@runalabs/rill-cli 0.1.13 → 0.1.15

package/dist/cli.js

@@ -5,23 +5,109 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/windows-credentials.ts
+import { spawn } from "child_process";
+import { createHash, randomUUID } from "crypto";
+import { homedir } from "os";
+import { join, win32 } from "path";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
+var script = String.raw`$ErrorActionPreference='Stop'; try {
+  Add-Type -AssemblyName System.Security
+  $inputData=[Console]::In.ReadToEnd() | ConvertFrom-Json
+  $bytes=[Convert]::FromBase64String($inputData.data)
+  $entropy=[Convert]::FromBase64String($inputData.entropy)
+  if ($inputData.operation -eq 'protect') {
+    $result=[System.Security.Cryptography.ProtectedData]::Protect($bytes,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+  } elseif ($inputData.operation -eq 'unprotect') {
+    $result=[System.Security.Cryptography.ProtectedData]::Unprotect($bytes,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+  } else { throw 'Invalid operation' }
+  [Console]::Out.Write([Convert]::ToBase64String($result))
+} catch { [Console]::Error.Write('Windows credential protection failed.'); exit 1 }`;
+var transformWindowsSecret = async (operation, data, entropy) => {
+  if (process.platform !== "win32") throw new Error("Windows credential protection requires Windows.");
+  return new Promise((resolve, reject) => {
+    const executable = win32.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    const child = spawn(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    let output = "";
+    let failed = false;
+    const fail2 = () => {
+      if (failed) return;
+      failed = true;
+      child.kill();
+      reject(new Error("Cannot access Windows protected credentials. Your saved identity has not been replaced."));
+    };
+    const timer = setTimeout(fail2, 15e3);
+    child.stdout.on("data", (chunk) => {
+      output += chunk.toString("ascii");
+      if (output.length > 256 * 1024) fail2();
+    });
+    child.stderr.resume();
+    child.once("error", fail2);
+    child.stdin.once("error", fail2);
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failed) return;
+      if (code !== 0 || !output || !/^[A-Za-z0-9+/]+={0,2}$/.test(output)) {
+        fail2();
+        return;
+      }
+      resolve(Buffer.from(output, "base64"));
+    });
+    child.stdin.end(JSON.stringify({ operation, data: data.toString("base64"), entropy: entropy.toString("base64") }));
+  });
+};
+var credentialRoot = () => join(process.env.RILL_HOME ?? join(homedir(), ".rill"), "windows-credentials");
+var key = (apiUrl) => createHash("sha256").update(apiUrl).digest();
+async function saveWindowsCredential(apiUrl, value, root = credentialRoot(), transform2 = transformWindowsSecret) {
+  if (!value || Buffer.byteLength(value) > 64 * 1024) throw new Error("The Windows credential is empty or too large.");
+  const entropy = key(apiUrl), protectedBytes = await transform2("protect", Buffer.from(value, "utf8"), entropy);
+  if (!protectedBytes.length || protectedBytes.length > 192 * 1024) throw new Error("Windows credential protection returned invalid data.");
+  await mkdir(root, { recursive: true, mode: 448 });
+  const path = join(root, entropy.toString("hex") + ".dpapi"), temporary = path + "." + randomUUID() + ".tmp";
+  try {
+    await writeFile(temporary, JSON.stringify({ version: 1, ciphertext: protectedBytes.toString("base64") }), { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function loadWindowsCredential(apiUrl, root = credentialRoot(), transform2 = transformWindowsSecret) {
+  const entropy = key(apiUrl), path = join(root, entropy.toString("hex") + ".dpapi");
+  try {
+    const info = await stat(path);
+    if (!info.isFile() || info.size > 256 * 1024) throw new Error("Invalid credential file.");
+    const stored = JSON.parse(await readFile(path, "utf8"));
+    if (stored.version !== 1 || typeof stored.ciphertext !== "string" || !stored.ciphertext || !/^[A-Za-z0-9+/]+={0,2}$/.test(stored.ciphertext)) throw new Error("Invalid protected credential.");
+    const plain = await transform2("unprotect", Buffer.from(stored.ciphertext, "base64"), entropy);
+    if (!plain.length || plain.length > 64 * 1024) throw new Error("Invalid credential size.");
+    return plain.toString("utf8");
+  } catch (error51) {
+    if (error51.code === "ENOENT") return null;
+    throw new Error("Cannot read Windows protected credentials. Your saved identity has not been replaced.");
+  }
+}
+
 // src/agent-session.ts
-import { hostname, homedir } from "os";
-import { mkdir, rm, stat } from "fs/promises";
-import { join } from "path";
-import { createHash, randomBytes } from "crypto";
+import { hostname, homedir as homedir2 } from "os";
+import { mkdir as mkdir2, rm as rm2, stat as stat2 } from "fs/promises";
+import { join as join2 } from "path";
+import { createHash as createHash2, randomBytes } from "crypto";
 
 // src/recording-guidance.ts
-function cliCommand(apiUrl, ...args) {
-  const quote = (value) => /^[a-zA-Z0-9_./:@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+function cliCommandForPlatform(platform, apiUrl, ...args) {
+  const quote = (value) => /^[a-zA-Z0-9_./:@=-]+$/.test(value) ? value : platform === "win32" ? `'${value.replaceAll("'", "''")}'` : `'${value.replaceAll("'", "'\\''")}'`;
   return ["rill", "--api-url", apiUrl, ...args].map(quote).join(" ");
 }
-var transportRecovery = "Use macOS or Linux for browser recording. On Windows, use RILL_TOKEN with rill upload <video-file> for video-only sharing; diagnostics are not imported. RILL_SOCKET does not enable Windows named-pipe or TCP support in this release.";
-function recorderTransportCheck(platform = process.platform) {
-  return platform === "win32" ? { name: "recorder_transport", status: "fail", message: "The local recorder transport does not support Windows.", recovery: transportRecovery } : { name: "recorder_transport", status: "pass", message: "The local recorder uses a Unix-domain socket." };
+function cliCommand(apiUrl, ...args) {
+  return cliCommandForPlatform(process.platform, apiUrl, ...args);
+}
+var transportRecovery = "Unset RILL_SOCKET on Windows so Rill can use its authenticated named pipe. Use RILL_HOME to choose a separate recorder identity directory.";
+function recorderTransportCheck(platform = process.platform, socketOverride = process.env.RILL_SOCKET) {
+  if (platform === "win32" && socketOverride) return { name: "recorder_transport", status: "fail", message: "Windows requires the authenticated recorder pipe.", recovery: transportRecovery };
+  return { name: "recorder_transport", status: "pass", message: platform === "win32" ? "The local recorder uses an authenticated Windows named pipe." : "The local recorder uses a Unix-domain socket." };
 }
-function assertRecorderTransport(platform = process.platform) {
-  const check2 = recorderTransportCheck(platform);
+function assertRecorderTransport(platform = process.platform, socketOverride = process.env.RILL_SOCKET) {
+  const check2 = recorderTransportCheck(platform, socketOverride);
   if (check2.status === "fail") throw Object.assign(new Error(`unsupported_platform: ${check2.message}`), { code: "unsupported_platform", recovery: check2.recovery });
 }
 function recordingNextStep(apiUrl, recordingId, status, options = {}) {
@@ -30,12 +116,13 @@ function recordingNextStep(apiUrl, recordingId, status, options = {}) {
   if (["uploading", "queued", "encoding", "processing", "finalizing"].includes(status)) return { nextCommand: cliCommand(apiUrl, "record", "status", recordingId), message: "Finalizing recordings hold a concurrency slot. Wait for ready; cancel only if abandoning the recording." };
   return {};
 }
-function browserAttachment(cdpUrl) {
+function browserAttachment(cdpUrl, tabId) {
   return {
     protocol: "cdp",
     cdpUrl,
+    ...tabId ? { tabId } : {},
     playwrightMethod: "chromium.connectOverCDP",
-    instructions: "Attach to this endpoint and use the existing browser context. A browser tool must explicitly support CDP attachment; do not drive a separate browser. Disconnect the automation client without closing the recorded browser, then run record stop.",
+    instructions: (tabId ? "Record only the returned tabId. Match it using a page CDP session and Target.getTargetInfo; do not pick the first page. " : "") + "Attach to this endpoint and use the existing browser context. A browser tool must explicitly support CDP attachment; do not drive a separate browser. Disconnect the automation client without closing the recorded browser, then run record stop.",
     shellFallback: "See the shell-only Playwright example in the Rill CLI README; install playwright-core in a temporary directory outside the project."
   };
 }
@@ -48,6 +135,7 @@ var AgentAuthError = class extends Error {
     super(`${code}: ${message}`);
     this.code = code;
   }
+  code;
 };
 function parseAuthorization(value) {
   if (!value?.startsWith("{")) return null;
@@ -63,7 +151,7 @@ async function request(apiUrl, path, body, form = false) {
     redirect: "error",
     signal: AbortSignal.timeout(15e3),
     headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
-    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
+    body: form ? new URLSearchParams(Object.entries(body).map(([key2, value2]) => [key2, String(value2)])) : JSON.stringify(body)
   });
   const value = await response.json();
   if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
@@ -107,19 +195,19 @@ async function ensureAnonymousCredential(apiUrl) {
   return withAuthorizationLock(apiUrl, () => createAnonymousCredential(apiUrl));
 }
 async function withAuthorizationLock(apiUrl, action) {
-  const root = join(homedir(), ".rill", "auth-locks");
-  await mkdir(root, { recursive: true, mode: 448 });
-  const lock = join(root, createHash("sha256").update(apiUrl).digest("hex"));
+  const root = join2(homedir2(), ".rill", "auth-locks");
+  await mkdir2(root, { recursive: true, mode: 448 });
+  const lock = join2(root, createHash2("sha256").update(apiUrl).digest("hex"));
   const deadline = Date.now() + 3e4;
   while (true) {
     try {
-      await mkdir(lock, { mode: 448 });
+      await mkdir2(lock, { mode: 448 });
       break;
     } catch (error51) {
       if (error51.code !== "EEXIST") throw error51;
-      const info = await stat(lock).catch(() => null);
+      const info = await stat2(lock).catch(() => null);
       if (info && Date.now() - info.mtimeMs > 12e4) {
-        await rm(lock, { recursive: true, force: true });
+        await rm2(lock, { recursive: true, force: true });
         continue;
       }
       if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
@@ -129,7 +217,7 @@ async function withAuthorizationLock(apiUrl, action) {
   try {
     return await action();
   } finally {
-    await rm(lock, { recursive: true, force: true });
+    await rm2(lock, { recursive: true, force: true });
   }
 }
 async function createAnonymousCredential(apiUrl) {
@@ -246,9 +334,10 @@ async function pollSavedConnection(apiUrl, authorizationId) {
 }
 
 // src/keychain.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 var service = "rill";
 async function saveCredential(apiUrl, token) {
+  if (process.platform === "win32") return saveWindowsCredential(apiUrl, token);
   if (process.platform === "darwin") {
     await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
     return;
@@ -263,6 +352,7 @@ function loadCredential(apiUrl) {
   return loadAgentCredential(apiUrl);
 }
 async function loadStoredCredential(apiUrl) {
+  if (process.platform === "win32") return loadWindowsCredential(apiUrl);
   try {
     if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
     if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
@@ -276,7 +366,7 @@ async function loadStoredCredential(apiUrl) {
 }
 function run(command, args, input) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    const child = spawn2(command, args, { stdio: ["pipe", "pipe", "pipe"] });
     const stdout = [];
     const stderr = [];
     child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
@@ -290,7 +380,7 @@ function run(command, args, input) {
 
 // src/control-plane.ts
 import { createReadStream } from "fs";
-import { readFile, stat as stat2 } from "fs/promises";
+import { readFile as readFile2, stat as stat3 } from "fs/promises";
 import { Upload } from "tus-js-client";
 var ControlPlaneError = class extends Error {
   constructor(code, message, recovery, details, httpStatus) {
@@ -301,6 +391,10 @@ var ControlPlaneError = class extends Error {
     this.httpStatus = httpStatus;
     this.name = "ControlPlaneError";
   }
+  code;
+  recovery;
+  details;
+  httpStatus;
 };
 var ControlPlaneHttpError = class extends Error {
   constructor(httpStatus) {
@@ -308,12 +402,15 @@ var ControlPlaneHttpError = class extends Error {
     this.httpStatus = httpStatus;
     this.name = "ControlPlaneHttpError";
   }
+  httpStatus;
 };
 var ControlPlaneClient = class {
   constructor(apiUrl, token) {
     this.apiUrl = apiUrl;
     this.token = token;
   }
+  apiUrl;
+  token;
   recordingStatusCommand(id) {
     return cliCommand(this.apiUrl, "record", "status", id);
   }
@@ -356,6 +453,9 @@ var ControlPlaneClient = class {
   createRecording(input) {
     return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
   }
+  failLocalCapture(recordingId) {
+    return this.request(`/api/recordings/${encodeURIComponent(recordingId)}/local-failed`, { method: "POST", body: "{}" });
+  }
   markRecordingStarted(recordingId, input) {
     return this.request(`/api/recordings/${recordingId}/local-started`, {
       method: "POST",
@@ -402,7 +502,7 @@ var ControlPlaneClient = class {
     throw new ControlPlaneError("processing_pending", "Upload complete; the recording is not playable yet.", `Run ${cliCommand(this.apiUrl, "record", "status", recordingId)} to continue checking.`, { recordingId, nextCommand: cliCommand(this.apiUrl, "record", "status", recordingId) });
   }
   async uploadVideo(uploadUrl, filePath) {
-    const file2 = await stat2(filePath);
+    const file2 = await stat3(filePath);
     if (uploadUrl.startsWith(this.apiUrl)) {
       const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
       if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
@@ -424,7 +524,7 @@ var ControlPlaneClient = class {
     process.stderr.write("\nUpload complete; playback processing may continue.\n");
   }
   async uploadDiagnostics(recordingId, filePath, summary) {
-    const body = await readFile(filePath);
+    const body = await readFile2(filePath);
     return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
   }
   listRecordings() {
@@ -436,16 +536,33 @@ var ControlPlaneClient = class {
   pollDeviceAuthorization(deviceCode) {
     return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
   }
-  inspect(shareUrl, cursor) {
+  async inspect(shareUrl, cursor) {
     if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
     const url2 = new URL(shareUrl);
     const slug = url2.pathname.split("/").filter(Boolean).at(-1);
     if (!slug) throw new Error("The share URL does not contain a slug.");
-    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`, { headers: { Accept: "application/json" } }).then(async (response) => {
+    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`, { headers: await this.reviewHeaders(url2.origin) }).then(async (response) => {
       if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
       return response.json();
     });
   }
+  async reviewHeaders(origin) {
+    const headers = new Headers({ Accept: "application/json" });
+    if (origin !== new URL(this.apiUrl).origin) return headers;
+    const token = typeof this.token === "function" ? await this.token() : this.token;
+    if (token) headers.set("Authorization", `Bearer ${token}`);
+    this.identifyAgent(headers);
+    const id = process.env.RILL_AGENT_ID;
+    if (id && /^[a-zA-Z0-9_-]{8,80}$/.test(id)) headers.set("x-rill-agent-id", id);
+    if (id && process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1") headers.set("x-rill-analytics", "1");
+    return headers;
+  }
+  identifyAgent(headers) {
+    if (process.env.DO_NOT_TRACK === "1" || process.env.RILL_ANONYMOUS_ANALYTICS === "0") headers.set("x-rill-analytics", "0");
+    const client = process.env.RILL_AGENT_CLIENT || (process.env.CODEX_THREAD_ID ? "Codex" : process.env.CLAUDECODE ? "Claude" : process.env.CURSOR_TRACE_ID ? "Cursor" : void 0);
+    if (client) headers.set("x-rill-agent-client", client.replace(/[\x00-\x1f\x7f]/g, "").slice(0, 80));
+    if (process.env.RILL_AGENT_NAME) headers.set("x-rill-agent-name", process.env.RILL_AGENT_NAME.replace(/[\x00-\x1f\x7f]/g, "").slice(0, 48));
+  }
   reviewPath(shareUrl) {
     const url2 = new URL(shareUrl);
     if (url2.origin !== new URL(this.apiUrl).origin) throw new Error("The share URL must match --api-url before sending agent credentials.");
@@ -461,6 +578,7 @@ var ControlPlaneClient = class {
   }
   async request(path, init = {}, authenticated = true) {
     const headers = new Headers(init.headers);
+    if (authenticated) this.identifyAgent(headers);
     if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
     if (authenticated) {
       const token = typeof this.token === "function" ? await this.token() : this.token;
@@ -500,8 +618,8 @@ async function whoami(apiUrl) {
 }
 
 // src/remote-encoding.ts
-import { open, readFile as readFile2 } from "fs/promises";
-import { join as join2 } from "path";
+import { open, readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -1225,9 +1343,9 @@ function floatSafeRemainder(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object2, key, getter) {
+function defineLazy(object2, key2, getter) {
   let value = void 0;
-  Object.defineProperty(object2, key, {
+  Object.defineProperty(object2, key2, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -1239,7 +1357,7 @@ function defineLazy(object2, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object2, key, {
+      Object.defineProperty(object2, key2, {
         value: v
         // configurable: true,
       });
@@ -1272,11 +1390,11 @@ function cloneDef(schema) {
 function getElementAtPath(obj, path) {
   if (!path)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
-  const promises = keys.map((key) => promisesObj[key]);
+  const promises = keys.map((key2) => promisesObj[key2]);
   return Promise.all(promises).then((results) => {
     const resolvedObj = {};
     for (let i = 0; i < keys.length; i++) {
@@ -1348,8 +1466,8 @@ function shallowClone(o) {
 }
 function numKeys(data) {
   let keyCount = 0;
-  for (const key in data) {
-    if (Object.prototype.hasOwnProperty.call(data, key)) {
+  for (const key2 in data) {
+    if (Object.prototype.hasOwnProperty.call(data, key2)) {
       keyCount++;
     }
   }
@@ -1499,13 +1617,13 @@ function pick(schema, mask) {
   const def = mergeDefs(schema._zod.def, {
     get shape() {
       const newShape = {};
-      for (const key in mask) {
-        if (!(key in currDef.shape)) {
-          throw new Error(`Unrecognized key: "${key}"`);
+      for (const key2 in mask) {
+        if (!(key2 in currDef.shape)) {
+          throw new Error(`Unrecognized key: "${key2}"`);
         }
-        if (!mask[key])
+        if (!mask[key2])
           continue;
-        newShape[key] = currDef.shape[key];
+        newShape[key2] = currDef.shape[key2];
       }
       assignProp(this, "shape", newShape);
       return newShape;
@@ -1524,13 +1642,13 @@ function omit(schema, mask) {
   const def = mergeDefs(schema._zod.def, {
     get shape() {
       const newShape = { ...schema._zod.def.shape };
-      for (const key in mask) {
-        if (!(key in currDef.shape)) {
-          throw new Error(`Unrecognized key: "${key}"`);
+      for (const key2 in mask) {
+        if (!(key2 in currDef.shape)) {
+          throw new Error(`Unrecognized key: "${key2}"`);
         }
-        if (!mask[key])
+        if (!mask[key2])
           continue;
-        delete newShape[key];
+        delete newShape[key2];
       }
       assignProp(this, "shape", newShape);
       return newShape;
@@ -1547,8 +1665,8 @@ function extend(schema, shape) {
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
     const existingShape = schema._zod.def.shape;
-    for (const key in shape) {
-      if (Object.getOwnPropertyDescriptor(existingShape, key) !== void 0) {
+    for (const key2 in shape) {
+      if (Object.getOwnPropertyDescriptor(existingShape, key2) !== void 0) {
         throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.");
       }
     }
@@ -1604,23 +1722,23 @@ function partial(Class2, schema, mask) {
       const oldShape = schema._zod.def.shape;
       const shape = { ...oldShape };
       if (mask) {
-        for (const key in mask) {
-          if (!(key in oldShape)) {
-            throw new Error(`Unrecognized key: "${key}"`);
+        for (const key2 in mask) {
+          if (!(key2 in oldShape)) {
+            throw new Error(`Unrecognized key: "${key2}"`);
           }
-          if (!mask[key])
+          if (!mask[key2])
             continue;
-          shape[key] = Class2 ? new Class2({
+          shape[key2] = Class2 ? new Class2({
             type: "optional",
-            innerType: oldShape[key]
-          }) : oldShape[key];
+            innerType: oldShape[key2]
+          }) : oldShape[key2];
         }
       } else {
-        for (const key in oldShape) {
-          shape[key] = Class2 ? new Class2({
+        for (const key2 in oldShape) {
+          shape[key2] = Class2 ? new Class2({
             type: "optional",
-            innerType: oldShape[key]
-          }) : oldShape[key];
+            innerType: oldShape[key2]
+          }) : oldShape[key2];
         }
       }
       assignProp(this, "shape", shape);
@@ -1636,22 +1754,22 @@ function required(Class2, schema, mask) {
       const oldShape = schema._zod.def.shape;
       const shape = { ...oldShape };
       if (mask) {
-        for (const key in mask) {
-          if (!(key in shape)) {
-            throw new Error(`Unrecognized key: "${key}"`);
+        for (const key2 in mask) {
+          if (!(key2 in shape)) {
+            throw new Error(`Unrecognized key: "${key2}"`);
           }
-          if (!mask[key])
+          if (!mask[key2])
             continue;
-          shape[key] = new Class2({
+          shape[key2] = new Class2({
             type: "nonoptional",
-            innerType: oldShape[key]
+            innerType: oldShape[key2]
           });
         }
       } else {
-        for (const key in oldShape) {
-          shape[key] = new Class2({
+        for (const key2 in oldShape) {
+          shape[key2] = new Class2({
             type: "nonoptional",
-            innerType: oldShape[key]
+            innerType: oldShape[key2]
           });
         }
       }
@@ -3432,13 +3550,13 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     return payload;
   };
 });
-function handlePropertyResult(result, final, key, input, isOptionalIn, isOptionalOut) {
-  const isPresent = key in input;
+function handlePropertyResult(result, final, key2, input, isOptionalIn, isOptionalOut) {
+  const isPresent = key2 in input;
   if (result.issues.length) {
     if (isOptionalIn && isOptionalOut && !isPresent) {
       return;
     }
-    final.issues.push(...prefixIssues(key, result.issues));
+    final.issues.push(...prefixIssues(key2, result.issues));
   }
   if (!isPresent && !isOptionalIn) {
     if (!result.issues.length) {
@@ -3446,17 +3564,17 @@ function handlePropertyResult(result, final, key, input, isOptionalIn, isOptiona
         code: "invalid_type",
         expected: "nonoptional",
         input: void 0,
-        path: [key]
+        path: [key2]
       });
     }
     return;
   }
   if (result.value === void 0) {
     if (isPresent) {
-      final.value[key] = void 0;
+      final.value[key2] = void 0;
     }
   } else {
-    final.value[key] = result.value;
+    final.value[key2] = result.value;
   }
 }
 function normalizeDef(def) {
@@ -3482,20 +3600,20 @@ function handleCatchall(proms, input, payload, ctx, def, inst) {
   const t = _catchall.def.type;
   const isOptionalIn = _catchall.optin === "optional";
   const isOptionalOut = _catchall.optout === "optional";
-  for (const key in input) {
-    if (key === "__proto__")
+  for (const key2 in input) {
+    if (key2 === "__proto__")
       continue;
-    if (keySet.has(key))
+    if (keySet.has(key2))
       continue;
     if (t === "never") {
-      unrecognized.push(key);
+      unrecognized.push(key2);
       continue;
     }
-    const r = _catchall.run({ value: input[key], issues: [] }, ctx);
+    const r = _catchall.run({ value: input[key2], issues: [] }, ctx);
     if (r instanceof Promise) {
-      proms.push(r.then((r2) => handlePropertyResult(r2, payload, key, input, isOptionalIn, isOptionalOut)));
+      proms.push(r.then((r2) => handlePropertyResult(r2, payload, key2, input, isOptionalIn, isOptionalOut)));
     } else {
-      handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);
+      handlePropertyResult(r, payload, key2, input, isOptionalIn, isOptionalOut);
     }
   }
   if (unrecognized.length) {
@@ -3531,12 +3649,12 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   defineLazy(inst._zod, "propValues", () => {
     const shape = def.shape;
     const propValues = {};
-    for (const key in shape) {
-      const field = shape[key]._zod;
+    for (const key2 in shape) {
+      const field = shape[key2]._zod;
       if (field.values) {
-        propValues[key] ?? (propValues[key] = /* @__PURE__ */ new Set());
+        propValues[key2] ?? (propValues[key2] = /* @__PURE__ */ new Set());
         for (const v of field.values)
-          propValues[key].add(v);
+          propValues[key2].add(v);
       }
     }
     return propValues;
@@ -3559,15 +3677,15 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     payload.value = {};
     const proms = [];
     const shape = value.shape;
-    for (const key of value.keys) {
-      const el = shape[key];
+    for (const key2 of value.keys) {
+      const el = shape[key2];
       const isOptionalIn = el._zod.optin === "optional";
       const isOptionalOut = el._zod.optout === "optional";
-      const r = el._zod.run({ value: input[key], issues: [] }, ctx);
+      const r = el._zod.run({ value: input[key2], issues: [] }, ctx);
       if (r instanceof Promise) {
-        proms.push(r.then((r2) => handlePropertyResult(r2, payload, key, input, isOptionalIn, isOptionalOut)));
+        proms.push(r.then((r2) => handlePropertyResult(r2, payload, key2, input, isOptionalIn, isOptionalOut)));
       } else {
-        handlePropertyResult(r, payload, key, input, isOptionalIn, isOptionalOut);
+        handlePropertyResult(r, payload, key2, input, isOptionalIn, isOptionalOut);
       }
     }
     if (!catchall) {
@@ -3583,24 +3701,24 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   const generateFastpass = (shape) => {
     const doc = new Doc(["shape", "payload", "ctx"]);
     const normalized = _normalized.value;
-    const parseStr = (key) => {
-      const k = esc(key);
+    const parseStr = (key2) => {
+      const k = esc(key2);
       return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
     };
     doc.write(`const input = payload.value;`);
     const ids = /* @__PURE__ */ Object.create(null);
     let counter = 0;
-    for (const key of normalized.keys) {
-      ids[key] = `key_${counter++}`;
+    for (const key2 of normalized.keys) {
+      ids[key2] = `key_${counter++}`;
     }
     doc.write(`const newResult = {};`);
-    for (const key of normalized.keys) {
-      const id = ids[key];
-      const k = esc(key);
-      const schema = shape[key];
+    for (const key2 of normalized.keys) {
+      const id = ids[key2];
+      const k = esc(key2);
+      const schema = shape[key2];
       const isOptionalIn = schema?._zod?.optin === "optional";
       const isOptionalOut = schema?._zod?.optout === "optional";
-      doc.write(`const ${id} = ${parseStr(key)};`);
+      doc.write(`const ${id} = ${parseStr(key2)};`);
       if (isOptionalIn && isOptionalOut) {
         doc.write(`
         if (${id}.issues.length) {
@@ -3912,17 +4030,17 @@ function mergeValues(a, b) {
   }
   if (isPlainObject(a) && isPlainObject(b)) {
     const bKeys = Object.keys(b);
-    const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
+    const sharedKeys = Object.keys(a).filter((key2) => bKeys.indexOf(key2) !== -1);
     const newObj = { ...a, ...b };
-    for (const key of sharedKeys) {
-      const sharedValue = mergeValues(a[key], b[key]);
+    for (const key2 of sharedKeys) {
+      const sharedValue = mergeValues(a[key2], b[key2]);
       if (!sharedValue.valid) {
         return {
           valid: false,
-          mergeErrorPath: [key, ...sharedValue.mergeErrorPath]
+          mergeErrorPath: [key2, ...sharedValue.mergeErrorPath]
         };
       }
-      newObj[key] = sharedValue.data;
+      newObj[key2] = sharedValue.data;
     }
     return { valid: true, data: newObj };
   }
@@ -4057,9 +4175,9 @@ var $ZodTuple = /* @__PURE__ */ $constructor("$ZodTuple", (inst, def) => {
     return handleTupleResults(itemResults, payload, items, input, optoutStart);
   };
 });
-function getTupleOptStart(items, key) {
+function getTupleOptStart(items, key2) {
   for (let i = items.length - 1; i >= 0; i--) {
-    if (items[i]._zod[key] !== "optional")
+    if (items[i]._zod[key2] !== "optional")
       return i + 1;
   }
   return 0;
@@ -4110,10 +4228,10 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
     if (values) {
       payload.value = {};
       const recordKeys = /* @__PURE__ */ new Set();
-      for (const key of values) {
-        if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
-          recordKeys.add(typeof key === "number" ? key.toString() : key);
-          const keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+      for (const key2 of values) {
+        if (typeof key2 === "string" || typeof key2 === "number" || typeof key2 === "symbol") {
+          recordKeys.add(typeof key2 === "number" ? key2.toString() : key2);
+          const keyResult = def.keyType._zod.run({ value: key2, issues: [] }, ctx);
           if (keyResult instanceof Promise) {
             throw new Error("Async schemas not supported in object keys currently");
           }
@@ -4122,34 +4240,34 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
               code: "invalid_key",
               origin: "record",
               issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
-              input: key,
-              path: [key],
+              input: key2,
+              path: [key2],
               inst
             });
             continue;
           }
           const outKey = keyResult.value;
-          const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+          const result = def.valueType._zod.run({ value: input[key2], issues: [] }, ctx);
           if (result instanceof Promise) {
             proms.push(result.then((result2) => {
               if (result2.issues.length) {
-                payload.issues.push(...prefixIssues(key, result2.issues));
+                payload.issues.push(...prefixIssues(key2, result2.issues));
               }
               payload.value[outKey] = result2.value;
             }));
           } else {
             if (result.issues.length) {
-              payload.issues.push(...prefixIssues(key, result.issues));
+              payload.issues.push(...prefixIssues(key2, result.issues));
             }
             payload.value[outKey] = result.value;
           }
         }
       }
       let unrecognized;
-      for (const key in input) {
-        if (!recordKeys.has(key)) {
+      for (const key2 in input) {
+        if (!recordKeys.has(key2)) {
           unrecognized = unrecognized ?? [];
-          unrecognized.push(key);
+          unrecognized.push(key2);
         }
       }
       if (unrecognized && unrecognized.length > 0) {
@@ -4162,18 +4280,18 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
       }
     } else {
       payload.value = {};
-      for (const key of Reflect.ownKeys(input)) {
-        if (key === "__proto__")
+      for (const key2 of Reflect.ownKeys(input)) {
+        if (key2 === "__proto__")
           continue;
-        if (!Object.prototype.propertyIsEnumerable.call(input, key))
+        if (!Object.prototype.propertyIsEnumerable.call(input, key2))
           continue;
-        let keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+        let keyResult = def.keyType._zod.run({ value: key2, issues: [] }, ctx);
         if (keyResult instanceof Promise) {
           throw new Error("Async schemas not supported in object keys currently");
         }
-        const checkNumericKey = typeof key === "string" && number.test(key) && keyResult.issues.length;
+        const checkNumericKey = typeof key2 === "string" && number.test(key2) && keyResult.issues.length;
         if (checkNumericKey) {
-          const retryResult = def.keyType._zod.run({ value: Number(key), issues: [] }, ctx);
+          const retryResult = def.keyType._zod.run({ value: Number(key2), issues: [] }, ctx);
           if (retryResult instanceof Promise) {
             throw new Error("Async schemas not supported in object keys currently");
           }
@@ -4183,30 +4301,30 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
         }
         if (keyResult.issues.length) {
           if (def.mode === "loose") {
-            payload.value[key] = input[key];
+            payload.value[key2] = input[key2];
           } else {
             payload.issues.push({
               code: "invalid_key",
               origin: "record",
               issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
-              input: key,
-              path: [key],
+              input: key2,
+              path: [key2],
               inst
             });
           }
           continue;
         }
-        const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+        const result = def.valueType._zod.run({ value: input[key2], issues: [] }, ctx);
         if (result instanceof Promise) {
           proms.push(result.then((result2) => {
             if (result2.issues.length) {
-              payload.issues.push(...prefixIssues(key, result2.issues));
+              payload.issues.push(...prefixIssues(key2, result2.issues));
             }
             payload.value[keyResult.value] = result2.value;
           }));
         } else {
           if (result.issues.length) {
-            payload.issues.push(...prefixIssues(key, result.issues));
+            payload.issues.push(...prefixIssues(key2, result.issues));
           }
           payload.value[keyResult.value] = result.value;
         }
@@ -4233,15 +4351,15 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
     }
     const proms = [];
     payload.value = /* @__PURE__ */ new Map();
-    for (const [key, value] of input) {
-      const keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+    for (const [key2, value] of input) {
+      const keyResult = def.keyType._zod.run({ value: key2, issues: [] }, ctx);
       const valueResult = def.valueType._zod.run({ value, issues: [] }, ctx);
       if (keyResult instanceof Promise || valueResult instanceof Promise) {
         proms.push(Promise.all([keyResult, valueResult]).then(([keyResult2, valueResult2]) => {
-          handleMapResult(keyResult2, valueResult2, payload, key, input, inst, ctx);
+          handleMapResult(keyResult2, valueResult2, payload, key2, input, inst, ctx);
         }));
       } else {
-        handleMapResult(keyResult, valueResult, payload, key, input, inst, ctx);
+        handleMapResult(keyResult, valueResult, payload, key2, input, inst, ctx);
       }
     }
     if (proms.length)
@@ -4249,10 +4367,10 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
     return payload;
   };
 });
-function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
+function handleMapResult(keyResult, valueResult, final, key2, input, inst, ctx) {
   if (keyResult.issues.length) {
-    if (propertyKeyTypes.has(typeof key)) {
-      final.issues.push(...prefixIssues(key, keyResult.issues));
+    if (propertyKeyTypes.has(typeof key2)) {
+      final.issues.push(...prefixIssues(key2, keyResult.issues));
     } else {
       final.issues.push({
         code: "invalid_key",
@@ -4264,15 +4382,15 @@ function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
     }
   }
   if (valueResult.issues.length) {
-    if (propertyKeyTypes.has(typeof key)) {
-      final.issues.push(...prefixIssues(key, valueResult.issues));
+    if (propertyKeyTypes.has(typeof key2)) {
+      final.issues.push(...prefixIssues(key2, valueResult.issues));
     } else {
       final.issues.push({
         origin: "map",
         code: "invalid_element",
         input,
         inst,
-        key,
+        key: key2,
         issues: valueResult.issues.map((iss) => finalizeIssue(iss, ctx, config()))
       });
     }
@@ -12033,8 +12151,8 @@ function extractDefs(ctx, schema) {
     if (defId)
       seen.defId = defId;
     const schema2 = seen.schema;
-    for (const key in schema2) {
-      delete schema2[key];
+    for (const key2 in schema2) {
+      delete schema2[key2];
     }
     schema2.$ref = ref;
   };
@@ -12103,20 +12221,20 @@ function finalize(ctx, schema) {
       Object.assign(schema2, _cached);
       const isParentRef = zodSchema._zod.parent === ref;
       if (isParentRef) {
-        for (const key in schema2) {
-          if (key === "$ref" || key === "allOf")
+        for (const key2 in schema2) {
+          if (key2 === "$ref" || key2 === "allOf")
             continue;
-          if (!(key in _cached)) {
-            delete schema2[key];
+          if (!(key2 in _cached)) {
+            delete schema2[key2];
           }
         }
       }
       if (refSchema.$ref && refSeen.def) {
-        for (const key in schema2) {
-          if (key === "$ref" || key === "allOf")
+        for (const key2 in schema2) {
+          if (key2 === "$ref" || key2 === "allOf")
             continue;
-          if (key in refSeen.def && JSON.stringify(schema2[key]) === JSON.stringify(refSeen.def[key])) {
-            delete schema2[key];
+          if (key2 in refSeen.def && JSON.stringify(schema2[key2]) === JSON.stringify(refSeen.def[key2])) {
+            delete schema2[key2];
           }
         }
       }
@@ -12128,11 +12246,11 @@ function finalize(ctx, schema) {
       if (parentSeen?.schema.$ref) {
         schema2.$ref = parentSeen.schema.$ref;
         if (parentSeen.def) {
-          for (const key in schema2) {
-            if (key === "$ref" || key === "allOf")
+          for (const key2 in schema2) {
+            if (key2 === "$ref" || key2 === "allOf")
               continue;
-            if (key in parentSeen.def && JSON.stringify(schema2[key]) === JSON.stringify(parentSeen.def[key])) {
-              delete schema2[key];
+            if (key2 in parentSeen.def && JSON.stringify(schema2[key2]) === JSON.stringify(parentSeen.def[key2])) {
+              delete schema2[key2];
             }
           }
         }
@@ -12233,8 +12351,8 @@ function isTransforming(_schema, _ctx) {
     return isTransforming(def.in, ctx) || isTransforming(def.out, ctx);
   }
   if (def.type === "object") {
-    for (const key in def.shape) {
-      if (isTransforming(def.shape[key], ctx))
+    for (const key2 in def.shape) {
+      if (isTransforming(def.shape[key2], ctx))
         return true;
     }
     return false;
@@ -12523,15 +12641,15 @@ var objectProcessor = (schema, ctx, _json, params) => {
   json3.type = "object";
   json3.properties = {};
   const shape = def.shape;
-  for (const key in shape) {
-    json3.properties[key] = process2(shape[key], ctx, {
+  for (const key2 in shape) {
+    json3.properties[key2] = process2(shape[key2], ctx, {
       ...params,
-      path: [...params.path, "properties", key]
+      path: [...params.path, "properties", key2]
     });
   }
   const allKeys = new Set(Object.keys(shape));
-  const requiredKeys = new Set([...allKeys].filter((key) => {
-    const v = def.shape[key]._zod;
+  const requiredKeys = new Set([...allKeys].filter((key2) => {
+    const v = def.shape[key2]._zod;
     if (ctx.io === "input") {
       return v.optin === void 0;
     } else {
@@ -12797,9 +12915,9 @@ function toJSONSchema(input, params) {
     };
     ctx2.external = external;
     for (const entry of registry2._idmap.entries()) {
-      const [key, schema] = entry;
+      const [key2, schema] = entry;
       extractDefs(ctx2, schema);
-      schemas[key] = finalize(ctx2, schema);
+      schemas[key2] = finalize(ctx2, schema);
     }
     if (Object.keys(defs).length > 0) {
       const defsSegment = ctx2.target === "draft-2020-12" ? "$defs" : "definitions";
@@ -13205,14 +13323,14 @@ function _installLazyMethods(inst, group, methods) {
   if (installed.has(group))
     return;
   installed.add(group);
-  for (const key in methods) {
-    const fn = methods[key];
-    Object.defineProperty(proto, key, {
+  for (const key2 in methods) {
+    const fn = methods[key2];
+    Object.defineProperty(proto, key2, {
       configurable: true,
       enumerable: false,
       get() {
         const bound = fn.bind(this);
-        Object.defineProperty(this, key, {
+        Object.defineProperty(this, key2, {
           configurable: true,
           writable: true,
           enumerable: true,
@@ -13221,7 +13339,7 @@ function _installLazyMethods(inst, group, methods) {
         return bound;
       },
       set(v) {
-        Object.defineProperty(this, key, {
+        Object.defineProperty(this, key2, {
           configurable: true,
           writable: true,
           enumerable: true,
@@ -14609,11 +14727,11 @@ function resolveRef(ref, ctx) {
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
   if (path[0] === defsKey) {
-    const key = path[1];
-    if (!key || !ctx.defs[key]) {
+    const key2 = path[1];
+    if (!key2 || !ctx.defs[key2]) {
       throw new Error(`Reference not found: ${ref}`);
     }
-    return ctx.defs[key];
+    return ctx.defs[key2];
   }
   throw new Error(`Reference not found: ${ref}`);
 }
@@ -14799,9 +14917,9 @@ function convertBaseSchema(schema, ctx) {
       const shape = {};
       const properties = schema.properties || {};
       const requiredSet = new Set(schema.required || []);
-      for (const [key, propSchema] of Object.entries(properties)) {
+      for (const [key2, propSchema] of Object.entries(properties)) {
         const propZodSchema = convertSchema(propSchema, ctx);
-        shape[key] = requiredSet.has(key) ? propZodSchema : propZodSchema.optional();
+        shape[key2] = requiredSet.has(key2) ? propZodSchema : propZodSchema.optional();
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
@@ -14942,20 +15060,20 @@ function convertSchema(schema, ctx) {
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
-  for (const key of coreMetadataKeys) {
-    if (key in schema) {
-      extraMeta[key] = schema[key];
+  for (const key2 of coreMetadataKeys) {
+    if (key2 in schema) {
+      extraMeta[key2] = schema[key2];
     }
   }
   const contentMetadataKeys = ["contentEncoding", "contentMediaType", "contentSchema"];
-  for (const key of contentMetadataKeys) {
-    if (key in schema) {
-      extraMeta[key] = schema[key];
+  for (const key2 of contentMetadataKeys) {
+    if (key2 in schema) {
+      extraMeta[key2] = schema[key2];
     }
   }
-  for (const key of Object.keys(schema)) {
-    if (!RECOGNIZED_KEYS.has(key)) {
-      extraMeta[key] = schema[key];
+  for (const key2 of Object.keys(schema)) {
+    if (!RECOGNIZED_KEYS.has(key2)) {
+      extraMeta[key2] = schema[key2];
     }
   }
   if (Object.keys(extraMeta).length > 0) {
@@ -15033,47 +15151,78 @@ var frameManifestSchema = external_exports.object({
 });
 
 // src/remote-encoding.ts
-async function withFrameUploadRetry(upload, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+async function withFrameUploadRetry(upload, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), canRetry = () => true) {
   for (let attempt = 0; ; attempt++) {
     try {
       return await upload();
     } catch (error51) {
       const status = error51 instanceof ControlPlaneError || error51 instanceof ControlPlaneHttpError ? error51.httpStatus : void 0;
       const transient = status !== void 0 ? status === 408 || status === 429 || status >= 500 : error51 instanceof TypeError || error51 instanceof DOMException && ["TimeoutError", "AbortError"].includes(error51.name);
-      if (!transient || attempt >= 7) throw error51;
+      if (!transient || attempt >= 7 || !canRetry()) throw error51;
       const delay = Math.min(15e3, 1e3 * 2 ** attempt);
       process.stderr.write(`
 Frame upload interrupted; retrying in ${delay / 1e3}s.
 `);
       await sleep(delay);
+      if (!canRetry()) throw error51;
     }
   }
 }
 async function submitFrameCapture(client, id, directory) {
-  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join2(directory, "capture-manifest.json"), "utf8")));
+  const manifest = frameManifestSchema.parse(JSON.parse(await readFile3(join3(directory, "capture-manifest.json"), "utf8")));
   let status = await client.beginEncoding(id, manifest);
   if (status.status === "failed") status = await client.retryEncoding(id);
   if (status.status !== "uploading") {
     if (["expired", "cancelled"].includes(status.status)) throw new Error(`Capture ${status.status}; it cannot be retried.`);
     return status;
   }
-  const file2 = await open(join2(directory, "frames.bin"), "r");
+  const file2 = await open(join3(directory, "frames.bin"), "r");
   try {
     const total = manifest.frames.reduce((n, f) => n + f.size, 0);
     if ((await file2.stat()).size !== total) throw new Error("Capture bytes do not match the manifest.");
-    const uploaded = new Set(status.uploadedParts);
-    for (let part = 0; part < Math.ceil(total / ENCODING_PART_BYTES); part++) {
-      if (uploaded.has(part)) continue;
-      const bytes = Buffer.alloc(Math.min(ENCODING_PART_BYTES, total - part * ENCODING_PART_BYTES));
-      let offset = 0;
-      while (offset < bytes.length) {
-        const r = await file2.read(bytes, offset, bytes.length - offset, part * ENCODING_PART_BYTES + offset);
-        if (!r.bytesRead) throw new Error("Incomplete capture bytes.");
-        offset += r.bytesRead;
-      }
-      await withFrameUploadRetry(() => client.uploadEncodingPart(id, part, bytes));
-      process.stderr.write(`\ruploading frames ${Math.round(Math.min(total, (part + 1) * ENCODING_PART_BYTES) / total * 100)}%`);
-    }
+    const parts = Math.ceil(total / ENCODING_PART_BYTES);
+    const uploaded = new Set(status.uploadedParts.filter((part) => Number.isInteger(part) && part >= 0 && part < parts));
+    const missing = Array.from({ length: parts }, (_, part) => part).filter((part) => !uploaded.has(part));
+    let next = 0, failed = false;
+    let firstFailure;
+    let acceptedBytes = [...uploaded].reduce((sum, part) => sum + Math.min(ENCODING_PART_BYTES, total - part * ENCODING_PART_BYTES), 0);
+    let transferredBytes = 0;
+    const startedAt = Date.now();
+    const progress = () => {
+      const seconds = (Date.now() - startedAt) / 1e3;
+      const rate = seconds > 0 ? transferredBytes / seconds : 0;
+      const remaining = rate > 0 ? ` \xB7 about ${Math.ceil((total - acceptedBytes) / rate)}s left` : "";
+      process.stderr.write(`\ruploading frames ${Math.floor(acceptedBytes / total * 100)}% \xB7 ${(acceptedBytes / 1048576).toFixed(2)}/${(total / 1048576).toFixed(2)} MiB${rate > 0 ? ` \xB7 ${(rate / 1048576).toFixed(2)} MiB/s` : ""}${remaining}`);
+    };
+    progress();
+    const transfer = async () => {
+      while (!failed) {
+        const part = missing[next++];
+        if (part === void 0) return;
+        try {
+          const bytes = Buffer.alloc(Math.min(ENCODING_PART_BYTES, total - part * ENCODING_PART_BYTES));
+          let offset = 0;
+          while (offset < bytes.length) {
+            const r = await file2.read(bytes, offset, bytes.length - offset, part * ENCODING_PART_BYTES + offset);
+            if (!r.bytesRead) throw new Error("Incomplete capture bytes.");
+            offset += r.bytesRead;
+          }
+          if (failed) return;
+          await withFrameUploadRetry(() => client.uploadEncodingPart(id, part, bytes), void 0, () => !failed);
+          acceptedBytes += bytes.length;
+          transferredBytes += bytes.length;
+          progress();
+        } catch (error51) {
+          if (!failed) {
+            firstFailure = error51;
+            failed = true;
+          }
+          throw error51;
+        }
+      }
+    };
+    await Promise.allSettled(Array.from({ length: Math.min(3, missing.length) }, transfer));
+    if (failed) throw firstFailure;
   } finally {
     await file2.close();
   }
@@ -15093,41 +15242,244 @@ async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
 }
 
 // src/cli.ts
-import { spawn as spawn6 } from "child_process";
-import { hostname as hostname4 } from "os";
+import { spawn as spawn8 } from "child_process";
+import { hostname as hostname4, tmpdir as tmpdir3 } from "os";
 import { Command } from "commander";
-import { basename, dirname as dirname2 } from "path";
-import { readdir as readdir2, rm as rm5, stat as stat4 } from "fs/promises";
+import { basename, dirname as dirname2, join as join11 } from "path";
+import { readdir as readdir2, rm as rm7, stat as stat5 } from "fs/promises";
+
+// ../recorder/src/windows-ipc.ts
+import { spawn as spawn3 } from "child_process";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { link, lstat, mkdir as mkdir3, readFile as readFile4, rm as rm3, writeFile as writeFile2 } from "fs/promises";
+import { join as join5, win32 as win322 } from "path";
+
+// ../recorder/src/paths.ts
+import { homedir as homedir3, tmpdir } from "os";
+import { join as join4 } from "path";
+var rillDirectory = () => process.env.RILL_HOME ?? join4(homedir3(), ".rill");
+var daemonSocketPath = () => process.env.RILL_SOCKET ?? join4(rillDirectory(), "recorder-v2.sock");
+var daemonStatePath = () => join4(rillDirectory(), "sessions-v2.json");
+var recordingTempRoot = () => process.env.RILL_TEMP ?? join4(tmpdir(), "rill-recordings");
+
+// ../recorder/src/windows-ipc.ts
+var aclScript = String.raw`$ErrorActionPreference='Stop';try {
+ $path=([Console]::In.ReadToEnd() | ConvertFrom-Json).path
+ $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User
+ $acl=[System.Security.AccessControl.DirectorySecurity]::new()
+ $acl.SetOwner($sid)
+ $acl.SetAccessRuleProtection($true,$false)
+ $rule=[System.Security.AccessControl.FileSystemAccessRule]::new($sid,[System.Security.AccessControl.FileSystemRights]::FullControl,[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)
+ $acl.AddAccessRule($rule)
+ ([System.IO.DirectoryInfo]::new($path)).SetAccessControl($acl)
+ [Console]::Out.Write('secured')
+}catch{[Console]::Error.Write('Recorder directory protection failed.');exit 1}`;
+async function secureWindowsIpcDirectory(path) {
+  if (process.platform !== "win32") throw new Error("Windows IPC directory protection requires Windows.");
+  await new Promise((resolve, reject) => {
+    const executable = win322.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    const child = spawn3(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", aclScript], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    let output = "", failed = false;
+    const fail2 = () => {
+      if (failed) return;
+      failed = true;
+      child.kill();
+      reject(new Error("Cannot secure the Windows recorder directory. Recording has not started."));
+    };
+    const timer = setTimeout(fail2, 15e3);
+    child.once("error", fail2);
+    child.stdin.once("error", fail2);
+    child.stderr.resume();
+    child.stdout.on("data", (chunk) => {
+      output += chunk.toString("ascii");
+      if (output.length > 1024) fail2();
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failed) return;
+      if (code !== 0 || output !== "secured") {
+        fail2();
+        return;
+      }
+      resolve();
+    });
+    child.stdin.end(JSON.stringify({ path }));
+  });
+}
+function validWindowsIpcIdentity(value) {
+  const v = value;
+  return v?.version === 1 && typeof v.pipe === "string" && /^\\\\\.\\pipe\\rill-v3-[a-f0-9]{64}$/.test(v.pipe) && typeof v.token === "string" && /^[a-f0-9]{64}$/.test(v.token);
+}
+function acceptsWindowsIpcToken(expected, header) {
+  if (typeof header !== "string" || !/^Bearer [a-f0-9]{64}$/.test(header)) return false;
+  const supplied = header.slice(7);
+  return supplied.length === expected.length && timingSafeEqual(Buffer.from(supplied), Buffer.from(expected));
+}
+async function windowsIpcIdentity(directory = join5(rillDirectory(), "windows-ipc-v3"), secure = secureWindowsIpcDirectory) {
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  if ((await lstat(directory)).isSymbolicLink()) throw new Error("Recorder directory cannot be a symbolic link.");
+  await secure(directory);
+  const path = join5(directory, "identity.json");
+  const load = async () => {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw new Error("Invalid recorder identity.");
+    const value = JSON.parse(await readFile4(path, "utf8"));
+    if (!validWindowsIpcIdentity(value)) throw new Error("Invalid recorder identity.");
+    return value;
+  };
+  try {
+    return await load();
+  } catch (e) {
+    if (e.code !== "ENOENT") throw new Error("Cannot read the protected recorder identity.");
+  }
+  const identity = { version: 1, pipe: "\\\\.\\pipe\\rill-v3-" + randomBytes2(32).toString("hex"), token: randomBytes2(32).toString("hex") };
+  const temporary = join5(directory, randomBytes2(16).toString("hex") + ".tmp");
+  try {
+    await writeFile2(temporary, JSON.stringify(identity), { mode: 384, flag: "wx" });
+    try {
+      await link(temporary, path);
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+    return await load();
+  } finally {
+    await rm3(temporary, { force: true });
+  }
+}
 
 // ../recorder/src/client.ts
 import { request as request2 } from "http";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 
-// ../recorder/src/paths.ts
-import { homedir as homedir2, tmpdir } from "os";
-import { join as join3 } from "path";
-var rillDirectory = () => process.env.RILL_HOME ?? join3(homedir2(), ".rill");
-var daemonSocketPath = () => process.env.RILL_SOCKET ?? join3(rillDirectory(), "recorder-v2.sock");
-var daemonStatePath = () => join3(rillDirectory(), "sessions-v2.json");
-var recordingTempRoot = () => process.env.RILL_TEMP ?? join3(tmpdir(), "rill-recordings");
+// ../recorder/src/browser-tabs.ts
+import { chromium } from "playwright-core";
+
+// ../recorder/src/redaction.ts
+var secretKeyPattern = /(?:pass(?:word)?|secret|token|api[_-]?key|authorization|cookie|session|access[_-]?token|refresh[_-]?token|client[_-]?secret)/i;
+var tokenValuePattern = /\b(?:sk|pk|ghp|github_pat|xox[baprs]|eyJ)[-_a-zA-Z0-9.]{16,}\b/g;
+function sanitizeUrl(input) {
+  try {
+    const url2 = new URL(input);
+    url2.username = "";
+    url2.password = "";
+    url2.hash = "";
+    for (const key2 of [...url2.searchParams.keys()]) url2.searchParams.set(key2, "[REDACTED]");
+    return url2.toString();
+  } catch {
+    return "[invalid-url]";
+  }
+}
+function redactText(value, maxLength = 8e3) {
+  return value.replace(tokenValuePattern, "[REDACTED]").slice(0, maxLength);
+}
+function redactBody(value, contentType, maxBytes = 65536) {
+  if (Buffer.byteLength(value) > maxBytes) return { body: void 0, omittedReason: "body_too_large" };
+  if (!isAllowedBodyType(contentType)) return { body: void 0, omittedReason: "unsupported_content_type" };
+  if (contentType?.includes("json")) {
+    try {
+      const parsed = JSON.parse(value);
+      return { body: JSON.stringify(redactJson(parsed)) };
+    } catch {
+      return { body: redactText(value) };
+    }
+  }
+  return { body: redactText(value) };
+}
+function isAllowedBodyType(contentType) {
+  if (!contentType) return false;
+  const normalized = contentType.toLowerCase();
+  return normalized.includes("application/json") || normalized.includes("application/problem+json") || normalized.includes("application/graphql-response+json") || normalized.includes("text/plain") || normalized.includes("application/xml") || normalized.includes("text/xml");
+}
+function redactJson(value, depth = 0) {
+  if (depth > 12) return "[TRUNCATED]";
+  if (Array.isArray(value)) return value.slice(0, 100).map((item) => redactJson(item, depth + 1));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).slice(0, 200).map(([key2, child]) => [key2, secretKeyPattern.test(key2) ? "[REDACTED]" : redactJson(child, depth + 1)]));
+  }
+  if (typeof value === "string") return redactText(value, 8e3);
+  return value;
+}
+
+// ../recorder/src/browser-tabs.ts
+function validateTabSelection(options) {
+  if (options.tabId && !options.cdpUrl) throw new Error("validation_failed: --tab-id requires --cdp-url.");
+}
+async function tabs(browser) {
+  const result = [];
+  for (const context of browser.contexts()) for (const page of context.pages()) {
+    if (page.isClosed()) continue;
+    const session = await context.newCDPSession(page).catch(() => null);
+    if (!session) {
+      if (page.isClosed()) continue;
+      throw new Error("browser_unavailable: Could not inspect an open tab.");
+    }
+    try {
+      const { targetInfo } = await session.send("Target.getTargetInfo");
+      result.push({ page, context, tab: { tabId: targetInfo.targetId, url: /^(?:https?:|about:)/i.test(page.url()) ? sanitizeUrl(page.url()) : `[${page.url().split(":", 1)[0]} URL omitted]`, title: redactText(targetInfo.title, 200) } });
+    } catch (error51) {
+      if (!page.isClosed()) throw error51;
+    } finally {
+      await session.detach().catch(() => void 0);
+    }
+  }
+  return result;
+}
+async function listBrowserTabs(cdpUrl) {
+  const browser = await chromium.connectOverCDP(cdpUrl, { noDefaults: true });
+  try {
+    return (await tabs(browser)).map((entry) => entry.tab);
+  } finally {
+    await browser.close();
+  }
+}
+async function connectRecordingTab(cdpUrl, outputDirectory, tabId) {
+  const browser = await chromium.connectOverCDP(cdpUrl, { artifactsDir: outputDirectory, isLocal: true, noDefaults: true });
+  try {
+    const available = await tabs(browser);
+    const selected = tabId ? available.find((entry) => entry.tab.tabId === tabId) : available.length === 1 ? available[0] : void 0;
+    if (!selected) {
+      if (tabId) throw new Error("browser_unavailable: The selected tab is no longer available. Run record tabs --cdp-url <endpoint> and choose an open tab.");
+      if (!available.length) throw new Error("browser_unavailable: The attached browser has no page target to record.");
+      throw new Error("validation_failed: Several tabs are open. Run record tabs --cdp-url <endpoint>, then record start --cdp-url <endpoint> --tab-id <tab-id>.");
+    }
+    return { cdpUrl, browser, context: selected.context, page: selected.page, tabId: selected.tab.tabId };
+  } catch (error51) {
+    await browser.close().catch(() => void 0);
+    throw error51;
+  }
+}
 
 // ../recorder/src/client.ts
-async function ensureDaemon(cliEntryPath) {
+async function ensureDaemon(cliEntryPath, requireTabSelection = false) {
+  const check2 = (health2) => {
+    if (requireTabSelection && !health2.capabilities?.includes("tab-selection-v1")) throw new Error("browser_unavailable: The running Rill recorder predates tab selection. Stop active recordings, then restart the recorder service before attaching.");
+  };
+  let health;
   try {
-    await callDaemon("GET", "/health");
-    return;
+    health = await callDaemon("GET", "/health");
   } catch {
   }
-  const child = spawn2(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
+  if (health) {
+    check2(health);
+    return;
+  }
+  const child = spawn4(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env, windowsHide: true });
+  let startupError;
+  child.once("error", () => {
+    startupError = new Error("The local recorder process could not be launched.");
+  });
   child.unref();
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline) {
+    if (startupError) throw startupError;
     try {
-      await callDaemon("GET", "/health");
-      return;
+      health = await callDaemon("GET", "/health");
     } catch {
       await new Promise((resolve) => setTimeout(resolve, 100));
+      continue;
     }
+    check2(health);
+    return;
   }
   throw new Error("The local recorder service did not start.");
 }
@@ -15140,10 +15492,16 @@ function stopRecording(recordingId) {
 function recordingStatus(recordingId) {
   return callDaemon("GET", `/sessions/${encodeURIComponent(recordingId)}`);
 }
-function callDaemon(method, path, body) {
+var windowsIdentityPromise;
+async function callDaemon(method, path, body) {
+  if (process.platform === "win32" && process.env.RILL_SOCKET) throw new Error("RILL_SOCKET overrides are not supported by authenticated Windows IPC. Unset it before recording.");
+  const identity = process.platform === "win32" ? await (windowsIdentityPromise ??= windowsIpcIdentity().catch((error51) => {
+    windowsIdentityPromise = void 0;
+    throw error51;
+  })) : void 0;
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
-    const outgoing = request2({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
+    const outgoing = request2({ socketPath: identity?.pipe ?? daemonSocketPath(), method, path, headers: { ...payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : {}, ...identity ? { Authorization: "Bearer " + identity.token } : {} } }, (incoming) => {
       const chunks = [];
       incoming.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
       incoming.on("end", () => {
@@ -15156,6 +15514,7 @@ function callDaemon(method, path, body) {
         }
       });
     });
+    outgoing.setTimeout(path === "/health" ? 2e3 : 12e4, () => outgoing.destroy(new Error("Local recorder request timed out.")));
     outgoing.once("error", reject);
     if (payload) outgoing.write(payload);
     outgoing.end();
@@ -15163,17 +15522,17 @@ function callDaemon(method, path, body) {
 }
 
 // ../recorder/src/retention.ts
-import { readdir, readFile as readFile3, rm as rm2 } from "fs/promises";
-import { join as join4 } from "path";
+import { readdir, readFile as readFile5, rm as rm4 } from "fs/promises";
+import { join as join6 } from "path";
 async function purgeExpiredRemoteCaptures(root, now = Date.now()) {
   const removed = [];
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
-    const directory = join4(root, id);
+    const directory = join6(root, id);
     try {
-      const marker = JSON.parse(await readFile3(join4(directory, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile5(join6(directory, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt !== "number" || marker.expiresAt > now) continue;
-      await rm2(directory, { recursive: true, force: true });
+      await rm4(directory, { recursive: true, force: true });
       removed.push(id);
     } catch {
     }
@@ -15184,7 +15543,7 @@ async function hasRetainedRemoteCaptures(root) {
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
     try {
-      const marker = JSON.parse(await readFile3(join4(root, id, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile5(join6(root, id, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt === "number" && Number.isFinite(marker.expiresAt)) return true;
     } catch {
     }
@@ -15194,8 +15553,238 @@ async function hasRetainedRemoteCaptures(root) {
 
 // ../recorder/src/daemon.ts
 import { createServer as createServer2 } from "http";
-import { mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat3 } from "fs/promises";
-import { dirname, join as join8 } from "path";
+import { mkdir as mkdir7, readFile as readFile7, unlink, writeFile as writeFile6, rename as rename2, stat as stat4, chmod } from "fs/promises";
+import { dirname, join as join10 } from "path";
+
+// ../recorder/src/click-capture.ts
+import { randomUUID as randomUUID2 } from "crypto";
+async function captureClicks(page, session, onClick) {
+  const binding = `__rillClick_${randomUUID2().replaceAll("-", "")}`;
+  const source = `(() => {
+    const key = ${JSON.stringify(binding)};
+    if (window[key + '_listener']) return;
+    const listener = event => {
+      const target = event.target;
+      const label = target?.innerText?.trim().slice(0, 80) || target?.getAttribute?.('aria-label') || target?.tagName || 'Element';
+      try { window[key](JSON.stringify({ x: event.clientX, y: event.clientY, label })); } catch {}
+    };
+    window[key + '_listener'] = listener;
+    document.addEventListener('click', listener, { capture: true });
+  })();`;
+  const receive = (event) => {
+    if (event.name !== binding) return;
+    try {
+      const value = JSON.parse(event.payload);
+      if (typeof value.x === "number" && Number.isFinite(value.x) && typeof value.y === "number" && Number.isFinite(value.y) && typeof value.label === "string") onClick({ x: value.x, y: value.y, label: value.label.slice(0, 80) });
+    } catch {
+    }
+  };
+  let identifier;
+  session.on("Runtime.bindingCalled", receive);
+  const cleanup = async () => {
+    session.off("Runtime.bindingCalled", receive);
+    if (identifier) await session.send("Page.removeScriptToEvaluateOnNewDocument", { identifier }).catch(() => void 0);
+    await Promise.all(page.frames().map((frame) => frame.evaluate((key2) => {
+      const target = window;
+      const listener = target[key2 + "_listener"];
+      if (typeof listener === "function") document.removeEventListener("click", listener, { capture: true });
+      delete target[key2 + "_listener"];
+      delete target[key2];
+    }, binding).catch(() => void 0)));
+    await session.send("Runtime.removeBinding", { name: binding }).catch(() => void 0);
+  };
+  try {
+    await session.send("Runtime.enable");
+    await session.send("Runtime.addBinding", { name: binding });
+    ({ identifier } = await session.send("Page.addScriptToEvaluateOnNewDocument", { source }));
+    await Promise.all(page.frames().map((frame) => frame.evaluate(source)));
+    return cleanup;
+  } catch (error51) {
+    await cleanup();
+    throw error51;
+  }
+}
+
+// ../contracts/src/cloud-blocklist.ts
+var blockedCloudDomains = [
+  // Torrent indexes and unofficial software-download destinations.
+  // Explicit domains only: do not block legitimate torrent clients or all downloads.
+  "yasdl.com",
+  "soft98.ir",
+  "downloadha.com",
+  "patoghu.com",
+  "thepiratebay.org",
+  "1337x.to",
+  "yts.mx",
+  "eztvx.to",
+  "fitgirl-repacks.site",
+  "dodi-repacks.site",
+  // Search and reference
+  "google.com",
+  "google.co.uk",
+  "google.co.in",
+  "google.com.ng",
+  "google.ca",
+  "google.com.au",
+  "google.de",
+  "google.fr",
+  "google.co.jp",
+  "google.com.br",
+  "google.es",
+  "bing.com",
+  "yahoo.com",
+  "duckduckgo.com",
+  "baidu.com",
+  "yandex.com",
+  "yandex.ru",
+  "wikipedia.org",
+  "quora.com",
+  // Social networks and media
+  "reddit.com",
+  "redd.it",
+  "facebook.com",
+  "fb.com",
+  "instagram.com",
+  "threads.net",
+  "threads.com",
+  "twitter.com",
+  "x.com",
+  "t.co",
+  "linkedin.com",
+  "tiktok.com",
+  "pinterest.com",
+  "snapchat.com",
+  "youtube.com",
+  "youtu.be",
+  "twitch.tv",
+  "discord.com",
+  "discord.gg",
+  "telegram.org",
+  "t.me",
+  "whatsapp.com",
+  // Shopping and marketplaces
+  "amazon.com",
+  "amazon.co.uk",
+  "amazon.ca",
+  "amazon.de",
+  "amazon.fr",
+  "amazon.in",
+  "amazon.co.jp",
+  "amazon.com.au",
+  "amazon.it",
+  "amazon.es",
+  "ebay.com",
+  "ebay.co.uk",
+  "etsy.com",
+  "walmart.com",
+  "target.com",
+  "aliexpress.com",
+  "alibaba.com",
+  "temu.com",
+  "shein.com",
+  "craigslist.org",
+  "facebookmarketplace.com",
+  "bestbuy.com",
+  "costco.com",
+  "homedepot.com",
+  "wayfair.com",
+  "mercadolibre.com",
+  "shopee.com",
+  "lazada.com",
+  "jiji.ng",
+  "jumia.com.ng",
+  "konga.com",
+  "propertypro.ng",
+  "property24.com",
+  // Travel, property, jobs and business directories
+  "airbnb.com",
+  "airbnb.co.uk",
+  "airbnb.ca",
+  "airbnb.com.au",
+  "airbnb.fr",
+  "airbnb.de",
+  "booking.com",
+  "expedia.com",
+  "tripadvisor.com",
+  "agoda.com",
+  "hotels.com",
+  "kayak.com",
+  "skyscanner.net",
+  "zillow.com",
+  "realtor.com",
+  "rightmove.co.uk",
+  "zoopla.co.uk",
+  "indeed.com",
+  "glassdoor.com",
+  "yelp.com",
+  "yellowpages.com",
+  "trustpilot.com",
+  "crunchbase.com",
+  "g2.com",
+  "capterra.com",
+  "clutch.co",
+  "zoominfo.com",
+  "apollo.io",
+  "monster.com",
+  "ziprecruiter.com",
+  "seek.com.au",
+  "naukri.com",
+  "redfin.com",
+  "trulia.com",
+  "apartments.com",
+  "realtor.ca",
+  "realestate.com.au",
+  "vrbo.com",
+  "trip.com",
+  "trivago.com",
+  "hostelworld.com"
+];
+var blockedCloudTargetMessage = "This website is not supported for cloud runs. Use your own website or app instead.";
+function isBlockedCloudTarget(value) {
+  try {
+    const hostname5 = new URL(value).hostname.toLowerCase().replace(/\.+$/, "");
+    return blockedCloudDomains.some((domain2) => hostname5 === domain2 || hostname5.endsWith(`.${domain2}`));
+  } catch {
+    return false;
+  }
+}
+
+// ../contracts/src/cloud-run.ts
+var publicTarget = external_exports.string().url().max(2048).refine((value) => {
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    return false;
+  }
+  return ["http:", "https:"].includes(u.protocol) && !u.username && !u.password && !u.port && !u.hash && u.hostname.includes(".") && !/^[0-9.]+$/.test(u.hostname) && !u.hostname.endsWith(".exe.xyz") && !u.hostname.endsWith(".local") && !u.hostname.endsWith(".internal") && !u.hostname.endsWith(".localhost");
+}, "Use a public HTTP(S) URL without credentials, fragments, or a custom port.");
+var cloudRunTarget = publicTarget.refine((value) => !isBlockedCloudTarget(value), blockedCloudTargetMessage);
+var interactionFields = {
+  mode: external_exports.enum(["browse", "interact"]).optional(),
+  interactionConfirmed: external_exports.boolean().optional(),
+  // Legacy payload compatibility only; Interact automatically permits API destinations.
+  allowedWriteOrigins: external_exports.array(cloudRunTarget.refine((v) => new URL(v).origin === v, "Use an exact origin.")).max(5).optional()
+};
+var sideEffectSchema = external_exports.object({
+  action: external_exports.enum(["fill", "check", "select", "press", "click"]),
+  page: external_exports.string().max(2048),
+  target: external_exports.string().max(160),
+  status: external_exports.enum(["performed", "unknown"])
+}).strict();
+var interactionReportFields = {
+  mode: external_exports.enum(["browse", "interact"]).optional(),
+  sideEffects: external_exports.array(sideEffectSchema).max(30).optional(),
+  cleanup: external_exports.literal("not_attempted").optional()
+};
+var cloudSubmission = external_exports.object({ ...interactionFields, id: external_exports.string().uuid(), url: cloudRunTarget, prompt: external_exports.string().trim().min(1).max(2e3), expectation: external_exports.string().trim().min(1).max(1e3).optional(), account: external_exports.string().regex(/^[a-z0-9-]{1,60}$/).optional() }).strict();
+var siteAccountSchema = external_exports.object({
+  name: external_exports.string().regex(/^[a-z0-9-]{1,60}$/),
+  origin: publicTarget.refine((v) => new URL(v).protocol === "https:" && new URL(v).origin === v, "Use an exact HTTPS origin."),
+  loginUrl: publicTarget.refine((v) => new URL(v).protocol === "https:").optional(),
+  username: external_exports.string().min(1).max(320),
+  password: external_exports.string().min(1).max(1e3)
+}).strict().refine((v) => !v.loginUrl || new URL(v.loginUrl).origin === v.origin, "Login must use the saved website origin.");
 
 // ../contracts/src/recording.ts
 var cursorAppearanceSchema = external_exports.object({
@@ -15236,6 +15825,7 @@ var recordingSchema = external_exports.object({
   })
 });
 var agentOutcomeSchema = external_exports.object({
+  ...interactionReportFields,
   outcome: external_exports.enum(["walkthrough", "passed", "failed", "inconclusive"]),
   summary: external_exports.string().min(1).max(1e3),
   evidence: external_exports.string().max(1e3)
@@ -15323,15 +15913,15 @@ async function attachCursorOverlay(page, cdp, input) {
   const appearance = cursorAppearanceSchema.parse(input ?? {});
   if (!appearance.enabled) return async () => {
   };
-  const key = `__rillCursor_${crypto.randomUUID().replaceAll("-", "")}`;
-  const source = `(${installCursorOverlay.toString()})(${JSON.stringify({ ...appearance, key })})`;
+  const key2 = `__rillCursor_${crypto.randomUUID().replaceAll("-", "")}`;
+  const source = `(${installCursorOverlay.toString()})(${JSON.stringify({ ...appearance, key: key2 })})`;
   await cdp.send("Page.enable");
   const { identifier } = await cdp.send("Page.addScriptToEvaluateOnNewDocument", { source });
   let stopped = false;
-  const removeFromFrame = (frame) => frame.evaluate((key2) => {
-    const cleanup2 = window[key2];
+  const removeFromFrame = (frame) => frame.evaluate((key3) => {
+    const cleanup2 = window[key3];
     if (typeof cleanup2 === "function") cleanup2();
-  }, key).catch(() => void 0);
+  }, key2).catch(() => void 0);
   const onNavigation = (frame) => {
     if (stopped) return;
     void frame.evaluate(source).then(() => {
@@ -15355,11 +15945,11 @@ async function attachCursorOverlay(page, cdp, input) {
 }
 
 // ../recorder/src/session.ts
-import { chromium } from "playwright-core";
-import { spawn as spawn4 } from "child_process";
+import { chromium as chromium2 } from "playwright-core";
+import { spawn as spawn6 } from "child_process";
 import { createServer } from "net";
-import { mkdir as mkdir4, mkdtemp, rm as rm3, writeFile as writeFile3 } from "fs/promises";
-import { join as join7 } from "path";
+import { mkdir as mkdir6, mkdtemp, rm as rm5, writeFile as writeFile5 } from "fs/promises";
+import { join as join9 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // ../recorder/src/bundle.ts
@@ -15385,63 +15975,22 @@ async function writeBundle(bundle, outputPath) {
 
 // ../recorder/src/environment.ts
 import { existsSync } from "fs";
-function findChromeExecutable() {
-  if (process.env.RILL_CHROME_PATH) return process.env.RILL_CHROME_PATH;
-  if (process.platform === "darwin") return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
-  const candidates = ["/usr/bin/google-chrome", "/usr/bin/google-chrome-stable", "/usr/bin/chromium", "/usr/bin/chromium-browser"];
-  return candidates.find((candidate) => existsSync(candidate)) ?? "google-chrome";
-}
-
-// ../recorder/src/redaction.ts
-var secretKeyPattern = /(?:pass(?:word)?|secret|token|api[_-]?key|authorization|cookie|session|access[_-]?token|refresh[_-]?token|client[_-]?secret)/i;
-var tokenValuePattern = /\b(?:sk|pk|ghp|github_pat|xox[baprs]|eyJ)[-_a-zA-Z0-9.]{16,}\b/g;
-function sanitizeUrl(input) {
-  try {
-    const url2 = new URL(input);
-    url2.username = "";
-    url2.password = "";
-    url2.hash = "";
-    for (const key of [...url2.searchParams.keys()]) url2.searchParams.set(key, "[REDACTED]");
-    return url2.toString();
-  } catch {
-    return "[invalid-url]";
+import { win32 as win323 } from "path";
+function findChromeExecutable(platform = process.platform, env = process.env, exists = existsSync) {
+  if (env.RILL_CHROME_PATH) return env.RILL_CHROME_PATH;
+  if (platform === "darwin") return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
+  if (platform === "win32") {
+    const candidates2 = [env.PROGRAMFILES ?? env.ProgramFiles, env["PROGRAMFILES(X86)"] ?? env["ProgramFiles(x86)"], env.LOCALAPPDATA].filter((root) => Boolean(root)).map((root) => win323.join(root, "Google", "Chrome", "Application", "chrome.exe"));
+    return candidates2.find(exists) ?? win323.join(env.PROGRAMFILES ?? env.ProgramFiles ?? "C:\\Program Files", "Google", "Chrome", "Application", "chrome.exe");
   }
-}
-function redactText(value, maxLength = 8e3) {
-  return value.replace(tokenValuePattern, "[REDACTED]").slice(0, maxLength);
-}
-function redactBody(value, contentType, maxBytes = 65536) {
-  if (Buffer.byteLength(value) > maxBytes) return { body: void 0, omittedReason: "body_too_large" };
-  if (!isAllowedBodyType(contentType)) return { body: void 0, omittedReason: "unsupported_content_type" };
-  if (contentType?.includes("json")) {
-    try {
-      const parsed = JSON.parse(value);
-      return { body: JSON.stringify(redactJson(parsed)) };
-    } catch {
-      return { body: redactText(value) };
-    }
-  }
-  return { body: redactText(value) };
-}
-function isAllowedBodyType(contentType) {
-  if (!contentType) return false;
-  const normalized = contentType.toLowerCase();
-  return normalized.includes("application/json") || normalized.includes("application/problem+json") || normalized.includes("application/graphql-response+json") || normalized.includes("text/plain") || normalized.includes("application/xml") || normalized.includes("text/xml");
-}
-function redactJson(value, depth = 0) {
-  if (depth > 12) return "[TRUNCATED]";
-  if (Array.isArray(value)) return value.slice(0, 100).map((item) => redactJson(item, depth + 1));
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).slice(0, 200).map(([key, child]) => [key, secretKeyPattern.test(key) ? "[REDACTED]" : redactJson(child, depth + 1)]));
-  }
-  if (typeof value === "string") return redactText(value, 8e3);
-  return value;
+  const candidates = ["/usr/bin/google-chrome", "/usr/bin/google-chrome-stable", "/usr/bin/chromium", "/usr/bin/chromium-browser"];
+  return candidates.find(exists) ?? "google-chrome";
 }
 
 // ../recorder/src/encoding.ts
-import { open as open2, writeFile, mkdir as mkdir2 } from "fs/promises";
-import { spawn as spawn3 } from "child_process";
-import { join as join5 } from "path";
+import { open as open2, writeFile as writeFile3, mkdir as mkdir4 } from "fs/promises";
+import { spawn as spawn5 } from "child_process";
+import { join as join7 } from "path";
 var active = 0;
 var waiting = [];
 function encodingConcurrency() {
@@ -15449,8 +15998,22 @@ function encodingConcurrency() {
   if (!Number.isInteger(n) || n < 1 || n > 8) throw new Error("Invalid RILL_ENCODING_CONCURRENCY");
   return n;
 }
-async function withEncodingSlot(work) {
-  if (active >= encodingConcurrency()) await new Promise((resolve) => waiting.push(resolve));
+async function withEncodingSlot(work, signal) {
+  signal?.throwIfAborted();
+  if (active >= encodingConcurrency()) await new Promise((resolve, reject) => {
+    const granted = () => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    };
+    const abort = () => {
+      const i = waiting.indexOf(granted);
+      if (i >= 0) waiting.splice(i, 1);
+      reject(new Error("encoding_aborted"));
+    };
+    waiting.push(granted);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+  });
   else active++;
   try {
     return await work();
@@ -15471,11 +16034,15 @@ async function encodeFrames(directory, manifest, output, signal) {
       lines.push(`file 'frame-${String(i).padStart(6, "0")}.jpg'`, `duration ${Math.max(1 / 60, duration3).toFixed(6)}`);
     }
     lines.push(`file 'frame-${String(manifest.frames.length - 1).padStart(6, "0")}.jpg'`);
-    await writeFile(join5(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
+    await writeFile3(join7(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
     const threads = Number(process.env.RILL_FFMPEG_THREADS ?? 1);
     if (!Number.isInteger(threads) || threads < 1 || threads > 16) throw new Error("Invalid RILL_FFMPEG_THREADS");
+    signal?.throwIfAborted();
+    const dimensions = `scale=${manifest.width}:${manifest.height}:force_original_aspect_ratio=decrease,pad=${manifest.width}:${manifest.height}:(ow-iw)/2:(oh-ih)/2,setsar=1`;
+    const filters = output.endsWith(".mp4") ? `${dimensions},fps=30,tpad=stop_mode=clone:stop_duration=1` : dimensions;
+    const codec2 = output.endsWith(".mp4") ? ["-c:v", "libx264", "-preset", "veryfast", "-crf", "23", "-movflags", "+faststart", "-fps_mode", "cfr", "-t", String(Math.min(60, manifest.durationSeconds))] : ["-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-b:v", "0", "-crf", "32"];
     await new Promise((resolve, reject) => {
-      const child = spawn3(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
+      const child = spawn5(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-vf", filters, ...codec2, "-threads", String(threads), "-y", output], { cwd: directory, windowsHide: true, stdio: ["ignore", "ignore", "pipe"] });
       let stderr = "";
       child.stderr.on("data", (chunk) => {
         stderr = (stderr + String(chunk)).slice(-2e3);
@@ -15483,6 +16050,7 @@ async function encodeFrames(directory, manifest, output, signal) {
       const abort = () => child.kill("SIGKILL");
       const timer = setTimeout(abort, 20 * 6e4);
       signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted) abort();
       const clean = () => {
         clearTimeout(timer);
         signal?.removeEventListener("abort", abort);
@@ -15496,12 +16064,12 @@ async function encodeFrames(directory, manifest, output, signal) {
         code === 0 ? resolve() : reject(new Error(`ffmpeg failed (${code}): ${stderr}`));
       });
     });
-  });
+  }, signal);
 }
 
 // ../recorder/src/screencast.ts
-import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
-import { join as join6 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile4, readFile as readFile6, open as open3 } from "fs/promises";
+import { join as join8 } from "path";
 var ScreencastRecorder = class {
   constructor(session, directory, width, height) {
     this.session = session;
@@ -15509,6 +16077,10 @@ var ScreencastRecorder = class {
     this.width = width;
     this.height = height;
   }
+  session;
+  directory;
+  width;
+  height;
   frames = [];
   pendingWrites = /* @__PURE__ */ new Set();
   started = false;
@@ -15516,7 +16088,7 @@ var ScreencastRecorder = class {
   frameBytes = 0;
   captureError;
   async start() {
-    await mkdir3(this.directory, { recursive: true, mode: 448 });
+    await mkdir5(this.directory, { recursive: true, mode: 448 });
     this.session.on("Page.screencastFrame", (payload) => {
       const bytes = Buffer.from(payload.data, "base64");
       if (this.frameCounter >= 36e3 || this.frameBytes + bytes.length > ENCODING_MAX_BYTES || bytes.length > ENCODING_PART_BYTES) {
@@ -15525,9 +16097,9 @@ var ScreencastRecorder = class {
         return;
       }
       this.frameBytes += bytes.length;
-      const path = join6(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
+      const path = join8(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
       this.frameCounter += 1;
-      const write = writeFile2(path, bytes, { mode: 384 }).then(() => {
+      const write = writeFile4(path, bytes, { mode: 384 }).then(() => {
         this.frames.push({ path, timestamp: payload.metadata.timestamp ?? Date.now() / 1e3 });
       }).catch((error51) => {
         this.captureError = error51 instanceof Error ? error51 : new Error(String(error51));
@@ -15541,7 +16113,7 @@ var ScreencastRecorder = class {
     await this.session.send("Page.startScreencast", { format: "jpeg", quality: 82, maxWidth: this.width, maxHeight: this.height, everyNthFrame: 1 });
     this.started = true;
   }
-  async stop(outputPath, expectedDurationSeconds, captureOnly = false) {
+  async stop(outputPath, expectedDurationSeconds, captureOnly = false, signal) {
     if (this.started) await this.session.send("Page.stopScreencast").catch(() => void 0);
     await new Promise((resolve) => setTimeout(resolve, 120));
     await Promise.all(this.pendingWrites);
@@ -15549,10 +16121,10 @@ var ScreencastRecorder = class {
     if (!this.frames.length) throw new Error("No video frames were captured.");
     const ordered = this.frames.toSorted((a, b) => a.timestamp - b.timestamp);
     const frames = [];
-    const bundle = await open3(join6(this.directory, "frames.bin"), "w", 384);
+    const bundle = await open3(join8(this.directory, "frames.bin"), "w", 384);
     try {
       for (const frame of ordered) {
-        const bytes = await readFile4(frame.path);
+        const bytes = await readFile6(frame.path);
         await bundle.writeFile(bytes);
         frames.push({ timestamp: frame.timestamp, size: bytes.length });
       }
@@ -15560,8 +16132,8 @@ var ScreencastRecorder = class {
       await bundle.close();
     }
     const manifest = frameManifestSchema.parse({ version: 1, durationSeconds: Math.min(600, expectedDurationSeconds), width: this.width, height: this.height, frames });
-    await writeFile2(join6(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
-    if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath);
+    await writeFile4(join8(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
+    if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath, signal);
     return { frameCount: this.frames.length, outputPath };
   }
 };
@@ -15572,6 +16144,7 @@ var RecordingSession = class _RecordingSession {
   recordingId;
   startedAt = /* @__PURE__ */ new Date();
   cdpUrl;
+  tabId;
   browser;
   context;
   page;
@@ -15585,6 +16158,8 @@ var RecordingSession = class _RecordingSession {
   requestEvents = /* @__PURE__ */ new Map();
   stopPromise;
   maxTimer;
+  maxDurationSeconds;
+  removeClickCapture;
   removeCursorOverlay;
   diagnosticsPaused = false;
   secretValues = [];
@@ -15595,9 +16170,13 @@ var RecordingSession = class _RecordingSession {
   bodyBytes = 0;
   truncated = false;
   constructor(options, runtime) {
+    this.maxDurationSeconds = options.maxDurationSeconds ?? 600;
     this.encoding = options.encoding ?? "local";
+    this.videoFormat = options.videoFormat ?? "webm";
+    this.captureSignal = options.signal;
     this.recordingId = options.recordingId;
     this.cdpUrl = runtime.cdpUrl;
+    this.tabId = runtime.tabId;
     this.browser = runtime.browser;
     this.context = runtime.context;
     this.page = runtime.page;
@@ -15607,17 +16186,28 @@ var RecordingSession = class _RecordingSession {
     this.outputDirectory = options.outputDirectory;
   }
   static async start(options) {
+    validateTabSelection(options);
     const width = options.width ?? 1280;
     const height = options.height ?? 720;
-    await mkdir4(options.outputDirectory, { recursive: true, mode: 448 });
-    if (options.encoding === "remote") await writeFile3(join7(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
-    const runtime = options.cdpUrl ? await connectAttached(options.cdpUrl, options.outputDirectory) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer });
-    const cdpSession = await runtime.context.newCDPSession(runtime.page);
-    const screencast = new ScreencastRecorder(cdpSession, join7(options.outputDirectory, "frames"), width, height);
+    await mkdir6(options.outputDirectory, { recursive: true, mode: 448 });
+    if (options.encoding === "remote") await writeFile5(join9(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
+    const runtime = options.cdpUrl ? await connectRecordingTab(options.cdpUrl, options.outputDirectory, options.tabId) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer, blockServiceWorkers: options.blockServiceWorkers });
+    let cdpSession;
+    try {
+      cdpSession = await runtime.context.newCDPSession(runtime.page);
+    } catch (error51) {
+      await runtime.browser.close().catch(() => void 0);
+      if ("browserProcess" in runtime && runtime.browserProcess) await terminateBrowser(runtime.browserProcess);
+      if ("profileDirectory" in runtime && runtime.profileDirectory) await rm5(runtime.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+      throw error51;
+    }
+    const screencast = new ScreencastRecorder(cdpSession, join9(options.outputDirectory, "frames"), width, height);
     const session = new _RecordingSession(options, { ...runtime, screencast });
     try {
-      await session.attachDiagnostics(options.captureNetworkBodies ?? false);
-      session.removeCursorOverlay = await attachCursorOverlay(runtime.page, cdpSession, options.cursorAppearance);
+      await session.attachDiagnostics(options.captureNetworkBodies ?? false, cdpSession);
+      if (!options.hideCursor) session.removeCursorOverlay = await attachCursorOverlay(runtime.page, cdpSession, options.cursorAppearance);
+      await options.beforeCapture?.(runtime.page);
+      session.startedAt = /* @__PURE__ */ new Date();
       await screencast.start();
       if (options.url) await session.page.goto(options.url, { waitUntil: "domcontentloaded" });
     } catch (error51) {
@@ -15626,7 +16216,7 @@ var RecordingSession = class _RecordingSession {
     }
     session.maxTimer = setTimeout(() => {
       void session.stop("max_duration").catch(() => void 0);
-    }, (options.maxDurationSeconds ?? 600) * 1e3);
+    }, Math.max(0, session.startedAt.getTime() + session.maxDurationSeconds * 1e3 - Date.now()));
     return session;
   }
   // In-process agents share this connection so exposed diagnostic bindings are
@@ -15635,7 +16225,18 @@ var RecordingSession = class _RecordingSession {
     return this.page;
   }
   status() {
-    return { recordingId: this.recordingId, cdpUrl: this.cdpUrl, startedAt: this.startedAt.toISOString(), status: this.stopPromise ? "finalizing" : "recording" };
+    const elapsedSeconds = Math.max(0, (Date.now() - this.startedAt.getTime()) / 1e3);
+    return {
+      recordingId: this.recordingId,
+      cdpUrl: this.cdpUrl,
+      ...this.tabId ? { tabId: this.tabId } : {},
+      startedAt: this.startedAt.toISOString(),
+      maxDurationSeconds: this.maxDurationSeconds,
+      elapsedSeconds,
+      remainingSeconds: this.stopPromise ? 0 : Math.max(0, this.maxDurationSeconds - elapsedSeconds),
+      stopsAt: new Date(this.startedAt.getTime() + this.maxDurationSeconds * 1e3).toISOString(),
+      status: this.stopPromise ? "finalizing" : "recording"
+    };
   }
   async stop(reason = "agent_request") {
     this.stopPromise ??= this.finalize(reason);
@@ -15645,8 +16246,8 @@ var RecordingSession = class _RecordingSession {
     if (this.maxTimer) clearTimeout(this.maxTimer);
     const durationSeconds = Math.max(0.1, (Date.now() - this.startedAt.getTime()) / 1e3);
     const outputDirectory = this.outputDirectory;
-    const videoPath = join7(outputDirectory, "recording.webm");
-    const diagnosticsPath = join7(outputDirectory, "diagnostics-v1.ndjson.gz");
+    const videoPath = join9(outputDirectory, `recording.${this.videoFormat}`);
+    const diagnosticsPath = join9(outputDirectory, "diagnostics-v1.ndjson.gz");
     const bundle = {
       schemaVersion: 1,
       capturePolicyVersion: "safe-default-v1",
@@ -15663,24 +16264,27 @@ var RecordingSession = class _RecordingSession {
     try {
       const safeBundle = JSON.parse(this.secretValues.reduce((text, secret) => text.split(JSON.stringify(secret).slice(1, -1)).join("[redacted]"), JSON.stringify(bundle)));
       await writeBundle(safeBundle, diagnosticsPath);
-      await this.screencast.stop(videoPath, durationSeconds, this.encoding === "remote");
+      await this.screencast.stop(videoPath, durationSeconds, this.encoding === "remote", this.captureSignal);
     } finally {
-      await this.removeCursorOverlay?.();
+      await this.removeClickCapture?.().catch(() => void 0);
+      await this.removeCursorOverlay?.().catch(() => void 0);
+      await this.browser.close().catch(() => void 0);
       if (this.browserProcess) {
-        await this.browser.close().catch(() => void 0);
         await terminateBrowser(this.browserProcess);
-        if (this.profileDirectory) await rm3(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+        if (this.profileDirectory) await rm5(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
       }
     }
     const consoleErrors = this.consoleEvents.filter((event) => event.severity === "error").length;
     const failedRequests = this.networkEvents.filter((event) => event.failureReason).length;
     const httpErrors = this.networkEvents.filter((event) => (event.status ?? 0) >= 400).length;
-    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join7(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
+    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join9(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
   }
   captureNetworkBodies = false;
+  captureSignal;
+  videoFormat = "webm";
   encoding = "local";
   outputDirectory = "";
-  async attachDiagnostics(captureNetworkBodies) {
+  async attachDiagnostics(captureNetworkBodies, cdpSession) {
     this.captureNetworkBodies = captureNetworkBodies;
     const offset = () => Date.now() - this.startedAt.getTime();
     const pushTimeline = (event) => {
@@ -15691,14 +16295,7 @@ var RecordingSession = class _RecordingSession {
       }
       this.timelineEvents.push({ id: `time_${this.timelineEvents.length + 1}`, ...event });
     };
-    await this.page.exposeFunction("__rillClick", (payload) => pushTimeline({ offsetMs: offset(), type: "click", label: `${payload.label || "Element"} at ${Math.round(payload.x)},${Math.round(payload.y)}` })).catch(() => void 0);
-    await this.page.addInitScript(() => {
-      document.addEventListener("click", (event) => {
-        const target = event.target;
-        const label = target?.innerText?.trim().slice(0, 80) || target?.getAttribute("aria-label") || target?.tagName || "Element";
-        void window.__rillClick?.({ x: event.clientX, y: event.clientY, label });
-      }, { capture: true });
-    });
+    this.removeClickCapture = await captureClicks(this.page, cdpSession, (payload) => pushTimeline({ offsetMs: offset(), type: "click", label: `${payload.label || "Element"} at ${Math.round(payload.x)},${Math.round(payload.y)}` }));
     this.page.on("framenavigated", (frame) => {
       if (frame === this.page.mainFrame()) pushTimeline({ offsetMs: offset(), type: "navigation", label: sanitizeUrl(frame.url()) });
     });
@@ -15787,7 +16384,7 @@ var RecordingSession = class _RecordingSession {
 };
 async function launchManaged(options) {
   const port = await getAvailablePort();
-  const profileDirectory = await mkdtemp(join7(tmpdir2(), "rill-chrome-"));
+  const profileDirectory = await mkdtemp(join9(tmpdir2(), "rill-chrome-"));
   const executable = findChromeExecutable();
   const args = [
     `--remote-debugging-port=${port}`,
@@ -15804,29 +16401,22 @@ async function launchManaged(options) {
     ...options.headed ? [] : ["--headless=new", "--hide-scrollbars"],
     "about:blank"
   ];
-  const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key))) : process.env;
-  const browserProcess = spawn4(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
+  const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key2]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key2))) : process.env;
+  const browserProcess = spawn6(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, windowsHide: true, env });
   const cdpUrl = `http://127.0.0.1:${port}`;
   try {
     await waitForCdp(cdpUrl, browserProcess);
-    const browser = await chromium.connectOverCDP(cdpUrl, { artifactsDir: options.outputDirectory, isLocal: true });
-    const context = browser.contexts()[0];
+    const browser = await chromium2.connectOverCDP(cdpUrl, { artifactsDir: options.outputDirectory, isLocal: true });
+    const context = options.blockServiceWorkers ? await browser.newContext({ serviceWorkers: "block" }) : browser.contexts()[0];
     const page = context.pages()[0] ?? await context.newPage();
     await page.setViewportSize({ width: options.width, height: options.height });
     return { cdpUrl, browser, context, page, browserProcess, profileDirectory };
   } catch (error51) {
     await terminateBrowser(browserProcess);
-    await rm3(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+    await rm5(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
     throw error51;
   }
 }
-async function connectAttached(cdpUrl, outputDirectory) {
-  const browser = await chromium.connectOverCDP(cdpUrl, { artifactsDir: outputDirectory, isLocal: true, noDefaults: true });
-  const context = browser.contexts()[0];
-  const page = context.pages()[0];
-  if (!page) throw new Error("The attached browser has no page target to record.");
-  return { cdpUrl, browser, context, page };
-}
 async function getAvailablePort() {
   const server = createServer();
   await new Promise((resolve, reject) => server.listen(0, "127.0.0.1", resolve).once("error", reject));
@@ -15866,16 +16456,31 @@ async function waitForCdp(cdpUrl, browserProcess) {
 var sessions = /* @__PURE__ */ new Map();
 var lastActivity = Date.now();
 async function runDaemon() {
-  const socketPath = daemonSocketPath();
-  await mkdir5(dirname(socketPath), { recursive: true, mode: 448 });
-  await mkdir5(recordingTempRoot(), { recursive: true, mode: 448 });
+  if (process.platform === "win32" && process.env.RILL_SOCKET) throw new Error("RILL_SOCKET overrides are not supported by authenticated Windows IPC.");
+  const identity = process.platform === "win32" ? await windowsIpcIdentity() : void 0;
+  const socketPath = identity?.pipe ?? daemonSocketPath();
+  await mkdir7(identity ? dirname(daemonStatePath()) : dirname(socketPath), { recursive: true, mode: 448 });
+  await mkdir7(recordingTempRoot(), { recursive: true, mode: 448 });
   await restoreRecoverableSessions();
   await purgeExpiredCaptures();
-  await unlink(socketPath).catch((error51) => {
+  if (!identity) await unlink(socketPath).catch((error51) => {
     if (error51.code !== "ENOENT") throw error51;
   });
-  const server = createServer2((request3, response) => void route(request3, response));
-  server.listen(socketPath, () => process.platform !== "win32" && import("fs/promises").then(({ chmod }) => chmod(socketPath, 384)));
+  const server = createServer2((request3, response) => {
+    if (identity && !acceptsWindowsIpcToken(identity.token, request3.headers.authorization)) {
+      request3.resume();
+      json2(response, 401, { error: { code: "authentication_required", message: "Recorder authentication required." } });
+      return;
+    }
+    void route(request3, response);
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      if (identity) resolve();
+      else void chmod(socketPath, 384).then(resolve, reject);
+    });
+  });
   const idleTimer = setInterval(() => {
     void (async () => {
       await purgeExpiredCaptures();
@@ -15888,7 +16493,7 @@ async function runDaemon() {
   const close = () => {
     clearInterval(idleTimer);
     server.close();
-    void unlink(socketPath).catch(() => void 0);
+    if (!identity) void unlink(socketPath).catch(() => void 0);
   };
   process.once("SIGTERM", close);
   process.once("SIGINT", close);
@@ -15896,18 +16501,18 @@ async function runDaemon() {
 async function route(request3, response) {
   lastActivity = Date.now();
   const url2 = new URL(request3.url ?? "/", "http://daemon.local");
-  if (request3.method === "GET" && url2.pathname === "/health") return json2(response, 200, { ok: true, pid: process.pid });
+  if (request3.method === "GET" && url2.pathname === "/health") return json2(response, 200, { ok: true, pid: process.pid, capabilities: ["tab-selection-v1"] });
   if (request3.method === "POST" && url2.pathname === "/sessions") {
     if ([...sessions.values()].filter((entry) => entry.state === "recording").length >= 2) return json2(response, 429, { error: { code: "quota_exceeded", message: "This recorder already has two active sessions." } });
     try {
       const input = await readJson(request3);
       if (!/^rec_[a-zA-Z0-9_-]+$/.test(input.recordingId)) return json2(response, 400, { error: { code: "validation_failed", message: "recordingId is required." } });
-      const outputDirectory = join8(recordingTempRoot(), input.recordingId);
+      const outputDirectory = join10(recordingTempRoot(), input.recordingId);
       const session = await RecordingSession.start({ ...input, outputDirectory });
       const status = session.status();
-      const entry = { session, base: { recordingId: status.recordingId, cdpUrl: status.cdpUrl, startedAt: status.startedAt }, state: "recording" };
+      const entry = { session, base: { recordingId: status.recordingId, cdpUrl: status.cdpUrl, tabId: status.tabId, startedAt: status.startedAt }, state: "recording" };
       sessions.set(input.recordingId, entry);
-      const maxTimer = setTimeout(() => void finalizeEntry(entry, "max_duration"), (input.maxDurationSeconds ?? 600) * 1e3 + 250);
+      const maxTimer = setTimeout(() => void finalizeEntry(entry, "max_duration"), Math.max(0, Date.parse(status.stopsAt) - Date.now()) + 250);
       maxTimer.unref();
       await persistState();
       return json2(response, 201, session.status());
@@ -15942,14 +16547,21 @@ async function finalizeEntry(entry, reason) {
   await persistState();
 }
 function serializeEntry(entry) {
-  return { ...entry.base, status: entry.state, result: entry.result, error: entry.error };
+  return {
+    ...entry.base,
+    ...entry.session?.status(),
+    status: entry.state,
+    ...entry.state !== "recording" ? { remainingSeconds: 0, ...entry.result ? { elapsedSeconds: entry.result.durationSeconds } : {} } : {},
+    result: entry.result,
+    error: entry.error
+  };
 }
 async function restoreRecoverableSessions() {
   try {
-    const value = JSON.parse(await readFile5(daemonStatePath(), "utf8"));
+    const value = JSON.parse(await readFile7(daemonStatePath(), "utf8"));
     for (const [id, entry] of Object.entries(value)) {
       if (entry.status !== "ready" && entry.status !== "failed") continue;
-      sessions.set(id, { base: { recordingId: entry.recordingId, cdpUrl: entry.cdpUrl, startedAt: entry.startedAt }, state: entry.status, result: entry.result, error: entry.error });
+      sessions.set(id, { base: { recordingId: entry.recordingId, cdpUrl: entry.cdpUrl, tabId: entry.tabId, startedAt: entry.startedAt }, state: entry.status, result: entry.result, error: entry.error });
     }
   } catch {
   }
@@ -15957,9 +16569,9 @@ async function restoreRecoverableSessions() {
 async function persistState() {
   const state = Object.fromEntries([...sessions.entries()].map(([id, entry]) => [id, serializeEntry(entry)]));
   const temporary = daemonStatePath() + "." + crypto.randomUUID() + ".tmp";
-  await writeFile4(temporary, `${JSON.stringify(state, null, 2)}
+  await writeFile6(temporary, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
-  await rename(temporary, daemonStatePath());
+  await rename2(temporary, daemonStatePath());
 }
 async function readJson(request3) {
   const chunks = [];
@@ -15980,7 +16592,7 @@ async function purgeExpiredCaptures() {
   const removed = await purgeExpiredRemoteCaptures(recordingTempRoot());
   for (const id of removed) sessions.delete(id);
   let changed = removed.length > 0;
-  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat3(entry.result.frameDirectory).catch(() => null)) {
+  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat4(entry.result.frameDirectory).catch(() => null)) {
     sessions.delete(id);
     changed = true;
   }
@@ -16025,7 +16637,7 @@ function emit(value, pretty = false) {
 function failureValue(error51) {
   const message = error51 instanceof Error ? error51.message : String(error51);
   const [candidate] = message.split(":", 1);
-  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "authorization_not_found", "expired_token", "access_denied", "unsupported_platform", "scope_denied", "quota_exceeded", "browser_unavailable", "recording_not_found", "upload_interrupted", "processing_pending", "processing_failed", "share_revoked", "validation_failed"]);
+  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "authorization_not_found", "expired_token", "access_denied", "unsupported_platform", "scope_denied", "quota_exceeded", "browser_unavailable", "local_capture_failed", "recording_not_found", "upload_interrupted", "processing_pending", "processing_failed", "share_revoked", "validation_failed"]);
   const structured = error51 && typeof error51 === "object" ? error51 : {};
   const code = structured.code && knownCodes.has(structured.code) ? structured.code : knownCodes.has(candidate) ? candidate : "internal_error";
   return { error: { code, message, ...structured.recovery ? { recovery: structured.recovery } : {}, ...structured.details ? { details: structured.details } : {} } };
@@ -16092,7 +16704,7 @@ async function withRunFeedback(session, start) {
 }
 
 // src/doctor.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn7 } from "child_process";
 
 // src/version.ts
 import { createRequire } from "module";
@@ -16153,7 +16765,7 @@ async function runDoctor(apiUrl, overrides = {}) {
       credentialError = error51;
     }
     if (credentialError) {
-      checks.push({ name: "authentication", status: "fail", message: errorMessage(credentialError), recovery: "Unlock the OS credential store, or use RILL_TOKEN. Windows local recording remains unsupported." });
+      checks.push({ name: "authentication", status: "fail", message: errorMessage(credentialError), recovery: "Unlock the OS credential store, or use RILL_TOKEN. On Windows, use the same Windows account that saved the credential." });
     } else if (!token) {
       checks.push({ name: "authentication", status: health.anonymousAccess ? "warn" : "fail", message: health.anonymousAccess ? "The first recording will create an anonymous identity in your OS credential store. Anonymous recordings expire after seven days." : "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
     } else {
@@ -16168,7 +16780,7 @@ async function runDoctor(apiUrl, overrides = {}) {
   }
   checks.push(await executableCheck("chrome", dependencies.chromePath, ["--version"], dependencies.commandVersion, "Install Google Chrome or Chromium, or set RILL_CHROME_PATH to its executable."));
   if (dependencies.encoding === "local") {
-    checks.push(await executableCheck("ffmpeg", dependencies.ffmpegPath, ["-version"], dependencies.commandVersion, process.platform === "darwin" ? "Install ffmpeg with `brew install ffmpeg`, or set RILL_FFMPEG." : "Install ffmpeg using the system package manager, or set RILL_FFMPEG."));
+    checks.push(await executableCheck("ffmpeg", dependencies.ffmpegPath, ["-version"], dependencies.commandVersion, dependencies.platform === "darwin" ? "Install ffmpeg with `brew install ffmpeg`, or set RILL_FFMPEG." : "Install ffmpeg using the system package manager, or set RILL_FFMPEG."));
   } else {
     checks.push({ name: "ffmpeg", status: "skip", message: "Remote encoding does not require local FFmpeg." });
     try {
@@ -16176,7 +16788,7 @@ async function runDoctor(apiUrl, overrides = {}) {
       if (!(token ? (await dependencies.encodingCapabilities(apiUrl, token)).enabled : health?.anonymousAccess && health.anonymousRemoteEncoding)) throw new Error("Remote encoding is not enabled for this workspace.");
       checks.push({ name: "encoding", status: "pass", message: token ? "Remote encoding is enabled." : "Remote encoding is available for the first anonymous recording." });
     } catch (error51) {
-      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Remote encoding must be enabled on the server before using the default recording workflow." });
+      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Run doctor --encoding local to check local FFmpeg, then record start --encoding local, or ask the workspace owner to enable remote encoding." });
     }
   }
   return { schemaVersion: 1, status: checks.some((check2) => check2.status === "fail") ? "error" : "ok", apiUrl, checks, ...runFeedbackFields(feedbackEnabled) };
@@ -16191,7 +16803,7 @@ async function executableCheck(name, path, args, run2, recovery) {
 }
 function commandVersion(command, args) {
   return new Promise((resolve, reject) => {
-    const child = spawn5(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn7(command, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const stdout = [];
     const stderr = [];
     const timeout = setTimeout(() => {
@@ -16252,16 +16864,24 @@ function formatCloudRun(run2) {
 }
 
 // src/recording-lifecycle.ts
-async function startRecordingWithCompensation(remote, dependencies) {
+async function startRecordingWithCompensation(remote, dependencies, apiUrl = "https://userill.dev") {
   try {
     return await dependencies.startLocal();
   } catch (startupError) {
     try {
       await dependencies.cancelRemote(remote.recordingId, "local_start_failed");
     } catch (cleanupError) {
-      throw new AggregateError(
-        [startupError, cleanupError],
-        "Local recording startup failed and the remote reservation could not be cancelled. Run `rill record cancel <recording-id>`."
+      const nextCommand = cliCommand(apiUrl, "record", "cancel", remote.recordingId);
+      throw Object.assign(
+        new AggregateError(
+          [startupError, cleanupError],
+          "browser_unavailable: Local startup failed and its remote reservation could not be cancelled."
+        ),
+        {
+          code: "browser_unavailable",
+          recovery: `Run ${nextCommand} to release this failed startup reservation.`,
+          details: { recordingId: remote.recordingId, nextCommand }
+        }
       );
     }
     throw startupError;
@@ -16279,11 +16899,62 @@ async function remoteAwareRecordingStatus(recordingId, dependencies, apiUrl = "h
   try {
     const local = await dependencies.localStatus(recordingId);
     const status = local.status === "ready" ? "captured" : local.status;
-    return { ...local, status, source: "local", ...recordingNextStep(apiUrl, recordingId, String(status)) };
+    return {
+      ...local,
+      status,
+      source: "local",
+      ...recordingNextStep(apiUrl, recordingId, String(status)),
+      ...status === "failed" ? {
+        nextCommand: cliCommand(apiUrl, "record", "cancel", recordingId),
+        message: "Local capture failed; the remote reservation may still hold a slot. Preserve any local draft you need, then cancel this failed attempt to release its slot. Cancellation does not delete local drafts."
+      } : {}
+    };
   } catch {
     return remoteView;
   }
 }
+async function releaseFailedLocalCapture(id, dependencies) {
+  const local = await dependencies.localStatus(id).catch(() => null);
+  if (!local || local.recordingId !== id || local.status !== "failed" || local.result) return false;
+  try {
+    await dependencies.failRemote(id);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createRecordingWithRecovery(dependencies) {
+  try {
+    return await dependencies.createRemote();
+  } catch (error51) {
+    if (!(error51 instanceof ControlPlaneError) || error51.code !== "quota_exceeded") throw error51;
+    const quota = error51.details?.quota;
+    if (!quota || !["credential_concurrency", "workspace_concurrency"].includes(String(quota.type)) || typeof quota.blockingRecordingId !== "string" || !/^rec_[a-zA-Z0-9_-]+$/.test(quota.blockingRecordingId)) throw error51;
+    if (!await releaseFailedLocalCapture(quota.blockingRecordingId, dependencies)) throw error51;
+    dependencies.onRecovered?.(quota.blockingRecordingId);
+    return dependencies.createRemote();
+  }
+}
+async function stopRecordingWithCompensation(id, dependencies, apiUrl) {
+  let local;
+  try {
+    local = await dependencies.stopLocal(id);
+  } catch (error51) {
+    const known = await dependencies.localStatus(id).catch(() => null);
+    if (!known || known.recordingId !== id || known.status !== "failed" || known.result) throw error51;
+    local = known;
+  }
+  if (local.recordingId === id && local.status === "failed" && !local.result) {
+    const released = await releaseFailedLocalCapture(id, dependencies);
+    throw new ControlPlaneError(
+      "local_capture_failed",
+      local.error ?? "The local capture could not be finalized.",
+      released ? "Its unused recording slot was released. Start a new recording." : `The recording slot could not be released automatically. Check ${cliCommand(apiUrl, "record", "status", id)} before cancelling it.`,
+      { recordingId: id, reservationReleased: released }
+    );
+  }
+  return local;
+}
 
 // src/config.ts
 var PRODUCTION_API_URL = "https://userill.dev";
@@ -16295,10 +16966,10 @@ function controlPlaneUrl(environmentUrl) {
 async function removeLocalCapture(id) {
   await ensureDaemon(process.argv[1]);
   const local = await recordingStatus(id).catch(() => null);
-  if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (local?.result?.frameDirectory) await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
 }
 function watchEncoding(apiUrl, id) {
-  const child = spawn6(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env } });
+  const child = spawn8(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env }, windowsHide: true });
   child.on("error", () => void 0);
   child.unref();
 }
@@ -16320,7 +16991,7 @@ async function authorize(quiet = false) {
   process.stderr.write(`Open ${authorization.verificationUri} and enter ${authorization.userCode}
 `);
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
-  const child = spawn6(opener, [authorization.verificationUri], { stdio: "ignore", detached: true });
+  const child = spawn8(opener, [authorization.verificationUri], { stdio: "ignore", detached: true });
   child.on("error", () => void 0);
   child.unref();
   const deadline = Date.now() + authorization.expiresIn * 1e3;
@@ -16387,9 +17058,14 @@ for (const action of ["status", "cancel"]) cloudRun.command(action).argument("<r
   if (options.json || options.pretty) emit(customerRun(run2), options.pretty);
   else process.stdout.write(formatCloudRun(run2));
 });
-record2.command("start").option("--encoding <mode>", "remote or local", "remote").option("--url <url>").option("--title <title>").option("--description <description>", "").option("--headed").option("--cdp-url <url>").option("--width <pixels>", "", "1280").option("--height <pixels>", "", "720").option("--max-duration <seconds>", "", "600").action(async (commandOptions) => {
+record2.command("tabs").requiredOption("--cdp-url <url>", "Existing Chromium CDP endpoint").action(async (commandOptions) => {
+  const options = program.opts();
+  emit({ schemaVersion: 1, tabs: await listBrowserTabs(commandOptions.cdpUrl) }, options.pretty);
+});
+record2.command("start").option("--encoding <mode>", "remote or local", "remote").option("--url <url>").option("--title <title>").option("--description <description>", "").option("--headed").option("--cdp-url <url>").option("--tab-id <id>", "Record this existing tab from record tabs").option("--width <pixels>", "", "1280").option("--height <pixels>", "", "720").option("--max-duration <seconds>", "", "600").action(async (commandOptions) => {
   const options = program.opts();
   assertRecorderTransport();
+  validateTabSelection(commandOptions);
   await ensureAnonymousCredential(options.apiUrl);
   const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await withRunFeedback(() => client.agentSession(), async (rememberRecording) => {
@@ -16398,15 +17074,24 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
     if (!Number.isFinite(Number(commandOptions.maxDuration)) || Number(commandOptions.maxDuration) < 1 || Number(commandOptions.maxDuration) > 600) throw new Error("Recording duration must be between 1 and 600 seconds.");
     const width = Number(commandOptions.width);
     const height = Number(commandOptions.height);
-    const remote = await client.createRecording({ title: commandOptions.title ?? `Browser recording \xB7 ${(/* @__PURE__ */ new Date()).toISOString()}`, description: commandOptions.description, sourceUrl: commandOptions.url ?? null, width, height });
+    const metadata = { requestId: crypto.randomUUID(), title: commandOptions.title ?? `Browser recording \xB7 ${(/* @__PURE__ */ new Date()).toISOString()}`, description: commandOptions.description, sourceUrl: commandOptions.url ?? null, width, height };
+    const remote = await createRecordingWithRecovery({
+      createRemote: () => client.createRecording(metadata),
+      localStatus: recordingStatus,
+      failRemote: (id) => client.failLocalCapture(id),
+      onRecovered: (id) => {
+        process.stderr.write(`Released the unused slot for failed local capture ${id}.
+`);
+      }
+    });
     rememberRecording(remote.recordingId);
     const local = await startRecordingWithCompensation(remote, {
       startLocal: async () => {
-        await ensureDaemon(process.argv[1]);
-        return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
+        await ensureDaemon(process.argv[1], Boolean(commandOptions.cdpUrl));
+        return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, tabId: commandOptions.tabId, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
       },
       cancelRemote: (recordingId, reason) => client.cancelRecording(recordingId, reason)
-    });
+    }, options.apiUrl);
     await client.markRecordingStarted(remote.recordingId, {
       cliVersion: CLI_VERSION,
       os: process.platform,
@@ -16414,16 +17099,20 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
       headed: Boolean(commandOptions.headed),
       attached: Boolean(commandOptions.cdpUrl)
     }).catch(() => void 0);
-    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, browserAttachment: browserAttachment(local.cdpUrl), bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
+    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, ...local.tabId ? { tabId: local.tabId } : {}, browserAttachment: browserAttachment(local.cdpUrl, local.tabId), startedAt: local.startedAt, stopsAt: local.stopsAt, elapsedSeconds: local.elapsedSeconds, remainingSeconds: local.remainingSeconds, bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
   });
   emit(result, options.pretty);
 });
 record2.command("stop").argument("<recording-id>").option("--no-wait").option("--no-feedback", "Disable feedback only when the user explicitly requests it").action(async (recordingId, commandOptions) => {
   const options = program.opts();
   await ensureDaemon(process.argv[1]);
-  const local = await stopRecording(recordingId);
-  if (!local.result) throw new Error(local.error ?? "The recorder did not produce an artifact.");
   const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  const local = await stopRecordingWithCompensation(recordingId, {
+    stopLocal: stopRecording,
+    localStatus: recordingStatus,
+    failRemote: (id) => client.failLocalCapture(id)
+  }, options.apiUrl);
+  if (!local.result) throw new Error(local.error ?? "The recorder did not produce an artifact.");
   const stopped = await client.markRecordingStopped(recordingId, {
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
@@ -16435,11 +17124,11 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     const accepted = await submitFrameCapture(client, recordingId, local.result.frameDirectory);
     const result2 = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
     emit({ schemaVersion: 1, ...result2, ...recordingNextStep(options.apiUrl, recordingId, result2.status, { resumableFrames: true }), ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
-    if (result2.status === "ready") await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+    if (result2.status === "ready") await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
     else watchEncoding(options.apiUrl, recordingId);
     return;
   }
-  const video = await stat4(local.result.videoPath);
+  const video = await stat5(local.result.videoPath);
   const provisioned = await client.provisionVideo(recordingId, { sizeBytes: video.size, filename: basename(local.result.videoPath), uploadKind: "recorded_browser" });
   await Promise.all([client.uploadVideo(provisioned.uploadUrl, local.result.videoPath), client.uploadDiagnostics(recordingId, local.result.diagnosticsPath, local.result.diagnostics)]);
   const remote = commandOptions.wait === false || record2.opts().wait === false ? null : await client.waitUntilPlayable(recordingId);
@@ -16457,7 +17146,7 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false)
   };
   emit(result, options.pretty);
-  if (remote) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (remote) await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
 });
 record2.command("retry").argument("<recording-id>").option("--no-wait").action(async (recordingId, commandOptions) => {
   const options = program.opts();
@@ -16489,7 +17178,7 @@ program.command("encoding-watch", { hidden: true }).argument("<recording-id>").a
   if (result.status === "ready") {
     await ensureDaemon(process.argv[1]);
     const local = await recordingStatus(id).catch(() => null);
-    if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+    if (local?.result?.frameDirectory) await rm7(dirname2(local.result.videoPath), { recursive: true, force: true });
   }
 });
 var feedback = program.command("feedback").description("Submit a short Rill product review for a recorded run.");
@@ -16544,7 +17233,7 @@ program.command("upload").argument("<video-file>").option("--title <title>").opt
   const options = program.opts();
   await ensureAnonymousCredential(options.apiUrl);
   const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
-  const file2 = await stat4(videoFile);
+  const file2 = await stat5(videoFile);
   const recording = await client.createRecording({ title: commandOptions.title ?? basename(videoFile), sourceUrl: null });
   const upload = await client.provisionVideo(recording.recordingId, { sizeBytes: file2.size, filename: basename(videoFile), uploadKind: "existing_video" });
   await client.uploadVideo(upload.uploadUrl, videoFile);
@@ -16573,20 +17262,20 @@ comments.command("edit").argument("<share-url>").requiredOption("--comment <id>"
 var drafts = program.command("drafts");
 drafts.command("list").action(async () => {
   const options = program.opts();
-  const root = process.env.RILL_TEMP ?? `${process.env.TMPDIR ?? "/tmp"}/rill-recordings`;
+  const root = process.env.RILL_TEMP ?? join11(tmpdir3(), "rill-recordings");
   const names = await readdir2(root).catch(() => []);
   emit({ schemaVersion: 1, drafts: names }, options.pretty);
 });
 drafts.command("purge").action(async () => {
   const options = program.opts();
-  const root = process.env.RILL_TEMP ?? `${process.env.TMPDIR ?? "/tmp"}/rill-recordings`;
+  const root = process.env.RILL_TEMP ?? join11(tmpdir3(), "rill-recordings");
   const names = await readdir2(root).catch(() => []);
   let purged = 0;
   for (const name of names) {
-    const path = `${root}/${name}`;
-    const metadata = await stat4(path);
+    const path = join11(root, name);
+    const metadata = await stat5(path);
     if (Date.now() - metadata.mtimeMs > 24 * 60 * 60 * 1e3) {
-      await rm5(path, { recursive: true, force: true });
+      await rm7(path, { recursive: true, force: true });
       purged += 1;
     }
   }