@runalabs/rill-cli 0.1.18 → 0.1.20

package/README.md

@@ -1,5 +1,24 @@
 # @runalabs/rill-cli
 
+## Runtime security requirement
+
+Use Node.js **24.22.1 LTS or newer on a patched release line**. The minimum
+supported versions are **22.23.4**, **24.22.1**, and **26.12.1**; Node 23, Node 25,
+and prerelease builds are not supported. These releases address the October 2026
+[eMudhra certificate compromise](https://emudhra.we-have-a-problem.com/).
+
+Rill 0.1.20 checks Node before command actions, authentication, or telemetry.
+An unsupported runtime receives `unsupported_node_version` and an upgrade step.
+`rill doctor` reports that failure without contacting the API or reading saved
+credentials. `rill --help` and `rill --version` remain available.
+
+The CLI uses your installed Node and Chrome/Chromium. Updating Rill alone does
+not replace their certificate stores. Keep Chrome/Chromium updated, and restart
+long-running recorder processes after saving active recordings when updating
+their runtimes. Doctor's browser version check confirms availability, not that
+every certificate revocation is enforced. Rill does not disable TLS validation
+or accept a custom CA workaround in place of the patched Node requirement.
+
 Record a browser flow, keep its video and runtime evidence together, and return an inspectable share link. Use Rill to reproduce a bug, verify a change, or hand a browser run to another developer or agent.
 
 Rill starts a local Chromium recorder. Your browser tool drives the returned CDP endpoint; Rill captures the selected page and uploads the result when you stop.
@@ -8,7 +27,7 @@ Rill starts a local Chromium recorder. Your browser tool drives the returned CDP
 
 ## Cloud agent runs
 
-Invited workspaces can supply a URL and prompt. Cloud runs need Node.js 22+ and a Rill login; Chrome and ffmpeg run on Rill's server.
+Invited workspaces can supply a URL and prompt. Cloud runs need a patched Node.js version listed above and a Rill login; Chrome and ffmpeg run on Rill's server.
 
 ```sh
 rill record https://example.com -p "Open pricing and describe the plans."
@@ -29,7 +48,7 @@ Check `node --version`, `node -p "process.platform"`, and `rill --version` befor
 
 If the CLI is missing, check npm with `npm ping --fetch-timeout=5000 --fetch-retries=0` before installation. See the [canonical skill](https://userill.dev/skill.md) for the bounded Rill connectivity check and Windows Terminal fallback. Report blocked network access instead of repeating installation attempts.
 
-Browser recording runs on macOS, Linux, and Windows. Install Node.js 22+ and Google Chrome or Chromium. Rill encodes recordings remotely by default; local FFmpeg is optional. Chrome stays on your machine and can access localhost. Raw frames upload after recording stops.
+Browser recording runs on macOS, Linux, and Windows. Install a patched Node.js version listed above and up-to-date Google Chrome or Chromium. Rill encodes recordings remotely by default; local FFmpeg is optional. Chrome stays on your machine and can access localhost. Raw frames upload after recording stops.
 
 Then install the scoped package:
 

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
-var __export = (target, all) => {
+var __export = (target2, all) => {
   for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+    __defProp(target2, name, { get: all[name], enumerable: true });
 };
 
 // src/windows-credentials.ts
@@ -1390,8 +1390,8 @@ function defineLazy(object2, key2, getter) {
 function objectClone(obj) {
   return Object.create(Object.getPrototypeOf(obj), Object.getOwnPropertyDescriptors(obj));
 }
-function assignProp(target, prop, value) {
-  Object.defineProperty(target, prop, {
+function assignProp(target2, prop, value) {
+  Object.defineProperty(target2, prop, {
     value,
     writable: true,
     enumerable: true,
@@ -1574,35 +1574,35 @@ function normalizeParams(_params) {
   return params;
 }
 function createTransparentProxy(getter) {
-  let target;
+  let target2;
   return new Proxy({}, {
     get(_, prop, receiver) {
-      target ?? (target = getter());
-      return Reflect.get(target, prop, receiver);
+      target2 ?? (target2 = getter());
+      return Reflect.get(target2, prop, receiver);
     },
     set(_, prop, value, receiver) {
-      target ?? (target = getter());
-      return Reflect.set(target, prop, value, receiver);
+      target2 ?? (target2 = getter());
+      return Reflect.set(target2, prop, value, receiver);
     },
     has(_, prop) {
-      target ?? (target = getter());
-      return Reflect.has(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.has(target2, prop);
     },
     deleteProperty(_, prop) {
-      target ?? (target = getter());
-      return Reflect.deleteProperty(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.deleteProperty(target2, prop);
     },
     ownKeys(_) {
-      target ?? (target = getter());
-      return Reflect.ownKeys(target);
+      target2 ?? (target2 = getter());
+      return Reflect.ownKeys(target2);
     },
     getOwnPropertyDescriptor(_, prop) {
-      target ?? (target = getter());
-      return Reflect.getOwnPropertyDescriptor(target, prop);
+      target2 ?? (target2 = getter());
+      return Reflect.getOwnPropertyDescriptor(target2, prop);
     },
     defineProperty(_, prop, descriptor) {
-      target ?? (target = getter());
-      return Reflect.defineProperty(target, prop, descriptor);
+      target2 ?? (target2 = getter());
+      return Reflect.defineProperty(target2, prop, descriptor);
     }
   });
 }
@@ -2237,10 +2237,10 @@ var nanoid = /^[a-zA-Z0-9_-]{21}$/;
 var duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
 var extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
 var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-var uuid = (version2) => {
-  if (!version2)
+var uuid = (version3) => {
+  if (!version3)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
 var uuid4 = /* @__PURE__ */ uuid(4);
 var uuid6 = /* @__PURE__ */ uuid(6);
@@ -11701,10 +11701,10 @@ function _slugify() {
   return /* @__PURE__ */ _overwrite((input) => slugify(input));
 }
 // @__NO_SIDE_EFFECTS__
-function _array(Class2, element, params) {
+function _array(Class2, element2, params) {
   return new Class2({
     type: "array",
-    element,
+    element: element2,
     // get element() {
     //   return element;
     // },
@@ -12054,15 +12054,15 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
 
 // ../../node_modules/zod/v4/core/to-json-schema.js
 function initializeContext(params) {
-  let target = params?.target ?? "draft-2020-12";
-  if (target === "draft-4")
-    target = "draft-04";
-  if (target === "draft-7")
-    target = "draft-07";
+  let target2 = params?.target ?? "draft-2020-12";
+  if (target2 === "draft-4")
+    target2 = "draft-04";
+  if (target2 === "draft-7")
+    target2 = "draft-07";
   return {
     processors: params.processors ?? {},
     metadataRegistry: params?.metadata ?? globalRegistry,
-    target,
+    target: target2,
     unrepresentable: params?.unrepresentable ?? "throw",
     override: params?.override ?? (() => {
     }),
@@ -12404,8 +12404,8 @@ var createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
   return finalize(ctx, schema);
 };
 var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
-  const { libraryOptions, target } = params ?? {};
-  const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
+  const { libraryOptions, target: target2 } = params ?? {};
+  const ctx = initializeContext({ ...libraryOptions ?? {}, target: target2, io, processors });
   process2(schema, ctx);
   extractDefs(ctx, schema);
   return finalize(ctx, schema);
@@ -13464,8 +13464,8 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     catch(params) {
       return _catch2(this, params);
     },
-    pipe(target) {
-      return pipe(this, target);
+    pipe(target2) {
+      return pipe(this, target2);
     },
     readonly() {
       return readonly(this);
@@ -13986,8 +13986,8 @@ var ZodArray = /* @__PURE__ */ $constructor("ZodArray", (inst, def) => {
     }
   });
 });
-function array(element, params) {
-  return _array(ZodArray, element, params);
+function array(element2, params) {
+  return _array(ZodArray, element2, params);
 }
 function keyof(schema) {
   const shape = schema._zod.def.shape;
@@ -15024,8 +15024,8 @@ function convertBaseSchema(schema, ctx) {
           zodSchema = zodSchema.check(z.maxLength(schema.maxItems));
         }
       } else if (items !== void 0) {
-        const element = convertSchema(items, ctx);
-        let arraySchema = z.array(element);
+        const element2 = convertSchema(items, ctx);
+        let arraySchema = z.array(element2);
         if (typeof schema.minItems === "number") {
           arraySchema = arraySchema.min(schema.minItems);
         }
@@ -15116,10 +15116,10 @@ function fromJSONSchema(schema, params) {
   } catch {
     throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
   }
-  const version2 = detectVersion(normalized, params?.defaultTarget);
+  const version3 = detectVersion(normalized, params?.defaultTarget);
   const defs = normalized.$defs || normalized.definitions || {};
   const ctx = {
-    version: version2,
+    version: version3,
     defs,
     refs: /* @__PURE__ */ new Map(),
     processing: /* @__PURE__ */ new Set(),
@@ -15354,10 +15354,10 @@ async function windowsIpcIdentity(directory = join5(rillDirectory(), "windows-ip
   } catch (e) {
     if (e.code !== "ENOENT") throw new Error("Cannot read the protected recorder identity.");
   }
-  const identity = { version: 1, pipe: "\\\\.\\pipe\\rill-v3-" + randomBytes2(32).toString("hex"), token: randomBytes2(32).toString("hex") };
+  const identity2 = { version: 1, pipe: "\\\\.\\pipe\\rill-v3-" + randomBytes2(32).toString("hex"), token: randomBytes2(32).toString("hex") };
   const temporary = join5(directory, randomBytes2(16).toString("hex") + ".tmp");
   try {
-    await writeFile2(temporary, JSON.stringify(identity), { mode: 384, flag: "wx" });
+    await writeFile2(temporary, JSON.stringify(identity2), { mode: 384, flag: "wx" });
     try {
       await link(temporary, path);
     } catch (e) {
@@ -15428,16 +15428,16 @@ function validateTabSelection(options) {
 }
 async function tabs(browser) {
   const result = [];
-  for (const context of browser.contexts()) for (const page of context.pages()) {
+  for (const context2 of browser.contexts()) for (const page of context2.pages()) {
     if (page.isClosed()) continue;
-    const session = await context.newCDPSession(page).catch(() => null);
+    const session = await context2.newCDPSession(page).catch(() => null);
     if (!session) {
       if (page.isClosed()) continue;
       throw new Error("browser_unavailable: Could not inspect an open tab.");
     }
     try {
       const { targetInfo } = await session.send("Target.getTargetInfo");
-      result.push({ page, context, tab: { tabId: targetInfo.targetId, url: /^(?:https?:|about:)/i.test(page.url()) ? sanitizeUrl(page.url()) : `[${page.url().split(":", 1)[0]} URL omitted]`, title: redactText(targetInfo.title, 200) } });
+      result.push({ page, context: context2, tab: { tabId: targetInfo.targetId, url: /^(?:https?:|about:)/i.test(page.url()) ? sanitizeUrl(page.url()) : `[${page.url().split(":", 1)[0]} URL omitted]`, title: redactText(targetInfo.title, 200) } });
     } catch (error51) {
       if (!page.isClosed()) throw error51;
     } finally {
@@ -15517,13 +15517,13 @@ function recordingStatus(recordingId) {
 var windowsIdentityPromise;
 async function callDaemon(method, path, body) {
   if (process.platform === "win32" && process.env.RILL_SOCKET) throw new Error("RILL_SOCKET overrides are not supported by authenticated Windows IPC. Unset it before recording.");
-  const identity = process.platform === "win32" ? await (windowsIdentityPromise ??= windowsIpcIdentity().catch((error51) => {
+  const identity2 = process.platform === "win32" ? await (windowsIdentityPromise ??= windowsIpcIdentity().catch((error51) => {
     windowsIdentityPromise = void 0;
     throw error51;
   })) : void 0;
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
-    const outgoing = request2({ socketPath: identity?.pipe ?? daemonSocketPath(), method, path, headers: { ...payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : {}, ...identity ? { Authorization: "Bearer " + identity.token } : {} } }, (incoming) => {
+    const outgoing = request2({ socketPath: identity2?.pipe ?? daemonSocketPath(), method, path, headers: { ...payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : {}, ...identity2 ? { Authorization: "Bearer " + identity2.token } : {} } }, (incoming) => {
       const chunks = [];
       incoming.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
       incoming.on("end", () => {
@@ -15604,16 +15604,16 @@ async function captureClicks(page, session, onClick) {
   let identifier;
   session.on("Runtime.bindingCalled", receive);
   const cleanup = async () => {
-    session.off("Runtime.bindingCalled", receive);
     if (identifier) await session.send("Page.removeScriptToEvaluateOnNewDocument", { identifier }).catch(() => void 0);
     await Promise.all(page.frames().map((frame) => frame.evaluate((key2) => {
-      const target = window;
-      const listener = target[key2 + "_listener"];
+      const target2 = window;
+      const listener = target2[key2 + "_listener"];
       if (typeof listener === "function") document.removeEventListener("click", listener, { capture: true });
-      delete target[key2 + "_listener"];
-      delete target[key2];
+      delete target2[key2 + "_listener"];
+      delete target2[key2];
     }, binding).catch(() => void 0)));
     await session.send("Runtime.removeBinding", { name: binding }).catch(() => void 0);
+    session.off("Runtime.bindingCalled", receive);
   };
   try {
     await session.send("Runtime.enable");
@@ -15800,7 +15800,8 @@ var interactionReportFields = {
   cleanup: external_exports.literal("not_attempted").optional()
 };
 var cloudRunPrompt = external_exports.string().min(1).max(2e3).refine((value) => Boolean(value.trim()), "Describe what you want Rill to do.");
-var cloudSubmission = external_exports.object({ ...interactionFields, id: external_exports.string().uuid(), url: cloudRunTarget, prompt: cloudRunPrompt, expectation: external_exports.string().trim().min(1).max(1e3).optional(), account: external_exports.string().regex(/^[a-z0-9-]{1,60}$/).optional() }).strict();
+var practiceReference = external_exports.object({ missionId: external_exports.string().regex(/^[a-z]+-[a-z]+$/).max(60), version: external_exports.literal(1) }).strict();
+var cloudSubmission = external_exports.object({ ...interactionFields, id: external_exports.string().uuid(), url: cloudRunTarget, prompt: cloudRunPrompt, expectation: external_exports.string().trim().min(1).max(1e3).optional(), account: external_exports.string().regex(/^[a-z0-9-]{1,60}$/).optional(), practice: practiceReference.optional() }).strict();
 var siteAccountSchema = external_exports.object({
   name: external_exports.string().regex(/^[a-z0-9-]{1,60}$/),
   origin: publicTarget.refine((v) => new URL(v).protocol === "https:" && new URL(v).origin === v, "Use an exact HTTPS origin."),
@@ -15896,6 +15897,7 @@ var scrollCapsuleSvg = `<svg xmlns="http://www.w3.org/2000/svg" width="20.5" hei
 </svg>`;
 var scrollCapsuleStyles = `
 .scroll-indicator { position:absolute; right:12.75px; bottom:10.75px; width:20.5px; height:42.5px; opacity:0; transform:translateY(4px) scale(.92); transform-origin:center; transition:opacity 180ms ease-out,transform 180ms ease-out; filter:drop-shadow(0 1px 1.5px rgba(12,12,18,.18)) drop-shadow(0 4px 5px rgba(12,12,18,.12)); --rill-cursor-accent-light:color-mix(in srgb,var(--rill-cursor-accent) 78%,#fff); }
+.scroll-label { left:auto; right:calc(100% + 7px); top:50%; transform:translateY(-50%); }
 .scroll-indicator.is-visible { opacity:1; transform:none; transition:opacity 160ms ease-out,transform 260ms cubic-bezier(.2,.9,.3,1.25); }
 .scroll-indicator svg { position:absolute; left:50%; top:50%; width:20.5px; height:42.5px; translate:-50% -50%; transform-origin:center; }
 .scroll-indicator[data-direction="right"],.scroll-indicator[data-direction="left"] { width:42.5px; height:20.5px; }
@@ -15946,7 +15948,7 @@ function installCursorOverlay(options) {
     pointer.innerHTML = options.pointerMarkup;
     const scrollIndicator = document.createElement("div");
     scrollIndicator.className = "scroll-indicator";
-    scrollIndicator.innerHTML = options.scrollMarkup;
+    scrollIndicator.innerHTML = options.scrollMarkup + '<span class="rill-cursor-label scroll-label">Scrolling</span>';
     const chevrons = scrollIndicator.querySelector("#chevrons");
     root.append(style, pointer, scrollIndicator);
     document.documentElement.appendChild(host);
@@ -15993,11 +15995,11 @@ function installCursorOverlay(options) {
     positions.set(document, { x: window.scrollX, y: window.scrollY });
     document.addEventListener("scroll", (event) => {
       if (!event.isTrusted || document.hidden) return;
-      const target = event.target;
-      if (target !== document && !(target instanceof Element)) return;
-      const position = target === document ? { x: window.scrollX, y: window.scrollY } : { x: target.scrollLeft, y: target.scrollTop };
-      const previous = positions.get(target);
-      positions.set(target, position);
+      const target2 = event.target;
+      if (target2 !== document && !(target2 instanceof Element)) return;
+      const position = target2 === document ? { x: window.scrollX, y: window.scrollY } : { x: target2.scrollLeft, y: target2.scrollTop };
+      const previous = positions.get(target2);
+      positions.set(target2, position);
       const dx = previous ? position.x - previous.x : 0;
       const dy = previous ? position.y - previous.y : 0;
       if (previous && !dx && !dy) return;
@@ -16028,13 +16030,13 @@ function installCursorOverlay(options) {
     document.addEventListener("pointerover", move, listenerOptions);
     document.addEventListener("pointerup", release, listenerOptions);
     document.addEventListener("pointercancel", release, listenerOptions);
-    const animateFeedback = (element, frames, duration3, easing) => {
-      root.insertBefore(element, pointer);
-      const animation = element.animate(frames, { duration: duration3, easing });
+    const animateFeedback = (element2, frames, duration3, easing) => {
+      root.insertBefore(element2, pointer);
+      const animation = element2.animate(frames, { duration: duration3, easing });
       animations.add(animation);
       void animation.finished.catch(() => void 0).finally(() => {
         animations.delete(animation);
-        element.remove();
+        element2.remove();
       });
     };
     document.addEventListener("pointerdown", (event) => {
@@ -16125,8 +16127,10 @@ async function writeBundle(bundle, outputPath) {
   const output = createWriteStream(outputPath, { mode: 384 });
   const gzip = createGzip({ level: 9 });
   gzip.pipe(output);
-  const { console: consoleEvents, network, timeline, ...manifest } = bundle;
+  const { console: consoleEvents, network, timeline, actions, ...manifest } = bundle;
   gzip.write(`${JSON.stringify({ kind: "manifest", ...manifest })}
+`);
+  for (const event of actions ?? []) gzip.write(`${JSON.stringify(event)}
 `);
   for (const event of consoleEvents) gzip.write(`${JSON.stringify({ kind: "console", ...event })}
 `);
@@ -16138,6 +16142,203 @@ async function writeBundle(bundle, outputPath) {
   await once(output, "close");
 }
 
+// ../contracts/src/browser.ts
+var browserContractVersion = 1;
+var identity = external_exports.string().min(1).max(100);
+var element = external_exports.number().int().min(1).max(100);
+var version2 = { schemaVersion: external_exports.literal(browserContractVersion) };
+var target = { observationId: identity, element };
+var browserActionSchema = external_exports.enum(["observe", "click", "fill", "check", "select", "press", "navigate", "scroll", "finish"]);
+var browserCommandSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({ ...version2, action: external_exports.literal("observe") }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("click"), ...target }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("fill"), ...target, value: external_exports.string().max(2e3) }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("check"), ...target, checked: external_exports.boolean() }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("select"), ...target, value: external_exports.string().max(200) }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("press"), ...target, key: external_exports.enum(["Enter", "Tab", "ArrowDown", "ArrowUp", "Escape"]) }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("navigate"), url: external_exports.string().url().max(2048) }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("scroll"), observationId: identity, direction: external_exports.enum(["up", "down"]) }).strict(),
+  external_exports.object({ ...version2, action: external_exports.literal("finish"), outcome: external_exports.enum(["walkthrough", "passed", "failed", "inconclusive"]), summary: external_exports.string().min(1).max(1e3), evidence: external_exports.string().max(1e3) }).strict()
+]);
+var context = { recordingId: identity, pageId: identity, frameId: external_exports.literal("main"), documentId: identity };
+var browserObservationSchema = external_exports.object({
+  ...version2,
+  kind: external_exports.literal("observation"),
+  ...context,
+  observationId: identity,
+  offsetMs: external_exports.number().nonnegative(),
+  url: external_exports.string(),
+  title: external_exports.string().max(500),
+  text: external_exports.string().max(12e3),
+  viewport: external_exports.object({ width: external_exports.number().nonnegative(), height: external_exports.number().nonnegative(), scrollX: external_exports.number(), scrollY: external_exports.number(), documentHeight: external_exports.number().nonnegative(), text: external_exports.string().max(12e3), textTruncated: external_exports.boolean(), evidence: external_exports.literal("dom_geometry") }).strict(),
+  elements: external_exports.array(external_exports.object({
+    kind: external_exports.literal("dom"),
+    id: element,
+    tag: external_exports.string(),
+    label: external_exports.string().max(160),
+    type: external_exports.string().nullable(),
+    role: external_exports.string().nullable(),
+    disabled: external_exports.boolean(),
+    checked: external_exports.union([external_exports.boolean(), external_exports.string(), external_exports.null()]),
+    options: external_exports.array(external_exports.object({ value: external_exports.string().max(200), label: external_exports.string().max(100), selected: external_exports.boolean() }).strict()).max(50).optional(),
+    optionsTruncated: external_exports.boolean().optional(),
+    validation: external_exports.string().max(160).optional()
+  }).strict()).max(100),
+  completeness: external_exports.object({
+    scope: external_exports.literal("main_document"),
+    childFrames: external_exports.literal("excluded"),
+    shadowRoots: external_exports.literal("excluded"),
+    targetsTruncated: external_exports.boolean(),
+    textTruncated: external_exports.boolean(),
+    targetLimit: external_exports.literal(100),
+    textLimit: external_exports.literal(12e3)
+  }).strict(),
+  blockedRequests: external_exports.number().int().nonnegative(),
+  submissionOutcomeUnknown: external_exports.boolean()
+}).strict();
+var browserErrorSchema = external_exports.enum([
+  "invalid_browser_command",
+  "browser_busy",
+  "run_finished",
+  "stale_observation",
+  "stale_target",
+  "observation_unavailable",
+  "interaction_required",
+  "consequential_action_blocked",
+  "unsupported_control",
+  "target_not_allowed",
+  "submission_outcome_unknown",
+  "action_outcome_unknown",
+  "browser_action_unavailable",
+  "verification_requires_expectation_and_evidence"
+]);
+var browserActionReceiptSchema = external_exports.object({
+  ...version2,
+  kind: external_exports.literal("action"),
+  ...context,
+  actionId: identity,
+  action: browserActionSchema.nullable(),
+  inputObservationId: identity.nullable(),
+  target: external_exports.object({ kind: external_exports.literal("dom"), element }).strict().optional(),
+  startedAtMs: external_exports.number().nonnegative(),
+  finishedAtMs: external_exports.number().nonnegative(),
+  status: external_exports.enum(["completed", "rejected", "failed"]),
+  effectState: external_exports.enum(["none", "dispatched", "unknown"]),
+  next: external_exports.enum(["observe", "inspect_only", "finished"]),
+  errorCode: browserErrorSchema.optional(),
+  blockedRequests: external_exports.number().int().nonnegative()
+}).strict().refine((value) => value.finishedAtMs >= value.startedAtMs, "Receipt timestamps must be ordered").refine((value) => value.status !== "rejected" || value.effectState === "none", "Rejected actions cannot have effects").refine((value) => value.status === "completed" === (value.errorCode === void 0), "Errors require a non-completed status").refine((value) => value.effectState !== "unknown" || value.next === "inspect_only", "Unknown effects require inspection");
+
+// ../contracts/src/diagnostics.ts
+var diagnosticSeveritySchema = external_exports.enum(["debug", "info", "warning", "error"]);
+var consoleEventSchema = external_exports.object({
+  id: external_exports.string(),
+  offsetMs: external_exports.number().nonnegative(),
+  severity: diagnosticSeveritySchema,
+  text: external_exports.string(),
+  sourceUrl: external_exports.string().optional(),
+  lineNumber: external_exports.number().optional(),
+  stack: external_exports.array(external_exports.string()).default([])
+});
+var networkEventSchema = external_exports.object({
+  id: external_exports.string(),
+  offsetMs: external_exports.number().nonnegative(),
+  method: external_exports.string(),
+  url: external_exports.string(),
+  resourceType: external_exports.string(),
+  status: external_exports.number().int().optional(),
+  mimeType: external_exports.string().optional(),
+  durationMs: external_exports.number().nonnegative().optional(),
+  transferSize: external_exports.number().nonnegative().optional(),
+  failureReason: external_exports.string().optional(),
+  completedOffsetMs: external_exports.number().nonnegative().optional(),
+  pageUrl: external_exports.string().optional(),
+  blockedBy: external_exports.enum(["rill"]).optional(),
+  blockReason: external_exports.enum(["write_policy", "navigation_policy", "interception_error"]).optional(),
+  requestBody: external_exports.string().optional(),
+  responseBody: external_exports.string().optional(),
+  bodyOmittedReason: external_exports.string().optional()
+});
+var timelineEventSchema = external_exports.object({
+  id: external_exports.string(),
+  offsetMs: external_exports.number().nonnegative(),
+  type: external_exports.enum(["navigation", "click", "console", "network", "exception", "lifecycle"]),
+  label: external_exports.string(),
+  severity: diagnosticSeveritySchema.optional()
+});
+var browserActionEventSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  kind: external_exports.literal("browser_action"),
+  id: external_exports.string().regex(/^action_[1-9][0-9]{0,3}$/),
+  offsetMs: external_exports.number().int().min(0).max(864e5),
+  finishedAtMs: external_exports.number().int().min(0).max(864e5),
+  action: browserActionSchema.nullable(),
+  status: external_exports.enum(["completed", "rejected", "failed"]),
+  effectState: external_exports.enum(["none", "dispatched", "unknown"]),
+  next: external_exports.enum(["observe", "inspect_only", "finished"]),
+  errorCode: browserErrorSchema.optional(),
+  blockedRequests: external_exports.number().int().nonnegative()
+}).strict().refine((event) => event.finishedAtMs >= event.offsetMs, "Action timestamps must be ordered").refine((event) => event.status !== "rejected" || event.effectState === "none", "Rejected actions cannot have effects").refine((event) => event.status === "completed" === (event.errorCode === void 0), "Errors require a non-completed status").refine((event) => event.effectState !== "unknown" || event.next === "inspect_only", "Unknown effects require inspection");
+var diagnosticBundleSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  capturePolicyVersion: external_exports.string(),
+  videoStartOffsetMs: external_exports.number().optional(),
+  recordingId: external_exports.string(),
+  startedAt: external_exports.string().datetime(),
+  durationMs: external_exports.number().nonnegative(),
+  bodyCaptureEnabled: external_exports.boolean(),
+  bodyCaptureRedacted: external_exports.boolean(),
+  truncated: external_exports.boolean(),
+  actions: external_exports.array(browserActionEventSchema).max(1e3).optional(),
+  actionsTruncated: external_exports.boolean().optional(),
+  console: external_exports.array(consoleEventSchema),
+  network: external_exports.array(networkEventSchema),
+  timeline: external_exports.array(timelineEventSchema)
+});
+
+// ../recorder/src/browser-actions.ts
+var BrowserActionCapture = class {
+  constructor(recordingId) {
+    this.recordingId = recordingId;
+  }
+  recordingId;
+  events = [];
+  truncated = false;
+  seen = /* @__PURE__ */ new Set();
+  add(input) {
+    const parsed = browserActionReceiptSchema.safeParse(input);
+    if (!parsed.success || parsed.data.recordingId !== this.recordingId) {
+      this.truncated = true;
+      return;
+    }
+    const receipt = parsed.data;
+    if (this.seen.has(receipt.actionId)) return;
+    if (this.events.length >= 1e3) {
+      this.truncated = true;
+      return;
+    }
+    const event = browserActionEventSchema.safeParse({
+      schemaVersion: 1,
+      kind: "browser_action",
+      id: `action_${this.events.length + 1}`,
+      offsetMs: Math.round(receipt.startedAtMs),
+      finishedAtMs: Math.round(receipt.finishedAtMs),
+      action: receipt.action,
+      status: receipt.status,
+      effectState: receipt.effectState,
+      next: receipt.next,
+      ...receipt.errorCode ? { errorCode: receipt.errorCode } : {},
+      blockedRequests: receipt.blockedRequests
+    });
+    if (!event.success) {
+      this.truncated = true;
+      return;
+    }
+    this.seen.add(receipt.actionId);
+    this.events.push(event.data);
+  }
+};
+
 // ../recorder/src/environment.ts
 import { existsSync } from "fs";
 import { win32 as win323 } from "path";
@@ -16249,12 +16450,18 @@ var ScreencastRecorder = class {
   frames = [];
   pendingWrites = /* @__PURE__ */ new Set();
   started = false;
+  firstFrameEpochMs;
+  get videoStartedAtMs() {
+    return this.firstFrameEpochMs;
+  }
   frameCounter = 0;
   frameBytes = 0;
   captureError;
   async start() {
     await mkdir5(this.directory, { recursive: true, mode: 448 });
     this.session.on("Page.screencastFrame", (payload) => {
+      const frameEpochMs = (payload.metadata.timestamp ?? Date.now() / 1e3) * 1e3;
+      this.firstFrameEpochMs = Math.min(this.firstFrameEpochMs ?? frameEpochMs, frameEpochMs);
       const bytes = Buffer.from(payload.data, "base64");
       if (this.frameCounter >= 36e3 || this.frameBytes + bytes.length > ENCODING_MAX_BYTES || bytes.length > ENCODING_PART_BYTES) {
         this.captureError = new Error("Capture exceeds the remote encoding frame or byte limit.");
@@ -16265,7 +16472,7 @@ var ScreencastRecorder = class {
       const path = join8(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
       this.frameCounter += 1;
       const write = writeFile4(path, bytes, { mode: 384 }).then(() => {
-        this.frames.push({ path, timestamp: payload.metadata.timestamp ?? Date.now() / 1e3 });
+        this.frames.push({ path, timestamp: frameEpochMs / 1e3 });
       }).catch((error51) => {
         this.captureError = error51 instanceof Error ? error51 : new Error(String(error51));
       }).finally(() => {
@@ -16319,6 +16526,17 @@ var RecordingSession = class _RecordingSession {
   consoleEvents = [];
   networkEvents = [];
   timelineEvents = [];
+  browserActions;
+  captureBrowserAction(receipt) {
+    if (!this.diagnosticsPaused && !this.stopPromise) this.browserActions.add(receipt);
+  }
+  captureRequestBlock(request3, reason) {
+    const event = this.requestEvents.get(request3);
+    if (event) {
+      event.blockedBy = "rill";
+      event.blockReason = reason;
+    }
+  }
   requestStart = /* @__PURE__ */ new Map();
   requestEvents = /* @__PURE__ */ new Map();
   stopPromise;
@@ -16340,6 +16558,7 @@ var RecordingSession = class _RecordingSession {
     this.videoFormat = options.videoFormat ?? "webm";
     this.captureSignal = options.signal;
     this.recordingId = options.recordingId;
+    this.browserActions = new BrowserActionCapture(options.recordingId);
     this.cdpUrl = runtime.cdpUrl;
     this.tabId = runtime.tabId;
     this.browser = runtime.browser;
@@ -16409,6 +16628,10 @@ var RecordingSession = class _RecordingSession {
   }
   async finalize(reason) {
     if (this.maxTimer) clearTimeout(this.maxTimer);
+    await this.removeClickCapture?.().catch(() => {
+      this.truncated = true;
+    });
+    this.removeClickCapture = void 0;
     const durationSeconds = Math.max(0.1, (Date.now() - this.startedAt.getTime()) / 1e3);
     const outputDirectory = this.outputDirectory;
     const videoPath = join9(outputDirectory, `recording.${this.videoFormat}`);
@@ -16416,22 +16639,25 @@ var RecordingSession = class _RecordingSession {
     const bundle = {
       schemaVersion: 1,
       capturePolicyVersion: "safe-default-v1",
+      ...this.screencast.videoStartedAtMs == null ? {} : { videoStartOffsetMs: this.screencast.videoStartedAtMs - this.startedAt.getTime() },
       recordingId: this.recordingId,
       startedAt: this.startedAt.toISOString(),
       durationMs: Math.round(durationSeconds * 1e3),
       bodyCaptureEnabled: this.captureNetworkBodies,
       bodyCaptureRedacted: this.captureNetworkBodies,
-      truncated: this.truncated,
+      truncated: this.truncated || this.browserActions.truncated,
+      actionsTruncated: this.browserActions.truncated,
       console: this.consoleEvents,
       network: this.networkEvents,
       timeline: this.timelineEvents.toSorted((left, right) => left.offsetMs - right.offsetMs)
     };
     try {
       const safeBundle = JSON.parse(this.secretValues.reduce((text, secret) => text.split(JSON.stringify(secret).slice(1, -1)).join("[redacted]"), JSON.stringify(bundle)));
+      safeBundle.actions = this.browserActions.events;
+      safeBundle.actionsTruncated = this.browserActions.truncated;
       await writeBundle(safeBundle, diagnosticsPath);
       await this.screencast.stop(videoPath, durationSeconds, this.encoding === "remote", this.captureSignal);
     } finally {
-      await this.removeClickCapture?.().catch(() => void 0);
       await this.removeCursorOverlay?.().catch(() => void 0);
       await this.browser.close().catch(() => void 0);
       if (this.browserProcess) {
@@ -16442,7 +16668,7 @@ var RecordingSession = class _RecordingSession {
     const consoleErrors = this.consoleEvents.filter((event) => event.severity === "error").length;
     const failedRequests = this.networkEvents.filter((event) => event.failureReason).length;
     const httpErrors = this.networkEvents.filter((event) => (event.status ?? 0) >= 400).length;
-    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join9(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
+    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join9(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated || this.browserActions.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
   }
   captureNetworkBodies = false;
   captureSignal;
@@ -16497,7 +16723,7 @@ var RecordingSession = class _RecordingSession {
       }
       const started = offset();
       this.requestStart.set(request3, started);
-      const event = { id: `net_${this.networkEvents.length + 1}`, offsetMs: started, method: request3.method(), url: sanitizeUrl(request3.url()), resourceType: request3.resourceType() };
+      const event = { id: `net_${this.networkEvents.length + 1}`, offsetMs: started, method: request3.method(), url: sanitizeUrl(request3.url()), resourceType: request3.resourceType(), pageUrl: sanitizeUrl(this.page.url()) };
       if (captureNetworkBodies && request3.postData()) {
         const redacted = redactBody(request3.postData(), request3.headers()["content-type"]);
         event.requestBody = redacted.body;
@@ -16512,6 +16738,7 @@ var RecordingSession = class _RecordingSession {
       const event = this.requestEvents.get(request3);
       if (!event) return;
       event.failureReason = request3.failure()?.errorText ?? "request_failed";
+      event.completedOffsetMs = offset();
       event.durationMs = Math.max(0, offset() - (this.requestStart.get(request3) ?? offset()));
       pushTimeline({ offsetMs: event.offsetMs, type: "network", label: `${event.method} ${event.url} \u2192 ${event.failureReason}`, severity: "error" });
     });
@@ -16524,6 +16751,7 @@ var RecordingSession = class _RecordingSession {
     const event = this.requestEvents.get(response.request());
     if (!event) return;
     event.status = response.status();
+    event.completedOffsetMs = Math.max(0, Date.now() - this.startedAt.getTime());
     event.mimeType = response.headers()["content-type"];
     event.durationMs = Math.max(0, Date.now() - this.startedAt.getTime() - event.offsetMs);
     event.transferSize = Number(response.headers()["content-length"] ?? 0) || void 0;
@@ -16572,10 +16800,10 @@ async function launchManaged(options) {
   try {
     await waitForCdp(cdpUrl, browserProcess);
     const browser = await chromium2.connectOverCDP(cdpUrl, { artifactsDir: options.outputDirectory, isLocal: true });
-    const context = options.blockServiceWorkers ? await browser.newContext({ serviceWorkers: "block" }) : browser.contexts()[0];
-    const page = context.pages()[0] ?? await context.newPage();
+    const context2 = options.blockServiceWorkers ? await browser.newContext({ serviceWorkers: "block" }) : browser.contexts()[0];
+    const page = context2.pages()[0] ?? await context2.newPage();
     await page.setViewportSize({ width: options.width, height: options.height });
-    return { cdpUrl, browser, context, page, browserProcess, profileDirectory };
+    return { cdpUrl, browser, context: context2, page, browserProcess, profileDirectory };
   } catch (error51) {
     await terminateBrowser(browserProcess);
     await rm5(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
@@ -16622,17 +16850,17 @@ var sessions = /* @__PURE__ */ new Map();
 var lastActivity = Date.now();
 async function runDaemon() {
   if (process.platform === "win32" && process.env.RILL_SOCKET) throw new Error("RILL_SOCKET overrides are not supported by authenticated Windows IPC.");
-  const identity = process.platform === "win32" ? await windowsIpcIdentity() : void 0;
-  const socketPath = identity?.pipe ?? daemonSocketPath();
-  await mkdir7(identity ? dirname(daemonStatePath()) : dirname(socketPath), { recursive: true, mode: 448 });
+  const identity2 = process.platform === "win32" ? await windowsIpcIdentity() : void 0;
+  const socketPath = identity2?.pipe ?? daemonSocketPath();
+  await mkdir7(identity2 ? dirname(daemonStatePath()) : dirname(socketPath), { recursive: true, mode: 448 });
   await mkdir7(recordingTempRoot(), { recursive: true, mode: 448 });
   await restoreRecoverableSessions();
   await purgeExpiredCaptures();
-  if (!identity) await unlink(socketPath).catch((error51) => {
+  if (!identity2) await unlink(socketPath).catch((error51) => {
     if (error51.code !== "ENOENT") throw error51;
   });
   const server = createServer2((request3, response) => {
-    if (identity && !acceptsWindowsIpcToken(identity.token, request3.headers.authorization)) {
+    if (identity2 && !acceptsWindowsIpcToken(identity2.token, request3.headers.authorization)) {
       request3.resume();
       json2(response, 401, { error: { code: "authentication_required", message: "Recorder authentication required." } });
       return;
@@ -16642,7 +16870,7 @@ async function runDaemon() {
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(socketPath, () => {
-      if (identity) resolve();
+      if (identity2) resolve();
       else void chmod(socketPath, 384).then(resolve, reject);
     });
   });
@@ -16658,7 +16886,7 @@ async function runDaemon() {
   const close = () => {
     clearInterval(idleTimer);
     server.close();
-    if (!identity) void unlink(socketPath).catch(() => void 0);
+    if (!identity2) void unlink(socketPath).catch(() => void 0);
   };
   process.once("SIGTERM", close);
   process.once("SIGINT", close);
@@ -16802,7 +17030,7 @@ function emit(value, pretty = false) {
 function failureValue(error51) {
   const message = error51 instanceof Error ? error51.message : String(error51);
   const [candidate] = message.split(":", 1);
-  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "authorization_not_found", "expired_token", "access_denied", "unsupported_platform", "scope_denied", "quota_exceeded", "browser_unavailable", "local_capture_failed", "recording_not_found", "upload_interrupted", "processing_pending", "processing_failed", "share_revoked", "validation_failed"]);
+  const knownCodes = /* @__PURE__ */ new Set(["authentication_required", "authorization_not_found", "expired_token", "access_denied", "unsupported_platform", "unsupported_node_version", "scope_denied", "quota_exceeded", "browser_unavailable", "local_capture_failed", "recording_not_found", "upload_interrupted", "processing_pending", "processing_failed", "share_revoked", "validation_failed"]);
   const structured = error51 && typeof error51 === "object" ? error51 : {};
   const code = structured.code && knownCodes.has(structured.code) ? structured.code : knownCodes.has(candidate) ? candidate : "internal_error";
   return { error: { code, message, ...structured.recovery ? { recovery: structured.recovery } : {}, ...structured.details ? { details: structured.details } : {} } };
@@ -16816,17 +17044,17 @@ function fail(error51) {
 function terminalColor(enabled = Boolean(process.stdout.isTTY) && !("NO_COLOR" in process.env) && process.env.TERM !== "dumb") {
   return (text, code) => enabled ? `\x1B[${code}m${text}\x1B[0m` : text;
 }
-function formatIdentity(identity, color = terminalColor()) {
-  if (identity.status === "not_connected") return `${color("! Not connected to Rill", 33)}
+function formatIdentity(identity2, color = terminalColor()) {
+  if (identity2.status === "not_connected") return `${color("! Not connected to Rill", 33)}
 
-Sign in: ${cliCommand(identity.apiUrl, "login")}
+Sign in: ${cliCommand(identity2.apiUrl, "login")}
 `;
-  if (identity.status === "anonymous") return `${color("\u2713 Using Rill anonymously", 32)}
+  if (identity2.status === "anonymous") return `${color("\u2713 Using Rill anonymously", 32)}
 
-Connect your account: ${cliCommand(identity.apiUrl, "connect", "--email", "<your-email>")}
+Connect your account: ${cliCommand(identity2.apiUrl, "connect", "--email", "<your-email>")}
 `;
   return `${color("\u2713 Connected to Rill", 32)}
-Account: ${identity.email ?? "Email unavailable"}
+Account: ${identity2.email ?? "Email unavailable"}
 `;
 }
 function formatDoctor(result, color = terminalColor()) {
@@ -16936,6 +17164,31 @@ async function withRunFeedback(session, start) {
 
 // src/doctor.ts
 import { spawn as spawn7 } from "child_process";
+
+// src/node-runtime.ts
+var SUPPORTED_NODE_RANGE = "^22.23.4 || ^24.22.1 || >=26.12.1";
+var NODE_UPGRADE_RECOVERY = "Install Node.js 24.22.1 LTS or a newer patched release (22.23.4+, 24.22.1+, or 26.12.1+), then rerun the command. Update Chrome/Chromium separately for local recording.";
+function supportsNodeRuntime(version3) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:\+[\w.-]+)?$/.exec(version3);
+  if (!match) return false;
+  const [major, minor, patch] = match.slice(1).map(Number);
+  const minimum = major === 22 ? [23, 4] : major === 24 ? [22, 1] : major === 26 ? [12, 1] : null;
+  if (!minimum) return major > 26;
+  return minor > minimum[0] || minor === minimum[0] && patch >= minimum[1];
+}
+var UnsupportedNodeRuntimeError = class extends Error {
+  code = "unsupported_node_version";
+  recovery = NODE_UPGRADE_RECOVERY;
+  constructor(version3) {
+    super(`Node.js ${version3} does not meet Rill's patched runtime requirement for the eMudhra certificate compromise. Supported versions: ${SUPPORTED_NODE_RANGE}.`);
+    this.name = "UnsupportedNodeRuntimeError";
+  }
+};
+function assertNodeRuntime(version3 = process.version) {
+  if (!supportsNodeRuntime(version3)) throw new UnsupportedNodeRuntimeError(version3);
+}
+
+// src/doctor.ts
 var defaultDependencies = {
   platform: process.platform,
   encoding: "remote",
@@ -16954,10 +17207,12 @@ async function runDoctor(apiUrl, overrides = {}) {
   const checks = [];
   let feedbackEnabled = false;
   checks.push(recorderTransportCheck(dependencies.platform));
-  if (compareVersions(normalizeVersion(dependencies.nodeVersion), "22.0.0") >= 0) {
+  if (supportsNodeRuntime(dependencies.nodeVersion)) {
     checks.push({ name: "node", status: "pass", message: `Node.js ${dependencies.nodeVersion} is supported.`, version: dependencies.nodeVersion });
   } else {
-    checks.push({ name: "node", status: "fail", message: `Node.js ${dependencies.nodeVersion} is unsupported.`, version: dependencies.nodeVersion, recovery: "Install Node.js 22 or newer, then reinstall the Rill CLI." });
+    const error51 = new UnsupportedNodeRuntimeError(dependencies.nodeVersion);
+    checks.push({ name: "node", status: "fail", message: error51.message, version: dependencies.nodeVersion, recovery: error51.recovery });
+    return { schemaVersion: 1, status: "error", apiUrl, environment: { platform: dependencies.platform }, checks };
   }
   let health = null;
   try {
@@ -17024,8 +17279,8 @@ async function runDoctor(apiUrl, overrides = {}) {
 }
 async function executableCheck(name, path, args, run2, recovery) {
   try {
-    const version2 = firstLine(await run2(path, args));
-    return { name, status: "pass", message: `${name === "chrome" ? "Chrome/Chromium" : "ffmpeg"} is available.`, version: version2, path };
+    const version3 = firstLine(await run2(path, args));
+    return { name, status: "pass", message: `${name === "chrome" ? "Chrome/Chromium" : "ffmpeg"} is available.`, version: version3, path };
   } catch (error51) {
     return { name, status: "fail", message: `${name === "chrome" ? "Chrome/Chromium" : "ffmpeg"} is unavailable: ${errorMessage(error51)}`, path, recovery };
   }
@@ -17054,8 +17309,8 @@ ${Buffer.concat(stderr).toString("utf8")}`.trim();
     });
   });
 }
-function normalizeVersion(version2) {
-  return version2.replace(/^v/, "").split("-")[0];
+function normalizeVersion(version3) {
+  return version3.replace(/^v/, "").split("-")[0];
 }
 function compareVersions(left, right) {
   const leftParts = normalizeVersion(left).split(".").map(Number);
@@ -17205,9 +17460,9 @@ function watchEncoding(apiUrl, id) {
 var program = new Command();
 program.name("rill").description("Record, inspect, and share agent browser runs.").version(CLI_VERSION).option("--api-url <url>", "Rill control plane", controlPlaneUrl(process.env.RILL_API_URL)).option("--pretty", "Pretty-print JSON output", false).option("--json", "Output machine-readable JSON (including whoami)", false).option("--human", "Readable doctor, login, whoami and recording start/stop/status/retry output", false);
 program.configureOutput({ outputError: () => void 0 }).exitOverride();
-function humanOutput(identity = false) {
+function humanOutput(identity2 = false) {
   const options = program.opts();
-  return !options.json && !options.pretty && (identity || options.human);
+  return !options.json && !options.pretty && (identity2 || options.human);
 }
 function emitRecording(value, pretty) {
   if (humanOutput()) process.stdout.write(formatRecording(value, program.opts().apiUrl));
@@ -17250,10 +17505,10 @@ async function authorize(quiet = false) {
 }
 program.command("whoami").description("Show the current verified identity without starting sign-in.").addHelpText("after", "\nShows a short account summary by default. Use rill whoami --json for agents, or rill --pretty whoami for indented JSON.").action(async () => {
   const options = program.opts();
-  const identity = await whoami(options.apiUrl);
-  if (humanOutput(true)) process.stdout.write(formatIdentity(identity));
-  else emit(identity, options.pretty);
-  if (!identity.authenticated) process.exitCode = 1;
+  const identity2 = await whoami(options.apiUrl);
+  if (humanOutput(true)) process.stdout.write(formatIdentity(identity2));
+  else emit(identity2, options.pretty);
+  if (!identity2.authenticated) process.exitCode = 1;
 });
 var connect = program.command("connect").description("Connect this agent once, with renewable account access.").option("--email <email>", "Email of the Rill account approving access").option("--no-wait", "Return approval instructions immediately; poll with connect status").action(async (input) => {
   if (!input.email) throw new Error("validation_failed: Supply --email <email> to start a connection.");
@@ -17525,6 +17780,10 @@ drafts.command("purge").action(async () => {
   emit({ schemaVersion: 1, purged }, options.pretty);
 });
 program.hook("preAction", async (_command, actionCommand) => {
+  if (!supportsNodeRuntime(process.version)) {
+    if (commandPath(actionCommand).join(" ") === "doctor") return;
+    assertNodeRuntime();
+  }
   if (commandPath(actionCommand).join(" ") === "record start") assertRecorderTransport();
   const command = cliCommandCategory(commandPath(actionCommand));
   if (!command) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runalabs/rill-cli",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Record, inspect, and share agent-controlled browser runs with Rill.",
   "license": "Apache-2.0",
   "repository": {
@@ -12,7 +12,7 @@
   "bugs": "https://github.com/RunaLabsDev/rill-web/issues",
   "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "bin": {
     "rill": "dist/cli.js"