# Capture a URL or preserve one verified media item.

Use `wrench read` for a non-persistent inspection, pass a URL to Wrench for durable Markdown capture, or use `wrench archive` for one authorized, accessible, finite, non-DRM media item with integrity evidence.

This guide describes v0.16.11 and was checked against the public source for that immutable release.

## Choose the result before you run the command

| Command | Result | Persistence |
| --- | --- | --- |
| `wrench read URL` | Readable page inspection | Does not save the page |
| `wrench URL` | Durable Markdown page capture and local assets when applicable | Saves to the configured knowledge base |
| `wrench archive URL` | Verified source media plus requested derivatives, transcript, manifest, and hashes | Saves one archive item |
| `wrench audio\|video\|transcript URL` | One focused derivative from the same bounded media pipeline | Saves the requested archive view |

## Capture readable web knowledge

```
wrench read https://example.com/article
wrench https://example.com/article
wrench search "bounded provider contracts"
wrench context path/to/code
```

The saved form is Markdown intended to remain inspectable and searchable in local knowledge. `wrench context` resolves nearby agent context for a repository path, while `wrench search` queries the knowledge already kept locally.

Wrench also exposes the shared `@hraness/kb` URL-intelligence boundary:

```
wrench url-metadata backfill --root kb
```

The backfill uses a pinned Rust search helper for bounded metadata lookup, writes resumable `url-metadata.json` sidecars beside saved URLs, and performs read-only Archive.today discovery, including archive.is URLs, by default. `--no-archive` disables archive discovery; `--refresh` replaces an existing sidecar after a fresh bounded lookup.

## Preserve media with recomputable integrity

```
wrench archive https://example.com/authorized-media
wrench verify path/to/archive-item
```

A completed media item retains the acquired encoded media, privacy-projected provider metadata, requested derivatives and transcripts, a versioned manifest, and SHA-256 integrity records. `wrench verify` recomputes every recorded artifact hash so the archive can be checked independently after capture.

The unit of work is exactly one accessible, finite item. Wrench rejects playlists, live streams, affirmative DRM, and unsupported authentication rather than silently weakening the boundary. It does not bypass authentication, payment, access controls, or DRM.

## Local browser work is bounded

Fresh and profile-backed page capture share at most two locally owned browser acquisitions across Wrench processes using the same state home. Admission consumes the capture timeout and remains held through browser, proxy, process, and isolation cleanup.

An explicit `--cdp` or `--browser-live` attachment does not launch a Wrench-owned browser and does not consume one of those two slots. Ambiguous same-boot admission state stays occupied rather than allowing capacity to exceed the bound. Run `wrench doctor --json` for the exact state home and recovery evidence.

## Email thread clipping is a separate authenticated path

A Gmail `messaging.list` result includes a provider-derived `threadUrl`. Pass that URL to `wrench read` or `wrench clip` with the same Gmail auth locator. Gmail clips default to private Wrench state; `--output <directory>` is the explicit plaintext export boundary.

The default and `--media all` include every MIME attachment. `--media none` omits attachment bytes, while `--media images` is rejected because it would misrepresent non-image files. Attachment objects are content-addressed, integrity-recorded, and stored under deterministic SHA-256 names. See the [provider support directory](https://wrench.rip/provider-capabilities/) for available inbox, search, thread, and contact actions.

## Keep the capture boundary explicit

Install and verify the CLI with the [getting started guide](https://wrench.rip/getting-started/). For account-bound reads, review [local custody and provider contracts](https://wrench.rip/security/) before adding credentials.