Record a browser session (shakerscan record)

shakerscan record opens a Chromium window on one of your targets and keeps what you do there. You sign in and walk through the flows a crawler does not reach; your Enterprise instance receives every request to the target's exact origin as you go. The result is a browser capture: a request collection that Scans and Hunts use like an imported HAR file, and that your agent can read while you are still browsing. It needs engine 2.11 or later behind the gateway.

There is no proxy and no certificate to install: the client drives the browser through the Chrome DevTools Protocol and uploads through the same connection as every other client command.

Before you start

• A client connected to the instance (shakerscan connect, see Work with an agent) with a token of the operator or administrator role. Recording is for whoever may create a request collection; viewers cannot create, add to, close or follow a capture.

• Playwright, an optional part of the client:

  pipx install --force 'shakerscan[record]'
  python -m playwright install chromium     # with the client's Python, once
  

Record

shakerscan record <target> [--name NAME] [--start-url URL] [--include-assets] [--json]

<target> is a target id, or a URL whose origin names exactly one target. Close the browser or press Ctrl-C to finish: the client uploads what is left, closes the capture and prints the capture id and the commands to scan or Hunt with it. Until it is closed a capture cannot be selected for a Scan or a Hunt (the instance answers 409 capture_open); your agent can already read its requests (GET /request-collections/<id>/requests?since_seq=, or the shakerscan_captures tool).

A capture the client could not close (the laptop slept, the client died) is closed by the instance after 30 minutes without an upload.

Whose capture it is

A capture belongs to the person who opened it. Only that person can add to it or close it, from their browser session or from a service token that acts for them (set "Acts for" when the administrator issues the token). Another operator, or a token that acts for nobody, is refused with 403 capture_owner_mismatch. A token that acts for nobody records as its own service account.

Limitation: the owner is recorded by the person's display name and sign-in identity. If an administrator renames that person while a capture is open, the capture's later uploads and its close are refused as if someone else had opened it. Finish open captures before renaming people; a capture left this way is closed by the instance after 30 minutes and keeps what was uploaded.

Limits

Closing assembles the capture on the instance. While another capture is being assembled the instance answers 503 capture_assembly_busy with Retry-After; the client waits and retries. Uploads count against the ordinary per-person request rate, far above what a recording uses.

What is stored and shown

The captured document is stored encrypted, like any request collection. What anyone reads back (the collection library, the request list, the agent's tools) is the masked request index: cookie, set-cookie and authorization values, token-like query values and password-like fields are withheld. Captured credentials are not used: Scans and Hunts authenticate with the target's credential profiles, never with a recorded cookie or password.

The audit log names the person, the channel (browser or service token), the target and the collection when a capture is opened (capture.create) and closed (capture.close); each upload is one engine.capture record. Bodies are never written to the audit log.

Not in this beta

• Recording non-browser applications through a local proxy.
• Using a captured sign-in as a credential.