rechrome 1.31.4 → 1.31.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.31.4",
+  "version": "1.31.6",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -8,7 +8,7 @@ import { createHash, randomBytes } from "crypto";
 import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
-import { join, basename, dirname } from "path";
+import { join, basename, dirname, resolve } from "path";
 import { pathToFileURL } from "url";
 import { createRequire } from "node:module";
 import { spawn as cpSpawn } from "child_process";
@@ -942,16 +942,135 @@ export function buildProfileRows(cache: Record<string, ChromeProfileInfo> | null
   return rows;
 }
 
-/** PIDs of browser processes (not helpers) running on a Chrome user-data dir. POSIX only. */
-function browsersUsing(userDataDir: string): number[] {
-  if (process.platform === "win32") return [];
+/**
+ * Split a Windows command line into arguments the way the C runtime does (CommandLineToArgvW
+ * rules): whitespace separates outside quotes; quotes toggle and may sit mid-argument
+ * (`--x="C:\a"b` is `--x=C:\ab`); 2n backslashes before a quote are n backslashes and the quote
+ * toggles, 2n+1 are n and a literal quote; `""` inside quotes is a literal quote.
+ */
+export function splitWindowsCommandLine(commandLine: string): string[] {
+  const args: string[] = [];
+  let current = "", quoted = false, started = false;
+  for (let i = 0; i < commandLine.length; i++) {
+    const c = commandLine[i];
+    if (c === "\\") {
+      let n = 0;
+      while (commandLine[i] === "\\") { n++; i++; }
+      if (commandLine[i] === '"') {
+        current += "\\".repeat(n >> 1);
+        if (n % 2) current += '"'; else quoted = !quoted;
+      } else { current += "\\".repeat(n); i--; }
+      started = true;
+    } else if (c === '"') {
+      if (quoted && commandLine[i + 1] === '"') { current += '"'; i++; } else quoted = !quoted;
+      started = true;
+    } else if (!quoted && (c === " " || c === "\t")) {
+      if (started) { args.push(current); current = ""; started = false; }
+    } else { current += c; started = true; }
+  }
+  if (started) args.push(current);
+  return args;
+}
+
+/** The `--user-data-dir` value among exact arguments, or null. */
+export function userDataDirArg(args: string[]): string | null {
+  const arg = args.find(a => a.startsWith("--user-data-dir="));
+  return arg === undefined ? null : arg.slice("--user-data-dir=".length);
+}
+
+/** Same folder: exact path, ignoring trailing separators (and case on Windows). */
+export function sameDataDir(a: string, b: string, windows = process.platform === "win32"): boolean {
+  const norm = (p: string) => { const t = p.replace(/[\\/]+$/, ""); return windows ? t.replaceAll("/", "\\").toLowerCase() : t; };
+  return norm(a) === norm(b);
+}
+
+/**
+ * Match a flattened POSIX `ps` command line (no quotes, argument boundaries lost) against a
+ * user-data dir: "exact" only when the path is the last thing on the line; "ambiguous" when
+ * more text follows (another flag, or a sibling folder like `qa -backup`); else "none".
+ */
+export function flatUserDataDirMatch(command: string, userDataDir: string): "exact" | "ambiguous" | "none" {
+  const flag = `--user-data-dir=${userDataDir.replace(/\/+$/, "")}`;
+  const at = command.indexOf(flag);
+  if (at < 0 || (at > 0 && !/\s/.test(command[at - 1]))) return "none";
+  const rest = command.slice(at + flag.length);
+  if (/^\/*\s*$/.test(rest)) return "exact";
+  return /^\/*\s/.test(rest) ? "ambiguous" : "none";   // `qa2` / `qa-x` are other folders
+}
+
+/**
+ * Browser processes (not helpers) on this Chrome user-data dir. `exact`: certainly this folder
+ * (Windows command lines are split with the C runtime's rules; Linux reads argv from /proc).
+ * `ambiguous`: flattened `ps` output that may name a sibling folder — never killed.
+ */
+function browsersUsing(userDataDir: string): { exact: number[]; ambiguous: number[] } {
+  const exact: number[] = [], ambiguous: number[] = [];
+  const isHelper = (args: string[]) => args.some(a => a.startsWith("--type="));
+  if (process.platform === "win32") {
+    const out = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command",
+      "Get-CimInstance Win32_Process | ForEach-Object { \"$($_.ProcessId)`t$($_.CommandLine)\" }"], { windowsHide: true }).stdout.toString();
+    for (const line of out.split(/\r?\n/)) {
+      const tab = line.indexOf("\t"), pid = Number(line.slice(0, tab));
+      if (!pid || pid === process.pid) continue;
+      const args = splitWindowsCommandLine(line.slice(tab + 1));
+      const dir = userDataDirArg(args);
+      if (dir !== null && !isHelper(args) && sameDataDir(dir, userDataDir)) exact.push(pid);
+    }
+    return { exact, ambiguous };
+  }
   const ps = Bun.spawnSync(["ps", "ax", "-o", "pid=,command="]).stdout.toString();
-  return ps.split("\n").filter(line => line.includes(`--user-data-dir=${userDataDir}`) && !line.includes("--type="))
-    .map(line => Number(line.trim().split(/\s+/)[0])).filter(Boolean);
+  for (const line of ps.split("\n")) {
+    const m = /^\s*(\d+)\s+(.*)$/.exec(line);
+    if (!m || Number(m[1]) === process.pid || !m[2].includes("--user-data-dir=")) continue;
+    const pid = Number(m[1]);
+    let argv: string[] | null = null;
+    try { argv = readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").filter(Boolean); } catch { /* not Linux, or gone */ }
+    if (argv) {
+      const dir = userDataDirArg(argv);
+      if (dir !== null && !isHelper(argv) && sameDataDir(dir, userDataDir, false)) exact.push(pid);
+      continue;
+    }
+    if (/(?:^|\s)--type=/.test(m[2])) continue;
+    const match = flatUserDataDirMatch(m[2], userDataDir);
+    if (match === "exact") exact.push(pid);
+    else if (match === "ambiguous") ambiguous.push(pid);
+  }
+  return { exact, ambiguous };
 }
 
 /** Move a folder to the user's Trash (recoverable). Returns where it went, or null if unsupported here. */
 function moveToTrash(dir: string): string | null {
+  // An explicit trash folder (tests use it to keep the real Trash / Recycle Bin clean).
+  const override = process.env.RECH_TRASH_DIR;
+  if (override) {
+    mkdirSync(override, { recursive: true });
+    let dest = join(override, basename(dir));
+    if (existsSync(dest)) dest = `${dest} ${new Date().toISOString().replace(/[:.]/g, "-")}`;
+    renameSync(dir, dest);
+    return dest;
+  }
+  if (process.platform === "win32") {
+    // SHFileOperation with ALLOWUNDO sends it to the Recycle Bin, with no prompts or progress UI.
+    // WANTNUKEWARNING makes Windows ask rather than silently delete for good when the item
+    // cannot be recycled. (.NET's FileSystem.DeleteDirectory(..., SendToRecycleBin) deleted
+    // permanently here.) The path goes through the environment so quoting can't break it.
+    const source = [
+      "using System; using System.Runtime.InteropServices;",
+      "public static class RechRecycle {",
+      "  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]",
+      "  struct Op { public IntPtr hwnd; public uint wFunc; public string pFrom; public string pTo; public ushort fFlags; public bool aborted; public IntPtr mappings; public string title; }",
+      "  [DllImport(\"shell32.dll\", CharSet = CharSet.Unicode)] static extern int SHFileOperation(ref Op op);",
+      "  public static int Recycle(string path) {",
+      "    var op = new Op { wFunc = 3, pFrom = path + \"\\0\\0\", fFlags = 0x0040 | 0x0010 | 0x0004 | 0x0400 | 0x4000 };",
+      "    int r = SHFileOperation(ref op); return op.aborted ? -1 : r;",
+      "  }",
+      "}",
+    ].join("\n");
+    const r = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command",
+      "Add-Type -TypeDefinition $env:RECH_RECYCLE_SOURCE; exit [RechRecycle]::Recycle($env:RECH_RECYCLE_PATH)"],
+      { env: { ...process.env, RECH_RECYCLE_SOURCE: source, RECH_RECYCLE_PATH: dir.replaceAll("/", "\\").replace(/\\+$/, "") }, windowsHide: true }); // SHFileOperation rejects `/` and a trailing `\`
+    return r.exitCode === 0 && !existsSync(dir) ? "the Recycle Bin" : null;
+  }
   const trash = process.platform === "darwin" ? join(HOME, ".Trash") : process.platform === "linux" ? join(HOME, ".local", "share", "Trash", "files") : null;
   if (!trash) return null;
   mkdirSync(trash, { recursive: true });
@@ -972,13 +1091,17 @@ async function removeProfile(selector: string, opts: { yes?: boolean; close?: bo
   const key = (await resolveGlobalProfile(registry, cache, selector)).email;
   const config = await readListeners();
   const plan = planProfileRemoval(key, registry, config?.listeners ?? [], join(RECH_DIR, "profiles"));
-  const running = plan.dataDir ? browsersUsing(plan.dataDir) : [];
+  const using = plan.dataDir ? browsersUsing(plan.dataDir) : { exact: [], ambiguous: [] };
+  const running = using.exact;
   console.log(`Remove profile "${key}"${plan.keys.length > 1 ? ` (registered as ${plan.keys.join(", ")})` : ""}:`);
   for (const edit of plan.listeners) console.log(edit.drop ? `  - remove listener "${edit.name}" (it serves only this profile)` : `  - stop sharing it on listener "${edit.name}"`);
   console.log(`  - unregister it from rech (~/.rechrome/profiles.yaml)`);
   if (plan.dataDir) console.log(`  - move its data folder to the Trash: ${plan.dataDir}`);
   else console.log(`  - its Chrome data is left alone (this only unregisters it from rech)`);
   if (running.length) console.log(`  - close its browser window, which is running now (pid ${running.join(", ")})`);
+  // A process that may be on this folder or on a sibling one: never killed, and nothing changes.
+  if (using.ambiguous.length)
+    throw new Error(`A process that may be using ${plan.dataDir} is running (pid ${using.ambiguous.join(", ")}), and rech can't tell it from one on a similarly named folder. Close it yourself, then run this again. Nothing changed.`);
   const interactive = isInteractive();
   if (!opts.yes) {
     if (!interactive) throw new Error("Not removed. Re-run with --yes to confirm" + (running.length ? " and --close to close its running window." : "."));
@@ -989,8 +1112,8 @@ async function removeProfile(selector: string, opts: { yes?: boolean; close?: bo
     // In a terminal, confirming the plan above (which lists closing it) is the consent; otherwise --close.
     if (!interactive && !opts.close) throw new Error("Its window is running; re-run with --close to close it, or close it yourself first.");
     for (const pid of running) process.kill(pid, "SIGTERM");
-    for (let i = 0; i < 40 && browsersUsing(plan.dataDir!).length; i++) await Bun.sleep(250);
-    if (browsersUsing(plan.dataDir!).length) throw new Error("Its window did not close; close it and run this again. Nothing else changed.");
+    for (let i = 0; i < 40 && browsersUsing(plan.dataDir!).exact.length; i++) await Bun.sleep(250);
+    if (browsersUsing(plan.dataDir!).exact.length) throw new Error("Its window did not close; close it and run this again. Nothing else changed.");
   }
   if (config && plan.listeners.length) {
     for (const edit of plan.listeners) {
@@ -1011,7 +1134,7 @@ async function removeProfile(selector: string, opts: { yes?: boolean; close?: bo
   }
   let moved: string | null = null;
   if (plan.dataDir && existsSync(plan.dataDir)) moved = moveToTrash(plan.dataDir);
-  console.log(`Removed "${key}".${moved ? ` Its data folder is in the Trash: ${moved}` : plan.dataDir ? ` Its data folder was left at ${plan.dataDir}; delete it yourself if you like.` : ""}`);
+  console.log(`Removed "${key}".${moved ? ` Its data folder was moved to ${moved}.` : plan.dataDir ? ` Its data folder was left at ${plan.dataDir}; delete it yourself if you like.` : ""}`);
 }
 
 /** On a client of a remote host, `rech profile` lists what that host's link shares. */
@@ -1930,9 +2053,48 @@ function oxmgrVersion(bin: string): string | null {
 // RECH_DAEMON_MANAGER override — lives in ./daemon-manager.js (pure + tested);
 // here we just supply the runtime inputs (what's on PATH, the oxmgr version).
 let _daemonMgr: DaemonManager | undefined;
+/**
+ * The first oxmgr that actually runs. PATH order alone isn't enough: a stale global shim
+ * (e.g. bun's, printing "oxmgr binary is missing") can shadow a working build, and npm's
+ * `oxmgr.cmd` re-parses argv through cmd.exe, so real executables come first. RECH_OXMGR
+ * names one explicitly (a path, or a command looked up on PATH). The successful probe's
+ * output seeds the version cache, so `--version` runs once.
+ */
+function findWorkingOxmgr(): string | null {
+  const ext = IS_WINDOWS ? ".exe" : "";
+  // Windows PATH entries may be quoted ("C:\Program Files\x"); quotes break the joined path.
+  const dirs = (process.env.PATH ?? "").split(IS_WINDOWS ? ";" : ":").map(d => d.trim().replace(/^"(.*)"$/, "$1")).filter(Boolean);
+  const override = process.env.RECH_OXMGR;
+  const candidates = [
+    override && (/[\\/]/.test(override) ? resolve(override) : Bun.which(override)),
+    ...dirs.map(d => join(d, `oxmgr${ext}`)),
+    // The vendored binary inside a global npm / bun install of the `oxmgr` package
+    // (npm: <dir>/node_modules on Windows, <prefix>/lib/node_modules beside <prefix>/bin elsewhere).
+    ...dirs.map(d => join(d, "node_modules", "oxmgr", "vendor", `oxmgr${ext}`)),
+    ...(IS_WINDOWS ? [] : dirs.map(d => join(d, "..", "lib", "node_modules", "oxmgr", "vendor", "oxmgr"))),
+    join(HOME, ".bun", "install", "global", "node_modules", "oxmgr", "vendor", `oxmgr${ext}`),
+  ].filter((p): p is string => !!p && existsSync(p));
+  const works = (p: string) => {
+    try {
+      const r = Bun.spawnSync([p, "--version"], { stdout: "pipe", stderr: "ignore", windowsHide: true });
+      if (r.exitCode !== 0) return false;
+      const m = /(\d+\.\d+\.\d+[^\s]*)/.exec(r.stdout?.toString() ?? "");
+      _oxmgrVersion = m ? m[1]! : null;
+      return true;
+    } catch { return false; }
+  };
+  const exe = [...new Set(candidates)].find(works);
+  if (exe) return exe;
+  // Last resort (Windows): a working shim such as npm's oxmgr.cmd, but never over a working
+  // pm2 — cmd.exe re-parses a shim's argv (see runPm).
+  if (!IS_WINDOWS || Bun.which("pm2")) return null;
+  const shim = Bun.which("oxmgr");
+  return shim && works(shim) ? shim : null;
+}
+
 function daemonManager(): DaemonManager {
   if (_daemonMgr) return _daemonMgr;
-  const oxmgrBin = Bun.which("oxmgr");
+  const oxmgrBin = findWorkingOxmgr();
   const pm2Bin = Bun.which("pm2");
   _daemonMgr = pickDaemonManager({
     oxmgrBin,
@@ -1951,6 +2113,10 @@ function daemonManager(): DaemonManager {
 // the managed process (it has no per-var flag like oxmgr's --env), so install
 // passes daemon env this way.
 async function runPm(mgr: DaemonManager, args: string[], env?: Record<string, string>): Promise<number> {
+  // A .cmd/.bat shim runs through cmd.exe, which treats & | < > ^ in an argument as syntax
+  // (e.g. the &s in a RECHROME_URL passed with --env): fail clearly instead of mangling it.
+  if (/\.(cmd|bat)$/i.test(mgr.bin) && args.some(a => /[&|<>^]/.test(a)))
+    throw new Error(`${mgr.bin} is a cmd.exe shim, which would mangle an argument containing & | < > ^. Install the ${mgr.id} executable (or set RECH_OXMGR to it) and try again.`);
   const proc = Bun.spawn([mgr.bin, ...args], {
     stdout: "inherit",
     stderr: "inherit",
@@ -2053,7 +2219,7 @@ async function ensureDaemonManager(ask: (q: string, def?: string) => Promise<str
   });
   const code = await proc.exited;
   if (code !== 0) throw new Error(`\`${command.join(" ")}\` failed (exit code ${code}). Resolve the installation error, then rerun setup.`);
-  if (!Bun.which("oxmgr")) {
+  if (!findWorkingOxmgr()) {
     throw new Error("oxmgr was installed but is not on PATH. Add the package manager's global bin directory to PATH, then rerun setup.");
   }
   _daemonMgr = undefined;
@@ -2172,7 +2338,7 @@ async function daemonUninstall(): Promise<void> {
   const mgr = daemonManager();
   for (const name of [PM_PROCESS_NAME, ...LEGACY_PROCESS_NAMES]) await runPm(mgr, ["delete", name]);
   if (mgr.id === "pm2") await runPm(mgr, ["save", "--force"]); // an emptied list must still overwrite the dump
-  else await runPm(mgr, ["service", "uninstall"]);
+  // oxmgr's boot/login service is left installed: every other oxmgr-managed process depends on it.
   console.log(`Removed ${mgr.id} process: ${PM_PROCESS_NAME}`);
 }
 

package/rechrome.ts

@@ -8,7 +8,7 @@ import { createHash, randomBytes } from "crypto";
 import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
-import { join, basename, dirname } from "path";
+import { join, basename, dirname, resolve } from "path";
 import { pathToFileURL } from "url";
 import { createRequire } from "node:module";
 import { spawn as cpSpawn } from "child_process";
@@ -942,16 +942,135 @@ export function buildProfileRows(cache: Record<string, ChromeProfileInfo> | null
   return rows;
 }
 
-/** PIDs of browser processes (not helpers) running on a Chrome user-data dir. POSIX only. */
-function browsersUsing(userDataDir: string): number[] {
-  if (process.platform === "win32") return [];
+/**
+ * Split a Windows command line into arguments the way the C runtime does (CommandLineToArgvW
+ * rules): whitespace separates outside quotes; quotes toggle and may sit mid-argument
+ * (`--x="C:\a"b` is `--x=C:\ab`); 2n backslashes before a quote are n backslashes and the quote
+ * toggles, 2n+1 are n and a literal quote; `""` inside quotes is a literal quote.
+ */
+export function splitWindowsCommandLine(commandLine: string): string[] {
+  const args: string[] = [];
+  let current = "", quoted = false, started = false;
+  for (let i = 0; i < commandLine.length; i++) {
+    const c = commandLine[i];
+    if (c === "\\") {
+      let n = 0;
+      while (commandLine[i] === "\\") { n++; i++; }
+      if (commandLine[i] === '"') {
+        current += "\\".repeat(n >> 1);
+        if (n % 2) current += '"'; else quoted = !quoted;
+      } else { current += "\\".repeat(n); i--; }
+      started = true;
+    } else if (c === '"') {
+      if (quoted && commandLine[i + 1] === '"') { current += '"'; i++; } else quoted = !quoted;
+      started = true;
+    } else if (!quoted && (c === " " || c === "\t")) {
+      if (started) { args.push(current); current = ""; started = false; }
+    } else { current += c; started = true; }
+  }
+  if (started) args.push(current);
+  return args;
+}
+
+/** The `--user-data-dir` value among exact arguments, or null. */
+export function userDataDirArg(args: string[]): string | null {
+  const arg = args.find(a => a.startsWith("--user-data-dir="));
+  return arg === undefined ? null : arg.slice("--user-data-dir=".length);
+}
+
+/** Same folder: exact path, ignoring trailing separators (and case on Windows). */
+export function sameDataDir(a: string, b: string, windows = process.platform === "win32"): boolean {
+  const norm = (p: string) => { const t = p.replace(/[\\/]+$/, ""); return windows ? t.replaceAll("/", "\\").toLowerCase() : t; };
+  return norm(a) === norm(b);
+}
+
+/**
+ * Match a flattened POSIX `ps` command line (no quotes, argument boundaries lost) against a
+ * user-data dir: "exact" only when the path is the last thing on the line; "ambiguous" when
+ * more text follows (another flag, or a sibling folder like `qa -backup`); else "none".
+ */
+export function flatUserDataDirMatch(command: string, userDataDir: string): "exact" | "ambiguous" | "none" {
+  const flag = `--user-data-dir=${userDataDir.replace(/\/+$/, "")}`;
+  const at = command.indexOf(flag);
+  if (at < 0 || (at > 0 && !/\s/.test(command[at - 1]))) return "none";
+  const rest = command.slice(at + flag.length);
+  if (/^\/*\s*$/.test(rest)) return "exact";
+  return /^\/*\s/.test(rest) ? "ambiguous" : "none";   // `qa2` / `qa-x` are other folders
+}
+
+/**
+ * Browser processes (not helpers) on this Chrome user-data dir. `exact`: certainly this folder
+ * (Windows command lines are split with the C runtime's rules; Linux reads argv from /proc).
+ * `ambiguous`: flattened `ps` output that may name a sibling folder — never killed.
+ */
+function browsersUsing(userDataDir: string): { exact: number[]; ambiguous: number[] } {
+  const exact: number[] = [], ambiguous: number[] = [];
+  const isHelper = (args: string[]) => args.some(a => a.startsWith("--type="));
+  if (process.platform === "win32") {
+    const out = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command",
+      "Get-CimInstance Win32_Process | ForEach-Object { \"$($_.ProcessId)`t$($_.CommandLine)\" }"], { windowsHide: true }).stdout.toString();
+    for (const line of out.split(/\r?\n/)) {
+      const tab = line.indexOf("\t"), pid = Number(line.slice(0, tab));
+      if (!pid || pid === process.pid) continue;
+      const args = splitWindowsCommandLine(line.slice(tab + 1));
+      const dir = userDataDirArg(args);
+      if (dir !== null && !isHelper(args) && sameDataDir(dir, userDataDir)) exact.push(pid);
+    }
+    return { exact, ambiguous };
+  }
   const ps = Bun.spawnSync(["ps", "ax", "-o", "pid=,command="]).stdout.toString();
-  return ps.split("\n").filter(line => line.includes(`--user-data-dir=${userDataDir}`) && !line.includes("--type="))
-    .map(line => Number(line.trim().split(/\s+/)[0])).filter(Boolean);
+  for (const line of ps.split("\n")) {
+    const m = /^\s*(\d+)\s+(.*)$/.exec(line);
+    if (!m || Number(m[1]) === process.pid || !m[2].includes("--user-data-dir=")) continue;
+    const pid = Number(m[1]);
+    let argv: string[] | null = null;
+    try { argv = readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").filter(Boolean); } catch { /* not Linux, or gone */ }
+    if (argv) {
+      const dir = userDataDirArg(argv);
+      if (dir !== null && !isHelper(argv) && sameDataDir(dir, userDataDir, false)) exact.push(pid);
+      continue;
+    }
+    if (/(?:^|\s)--type=/.test(m[2])) continue;
+    const match = flatUserDataDirMatch(m[2], userDataDir);
+    if (match === "exact") exact.push(pid);
+    else if (match === "ambiguous") ambiguous.push(pid);
+  }
+  return { exact, ambiguous };
 }
 
 /** Move a folder to the user's Trash (recoverable). Returns where it went, or null if unsupported here. */
 function moveToTrash(dir: string): string | null {
+  // An explicit trash folder (tests use it to keep the real Trash / Recycle Bin clean).
+  const override = process.env.RECH_TRASH_DIR;
+  if (override) {
+    mkdirSync(override, { recursive: true });
+    let dest = join(override, basename(dir));
+    if (existsSync(dest)) dest = `${dest} ${new Date().toISOString().replace(/[:.]/g, "-")}`;
+    renameSync(dir, dest);
+    return dest;
+  }
+  if (process.platform === "win32") {
+    // SHFileOperation with ALLOWUNDO sends it to the Recycle Bin, with no prompts or progress UI.
+    // WANTNUKEWARNING makes Windows ask rather than silently delete for good when the item
+    // cannot be recycled. (.NET's FileSystem.DeleteDirectory(..., SendToRecycleBin) deleted
+    // permanently here.) The path goes through the environment so quoting can't break it.
+    const source = [
+      "using System; using System.Runtime.InteropServices;",
+      "public static class RechRecycle {",
+      "  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]",
+      "  struct Op { public IntPtr hwnd; public uint wFunc; public string pFrom; public string pTo; public ushort fFlags; public bool aborted; public IntPtr mappings; public string title; }",
+      "  [DllImport(\"shell32.dll\", CharSet = CharSet.Unicode)] static extern int SHFileOperation(ref Op op);",
+      "  public static int Recycle(string path) {",
+      "    var op = new Op { wFunc = 3, pFrom = path + \"\\0\\0\", fFlags = 0x0040 | 0x0010 | 0x0004 | 0x0400 | 0x4000 };",
+      "    int r = SHFileOperation(ref op); return op.aborted ? -1 : r;",
+      "  }",
+      "}",
+    ].join("\n");
+    const r = Bun.spawnSync(["powershell", "-NoProfile", "-NonInteractive", "-Command",
+      "Add-Type -TypeDefinition $env:RECH_RECYCLE_SOURCE; exit [RechRecycle]::Recycle($env:RECH_RECYCLE_PATH)"],
+      { env: { ...process.env, RECH_RECYCLE_SOURCE: source, RECH_RECYCLE_PATH: dir.replaceAll("/", "\\").replace(/\\+$/, "") }, windowsHide: true }); // SHFileOperation rejects `/` and a trailing `\`
+    return r.exitCode === 0 && !existsSync(dir) ? "the Recycle Bin" : null;
+  }
   const trash = process.platform === "darwin" ? join(HOME, ".Trash") : process.platform === "linux" ? join(HOME, ".local", "share", "Trash", "files") : null;
   if (!trash) return null;
   mkdirSync(trash, { recursive: true });
@@ -972,13 +1091,17 @@ async function removeProfile(selector: string, opts: { yes?: boolean; close?: bo
   const key = (await resolveGlobalProfile(registry, cache, selector)).email;
   const config = await readListeners();
   const plan = planProfileRemoval(key, registry, config?.listeners ?? [], join(RECH_DIR, "profiles"));
-  const running = plan.dataDir ? browsersUsing(plan.dataDir) : [];
+  const using = plan.dataDir ? browsersUsing(plan.dataDir) : { exact: [], ambiguous: [] };
+  const running = using.exact;
   console.log(`Remove profile "${key}"${plan.keys.length > 1 ? ` (registered as ${plan.keys.join(", ")})` : ""}:`);
   for (const edit of plan.listeners) console.log(edit.drop ? `  - remove listener "${edit.name}" (it serves only this profile)` : `  - stop sharing it on listener "${edit.name}"`);
   console.log(`  - unregister it from rech (~/.rechrome/profiles.yaml)`);
   if (plan.dataDir) console.log(`  - move its data folder to the Trash: ${plan.dataDir}`);
   else console.log(`  - its Chrome data is left alone (this only unregisters it from rech)`);
   if (running.length) console.log(`  - close its browser window, which is running now (pid ${running.join(", ")})`);
+  // A process that may be on this folder or on a sibling one: never killed, and nothing changes.
+  if (using.ambiguous.length)
+    throw new Error(`A process that may be using ${plan.dataDir} is running (pid ${using.ambiguous.join(", ")}), and rech can't tell it from one on a similarly named folder. Close it yourself, then run this again. Nothing changed.`);
   const interactive = isInteractive();
   if (!opts.yes) {
     if (!interactive) throw new Error("Not removed. Re-run with --yes to confirm" + (running.length ? " and --close to close its running window." : "."));
@@ -989,8 +1112,8 @@ async function removeProfile(selector: string, opts: { yes?: boolean; close?: bo
     // In a terminal, confirming the plan above (which lists closing it) is the consent; otherwise --close.
     if (!interactive && !opts.close) throw new Error("Its window is running; re-run with --close to close it, or close it yourself first.");
     for (const pid of running) process.kill(pid, "SIGTERM");
-    for (let i = 0; i < 40 && browsersUsing(plan.dataDir!).length; i++) await Bun.sleep(250);
-    if (browsersUsing(plan.dataDir!).length) throw new Error("Its window did not close; close it and run this again. Nothing else changed.");
+    for (let i = 0; i < 40 && browsersUsing(plan.dataDir!).exact.length; i++) await Bun.sleep(250);
+    if (browsersUsing(plan.dataDir!).exact.length) throw new Error("Its window did not close; close it and run this again. Nothing else changed.");
   }
   if (config && plan.listeners.length) {
     for (const edit of plan.listeners) {
@@ -1011,7 +1134,7 @@ async function removeProfile(selector: string, opts: { yes?: boolean; close?: bo
   }
   let moved: string | null = null;
   if (plan.dataDir && existsSync(plan.dataDir)) moved = moveToTrash(plan.dataDir);
-  console.log(`Removed "${key}".${moved ? ` Its data folder is in the Trash: ${moved}` : plan.dataDir ? ` Its data folder was left at ${plan.dataDir}; delete it yourself if you like.` : ""}`);
+  console.log(`Removed "${key}".${moved ? ` Its data folder was moved to ${moved}.` : plan.dataDir ? ` Its data folder was left at ${plan.dataDir}; delete it yourself if you like.` : ""}`);
 }
 
 /** On a client of a remote host, `rech profile` lists what that host's link shares. */
@@ -1930,9 +2053,48 @@ function oxmgrVersion(bin: string): string | null {
 // RECH_DAEMON_MANAGER override — lives in ./daemon-manager.ts (pure + tested);
 // here we just supply the runtime inputs (what's on PATH, the oxmgr version).
 let _daemonMgr: DaemonManager | undefined;
+/**
+ * The first oxmgr that actually runs. PATH order alone isn't enough: a stale global shim
+ * (e.g. bun's, printing "oxmgr binary is missing") can shadow a working build, and npm's
+ * `oxmgr.cmd` re-parses argv through cmd.exe, so real executables come first. RECH_OXMGR
+ * names one explicitly (a path, or a command looked up on PATH). The successful probe's
+ * output seeds the version cache, so `--version` runs once.
+ */
+function findWorkingOxmgr(): string | null {
+  const ext = IS_WINDOWS ? ".exe" : "";
+  // Windows PATH entries may be quoted ("C:\Program Files\x"); quotes break the joined path.
+  const dirs = (process.env.PATH ?? "").split(IS_WINDOWS ? ";" : ":").map(d => d.trim().replace(/^"(.*)"$/, "$1")).filter(Boolean);
+  const override = process.env.RECH_OXMGR;
+  const candidates = [
+    override && (/[\\/]/.test(override) ? resolve(override) : Bun.which(override)),
+    ...dirs.map(d => join(d, `oxmgr${ext}`)),
+    // The vendored binary inside a global npm / bun install of the `oxmgr` package
+    // (npm: <dir>/node_modules on Windows, <prefix>/lib/node_modules beside <prefix>/bin elsewhere).
+    ...dirs.map(d => join(d, "node_modules", "oxmgr", "vendor", `oxmgr${ext}`)),
+    ...(IS_WINDOWS ? [] : dirs.map(d => join(d, "..", "lib", "node_modules", "oxmgr", "vendor", "oxmgr"))),
+    join(HOME, ".bun", "install", "global", "node_modules", "oxmgr", "vendor", `oxmgr${ext}`),
+  ].filter((p): p is string => !!p && existsSync(p));
+  const works = (p: string) => {
+    try {
+      const r = Bun.spawnSync([p, "--version"], { stdout: "pipe", stderr: "ignore", windowsHide: true });
+      if (r.exitCode !== 0) return false;
+      const m = /(\d+\.\d+\.\d+[^\s]*)/.exec(r.stdout?.toString() ?? "");
+      _oxmgrVersion = m ? m[1]! : null;
+      return true;
+    } catch { return false; }
+  };
+  const exe = [...new Set(candidates)].find(works);
+  if (exe) return exe;
+  // Last resort (Windows): a working shim such as npm's oxmgr.cmd, but never over a working
+  // pm2 — cmd.exe re-parses a shim's argv (see runPm).
+  if (!IS_WINDOWS || Bun.which("pm2")) return null;
+  const shim = Bun.which("oxmgr");
+  return shim && works(shim) ? shim : null;
+}
+
 function daemonManager(): DaemonManager {
   if (_daemonMgr) return _daemonMgr;
-  const oxmgrBin = Bun.which("oxmgr");
+  const oxmgrBin = findWorkingOxmgr();
   const pm2Bin = Bun.which("pm2");
   _daemonMgr = pickDaemonManager({
     oxmgrBin,
@@ -1951,6 +2113,10 @@ function daemonManager(): DaemonManager {
 // the managed process (it has no per-var flag like oxmgr's --env), so install
 // passes daemon env this way.
 async function runPm(mgr: DaemonManager, args: string[], env?: Record<string, string>): Promise<number> {
+  // A .cmd/.bat shim runs through cmd.exe, which treats & | < > ^ in an argument as syntax
+  // (e.g. the &s in a RECHROME_URL passed with --env): fail clearly instead of mangling it.
+  if (/\.(cmd|bat)$/i.test(mgr.bin) && args.some(a => /[&|<>^]/.test(a)))
+    throw new Error(`${mgr.bin} is a cmd.exe shim, which would mangle an argument containing & | < > ^. Install the ${mgr.id} executable (or set RECH_OXMGR to it) and try again.`);
   const proc = Bun.spawn([mgr.bin, ...args], {
     stdout: "inherit",
     stderr: "inherit",
@@ -2053,7 +2219,7 @@ async function ensureDaemonManager(ask: (q: string, def?: string) => Promise<str
   });
   const code = await proc.exited;
   if (code !== 0) throw new Error(`\`${command.join(" ")}\` failed (exit code ${code}). Resolve the installation error, then rerun setup.`);
-  if (!Bun.which("oxmgr")) {
+  if (!findWorkingOxmgr()) {
     throw new Error("oxmgr was installed but is not on PATH. Add the package manager's global bin directory to PATH, then rerun setup.");
   }
   _daemonMgr = undefined;
@@ -2172,7 +2338,7 @@ async function daemonUninstall(): Promise<void> {
   const mgr = daemonManager();
   for (const name of [PM_PROCESS_NAME, ...LEGACY_PROCESS_NAMES]) await runPm(mgr, ["delete", name]);
   if (mgr.id === "pm2") await runPm(mgr, ["save", "--force"]); // an emptied list must still overwrite the dump
-  else await runPm(mgr, ["service", "uninstall"]);
+  // oxmgr's boot/login service is left installed: every other oxmgr-managed process depends on it.
   console.log(`Removed ${mgr.id} process: ${PM_PROCESS_NAME}`);
 }
 

package/serve.js

@@ -496,7 +496,7 @@ export async function serve() {
   if (certPath && keyPath) {
     const renewed = await renewCertIfNeeded(certPath, keyPath);
     if (renewed) { log("Restarting to load renewed TLS cert..."); process.exit(0); }
-    // Check daily; pm2 restarts cleanly after exit(0)
+    // Check daily; the process manager (oxmgr --restart always, or pm2) restarts cleanly after exit(0)
     setInterval(async () => {
       if (await renewCertIfNeeded(certPath, keyPath)) { log("Restarting to load renewed TLS cert..."); process.exit(0); }
     }, 86_400_000);

package/serve.ts

@@ -496,7 +496,7 @@ export async function serve() {
   if (certPath && keyPath) {
     const renewed = await renewCertIfNeeded(certPath, keyPath);
     if (renewed) { log("Restarting to load renewed TLS cert..."); process.exit(0); }
-    // Check daily; pm2 restarts cleanly after exit(0)
+    // Check daily; the process manager (oxmgr --restart always, or pm2) restarts cleanly after exit(0)
     setInterval(async () => {
       if (await renewCertIfNeeded(certPath, keyPath)) { log("Restarting to load renewed TLS cert..."); process.exit(0); }
     }, 86_400_000);