rechrome 1.24.0 → 1.25.0

package/README.md

@@ -40,33 +40,69 @@ bun link
 
 Now `rechrome` (or `rech`) is available globally.
 
+`rech profile` and `rech profiles` are aliases that list installed Chrome profiles and registered managed test profiles together.
+Both also accept `ls` or `list`, for example `rechrome profiles ls`.
+The connection column checks each profile's default session for the current worktree without
+opening a browser: **Connected**, **Registered / idle**, **Registered / unknown** (the check
+could not complete), or **Not set up**. Sessions opened with a custom `-s` or from another
+worktree are outside this check. Managed test profiles are labeled separately from real Chrome.
+
 ## Quick start
 
+Agents setting up Chrome on macOS can use the [rechrome setup skill](skills/rechrome-setup/SKILL.md), which covers native extension installation with Computer Use and CLI connection verification.
+`rech setup` detects Codex and Claude Code environment hints and prints agent-specific guidance before the setup prompts. Set `RECH_SETUP_AGENT=codex`, `claude`, or `none` to override detection. Detection changes guidance only; desktop automation still follows the available tools and approval rules.
+
 ### 0. One-command setup (recommended)
 
 `rech setup` configures the daemon, Chrome extension, and connection URL in one pass:
 
+If no supported daemon manager is available, setup asks before installing `oxmgr` globally
+(default: No). It uses `bun i -g oxmgr` when launched with bunx and `npm i -g oxmgr`
+when launched with npx. Pass `--yes` to approve this installation without prompting,
+for example `bunx rechrome setup --profile Default --yes`.
+
 ```bash
-rech setup                          # interactive: pick a profile, follow the prompts
+rech setup                          # choose a network, then a Chrome profile
 rech setup --profile you@email.com  # non-interactive profile selection
+rech setup --listen tailscale --profile you@email.com
 ```
 
 What it does per Chrome profile:
 
-1. **Daemon** — installs/starts the `serve` daemon (skipped if already healthy).
-2. **Extension** — if the multi-tab extension isn't installed in the chosen profile, it opens an
+1. **Network** — choose where this profile should be accessible: Local (default),
+   LAN, Tailscale (only when detected), or another detected interface. One daemon
+   serves multiple addresses; changing this profile's exposure preserves other
+   profiles. Listener changes reload without restarting the daemon or Chrome.
+2. **Profile** — choose a Chrome profile; automatically select it when only one exists.
+3. **Extension** — if the multi-tab extension isn't installed in the chosen profile, it opens an
    install guide **in that exact profile**; load it once via `chrome://extensions → Load unpacked`
    (a one-time manual click — Chrome only allows unpacked extensions through the GUI).
-3. **Token** — once the extension is present, the auth token is **read automatically** from the
+4. **Token and connection** — once the extension is present, the auth token is **read automatically** from the
    profile's `localStorage` (no copy-paste). For headless/agent runs you can also pass it
    explicitly:
 
    ```bash
-   rech setup --profile 18 --token <PLAYWRIGHT_MCP_EXTENSION_TOKEN>   # or RECH_TOKEN=… rech setup …
+   rech setup --profile "Profile 18" --token <PLAYWRIGHT_MCP_EXTENSION_TOKEN>   # or RECH_TOKEN=… rech setup …
    ```
 
-`setup` is agent-friendly: it never blocks on a TTY, opens the guide in the right profile, and
-auto-reads the token, so a non-interactive run completes end-to-end once the extension is loaded.
+For unattended runs, `--listen local`, `--listen lan`, `--listen tailscale`, or
+`--listen <detected-IP>` chooses the network. Multiple LAN addresses require an
+explicit IP. Without `--listen`, setup selects local-only access for this profile.
+Choosing Local removes this profile from remote listener allowlists. LAN binds to the selected address,
+not `0.0.0.0`. Discovery lists IPv4 interfaces; it does not configure port forwarding
+or publish through external tunnel providers.
+
+`setup` opens a live guide in the selected profile. On macOS, the Extensions tab
+is immediately before the guide: copy the path, switch to the previous tab, choose
+Load unpacked, paste the path, and return. Setup monitors installation and reads
+the token automatically, then verifies the browser connection. The page updates
+without a refresh and offers Retry connection if the handshake fails.
+
+Manual token paste remains available in the guide and interactive terminal;
+`--token` / `RECH_TOKEN` also work. Keep the setup process running while using the
+guide. Installation/token detection and connection retries each time out after
+15 minutes. Non-interactive setup waits for browser installation rather than
+prompting for stdin, then uses the default configuration save location.
 
 > **Managed QA profiles (experimental):** `rech provision-profile <name> --experimental` spins up a
 > fully isolated profile on **Chrome for Testing** (run `npx playwright install chromium` first) with
@@ -105,10 +141,24 @@ rech tab-list
 rech --help
 ```
 
-rechrome walks up from the current working directory to find `.env.local`, so each project can have its own connection URL, Chrome profile, and extension token.
+rechrome walks up from the current working directory to find `.env.local`, so each project can have its own connection URL, Chrome profile, and extension token. Explicit environment variables take priority: `RECHROME_URL='http://KEY@host:13775' rech status` overrides the saved URL for that command.
 
 ## Configuration
 
+Profiles are stored in `~/.rechrome/profiles.yaml`. Existing `profiles.json` registries are also supported and automatically migrated on first read; the original JSON is retained as a private backup. YAML takes precedence when both exist. Registry writes are atomic and use owner-only permissions because entries contain Playwright bridge tokens. Invalid YAML fails explicitly instead of falling back to potentially stale JSON credentials.
+
+Connection parameters also accept URL fragments:
+
+```sh
+RECHROME_URL='https://your-host.ts.net/rechrome/?profile=qa#key=DAEMON_KEY' rech status
+```
+
+`rech setup` prints and saves this URI format. Retrieve it later with `rech profile qa --print-uri`, or omit `qa` to use the configured profile. `profiles` remains an alias. The command prints only the URI to stdout, using the configured `RECHROME_URL` endpoint; `--listener local` selects a local listener instead. For example: `rech profile qa --print-uri --listener local`. The output contains a secret daemon key.
+
+Direct connections use the root path, such as `http://127.0.0.1:13775/?profile=qa#key=DAEMON_KEY`. A prefix is optional and only added when explicitly configured with `--prefix`, for example for a proxy mounted at `/rechrome/`. Tailscale can also serve at the root without a prefix.
+
+Setup generates this format: the profile is in the query and the daemon listener's bearer `key` is in the fragment. The daemon looks up the registered profile's separate Playwright bridge token and browser paths locally. Advanced clients can still supply the bridge credential as `token` (for example `#key=DAEMON_KEY&token=BRIDGE_TOKEN`). Fragment parameters override matching query parameters; fragment `key` overrides legacy `KEY@host`. Both `#?key=…` and `#key=…` work. The CLI reads these locally and sends the daemon key as an Authorization header; fragments are omitted from HTTP request URLs. Opening the URL in a browser does not configure a client or display a dashboard. Fragments can still be stored in browser history and copied links, so treat the complete connection URL as a secret.
+
 Copy `.env.example` to `.env.local` and edit:
 
 ```bash
@@ -119,7 +169,7 @@ cp .env.example .env.local
 | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
 | `RECHROME_URL`                      | Connection URL (auto-generated by `rech serve`). Also accepts `?extension_id=`, `?token=`, `?profile=` query params                 | —                |
 | `PLAYWRIGHT_CLI`                    | Override the playwright-cli command/path (defaults to the bundled `@playwright/cli`; set this only for a custom or forked CLI)       | bundled `@playwright/cli` |
-| `RECH_HOST`                         | Server bind address                                                                                                                 | `127.0.0.1`      |
+| `RECH_HOST`                         | Legacy bind address, used only before listeners.json is configured                                                                  | `127.0.0.1`      |
 | `PLAYWRIGHT_MCP_EXTENSION_ID`       | Chrome extension ID (client overrides server)                                                                                       | —                |
 | `PLAYWRIGHT_MCP_EXTENSION_TOKEN`    | Chrome extension token — profile-specific, get it from the extension's status page (client overrides server)                        | —                |
 | `PLAYWRIGHT_MCP_USER_DATA_DIR`      | Chrome user data directory — use to pin connections to a specific Chrome install (client overrides server)                          | —                |
@@ -136,10 +186,59 @@ cp .env.example .env.local
 
 ### Remote access
 
-By default the server binds to `127.0.0.1` (localhost only). For remote access, either:
+`rech setup --profile <profile> --listen tailscale` exposes that profile through a
+dedicated authenticated listener while retaining local management. The daemon
+stores listener addresses, keys, and profile allowlists in `~/.rechrome/listeners.json`
+(mode 0600), reloads changes automatically, and rejects invalid changes while keeping
+the last working configuration. Each listener has its own bearer key. Use `rech profile ls`
+to see configured exposure, and `rech listener ls` to list bindings without credentials.
+
+```bash
+rech listener add qa --listen tailscale --profile qamac-remote --port 13776
+rech listener remove qa
+```
+
+Repeat `--profile` to allow several registered profiles. A profile may appear on
+multiple listeners; `setup --listen` selects its exposure afresh. Edit the protected
+JSON file to update an existing listener's allowlist or key. Changes do not terminate
+browser sessions; removed listeners reject further requests. An occupied or unavailable
+address causes reload to retain the old configuration, so verify reachability after editing.
+
+Remote listeners permit navigation, tabs, snapshots, screenshots, and basic page interactions.
+They reject arbitrary `run-code`/`eval`, filesystem commands, global session commands, and
+browser/config overrides. Those commands remain available on the unrestricted **loopback
+management listener**. Scoped sessions and output directories are separate from management
+sessions; a listener cannot download another profile's output. This is an application access
+policy, not an OS sandbox for the browser. Never publish the management listener through a
+proxy or tunnel to clients that should have restricted access.
+
+LAN traffic is plain HTTP unless TLS is configured. Tailscale provides its private transport;
+binding an address does not configure Tailscale ACLs, port forwarding, or public tunnels.
+
+To mount rechrome under a Tailscale Serve path, use a separate scoped loopback listener:
+
+```bash
+rech setup --profile taku3 --listen local --prefix=rechrome --port=13776
+tailscale serve --bg --https=443 --set-path=/rechrome http://127.0.0.1:13776/rechrome
+```
 
-- Use an SSH tunnel: `ssh -L 13775:localhost:13775 server-host`
-- Or set `RECH_HOST=0.0.0.0` (⚠️ ensure network is trusted — traffic is plain HTTP)
+`--prefix=rechrome` and `--prefix=/rechrome/` both normalize to `/rechrome/`.
+Without `--port`, prefixed setup reuses a matching scoped listener or defaults to
+the management port plus one. Existing profiles can also use
+`rech listener add qa-proxy --listen local --profile <profile> --port 13776 --prefix=rechrome`.
+Setup prints the matching Serve command but does not run it or change existing Serve routes.
+Include the path in the proxy target: Serve strips the mount path and the target restores it.
+
+For remote clients, change the saved connection URL's origin to
+`https://<machine>.<tailnet>.ts.net`, retaining `/rechrome/`, the listener's bearer
+userinfo, and the profile query. Health checks, commands, and file downloads honor
+that base path. The setup guide remains a temporary local page owned by the setup
+process; it is not published through Serve. Never proxy the unrestricted management listener.
+
+Existing installations retain the legacy listener until `rech setup` initializes the new
+configuration. The first migration restarts only the daemon to load the new source. Existing
+remote access is retained for currently registered profiles with a **new scoped key**; remote
+clients need the new listener credentials. Browser processes are left running.
 
 ## Session namespacing
 

package/daemon-manager.js

@@ -0,0 +1,71 @@
+// @bun
+// daemon-manager.ts
+var OXMGR_WINFIX_BASE = "0.4.0";
+function compareVersion(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0;i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0)
+      return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function oxmgrHasWinfix(version) {
+  if (!version)
+    return false;
+  const plus = version.indexOf("+");
+  const base = plus === -1 ? version : version.slice(0, plus);
+  const build = plus === -1 ? "" : version.slice(plus + 1);
+  if (build.includes("winfix"))
+    return true;
+  return compareVersion(base.trim(), OXMGR_WINFIX_BASE) > 0;
+}
+function pickDaemonManager(opts) {
+  const override = opts.override?.toLowerCase();
+  if (override === "oxmgr" && !opts.oxmgrBin) {
+    throw new Error("RECH_DAEMON_MANAGER=oxmgr, but oxmgr is not on PATH. Install oxmgr and add it to PATH, or install pm2 with `bun add -g pm2` and set RECH_DAEMON_MANAGER=pm2.");
+  }
+  if (override === "pm2" && !opts.pm2Bin) {
+    throw new Error("RECH_DAEMON_MANAGER=pm2, but pm2 is not on PATH. Install it with `bun add -g pm2` and ensure the global bin directory is on PATH.");
+  }
+  if (!opts.oxmgrBin && !opts.pm2Bin) {
+    throw new Error("No daemon process manager found on PATH (oxmgr or pm2). Install pm2 with `bun add -g pm2`, ensure the global bin directory is on PATH, then rerun `bunx rechrome setup`.");
+  }
+  const oxmgr = { id: "oxmgr", bin: opts.oxmgrBin ?? "oxmgr" };
+  const pm2 = { id: "pm2", bin: opts.pm2Bin ?? "pm2" };
+  if (override === "pm2")
+    return pm2;
+  if (override === "oxmgr")
+    return oxmgr;
+  if (opts.isWindows) {
+    if (opts.oxmgrBin && oxmgrHasWinfix(opts.oxmgrVersion))
+      return oxmgr;
+    if (opts.pm2Bin)
+      return pm2;
+    return oxmgr;
+  }
+  if (opts.oxmgrBin)
+    return oxmgr;
+  if (opts.pm2Bin)
+    return pm2;
+  return oxmgr;
+}
+function oxmgrInstallCommand(env) {
+  const agent = env.npm_config_user_agent?.toLowerCase() ?? "";
+  if (agent.startsWith("npm/"))
+    return ["npm", "i", "-g", "oxmgr"];
+  if (agent.startsWith("bun/"))
+    return ["bun", "i", "-g", "oxmgr"];
+  const execPath = env.npm_execpath?.replace(/\\/g, "/") ?? "";
+  if (/(^|\/)(npm|npx)(-cli\.js|\.cmd|\.exe)?$/i.test(execPath))
+    return ["npm", "i", "-g", "oxmgr"];
+  return ["bun", "i", "-g", "oxmgr"];
+}
+export {
+  OXMGR_WINFIX_BASE,
+  compareVersion,
+  oxmgrHasWinfix,
+  oxmgrInstallCommand,
+  pickDaemonManager
+};

package/daemon-manager.ts

@@ -0,0 +1,99 @@
+// Process-manager selection policy for the `rech serve` daemon.
+//
+// oxmgr is the cross-platform default. On Windows, stock oxmgr 0.4.0 wedges after
+// a daemon crash: it leaves the daemon's control socket bound to a dead PID, so
+// every subsequent oxmgr command fails with "daemon did not become ready in
+// time". The snomiao/OxMgr fork fixes it and stamps the build `0.4.0+winfix`.
+// We therefore only PREFER oxmgr on Windows when the winfix build is present;
+// stock 0.4.0 falls back to pm2's named-pipe daemon, which has no such failure
+// mode. POSIX oxmgr is unaffected and stays the default there.
+//
+// This module is deliberately pure (no Bun/process/fs) so the selection policy is
+// unit-testable; the impure probing (Bun.which, `oxmgr --version`) lives in
+// rechrome.ts and feeds its results into pickDaemonManager.
+
+export type DaemonManager = { id: "oxmgr" | "pm2"; bin: string };
+
+// Base version that first shipped the winfix build tag. A strictly newer base
+// version is assumed to carry the fix upstream even without the explicit
+// `+winfix` tag, so a future release doesn't get pinned out.
+export const OXMGR_WINFIX_BASE = "0.4.0";
+
+// Compare dotted numeric versions (major.minor.patch); any build/prerelease
+// suffix must be stripped by the caller. Returns <0, 0, or >0.
+export function compareVersion(a: string, b: string): number {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+// True when an `oxmgr --version` string reports a build carrying the Windows
+// daemon-wedge fix: the `+winfix` build tag, OR a base version newer than the
+// 0.4.0 that first shipped it. Anything older/unknown/empty is treated as
+// unfixed so a Windows install falls back to pm2 rather than the wedge.
+export function oxmgrHasWinfix(version: string | null | undefined): boolean {
+  if (!version) return false;
+  const plus = version.indexOf("+");
+  const base = plus === -1 ? version : version.slice(0, plus);
+  const build = plus === -1 ? "" : version.slice(plus + 1);
+  if (build.includes("winfix")) return true;
+  return compareVersion(base.trim(), OXMGR_WINFIX_BASE) > 0;
+}
+
+// Decide which manager daemonizes `rech serve`, given what's discoverable at
+// runtime. `override` is RECH_DAEMON_MANAGER (case-insensitive) and, when set to
+// a known manager, wins outright — bypassing the winfix guard as an explicit
+// opt-in. The `*Bin` inputs are resolved executable paths (null when not on
+// PATH). Missing dependencies fail here, before callers mutate configuration.
+export function pickDaemonManager(opts: {
+  oxmgrBin: string | null;
+  pm2Bin: string | null;
+  oxmgrVersion: string | null;
+  isWindows: boolean;
+  override?: string | null;
+}): DaemonManager {
+  const override = opts.override?.toLowerCase();
+  if (override === "oxmgr" && !opts.oxmgrBin) {
+    throw new Error("RECH_DAEMON_MANAGER=oxmgr, but oxmgr is not on PATH. Install oxmgr and add it to PATH, or install pm2 with `bun add -g pm2` and set RECH_DAEMON_MANAGER=pm2.");
+  }
+  if (override === "pm2" && !opts.pm2Bin) {
+    throw new Error("RECH_DAEMON_MANAGER=pm2, but pm2 is not on PATH. Install it with `bun add -g pm2` and ensure the global bin directory is on PATH.");
+  }
+  if (!opts.oxmgrBin && !opts.pm2Bin) {
+    throw new Error("No daemon process manager found on PATH (oxmgr or pm2). Install pm2 with `bun add -g pm2`, ensure the global bin directory is on PATH, then rerun `bunx rechrome setup`.");
+  }
+  const oxmgr: DaemonManager = { id: "oxmgr", bin: opts.oxmgrBin ?? "oxmgr" };
+  const pm2: DaemonManager = { id: "pm2", bin: opts.pm2Bin ?? "pm2" };
+
+  if (override === "pm2") return pm2;
+  if (override === "oxmgr") return oxmgr;
+
+  if (opts.isWindows) {
+    // Prefer oxmgr only when it carries the winfix; otherwise pm2. If pm2 is
+    // missing, fall back to oxmgr regardless — a possibly-wedging manager still
+    // beats none, and the operator can install pm2 or the winfix build.
+    if (opts.oxmgrBin && oxmgrHasWinfix(opts.oxmgrVersion)) return oxmgr;
+    if (opts.pm2Bin) return pm2;
+    return oxmgr;
+  }
+
+  // POSIX: oxmgr preferred, pm2 fallback.
+  if (opts.oxmgrBin) return oxmgr;
+  if (opts.pm2Bin) return pm2;
+  return oxmgr;
+}
+
+// npm/npx sets npm_config_user_agent even when the CLI's shebang runs Bun.
+// Prefer launcher metadata over the runtime, which is Bun for both launchers.
+export function oxmgrInstallCommand(env: { npm_config_user_agent?: string; npm_execpath?: string; [name: string]: string | undefined }):["bun" | "npm", "i", "-g", "oxmgr"] {
+  const agent = env.npm_config_user_agent?.toLowerCase() ?? "";
+  if (agent.startsWith("npm/")) return ["npm", "i", "-g", "oxmgr"];
+  if (agent.startsWith("bun/")) return ["bun", "i", "-g", "oxmgr"];
+  const execPath = env.npm_execpath?.replace(/\\/g, "/") ?? "";
+  if (/(^|\/)(npm|npx)(-cli\.js|\.cmd|\.exe)?$/i.test(execPath)) return ["npm", "i", "-g", "oxmgr"];
+  return ["bun", "i", "-g", "oxmgr"];
+}

package/extension/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Portions Copyright (c) Microsoft Corporation.
+   Portions Copyright 2017 Google Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/extension/MODIFICATIONS.md

@@ -0,0 +1,19 @@
+# Rechrome extension modifications
+
+Derived from microsoft/playwright, Apache-2.0. Upstream extension baseline:
+`bb6c00957` (extension 0.2.1); audited fork revision: `62472742d`.
+
+Modified by rechrome contributors:
+
+- `manifest.json`: version and tab-group permission for the fork.
+- `src/background.ts`, `src/connectedTabGroup.ts`, `src/pendingConnection.ts`,
+  `src/relayConnection.ts`: concurrent clients, client tab groups, shorter titles,
+  and recovery from stalled relay connections.
+- `src/ui/connect.tsx`: client name forwarding on token-bypass connections and
+  recovery from a stalled extension service worker.
+- `vite.config.mts`, `vite.sw.config.mts`: ship licensing documents and retain
+  modification notices in generated bundles through `licensePlugin.ts`.
+
+Generated JavaScript and the manifest in the shipped extension incorporate these
+changes. Upstream copyright and license notices remain applicable. Rechrome's
+root MIT license does not replace the Apache-2.0 terms for inherited code.

package/extension/NOTICE

@@ -0,0 +1,10 @@
+Playwright
+Copyright (c) Microsoft Corporation
+
+This software contains code derived from the Puppeteer project (https://github.com/puppeteer/puppeteer),
+available under the Apache 2.0 license (https://github.com/puppeteer/puppeteer/blob/master/LICENSE).
+
+Rechrome extension fork
+Modifications Copyright (c) 2026 rechrome contributors.
+This is an independently maintained fork, not an official Microsoft release.
+See MODIFICATIONS.md for changes and THIRD_PARTY_NOTICES.txt for bundled dependencies.