rechrome 1.21.0 → 1.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rech.js

@@ -104,7 +104,7 @@ function openInDefaultApp(target: string): void {
   const cmd = process.platform === "darwin" ? ["open", target]
     : process.platform === "win32" ? ["cmd", "/c", "start", "", target]
     : ["xdg-open", target];
-  try { Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore" }); } catch {}
+  try { Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore", windowsHide: true }); } catch {}
 }
 
 // Best-effort path to the Chrome executable for the current platform (used to open a
@@ -137,7 +137,7 @@ function openInChromeProfile(profileDir: string, target: string): boolean {
   try {
     Bun.spawn(
       [chromeBin, `--profile-directory=${profileDir}`, target],
-      { stdout: "ignore", stderr: "ignore", detached: true },
+      { stdout: "ignore", stderr: "ignore", detached: true, windowsHide: true },
     );
     return true;
   } catch {
@@ -200,7 +200,8 @@ function realpathSafe(p: string): string {
 
 async function gitOutput(args: string[], cwd: string): Promise<string | null> {
   try {
-    const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "ignore" });
+    // windowsHide: don't flash a console window on Windows (git.exe is a console app)
+    const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "ignore", windowsHide: true });
     const out = (await new Response(proc.stdout).text()).trim();
     await proc.exited;
     return out || null;
@@ -478,12 +479,18 @@ async function listProfiles(): Promise<void> {
     }
   }
 
-  const rows = Object.entries(cache).map(([dir, info]) => [
-    dir,
-    info.user_name || "",
-    info.name || "",
-    dir === currentDir ? "← current" : "",
-  ]);
+  // Header clarifies each column; email/nickname sit beside the profile dir so a bare
+  // "Profile N" is never shown alone. Only user_name (email) + name (nickname) are read
+  // from Local State — the gaia real name is deliberately never surfaced.
+  const rows = [
+    ["PROFILE", "EMAIL", "NICKNAME", ""],
+    ...Object.entries(cache).map(([dir, info]) => [
+      dir,
+      info.user_name || "",
+      info.name || "",
+      dir === currentDir ? "← current" : "",
+    ]),
+  ];
   const widths = rows.reduce((w, r) => r.map((c, i) => Math.max(w[i] ?? 0, c.length)), [] as number[]);
   for (const row of rows) {
     console.log(row.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd());
@@ -494,9 +501,13 @@ async function callServe(
   url: string,
   args: string[],
   overrideEnv?: Record<string, string>,
+  precomputedIdentity?: { key: string; label: string; profile?: string },
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
-  const identity = await getClientIdentity();
+  // Reuse the caller's identity when provided — computing it shells out to `git` several times,
+  // and run() has already done so for its log line. Recomputing here would double those git
+  // spawns (and, on Windows, the console-window flashes) on every `rech open`.
+  const identity = precomputedIdentity ?? await getClientIdentity();
   const effectiveProfile = resolveEffectiveProfile(profileDirectory);
   if (effectiveProfile) identity.profile = effectiveProfile;
   const env = { ...(await getClientEnv({ extensionId, extensionToken, profileDirectory, userDataDir, loadExtension })), ...overrideEnv };
@@ -545,7 +556,7 @@ async function run(url: string, args: string[]) {
   );
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory, userDataDir, loadExtension });
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args);
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, undefined, identity);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -658,6 +669,7 @@ async function runPm(args: string[], env?: Record<string, string>): Promise<numb
   const proc = Bun.spawn(["bunx", PM_BIN, ...args], {
     stdout: "inherit",
     stderr: "inherit",
+    windowsHide: true, // no console-window flash for the bunx/pm2 child on Windows
     ...(env ? { env: { ...process.env, ...env } } : {}),
   });
   await proc.exited;
@@ -667,7 +679,7 @@ async function runPm(args: string[], env?: Record<string, string>): Promise<numb
 // Capture the process-manager's process list as text (oxmgr `list` / pm2 `jlist`).
 // Both render the process name verbatim, so callers can substring-match it.
 async function pmList(): Promise<string> {
-  const proc = Bun.spawn(["bunx", PM_BIN, IS_WINDOWS ? "jlist" : "list"], { stdout: "pipe", stderr: "ignore" });
+  const proc = Bun.spawn(["bunx", PM_BIN, IS_WINDOWS ? "jlist" : "list"], { stdout: "pipe", stderr: "ignore", windowsHide: true });
   return await new Response(proc.stdout).text();
 }
 
@@ -983,7 +995,7 @@ async function provisionExtensionToken(opts: {
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
   args.push("about:blank");
-  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore" });
+  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
@@ -1198,13 +1210,34 @@ async function setup(opts: { profile?: string; token?: string } = {}): Promise<v
     );
     if (opts.profile !== undefined) {
       const num = parseInt(opts.profile);
-      if (!isNaN(num) && String(num) === opts.profile.trim()) return available[num - 1] ?? null;
+      if (!isNaN(num) && String(num) === opts.profile.trim()) {
+        // A bare integer is a 1-based MENU INDEX, NOT the Chrome directory literally named
+        // "Profile <N>". The two collide in the user's head: `--profile 1` selects the first
+        // *listed* profile (usually Default), not the dir "Profile 1". When such a dir exists
+        // and differs from the indexed pick, warn so the mismatch is caught; echo the resolved
+        // selection either way. Email is the unambiguous selector — steer toward it.
+        const sel = available[num - 1] ?? null;
+        const dirNamed = available.find(([dir]) => dir.toLowerCase() === `profile ${num}`);
+        if (dirNamed && dirNamed[0] !== sel?.[0]) {
+          const hint = dirNamed[1].user_name || `"Profile ${num}"`;
+          console.error(
+            `      [warn] --profile ${num} = menu index ${num} → ` +
+            `${sel ? `${sel[1].user_name || sel[0]} [${sel[0]}]` : "(out of range)"}, ` +
+            `NOT the Chrome directory "Profile ${num}" (${dirNamed[1].user_name || dirNamed[0]}). ` +
+            `For an unambiguous match use the email or exact directory name, e.g. --profile ${hint}.`,
+          );
+        }
+        if (sel) console.log(`      selected: ${sel[1].user_name || "(no email)"} [${sel[0]}]`);
+        return sel;
+      }
       const needle = opts.profile.toLowerCase();
-      return available.find(([dir, info]) =>
+      const match = available.find(([dir, info]) =>
         dir.toLowerCase() === needle
         || (info.name ?? "").toLowerCase() === needle
         || (info.user_name ?? "").toLowerCase().includes(needle)
       ) ?? null;
+      if (match) console.log(`      selected: ${match[1].user_name || "(no email)"} [${match[0]}]`);
+      return match;
     }
     if (available.length === 1) {
       console.log(`      Only one profile available — selecting: ${available[0][1].user_name || available[0][0]}`);
@@ -1414,14 +1447,17 @@ async function status(): Promise<void> {
   const ping = await fetch(`${protocol}://${host}:${port}/`, { signal: AbortSignal.timeout(2000) }).catch(() => null);
   // Resolve the daemon's actual bind from its authenticated /ping (cross-platform; lsof is
   // POSIX-only and absent on Windows). bind is "0.0.0.0" (all interfaces) or the loopback IP.
-  const bind = ping
+  const pingBody = ping
     ? await fetch(`${protocol}://${host}:${port}/ping`, {
         headers: { Authorization: `Bearer ${parsed.key}` },
         signal: AbortSignal.timeout(2000),
-      }).then(r => (r.ok ? r.json() : null)).then((b: { bind?: string } | null) => b?.bind).catch(() => undefined)
-    : undefined;
+      }).then(r => (r.ok ? r.json() : null)).catch(() => null) as { bind?: string; degraded?: boolean; consecutiveTimeouts?: number } | null
+    : null;
+  const bind = pingBody?.bind;
   const listenAddr = bind ? `${bind}:${port}` : `${host}:${port}`;
   console.log(`serve:    ${ping ? `running  ${protocol}://${listenAddr}` : "not running"}`);
+  if (pingBody?.degraded)
+    console.log(`relay:    ⚠ degraded (${pingBody.consecutiveTimeouts} consecutive command timeouts) — if it persists, the daemon self-restarts; force it now with \`${PM_BIN} restart ${PM_PROCESS_NAME}\``);
   const pmOut = await pmList();
   const daemonRegistered = pmOut.includes(PM_PROCESS_NAME);
   console.log(`daemon:   ${daemonRegistered ? `${PM_BIN} (${PM_PROCESS_NAME})` : "not installed"}`);
@@ -1448,7 +1484,12 @@ function printHelp(): void {
 Usage:
   rech setup [--profile <num|email>] [--token <tok>]
                                First-time setup: daemon + Chrome extension + config
-                               --profile selects the Chrome profile non-interactively
+                               --profile selects the Chrome profile non-interactively.
+                               A bare number is the 1-based MENU INDEX (position in the
+                               listed order), NOT the Chrome directory "Profile N". For
+                               scripts prefer the email (e.g. --profile you@gmail.com) —
+                               it is the only unambiguous selector; an exact directory
+                               name ("Profile 1") also matches.
                                --token (or RECH_TOKEN) supplies the auth token for
                                non-TTY/agent runs, skipping the interactive paste
   rech provision-profile <name> --experimental [--headed]

package/rech.ts

@@ -104,7 +104,7 @@ function openInDefaultApp(target: string): void {
   const cmd = process.platform === "darwin" ? ["open", target]
     : process.platform === "win32" ? ["cmd", "/c", "start", "", target]
     : ["xdg-open", target];
-  try { Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore" }); } catch {}
+  try { Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore", windowsHide: true }); } catch {}
 }
 
 // Best-effort path to the Chrome executable for the current platform (used to open a
@@ -137,7 +137,7 @@ function openInChromeProfile(profileDir: string, target: string): boolean {
   try {
     Bun.spawn(
       [chromeBin, `--profile-directory=${profileDir}`, target],
-      { stdout: "ignore", stderr: "ignore", detached: true },
+      { stdout: "ignore", stderr: "ignore", detached: true, windowsHide: true },
     );
     return true;
   } catch {
@@ -200,7 +200,8 @@ function realpathSafe(p: string): string {
 
 async function gitOutput(args: string[], cwd: string): Promise<string | null> {
   try {
-    const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "ignore" });
+    // windowsHide: don't flash a console window on Windows (git.exe is a console app)
+    const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "ignore", windowsHide: true });
     const out = (await new Response(proc.stdout).text()).trim();
     await proc.exited;
     return out || null;
@@ -478,12 +479,18 @@ async function listProfiles(): Promise<void> {
     }
   }
 
-  const rows = Object.entries(cache).map(([dir, info]) => [
-    dir,
-    info.user_name || "",
-    info.name || "",
-    dir === currentDir ? "← current" : "",
-  ]);
+  // Header clarifies each column; email/nickname sit beside the profile dir so a bare
+  // "Profile N" is never shown alone. Only user_name (email) + name (nickname) are read
+  // from Local State — the gaia real name is deliberately never surfaced.
+  const rows = [
+    ["PROFILE", "EMAIL", "NICKNAME", ""],
+    ...Object.entries(cache).map(([dir, info]) => [
+      dir,
+      info.user_name || "",
+      info.name || "",
+      dir === currentDir ? "← current" : "",
+    ]),
+  ];
   const widths = rows.reduce((w, r) => r.map((c, i) => Math.max(w[i] ?? 0, c.length)), [] as number[]);
   for (const row of rows) {
     console.log(row.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd());
@@ -494,9 +501,13 @@ async function callServe(
   url: string,
   args: string[],
   overrideEnv?: Record<string, string>,
+  precomputedIdentity?: { key: string; label: string; profile?: string },
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
-  const identity = await getClientIdentity();
+  // Reuse the caller's identity when provided — computing it shells out to `git` several times,
+  // and run() has already done so for its log line. Recomputing here would double those git
+  // spawns (and, on Windows, the console-window flashes) on every `rech open`.
+  const identity = precomputedIdentity ?? await getClientIdentity();
   const effectiveProfile = resolveEffectiveProfile(profileDirectory);
   if (effectiveProfile) identity.profile = effectiveProfile;
   const env = { ...(await getClientEnv({ extensionId, extensionToken, profileDirectory, userDataDir, loadExtension })), ...overrideEnv };
@@ -545,7 +556,7 @@ async function run(url: string, args: string[]) {
   );
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory, userDataDir, loadExtension });
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args);
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, undefined, identity);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -658,6 +669,7 @@ async function runPm(args: string[], env?: Record<string, string>): Promise<numb
   const proc = Bun.spawn(["bunx", PM_BIN, ...args], {
     stdout: "inherit",
     stderr: "inherit",
+    windowsHide: true, // no console-window flash for the bunx/pm2 child on Windows
     ...(env ? { env: { ...process.env, ...env } } : {}),
   });
   await proc.exited;
@@ -667,7 +679,7 @@ async function runPm(args: string[], env?: Record<string, string>): Promise<numb
 // Capture the process-manager's process list as text (oxmgr `list` / pm2 `jlist`).
 // Both render the process name verbatim, so callers can substring-match it.
 async function pmList(): Promise<string> {
-  const proc = Bun.spawn(["bunx", PM_BIN, IS_WINDOWS ? "jlist" : "list"], { stdout: "pipe", stderr: "ignore" });
+  const proc = Bun.spawn(["bunx", PM_BIN, IS_WINDOWS ? "jlist" : "list"], { stdout: "pipe", stderr: "ignore", windowsHide: true });
   return await new Response(proc.stdout).text();
 }
 
@@ -983,7 +995,7 @@ async function provisionExtensionToken(opts: {
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
   args.push("about:blank");
-  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore" });
+  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
@@ -1198,13 +1210,34 @@ async function setup(opts: { profile?: string; token?: string } = {}): Promise<v
     );
     if (opts.profile !== undefined) {
       const num = parseInt(opts.profile);
-      if (!isNaN(num) && String(num) === opts.profile.trim()) return available[num - 1] ?? null;
+      if (!isNaN(num) && String(num) === opts.profile.trim()) {
+        // A bare integer is a 1-based MENU INDEX, NOT the Chrome directory literally named
+        // "Profile <N>". The two collide in the user's head: `--profile 1` selects the first
+        // *listed* profile (usually Default), not the dir "Profile 1". When such a dir exists
+        // and differs from the indexed pick, warn so the mismatch is caught; echo the resolved
+        // selection either way. Email is the unambiguous selector — steer toward it.
+        const sel = available[num - 1] ?? null;
+        const dirNamed = available.find(([dir]) => dir.toLowerCase() === `profile ${num}`);
+        if (dirNamed && dirNamed[0] !== sel?.[0]) {
+          const hint = dirNamed[1].user_name || `"Profile ${num}"`;
+          console.error(
+            `      [warn] --profile ${num} = menu index ${num} → ` +
+            `${sel ? `${sel[1].user_name || sel[0]} [${sel[0]}]` : "(out of range)"}, ` +
+            `NOT the Chrome directory "Profile ${num}" (${dirNamed[1].user_name || dirNamed[0]}). ` +
+            `For an unambiguous match use the email or exact directory name, e.g. --profile ${hint}.`,
+          );
+        }
+        if (sel) console.log(`      selected: ${sel[1].user_name || "(no email)"} [${sel[0]}]`);
+        return sel;
+      }
       const needle = opts.profile.toLowerCase();
-      return available.find(([dir, info]) =>
+      const match = available.find(([dir, info]) =>
         dir.toLowerCase() === needle
         || (info.name ?? "").toLowerCase() === needle
         || (info.user_name ?? "").toLowerCase().includes(needle)
       ) ?? null;
+      if (match) console.log(`      selected: ${match[1].user_name || "(no email)"} [${match[0]}]`);
+      return match;
     }
     if (available.length === 1) {
       console.log(`      Only one profile available — selecting: ${available[0][1].user_name || available[0][0]}`);
@@ -1414,14 +1447,17 @@ async function status(): Promise<void> {
   const ping = await fetch(`${protocol}://${host}:${port}/`, { signal: AbortSignal.timeout(2000) }).catch(() => null);
   // Resolve the daemon's actual bind from its authenticated /ping (cross-platform; lsof is
   // POSIX-only and absent on Windows). bind is "0.0.0.0" (all interfaces) or the loopback IP.
-  const bind = ping
+  const pingBody = ping
     ? await fetch(`${protocol}://${host}:${port}/ping`, {
         headers: { Authorization: `Bearer ${parsed.key}` },
         signal: AbortSignal.timeout(2000),
-      }).then(r => (r.ok ? r.json() : null)).then((b: { bind?: string } | null) => b?.bind).catch(() => undefined)
-    : undefined;
+      }).then(r => (r.ok ? r.json() : null)).catch(() => null) as { bind?: string; degraded?: boolean; consecutiveTimeouts?: number } | null
+    : null;
+  const bind = pingBody?.bind;
   const listenAddr = bind ? `${bind}:${port}` : `${host}:${port}`;
   console.log(`serve:    ${ping ? `running  ${protocol}://${listenAddr}` : "not running"}`);
+  if (pingBody?.degraded)
+    console.log(`relay:    ⚠ degraded (${pingBody.consecutiveTimeouts} consecutive command timeouts) — if it persists, the daemon self-restarts; force it now with \`${PM_BIN} restart ${PM_PROCESS_NAME}\``);
   const pmOut = await pmList();
   const daemonRegistered = pmOut.includes(PM_PROCESS_NAME);
   console.log(`daemon:   ${daemonRegistered ? `${PM_BIN} (${PM_PROCESS_NAME})` : "not installed"}`);
@@ -1448,7 +1484,12 @@ function printHelp(): void {
 Usage:
   rech setup [--profile <num|email>] [--token <tok>]
                                First-time setup: daemon + Chrome extension + config
-                               --profile selects the Chrome profile non-interactively
+                               --profile selects the Chrome profile non-interactively.
+                               A bare number is the 1-based MENU INDEX (position in the
+                               listed order), NOT the Chrome directory "Profile N". For
+                               scripts prefer the email (e.g. --profile you@gmail.com) —
+                               it is the only unambiguous selector; an exact directory
+                               name ("Profile 1") also matches.
                                --token (or RECH_TOKEN) supplies the auth token for
                                non-TTY/agent runs, skipping the interactive paste
   rech provision-profile <name> --experimental [--headed]

package/serve.js

@@ -55,6 +55,35 @@ export function isIsoSession(namespacedSession: string): boolean {
   return /(?:^|-)iso-[0-9a-f]+$/.test(namespacedSession);
 }
 
+// --- Relay health / self-heal ---------------------------------------------------------
+// The daemon spawns a short-lived CLI child per command, but all commands share a long-lived
+// per-session cliDaemon and a single extension↔relay path. Under sustained multi-session load
+// the relay can wedge: navigations (`open`) hang to the 60s cap while cheap calls still return,
+// and — critically — the wedge PERSISTS (every later command reuses the same broken cliDaemon),
+// so historically only a manual `oxmgr restart rechrome` cleared it. We heal automatically on
+// two layers, driven by real command timeouts (no synthetic probe → Chrome is never touched):
+//   - per-session: after SESSION_CLOSE_TIMEOUTS consecutive timeouts on ONE session, run the
+//     CLI `close` for it so the next command respawns a clean cliDaemon.
+//   - global: after WATCHDOG_TIMEOUTS consecutive timeouts across ALL sessions with no success
+//     in between (= the shared relay is dead), exit(1); oxmgr's `--restart always` respawns us
+//     clean and the extension WS reconnects. Each timeout burns 60s of wall time, so this can't
+//     spin faster than ~once/minute even under concurrent load.
+const SESSION_CLOSE_TIMEOUTS = Number(process.env.RECH_SESSION_CLOSE_TIMEOUTS) || 2;
+const WATCHDOG_TIMEOUTS = Number(process.env.RECH_WATCHDOG_TIMEOUTS) || 3;
+let consecutiveTimeouts = 0;                       // global; reset on any non-timeout /run
+const sessionTimeouts = new Map<string, number>(); // per-session consecutive-timeout streak
+// Most-recently-used non-iso sessions, so the deep health probe can target something real
+// instead of spawning a fresh session (which could open a browser window).
+const recentSessions = new Map<string, number>();
+function noteSession(sess: string, now: number): void {
+  recentSessions.set(sess, now);
+  if (recentSessions.size > 64) {
+    let oldestKey: string | undefined, oldestAt = Infinity;
+    for (const [k, t] of recentSessions) if (t < oldestAt) { oldestAt = t; oldestKey = k; }
+    if (oldestKey) recentSessions.delete(oldestKey);
+  }
+}
+
 function tmpSocketRoot(): string {
   return `${(process.env.TMPDIR || "/tmp").replace(/\/$/, "")}/playwright-cli`;
 }
@@ -92,6 +121,7 @@ function reapIdleIsoSessions(bin: string, binArgs: string[], workDir: string): v
         stdin: "ignore",
         stdout: "ignore",
         stderr: "ignore",
+        windowsHide: true, // hide the CLI child's console; the user's Chrome (a GUI grandchild) stays visible
         env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
       });
       log(`reaped idle isolated session (idle ${Math.round((now - last) / 1000)}s): ${sess}`);
@@ -112,7 +142,7 @@ async function renewCertIfNeeded(certPath: string, keyPath: string): Promise<boo
     if (!domain) { log("TLS cert renewal: could not determine domain"); return false; }
     log(`TLS cert expires in ${Math.floor(daysLeft)} days, renewing ${domain}...`);
     const proc = Bun.spawn([TAILSCALE_BIN, "cert", "--cert-file", certPath, "--key-file", keyPath, domain], {
-      stdout: "pipe", stderr: "pipe",
+      stdout: "pipe", stderr: "pipe", windowsHide: true,
     });
     const [status, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
     if (status !== 0) { log(`TLS cert renewal failed: ${stderr.trim()}`); return false; }
@@ -189,7 +219,7 @@ async function freeStalePort(port: number): Promise<void> {
         "  $h | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }",
         "}",
       ].join(" ");
-      const r = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command", ps]);
+      const r = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command", ps], { windowsHide: true });
       const out = r.stdout?.toString().trim();
       if (out) log(out);
     } else {
@@ -228,9 +258,13 @@ export async function serve() {
     }, 86_400_000);
   }
   const tls = certPath && keyPath ? { cert: Bun.file(certPath), key: Bun.file(keyPath) } : undefined;
-  const startServer = () => Bun.serve({
+  const startServer = (reusePort = false) => Bun.serve({
     hostname: listenHost,
     port,
+    // reusePort is used only as a last-resort fallback (see the bind loop below): if an orphaned
+    // holder can't be killed, binding with SO_REUSEADDR keeps serve up (degraded, port-shared)
+    // instead of crash-looping on EADDRINUSE. The normal path binds a clean, exclusive socket.
+    reusePort,
     tls,
     error(err) {
       log(`unhandled error: ${err.message}`);
@@ -254,7 +288,32 @@ export async function serve() {
       if (reqUrl.pathname === "/ping") {
         const denied = authCheck(req, key);
         if (denied) return denied;
-        return Response.json({ ok: true, bind: listenHost });
+        // Shallow ping proves only that the HTTP listener is up (it stayed up through past
+        // relay wedges). `degraded` surfaces the passive timeout streak from real traffic so
+        // clients / `rech status` can see trouble without an active probe.
+        const degraded = consecutiveTimeouts > 0;
+        if (!reqUrl.searchParams.get("deep"))
+          return Response.json({ ok: true, bind: listenHost, consecutiveTimeouts, degraded });
+        // Deep probe: exercise the relay read-only via `tab-list` (opens nothing) against the
+        // most-recently-used session — never a fresh one, which could spawn a browser window.
+        const target = [...recentSessions.entries()].sort((a, b) => b[1] - a[1])[0]?.[0];
+        if (!target)
+          return Response.json({ ok: true, bind: listenHost, relay: "idle", consecutiveTimeouts, degraded });
+        const [pbin, ...pbinArgs] = splitCommand(resolvePlaywrightCli());
+        const probe = Bun.spawn([pbin, ...pbinArgs, "tab-list", `-s=${target}`], {
+          cwd: workDir, stdin: "ignore", stdout: "ignore", stderr: "ignore",
+          windowsHide: true,
+          env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
+        });
+        const probeStatus = await Promise.race([
+          probe.exited,
+          new Promise<number>((r) => setTimeout(() => { probe.kill(); r(-1); }, 5000)),
+        ]);
+        const healthy = probeStatus !== -1;
+        return Response.json({
+          ok: healthy, bind: listenHost, relay: healthy ? "healthy" : "degraded",
+          consecutiveTimeouts, degraded: degraded || !healthy,
+        });
       }
       if (reqUrl.pathname !== "/run") return new Response("rech server\n");
       const denied = authCheck(req, key);
@@ -312,7 +371,9 @@ export async function serve() {
       });
       const namespacedSession = clientSession ? `${sessionId}-${clientSession}` : sessionId;
       // Track --isolate sessions so the idle-TTL reaper can close them later.
-      if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, Date.now());
+      const nowMs = Date.now();
+      if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, nowMs);
+      else noteSession(namespacedSession, nowMs); // for the deep health probe to target
 
       // daemonInstall bakes PLAYWRIGHT_CLI into the daemon env; resolvePlaywrightCli() is the
       // fallback for a standalone `serve` (it re-runs the same env > fork > @playwright/cli > legacy chain).
@@ -339,6 +400,7 @@ export async function serve() {
             stdin: "ignore",
             stdout: "pipe",
             stderr: "pipe",
+            windowsHide: true, // hide the CLI child's console; the user's Chrome (a GUI grandchild) stays visible
             env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
           });
           const [listStatus, listOut] = await Promise.race([
@@ -421,16 +483,20 @@ export async function serve() {
         stdin: "ignore",
         stdout: "pipe",
         stderr: "pipe",
+        windowsHide: true, // hide the CLI child's console; the user's Chrome (a GUI grandchild) stays visible
         env: childEnv,
       });
 
       const TIMEOUT = 60_000;
-      const timeout = new Promise<never>((_, reject) =>
-        setTimeout(() => {
+      let timedOut = false;
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const timeout = new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          timedOut = true;
           proc.kill();
           reject(new Error("timeout"));
-        }, TIMEOUT),
-      );
+        }, TIMEOUT);
+      });
       const [status, stdout, stderr] = await Promise.race([
         Promise.all([
           proc.exited,
@@ -441,9 +507,37 @@ export async function serve() {
       ]).catch(
         () => [1, "", `Command timed out after ${TIMEOUT / 1000}s\n`] as [number, string, string],
       ) as [number, string, string];
+      clearTimeout(timer);
 
       log(`exit: ${status}${stdout.trim() ? ` | ${stdout.trim().slice(0, 200)}` : ""}`);
 
+      // Relay self-heal (see notes at SESSION_CLOSE_TIMEOUTS): a command that RETURNS — even
+      // non-zero — proves the relay answered, so clear the streaks; a TIMEOUT means it didn't.
+      if (timedOut) {
+        consecutiveTimeouts++;
+        const streak = (sessionTimeouts.get(namespacedSession) ?? 0) + 1;
+        sessionTimeouts.set(namespacedSession, streak);
+        log(`timeout: session=${namespacedSession} sessionStreak=${streak} globalStreak=${consecutiveTimeouts}`);
+        if (streak >= SESSION_CLOSE_TIMEOUTS) {
+          log(`session ${namespacedSession} wedged (${streak} consecutive timeouts) — closing so the next command respawns a clean cliDaemon`);
+          try {
+            Bun.spawn([bin, ...binArgs, "close", `-s=${namespacedSession}`], {
+              cwd: workDir, stdin: "ignore", stdout: "ignore", stderr: "ignore",
+              windowsHide: true,
+              env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
+            });
+          } catch {}
+          sessionTimeouts.delete(namespacedSession);
+        }
+        if (consecutiveTimeouts >= WATCHDOG_TIMEOUTS) {
+          log(`relay wedged: ${consecutiveTimeouts} consecutive timeouts, no success between — exiting for oxmgr (--restart always) to respawn clean; extension WS will reconnect (Chrome untouched)`);
+          setTimeout(() => process.exit(1), 100); // brief delay to flush this response
+        }
+      } else {
+        consecutiveTimeouts = 0;
+        sessionTimeouts.delete(namespacedSession);
+      }
+
       // Detect files mentioned in output
       const filePattern = /[\w./-]+\.(?:png|jpe?g|pdf|json|yml)\b/gi;
       const mentionedFiles = [
@@ -482,17 +576,34 @@ export async function serve() {
     },
   });
 
-  // A leaked listening-socket handle in an orphaned cliDaemon can keep the port held after a
-  // prior serve exits; on EADDRINUSE, clear stale holders once and retry rather than crash-loop.
-  let server: ReturnType<typeof startServer>;
-  try {
-    server = startServer();
-  } catch (e: any) {
-    if (!String(e?.code ?? e?.message ?? "").includes("EADDRINUSE")) throw e;
-    log(`port ${port} in use — clearing stale daemon holders and retrying`);
-    await freeStalePort(port);
-    server = startServer();
+  // A leaked listening-socket handle in an orphaned cliDaemon can keep the port in LISTEN after a
+  // prior serve exits: Bun.serve creates the socket inheritable and Bun.spawn sweeps it into the
+  // detached daemon grandchild via bInheritHandles, so the socket outlives its creating serve.
+  // netstat then attributes the port to the now-dead *creator*, not the live holder, so we can't
+  // map port -> killable PID — freeStalePort kills the orphan by its cliDaemon signature instead.
+  // Retry a bounded number of times: the old single retry crash-looped whenever the OS hadn't yet
+  // released the socket after the kill (pm2 then restarts serve into the same race). As an absolute
+  // last resort, bind with reusePort so a holder we genuinely can't kill degrades to "up but sharing
+  // the port" rather than a permanent EADDRINUSE crash-loop.
+  const isEaddrInUse = (e: any) => String(e?.code ?? e?.message ?? "").includes("EADDRINUSE");
+  const MAX_BIND_ATTEMPTS = 4;
+  let server: ReturnType<typeof startServer> | undefined;
+  for (let attempt = 1; attempt <= MAX_BIND_ATTEMPTS; attempt++) {
+    try {
+      server = startServer();
+      break;
+    } catch (e: any) {
+      if (!isEaddrInUse(e)) throw e;
+      if (attempt === MAX_BIND_ATTEMPTS) {
+        log(`port ${port} still held after ${attempt - 1} cleanup attempts — binding with reusePort (last resort)`);
+        server = startServer(true);
+        break;
+      }
+      log(`port ${port} in use — clearing stale daemon holders and retrying (attempt ${attempt}/${MAX_BIND_ATTEMPTS - 1})`);
+      await freeStalePort(port);
+    }
   }
+  if (!server) throw new Error(`failed to bind port ${port}`);
 
   log(`serving on ${tls ? "https" : "http"}://${server.hostname}:${server.port}`);
   log(`Connection URL set (use .env.local to view)`);

package/serve.ts

@@ -55,6 +55,35 @@ export function isIsoSession(namespacedSession: string): boolean {
   return /(?:^|-)iso-[0-9a-f]+$/.test(namespacedSession);
 }
 
+// --- Relay health / self-heal ---------------------------------------------------------
+// The daemon spawns a short-lived CLI child per command, but all commands share a long-lived
+// per-session cliDaemon and a single extension↔relay path. Under sustained multi-session load
+// the relay can wedge: navigations (`open`) hang to the 60s cap while cheap calls still return,
+// and — critically — the wedge PERSISTS (every later command reuses the same broken cliDaemon),
+// so historically only a manual `oxmgr restart rechrome` cleared it. We heal automatically on
+// two layers, driven by real command timeouts (no synthetic probe → Chrome is never touched):
+//   - per-session: after SESSION_CLOSE_TIMEOUTS consecutive timeouts on ONE session, run the
+//     CLI `close` for it so the next command respawns a clean cliDaemon.
+//   - global: after WATCHDOG_TIMEOUTS consecutive timeouts across ALL sessions with no success
+//     in between (= the shared relay is dead), exit(1); oxmgr's `--restart always` respawns us
+//     clean and the extension WS reconnects. Each timeout burns 60s of wall time, so this can't
+//     spin faster than ~once/minute even under concurrent load.
+const SESSION_CLOSE_TIMEOUTS = Number(process.env.RECH_SESSION_CLOSE_TIMEOUTS) || 2;
+const WATCHDOG_TIMEOUTS = Number(process.env.RECH_WATCHDOG_TIMEOUTS) || 3;
+let consecutiveTimeouts = 0;                       // global; reset on any non-timeout /run
+const sessionTimeouts = new Map<string, number>(); // per-session consecutive-timeout streak
+// Most-recently-used non-iso sessions, so the deep health probe can target something real
+// instead of spawning a fresh session (which could open a browser window).
+const recentSessions = new Map<string, number>();
+function noteSession(sess: string, now: number): void {
+  recentSessions.set(sess, now);
+  if (recentSessions.size > 64) {
+    let oldestKey: string | undefined, oldestAt = Infinity;
+    for (const [k, t] of recentSessions) if (t < oldestAt) { oldestAt = t; oldestKey = k; }
+    if (oldestKey) recentSessions.delete(oldestKey);
+  }
+}
+
 function tmpSocketRoot(): string {
   return `${(process.env.TMPDIR || "/tmp").replace(/\/$/, "")}/playwright-cli`;
 }
@@ -92,6 +121,7 @@ function reapIdleIsoSessions(bin: string, binArgs: string[], workDir: string): v
         stdin: "ignore",
         stdout: "ignore",
         stderr: "ignore",
+        windowsHide: true, // hide the CLI child's console; the user's Chrome (a GUI grandchild) stays visible
         env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
       });
       log(`reaped idle isolated session (idle ${Math.round((now - last) / 1000)}s): ${sess}`);
@@ -112,7 +142,7 @@ async function renewCertIfNeeded(certPath: string, keyPath: string): Promise<boo
     if (!domain) { log("TLS cert renewal: could not determine domain"); return false; }
     log(`TLS cert expires in ${Math.floor(daysLeft)} days, renewing ${domain}...`);
     const proc = Bun.spawn([TAILSCALE_BIN, "cert", "--cert-file", certPath, "--key-file", keyPath, domain], {
-      stdout: "pipe", stderr: "pipe",
+      stdout: "pipe", stderr: "pipe", windowsHide: true,
     });
     const [status, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
     if (status !== 0) { log(`TLS cert renewal failed: ${stderr.trim()}`); return false; }
@@ -189,7 +219,7 @@ async function freeStalePort(port: number): Promise<void> {
         "  $h | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }",
         "}",
       ].join(" ");
-      const r = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command", ps]);
+      const r = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command", ps], { windowsHide: true });
       const out = r.stdout?.toString().trim();
       if (out) log(out);
     } else {
@@ -228,9 +258,13 @@ export async function serve() {
     }, 86_400_000);
   }
   const tls = certPath && keyPath ? { cert: Bun.file(certPath), key: Bun.file(keyPath) } : undefined;
-  const startServer = () => Bun.serve({
+  const startServer = (reusePort = false) => Bun.serve({
     hostname: listenHost,
     port,
+    // reusePort is used only as a last-resort fallback (see the bind loop below): if an orphaned
+    // holder can't be killed, binding with SO_REUSEADDR keeps serve up (degraded, port-shared)
+    // instead of crash-looping on EADDRINUSE. The normal path binds a clean, exclusive socket.
+    reusePort,
     tls,
     error(err) {
       log(`unhandled error: ${err.message}`);
@@ -254,7 +288,32 @@ export async function serve() {
       if (reqUrl.pathname === "/ping") {
         const denied = authCheck(req, key);
         if (denied) return denied;
-        return Response.json({ ok: true, bind: listenHost });
+        // Shallow ping proves only that the HTTP listener is up (it stayed up through past
+        // relay wedges). `degraded` surfaces the passive timeout streak from real traffic so
+        // clients / `rech status` can see trouble without an active probe.
+        const degraded = consecutiveTimeouts > 0;
+        if (!reqUrl.searchParams.get("deep"))
+          return Response.json({ ok: true, bind: listenHost, consecutiveTimeouts, degraded });
+        // Deep probe: exercise the relay read-only via `tab-list` (opens nothing) against the
+        // most-recently-used session — never a fresh one, which could spawn a browser window.
+        const target = [...recentSessions.entries()].sort((a, b) => b[1] - a[1])[0]?.[0];
+        if (!target)
+          return Response.json({ ok: true, bind: listenHost, relay: "idle", consecutiveTimeouts, degraded });
+        const [pbin, ...pbinArgs] = splitCommand(resolvePlaywrightCli());
+        const probe = Bun.spawn([pbin, ...pbinArgs, "tab-list", `-s=${target}`], {
+          cwd: workDir, stdin: "ignore", stdout: "ignore", stderr: "ignore",
+          windowsHide: true,
+          env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
+        });
+        const probeStatus = await Promise.race([
+          probe.exited,
+          new Promise<number>((r) => setTimeout(() => { probe.kill(); r(-1); }, 5000)),
+        ]);
+        const healthy = probeStatus !== -1;
+        return Response.json({
+          ok: healthy, bind: listenHost, relay: healthy ? "healthy" : "degraded",
+          consecutiveTimeouts, degraded: degraded || !healthy,
+        });
       }
       if (reqUrl.pathname !== "/run") return new Response("rech server\n");
       const denied = authCheck(req, key);
@@ -312,7 +371,9 @@ export async function serve() {
       });
       const namespacedSession = clientSession ? `${sessionId}-${clientSession}` : sessionId;
       // Track --isolate sessions so the idle-TTL reaper can close them later.
-      if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, Date.now());
+      const nowMs = Date.now();
+      if (isIsoSession(namespacedSession)) isoLastUsed.set(namespacedSession, nowMs);
+      else noteSession(namespacedSession, nowMs); // for the deep health probe to target
 
       // daemonInstall bakes PLAYWRIGHT_CLI into the daemon env; resolvePlaywrightCli() is the
       // fallback for a standalone `serve` (it re-runs the same env > fork > @playwright/cli > legacy chain).
@@ -339,6 +400,7 @@ export async function serve() {
             stdin: "ignore",
             stdout: "pipe",
             stderr: "pipe",
+            windowsHide: true, // hide the CLI child's console; the user's Chrome (a GUI grandchild) stays visible
             env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
           });
           const [listStatus, listOut] = await Promise.race([
@@ -421,16 +483,20 @@ export async function serve() {
         stdin: "ignore",
         stdout: "pipe",
         stderr: "pipe",
+        windowsHide: true, // hide the CLI child's console; the user's Chrome (a GUI grandchild) stays visible
         env: childEnv,
       });
 
       const TIMEOUT = 60_000;
-      const timeout = new Promise<never>((_, reject) =>
-        setTimeout(() => {
+      let timedOut = false;
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const timeout = new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          timedOut = true;
           proc.kill();
           reject(new Error("timeout"));
-        }, TIMEOUT),
-      );
+        }, TIMEOUT);
+      });
       const [status, stdout, stderr] = await Promise.race([
         Promise.all([
           proc.exited,
@@ -441,9 +507,37 @@ export async function serve() {
       ]).catch(
         () => [1, "", `Command timed out after ${TIMEOUT / 1000}s\n`] as [number, string, string],
       ) as [number, string, string];
+      clearTimeout(timer);
 
       log(`exit: ${status}${stdout.trim() ? ` | ${stdout.trim().slice(0, 200)}` : ""}`);
 
+      // Relay self-heal (see notes at SESSION_CLOSE_TIMEOUTS): a command that RETURNS — even
+      // non-zero — proves the relay answered, so clear the streaks; a TIMEOUT means it didn't.
+      if (timedOut) {
+        consecutiveTimeouts++;
+        const streak = (sessionTimeouts.get(namespacedSession) ?? 0) + 1;
+        sessionTimeouts.set(namespacedSession, streak);
+        log(`timeout: session=${namespacedSession} sessionStreak=${streak} globalStreak=${consecutiveTimeouts}`);
+        if (streak >= SESSION_CLOSE_TIMEOUTS) {
+          log(`session ${namespacedSession} wedged (${streak} consecutive timeouts) — closing so the next command respawns a clean cliDaemon`);
+          try {
+            Bun.spawn([bin, ...binArgs, "close", `-s=${namespacedSession}`], {
+              cwd: workDir, stdin: "ignore", stdout: "ignore", stderr: "ignore",
+              windowsHide: true,
+              env: { PATH: process.env.PATH, HOME: HOME, USERPROFILE: process.env.USERPROFILE },
+            });
+          } catch {}
+          sessionTimeouts.delete(namespacedSession);
+        }
+        if (consecutiveTimeouts >= WATCHDOG_TIMEOUTS) {
+          log(`relay wedged: ${consecutiveTimeouts} consecutive timeouts, no success between — exiting for oxmgr (--restart always) to respawn clean; extension WS will reconnect (Chrome untouched)`);
+          setTimeout(() => process.exit(1), 100); // brief delay to flush this response
+        }
+      } else {
+        consecutiveTimeouts = 0;
+        sessionTimeouts.delete(namespacedSession);
+      }
+
       // Detect files mentioned in output
       const filePattern = /[\w./-]+\.(?:png|jpe?g|pdf|json|yml)\b/gi;
       const mentionedFiles = [
@@ -482,17 +576,34 @@ export async function serve() {
     },
   });
 
-  // A leaked listening-socket handle in an orphaned cliDaemon can keep the port held after a
-  // prior serve exits; on EADDRINUSE, clear stale holders once and retry rather than crash-loop.
-  let server: ReturnType<typeof startServer>;
-  try {
-    server = startServer();
-  } catch (e: any) {
-    if (!String(e?.code ?? e?.message ?? "").includes("EADDRINUSE")) throw e;
-    log(`port ${port} in use — clearing stale daemon holders and retrying`);
-    await freeStalePort(port);
-    server = startServer();
+  // A leaked listening-socket handle in an orphaned cliDaemon can keep the port in LISTEN after a
+  // prior serve exits: Bun.serve creates the socket inheritable and Bun.spawn sweeps it into the
+  // detached daemon grandchild via bInheritHandles, so the socket outlives its creating serve.
+  // netstat then attributes the port to the now-dead *creator*, not the live holder, so we can't
+  // map port -> killable PID — freeStalePort kills the orphan by its cliDaemon signature instead.
+  // Retry a bounded number of times: the old single retry crash-looped whenever the OS hadn't yet
+  // released the socket after the kill (pm2 then restarts serve into the same race). As an absolute
+  // last resort, bind with reusePort so a holder we genuinely can't kill degrades to "up but sharing
+  // the port" rather than a permanent EADDRINUSE crash-loop.
+  const isEaddrInUse = (e: any) => String(e?.code ?? e?.message ?? "").includes("EADDRINUSE");
+  const MAX_BIND_ATTEMPTS = 4;
+  let server: ReturnType<typeof startServer> | undefined;
+  for (let attempt = 1; attempt <= MAX_BIND_ATTEMPTS; attempt++) {
+    try {
+      server = startServer();
+      break;
+    } catch (e: any) {
+      if (!isEaddrInUse(e)) throw e;
+      if (attempt === MAX_BIND_ATTEMPTS) {
+        log(`port ${port} still held after ${attempt - 1} cleanup attempts — binding with reusePort (last resort)`);
+        server = startServer(true);
+        break;
+      }
+      log(`port ${port} in use — clearing stale daemon holders and retrying (attempt ${attempt}/${MAX_BIND_ATTEMPTS - 1})`);
+      await freeStalePort(port);
+    }
   }
+  if (!server) throw new Error(`failed to bind port ${port}`);
 
   log(`serving on ${tls ? "https" : "http"}://${server.hostname}:${server.port}`);
   log(`Connection URL set (use .env.local to view)`);