Private by default

Browser recordings can contain sensitive UI state. Unsurf treats that as the default, not an edge case.

Default behavior

New traces return a signed viewerUrl. Bare /r/<id> URLs 404 for current uploads.

bare trace URL      → 404
viewer URL + grant  → 200

Record privately

import { recordAttachedLocal } from "unsurf/skills/record";

const result = await recordAttachedLocal({
  connect: 9222,
  task: "authenticated browser proof",
  run: async (browser) => {
    await browser.wait(2000);
  },
});

console.log(result.viewerUrl);

The viewer grant authorizes the trace page and related metadata for a limited window.

Long-lived shareable demos

unsurf record ./demo.ts --public
unsurf loop ./goal.json --north-star "done?" --public

public still means grant-gated; it simply gets a longer-lived share link.

Revoke access

unsurf trace-revoke <id>

Revocation bumps the grant generation and invalidates previous links.

Why this matters

Unsurf is built around proof artifacts. Proof should be easy to share intentionally and hard to leak accidentally.