@vosjs/cli 0.39.0 → 0.41.0

package/README.md

@@ -80,7 +80,7 @@ vos plan take --reuse                                   # re-time that cut onto
 
 | Verb     | Flags                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `record` | `--actions <file>` (or positional) `--url` `--out take` `--strict` `--dry-run` `--keep-frames` `--storage-state <file>` `--browser-arg=<switch>`... `--max-duration <s>` `--background <slug\|url\|none>`                                                                                                                                                                                                                                                                 |
+| `record` | `--actions <file>` (or positional) `--url` `--out take` `--strict` `--dry-run` `--allow-wall` `--keep-frames` `--storage-state <file>` `--browser-arg=<switch>`... `--max-duration <s>` `--background <slug\|url\|none>`                                                                                                                                                                                                                                                  |
 | `create` | The `record` flags plus the render flags (`--width` `--height` `--fps` `--format` `--parallel` `--draft` `--frame` `--set`), no `--range`. With `--strict` an incomplete recording exits 2 before anything is rendered                                                                                                                                                                                                                                                    |
 | `plan`   | `--fresh` (discard the current plan) `--reuse` `--from <doc.json>` (defaults to `<take>/doc.prev.json`) `--style <doc.json\|take\|vosId>` `--with <doc.json\|take\|vosId>[@end\|@start\|@step:<id>\|@<seconds>]` (a template, repeatable) `--background` `--motion` (re-propose the motion) `--headline` `--kicker` `--launch` `--brand` `--music` `--entrance` `--transitions slide\|fade\|scale\|none` `--end-card on\|none\|<ref>` `--captions` `--clicks` `--release` |
 | `digest` | `--out <take>/digest` `--full 960` `--crop 640` (image long edges, the token budget) `--no-frames` `--transcript <file>` (Whisper-shaped segments merged as `said`) `--style <ref>` (report a reference document's style fields)                                                                                                                                                                                                                                          |
@@ -88,6 +88,8 @@ vos plan take --reuse                                   # re-time that cut onto
 | `render` | `--width` `--height` `--fps` `--format webm\|mp4` `--parallel N` (1..16 sessions) `--range a..b` (output seconds; keeps its audio) `--draft` `--frame <kind>` `--background` `--set …`; `out` defaults to `<take>/out.<format>`                                                                                                                                                                                                                                           |
 | `open`   | `--studio http://localhost:6060` `--print` (print the URL, do not launch a browser)                                                                                                                                                                                                                                                                                                                                                                                       |
 
+**The wall check.** Once the first navigation settles, and before a frame is captured, `record`, `create` and `--dry-run` ask whether the recorder landed where it was sent. A take that met a sign-in instead is refused with exit 4 and a sentence (`asked for /dashboard, landed on /login: no session for app.acme.com`): the asked URL answered 401 or 403, the recorder was sent to an identity provider or a sign-in path, or the page is a sign-in form (one password field, or a one-time-code field) rendered in place. A redirect somewhere else with no sign-in in sight, which is what a site that shows strangers a public page looks like, is refused under `--strict` and in a rehearsal, and said as a warning otherwise. The check runs before a re-record clears anything, so a session that expired since the last take never costs the footage it failed to replace. The way past a wall is a session: `--storage-state <file>`, minted from the test auth the project already has wherever that exists. `--allow-wall` records the page anyway (a video OF a sign-in page is a legitimate take), and the take's `meta.wall` and its digest then say so.
+
 **Rehearse before you record.** `vos record … --dry-run` runs every step against the real page, in order, because a later selector usually exists only after an earlier click. Nothing is captured and nothing is written: the pointer lands instead of travelling, every pause is cut to a beat, and the take directory beside it keeps its footage, its cut and its script exactly as they were (a real re-record moves `doc.json` aside; a rehearsal does not). Selector lookups keep their whole timeout, so a miss here is a miss in the take. It prints each step with the rect it resolved, in capture px, which are the rects a pin or `vos callout --step` reads, and exits 2 on any miss or a first load that never settled. Add `--dry-run` to the exact command you were about to run; `--storage-state` and `--browser-arg=` apply to it too.
 
 **Digest first.** `vos digest <take>` is how an agent sees a recording without reading the video. It writes `digest/digest.json`: one moment per thing the cursor track says mattered (click clusters, typing sessions, scroll runs, dwells, idle gaps, head, tail, and frame-diff scene changes), each with source and output extents, a normalized `focus` and `rect` you can copy into a zoom span, per-second `activity`, and the planners' `proposed` span ids; plus one footage frame and a crop around the target per moment, and `sheet.png`, the contact sheet. Read the JSON, then the sheet, then a crop only where you must decide. `vos validate` then warns when a zoom does not contain what was clicked under it, and `vos frames --at-moments` renders the composed output at every moment so a still and its footage crop share an id.
@@ -217,8 +219,9 @@ Everything that runs on your machine is open source; [vos.so](https://vos.so) is
 vos login [--key <k>] [--label <name>] [--no-browser]   # browser sign-in: a code and a vos.so/cli/auth URL, a human approves, the key stores itself
 vos fetch <vosId|url> [--out <slug>] [--media]         # a program writes config.json + vos.json; a take writes doc.json (+ the recording with --media)
 vos check bright-loop/config.json                      # full local validation
-vos push bright-loop/config.json                       # create a PRIVATE vos (lineage from vos.json or --remix-of)
-vos push bright-loop/config.json --vos <id>            # add a version against your tracked base
+vos push bright-loop/config.json                       # untracked: create a PRIVATE vos. Tracked (vos.json): add a version to it
+vos push bright-loop/config.json --vos <id>            # add a version to a vos this directory does not track
+vos push bright-loop/config.json --remix-of <id>       # create a SEPARATE vos from this config, with that lineage
 vos push bright-loop/config.json --claimable           # no credential: a 72 h claim link instead (programs only)
 vos push take --yes --label "first pass" --note "…"    # host a take: private vos + version history (the recording uploads once)
 vos pull bright-loop [--since <versionId>] [--check]   # what changed on vos.so since your base; syncs config.json (backup kept), or doc.json for a take
@@ -229,7 +232,7 @@ vos asset push <file…> [--folder <slug>] | rename <id> <name.ext>
 vos recipe push <FILE.md> --folder <slug> | --asset <id>   # the one recipe write: create, or replace in place
 ```
 
-`push` is polymorphic by a deterministic sniff, never a flag: a take directory (a `doc.json` carrying `source`) pushes recording and document through the take pipeline; a `config.json` (or a directory holding one) pushes the program, and a `doc.json` beside it that carries `program` (a program document: overlays, objects, audio, speed, tween edits, its own length; `program.config` omitted on disk) rides along, lint-gated. `fetch` and `pull` write a program document back the same way. `pull` takes `--since <versionId>` (walk the changelog from that base instead of the tracked one) and `--check` (print what changed and stop: nothing on disk moves) on both paths. Program pushes take `--vos`, `--title`, `--slug`, `--desc`, `--tags`, `--folder`, `--remix-of`, `--base`, `--label`, `--note`, `--override <id>` (repeatable) and `--claimable`; take pushes take `--title`, `--label`, `--note`, `--folder`, `--override` and `--yes`.
+`push` is polymorphic by a deterministic sniff, never a flag: a take directory (a `doc.json` carrying `source`) pushes recording and document through the take pipeline; a `config.json` (or a directory holding one) pushes the program, and a `doc.json` beside it that carries `program` (a program document: overlays, objects, audio, speed, tween edits, its own length; `program.config` omitted on disk) rides along, lint-gated. `fetch` and `pull` write a program document back the same way. `pull` takes `--since <versionId>` (walk the changelog from that base instead of the tracked one) and `--check` (print what changed and stop: nothing on disk moves) on both paths. A program push LANDS where `vos.json` says: a directory that tracks a vos iterates it, so the fetch, edit, check, push, pull loop needs no flags, and making something separate from the same config is the explicit `--remix-of` door. Program pushes take `--vos`, `--title`, `--slug`, `--desc`, `--tags`, `--folder`, `--remix-of`, `--base`, `--label`, `--note`, `--override <id>` (repeatable) and `--claimable`; take pushes take `--title`, `--label`, `--note`, `--folder`, `--override` and `--yes`.
 
 Both paths share the same base tracking and the same two 409 shapes. `stale_base` replays the platform's typed changelog: run `vos pull`, re-apply, push again. `protected_conflict` lists nodes a human edited in the studio: keep their values, or re-push with `--override <id>` only when the user asked for that exact change. The first push of a take asks before uploading (`--yes` for headless); agents never upload unprompted. The take's duration rides the upload, and the platform refuses a take over the hosted recording cap. Every push should carry `--label` (what changed, one line) and `--note` (why: the user's ask); the version history reads as a conversation, and an unlabelled push is a turn the human cannot read.
 
@@ -253,7 +256,7 @@ vos push /tmp/take --label "$TAG launch" --yes --json       # VOS_API_KEY as a r
 ## For scripts and agents
 
 - **Output.** Logs on stderr, results on stdout. `--json` turns every verb into NDJSON events ending with `{"event":"done",…}`.
-- **Exit codes.** 0 ok, 1 error, 2 usage (including `--strict` failures), 3 no browser found.
+- **Exit codes.** 0 ok, 1 error, 2 usage (including `--strict` failures), 3 no browser found, 4 the recorder met a wall (a sign-in, or under `--strict` a redirect away from the asked page) and nothing was recorded or cleared. `--json` carries the verdict as a `wall` event (`kind`, `level`, `asked`, `landed`, `refused`).
 - **`--strict`** on `record` and `create` (agents: always): a skipped selector, a page that never reaches network idle, or a take that hit `--max-duration` exits 2 and lists `skipped[]` (and `capped`) in the done event. The default is lenient (exit 0, `skipped[]` still reported) for exploratory runs.
 - **`--max-duration <s>`** on `record` and `create` defaults to the hosted recording cap, read live from `GET /api/limits` (2 s, fail-open to 30 min when the origin is unreachable): the capture stops there and the done event says so. Cut the flow rather than raising the cap; the platform refuses a longer take.
 - **`create`** is the one-shot verb: record, auto-plan and render in one command and one browser session. The take directory still lands on disk, so the full loop (frames, edit `doc.json`, re-render) stays open afterwards.

package/dist/{chunk-RECQEBXN.js → chunk-BD4FXBUO.js}

@@ -79,6 +79,7 @@ var EXIT_OK = 0;
 var EXIT_ERROR = 1;
 var EXIT_USAGE = 2;
 var EXIT_NO_BROWSER = 3;
+var EXIT_WALL = 4;
 function createReporter(json) {
   return {
     json,
@@ -6628,6 +6629,135 @@ function paceLine(r) {
   return `pace: the script asked ${s(r.askedMs)}, the gestures added ${s(r.gestureMs)}, the take ran ${s(r.wallMs)} (${r.overheadPct} % overhead${slow})`;
 }
 
+// src/plugin/wall.ts
+var IDP_HOSTS = [
+  "accounts.google.com",
+  "login.microsoftonline.com",
+  "login.live.com",
+  "appleid.apple.com",
+  "auth0.com",
+  "okta.com",
+  "onelogin.com",
+  "clerk.accounts.dev",
+  "accounts.dev",
+  "b2clogin.com",
+  "amazoncognito.com",
+  "workos.com",
+  "stytch.com"
+];
+var SIGNIN_SEGMENTS = /* @__PURE__ */ new Set([
+  "login",
+  "log-in",
+  "signin",
+  "sign-in",
+  "sign_in",
+  "sso",
+  "auth",
+  "authenticate",
+  "authorize",
+  "oauth",
+  "oauth2",
+  "saml"
+]);
+function parse(url) {
+  try {
+    return new URL(url);
+  } catch {
+    return null;
+  }
+}
+var bareHost = (h) => h.replace(/^www\./, "").toLowerCase();
+var trimSlash = (p) => p.length > 1 ? p.replace(/\/+$/, "") : p;
+var place = (u) => `${u.origin}${trimSlash(u.pathname)}`;
+function isIdpHost(host) {
+  const h = host.toLowerCase();
+  if (h.startsWith("clerk.")) return true;
+  return IDP_HOSTS.some((idp) => h === idp || h.endsWith(`.${idp}`));
+}
+function isSignInPath(pathname) {
+  const segs = pathname.toLowerCase().split("/").filter(Boolean);
+  return segs.some((s) => SIGNIN_SEGMENTS.has(s));
+}
+function redirectedAway(asked, landed) {
+  if (bareHost(asked.hostname) !== bareHost(landed.hostname)) return true;
+  const a = trimSlash(asked.pathname).toLowerCase();
+  const l = trimSlash(landed.pathname).toLowerCase();
+  if (a === l || a === "/") return false;
+  if (l.startsWith(`${a}/`)) return false;
+  if (l.endsWith(a)) return false;
+  return true;
+}
+var LADDER = 'Walk the session ladder (mint a session from the test auth the project already has, or pass --storage-state): https://vos.so/llms-full.txt, "Sessions". A take OF this page is --allow-wall.';
+function wallVerdict(a) {
+  const asked = parse(a.askedUrl);
+  const landed = parse(a.landedUrl);
+  if (!asked || !landed) return null;
+  if (!/^https?:$/.test(asked.protocol)) return null;
+  const away = redirectedAway(asked, landed);
+  const where = { asked: place(asked), landed: place(landed) };
+  const host = bareHost(asked.hostname);
+  if (a.status === 401 || a.status === 403) {
+    return {
+      kind: "status",
+      level: "hard",
+      ...where,
+      message: `asked for ${asked.pathname}, answered ${a.status}: no session for ${host}. ${LADDER}`
+    };
+  }
+  const askedForSignIn = isSignInPath(asked.pathname) || isIdpHost(asked.hostname);
+  if (askedForSignIn && !away) return null;
+  if (away && isIdpHost(landed.hostname) && !isIdpHost(asked.hostname)) {
+    return {
+      kind: "idp",
+      level: "hard",
+      ...where,
+      message: `asked for ${asked.pathname}, landed on ${landed.hostname}: no session for ${host}. ${LADDER}`
+    };
+  }
+  const signInForm = a.passwordFields === 1 && !a.newPasswordField || a.oneTimeCodeField;
+  if (away && isSignInPath(landed.pathname) || signInForm && !askedForSignIn) {
+    const seen = away ? `landed on ${landed.pathname}` : "the page is a sign-in form";
+    return {
+      kind: "signin",
+      level: "hard",
+      ...where,
+      message: `asked for ${asked.pathname}, ${seen}: no session for ${host}. ${LADDER}`
+    };
+  }
+  if (away) {
+    return {
+      kind: "redirect",
+      level: "soft",
+      ...where,
+      message: `asked for ${asked.pathname}, landed on ${landed.pathname}: the site sent the recorder elsewhere, which is what a page behind a login does to a stranger. If that is the page you meant, record it by its own URL. ${LADDER}`
+    };
+  }
+  return null;
+}
+var WallError = class extends Error {
+  constructor(verdict) {
+    super(verdict.message);
+    this.verdict = verdict;
+    this.name = "WallError";
+  }
+  verdict;
+};
+var WALL_PROBE = `(() => {
+  const shown = (el) => {
+    const r = el.getBoundingClientRect()
+    if (r.width < 2 || r.height < 2) return false
+    const s = getComputedStyle(el)
+    return s.visibility !== 'hidden' && s.display !== 'none'
+  }
+  const pw = [...document.querySelectorAll('input[type="password"]')].filter(shown)
+  const otp = [...document.querySelectorAll('input[autocomplete="one-time-code"]')].filter(shown)
+  return {
+    passwordFields: pw.length,
+    newPasswordField: pw.some((el) => (el.getAttribute('autocomplete') || '').includes('new-password')),
+    oneTimeCodeField: otp.length > 0,
+  }
+})()`;
+
 // src/plugin/recorder.ts
 var realSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 var DRY_PAUSE_MS = 120;
@@ -6661,11 +6791,30 @@ async function recordTake(browser, url, actions, paths, log, opts = {}) {
   });
   log(`goto ${url}`);
   let navTimeout = false;
-  await page.goto(url, { waitUntil: "networkidle", timeout: 45e3 }).catch(() => {
+  const response = await page.goto(url, { waitUntil: "networkidle", timeout: 45e3 }).catch(() => {
     navTimeout = true;
     log("   (networkidle timeout \u2014 continuing)");
+    return null;
   });
   await sleep(800);
+  let wall = null;
+  if (opts.onArrival) {
+    const seen = await page.evaluate(WALL_PROBE).catch(() => null);
+    try {
+      wall = await opts.onArrival({
+        askedUrl: url,
+        landedUrl: page.url(),
+        ...response ? { status: response.status() } : {},
+        passwordFields: seen?.passwordFields ?? 0,
+        newPasswordField: seen?.newPasswordField ?? false,
+        oneTimeCodeField: seen?.oneTimeCodeField ?? false
+      }) ?? null;
+    } catch (e) {
+      await context.close().catch(() => {
+      });
+      throw e;
+    }
+  }
   const cdp = await context.newCDPSession(page);
   const frames = [];
   let frameIdx = 0;
@@ -6954,7 +7103,8 @@ async function recordTake(browser, url, actions, paths, log, opts = {}) {
     pageTitle,
     platform: process.platform === "darwin" ? "mac" : process.platform === "win32" ? "windows" : "linux",
     producer: "cli",
-    steps: stepSpans
+    steps: stepSpans,
+    ...wall ? { wall: { kind: wall.kind, asked: wall.asked, landed: wall.landed } } : {}
   };
   const freezes = [];
   for (let i = 1; i < frames.length; i++) {
@@ -6989,6 +7139,7 @@ async function recordTake(browser, url, actions, paths, log, opts = {}) {
     pace,
     skipped,
     navTimeout,
+    wall,
     freezes,
     freezePct,
     capped
@@ -7971,6 +8122,21 @@ function takePushRefusal(ask) {
     return `this take tracks vos ${ask.trackedVosId} (its vos.json), not ${ask.vos}. Drop --vos to push there, or remove vos.json to adopt ${ask.vos} instead`;
   return null;
 }
+function programPushTarget(ask) {
+  if (ask.vos) return { kind: "version", vosId: ask.vos, tracked: false };
+  if (ask.remixOf) return { kind: "create", remixOfId: ask.remixOf };
+  const tracked = ask.trackedVosId;
+  if (!tracked) return { kind: "create" };
+  const extra = ask.createOnly ?? [];
+  if (extra.length) {
+    const list = extra.map((f) => `--${f}`).join(", ");
+    return {
+      kind: "refuse",
+      why: `this directory tracks vos ${tracked} (vos.json), so a bare push adds a VERSION to it, and ${list} ${extra.length > 1 ? "apply" : "applies"} only when creating. To make a separate vos from this config: vos push <config.json> --remix-of ${tracked} ${list}. To change the tracked vos's title or slug, edit it on vos.so`
+    };
+  }
+  return { kind: "version", vosId: tracked, tracked: true };
+}
 async function pushTake(dir, flags, r) {
   const take = await loadTake(dir);
   if (!take.doc) {
@@ -8659,7 +8825,7 @@ async function cmdPushProgram(argv) {
   const config = pre.config;
   const state = readSyncState(dir);
   const vosFlag = strFlag(flags, "vos");
-  const vosId = vosFlag ? parseVosId(vosFlag) : null;
+  const explicitVosId = vosFlag ? parseVosId(vosFlag) : null;
   const programDoc = await readProgramDoc(dir, config);
   if (programDoc) {
     const lint = lintDoc(programDoc);
@@ -8670,7 +8836,7 @@ async function cmdPushProgram(argv) {
     for (const w of lint.warnings) r.log(`warning doc.json: ${w}`);
   }
   if (flags.claimable === true) {
-    if (vosId) {
+    if (explicitVosId) {
       throw new UsageError(
         "--claimable creates a NEW claimable vos and cannot iterate (--vos). After the human claims it, iterate with their key: vos push --vos <id>"
       );
@@ -8704,6 +8870,15 @@ with their key: vos push ${source} --vos ${String(created2.id ?? "<id>")}`
   const desc = strFlag(flags, "desc");
   const tagsFlag = strFlag(flags, "tags");
   const folderRef = strFlag(flags, "folder");
+  const remixOfFlag = strFlag(flags, "remix-of");
+  const pushTarget = programPushTarget({
+    vos: explicitVosId,
+    remixOf: remixOfFlag,
+    trackedVosId: state?.vosId ?? null,
+    createOnly: ["title", "slug"].filter((f) => strFlag(flags, f))
+  });
+  if (pushTarget.kind === "refuse") throw new UsageError(pushTarget.why);
+  const vosId = pushTarget.kind === "version" ? pushTarget.vosId : null;
   if (vosId && (desc || tagsFlag || folderRef)) {
     throw new UsageError(
       "--desc/--tags/--folder apply when CREATING a vos. On an existing one: vos folder move <id> --to <folder> for filing; edit title/description/tags on vos.so"
@@ -8772,7 +8947,7 @@ with their key: vos push ${source} --vos ${String(created2.id ?? "<id>")}`
     );
     return EXIT_OK;
   }
-  const remixOfId = strFlag(flags, "remix-of") ?? state?.vosId;
+  const remixOfId = pushTarget.kind === "create" ? pushTarget.remixOfId : void 0;
   const fallbackTitle = state?.title ? `${state.title} remix` : basename4(source).replace(/\.json$/i, "") || "vos remix";
   const title = (strFlag(flags, "title") ?? fallbackTitle).slice(0, 100);
   const folderId = folderRef ? resolveFolder(await listFolders(origin, key), folderRef).id : void 0;
@@ -10116,14 +10291,15 @@ var BOOLEAN_FLAGS5 = /* @__PURE__ */ new Set([
   "motion",
   "leader",
   "keep-frames",
-  "dry-run"
+  "dry-run",
+  "allow-wall"
 ]);
 var MULTI_FLAGS2 = /* @__PURE__ */ new Set(["set", "override", "browser-arg"]);
 var HELP = `vos \u2014 record a browser flow, plan effects, render a product video; sync with vos.so
 
 Take pipeline
-  vos create --actions actions.json [--url <url>] [--out take] [out.webm] [--strict] [--keep-frames] [--max-duration <s>] [--storage-state <file>] [--browser-arg=<switch>]... [--background <slug|url|none>] [render flags] [--json]
-  vos record --actions actions.json [--url <url>] [--out take] [--strict] [--dry-run] [--keep-frames] [--max-duration <s>] [--storage-state <file>] [--browser-arg=<switch>]... [--background <slug|url|none>] [--json]
+  vos create --actions actions.json [--url <url>] [--out take] [out.webm] [--strict] [--allow-wall] [--keep-frames] [--max-duration <s>] [--storage-state <file>] [--browser-arg=<switch>]... [--background <slug|url|none>] [render flags] [--json]
+  vos record --actions actions.json [--url <url>] [--out take] [--strict] [--dry-run] [--allow-wall] [--keep-frames] [--max-duration <s>] [--storage-state <file>] [--browser-arg=<switch>]... [--background <slug|url|none>] [--json]
   vos plan <take> [--fresh] [--reuse [--from <doc.json>]] [--style <doc.json|vosId>] [--with <doc.json|vosId>[@end|@start|@step:<id>|@<s>]]... [--background <slug|url|none>] [--motion] [--headline "\u2026"] [--kicker "\u2026"] [--launch LAUNCH.md] [--brand BRAND.md] [--music <slug|mood|none>] [--entrance tilt-in|pull-out|rise|fade|slide|none] [--transitions slide|fade|scale|none] [--end-card on|none|<doc.json|vosId>] [--captions none] [--clicks none] [--still <t>] [--release v2.1] [--json]
   vos render <take> [out.webm] [--width] [--height] [--fps] [--format webm|mp4] [--parallel N] [--range a..b] [--draft] [--frame <kind>] [--background <url|slug>] [--set <path=value>]... [--json]
   vos frames <take> [--times 0,25%,50%,75%,100%] [--frame <t>] [--at-zooms] [--at-moments] [--at-still] [--size WxH] [--out dir] [--background <url|slug>] [--set <path=value>]... [--json]
@@ -10432,6 +10608,24 @@ async function releaseFrames(paths, flags, log) {
       `released ${Math.round(freed / 1e6)} MB of screencast frames (the recording holds them now; --keep-frames keeps them)`
     );
 }
+function wallGate(flags, r, opts) {
+  const allow = flags["allow-wall"] === true;
+  return async (arrival) => {
+    const verdict = wallVerdict(arrival);
+    if (verdict && !allow && (verdict.level === "hard" || opts.strict)) {
+      r.event({ event: "wall", ...verdict, refused: true });
+      throw new WallError(verdict);
+    }
+    if (verdict) {
+      r.event({ event: "wall", ...verdict, refused: false });
+      r.log(
+        allow ? `   note: recording past the wall (--allow-wall): landed on ${verdict.landed}` : `   WARNING: ${verdict.message}`
+      );
+    }
+    await opts.prepare?.();
+    return verdict;
+  };
+}
 async function cmdRecord(argv) {
   const { positionals, flags, multi } = parseArgs(
     argv,
@@ -10467,7 +10661,12 @@ async function cmdRecord(argv) {
         actions,
         takePaths(outDir),
         r.log,
-        { storageState, dryRun: true }
+        {
+          storageState,
+          dryRun: true,
+          // A rehearsal is always strict, and it touches no directory.
+          onArrival: wallGate(flags, r, { strict: true })
+        }
       );
       const steps = rec.meta.steps ?? [];
       const lines = steps.map((s) => {
@@ -10494,21 +10693,28 @@ ${lines.join("\n")}
       await browser2.close();
     }
   }
-  if (existsSync15(join18(outDir, "meta.json"))) {
-    const { prevDoc, kept } = await prepareReRecord(outDir);
-    r.log(
-      `note: re-recording ${outDir} \u2014 kept ${kept.length ? kept.join(", ") : "nothing"}` + (prevDoc ? "; apply the previous cut to the new footage with: vos plan " + outDir + " --reuse" : "")
-    );
-  }
-  await mkdir10(outDir, { recursive: true });
-  const paths = await ensureTakeDir(outDir);
+  const paths = takePaths(outDir);
+  const prepare = async () => {
+    if (existsSync15(join18(outDir, "meta.json"))) {
+      const { prevDoc, kept } = await prepareReRecord(outDir);
+      r.log(
+        `note: re-recording ${outDir} \u2014 kept ${kept.length ? kept.join(", ") : "nothing"}` + (prevDoc ? "; apply the previous cut to the new footage with: vos plan " + outDir + " --reuse" : "")
+      );
+    }
+    await mkdir10(outDir, { recursive: true });
+    await ensureTakeDir(outDir);
+  };
   const browser = await launchBrowser(browserArgs);
   try {
     r.log("recording\u2026");
     r.event({ event: "phase", phase: "record" });
     const rec = await recordTake(browser, url, actions, paths, r.log, {
       maxDurationSeconds,
-      storageState
+      storageState,
+      onArrival: wallGate(flags, r, {
+        strict: flags.strict === true,
+        prepare
+      })
     });
     r.event({ event: "phase", phase: "encode" });
     r.log("encoding\u2026");
@@ -10540,6 +10746,7 @@ ${lines.join("\n")}
         freezePct: rec.freezePct,
         capped: rec.capped,
         pace: rec.pace,
+        ...rec.wall ? { wall: rec.wall } : {},
         ...strictFail ? { strictFailed: true } : {}
       },
       strictFail ? `STRICT: take recorded but incomplete \u2014 ${strictReason(rec)}; fix the flow and re-record.${skippedNote}` : `Take ready: ${outDir}
@@ -10582,21 +10789,28 @@ async function cmdCreate2(argv) {
   const maxDurationSeconds = await maxDuration(flags, r);
   const storageState = takeStorageState(flags);
   const browserArgs = takeBrowserArgs(multi);
-  if (existsSync15(join18(outDir, "meta.json"))) {
-    const { prevDoc, kept } = await prepareReRecord(outDir);
-    r.log(
-      `note: re-recording ${outDir} \u2014 kept ${kept.length ? kept.join(", ") : "nothing"}` + (prevDoc ? "; apply the previous cut to the new footage with: vos plan " + outDir + " --reuse" : "")
-    );
-  }
-  await mkdir10(outDir, { recursive: true });
-  const paths = await ensureTakeDir(outDir);
+  const paths = takePaths(outDir);
+  const prepare = async () => {
+    if (existsSync15(join18(outDir, "meta.json"))) {
+      const { prevDoc, kept } = await prepareReRecord(outDir);
+      r.log(
+        `note: re-recording ${outDir} \u2014 kept ${kept.length ? kept.join(", ") : "nothing"}` + (prevDoc ? "; apply the previous cut to the new footage with: vos plan " + outDir + " --reuse" : "")
+      );
+    }
+    await mkdir10(outDir, { recursive: true });
+    await ensureTakeDir(outDir);
+  };
   const browser = await launchBrowser(browserArgs);
   try {
     r.log("recording\u2026");
     r.event({ event: "phase", phase: "record" });
     const rec = await recordTake(browser, url, actions, paths, r.log, {
       maxDurationSeconds,
-      storageState
+      storageState,
+      onArrival: wallGate(flags, r, {
+        strict: flags.strict === true,
+        prepare
+      })
     });
     r.event({ event: "phase", phase: "encode" });
     r.log("encoding\u2026");
@@ -11219,12 +11433,14 @@ async function cmdDigest(argv) {
         sourceDuration: d.take.sourceDuration,
         outputDuration: d.take.outputDuration,
         hasCursor: d.take.hasCursor,
+        ...d.take.wall ? { wall: d.take.wall } : {},
         tokensEstimate: d.images.tokensEstimate,
         bytes: result.bytes
       },
       `Wrote ${result.file} \u2014 ${d.moments.length} moments (${Object.entries(
         kinds
-      ).map(([k, n]) => `${n} ${k}`).join(", ")}), ${d.images.full} frames + ${d.images.crop} crops` + (d.images.sheet ? `, sheet.png` : "") + ` \u2014 ~${d.images.tokensEstimate} image tokens to read them all` + (d.take.hasCursor ? "" : "\n  no cursor track: moments are head/tail/scenes only \u2014 pace by activity, zoom only where the ask names a place") + `
+      ).map(([k, n]) => `${n} ${k}`).join(", ")}), ${d.images.full} frames + ${d.images.crop} crops` + (d.images.sheet ? `, sheet.png` : "") + ` \u2014 ~${d.images.tokensEstimate} image tokens to read them all` + (d.take.hasCursor ? "" : "\n  no cursor track: moments are head/tail/scenes only \u2014 pace by activity, zoom only where the ask names a place") + (d.take.wall ? `
+  WALL: asked for ${d.take.wall.asked}, recorded ${d.take.wall.landed} \u2014 this footage may be the wrong page; re-record with a session before cutting it` : "") + `
   Read digest.json, then the sheet, then a crop only where you must decide.`
     );
     return EXIT_OK;
@@ -11697,6 +11913,11 @@ async function run(argv) {
 `);
       return EXIT_USAGE;
     }
+    if (e instanceof WallError) {
+      process.stderr.write(`wall: ${e.message}
+`);
+      return EXIT_WALL;
+    }
     if (e instanceof BrowserUnavailableError) {
       process.stderr.write(`${e.message}
 `);
@@ -11740,4 +11961,4 @@ export {
   takeBrowserArgs,
   run
 };
-//# sourceMappingURL=chunk-RECQEBXN.js.map
+//# sourceMappingURL=chunk-BD4FXBUO.js.map