rpc-agent 0.3.1 → 0.4.0

package/dist/help.js

@@ -15,16 +15,57 @@ const SHOT_OPTIONS = [
     ['    --open', 'open the output folder when done'],
     ['    --json', 'print the result as JSON (no colour, no progress)'],
 ];
+const AUTH_OPTIONS = [
+    ['    --cookie <c>', '"name=value[; Domain=…; Path=…]", repeatable; target origin only'],
+    ['    --header <h>', '"Name: value", repeatable; sent to the target origin only'],
+    ['    --storage-state <file>', 'load a Playwright storageState JSON (cookies + localStorage)'],
+    ['    --no-session', "don't use the session saved by `rpc login` for this origin"],
+    ['    --allow-origin <o>', 'also send headers and loaded cookies to this origin, repeatable'],
+];
+const LOGIN_OPTIONS = [
+    ['    --save <file>', 'write the storage state here instead of the per-origin session'],
+    ['    --form', 'headless: fill an email + password form (CI, agents)'],
+    ['    --email <email>', 'with --form; default $RPC_LOGIN_EMAIL'],
+    ['    --password <pw>', 'with --form; prefer $RPC_LOGIN_PASSWORD (keeps it out of shell history)'],
+    ['    --email-selector <css>', `default: input[type=email], input[name=email], …`],
+    ['    --password-selector <css>', 'default: input[type=password]'],
+    ['    --submit-selector <css>', 'default: button[type=submit], input[type=submit] (else Enter)'],
+    ['    --timeout <ms>', 'navigation and form timeout (default: 30000)'],
+    ['    --json', 'print the result as JSON'],
+];
 export const COMMANDS = {
     shot: {
         usage: 'rpc shot <url> [options]',
         summary: 'Capture a URL at device viewports, optionally framed in device bezels.',
-        options: SHOT_OPTIONS,
+        options: [...SHOT_OPTIONS, ...AUTH_OPTIONS],
         examples: [
             ['rpc shot localhost:3000 -d iphone-15,ipad,desktop-1440 --bezels', ''],
             ['rpc shot example.com/pricing --full-page --slices', 'whole page + review slices'],
             ['rpc shot localhost:5173 --color-scheme dark --open', 'dark mode, open when done'],
             ['rpc shot localhost:3000 -d pixel --json', 'machine-readable result'],
+            ['rpc shot localhost:3000/billing', 'uses the session saved by rpc login'],
+            ["rpc shot api.example.com/admin --header 'Authorization: Bearer $TOKEN'", ''],
+        ],
+    },
+    login: {
+        usage: 'rpc login <url> [--form] [--save <file>]',
+        summary: 'Open a browser window at the URL, sign in, then press Enter (or close the window). The session is saved for that ' +
+            'origin (~/.config/rpc-agent/sessions, mode 0600) and `rpc shot` uses it automatically.',
+        options: LOGIN_OPTIONS,
+        examples: [
+            ['rpc login localhost:3000/sign-in', 'sign in by hand in a window'],
+            ['RPC_LOGIN_EMAIL=me@x.test RPC_LOGIN_PASSWORD=… rpc login localhost:3000/sign-in --form', 'CI / agents'],
+            ['rpc login example.com --save auth.json', 'write a storageState file instead'],
+        ],
+    },
+    sessions: {
+        usage: 'rpc sessions [list] | rpc sessions clear [origin]',
+        summary: 'List the sessions saved by `rpc login` (origins, cookie counts, expiry; never values), or delete them.',
+        options: [['    --json', 'print as JSON']],
+        examples: [
+            ['rpc sessions', ''],
+            ['rpc sessions clear localhost:3000', 'forget one origin'],
+            ['rpc sessions clear', 'forget all'],
         ],
     },
     devices: {
@@ -43,18 +84,24 @@ export const COMMANDS = {
         examples: [['rpc doctor', 'exits 1 when Chromium is missing']],
     },
     install: {
-        usage: 'rpc install',
+        usage: 'rpc install [--headed]',
         summary: "Download Playwright's Chromium with the Playwright version rpc uses, then run doctor.",
-        examples: [['rpc install', '']],
+        options: [['    --headed', 'also download full Chromium, for the window `rpc login` opens']],
+        examples: [
+            ['rpc install', 'headless shell only (captures)'],
+            ['rpc install --headed', 'for rpc login'],
+        ],
     },
     mcp: {
         usage: 'rpc mcp',
-        summary: 'Run the MCP server on stdio (tools: screenshot, list_devices).',
+        summary: 'Run the MCP server on stdio (tools: screenshot, list_devices, list_sessions).',
         examples: [['claude mcp add --scope user rpc -- node /abs/path/dist/cli.js mcp', 'add to Claude Code']],
     },
 };
 const TOP = [
     ['shot <url>', 'capture screenshots'],
+    ['login <url>', 'sign in once; later shots of that origin use the session'],
+    ['sessions', 'list or clear saved sessions'],
     ['devices', 'list device ids and aliases'],
     ['doctor', "check that Playwright's Chromium is installed and launches"],
     ['install', "download Playwright's Chromium (same version rpc uses)"],
@@ -91,6 +138,9 @@ export function richHelp(c) {
         c.bold('Shot options:'),
         ...table(SHOT_OPTIONS, c),
         '',
+        c.bold('Auth options:'),
+        ...table(AUTH_OPTIONS, c),
+        '',
         c.bold('Examples:'),
         ...examples(COMMANDS.shot.examples, c),
         '',

package/dist/login.js

@@ -0,0 +1,150 @@
+// `rpc login`: sign in once, save the browser's storage state for the origin.
+import { chromium } from 'playwright';
+import { isLoginUrl, redact, scopeState, toOrigin, writeSession } from './auth.js';
+import { launchBrowser } from './browser.js';
+export const DEFAULT_SELECTORS = {
+    email: 'input[type=email], input[autocomplete=username], input[name=email], input[name=username], input#email',
+    password: 'input[type=password]',
+    submit: 'button[type=submit], input[type=submit]',
+};
+export class HeadedBrowserMissingError extends Error {
+    name = 'HeadedBrowserMissingError';
+    constructor() {
+        super('rpc login opens a browser window, which needs full Chromium (`rpc install` only downloads the headless shell). ' +
+            'Run `rpc install --headed`, or install Google Chrome, or sign in headlessly with `rpc login <url> --form`.');
+    }
+}
+/** Headed Chromium; falls back to an installed Google Chrome. */
+export async function launchHeaded() {
+    try {
+        return await chromium.launch({ headless: false });
+    }
+    catch (err) {
+        if (!/Executable doesn't exist|playwright install/i.test(err.message))
+            throw err;
+    }
+    try {
+        return await chromium.launch({ headless: false, channel: 'chrome' });
+    }
+    catch {
+        throw new HeadedBrowserMissingError();
+    }
+}
+async function save(state, opts, finalUrl) {
+    const origin = toOrigin(opts.url);
+    const path = await writeSession(state, { origin, savedAt: new Date().toISOString(), url: opts.url }, opts.save);
+    const own = scopeState(state, [origin]);
+    return {
+        origin,
+        path,
+        finalUrl,
+        cookies: own.cookies.length,
+        localStorage: own.origins.length,
+        stillOnLogin: isLoginUrl(finalUrl) && new URL(finalUrl).origin === origin,
+    };
+}
+/**
+ * Open a visible browser at the URL and save the storage state when `done`
+ * resolves (the user pressed Enter) or the window is closed.
+ */
+export async function interactiveLogin(opts, done, onOpen) {
+    const browser = await launchHeaded();
+    try {
+        const context = await browser.newContext({ viewport: null, ignoreHTTPSErrors: true });
+        const page = await context.newPage();
+        let lastUrl = opts.url;
+        page.on('framenavigated', f => {
+            if (f === page.mainFrame())
+                lastUrl = f.url();
+        });
+        await page.goto(opts.url, { timeout: opts.timeoutMs }).catch(() => { });
+        onOpen?.();
+        // Snapshot regularly: once the window is closed the context can't be read.
+        let snapshot = await context.storageState();
+        const timer = setInterval(() => {
+            context.storageState().then(s => (snapshot = s), () => { });
+        }, 1000);
+        const closed = new Promise(res => {
+            page.on('close', res);
+            browser.on('disconnected', res);
+        });
+        try {
+            await Promise.race([done, closed]);
+        }
+        finally {
+            clearInterval(timer);
+        }
+        const state = await context.storageState().catch(() => snapshot);
+        if (!page.isClosed())
+            lastUrl = page.url();
+        return await save(state, opts, lastUrl);
+    }
+    finally {
+        await browser.close().catch(() => { });
+    }
+}
+/**
+ * Headless: fill an email + password form, submit, wait to leave the login
+ * URL, save. For CI and agents.
+ */
+export async function formLogin(opts, form) {
+    const browser = await launchBrowser();
+    try {
+        const context = await browser.newContext({ ignoreHTTPSErrors: true });
+        const page = await context.newPage();
+        await page.goto(opts.url, { waitUntil: 'load', timeout: opts.timeoutMs });
+        // Let client-side forms hydrate, so submit runs the app's handler rather
+        // than a native GET that would put the password in the URL.
+        await page.waitForLoadState('networkidle', { timeout: Math.min(opts.timeoutMs, 10_000) }).catch(() => { });
+        const start = new URL(page.url());
+        const email = page.locator(form.emailSelector ?? DEFAULT_SELECTORS.email).first();
+        const password = page.locator(form.passwordSelector ?? DEFAULT_SELECTORS.password).first();
+        await waitVisible(email, 'email field', form.emailSelector ? '--email-selector' : undefined, opts.timeoutMs);
+        await email.fill(form.email);
+        await waitVisible(password, 'password field', form.passwordSelector ? '--password-selector' : undefined, opts.timeoutMs);
+        await password.fill(form.password);
+        const submit = page.locator(form.submitSelector ?? DEFAULT_SELECTORS.submit).first();
+        if (form.submitSelector || (await submit.count()) > 0) {
+            await waitVisible(submit, 'submit button', form.submitSelector ? '--submit-selector' : undefined, opts.timeoutMs);
+            await submit.click();
+        }
+        else {
+            await password.press('Enter');
+        }
+        try {
+            await page.waitForURL(u => u.origin + u.pathname !== start.origin + start.pathname, { timeout: opts.timeoutMs });
+        }
+        catch {
+            const shown = await pageMessage(page);
+            const message = shown && redact(shown, [form.password]);
+            throw new Error(`Still on ${start.origin}${start.pathname} ${Math.round(opts.timeoutMs / 1000)} s after submitting the form` +
+                `${message ? ` (the page says: "${message}")` : ''}. Check the credentials, or the selectors (--email-selector, --password-selector, --submit-selector).`);
+        }
+        await page.waitForLoadState('networkidle', { timeout: Math.min(opts.timeoutMs, 10_000) }).catch(() => { });
+        return await save(await context.storageState(), opts, page.url());
+    }
+    finally {
+        await browser.close().catch(() => { });
+    }
+}
+async function waitVisible(loc, what, flag, timeoutMs) {
+    try {
+        await loc.waitFor({ state: 'visible', timeout: Math.min(timeoutMs, 15_000) });
+    }
+    catch {
+        throw new Error(`No ${what} found on the page${flag ? ` for ${flag}` : ''}. Pass ${flag ?? `--${what.split(' ')[0]}-selector`} with a CSS selector that matches it.`);
+    }
+}
+/** A visible alert or error message, if the login page shows one. */
+async function pageMessage(page) {
+    const loc = page.locator('[role=alert], [aria-live=assertive], .error, [data-error]').filter({ hasText: /\S/ }).first();
+    try {
+        if ((await loc.count()) === 0)
+            return undefined;
+        const t = (await loc.innerText({ timeout: 1000 })).trim().replace(/\s+/g, ' ');
+        return t ? t.slice(0, 160) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/mcp.js

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
+import { describeAuth, listSessions, resolveAuth, sessionsDir, toOrigin } from './auth.js';
 import { capture, launchBrowser } from './capture.js';
 import { renderPreview } from './composite.js';
 import { CATEGORY_LABELS, CATEGORY_ORDER, DEFAULT_DEVICES, DEVICE_ALIASES, DEVICES, resolveDevices, } from './devices.js';
@@ -64,6 +65,33 @@ const screenshotInput = {
         .boolean()
         .optional()
         .describe('Return JPEG previews inline: one per device, or the full-page slices when fullPage. Default true.'),
+    cookies: z
+        .array(z.object({
+        name: z.string().min(1),
+        value: z.string(),
+        domain: z.string().optional().describe('Default: the target host only. Must match the target host (or an allowOrigins host).'),
+        path: z.string().optional().describe('Default /.'),
+    }))
+        .max(50)
+        .optional()
+        .describe('Cookies set on the target origin before loading. Values are never echoed back.'),
+    headers: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe('Request headers, e.g. {"Authorization": "Bearer …"}. Sent only to the target origin (and allowOrigins), never to third-party requests or redirects. Values are never echoed back.'),
+    storageState: z
+        .string()
+        .optional()
+        .describe("Path to a Playwright storageState JSON (cookies + localStorage), relative to the server's cwd. Only the target origin's entries are loaded."),
+    useSession: z
+        .boolean()
+        .optional()
+        .describe('Use the session saved by `rpc login <url>` for the target origin. Default true when one exists (see list_sessions). Ignored when storageState is set.'),
+    allowOrigins: z
+        .array(z.string())
+        .max(10)
+        .optional()
+        .describe('Extra origins (e.g. an API host) that also get the headers and loaded cookies.'),
 };
 export function createServer() {
     const server = new McpServer({ name: 'rpc', version: pkg.version });
@@ -77,6 +105,17 @@ export function createServer() {
     }, async (args) => {
         let options;
         try {
+            const auth = {};
+            if (args.cookies?.length)
+                auth.cookies = args.cookies;
+            if (args.headers && Object.keys(args.headers).length)
+                auth.headers = args.headers;
+            if (args.storageState)
+                auth.storageState = args.storageState;
+            if (args.useSession === false)
+                auth.useSession = false;
+            if (args.allowOrigins?.length)
+                auth.allowOrigins = args.allowOrigins.map(toOrigin);
             options = {
                 url: normalizeUrl(args.url),
                 devices: resolveDevices(args.devices ?? DEFAULT_DEVICES).map(d => d.id),
@@ -93,7 +132,9 @@ export function createServer() {
                 saveSlices: args.saveSlices,
                 maxSlices: args.maxSlices ?? DEFAULT_MAX_SLICES,
                 sliceWidth: args.sliceWidth ?? DEFAULT_SLICE_WIDTH,
+                ...(Object.keys(auth).length ? { auth } : {}),
             };
+            resolveAuth(options.url, auth); // bad cookies/headers/storage state: a tool error, before launching
         }
         catch (err) {
             return { isError: true, content: [{ type: 'text', text: err.message }] };
@@ -111,9 +152,9 @@ export function createServer() {
             const content = [
                 {
                     type: 'text',
-                    text: headline(result.shots, options) +
+                    text: headline(result.shots, options, result.auth) +
                         '\n\n' +
-                        JSON.stringify(summarise(result.url, result.outDir, result.shots), null, 2),
+                        JSON.stringify(summarise(result.url, result.outDir, result.shots, result.auth), null, 2),
                 },
             ];
             if (inline) {
@@ -168,6 +209,29 @@ export function createServer() {
             lines.push(`${a} -> ${id}`);
         return { content: [{ type: 'text', text: lines.join('\n') }] };
     });
+    server.registerTool('list_sessions', {
+        title: 'List saved login sessions',
+        description: 'List the origins that have a session saved by `rpc login` (used automatically by screenshot for that origin): ' +
+            'cookie count, when it was saved, and whether it has expired. Never returns cookie values.',
+        inputSchema: {},
+        annotations: { readOnlyHint: true },
+    }, async () => {
+        const list = await listSessions();
+        if (list.length === 0) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `No saved sessions in ${sessionsDir()}. The user can create one with \`rpc login <url>\` ` +
+                            '(a browser window) or `rpc login <url> --form` with RPC_LOGIN_EMAIL / RPC_LOGIN_PASSWORD set.',
+                    },
+                ],
+            };
+        }
+        const lines = list.map(s => `${s.origin}: ${s.cookies} cookie(s)${s.savedAt ? `, saved ${s.savedAt}` : ''}` +
+            `${s.expired ? `, EXPIRED ${s.expires} (run \`rpc login ${s.origin}\`)` : s.expires ? `, expires ${s.expires}` : ''}`);
+        return { content: [{ type: 'text', text: lines.join('\n') + '\n\n' + JSON.stringify({ dir: sessionsDir(), sessions: list }, null, 2) }] };
+    });
     return server;
 }
 /** Framed first screen (the hero), then the first maxSlices slices, each with a label. */
@@ -187,8 +251,10 @@ async function fullPageImages(browser, s, maxSlices) {
     return out;
 }
 /** Plain-language first lines: failures with hints, and what full-page output covers. */
-export function headline(shots, options) {
+export function headline(shots, options, auth) {
     const lines = [];
+    if (auth)
+        lines.push(`auth: ${describeAuth(auth)}`);
     const failed = shots.filter(s => s.error);
     if (failed.length === shots.length)
         lines.push(`All ${shots.length} device(s) failed.`);
@@ -232,11 +298,12 @@ export function headline(shots, options) {
     }
     return lines.join('\n');
 }
-function summarise(url, outDir, shots) {
+function summarise(url, outDir, shots, auth) {
     return {
         url,
         outDir,
         shots: shots.map(({ buffers: _b, ...s }) => s),
+        ...(auth ? { auth } : {}),
     };
 }
 export async function runMcpServer() {

package/dist/term.js

@@ -44,3 +44,23 @@ export function openPath(path) {
         return false;
     }
 }
+/**
+ * Resolve when a line (Enter) arrives on stdin. EOF never resolves it, so a
+ * caller can race it against something else (the login window closing).
+ */
+export function waitForEnter(input = process.stdin) {
+    let onData = () => { };
+    const promise = new Promise(res => {
+        onData = chunk => {
+            if (/[\r\n]/.test(String(chunk)))
+                res();
+        };
+        input.on('data', onData);
+        input.resume();
+    });
+    const stop = () => {
+        input.off('data', onData);
+        input.pause();
+    };
+    return { promise, stop };
+}

package/dist/ui.js

@@ -6,11 +6,12 @@ import { connect } from 'node:net';
 import { relative } from 'node:path';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
+import { clearSessions, listSessions, localTime, MASK, resolveAuth, sessionsDir, } from './auth.js';
 import { BrowserMissingError, installHint, launchBrowser } from './browser.js';
 import { capture } from './capture.js';
 import { CATEGORY_ORDER, DEVICE_ALIASES, DEVICES, } from './devices.js';
 import { defaultShotOptions, normalizeUrl } from './options.js';
-import { openCommand, openPath } from './term.js';
+import { openCommand, openPath, waitForEnter } from './term.js';
 export function colors(enabled) {
     return pc.createColors(enabled);
 }
@@ -174,7 +175,7 @@ export function printDevices(c) {
 }
 // ------------------------------------------------------------------ shot
 /** Lines for the "Capture Summary" box. */
-export function summaryLines(o, c) {
+export function summaryLines(o, c, auth) {
     const yes = (b) => (b ? c.green('yes') : c.dim('no'));
     const rows = [
         ['devices', formatList(o.devices.map(d => c.cyan(d)))],
@@ -188,10 +189,34 @@ export function summaryLines(o, c) {
         rows.push(['wait for', o.waitFor]);
     if (!o.emulate)
         rows.push(['emulation', c.yellow('viewport + DPR only')]);
+    if (auth)
+        rows.push(...authRows(auth, c));
     rows.push(['output', `${rel(o.outDir)}/`]);
     const w = Math.max(...rows.map(([k]) => k.length)) + 1;
     return [c.cyan(o.url), ...rows.map(([k, v]) => `  ${c.dim(`${k}:`.padEnd(w))} ${v}`)];
 }
+/** Auth rows for the summary box: names only, values masked. */
+export function authRows(a, c) {
+    const rows = [];
+    if (a.session) {
+        const saved = a.session.savedAt ? c.dim(` saved ${localTime(a.session.savedAt)}`) : '';
+        if (a.session.loaded)
+            rows.push(['session', `${c.green(a.session.origin)}${saved}`]);
+        else if (a.session.expired)
+            rows.push(['session', c.yellow(`${a.session.origin} expired, not loaded`)]);
+        else
+            rows.push(['session', c.dim(`${a.session.origin} skipped (--no-session)`)]);
+    }
+    if (a.storageState)
+        rows.push(['storage state', rel(a.storageState)]);
+    if (a.cookies?.length)
+        rows.push(['cookies', formatList(a.cookies.map(x => `${x.name}=${c.dim(MASK)}`))]);
+    if (a.headers)
+        rows.push(['headers', formatList(Object.keys(a.headers).map(h => `${h}: ${c.dim(MASK)}`))]);
+    if (a.allowOrigins?.length)
+        rows.push(['also allowed', formatList(a.allowOrigins)]);
+    return rows;
+}
 function statusCell(s, c) {
     if (s.error)
         return c.red(s.code ?? 'error');
@@ -279,10 +304,11 @@ export function capturedLines(result, c) {
     return out;
 }
 export async function runShot(options, run, c) {
+    const auth = resolveAuth(options.url, options.auth ?? {});
     if (!run.continued) {
         printBanner(c);
         intro(c);
-        p.note(summaryLines(options, c).join('\n'), 'Capture Summary');
+        p.note(summaryLines(options, c, auth.summary).join('\n'), 'Capture Summary');
     }
     const s = p.spinner();
     s.start('Starting Chromium');
@@ -313,6 +339,7 @@ export async function runShot(options, run, c) {
     try {
         result = await capture(options, {
             browser,
+            auth,
             onDeviceStart: (d) => {
                 started = performance.now();
                 current = p.spinner();
@@ -466,6 +493,90 @@ export async function runInteractive(c) {
     }
     return runShot(options, { open: false, continued: true, showCommand: true }, c);
 }
+// ------------------------------------------------------------------ login
+export async function runLogin(cmd, c) {
+    intro(c);
+    const { formLogin, interactiveLogin, HeadedBrowserMissingError } = await import('./login.js');
+    const s = p.spinner();
+    let spinning = false;
+    try {
+        let result;
+        if (cmd.form) {
+            s.start(`Signing in at ${c.cyan(cmd.url)} ${c.dim('(headless, form)')}`);
+            spinning = true;
+            result = await formLogin(cmd, cmd.form);
+            spinning = false;
+            s.stop(`Signed in ${c.dim(`now at ${result.finalUrl}`)}`);
+        }
+        else {
+            s.start('Opening Chromium');
+            spinning = true;
+            const enter = waitForEnter();
+            try {
+                result = await interactiveLogin(cmd, enter.promise, () => {
+                    spinning = false;
+                    s.stop(`Opened ${c.cyan(cmd.url)}`);
+                    p.log.info(`Sign in in the browser window, then press ${c.bold('Enter')} here ${c.dim('(or close the window)')}`);
+                });
+            }
+            finally {
+                enter.stop();
+            }
+        }
+        if (result.stillOnLogin) {
+            p.log.warn(c.yellow(`The page was still on a login URL (${result.finalUrl}). The sign-in may not have finished.`));
+        }
+        p.note([
+            `${c.dim('origin:')}       ${c.cyan(result.origin)}`,
+            `${c.dim('file:')}         ${rel(result.path)} ${c.dim('(mode 0600)')}`,
+            `${c.dim('cookies:')}      ${result.cookies}`,
+            `${c.dim('localStorage:')} ${result.localStorage} origin(s)`,
+        ].join('\n'), 'Saved session');
+        const next = cmd.save ? `rpc shot <url> --storage-state ${quote(rel(result.path))}` : `rpc shot ${result.origin}/…`;
+        p.outro(`${c.green('Done!')}  ${c.dim(`Next: ${next}`)}`);
+        return 0;
+    }
+    catch (err) {
+        const msg = err.message;
+        if (spinning)
+            s.error(c.red(err instanceof HeadedBrowserMissingError || err instanceof BrowserMissingError ? 'No browser to open' : 'Sign-in failed'));
+        if (err instanceof HeadedBrowserMissingError || err instanceof BrowserMissingError) {
+            p.note(wrap(msg.replace(/^Fix: /, ''), textWidth()).join('\n'), c.yellow('Fix'));
+        }
+        else {
+            p.log.error(wrap(msg, textWidth()).join('\n'));
+        }
+        p.outro(c.red('No session saved.'));
+        return 1;
+    }
+}
+export async function runSessions(action, origin, c) {
+    intro(c);
+    if (action === 'clear') {
+        const gone = await clearSessions(origin);
+        if (gone.length === 0)
+            p.log.info(origin ? `No saved session for ${c.cyan(origin)}` : 'No saved sessions');
+        for (const o of gone)
+            p.log.success(`Removed ${c.cyan(o)}`);
+        p.outro(c.dim(`${gone.length} removed`));
+        return 0;
+    }
+    const list = await listSessions();
+    if (list.length === 0) {
+        p.log.info(`No saved sessions in ${c.dim(sessionsDir())}`);
+        p.outro(c.dim('Create one with: rpc login <url>'));
+        return 0;
+    }
+    const when = localTime;
+    const originW = Math.max(...list.map(s => s.origin.length));
+    const lines = list.map(s => {
+        const exp = s.expired ? c.red(`expired ${when(s.expires)}`) : s.expires ? c.dim(`expires ${when(s.expires)}`) : c.dim('no expiry');
+        return `${c.cyan(s.origin.padEnd(originW))}  ${String(s.cookies).padStart(2)} cookie${s.cookies === 1 ? ' ' : 's'}  ${c.dim(`saved ${when(s.savedAt)}`)}  ${exp}`;
+    });
+    p.note(lines.join('\n'), `${list.length} saved session${list.length === 1 ? '' : 's'}`);
+    p.outro(c.dim(sessionsDir()));
+    return 0;
+}
 // ------------------------------------------------------------------ doctor
 export async function runDoctor(check, c) {
     intro(c);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rpc-agent",
-  "version": "0.3.1",
-  "description": "Screenshot a URL at device viewports, optionally framed in device bezels. CLI and MCP server for AI coding agents.",
+  "version": "0.4.0",
+  "description": "Screenshot a URL at device viewports, optionally framed in device bezels, signed in or not. CLI and MCP server for AI coding agents.",
   "keywords": [
     "mcp",
     "mcp-server",
@@ -55,6 +55,7 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
+    "@fontsource/ibm-plex-mono": "^5.3.0",
     "@types/node": "^22.20.5",
     "@xterm/headless": "^5.5.0",
     "tsx": "^4.23.15",