port = await getAvailablePort();
-  const profileDirectory = await mkdtemp(join7(tmpdir2(), "rill-chrome-"));
+  const profileDirectory = await mkdtemp(join9(tmpdir2(), "rill-chrome-"));
   const executable = findChromeExecutable();
   const args = [
     `--remote-debugging-port=${port}`,
@@ -15689,19 +16259,19 @@ async function launchManaged(options) {
     ...options.headed ? [] : ["--headless=new", "--hide-scrollbars"],
     "about:blank"
   ];
-  const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key))) : process.env;
-  const browserProcess = spawn4(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
+  const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key2]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key2))) : process.env;
+  const browserProcess = spawn6(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, windowsHide: true, env });
   const cdpUrl = `http://127.0.0.1:${port}`;
   try {
     await waitForCdp(cdpUrl, browserProcess);
     const browser = await chromium.connectOverCDP(cdpUrl, { artifactsDir: options.outputDirectory, isLocal: true });
-    const context = browser.contexts()[0];
+    const context = options.blockServiceWorkers ? await browser.newContext({ serviceWorkers: "block" }) : browser.contexts()[0];
     const page = context.pages()[0] ?? await context.newPage();
     await page.setViewportSize({ width: options.width, height: options.height });
     return { cdpUrl, browser, context, page, browserProcess, profileDirectory };
   } catch (error51) {
     await terminateBrowser(browserProcess);
-    await rm3(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+    await rm5(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
     throw error51;
   }
 }
@@ -15751,16 +16321,31 @@ async function waitForCdp(cdpUrl, browserProcess) {
 var sessions = /* @__PURE__ */ new Map();
 var lastActivity = Date.now();
 async function runDaemon() {
-  const socketPath = daemonSocketPath();
-  await mkdir5(dirname(socketPath), { recursive: true, mode: 448 });
-  await mkdir5(recordingTempRoot(), { recursive: true, mode: 448 });
+  if (process.platform === "win32" && process.env.RILL_SOCKET) throw new Error("RILL_SOCKET overrides are not supported by authenticated Windows IPC.");
+  const identity = process.platform === "win32" ? await windowsIpcIdentity() : void 0;
+  const socketPath = identity?.pipe ?? daemonSocketPath();
+  await mkdir7(identity ? dirname(daemonStatePath()) : dirname(socketPath), { recursive: true, mode: 448 });
+  await mkdir7(recordingTempRoot(), { recursive: true, mode: 448 });
   await restoreRecoverableSessions();
   await purgeExpiredCaptures();
-  await unlink(socketPath).catch((error51) => {
+  if (!identity) await unlink(socketPath).catch((error51) => {
     if (error51.code !== "ENOENT") throw error51;
   });
-  const server = createServer2((request3, response) => void route(request3, response));
-  server.listen(socketPath, () => process.platform !== "win32" && import("fs/promises").then(({ chmod }) => chmod(socketPath, 384)));
+  const server = createServer2((request3, response) => {
+    if (identity && !acceptsWindowsIpcToken(identity.token, request3.headers.authorization)) {
+      request3.resume();
+      json2(response, 401, { error: { code: "authentication_required", message: "Recorder authentication required." } });
+      return;
+    }
+    void route(request3, response);
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      if (identity) resolve();
+      else void chmod(socketPath, 384).then(resolve, reject);
+    });
+  });
   const idleTimer = setInterval(() => {
     void (async () => {
       await purgeExpiredCaptures();
@@ -15773,7 +16358,7 @@ async function runDaemon() {
   const close = () => {
     clearInterval(idleTimer);
     server.close();
-    void unlink(socketPath).catch(() => void 0);
+    if (!identity) void unlink(socketPath).catch(() => void 0);
   };
   process.once("SIGTERM", close);
   process.once("SIGINT", close);
@@ -15787,12 +16372,12 @@ async function route(request3, response) {
     try {
       const input = await readJson(request3);
       if (!/^rec_[a-zA-Z0-9_-]+$/.test(input.recordingId)) return json2(response, 400, { error: { code: "validation_failed", message: "recordingId is required." } });
-      const outputDirectory = join8(recordingTempRoot(), input.recordingId);
+      const outputDirectory = join10(recordingTempRoot(), input.recordingId);
       const session = await RecordingSession.start({ ...input, outputDirectory });
       const status = session.status();
       const entry = { session, base: { recordingId: status.recordingId, cdpUrl: status.cdpUrl, startedAt: status.startedAt }, state: "recording" };
       sessions.set(input.recordingId, entry);
-      const maxTimer = setTimeout(() => void finalizeEntry(entry, "max_duration"), (input.maxDurationSeconds ?? 600) * 1e3 + 250);
+      const maxTimer = setTimeout(() => void finalizeEntry(entry, "max_duration"), Math.max(0, Date.parse(status.stopsAt) - Date.now()) + 250);
       maxTimer.unref();
       await persistState();
       return json2(response, 201, session.status());
@@ -15827,11 +16412,18 @@ async function finalizeEntry(entry, reason) {
   await persistState();
 }
 function serializeEntry(entry) {
-  return { ...entry.base, status: entry.state, result: entry.result, error: entry.error };
+  return {
+    ...entry.base,
+    ...entry.session?.status(),
+    status: entry.state,
+    ...entry.state !== "recording" ? { remainingSeconds: 0, ...entry.result ? { elapsedSeconds: entry.result.durationSeconds } : {} } : {},
+    result: entry.result,
+    error: entry.error
+  };
 }
 async function restoreRecoverableSessions() {
   try {
-    const value = JSON.parse(await readFile5(daemonStatePath(), "utf8"));
+    const value = JSON.parse(await readFile7(daemonStatePath(), "utf8"));
     for (const [id, entry] of Object.entries(value)) {
       if (entry.status !== "ready" && entry.status !== "failed") continue;
       sessions.set(id, { base: { recordingId: entry.recordingId, cdpUrl: entry.cdpUrl, startedAt: entry.startedAt }, state: entry.status, result: entry.result, error: entry.error });
@@ -15842,9 +16434,9 @@ async function restoreRecoverableSessions() {
 async function persistState() {
   const state = Object.fromEntries([...sessions.entries()].map(([id, entry]) => [id, serializeEntry(entry)]));
   const temporary = daemonStatePath() + "." + crypto.randomUUID() + ".tmp";
-  await writeFile4(temporary, `${JSON.stringify(state, null, 2)}
+  await writeFile6(temporary, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
-  await rename(temporary, daemonStatePath());
+  await rename2(temporary, daemonStatePath());
 }
 async function readJson(request3) {
   const chunks = [];
@@ -15865,7 +16457,7 @@ async function purgeExpiredCaptures() {
   const removed = await purgeExpiredRemoteCaptures(recordingTempRoot());
   for (const id of removed) sessions.delete(id);
   let changed = removed.length > 0;
-  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat3(entry.result.frameDirectory).catch(() => null)) {
+  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat4(entry.result.frameDirectory).catch(() => null)) {
     sessions.delete(id);
     changed = true;
   }
@@ -15910,7 +16502,7 @@ function emit(value, pretty = false) {
 function failureValue(error51) {
   const message = error51 instanceof Error ? error51.message : String(error51);
   const [candidate] = message.split(":", 1);
-  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "scope_denied", "quota_exceeded", "browser_unavailable", "recording_not_found", "upload_interrupted", "processing_failed", "share_revoked", "validation_failed"]);
+  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "authorization_not_found", "expired_token", "access_denied", "unsupported_platform", "scope_denied", "quota_exceeded", "browser_unavailable", "recording_not_found", "upload_interrupted", "processing_pending", "processing_failed", "share_revoked", "validation_failed"]);
   const structured = error51 && typeof error51 === "object" ? error51 : {};
   const code = structured.code && knownCodes.has(structured.code) ? structured.code : knownCodes.has(candidate) ? candidate : "internal_error";
   return { error: { code, message, ...structured.recovery ? { recovery: structured.recovery } : {}, ...structured.details ? { details: structured.details } : {} } };
@@ -15977,7 +16569,7 @@ async function withRunFeedback(session, start) {
 }
 
 // src/doctor.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 
 // src/version.ts
 import { createRequire } from "module";
@@ -15986,6 +16578,7 @@ var CLI_VERSION = packageJson.version;
 
 // src/doctor.ts
 var defaultDependencies = {
+  platform: process.platform,
   encoding: "remote",
   encodingCapabilities: (apiUrl, token) => new ControlPlaneClient(apiUrl, token).encodingCapabilities(),
   nodeVersion: process.version,
@@ -16001,6 +16594,7 @@ async function runDoctor(apiUrl, overrides = {}) {
   const dependencies = { ...defaultDependencies, ...overrides };
   const checks = [];
   let feedbackEnabled = false;
+  checks.push(recorderTransportCheck(dependencies.platform));
   if (compareVersions(normalizeVersion(dependencies.nodeVersion), "22.0.0") >= 0) {
     checks.push({ name: "node", status: "pass", message: `Node.js ${dependencies.nodeVersion} is supported.`, version: dependencies.nodeVersion });
   } else {
@@ -16028,8 +16622,16 @@ async function runDoctor(apiUrl, overrides = {}) {
   if (!health) {
     checks.push({ name: "authentication", status: "skip", message: "Authentication was not checked because the API is unreachable.", recovery: `Restore API reachability, then run \`rill --api-url ${apiUrl} doctor\` again.` });
   } else {
-    const token = await dependencies.loadCredential(apiUrl);
-    if (!token) {
+    let token = null;
+    let credentialError;
+    try {
+      token = await dependencies.loadCredential(apiUrl);
+    } catch (error51) {
+      credentialError = error51;
+    }
+    if (credentialError) {
+      checks.push({ name: "authentication", status: "fail", message: errorMessage(credentialError), recovery: "Unlock the OS credential store, or use RILL_TOKEN. On Windows, use the same Windows account that saved the credential." });
+    } else if (!token) {
       checks.push({ name: "authentication", status: health.anonymousAccess ? "warn" : "fail", message: health.anonymousAccess ? "The first recording will create an anonymous identity in your OS credential store. Anonymous recordings expire after seven days." : "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
     } else {
       try {
@@ -16043,7 +16645,7 @@ async function runDoctor(apiUrl, overrides = {}) {
   }
   checks.push(await executableCheck("chrome", dependencies.chromePath, ["--version"], dependencies.commandVersion, "Install Google Chrome or Chromium, or set RILL_CHROME_PATH to its executable."));
   if (dependencies.encoding === "local") {
-    checks.push(await executableCheck("ffmpeg", dependencies.ffmpegPath, ["-version"], dependencies.commandVersion, process.platform === "darwin" ? "Install ffmpeg with `brew install ffmpeg`, or set RILL_FFMPEG." : "Install ffmpeg using the system package manager, or set RILL_FFMPEG."));
+    checks.push(await executableCheck("ffmpeg", dependencies.ffmpegPath, ["-version"], dependencies.commandVersion, dependencies.platform === "darwin" ? "Install ffmpeg with `brew install ffmpeg`, or set RILL_FFMPEG." : "Install ffmpeg using the system package manager, or set RILL_FFMPEG."));
   } else {
     checks.push({ name: "ffmpeg", status: "skip", message: "Remote encoding does not require local FFmpeg." });
     try {
@@ -16051,7 +16653,7 @@ async function runDoctor(apiUrl, overrides = {}) {
       if (!(token ? (await dependencies.encodingCapabilities(apiUrl, token)).enabled : health?.anonymousAccess && health.anonymousRemoteEncoding)) throw new Error("Remote encoding is not enabled for this workspace.");
       checks.push({ name: "encoding", status: "pass", message: token ? "Remote encoding is enabled." : "Remote encoding is available for the first anonymous recording." });
     } catch (error51) {
-      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Remote encoding must be enabled on the server before using the default recording workflow." });
+      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Run doctor --encoding local to check local FFmpeg, then record start --encoding local, or ask the workspace owner to enable remote encoding." });
     }
   }
   return { schemaVersion: 1, status: checks.some((check2) => check2.status === "fail") ? "error" : "ok", apiUrl, checks, ...runFeedbackFields(feedbackEnabled) };
@@ -16066,7 +16668,7 @@ async function executableCheck(name, path, args, run2, recovery) {
 }
 function commandVersion(command, args) {
   return new Promise((resolve, reject) => {
-    const child = spawn5(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn7(command, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const stdout = [];
     const stderr = [];
     const timeout = setTimeout(() => {
@@ -16127,31 +16729,53 @@ function formatCloudRun(run2) {
 }
 
 // src/recording-lifecycle.ts
-async function startRecordingWithCompensation(remote, dependencies) {
+async function startRecordingWithCompensation(remote, dependencies, apiUrl = "https://userill.dev") {
   try {
     return await dependencies.startLocal();
   } catch (startupError) {
     try {
       await dependencies.cancelRemote(remote.recordingId, "local_start_failed");
     } catch (cleanupError) {
-      throw new AggregateError(
-        [startupError, cleanupError],
-        "Local recording startup failed and the remote reservation could not be cancelled. Run `rill record cancel <recording-id>`."
+      const nextCommand = cliCommand(apiUrl, "record", "cancel", remote.recordingId);
+      throw Object.assign(
+        new AggregateError(
+          [startupError, cleanupError],
+          "browser_unavailable: Local startup failed and its remote reservation could not be cancelled."
+        ),
+        {
+          code: "browser_unavailable",
+          recovery: `Run ${nextCommand} to release this failed startup reservation.`,
+          details: { recordingId: remote.recordingId, nextCommand }
+        }
       );
     }
     throw startupError;
   }
 }
-async function remoteAwareRecordingStatus(recordingId, dependencies) {
+async function remoteAwareRecordingStatus(recordingId, dependencies, apiUrl = "https://userill.dev") {
+  const remote = await dependencies.remoteStatus(recordingId);
+  const remoteView = {
+    ...remote,
+    recordingId: typeof remote.recordingId === "string" ? remote.recordingId : remote.id ?? recordingId,
+    source: "remote",
+    ...recordingNextStep(apiUrl, recordingId, String(remote.status))
+  };
+  if (["uploading", "processing", "ready", "failed", "expired", "cancelled"].includes(String(remote.status))) return remoteView;
   try {
-    return { ...await dependencies.localStatus(recordingId), source: "local" };
-  } catch {
-    const remote = await dependencies.remoteStatus(recordingId);
+    const local = await dependencies.localStatus(recordingId);
+    const status = local.status === "ready" ? "captured" : local.status;
     return {
-      ...remote,
-      recordingId: typeof remote.recordingId === "string" ? remote.recordingId : remote.id ?? recordingId,
-      source: "remote"
+      ...local,
+      status,
+      source: "local",
+      ...recordingNextStep(apiUrl, recordingId, String(status)),
+      ...status === "failed" ? {
+        nextCommand: cliCommand(apiUrl, "record", "cancel", recordingId),
+        message: "Local capture failed; the remote reservation may still hold a slot. Preserve any local draft you need, then cancel this failed attempt to release its slot. Cancellation does not delete local drafts."
+      } : {}
     };
+  } catch {
+    return remoteView;
   }
 }
 
@@ -16165,10 +16789,10 @@ function controlPlaneUrl(environmentUrl) {
 async function removeLocalCapture(id) {
   await ensureDaemon(process.argv[1]);
   const local = await recordingStatus(id).catch(() => null);
-  if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (local?.result?.frameDirectory) await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
 }
 function watchEncoding(apiUrl, id) {
-  const child = spawn6(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env } });
+  const child = spawn8(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env }, windowsHide: true });
   child.on("error", () => void 0);
   child.unref();
 }
@@ -16190,7 +16814,7 @@ async function authorize(quiet = false) {
   process.stderr.write(`Open ${authorization.verificationUri} and enter ${authorization.userCode}
 `);
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
-  const child = spawn6(opener, [authorization.verificationUri], { stdio: "ignore", detached: true });
+  const child = spawn8(opener, [authorization.verificationUri], { stdio: "ignore", detached: true });
   child.on("error", () => void 0);
   child.unref();
   const deadline = Date.now() + authorization.expiresIn * 1e3;
@@ -16211,9 +16835,16 @@ program.command("whoami").description("Show the current verified agent identity
   emit(identity, options.pretty);
   if (!identity.authenticated) process.exitCode = 1;
 });
-program.command("connect").description("Connect this agent once, with renewable account access.").requiredOption("--email <email>", "Email of the Rill account approving access").action(async (input) => {
+var connect = program.command("connect").description("Connect this agent once, with renewable account access.").option("--email <email>", "Email of the Rill account approving access").option("--no-wait", "Return approval instructions immediately; poll with connect status").action(async (input) => {
+  if (!input.email) throw new Error("validation_failed: Supply --email <email> to start a connection.");
   const options = program.opts();
-  emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email) }, options.pretty);
+  emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email, { wait: input.wait }) }, options.pretty);
+});
+connect.command("status").argument("<authorization-id>").description("Poll a saved connection once without starting another approval.").action(async (id) => {
+  const options = program.opts();
+  const result = await pollConnection(options.apiUrl, id);
+  emit({ schemaVersion: 1, ...result }, options.pretty);
+  if (result.status === "expired" || result.status === "denied") process.exitCode = 1;
 });
 program.command("login").description("Authorize Rill using the existing device login flow.").action(async () => {
   await authorize();
@@ -16252,6 +16883,7 @@ for (const action of ["status", "cancel"]) cloudRun.command(action).argument("<r
 });
 record2.command("start").option("--encoding <mode>", "remote or local", "remote").option("--url <url>").option("--title <title>").option("--description <description>", "").option("--headed").option("--cdp-url <url>").option("--width <pixels>", "", "1280").option("--height <pixels>", "", "720").option("--max-duration <seconds>", "", "600").action(async (commandOptions) => {
   const options = program.opts();
+  assertRecorderTransport();
   await ensureAnonymousCredential(options.apiUrl);
   const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await withRunFeedback(() => client.agentSession(), async (rememberRecording) => {
@@ -16268,7 +16900,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
         return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
       },
       cancelRemote: (recordingId, reason) => client.cancelRecording(recordingId, reason)
-    });
+    }, options.apiUrl);
     await client.markRecordingStarted(remote.recordingId, {
       cliVersion: CLI_VERSION,
       os: process.platform,
@@ -16276,7 +16908,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
       headed: Boolean(commandOptions.headed),
       attached: Boolean(commandOptions.cdpUrl)
     }).catch(() => void 0);
-    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
+    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, browserAttachment: browserAttachment(local.cdpUrl), startedAt: local.startedAt, stopsAt: local.stopsAt, elapsedSeconds: local.elapsedSeconds, remainingSeconds: local.remainingSeconds, bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
   });
   emit(result, options.pretty);
 });
@@ -16296,12 +16928,12 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     await client.uploadDiagnostics(recordingId, local.result.diagnosticsPath, local.result.diagnostics);
     const accepted = await submitFrameCapture(client, recordingId, local.result.frameDirectory);
     const result2 = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
-    emit({ schemaVersion: 1, ...result2, ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
-    if (result2.status === "ready") await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+    emit({ schemaVersion: 1, ...result2, ...recordingNextStep(options.apiUrl, recordingId, result2.status, { resumableFrames: true }), ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
+    if (result2.status === "ready") await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
     else watchEncoding(options.apiUrl, recordingId);
     return;
   }
-  const video = await stat4(local.result.videoPath);
+  const video = await stat5(local.result.videoPath);
   const provisioned = await client.provisionVideo(recordingId, { sizeBytes: video.size, filename: basename(local.result.videoPath), uploadKind: "recorded_browser" });
   await Promise.all([client.uploadVideo(provisioned.uploadUrl, local.result.videoPath), client.uploadDiagnostics(recordingId, local.result.diagnosticsPath, local.result.diagnostics)]);
   const remote = commandOptions.wait === false || record2.opts().wait === false ? null : await client.waitUntilPlayable(recordingId);
@@ -16315,10 +16947,11 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
     diagnostics: local.result.diagnostics,
+    ...recordingNextStep(options.apiUrl, recordingId, remote ? "ready" : "processing"),
     ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false)
   };
   emit(result, options.pretty);
-  if (remote) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (remote) await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
 });
 record2.command("retry").argument("<recording-id>").option("--no-wait").action(async (recordingId, commandOptions) => {
   const options = program.opts();
@@ -16338,7 +16971,7 @@ record2.command("retry").argument("<recording-id>").option("--no-wait").action(a
   if (!accepted) throw new Error("Encoding job is unavailable.");
   if (["expired", "cancelled"].includes(accepted.status)) throw new Error(`Recording ${accepted.status}.`);
   const result = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
-  emit({ schemaVersion: 1, ...result }, options.pretty);
+  emit({ schemaVersion: 1, ...result, ...recordingNextStep(options.apiUrl, recordingId, result.status, { resumableFrames: true }) }, options.pretty);
   if (result.status === "ready") await removeLocalCapture(recordingId);
   else watchEncoding(options.apiUrl, recordingId);
 });
@@ -16350,7 +16983,7 @@ program.command("encoding-watch", { hidden: true }).argument("<recording-id>").a
   if (result.status === "ready") {
     await ensureDaemon(process.argv[1]);
     const local = await recordingStatus(id).catch(() => null);
-    if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+    if (local?.result?.frameDirectory) await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
   }
 });
 var feedback = program.command("feedback").description("Submit a short Rill product review for a recorded run.");
@@ -16380,11 +17013,11 @@ record2.command("status").argument("<recording-id>").action(async (recordingId)
   try {
     const encoding = await client.encodingStatus(recordingId);
     const remote = encoding.status === "ready" ? await client.recordingStatus(recordingId) : {};
-    emit({ schemaVersion: 1, ...encoding, ...remote, recordingId, source: "remote" }, options.pretty);
+    emit({ schemaVersion: 1, ...encoding, ...remote, recordingId, source: "remote", ...recordingNextStep(options.apiUrl, recordingId, encoding.status, { resumableFrames: true }) }, options.pretty);
     if (encoding.status === "ready") await removeLocalCapture(recordingId);
     return;
   } catch (error51) {
-    if (!(error51 instanceof Error) || !error51.message.includes("recording_not_found")) throw error51;
+    if (!(error51 instanceof ControlPlaneError) || error51.code !== "recording_not_found") throw error51;
   }
   const status = await remoteAwareRecordingStatus(recordingId, {
     localStatus: async (id) => {
@@ -16392,7 +17025,7 @@ record2.command("status").argument("<recording-id>").action(async (recordingId)
       return recordingStatus(id);
     },
     remoteStatus: (id) => client.recordingStatus(id)
-  });
+  }, options.apiUrl);
   emit({ schemaVersion: 1, ...status }, options.pretty);
 });
 record2.command("cancel").argument("<recording-id>").description("Cancel an active recording and release its remote quota slot.").action(async (recordingId) => {
@@ -16405,41 +17038,56 @@ program.command("upload").argument("<video-file>").option("--title <title>").opt
   const options = program.opts();
   await ensureAnonymousCredential(options.apiUrl);
   const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
-  const file2 = await stat4(videoFile);
+  const file2 = await stat5(videoFile);
   const recording = await client.createRecording({ title: commandOptions.title ?? basename(videoFile), sourceUrl: null });
   const upload = await client.provisionVideo(recording.recordingId, { sizeBytes: file2.size, filename: basename(videoFile), uploadKind: "existing_video" });
   await client.uploadVideo(upload.uploadUrl, videoFile);
   const remote = commandOptions.wait === false ? null : await client.waitUntilPlayable(recording.recordingId);
   if (remote) process.stderr.write("\n");
-  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, expiresAt: remote?.expires_at ?? recording.expiresAt ?? null, diagnosticsAvailable: false }, options.pretty);
+  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, expiresAt: remote?.expires_at ?? recording.expiresAt ?? null, diagnosticsAvailable: false, ...recordingNextStep(options.apiUrl, recording.recordingId, remote ? "ready" : "processing") }, options.pretty);
 });
-program.command("inspect").argument("<share-url>").action(async (shareUrl) => {
+program.command("inspect").argument("<share-url>").option("--cursor <cursor>", "Read the next page of discussions").action(async (shareUrl, commandOptions) => {
   const options = program.opts();
-  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).inspect(shareUrl), options.pretty);
+  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).inspect(shareUrl, commandOptions.cursor), options.pretty);
+});
+var comments = program.command("comments").description("Reply to pinned review discussions.");
+comments.command("reply").argument("<share-url>").requiredOption("--discussion <id>").requiredOption("--body <text>").option("--request-id <uuid>", "Reuse on retry to prevent duplicate replies").action(async (shareUrl, input) => {
+  const options = program.opts();
+  const requestId = input.requestId ?? crypto.randomUUID();
+  process.stderr.write(`Reply request ID: ${requestId} (reuse with --request-id when retrying)
+`);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  emit(await client.reply(shareUrl, input.discussion, input.body, requestId), options.pretty);
+});
+comments.command("edit").argument("<share-url>").requiredOption("--comment <id>").requiredOption("--body <text>").action(async (shareUrl, input) => {
+  const options = program.opts();
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  emit(await client.editReply(shareUrl, input.comment, input.body), options.pretty);
 });
 var drafts = program.command("drafts");
 drafts.command("list").action(async () => {
   const options = program.opts();
-  const root = process.env.RILL_TEMP ?? `${process.env.TMPDIR ?? "/tmp"}/rill-recordings`;
+  const root = process.env.RILL_TEMP ?? join11(tmpdir3(), "rill-recordings");
   const names = await readdir2(root).catch(() => []);
   emit({ schemaVersion: 1, drafts: names }, options.pretty);
 });
 drafts.command("purge").action(async () => {
   const options = program.opts();
-  const root = process.env.RILL_TEMP ?? `${process.env.TMPDIR ?? "/tmp"}/rill-recordings`;
+  const root = process.env.RILL_TEMP ?? join11(tmpdir3(), "rill-recordings");
   const names = await readdir2(root).catch(() => []);
   let purged = 0;
   for (const name of names) {
-    const path = `${root}/${name}`;
-    const metadata = await stat4(path);
+    const path = join11(root, name);
+    const metadata = await stat5(path);
     if (Date.now() - metadata.mtimeMs > 24 * 60 * 60 * 1e3) {
-      await rm5(path, { recursive: true, force: true });
+      await rm7(path, { recursive: true, force: true });
       purged += 1;
     }
   }
   emit({ schemaVersion: 1, purged }, options.pretty);
 });
 program.hook("preAction", async (_command, actionCommand) => {
+  if (commandPath(actionCommand).join(" ") === "record start") assertRecorderTransport();
   const command = cliCommandCategory(commandPath(actionCommand));
   if (!command) return;
   const options = program.opts();