@runalabs/rill-cli 0.1.16 → 0.1.17

package/README.md

@@ -370,6 +370,8 @@ Progress runs through `uploading` → `queued` → `encoding` → `processing`
 
 Run `rill connect --email you@example.com` to authorize account access or keep your anonymous recordings. Open the displayed link, sign in, and enter the code yourself. Approval allows creation and reading of your existing and new recordings for 90 days, with automatic renewal of one-hour access tokens. Revoke the connection in Settings → Agent access to stop access and renewal. Deletion and changes to existing sharing settings are not included.
 
+Browser approval does not finish the handshake: the CLI must collect and save credentials. With `--no-wait`, keep polling the returned `connect status <authorizationId>` command until `authenticated`. Starting with 0.1.17, the CLI checks the server even after its local approval deadline. Approval codes expire after ten minutes; successful approval starts a separate 30-minute collection window, with a 60-second lost-response retry window after first collection. If collection expires, run `connect --email` again with the same account to request fresh human approval while preserving the registration and recordings. Do not delete saved credentials to recover. Auth requests include the CLI version for consent-aware diagnostics.
+
 Use `rill record list` to list accessible recordings and `rill inspect <recording-id>` for private recording details. `rill inspect <share-url>` continues to work without account access. The existing `rill login` and `RILL_TOKEN` flows remain supported. Local credential storage requires macOS Keychain, Linux Secret Service, or Windows current-user DPAPI.
 
 ### Check the connected account

package/dist/cli.js

@@ -127,6 +127,11 @@ function browserAttachment(cdpUrl, tabId) {
   };
 }
 
+// src/version.ts
+import { createRequire } from "module";
+var packageJson = createRequire(import.meta.url)("../package.json");
+var CLI_VERSION = packageJson.version;
+
 // src/agent-session.ts
 var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
@@ -150,7 +155,7 @@ async function request(apiUrl, path, body, form = false) {
     method: "POST",
     redirect: "error",
     signal: AbortSignal.timeout(15e3),
-    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
+    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json", "X-Rill-CLI-Version": CLI_VERSION },
     body: form ? new URLSearchParams(Object.entries(body).map(([key2, value2]) => [key2, String(value2)])) : JSON.stringify(body)
   });
   const value = await response.json();
@@ -246,6 +251,12 @@ async function connectAgent(apiUrl, email3, options = {}) {
 async function beginConnection(apiUrl, email3) {
   if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
   let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  if (saved?.connection?.status === "pending" && saved.connection.expiresAt <= Date.now()) {
+    if (saved.connection.email !== email3) throw new Error("Use the original account to finish or recover this connection.");
+    const result = await pollSavedConnection(apiUrl, saved.connection.id);
+    if (result.status !== "expired") return result;
+    saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  }
   if (saved?.connection?.status === "pending" && saved.connection.expiresAt > Date.now()) {
     if (saved.connection.email !== email3) throw new Error("A connection for another email is pending. Let it expire before starting a different connection.");
     process.stderr.write(`Open ${saved.connection.verificationUri}
@@ -259,6 +270,22 @@ Sign in as ${email3} and enter ${saved.connection.userCode}. Approve only the re
       const result = await request(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
       claim = result.claim_attempt;
     } catch (error51) {
+      if (error51 instanceof AgentAuthError && error51.code === "claim_already_approved") {
+        saved.connection ??= {
+          id: randomBytes(16).toString("hex"),
+          email: email3,
+          verificationUri: "",
+          userCode: "",
+          expiresAt: Date.now(),
+          interval: 5,
+          nextPollAt: 0,
+          status: "pending"
+        };
+        saved.connection.status = "pending";
+        saved.connection.nextPollAt = 0;
+        await save(apiUrl, saved);
+        return pollSavedConnection(apiUrl, saved.connection.id);
+      }
       if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
     }
   }
@@ -309,11 +336,6 @@ async function pollSavedConnection(apiUrl, authorizationId) {
   if (!saved?.connection || saved.connection.id !== authorizationId) throw new AgentAuthError("authorization_not_found", "No matching saved connection for this API URL. Use the latest connect response.");
   const connection = saved.connection;
   if (connection.status !== "pending") return connectionView(apiUrl, saved);
-  if (Date.now() >= connection.expiresAt) {
-    connection.status = "expired";
-    await save(apiUrl, saved);
-    return connectionView(apiUrl, saved);
-  }
   if (Date.now() < connection.nextPollAt) return connectionView(apiUrl, saved);
   connection.nextPollAt = Date.now() + connection.interval * 1e3;
   await save(apiUrl, saved);
@@ -322,7 +344,7 @@ async function pollSavedConnection(apiUrl, authorizationId) {
     saved = withTokens({ version: 1, anonymous: false, connection: { ...connection, status: "authenticated", userCode: "" } }, tokens);
   } catch (error51) {
     if (!(error51 instanceof AgentAuthError)) throw error51;
-    if (error51.code === "expired_token" || error51.code === "claim_expired") connection.status = "expired";
+    if (error51.code === "expired_token" || error51.code === "claim_expired" || error51.code === "claim_delivery_expired" || error51.code === "claimed_or_in_flight" && Date.now() >= connection.expiresAt) connection.status = "expired";
     else if (error51.code === "access_denied" || error51.code === "claim_revoked") connection.status = "denied";
     else if (error51.code === "slow_down") {
       connection.interval += 5;
@@ -16771,13 +16793,6 @@ async function withRunFeedback(session, start) {
 
 // src/doctor.ts
 import { spawn as spawn7 } from "child_process";
-
-// src/version.ts
-import { createRequire } from "module";
-var packageJson = createRequire(import.meta.url)("../package.json");
-var CLI_VERSION = packageJson.version;
-
-// src/doctor.ts
 var defaultDependencies = {
   platform: process.platform,
   encoding: "remote",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runalabs/rill-cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Record, inspect, and share agent-controlled browser runs with Rill.",
   "license": "Apache-2.0",
   "repository": {