rechrome 1.31.2 → 1.31.4

package/README.md

@@ -74,6 +74,8 @@ between calls; another worktree gets its own. `-s=<name>` opens a named sub-sess
 `<project>` is the git worktree root (submodules count as their parent project), or the current
 directory outside git. rechrome reads `RECHROME_URL` from the nearest `.rechrome/.env.local` or
 `.env.local` walking up from the current directory; an explicit environment variable wins.
+When editing a file by hand, quote the URL (`RECHROME_URL="…#key=…"`): unquoted, a `#` starts a
+comment for some .env loaders. rech quotes it when it saves one.
 
 ### 4. Use it from another machine
 
@@ -106,7 +108,7 @@ rech open https://example.com
 `.rechrome/.env.local`. Remote listeners allow navigation, tabs, snapshots, screenshots and basic
 interactions, but not `eval`/`run-code` or filesystem commands (see [Remote access](#remote-access)).
 
-**Share several profiles in one link.** `rech share work@example.com taku2 symval-dev` puts
+**Share several profiles in one link.** `rech share work@example.com personal team-dev` puts
 exactly those profiles on one listener (its own key; running it again reuses it). Add
 `--listener <name>` to use a listener that already has a proxy route. Its links then reach
 exactly this list, and `rech listener rotate-key <name>` issues a fresh key if old links shouldn't.
@@ -262,7 +264,7 @@ the last working configuration. Each listener has its own bearer key. Use `rech
 to see configured exposure, and `rech listener ls` to list bindings without credentials.
 
 ```bash
-rech listener add qa --listen tailscale --profile qamac-remote --port 13776
+rech listener add qa --listen tailscale --profile qa-remote --port 13776
 rech listener remove qa
 ```
 

package/listeners.ts

@@ -142,7 +142,7 @@ const profileIdentity = (e: RegisteredProfile) => `${e.userDataDir ?? ""}\0${e.p
 
 /**
  * One registry key per Chrome profile (a profile can be registered under several aliases,
- * e.g. "Profile 5" and "taku2"): prefer an email, else the alphabetically first key.
+ * e.g. "Profile 5" and "personal"): prefer an email, else the alphabetically first key.
  */
 export function canonicalProfileKeys(registry: Record<string, RegisteredProfile>): string[] {
   const byProfile = new Map<string, string>();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.31.2",
+  "version": "1.31.4",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -88,7 +88,44 @@ const globalEnvFile = join(HOME || "~", ".env.local");
 
 // Capture inherited values once so explicit environment overrides survive reloads,
 // while values loaded from files can still change when those files are edited.
-const inheritedEnvKeys = new Set(Object.keys(process.env));
+/**
+ * A KEY=value line for an env file. A value with "#" (every connection URL's #key=…) or
+ * whitespace is double-quoted: Bun's own .env loader treats an unquoted "#" as a comment and
+ * would drop the key. rech's loader strips the quotes again.
+ */
+export function envAssignment(key: string, value: string): string {
+  return /[#\s]/.test(value) ? `${key}="${value}"` : `${key}=${value}`;
+}
+
+/** Parse KEY=value lines the way Bun's .env loader does (unquoted values end at "#"). */
+function parseBunEnvFile(text: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const line of text.split("\n")) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*)$/);
+    if (!m) continue;
+    const raw = m[2].trim();
+    const quoted = raw.match(/^(["'`])(.*)\1/);
+    out[m[1]] = quoted ? quoted[2] : raw.replace(/\s*#.*$/, "").trim();
+  }
+  return out;
+}
+
+/**
+ * Keys Bun itself loaded from the current folder's .env files before rech started. They look
+ * like shell exports, but are file values: counting them as inherited would let a folder's
+ * .env.local beat its .rechrome/.env.local, and a keyless (cut at "#") URL beat a good one.
+ */
+export function bunAutoloadedKeys(env: Record<string, string | undefined>, files: string[]): Set<string> {
+  const keys = new Set<string>();
+  for (const text of files)
+    for (const [key, value] of Object.entries(parseBunEnvFile(text))) if (env[key] === value) keys.add(key);
+  return keys;
+}
+
+const bunLoaded = bunAutoloadedKeys(process.env,
+  [".env", `.env.${process.env.NODE_ENV || "development"}`, ".env.local", `.env.${process.env.NODE_ENV || "development"}.local`]
+    .map(name => { try { return readFileSync(join(process.cwd(), name), "utf8"); } catch { return ""; } }));
+const inheritedEnvKeys = new Set(Object.keys(process.env).filter(key => !bunLoaded.has(key)));
 
 // Walk CWD→root loading env files nearest-first; inherited environment wins over files.
 // At each level .rechrome/.env.local is checked before .env.local (rechrome-specific overrides general).
@@ -362,7 +399,18 @@ export async function detectListenChoices(): Promise<ListenChoice[]> {
   return buildListenChoices(networkInterfaces(), ips);
 }
 
-export type TailscaleServe = { dnsName: string | null; routeUrl: string | null };
+/**
+ * `funnel`: Funnel (public internet) is on for the host that serves — or would serve — this
+ * node's routes, so a route there is not tailnet-only. `mounts`: every Serve path in use.
+ */
+export type TailscaleServe = { dnsName: string | null; routeUrl: string | null; funnel: boolean; mounts: string[] };
+
+export function serveMountsAndFunnel(serveStatus: unknown, host: string | null): { mounts: string[]; funnel: boolean } {
+  const status = serveStatus as { Web?: Record<string, { Handlers?: Record<string, unknown> }>; AllowFunnel?: Record<string, boolean> } | null;
+  const mounts = Object.values(status?.Web ?? {}).flatMap(config => Object.keys(config.Handlers ?? {}).map(path => path.replace(/\/+$/, "") || "/"));
+  const funnel = Object.entries(status?.AllowFunnel ?? {}).some(([hostPort, on]) => on && (!host || hostPort.split(/:(?=\d+$)/)[0] === host));
+  return { mounts: [...new Set(mounts)], funnel };
+}
 
 /**
  * Find the HTTPS Serve route that forwards `prefix` to a loopback listener on `port`,
@@ -393,7 +441,8 @@ export async function detectTailscaleServe(port: number, prefix: string): Promis
   let serveStatus: unknown = null;
   try { dnsName = (JSON.parse(status ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") || null; } catch { /* not connected */ }
   try { serveStatus = JSON.parse(serve ?? "null"); } catch { /* no Serve config */ }
-  return { dnsName, routeUrl: findTailscaleServeRoute(dnsName, serveStatus, port, prefix) };
+  const routeUrl = findTailscaleServeRoute(dnsName, serveStatus, port, prefix);
+  return { dnsName, routeUrl, ...serveMountsAndFunnel(serveStatus, routeUrl ? new URL(routeUrl).hostname : dnsName) };
 }
 
 /** The same connection (key and profile) at another base URL, e.g. where a proxy exposes the listener. */
@@ -425,7 +474,7 @@ export async function getOrCreateUrl(persist = true): Promise<string> {
   const key = randomBytes(12).toString("base64url"); // 16 chars
   const url = `http://${key}@127.0.0.1:${DEFAULT_PORT}`;
   if (persist) {
-    const newLine = `${ENV_KEY}=${url}`;
+    const newLine = envAssignment(ENV_KEY, url);
     // Write to ~/.env.local so it's not shadowed by project .env.local
     const envRaw = await file(globalEnvFile).text().catch(() => "");
     const lines = envRaw.trimEnd().split("\n").filter(l => !l.startsWith(`${ENV_KEY}=`));
@@ -1091,7 +1140,7 @@ export function chooseShareListener(profile: string, listeners: Listener[]): str
   throw new ShareListenerError([
     `"${profile}" isn't shared on any listener yet.`,
     scoped.length ? `  Allow it on one:  rech listener allow ${scoped[0].name} ${JSON.stringify(profile)}   (listeners: ${scoped.map(l => l.name).join(", ")})` : "",
-    `  Or create one:    rech listener add share --listen local --prefix=rechrome --port 13776 --profile ${JSON.stringify(profile)}`,
+    `  ${scoped.length ? "Or give" : "Give"} it its own link:  rech share ${JSON.stringify(profile)}   (in a terminal it asks who should connect)`,
   ].filter(Boolean).join("\n"), "none", scoped);
 }
 
@@ -1142,7 +1191,7 @@ async function shareProfiles(selectors: string[], opts: { listener?: string; loc
 }
 
 /** Put exactly `snapshot` on one scoped listener (created if missing) and print its link. */
-async function shareSet(snapshot: string[], opts: { listener?: string; local?: boolean; save?: boolean; defaultName: string; prefix: string; again: string }): Promise<void> {
+async function shareSet(snapshot: string[], opts: { listener?: string; local?: boolean; save?: boolean; defaultName: string; prefix: string; again: string; host?: string; tailscaleServe?: boolean }): Promise<void> {
   const config = await requireListeners();
   const name = opts.listener ?? opts.defaultName;
   let listener = config.listeners.find(l => l.name === name);
@@ -1151,7 +1200,7 @@ async function shareSet(snapshot: string[], opts: { listener?: string; local?: b
   let changes = "";
   if (!listener) {
     if (opts.listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
-    listener = { name, host: "127.0.0.1", port: freeListenerPort(config.listeners), prefix: opts.prefix, key: randomBytes(24).toString("base64url"), profiles: snapshot };
+    listener = { name, host: opts.host ?? "127.0.0.1", port: freeListenerPort(config.listeners), prefix: opts.prefix, key: randomBytes(24).toString("base64url"), profiles: snapshot };
     config.listeners.push(listener);
     changes = `created listener "${name}" on ${listenerAddress(listener)}${listener.prefix}`;
   } else {
@@ -1161,24 +1210,100 @@ async function shareSet(snapshot: string[], opts: { listener?: string; local?: b
     changes = added.length || removed.length ? [added.length && `added ${added.join(", ")}`, removed.length && `removed ${removed.join(", ")}`].filter(Boolean).join("; ") : "no changes";
   }
   await writeListeners(config);
-  console.error(`[rech] sharing ${snapshot.length} profiles through "${name}" (${changes}): ${snapshot.join(", ")}`);
+  if (changes.startsWith("created") && snapshot.length === 1) console.error(`New link "${name}" for ${snapshot[0]}.`);
+  else console.error(`[rech] sharing ${snapshot.length} profiles through "${name}" (${changes}): ${snapshot.join(", ")}`);
   if (opts.defaultName === "share-all") console.error(`[rech] this is a snapshot: after registering another profile, run ${opts.again} again.`);
   else if (changes !== "no changes" && !changes.startsWith("created")) console.error(`[rech] links already given out for "${name}" now reach exactly these profiles too (same key). For a fresh key: rech listener rotate-key ${name}`);
   // The daemon reloads listeners.json about every second: confirm this listener answers before handing out its URL.
-  const local = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}`;
+  // A one-profile link names its profile, so the other machine needs no --profile.
+  const only = snapshot.length === 1 ? `?profile=${encodeURIComponent(snapshot[0])}` : "";
+  const local = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}${only}`;
   let ready = false;
   for (let i = 0; i < 20 && !ready; i++) {
     ready = await fetch(serviceUrl(local, "ping"), { headers: { Authorization: `Bearer ${listener.key}` }, signal: AbortSignal.timeout(1000) }).then(r => r.ok).catch(() => false);
     if (!ready) await Bun.sleep(250);
   }
   if (!ready) console.error(`[rech] warning: listener "${name}" is not answering yet; check the daemon with rech status.`);
+  if (opts.tailscaleServe && !listener.publicUrl) {
+    const publicUrl = await exposeWithTailscaleServe(listener);
+    if (publicUrl) {
+      listener.publicUrl = publicUrl;
+      await writeListeners(config);
+    }
+  }
   const uri = listener.publicUrl && !opts.local ? rebaseConnectionUrl(listener.publicUrl, local) : registeredProfileUrl(local);
-  if (!listener.publicUrl) for (const line of listenerNextSteps(listener, undefined, opts.again)) console.error(line);
+  if (!listener.publicUrl && isLoopback(listener.host)) for (const line of listenerNextSteps(listener, undefined, opts.again)) console.error(line);
   console.log(uri);
-  console.error(`[rech] on the other machine: rech connect '<url>', then rech --profile <name> open https://example.com`);
+  console.error(snapshot.length === 1 ? `On the other machine: rech connect '<this link>'` : `On the other machine: rech connect '<this link>', then rech --profile <name> open <url>`);
   if (opts.save) console.error(`Saved RECHROME_URL to ${await saveProjectUrl(uri)}`);
 }
 
+/** A readable, URL-safe name for a profile's link: the email's local part or the profile name. */
+export function profileSlug(profile: string): string {
+  const slug = profile.split("@")[0].toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32);
+  return slug || "profile";
+}
+
+/**
+ * `base`, or `base-2`, `base-3`… — the first name whose listener and path are free. Never a
+ * reserved name (`share --all` and `share a b` reuse theirs and rewrite their allowlists, so a
+ * one-profile link under such a name would later grant its key more profiles), and never a
+ * mount a proxy already serves (Tailscale Serve would replace that route).
+ */
+export function uniqueShareName(base: string, listeners: Listener[], servedMounts: string[] = []): string {
+  const reserved = (name: string) => name === "local" || name === "share-all" || /^share-[0-9a-f]{6}$/.test(name);
+  const taken = (name: string) => reserved(name) || servedMounts.includes(`/rechrome/${name}`)
+    || listeners.some(l => l.name === name || normalizePrefix(l.prefix) === `/rechrome/${name}/`);
+  for (let i = 1; ; i++) { const name = i === 1 ? base : `${base}-${i}`; if (!taken(name)) return name; }
+}
+
+/** Route a loopback listener through Tailscale Serve (HTTPS, tailnet only); returns its public URL. */
+async function exposeWithTailscaleServe(listener: Listener): Promise<string | null> {
+  const prefix = normalizePrefix(listener.prefix);
+  const existing = await detectTailscaleServe(listener.port, prefix);
+  if (existing.funnel) {
+    console.error("Tailscale Funnel is on for this machine, so a Serve route here would be public, not tailnet-only. Not exposing it.\n  Turn Funnel off (tailscale funnel reset), then rech share again.");
+    return null;
+  }
+  if (existing.routeUrl) return existing.routeUrl;
+  const binary = tailscaleBinary();
+  if (!binary) return null;
+  const mount = prefix === "/" ? "/" : prefix.slice(0, -1);
+  const args = ["serve", "--bg", `--set-path=${mount}`, `http://127.0.0.1:${listener.port}${mount === "/" ? "" : mount}`];
+  console.error(`Running: tailscale ${args.join(" ")}`);
+  const proc = Bun.spawn([binary, ...args], { stdout: "ignore", stderr: "inherit", windowsHide: true });
+  if (await proc.exited !== 0) {
+    console.error(`tailscale serve failed. Run it yourself, then rech share again:\n  tailscale ${args.join(" ")}`);
+    return null;
+  }
+  return (await detectTailscaleServe(listener.port, prefix)).routeUrl;
+}
+
+/**
+ * Give one profile its own link. In a terminal, ask how the other machines will reach it
+ * (Tailscale Serve, a detected network, or the user's own proxy); without one, create a
+ * loopback link, like `rech share a b`.
+ */
+async function shareNewLink(profile: string, opts: { local?: boolean; save?: boolean }): Promise<void> {
+  const served = tailscaleBinary() ? (await detectTailscaleServe(0, "/")).mounts : [];
+  const name = uniqueShareName(profileSlug(profile), (await requireListeners()).listeners, served);
+  let host = "127.0.0.1", tailscaleServe = false;
+  if (isInteractive()) {
+    const serve = !!tailscaleBinary();
+    // With Tailscale Serve on offer, a plain-HTTP Tailscale IP would only be a worse duplicate.
+    const networks = (await detectListenChoices()).filter(c => c.kind !== "local" && !(serve && c.kind === "tailscale"));
+    const how = await promptChoice(`How will your other machines reach it?`, [
+      ...(serve ? [{ label: "Tailscale: HTTPS, only your tailnet", value: "tailscale-serve" }] : []),
+      ...networks.map(c => ({ label: `${c.label.split(" — ")[0]} network: http://${c.address}, plain HTTP`, value: c.address })),
+      { label: "My own reverse proxy", value: "127.0.0.1" },
+    ], 0);
+    if (!how) throw new Error("Cancelled; nothing shared.");
+    tailscaleServe = how === "tailscale-serve";
+    host = tailscaleServe ? "127.0.0.1" : how;
+  }
+  return shareSet([profile], { ...opts, host, tailscaleServe, defaultName: name, prefix: `/rechrome/${name}/`, again: `rech share ${JSON.stringify(profile)}` });
+}
+
 async function printProfileUri(selector?: string, listener?: string, opts: { local?: boolean; save?: boolean; all?: boolean } = {}): Promise<void> {
   if (opts.all) {
     if (selector) throw new Error("Pass a profile or --all, not both.");
@@ -1225,17 +1350,24 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
   if (!listener && config) {
     try { listener = chooseShareListener(profile, listeners); }
     catch (error) {
-      if (!interactive || !(error instanceof ShareListenerError)) throw error;
+      if (!(error instanceof ShareListenerError)) throw error;
+      // Not shared yet: give it its own link rather than stopping with instructions.
+      if (!interactive) { if (error.kind === "none") return shareNewLink(profile, opts); throw error; }
       const describe = (l: Listener) => `${l.name}  ${l.publicUrl ?? `${listenerAddress(l)}${normalizePrefix(l.prefix)}`}`;
       if (error.kind === "several") {
         listener = (await promptChoice(`"${profile}" is on several listeners. Share through which?`, error.listeners.map(l => ({ label: describe(l), value: l.name })))) ?? undefined;
         if (!listener) throw cancelled();
       } else {
-        if (!error.listeners.length) throw error; // nothing to allow it on: the error names `rech listener add`
-        // Allowing is a config change, so the default is to cancel.
-        const target = await promptChoice(`"${profile}" isn't shared on any listener yet. Allow it on:`,
-          [...error.listeners.map(l => ({ label: describe(l), value: l.name as string | null })), { label: "Cancel (change nothing)", value: null }], error.listeners.length);
+        // Keep going until there is a URL (or the user cancels): a new link of its own is the
+        // default, since allowing it on an existing listener hands it to that listener's key holders.
+        const NEW_LINK = "\0new";
+        const target = error.listeners.length ? await promptChoice(`${profile} isn't shared yet.`, [
+          { label: "Create a new link for it", value: NEW_LINK as string | null },
+          ...error.listeners.map(l => ({ label: `Add it to link "${l.name}" (its existing key)`, value: l.name as string | null })),
+          { label: "Cancel", value: null },
+        ], 0) : NEW_LINK;
         if (!target) throw cancelled();
+        if (target === NEW_LINK) return shareNewLink(profile, opts);
         allowProfiles(config, target, [profile]);
         await writeListeners(config);
         console.error(`[rech] allowed "${profile}" on ${target}`);
@@ -1250,7 +1382,14 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     console.error(`[rech] note: this link's key works for every profile on listener "${chosen.name}" (${chosen.profiles.join(", ")}); ?profile= only picks the default. For a one-profile link, give that profile its own listener.`);
   let uri = profileConnectionUri(profile, url, listeners, listener);
   // Prefer where a proxy exposes the listener, when it has been recorded.
-  const publicUrl = listeners.find(l => l.key === parseUrl(uri).key)?.publicUrl;
+  // A link whose proxy was set up by hand since (e.g. after `tailscale serve` failed here):
+  // record the tailnet-only route so this and later shares print it.
+  const pending = listeners.find(l => l.key === parseUrl(uri).key);
+  if (config && pending && pending.profiles !== "*" && !pending.publicUrl && isLoopback(pending.host) && tailscaleBinary()) {
+    const serve = await detectTailscaleServe(pending.port, normalizePrefix(pending.prefix));
+    if (serve.routeUrl && !serve.funnel) { pending.publicUrl = serve.routeUrl; await writeListeners(config); }
+  }
+  const publicUrl = pending?.publicUrl;
   if (publicUrl && !opts.local) uri = rebaseConnectionUrl(publicUrl, uri);
   console.log(uri);
   if (opts.save) console.error(`Saved RECHROME_URL to ${await saveProjectUrl(uri)}`);
@@ -1946,7 +2085,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
   const envRaw = await file(globalEnvFile).text().catch(() => "");
   const lines = envRaw.trimEnd().split("\n");
   const filtered = lines.filter(l => !l.startsWith(`${ENV_KEY}=`));
-  await Bun.write(globalEnvFile, [...filtered, `${ENV_KEY}=${keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))}`, ""].join("\n"));
+  await Bun.write(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"));
 
   const home = HOME;
   const bunBin = Bun.which("bun") ?? process.execPath;
@@ -2332,14 +2471,15 @@ async function provisionProfile(name: string, opts: { headed?: boolean } = {}):
   rechUrl.searchParams.set("load_extension", dist);
 
 
-  const newLine = `RECHROME_URL=${registeredProfileUrl(rechUrl.toString())}`;
+  const profileUrl = registeredProfileUrl(rechUrl.toString());
+  const newLine = envAssignment(ENV_KEY, profileUrl);
 
   // [3/3] Register in the token registry so `rech status` lists it and the daemon can resolve it.
   await saveTokenEntry(name, { extensionId: EXTENSION_ID, token, profileDir: name, userDataDir, loadExtension: dist });
   console.log(`\n[3/3] Registered "${name}" in ${TOKENS_FILE}`);
 
   console.log(`\nDone! RECHROME_URL for "${name}":\n\n  ${newLine}\n`);
-  console.log(`Use it per-call:\n  ${newLine.replace("RECHROME_URL=", "RECHROME_URL='")}' rech open https://example.com\n`);
+  console.log(`Use it per-call:\n  ${ENV_KEY}='${profileUrl}' rech open https://example.com\n`);
   console.log(`Or save it to a project .env.local to make it the default.`);
 }
 
@@ -2496,7 +2636,7 @@ async function saveProjectUrl(url: string): Promise<string> {
   if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
   const envPath = join(dataDir, ".env.local");
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
-  await writeFile(envPath, [...lines, `${ENV_KEY}=${url}`, ""].join("\n"), { mode: 0o600 });
+  await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
   await chmod(envPath, 0o600);
   return envPath;
 }
@@ -2846,7 +2986,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     console.log(`        rech setup --profile ${JSON.stringify(profileEmail)} --listen local --prefix=rechrome`);
     console.log(`      then expose it with tailscale serve (setup prints the command and the remote URL).`);
   }
-  const newLine = `RECHROME_URL=${registeredProfileUrl(rechUrl.toString())}`;
+  const newLine = envAssignment(ENV_KEY, registeredProfileUrl(rechUrl.toString()));
 
   console.log("\n○ [5/5] Connection verified. Save connection configuration:");
   console.log(`\n${newLine}\n`);

package/rechrome.ts

@@ -88,7 +88,44 @@ const globalEnvFile = join(HOME || "~", ".env.local");
 
 // Capture inherited values once so explicit environment overrides survive reloads,
 // while values loaded from files can still change when those files are edited.
-const inheritedEnvKeys = new Set(Object.keys(process.env));
+/**
+ * A KEY=value line for an env file. A value with "#" (every connection URL's #key=…) or
+ * whitespace is double-quoted: Bun's own .env loader treats an unquoted "#" as a comment and
+ * would drop the key. rech's loader strips the quotes again.
+ */
+export function envAssignment(key: string, value: string): string {
+  return /[#\s]/.test(value) ? `${key}="${value}"` : `${key}=${value}`;
+}
+
+/** Parse KEY=value lines the way Bun's .env loader does (unquoted values end at "#"). */
+function parseBunEnvFile(text: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const line of text.split("\n")) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*)$/);
+    if (!m) continue;
+    const raw = m[2].trim();
+    const quoted = raw.match(/^(["'`])(.*)\1/);
+    out[m[1]] = quoted ? quoted[2] : raw.replace(/\s*#.*$/, "").trim();
+  }
+  return out;
+}
+
+/**
+ * Keys Bun itself loaded from the current folder's .env files before rech started. They look
+ * like shell exports, but are file values: counting them as inherited would let a folder's
+ * .env.local beat its .rechrome/.env.local, and a keyless (cut at "#") URL beat a good one.
+ */
+export function bunAutoloadedKeys(env: Record<string, string | undefined>, files: string[]): Set<string> {
+  const keys = new Set<string>();
+  for (const text of files)
+    for (const [key, value] of Object.entries(parseBunEnvFile(text))) if (env[key] === value) keys.add(key);
+  return keys;
+}
+
+const bunLoaded = bunAutoloadedKeys(process.env,
+  [".env", `.env.${process.env.NODE_ENV || "development"}`, ".env.local", `.env.${process.env.NODE_ENV || "development"}.local`]
+    .map(name => { try { return readFileSync(join(process.cwd(), name), "utf8"); } catch { return ""; } }));
+const inheritedEnvKeys = new Set(Object.keys(process.env).filter(key => !bunLoaded.has(key)));
 
 // Walk CWD→root loading env files nearest-first; inherited environment wins over files.
 // At each level .rechrome/.env.local is checked before .env.local (rechrome-specific overrides general).
@@ -362,7 +399,18 @@ export async function detectListenChoices(): Promise<ListenChoice[]> {
   return buildListenChoices(networkInterfaces(), ips);
 }
 
-export type TailscaleServe = { dnsName: string | null; routeUrl: string | null };
+/**
+ * `funnel`: Funnel (public internet) is on for the host that serves — or would serve — this
+ * node's routes, so a route there is not tailnet-only. `mounts`: every Serve path in use.
+ */
+export type TailscaleServe = { dnsName: string | null; routeUrl: string | null; funnel: boolean; mounts: string[] };
+
+export function serveMountsAndFunnel(serveStatus: unknown, host: string | null): { mounts: string[]; funnel: boolean } {
+  const status = serveStatus as { Web?: Record<string, { Handlers?: Record<string, unknown> }>; AllowFunnel?: Record<string, boolean> } | null;
+  const mounts = Object.values(status?.Web ?? {}).flatMap(config => Object.keys(config.Handlers ?? {}).map(path => path.replace(/\/+$/, "") || "/"));
+  const funnel = Object.entries(status?.AllowFunnel ?? {}).some(([hostPort, on]) => on && (!host || hostPort.split(/:(?=\d+$)/)[0] === host));
+  return { mounts: [...new Set(mounts)], funnel };
+}
 
 /**
  * Find the HTTPS Serve route that forwards `prefix` to a loopback listener on `port`,
@@ -393,7 +441,8 @@ export async function detectTailscaleServe(port: number, prefix: string): Promis
   let serveStatus: unknown = null;
   try { dnsName = (JSON.parse(status ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") || null; } catch { /* not connected */ }
   try { serveStatus = JSON.parse(serve ?? "null"); } catch { /* no Serve config */ }
-  return { dnsName, routeUrl: findTailscaleServeRoute(dnsName, serveStatus, port, prefix) };
+  const routeUrl = findTailscaleServeRoute(dnsName, serveStatus, port, prefix);
+  return { dnsName, routeUrl, ...serveMountsAndFunnel(serveStatus, routeUrl ? new URL(routeUrl).hostname : dnsName) };
 }
 
 /** The same connection (key and profile) at another base URL, e.g. where a proxy exposes the listener. */
@@ -425,7 +474,7 @@ export async function getOrCreateUrl(persist = true): Promise<string> {
   const key = randomBytes(12).toString("base64url"); // 16 chars
   const url = `http://${key}@127.0.0.1:${DEFAULT_PORT}`;
   if (persist) {
-    const newLine = `${ENV_KEY}=${url}`;
+    const newLine = envAssignment(ENV_KEY, url);
     // Write to ~/.env.local so it's not shadowed by project .env.local
     const envRaw = await file(globalEnvFile).text().catch(() => "");
     const lines = envRaw.trimEnd().split("\n").filter(l => !l.startsWith(`${ENV_KEY}=`));
@@ -1091,7 +1140,7 @@ export function chooseShareListener(profile: string, listeners: Listener[]): str
   throw new ShareListenerError([
     `"${profile}" isn't shared on any listener yet.`,
     scoped.length ? `  Allow it on one:  rech listener allow ${scoped[0].name} ${JSON.stringify(profile)}   (listeners: ${scoped.map(l => l.name).join(", ")})` : "",
-    `  Or create one:    rech listener add share --listen local --prefix=rechrome --port 13776 --profile ${JSON.stringify(profile)}`,
+    `  ${scoped.length ? "Or give" : "Give"} it its own link:  rech share ${JSON.stringify(profile)}   (in a terminal it asks who should connect)`,
   ].filter(Boolean).join("\n"), "none", scoped);
 }
 
@@ -1142,7 +1191,7 @@ async function shareProfiles(selectors: string[], opts: { listener?: string; loc
 }
 
 /** Put exactly `snapshot` on one scoped listener (created if missing) and print its link. */
-async function shareSet(snapshot: string[], opts: { listener?: string; local?: boolean; save?: boolean; defaultName: string; prefix: string; again: string }): Promise<void> {
+async function shareSet(snapshot: string[], opts: { listener?: string; local?: boolean; save?: boolean; defaultName: string; prefix: string; again: string; host?: string; tailscaleServe?: boolean }): Promise<void> {
   const config = await requireListeners();
   const name = opts.listener ?? opts.defaultName;
   let listener = config.listeners.find(l => l.name === name);
@@ -1151,7 +1200,7 @@ async function shareSet(snapshot: string[], opts: { listener?: string; local?: b
   let changes = "";
   if (!listener) {
     if (opts.listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
-    listener = { name, host: "127.0.0.1", port: freeListenerPort(config.listeners), prefix: opts.prefix, key: randomBytes(24).toString("base64url"), profiles: snapshot };
+    listener = { name, host: opts.host ?? "127.0.0.1", port: freeListenerPort(config.listeners), prefix: opts.prefix, key: randomBytes(24).toString("base64url"), profiles: snapshot };
     config.listeners.push(listener);
     changes = `created listener "${name}" on ${listenerAddress(listener)}${listener.prefix}`;
   } else {
@@ -1161,24 +1210,100 @@ async function shareSet(snapshot: string[], opts: { listener?: string; local?: b
     changes = added.length || removed.length ? [added.length && `added ${added.join(", ")}`, removed.length && `removed ${removed.join(", ")}`].filter(Boolean).join("; ") : "no changes";
   }
   await writeListeners(config);
-  console.error(`[rech] sharing ${snapshot.length} profiles through "${name}" (${changes}): ${snapshot.join(", ")}`);
+  if (changes.startsWith("created") && snapshot.length === 1) console.error(`New link "${name}" for ${snapshot[0]}.`);
+  else console.error(`[rech] sharing ${snapshot.length} profiles through "${name}" (${changes}): ${snapshot.join(", ")}`);
   if (opts.defaultName === "share-all") console.error(`[rech] this is a snapshot: after registering another profile, run ${opts.again} again.`);
   else if (changes !== "no changes" && !changes.startsWith("created")) console.error(`[rech] links already given out for "${name}" now reach exactly these profiles too (same key). For a fresh key: rech listener rotate-key ${name}`);
   // The daemon reloads listeners.json about every second: confirm this listener answers before handing out its URL.
-  const local = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}`;
+  // A one-profile link names its profile, so the other machine needs no --profile.
+  const only = snapshot.length === 1 ? `?profile=${encodeURIComponent(snapshot[0])}` : "";
+  const local = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}${only}`;
   let ready = false;
   for (let i = 0; i < 20 && !ready; i++) {
     ready = await fetch(serviceUrl(local, "ping"), { headers: { Authorization: `Bearer ${listener.key}` }, signal: AbortSignal.timeout(1000) }).then(r => r.ok).catch(() => false);
     if (!ready) await Bun.sleep(250);
   }
   if (!ready) console.error(`[rech] warning: listener "${name}" is not answering yet; check the daemon with rech status.`);
+  if (opts.tailscaleServe && !listener.publicUrl) {
+    const publicUrl = await exposeWithTailscaleServe(listener);
+    if (publicUrl) {
+      listener.publicUrl = publicUrl;
+      await writeListeners(config);
+    }
+  }
   const uri = listener.publicUrl && !opts.local ? rebaseConnectionUrl(listener.publicUrl, local) : registeredProfileUrl(local);
-  if (!listener.publicUrl) for (const line of listenerNextSteps(listener, undefined, opts.again)) console.error(line);
+  if (!listener.publicUrl && isLoopback(listener.host)) for (const line of listenerNextSteps(listener, undefined, opts.again)) console.error(line);
   console.log(uri);
-  console.error(`[rech] on the other machine: rech connect '<url>', then rech --profile <name> open https://example.com`);
+  console.error(snapshot.length === 1 ? `On the other machine: rech connect '<this link>'` : `On the other machine: rech connect '<this link>', then rech --profile <name> open <url>`);
   if (opts.save) console.error(`Saved RECHROME_URL to ${await saveProjectUrl(uri)}`);
 }
 
+/** A readable, URL-safe name for a profile's link: the email's local part or the profile name. */
+export function profileSlug(profile: string): string {
+  const slug = profile.split("@")[0].toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32);
+  return slug || "profile";
+}
+
+/**
+ * `base`, or `base-2`, `base-3`… — the first name whose listener and path are free. Never a
+ * reserved name (`share --all` and `share a b` reuse theirs and rewrite their allowlists, so a
+ * one-profile link under such a name would later grant its key more profiles), and never a
+ * mount a proxy already serves (Tailscale Serve would replace that route).
+ */
+export function uniqueShareName(base: string, listeners: Listener[], servedMounts: string[] = []): string {
+  const reserved = (name: string) => name === "local" || name === "share-all" || /^share-[0-9a-f]{6}$/.test(name);
+  const taken = (name: string) => reserved(name) || servedMounts.includes(`/rechrome/${name}`)
+    || listeners.some(l => l.name === name || normalizePrefix(l.prefix) === `/rechrome/${name}/`);
+  for (let i = 1; ; i++) { const name = i === 1 ? base : `${base}-${i}`; if (!taken(name)) return name; }
+}
+
+/** Route a loopback listener through Tailscale Serve (HTTPS, tailnet only); returns its public URL. */
+async function exposeWithTailscaleServe(listener: Listener): Promise<string | null> {
+  const prefix = normalizePrefix(listener.prefix);
+  const existing = await detectTailscaleServe(listener.port, prefix);
+  if (existing.funnel) {
+    console.error("Tailscale Funnel is on for this machine, so a Serve route here would be public, not tailnet-only. Not exposing it.\n  Turn Funnel off (tailscale funnel reset), then rech share again.");
+    return null;
+  }
+  if (existing.routeUrl) return existing.routeUrl;
+  const binary = tailscaleBinary();
+  if (!binary) return null;
+  const mount = prefix === "/" ? "/" : prefix.slice(0, -1);
+  const args = ["serve", "--bg", `--set-path=${mount}`, `http://127.0.0.1:${listener.port}${mount === "/" ? "" : mount}`];
+  console.error(`Running: tailscale ${args.join(" ")}`);
+  const proc = Bun.spawn([binary, ...args], { stdout: "ignore", stderr: "inherit", windowsHide: true });
+  if (await proc.exited !== 0) {
+    console.error(`tailscale serve failed. Run it yourself, then rech share again:\n  tailscale ${args.join(" ")}`);
+    return null;
+  }
+  return (await detectTailscaleServe(listener.port, prefix)).routeUrl;
+}
+
+/**
+ * Give one profile its own link. In a terminal, ask how the other machines will reach it
+ * (Tailscale Serve, a detected network, or the user's own proxy); without one, create a
+ * loopback link, like `rech share a b`.
+ */
+async function shareNewLink(profile: string, opts: { local?: boolean; save?: boolean }): Promise<void> {
+  const served = tailscaleBinary() ? (await detectTailscaleServe(0, "/")).mounts : [];
+  const name = uniqueShareName(profileSlug(profile), (await requireListeners()).listeners, served);
+  let host = "127.0.0.1", tailscaleServe = false;
+  if (isInteractive()) {
+    const serve = !!tailscaleBinary();
+    // With Tailscale Serve on offer, a plain-HTTP Tailscale IP would only be a worse duplicate.
+    const networks = (await detectListenChoices()).filter(c => c.kind !== "local" && !(serve && c.kind === "tailscale"));
+    const how = await promptChoice(`How will your other machines reach it?`, [
+      ...(serve ? [{ label: "Tailscale: HTTPS, only your tailnet", value: "tailscale-serve" }] : []),
+      ...networks.map(c => ({ label: `${c.label.split(" — ")[0]} network: http://${c.address}, plain HTTP`, value: c.address })),
+      { label: "My own reverse proxy", value: "127.0.0.1" },
+    ], 0);
+    if (!how) throw new Error("Cancelled; nothing shared.");
+    tailscaleServe = how === "tailscale-serve";
+    host = tailscaleServe ? "127.0.0.1" : how;
+  }
+  return shareSet([profile], { ...opts, host, tailscaleServe, defaultName: name, prefix: `/rechrome/${name}/`, again: `rech share ${JSON.stringify(profile)}` });
+}
+
 async function printProfileUri(selector?: string, listener?: string, opts: { local?: boolean; save?: boolean; all?: boolean } = {}): Promise<void> {
   if (opts.all) {
     if (selector) throw new Error("Pass a profile or --all, not both.");
@@ -1225,17 +1350,24 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
   if (!listener && config) {
     try { listener = chooseShareListener(profile, listeners); }
     catch (error) {
-      if (!interactive || !(error instanceof ShareListenerError)) throw error;
+      if (!(error instanceof ShareListenerError)) throw error;
+      // Not shared yet: give it its own link rather than stopping with instructions.
+      if (!interactive) { if (error.kind === "none") return shareNewLink(profile, opts); throw error; }
       const describe = (l: Listener) => `${l.name}  ${l.publicUrl ?? `${listenerAddress(l)}${normalizePrefix(l.prefix)}`}`;
       if (error.kind === "several") {
         listener = (await promptChoice(`"${profile}" is on several listeners. Share through which?`, error.listeners.map(l => ({ label: describe(l), value: l.name })))) ?? undefined;
         if (!listener) throw cancelled();
       } else {
-        if (!error.listeners.length) throw error; // nothing to allow it on: the error names `rech listener add`
-        // Allowing is a config change, so the default is to cancel.
-        const target = await promptChoice(`"${profile}" isn't shared on any listener yet. Allow it on:`,
-          [...error.listeners.map(l => ({ label: describe(l), value: l.name as string | null })), { label: "Cancel (change nothing)", value: null }], error.listeners.length);
+        // Keep going until there is a URL (or the user cancels): a new link of its own is the
+        // default, since allowing it on an existing listener hands it to that listener's key holders.
+        const NEW_LINK = "\0new";
+        const target = error.listeners.length ? await promptChoice(`${profile} isn't shared yet.`, [
+          { label: "Create a new link for it", value: NEW_LINK as string | null },
+          ...error.listeners.map(l => ({ label: `Add it to link "${l.name}" (its existing key)`, value: l.name as string | null })),
+          { label: "Cancel", value: null },
+        ], 0) : NEW_LINK;
         if (!target) throw cancelled();
+        if (target === NEW_LINK) return shareNewLink(profile, opts);
         allowProfiles(config, target, [profile]);
         await writeListeners(config);
         console.error(`[rech] allowed "${profile}" on ${target}`);
@@ -1250,7 +1382,14 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     console.error(`[rech] note: this link's key works for every profile on listener "${chosen.name}" (${chosen.profiles.join(", ")}); ?profile= only picks the default. For a one-profile link, give that profile its own listener.`);
   let uri = profileConnectionUri(profile, url, listeners, listener);
   // Prefer where a proxy exposes the listener, when it has been recorded.
-  const publicUrl = listeners.find(l => l.key === parseUrl(uri).key)?.publicUrl;
+  // A link whose proxy was set up by hand since (e.g. after `tailscale serve` failed here):
+  // record the tailnet-only route so this and later shares print it.
+  const pending = listeners.find(l => l.key === parseUrl(uri).key);
+  if (config && pending && pending.profiles !== "*" && !pending.publicUrl && isLoopback(pending.host) && tailscaleBinary()) {
+    const serve = await detectTailscaleServe(pending.port, normalizePrefix(pending.prefix));
+    if (serve.routeUrl && !serve.funnel) { pending.publicUrl = serve.routeUrl; await writeListeners(config); }
+  }
+  const publicUrl = pending?.publicUrl;
   if (publicUrl && !opts.local) uri = rebaseConnectionUrl(publicUrl, uri);
   console.log(uri);
   if (opts.save) console.error(`Saved RECHROME_URL to ${await saveProjectUrl(uri)}`);
@@ -1946,7 +2085,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
   const envRaw = await file(globalEnvFile).text().catch(() => "");
   const lines = envRaw.trimEnd().split("\n");
   const filtered = lines.filter(l => !l.startsWith(`${ENV_KEY}=`));
-  await Bun.write(globalEnvFile, [...filtered, `${ENV_KEY}=${keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))}`, ""].join("\n"));
+  await Bun.write(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"));
 
   const home = HOME;
   const bunBin = Bun.which("bun") ?? process.execPath;
@@ -2332,14 +2471,15 @@ async function provisionProfile(name: string, opts: { headed?: boolean } = {}):
   rechUrl.searchParams.set("load_extension", dist);
 
 
-  const newLine = `RECHROME_URL=${registeredProfileUrl(rechUrl.toString())}`;
+  const profileUrl = registeredProfileUrl(rechUrl.toString());
+  const newLine = envAssignment(ENV_KEY, profileUrl);
 
   // [3/3] Register in the token registry so `rech status` lists it and the daemon can resolve it.
   await saveTokenEntry(name, { extensionId: EXTENSION_ID, token, profileDir: name, userDataDir, loadExtension: dist });
   console.log(`\n[3/3] Registered "${name}" in ${TOKENS_FILE}`);
 
   console.log(`\nDone! RECHROME_URL for "${name}":\n\n  ${newLine}\n`);
-  console.log(`Use it per-call:\n  ${newLine.replace("RECHROME_URL=", "RECHROME_URL='")}' rech open https://example.com\n`);
+  console.log(`Use it per-call:\n  ${ENV_KEY}='${profileUrl}' rech open https://example.com\n`);
   console.log(`Or save it to a project .env.local to make it the default.`);
 }
 
@@ -2496,7 +2636,7 @@ async function saveProjectUrl(url: string): Promise<string> {
   if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
   const envPath = join(dataDir, ".env.local");
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
-  await writeFile(envPath, [...lines, `${ENV_KEY}=${url}`, ""].join("\n"), { mode: 0o600 });
+  await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
   await chmod(envPath, 0o600);
   return envPath;
 }
@@ -2846,7 +2986,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     console.log(`        rech setup --profile ${JSON.stringify(profileEmail)} --listen local --prefix=rechrome`);
     console.log(`      then expose it with tailscale serve (setup prints the command and the remote URL).`);
   }
-  const newLine = `RECHROME_URL=${registeredProfileUrl(rechUrl.toString())}`;
+  const newLine = envAssignment(ENV_KEY, registeredProfileUrl(rechUrl.toString()));
 
   console.log("\n○ [5/5] Connection verified. Save connection configuration:");
   console.log(`\n${newLine}\n`);

package/skills/rechrome-setup/SKILL.md

@@ -11,12 +11,12 @@ Use this workflow when the user requests rechrome setup for an existing Chrome p
 
 - Preserve the user's browser choice. Installed Google Chrome profiles belong to the user; do not rename, create, delete, or replace them as part of setup.
 - If the user wants an isolated Playwright browser, do not send them through real-Chrome extension installation. Playwright can control its own browser directly. Check the current CLI help for available managed-browser support: the legacy `provision-profile --experimental` flow still uses a bridge and may require the vendored relay patch described in the repo's `AGENTS.md`. Do not present a proposed direct-browser mode as implemented.
-- Run `rech profile ls` and resolve the exact email, display name, or folder. For no-email profiles, use the folder (for example `Profile 7`) to avoid ambiguity. A requested display name such as `taku3` is also accepted with `--profile`.
+- Run `rech profile ls` and resolve the exact email, display name, or folder. For no-email profiles, use the folder (for example `Profile 7`) to avoid ambiguity. A requested display name such as `Work 2` is also accepted with `--profile`.
 - Use `rech` or `rechrome` if installed; from a checkout use `bun rechrome.ts`. The package is `rechrome`, not `rech`: use `bunx rechrome`, never `bunx rech`.
 
 ## Start and retain the setup process
 
-Run `rech setup --profile "<selector>"` in a retained terminal session, preferably with a TTY. A bare positional selector such as `rech setup taku3` is not supported by the current CLI.
+Run `rech setup --profile "<selector>"` in a retained terminal session, preferably with a TTY. A bare positional selector such as `rech setup work-2` is not supported by the current CLI.
 
 - The listen choice applies to the selected profile. Local is the default and removes that profile from remote allowlists; choose LAN or Tailscale when requested. Other profiles keep their exposure. The menu shows Tailscale only when detected. Use `rech listener ls` and `rech profile ls` to review configured bindings. Listener changes reload in one daemon without restarting Chrome; first migration may restart only the daemon.
 - Keep the terminal session handle and poll it while working in Chrome. Non-TTY mode also works, but input is read until EOF before setup starts: provide all prompt answers and close stdin. EOF does not stop the guide server.