rechrome 1.19.0 → 1.21.0

package/serve.js

@@ -1,6 +1,6 @@
 import { file } from "bun";
 import { createHash, X509Certificate } from "crypto";
-import { mkdirSync, unlinkSync, accessSync, constants as fsConstants } from "fs";
+import { mkdirSync, unlinkSync, accessSync, readdirSync, constants as fsConstants } from "fs";
 import { join, resolve, relative, isAbsolute } from "path";
 import {
   log,
@@ -10,30 +10,97 @@ import {
   RECH_DIR,
   HOME,
   PASSTHROUGH_ENV_KEYS,
+  resolvePlaywrightCli,
 } from "./rech.js";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
 
-// Short label for a client identity, used as the Chrome tab-group name (the tab
-// strip is space-constrained, so cap at 7 chars). gitUrl ".../owner/repo/tree/branch"
-// -> "rep:bra" (3+3); "host:/path/to/dir" -> "dir"; bare host/IP -> as-is. Strips a
-// trailing "@profile" suffix first.
-const MAX_GROUP_LABEL_LEN = 7;
-function shortClientLabel(raw: string): string {
+// Short label for a client identity, used as the Chrome tab-group name (the tab strip is
+// space-constrained, so cap at 7 chars). Handles the current label shape and the legacy gitUrl:
+//   "host/owner/repo#<basename>@<branch>" -> "bas:bra" (3+3)   (current)
+//   "host/owner/repo/tree/branch"         -> "rep:bra" (3+3)   (legacy gitUrl)
+//   "host:/path/to/dir"                   -> "dir"             (non-git)
+//   bare host/IP                          -> as-is
+export const MAX_GROUP_LABEL_LEN = 7;
+export function shortClientLabel(raw: string): string {
   if (!raw) return raw;
-  const baseId = raw.includes("@") ? raw.slice(0, raw.indexOf("@")) : raw;
-  const git = baseId.match(/^https?:\/\/[^/]+\/[^/]+\/([^/]+?)(?:\/tree\/(.+))?$/);
-  let label: string;
-  if (git)
-    label = git[2] ? `${git[1].slice(0, 3)}:${git[2].slice(0, 3)}` : git[1];
-  else {
-    const hostCwd = baseId.match(/^[^:]+:(.+)$/);
-    label = hostCwd ? (hostCwd[1].split("/").filter(Boolean).pop() || baseId) : baseId;
+  const join3 = (a: string, b?: string) => (b ? `${a.slice(0, 3)}:${b.slice(0, 3)}` : a);
+  // Current label: "[remote#]<worktree-basename>[@<branch>]"
+  if (raw.includes("#") || (raw.includes("@") && !raw.startsWith("http"))) {
+    const afterHash = raw.includes("#") ? raw.slice(raw.indexOf("#") + 1) : raw;
+    const [base, branch] = afterHash.split("@");
+    return join3(base, branch).slice(0, MAX_GROUP_LABEL_LEN);
   }
+  // Legacy gitUrl: ".../owner/repo/tree/branch"
+  const git = raw.match(/^https?:\/\/[^/]+\/[^/]+\/([^/]+?)(?:\/tree\/(.+))?$/);
+  if (git) return join3(git[1], git[2]).slice(0, MAX_GROUP_LABEL_LEN);
+  // "host:/path/to/dir" -> basename
+  const hostCwd = raw.match(/^[^:]+:(.+)$/);
+  const label = hostCwd ? (hostCwd[1].split("/").filter(Boolean).pop() || raw) : raw;
   return label.slice(0, MAX_GROUP_LABEL_LEN);
 }
 
+// --isolate sessions (`rech --isolate ...` -> `-s=iso-<rand>`) are throwaway, single-flow
+// buckets. We reap them on an idle TTL so an OAuth/login drive can't leak an orphaned browser
+// context. A TTL (not close-on-exit-per-command) is required because the flows are multi-step
+// (open -> click -> consent): closing after each command would break them. The reaper runs the
+// CLI's `close` for the specific iso session only — it never touches the user's other sessions
+// or quits Chrome.
+const ISO_SESSION_TTL_MS = Number(process.env.RECH_ISOLATE_TTL_MS) || 15 * 60_000;
+const ISO_REAP_INTERVAL_MS = 60_000;
+const isoLastUsed = new Map<string, number>();
+
+export function isIsoSession(namespacedSession: string): boolean {
+  return /(?:^|-)iso-[0-9a-f]+$/.test(namespacedSession);
+}
+
+function tmpSocketRoot(): string {
+  return `${(process.env.TMPDIR || "/tmp").replace(/\/$/, "")}/playwright-cli`;
+}
+
+// On startup, adopt any iso-* sessions a previous daemon left behind so they still get reaped
+// (in-memory tracking alone would miss pre-restart orphans). Best-effort: a mis-derived session
+// just yields a harmless no-op `close`. Socket files are named with the session as their prefix.
+function adoptOrphanedIsoSessions(): void {
+  try {
+    const root = tmpSocketRoot();
+    for (const sub of readdirSync(root)) {
+      let entries: string[];
+      try { entries = readdirSync(`${root}/${sub}`); } catch { continue; }
+      for (const f of entries) {
+        const m = f.match(/^([0-9a-f]+-iso-[0-9a-f]+)/) || f.match(/^(iso-[0-9a-f]+)/);
+        if (m && !isoLastUsed.has(m[1])) {
+          isoLastUsed.set(m[1], Date.now());
+          log(`adopted orphaned isolated session for reaping: ${m[1]}`);
+        }
+      }
+    }
+  } catch {
+    // socket dir may not exist yet — nothing to adopt
+  }
+}
+
+function reapIdleIsoSessions(bin: string, binArgs: string[], workDir: string): void {
+  const now = Date.now();
+  for (const [sess, last] of isoLastUsed) {
+    if (now - last < ISO_SESSION_TTL_MS) continue;
+    isoLastUsed.delete(sess);
+    try {
+      Bun.spawn([bin, ...binArgs, "close", `-s=${sess}`], {
+        cwd: workDir,
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "ignore",
+        env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
+      });
+      log(`reaped idle isolated session (idle ${Math.round((now - last) / 1000)}s): ${sess}`);
+    } catch (e) {
+      log(`reap failed for ${sess}: ${e}`);
+    }
+  }
+}
+
 async function renewCertIfNeeded(certPath: string, keyPath: string): Promise<boolean> {
   const certContent = await file(certPath).text().catch(() => null);
   if (!certContent) return false;
@@ -141,6 +208,13 @@ export async function serve() {
   const workDir = join(RECH_DIR, "output");
   mkdirSync(workDir, { recursive: true });
 
+  // Reap idle --isolate sessions so single-shot OAuth/login drives don't leak browser contexts.
+  adoptOrphanedIsoSessions();
+  setInterval(() => {
+    const [bin, ...binArgs] = splitCommand(resolvePlaywrightCli());
+    reapIdleIsoSessions(bin, binArgs, workDir);
+  }, ISO_REAP_INTERVAL_MS);
+
   const listenHost = process.env.RECH_HOST || "127.0.0.1";
   const canRead = (p?: string) => { try { accessSync(p!, fsConstants.R_OK); return true; } catch { return false; } };
   const certPath = canRead(process.env.RECH_TLS_CERT) ? process.env.RECH_TLS_CERT : undefined;
@@ -200,14 +274,19 @@ export async function serve() {
       } else {
         args = body.args;
         const id = body.identity as
-          | { gitUrl?: string; hostname?: string; cwd?: string; profile?: string }
+          | { key?: string; label?: string; gitUrl?: string; hostname?: string; cwd?: string; profile?: string }
           | undefined;
-        const baseId = id?.gitUrl || (id?.hostname && id?.cwd ? `${id.hostname}:${id.cwd}` : null);
-        const raw = baseId && id?.profile ? `${baseId}@${id.profile}` : baseId;
-        if (raw) {
-          sessionId = createHash("sha256").update(raw).digest("hex").slice(0, 8);
-          clientName = raw;
-          log(`session from identity: ${raw} -> ${sessionId}`);
+        // New clients send {key,label} (key = worktree-root-based, decoupled from the pretty
+        // label). Fall back to the legacy {gitUrl|hostname:cwd} shape for older clients.
+        const legacy = id?.gitUrl || (id?.hostname && id?.cwd ? `${id.hostname}:${id.cwd}` : null);
+        const keyBase = id?.key || legacy;
+        const labelBase = id?.label || legacy || keyBase;
+        if (keyBase) {
+          // Hash the key (+ profile via a NUL separator that never appears in a label).
+          const hashInput = id?.profile ? `${keyBase}\u0000${id.profile}` : keyBase;
+          sessionId = createHash("sha256").update(hashInput).digest("hex").slice(0, 8);
+          clientName = labelBase || keyBase;
+          log(`session from identity: ${clientName}${id?.profile ? ` profile:${id.profile}` : ""} [${keyBase}] -> ${sessionId}`);
         } else {
           const clientAddr = `${req.headers.get("x-forwarded-for") || server.requestIP(req)?.address || "unknown"}`;
           sessionId = createHash("sha256").update(clientAddr).digest("hex").slice(0, 8);
@@ -232,8 +311,12 @@ export async function serve() {
         return true;
       });
       const namespacedSession = clientSession ? `${sessionId}-${clientSession}` : sessionId;
+      // Track --isolate sessions so the idle-TTL reaper can close them later.
+      if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, Date.now());
 
-      const [bin, ...binArgs] = splitCommand(process.env.PLAYWRIGHT_CLI || "playwright-cli-multi-tab");
+      // daemonInstall bakes PLAYWRIGHT_CLI into the daemon env; resolvePlaywrightCli() is the
+      // fallback for a standalone `serve` (it re-runs the same env > fork > @playwright/cli > legacy chain).
+      const [bin, ...binArgs] = splitCommand(resolvePlaywrightCli());
 
       if (filteredArgs.length === 0) {
         filteredArgs.push("--help");

package/serve.ts

@@ -1,6 +1,6 @@
 import { file } from "bun";
 import { createHash, X509Certificate } from "crypto";
-import { mkdirSync, unlinkSync, accessSync, constants as fsConstants } from "fs";
+import { mkdirSync, unlinkSync, accessSync, readdirSync, constants as fsConstants } from "fs";
 import { join, resolve, relative, isAbsolute } from "path";
 import {
   log,
@@ -10,30 +10,97 @@ import {
   RECH_DIR,
   HOME,
   PASSTHROUGH_ENV_KEYS,
+  resolvePlaywrightCli,
 } from "./rech.ts";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
 
-// Short label for a client identity, used as the Chrome tab-group name (the tab
-// strip is space-constrained, so cap at 7 chars). gitUrl ".../owner/repo/tree/branch"
-// -> "rep:bra" (3+3); "host:/path/to/dir" -> "dir"; bare host/IP -> as-is. Strips a
-// trailing "@profile" suffix first.
-const MAX_GROUP_LABEL_LEN = 7;
-function shortClientLabel(raw: string): string {
+// Short label for a client identity, used as the Chrome tab-group name (the tab strip is
+// space-constrained, so cap at 7 chars). Handles the current label shape and the legacy gitUrl:
+//   "host/owner/repo#<basename>@<branch>" -> "bas:bra" (3+3)   (current)
+//   "host/owner/repo/tree/branch"         -> "rep:bra" (3+3)   (legacy gitUrl)
+//   "host:/path/to/dir"                   -> "dir"             (non-git)
+//   bare host/IP                          -> as-is
+export const MAX_GROUP_LABEL_LEN = 7;
+export function shortClientLabel(raw: string): string {
   if (!raw) return raw;
-  const baseId = raw.includes("@") ? raw.slice(0, raw.indexOf("@")) : raw;
-  const git = baseId.match(/^https?:\/\/[^/]+\/[^/]+\/([^/]+?)(?:\/tree\/(.+))?$/);
-  let label: string;
-  if (git)
-    label = git[2] ? `${git[1].slice(0, 3)}:${git[2].slice(0, 3)}` : git[1];
-  else {
-    const hostCwd = baseId.match(/^[^:]+:(.+)$/);
-    label = hostCwd ? (hostCwd[1].split("/").filter(Boolean).pop() || baseId) : baseId;
+  const join3 = (a: string, b?: string) => (b ? `${a.slice(0, 3)}:${b.slice(0, 3)}` : a);
+  // Current label: "[remote#]<worktree-basename>[@<branch>]"
+  if (raw.includes("#") || (raw.includes("@") && !raw.startsWith("http"))) {
+    const afterHash = raw.includes("#") ? raw.slice(raw.indexOf("#") + 1) : raw;
+    const [base, branch] = afterHash.split("@");
+    return join3(base, branch).slice(0, MAX_GROUP_LABEL_LEN);
   }
+  // Legacy gitUrl: ".../owner/repo/tree/branch"
+  const git = raw.match(/^https?:\/\/[^/]+\/[^/]+\/([^/]+?)(?:\/tree\/(.+))?$/);
+  if (git) return join3(git[1], git[2]).slice(0, MAX_GROUP_LABEL_LEN);
+  // "host:/path/to/dir" -> basename
+  const hostCwd = raw.match(/^[^:]+:(.+)$/);
+  const label = hostCwd ? (hostCwd[1].split("/").filter(Boolean).pop() || raw) : raw;
   return label.slice(0, MAX_GROUP_LABEL_LEN);
 }
 
+// --isolate sessions (`rech --isolate ...` -> `-s=iso-<rand>`) are throwaway, single-flow
+// buckets. We reap them on an idle TTL so an OAuth/login drive can't leak an orphaned browser
+// context. A TTL (not close-on-exit-per-command) is required because the flows are multi-step
+// (open -> click -> consent): closing after each command would break them. The reaper runs the
+// CLI's `close` for the specific iso session only — it never touches the user's other sessions
+// or quits Chrome.
+const ISO_SESSION_TTL_MS = Number(process.env.RECH_ISOLATE_TTL_MS) || 15 * 60_000;
+const ISO_REAP_INTERVAL_MS = 60_000;
+const isoLastUsed = new Map<string, number>();
+
+export function isIsoSession(namespacedSession: string): boolean {
+  return /(?:^|-)iso-[0-9a-f]+$/.test(namespacedSession);
+}
+
+function tmpSocketRoot(): string {
+  return `${(process.env.TMPDIR || "/tmp").replace(/\/$/, "")}/playwright-cli`;
+}
+
+// On startup, adopt any iso-* sessions a previous daemon left behind so they still get reaped
+// (in-memory tracking alone would miss pre-restart orphans). Best-effort: a mis-derived session
+// just yields a harmless no-op `close`. Socket files are named with the session as their prefix.
+function adoptOrphanedIsoSessions(): void {
+  try {
+    const root = tmpSocketRoot();
+    for (const sub of readdirSync(root)) {
+      let entries: string[];
+      try { entries = readdirSync(`${root}/${sub}`); } catch { continue; }
+      for (const f of entries) {
+        const m = f.match(/^([0-9a-f]+-iso-[0-9a-f]+)/) || f.match(/^(iso-[0-9a-f]+)/);
+        if (m && !isoLastUsed.has(m[1])) {
+          isoLastUsed.set(m[1], Date.now());
+          log(`adopted orphaned isolated session for reaping: ${m[1]}`);
+        }
+      }
+    }
+  } catch {
+    // socket dir may not exist yet — nothing to adopt
+  }
+}
+
+function reapIdleIsoSessions(bin: string, binArgs: string[], workDir: string): void {
+  const now = Date.now();
+  for (const [sess, last] of isoLastUsed) {
+    if (now - last < ISO_SESSION_TTL_MS) continue;
+    isoLastUsed.delete(sess);
+    try {
+      Bun.spawn([bin, ...binArgs, "close", `-s=${sess}`], {
+        cwd: workDir,
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "ignore",
+        env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
+      });
+      log(`reaped idle isolated session (idle ${Math.round((now - last) / 1000)}s): ${sess}`);
+    } catch (e) {
+      log(`reap failed for ${sess}: ${e}`);
+    }
+  }
+}
+
 async function renewCertIfNeeded(certPath: string, keyPath: string): Promise<boolean> {
   const certContent = await file(certPath).text().catch(() => null);
   if (!certContent) return false;
@@ -141,6 +208,13 @@ export async function serve() {
   const workDir = join(RECH_DIR, "output");
   mkdirSync(workDir, { recursive: true });
 
+  // Reap idle --isolate sessions so single-shot OAuth/login drives don't leak browser contexts.
+  adoptOrphanedIsoSessions();
+  setInterval(() => {
+    const [bin, ...binArgs] = splitCommand(resolvePlaywrightCli());
+    reapIdleIsoSessions(bin, binArgs, workDir);
+  }, ISO_REAP_INTERVAL_MS);
+
   const listenHost = process.env.RECH_HOST || "127.0.0.1";
   const canRead = (p?: string) => { try { accessSync(p!, fsConstants.R_OK); return true; } catch { return false; } };
   const certPath = canRead(process.env.RECH_TLS_CERT) ? process.env.RECH_TLS_CERT : undefined;
@@ -200,14 +274,19 @@ export async function serve() {
       } else {
         args = body.args;
         const id = body.identity as
-          | { gitUrl?: string; hostname?: string; cwd?: string; profile?: string }
+          | { key?: string; label?: string; gitUrl?: string; hostname?: string; cwd?: string; profile?: string }
           | undefined;
-        const baseId = id?.gitUrl || (id?.hostname && id?.cwd ? `${id.hostname}:${id.cwd}` : null);
-        const raw = baseId && id?.profile ? `${baseId}@${id.profile}` : baseId;
-        if (raw) {
-          sessionId = createHash("sha256").update(raw).digest("hex").slice(0, 8);
-          clientName = raw;
-          log(`session from identity: ${raw} -> ${sessionId}`);
+        // New clients send {key,label} (key = worktree-root-based, decoupled from the pretty
+        // label). Fall back to the legacy {gitUrl|hostname:cwd} shape for older clients.
+        const legacy = id?.gitUrl || (id?.hostname && id?.cwd ? `${id.hostname}:${id.cwd}` : null);
+        const keyBase = id?.key || legacy;
+        const labelBase = id?.label || legacy || keyBase;
+        if (keyBase) {
+          // Hash the key (+ profile via a NUL separator that never appears in a label).
+          const hashInput = id?.profile ? `${keyBase}\u0000${id.profile}` : keyBase;
+          sessionId = createHash("sha256").update(hashInput).digest("hex").slice(0, 8);
+          clientName = labelBase || keyBase;
+          log(`session from identity: ${clientName}${id?.profile ? ` profile:${id.profile}` : ""} [${keyBase}] -> ${sessionId}`);
         } else {
           const clientAddr = `${req.headers.get("x-forwarded-for") || server.requestIP(req)?.address || "unknown"}`;
           sessionId = createHash("sha256").update(clientAddr).digest("hex").slice(0, 8);
@@ -232,8 +311,12 @@ export async function serve() {
         return true;
       });
       const namespacedSession = clientSession ? `${sessionId}-${clientSession}` : sessionId;
+      // Track --isolate sessions so the idle-TTL reaper can close them later.
+      if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, Date.now());
 
-      const [bin, ...binArgs] = splitCommand(process.env.PLAYWRIGHT_CLI || "playwright-cli-multi-tab");
+      // daemonInstall bakes PLAYWRIGHT_CLI into the daemon env; resolvePlaywrightCli() is the
+      // fallback for a standalone `serve` (it re-runs the same env > fork > @playwright/cli > legacy chain).
+      const [bin, ...binArgs] = splitCommand(resolvePlaywrightCli());
 
       if (filteredArgs.length === 0) {
         filteredArgs.push("--help");

package/vendor/playwright-cli/node_modules/playwright-core/README.md

@@ -0,0 +1,3 @@
+# playwright-core
+
+This package contains the no-browser flavor of [Playwright](http://github.com/microsoft/playwright).

package/vendor/playwright-cli/node_modules/playwright-core/ThirdPartyNotices.txt

@@ -0,0 +1,13 @@
+microsoft/playwright-core
+
+THIRD-PARTY SOFTWARE NOTICES AND INFORMATION
+
+This package bundles third-party software inside individual files under
+`lib/`. Each bundled output has a sidecar `<bundle>.js.LICENSE` file next
+to it listing every npm package whose source was inlined into that
+bundle, together with the full license text for each.
+
+For example:
+- lib/utilsBundle.js.LICENSE
+
+This project incorporates components from the projects listed below. The original copyright notices and the licenses under which Microsoft received such components are set forth below. Microsoft reserves all rights not expressly granted herein, whether by implication, estoppel or otherwise.

package/vendor/playwright-cli/node_modules/playwright-core/bin/install_media_pack.ps1

@@ -0,0 +1,5 @@
+$osInfo = Get-WmiObject -Class Win32_OperatingSystem
+# check if running on Windows Server
+if ($osInfo.ProductType -eq 3) {
+  Install-WindowsFeature Server-Media-Foundation
+}

package/vendor/playwright-cli/node_modules/playwright-core/bin/install_webkit_wsl.ps1

@@ -0,0 +1,33 @@
+$ErrorActionPreference = 'Stop'
+
+# This script sets up a WSL distribution that will be used to run WebKit.
+
+$Distribution = "playwright"
+$Username = "pwuser"
+
+$distributions = (wsl --list --quiet) -split "\r?\n"
+if ($distributions -contains $Distribution) {
+    Write-Host "WSL distribution '$Distribution' already exists. Skipping installation."
+} else {
+    Write-Host "Installing new WSL distribution '$Distribution'..."
+    $VhdSize = "10GB"
+    wsl --install -d Ubuntu-24.04 --name $Distribution --no-launch --vhd-size $VhdSize
+    wsl -d $Distribution -u root adduser --gecos GECOS --disabled-password $Username
+}
+
+$pwshDirname = (Resolve-Path -Path $PSScriptRoot).Path;
+$playwrightCoreRoot = Resolve-Path (Join-Path $pwshDirname "..")
+
+$initScript = @"
+if [ ! -f "/home/$Username/node/bin/node" ]; then
+  mkdir -p /home/$Username/node
+  curl -fsSL https://nodejs.org/dist/v22.17.0/node-v22.17.0-linux-x64.tar.xz -o /home/$Username/node/node-v22.17.0-linux-x64.tar.xz
+  tar -xJf /home/$Username/node/node-v22.17.0-linux-x64.tar.xz -C /home/$Username/node --strip-components=1
+  sudo -u $Username echo 'export PATH=/home/$Username/node/bin:\`$PATH' >> /home/$Username/.profile
+fi
+/home/$Username/node/bin/node cli.js install-deps webkit
+sudo -u $Username PLAYWRIGHT_SKIP_BROWSER_GC=1 /home/$Username/node/bin/node cli.js install webkit
+"@ -replace "\r\n", "`n"
+
+wsl -d $Distribution --cd $playwrightCoreRoot -u root -- bash -c "$initScript"
+Write-Host "Done!"

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -e
+set -x
+
+if [[ $(arch) == "aarch64" ]]; then
+  echo "ERROR: not supported on Linux Arm64"
+  exit 1
+fi
+
+if [ -z "$PLAYWRIGHT_HOST_PLATFORM_OVERRIDE" ]; then
+  if [[ ! -f "/etc/os-release" ]]; then
+    echo "ERROR: cannot install on unknown linux distribution (/etc/os-release is missing)"
+    exit 1
+  fi
+
+  ID=$(bash -c 'source /etc/os-release && echo $ID')
+  if [[ "${ID}" != "ubuntu" && "${ID}" != "debian" ]]; then
+    echo "ERROR: cannot install on $ID distribution - only Ubuntu and Debian are supported"
+    exit 1
+  fi
+fi
+
+# 1. make sure to remove old beta if any.
+if dpkg --get-selections | grep -q "^google-chrome-beta[[:space:]]*install$" >/dev/null; then
+  apt-get remove -y google-chrome-beta
+fi
+
+# 2. Update apt lists (needed to install curl and chrome dependencies)
+apt-get update
+
+# 3. Install curl to download chrome
+if ! command -v curl >/dev/null; then
+  apt-get install -y curl
+fi
+
+# 4. download chrome beta from dl.google.com and install it.
+cd /tmp
+curl -O https://dl.google.com/linux/direct/google-chrome-beta_current_amd64.deb
+apt-get install -y ./google-chrome-beta_current_amd64.deb
+rm -rf ./google-chrome-beta_current_amd64.deb
+cd -
+google-chrome-beta --version

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_chrome_beta_mac.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -e
+set -x
+
+rm -rf "/Applications/Google Chrome Beta.app"
+cd /tmp
+curl --retry 3 -o ./googlechromebeta.dmg https://dl.google.com/chrome/mac/universal/beta/googlechromebeta.dmg
+hdiutil attach -nobrowse -quiet -noautofsck -noautoopen -mountpoint /Volumes/googlechromebeta.dmg ./googlechromebeta.dmg
+cp -pR "/Volumes/googlechromebeta.dmg/Google Chrome Beta.app" /Applications
+hdiutil detach /Volumes/googlechromebeta.dmg
+rm -rf /tmp/googlechromebeta.dmg
+
+/Applications/Google\ Chrome\ Beta.app/Contents/MacOS/Google\ Chrome\ Beta --version

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_chrome_beta_win.ps1

@@ -0,0 +1,24 @@
+$ErrorActionPreference = 'Stop'
+
+$url = 'https://dl.google.com/tag/s/dl/chrome/install/beta/googlechromebetastandaloneenterprise64.msi'
+
+Write-Host "Downloading Google Chrome Beta"
+$wc = New-Object net.webclient
+$msiInstaller = "$env:temp\google-chrome-beta.msi"
+$wc.Downloadfile($url, $msiInstaller)
+
+Write-Host "Installing Google Chrome Beta"
+$arguments = "/i `"$msiInstaller`" /quiet"
+Start-Process msiexec.exe -ArgumentList $arguments -Wait
+Remove-Item $msiInstaller
+
+$suffix = "\\Google\\Chrome Beta\\Application\\chrome.exe"
+if (Test-Path "${env:ProgramFiles(x86)}$suffix") {
+    (Get-Item "${env:ProgramFiles(x86)}$suffix").VersionInfo
+} elseif (Test-Path "${env:ProgramFiles}$suffix") {
+    (Get-Item "${env:ProgramFiles}$suffix").VersionInfo
+} else {
+    Write-Host "ERROR: Failed to install Google Chrome Beta."
+    Write-Host "ERROR: This could be due to insufficient privileges, in which case re-running as Administrator may help."
+    exit 1
+}

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_chrome_stable_linux.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -e
+set -x
+
+if [[ $(arch) == "aarch64" ]]; then
+  echo "ERROR: not supported on Linux Arm64"
+  exit 1
+fi
+
+if [ -z "$PLAYWRIGHT_HOST_PLATFORM_OVERRIDE" ]; then
+  if [[ ! -f "/etc/os-release" ]]; then
+    echo "ERROR: cannot install on unknown linux distribution (/etc/os-release is missing)"
+    exit 1
+  fi
+
+  ID=$(bash -c 'source /etc/os-release && echo $ID')
+  if [[ "${ID}" != "ubuntu" && "${ID}" != "debian" ]]; then
+    echo "ERROR: cannot install on $ID distribution - only Ubuntu and Debian are supported"
+    exit 1
+  fi
+fi
+
+# 1. make sure to remove old stable if any.
+if dpkg --get-selections | grep -q "^google-chrome[[:space:]]*install$" >/dev/null; then
+  apt-get remove -y google-chrome
+fi
+
+# 2. Update apt lists (needed to install curl and chrome dependencies)
+apt-get update
+
+# 3. Install curl to download chrome
+if ! command -v curl >/dev/null; then
+  apt-get install -y curl
+fi
+
+# 4. download chrome stable from dl.google.com and install it.
+cd /tmp
+curl -O https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
+apt-get install -y ./google-chrome-stable_current_amd64.deb
+rm -rf ./google-chrome-stable_current_amd64.deb
+cd -
+google-chrome --version

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_chrome_stable_mac.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -e
+set -x
+
+rm -rf "/Applications/Google Chrome.app"
+cd /tmp
+curl --retry 3 -o ./googlechrome.dmg https://dl.google.com/chrome/mac/universal/stable/GGRO/googlechrome.dmg
+hdiutil attach -nobrowse -quiet -noautofsck -noautoopen -mountpoint /Volumes/googlechrome.dmg ./googlechrome.dmg
+cp -pR "/Volumes/googlechrome.dmg/Google Chrome.app" /Applications
+hdiutil detach /Volumes/googlechrome.dmg
+rm -rf /tmp/googlechrome.dmg
+/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_chrome_stable_win.ps1

@@ -0,0 +1,24 @@
+$ErrorActionPreference = 'Stop'
+$url = 'https://dl.google.com/tag/s/dl/chrome/install/googlechromestandaloneenterprise64.msi'
+
+$wc = New-Object net.webclient
+$msiInstaller = "$env:temp\google-chrome.msi"
+Write-Host "Downloading Google Chrome"
+$wc.Downloadfile($url, $msiInstaller)
+
+Write-Host "Installing Google Chrome"
+$arguments = "/i `"$msiInstaller`" /quiet"
+Start-Process msiexec.exe -ArgumentList $arguments -Wait
+Remove-Item $msiInstaller
+
+
+$suffix = "\\Google\\Chrome\\Application\\chrome.exe"
+if (Test-Path "${env:ProgramFiles(x86)}$suffix") {
+    (Get-Item "${env:ProgramFiles(x86)}$suffix").VersionInfo
+} elseif (Test-Path "${env:ProgramFiles}$suffix") {
+    (Get-Item "${env:ProgramFiles}$suffix").VersionInfo
+} else {
+    Write-Host "ERROR: Failed to install Google Chrome."
+    Write-Host "ERROR: This could be due to insufficient privileges, in which case re-running as Administrator may help."
+    exit 1
+}

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_msedge_beta_linux.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+if [[ $(arch) == "aarch64" ]]; then
+  echo "ERROR: not supported on Linux Arm64"
+  exit 1
+fi
+
+if [ -z "$PLAYWRIGHT_HOST_PLATFORM_OVERRIDE" ]; then
+  if [[ ! -f "/etc/os-release" ]]; then
+    echo "ERROR: cannot install on unknown linux distribution (/etc/os-release is missing)"
+    exit 1
+  fi
+
+  ID=$(bash -c 'source /etc/os-release && echo $ID')
+  if [[ "${ID}" != "ubuntu" && "${ID}" != "debian" ]]; then
+    echo "ERROR: cannot install on $ID distribution - only Ubuntu and Debian are supported"
+    exit 1
+  fi
+fi
+
+# 1. make sure to remove old beta if any.
+if dpkg --get-selections | grep -q "^microsoft-edge-beta[[:space:]]*install$" >/dev/null; then
+  apt-get remove -y microsoft-edge-beta
+fi
+
+# 2. Install curl to download Microsoft gpg key
+if ! command -v curl >/dev/null; then
+  apt-get update
+  apt-get install -y curl
+fi
+
+# GnuPG is not preinstalled in slim images
+if ! command -v gpg >/dev/null; then
+  apt-get update
+  apt-get install -y gpg
+fi
+
+# 3. Add the GPG key, the apt repo, update the apt cache, and install the package
+curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /tmp/microsoft.gpg
+install -o root -g root -m 644 /tmp/microsoft.gpg /etc/apt/trusted.gpg.d/
+sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/edge stable main" > /etc/apt/sources.list.d/microsoft-edge-dev.list'
+rm /tmp/microsoft.gpg
+apt-get update && apt-get install -y microsoft-edge-beta
+
+microsoft-edge-beta --version

package/vendor/playwright-cli/node_modules/playwright-core/bin/reinstall_msedge_beta_mac.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+set -x
+
+cd /tmp
+curl --retry 3 -o ./msedge_beta.pkg "$1"
+# Note: there's no way to uninstall previously installed MSEdge.
+# However, running PKG again seems to update installation.
+sudo installer -pkg /tmp/msedge_beta.pkg -target /
+rm -rf /tmp/msedge_beta.pkg
+/Applications/Microsoft\ Edge\ Beta.app/Contents/MacOS/Microsoft\ Edge\ Beta --version