rechrome 1.20.0 → 1.22.0

package/rech.ts

@@ -104,7 +104,7 @@ function openInDefaultApp(target: string): void {
   const cmd = process.platform === "darwin" ? ["open", target]
     : process.platform === "win32" ? ["cmd", "/c", "start", "", target]
     : ["xdg-open", target];
-  try { Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore" }); } catch {}
+  try { Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore", windowsHide: true }); } catch {}
 }
 
 // Best-effort path to the Chrome executable for the current platform (used to open a
@@ -137,7 +137,7 @@ function openInChromeProfile(profileDir: string, target: string): boolean {
   try {
     Bun.spawn(
       [chromeBin, `--profile-directory=${profileDir}`, target],
-      { stdout: "ignore", stderr: "ignore", detached: true },
+      { stdout: "ignore", stderr: "ignore", detached: true, windowsHide: true },
     );
     return true;
   } catch {
@@ -194,48 +194,117 @@ export function authCheck(req: Request, key: string): Response | null {
   return null;
 }
 
-async function getClientIdentity(): Promise<{ gitUrl?: string; hostname?: string; cwd?: string }> {
-  const cwd = process.cwd();
+function realpathSafe(p: string): string {
+  try { return realpathSync(p); } catch { return p; }
+}
+
+async function gitOutput(args: string[], cwd: string): Promise<string | null> {
   try {
-    const remoteProc = Bun.spawn(["git", "remote", "get-url", "origin"], {
-      cwd,
-      stdout: "pipe",
-      stderr: "ignore",
-    });
-    const remoteUrl = (await new Response(remoteProc.stdout).text()).trim();
-    await remoteProc.exited;
+    // windowsHide: don't flash a console window on Windows (git.exe is a console app)
+    const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "ignore", windowsHide: true });
+    const out = (await new Response(proc.stdout).text()).trim();
+    await proc.exited;
+    return out || null;
+  } catch {
+    return null;
+  }
+}
 
-    const branchProc = Bun.spawn(["git", "rev-parse", "--abbrev-ref", "HEAD"], {
-      cwd,
-      stdout: "pipe",
-      stderr: "ignore",
-    });
-    const branch = (await new Response(branchProc.stdout).text()).trim();
-    await branchProc.exited;
-
-    if (remoteUrl) {
-      let gitUrl: string;
-      const sshMatch = remoteUrl.match(/^git@([^:]+):(.+?)(?:\.git)?$/);
-      const httpsMatch = remoteUrl.match(/^https?:\/\/([^/]+)\/(.+?)(?:\.git)?$/);
-      if (sshMatch) {
-        gitUrl = `https://${sshMatch[1]}/${sshMatch[2]}`;
-      } else if (httpsMatch) {
-        gitUrl = `https://${httpsMatch[1]}/${httpsMatch[2]}`;
-      } else {
-        gitUrl = remoteUrl.replace(/\.git$/, "");
-      }
-      if (branch) gitUrl += `/tree/${branch}`;
-      // Strip any embedded credentials from the URL
-      try {
-        const u = new URL(gitUrl);
-        u.username = "";
-        u.password = "";
-        gitUrl = u.toString();
-      } catch {}
-      return { gitUrl };
+// Normalize a git remote URL to "host/owner/repo" — no scheme, no .git, no credentials.
+export function normalizeRemote(remoteUrl: string): string {
+  const sshMatch = remoteUrl.match(/^git@([^:]+):(.+?)(?:\.git)?$/);
+  const httpsMatch = remoteUrl.match(/^https?:\/\/(?:[^@/]+@)?([^/]+)\/(.+?)(?:\.git)?$/);
+  if (sshMatch) return `${sshMatch[1]}/${sshMatch[2]}`;
+  if (httpsMatch) return `${httpsMatch[1]}/${httpsMatch[2]}`;
+  return remoteUrl.replace(/^[^/]*:\/\//, "").replace(/^[^@]*@/, "").replace(/\.git$/, "");
+}
+
+// Derive the session bucket KEY (what the server hashes) and a human LABEL (logs / tab group)
+// from already-gathered git facts. KEY and LABEL are deliberately decoupled: the key is keyed
+// on the *worktree root path* for predictability (a human can tell which browser they drive),
+// while the label renders a pretty <remote>#<basename>@<branch> for display only.
+//   - mode "worktree" (default): key = realpath(worktree root). Stable across `cd` within the
+//     project, distinct per worktree (no same-branch collisions), survives `git checkout`
+//     (no mutable-branch surprise), and has no branch so detached HEAD doesn't degrade it.
+//   - mode "branch": legacy opt-in — key = <remote>/tree/<branch> (the old behavior).
+//   - mode "cwd": key = realpath(cwd).
+// Pass realpath'd `cwd` and `root`.
+export function deriveIdentity(opts: {
+  mode: string;
+  cwd: string;
+  host: string;
+  root?: string | null;   // worktree root (already realpath'd), null when not in git
+  remote?: string | null; // normalized host/owner/repo
+  branch?: string | null; // branch name, or short SHA when detached
+}): { key: string; label: string } {
+  const { mode, cwd, host } = opts;
+  const root = opts.root || null;
+  const remote = opts.remote || null;
+  const branch = opts.branch || null;
+
+  let key: string;
+  if (mode === "branch") {
+    key = remote ? `https://${remote}${branch ? `/tree/${branch}` : ""}` : `${host}:${cwd}`;
+  } else if (mode === "cwd") {
+    key = `cwd:${cwd}`;
+  } else {
+    key = `worktree:${root || cwd}`;
+  }
+
+  let label: string;
+  if (root) {
+    label = `${remote ? `${remote}#` : ""}${basename(root)}${branch ? `@${branch}` : ""}`;
+  } else if (remote) {
+    label = `${remote}${branch ? `/tree/${branch}` : ""}`;
+  } else {
+    label = `${host}:${cwd}`;
+  }
+  return { key, label };
+}
+
+async function getClientIdentity(): Promise<{ key: string; label: string; profile?: string }> {
+  const cwd = realpathSafe(process.cwd());
+  const mode = (process.env.RECH_IDENTITY || "worktree").toLowerCase();
+  let root: string | null = null;
+  let remote: string | null = null;
+  let branch: string | null = null;
+
+  const top = await gitOutput(["rev-parse", "--show-toplevel"], cwd);
+  if (top) {
+    // Roll a submodule cwd up to the outermost superproject working tree, so submodule work
+    // shares the parent worktree's browser session (monorepo-friendly). Bounded loop guards
+    // against pathological nesting.
+    let superCwd = top;
+    for (let i = 0; i < 16; i++) {
+      const sup = await gitOutput(["rev-parse", "--show-superproject-working-tree"], superCwd);
+      if (!sup) break;
+      superCwd = sup;
     }
-  } catch {}
-  return { hostname: hostname(), cwd };
+    root = realpathSafe(superCwd);
+    branch = await gitOutput(["rev-parse", "--abbrev-ref", "HEAD"], root);
+    if (!branch || branch === "HEAD")
+      branch = await gitOutput(["rev-parse", "--short", "HEAD"], root); // detached HEAD
+    const remoteUrl = await gitOutput(["remote", "get-url", "origin"], root);
+    if (remoteUrl) remote = normalizeRemote(remoteUrl);
+  }
+
+  return deriveIdentity({ mode, cwd, host: hostname(), root, remote, branch });
+}
+
+// Profile precedence: an explicit `?profile=` in RECHROME_URL is authoritative; the
+// PLAYWRIGHT_MCP_PROFILE_DIRECTORY shell env is the fallback. When both are set and differ,
+// warn once — a silent mismatch here is how an OAuth/login flow can target the WRONG account.
+let _profileMismatchWarned = false;
+function resolveEffectiveProfile(urlProfile?: string): string | undefined {
+  const envProfile = process.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY;
+  if (urlProfile && envProfile && urlProfile !== envProfile && !_profileMismatchWarned) {
+    _profileMismatchWarned = true;
+    console.error(
+      `[rech] warning: profile mismatch — RECHROME_URL profile="${urlProfile}" wins over ` +
+      `PLAYWRIGHT_MCP_PROFILE_DIRECTORY="${envProfile}". Unset the env var to silence this.`,
+    );
+  }
+  return urlProfile || envProfile;
 }
 
 async function getClientEnv(urlExtras?: { extensionId?: string; extensionToken?: string; profileDirectory?: string; userDataDir?: string; loadExtension?: string }): Promise<Record<string, string>> {
@@ -410,12 +479,18 @@ async function listProfiles(): Promise<void> {
     }
   }
 
-  const rows = Object.entries(cache).map(([dir, info]) => [
-    dir,
-    info.user_name || "",
-    info.name || "",
-    dir === currentDir ? "← current" : "",
-  ]);
+  // Header clarifies each column; email/nickname sit beside the profile dir so a bare
+  // "Profile N" is never shown alone. Only user_name (email) + name (nickname) are read
+  // from Local State — the gaia real name is deliberately never surfaced.
+  const rows = [
+    ["PROFILE", "EMAIL", "NICKNAME", ""],
+    ...Object.entries(cache).map(([dir, info]) => [
+      dir,
+      info.user_name || "",
+      info.name || "",
+      dir === currentDir ? "← current" : "",
+    ]),
+  ];
   const widths = rows.reduce((w, r) => r.map((c, i) => Math.max(w[i] ?? 0, c.length)), [] as number[]);
   for (const row of rows) {
     console.log(row.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd());
@@ -426,11 +501,15 @@ async function callServe(
   url: string,
   args: string[],
   overrideEnv?: Record<string, string>,
+  precomputedIdentity?: { key: string; label: string; profile?: string },
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
-  const identity = await getClientIdentity();
-  const effectiveProfile = profileDirectory || process.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY;
-  if (effectiveProfile) (identity as any).profile = effectiveProfile;
+  // Reuse the caller's identity when provided — computing it shells out to `git` several times,
+  // and run() has already done so for its log line. Recomputing here would double those git
+  // spawns (and, on Windows, the console-window flashes) on every `rech open`.
+  const identity = precomputedIdentity ?? await getClientIdentity();
+  const effectiveProfile = resolveEffectiveProfile(profileDirectory);
+  if (effectiveProfile) identity.profile = effectiveProfile;
   const env = { ...(await getClientEnv({ extensionId, extensionToken, profileDirectory, userDataDir, loadExtension })), ...overrideEnv };
   const res = await fetch(`${protocol}://${host}:${port}/run`, {
     method: "POST",
@@ -468,16 +547,16 @@ async function callServe(
 
 async function run(url: string, args: string[]) {
   const { host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
-  const effectiveProfile = profileDirectory || process.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY;
+  const effectiveProfile = resolveEffectiveProfile(profileDirectory);
   const displayProfile = effectiveProfile ? await resolveProfileEmail(effectiveProfile) : undefined;
   const identity = await getClientIdentity();
   const profileSuffix = displayProfile ? ` profile:${displayProfile}` : "";
   console.error(
-    `[rech] connecting to ${host}:${port} (identity: ${identity.gitUrl || `${identity.hostname}:${identity.cwd}`}${profileSuffix})`,
+    `[rech] connecting to ${host}:${port} (identity: ${identity.label}${profileSuffix})`,
   );
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory, userDataDir, loadExtension });
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args);
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, undefined, identity);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -590,6 +669,7 @@ async function runPm(args: string[], env?: Record<string, string>): Promise<numb
   const proc = Bun.spawn(["bunx", PM_BIN, ...args], {
     stdout: "inherit",
     stderr: "inherit",
+    windowsHide: true, // no console-window flash for the bunx/pm2 child on Windows
     ...(env ? { env: { ...process.env, ...env } } : {}),
   });
   await proc.exited;
@@ -599,7 +679,7 @@ async function runPm(args: string[], env?: Record<string, string>): Promise<numb
 // Capture the process-manager's process list as text (oxmgr `list` / pm2 `jlist`).
 // Both render the process name verbatim, so callers can substring-match it.
 async function pmList(): Promise<string> {
-  const proc = Bun.spawn(["bunx", PM_BIN, IS_WINDOWS ? "jlist" : "list"], { stdout: "pipe", stderr: "ignore" });
+  const proc = Bun.spawn(["bunx", PM_BIN, IS_WINDOWS ? "jlist" : "list"], { stdout: "pipe", stderr: "ignore", windowsHide: true });
   return await new Response(proc.stdout).text();
 }
 
@@ -915,7 +995,7 @@ async function provisionExtensionToken(opts: {
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
   args.push("about:blank");
-  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore" });
+  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
@@ -1130,13 +1210,34 @@ async function setup(opts: { profile?: string; token?: string } = {}): Promise<v
     );
     if (opts.profile !== undefined) {
       const num = parseInt(opts.profile);
-      if (!isNaN(num) && String(num) === opts.profile.trim()) return available[num - 1] ?? null;
+      if (!isNaN(num) && String(num) === opts.profile.trim()) {
+        // A bare integer is a 1-based MENU INDEX, NOT the Chrome directory literally named
+        // "Profile <N>". The two collide in the user's head: `--profile 1` selects the first
+        // *listed* profile (usually Default), not the dir "Profile 1". When such a dir exists
+        // and differs from the indexed pick, warn so the mismatch is caught; echo the resolved
+        // selection either way. Email is the unambiguous selector — steer toward it.
+        const sel = available[num - 1] ?? null;
+        const dirNamed = available.find(([dir]) => dir.toLowerCase() === `profile ${num}`);
+        if (dirNamed && dirNamed[0] !== sel?.[0]) {
+          const hint = dirNamed[1].user_name || `"Profile ${num}"`;
+          console.error(
+            `      [warn] --profile ${num} = menu index ${num} → ` +
+            `${sel ? `${sel[1].user_name || sel[0]} [${sel[0]}]` : "(out of range)"}, ` +
+            `NOT the Chrome directory "Profile ${num}" (${dirNamed[1].user_name || dirNamed[0]}). ` +
+            `For an unambiguous match use the email or exact directory name, e.g. --profile ${hint}.`,
+          );
+        }
+        if (sel) console.log(`      selected: ${sel[1].user_name || "(no email)"} [${sel[0]}]`);
+        return sel;
+      }
       const needle = opts.profile.toLowerCase();
-      return available.find(([dir, info]) =>
+      const match = available.find(([dir, info]) =>
         dir.toLowerCase() === needle
         || (info.name ?? "").toLowerCase() === needle
         || (info.user_name ?? "").toLowerCase().includes(needle)
       ) ?? null;
+      if (match) console.log(`      selected: ${match[1].user_name || "(no email)"} [${match[0]}]`);
+      return match;
     }
     if (available.length === 1) {
       console.log(`      Only one profile available — selecting: ${available[0][1].user_name || available[0][0]}`);
@@ -1346,14 +1447,17 @@ async function status(): Promise<void> {
   const ping = await fetch(`${protocol}://${host}:${port}/`, { signal: AbortSignal.timeout(2000) }).catch(() => null);
   // Resolve the daemon's actual bind from its authenticated /ping (cross-platform; lsof is
   // POSIX-only and absent on Windows). bind is "0.0.0.0" (all interfaces) or the loopback IP.
-  const bind = ping
+  const pingBody = ping
     ? await fetch(`${protocol}://${host}:${port}/ping`, {
         headers: { Authorization: `Bearer ${parsed.key}` },
         signal: AbortSignal.timeout(2000),
-      }).then(r => (r.ok ? r.json() : null)).then((b: { bind?: string } | null) => b?.bind).catch(() => undefined)
-    : undefined;
+      }).then(r => (r.ok ? r.json() : null)).catch(() => null) as { bind?: string; degraded?: boolean; consecutiveTimeouts?: number } | null
+    : null;
+  const bind = pingBody?.bind;
   const listenAddr = bind ? `${bind}:${port}` : `${host}:${port}`;
   console.log(`serve:    ${ping ? `running  ${protocol}://${listenAddr}` : "not running"}`);
+  if (pingBody?.degraded)
+    console.log(`relay:    ⚠ degraded (${pingBody.consecutiveTimeouts} consecutive command timeouts) — if it persists, the daemon self-restarts; force it now with \`${PM_BIN} restart ${PM_PROCESS_NAME}\``);
   const pmOut = await pmList();
   const daemonRegistered = pmOut.includes(PM_PROCESS_NAME);
   console.log(`daemon:   ${daemonRegistered ? `${PM_BIN} (${PM_PROCESS_NAME})` : "not installed"}`);
@@ -1380,7 +1484,12 @@ function printHelp(): void {
 Usage:
   rech setup [--profile <num|email>] [--token <tok>]
                                First-time setup: daemon + Chrome extension + config
-                               --profile selects the Chrome profile non-interactively
+                               --profile selects the Chrome profile non-interactively.
+                               A bare number is the 1-based MENU INDEX (position in the
+                               listed order), NOT the Chrome directory "Profile N". For
+                               scripts prefer the email (e.g. --profile you@gmail.com) —
+                               it is the only unambiguous selector; an exact directory
+                               name ("Profile 1") also matches.
                                --token (or RECH_TOKEN) supplies the auth token for
                                non-TTY/agent runs, skipping the interactive paste
   rech provision-profile <name> --experimental [--headed]
@@ -1396,10 +1505,16 @@ Usage:
   rech serve                   Start the serve server manually (foreground)
   rech profiles                List Chrome profiles
   rech <playwright-args...>    Run Playwright CLI command (requires ${ENV_KEY})
+  rech --isolate <args...>     Run in a throwaway session (sugar for -s=<random>) so a
+                               fragile single-shot flow (OAuth/login) never shares tabs
+                               with the worktree's default session
 
 Environment:
   ${ENV_KEY}   Server URL set by \`rech setup\`
   RECH_TOKEN     Auth token for \`rech setup\` (same as --token)
+  RECH_IDENTITY  Session bucket mode: worktree (default) | branch | cwd. The session a
+                 client reuses is keyed on the worktree root path; \`branch\` restores the
+                 old <remote>/tree/<branch> keying, \`cwd\` keys on the exact directory
 
 Examples:
   rech setup
@@ -1468,6 +1583,15 @@ if (import.meta.main) {
       printHelp();
       process.exit(1);
     }
+    // --isolate: ephemeral session isolation, sugar for -s=iso-<random>. For fragile single-shot
+    // flows (OAuth/login) that must not share tabs with the worktree's default session. The `iso-`
+    // marker lets the daemon reap these throwaway sessions on an idle TTL (see serve.ts), so an
+    // OAuth drive can't leak an orphaned browser context.
+    const isolateIdx = args.findIndex((a) => a === "--isolate" || a === "--isolated");
+    if (isolateIdx !== -1) {
+      args.splice(isolateIdx, 1);
+      args.push(`-s=iso-${randomBytes(8).toString("hex")}`);
+    }
     await run(url, args);
     envWatcher?.close();
   }