rechrome 1.33.0 → 1.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.33.0",
+  "version": "1.35.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -84,6 +84,8 @@ async function saveTokenEntry(profileEmail: string, entry: TokenEntry): Promise<
 }
 
 const envFile = join(import.meta.dir, ".env.local");
+/** Machine-wide RECHROME_URL from `rech connect --global`: read from every folder, after the project's own files. */
+export const GLOBAL_ENV_FILE = join(RECH_DIR, ".env.local");
 const globalEnvFile = join(HOME || "~", ".env.local");
 
 // Capture inherited values once so explicit environment overrides survive reloads,
@@ -127,10 +129,15 @@ const bunLoaded = bunAutoloadedKeys(process.env,
     .map(name => { try { return readFileSync(join(process.cwd(), name), "utf8"); } catch { return ""; } }));
 const inheritedEnvKeys = new Set(Object.keys(process.env).filter(key => !bunLoaded.has(key)));
 
+/** Where RECHROME_URL came from: "environment", an env file's path, or undefined when unset. */
+export let rechromeUrlSource: string | undefined;
+
 // Walk CWD→root loading env files nearest-first; inherited environment wins over files.
 // At each level .rechrome/.env.local is checked before .env.local (rechrome-specific overrides general).
-export async function loadNearestEnv(extraFallbacks: string[] = []) {
+// The machine-wide file comes last, so it also applies outside $HOME (e.g. an agent's /tmp scratch dir).
+export async function loadNearestEnv(extraFallbacks: string[] = [GLOBAL_ENV_FILE]) {
   const seen = new Set<string>(inheritedEnvKeys);
+  rechromeUrlSource = seen.has(ENV_KEY) ? "environment" : undefined;
   const applyFile = async (path: string) => {
     const raw = await file(path).text().catch(() => "");
     for (const line of raw.split("\n")) {
@@ -138,6 +145,7 @@ export async function loadNearestEnv(extraFallbacks: string[] = []) {
       if (!m || m[1].startsWith("#")) continue;
       if (seen.has(m[1])) continue;
       seen.add(m[1]);
+      if (m[1] === ENV_KEY) rechromeUrlSource = path;
       process.env[m[1]] = m[2].replace(/^["']|["']$/g, "");
     }
   };
@@ -382,18 +390,27 @@ export function buildListenChoices(interfaces: ReturnType<typeof networkInterfac
 const TAILSCALE_ENV = { ...process.env, TAILSCALE_BE_CLI: "1" };
 const tailscaleBinary = () => Bun.which("tailscale") || (existsSync("/Applications/Tailscale.app/Contents/MacOS/Tailscale") ? "/Applications/Tailscale.app/Contents/MacOS/Tailscale" : null);
 
-/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
-async function runTailscale(args: string[]): Promise<string | null> {
+/** Run the Tailscale CLI read-only: its output, or why it gave none (missing, failed, slow). */
+async function runTailscaleDetailed(args: string[]): Promise<{ output: string } | { error: string; missing?: true }> {
   const binary = tailscaleBinary();
-  if (!binary) return null;
+  if (!binary) return { error: "not installed", missing: true };
   try {
-    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "pipe", stderr: "ignore" });
-    const timeout = setTimeout(() => proc.kill(), 2000);
+    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "pipe", stderr: "pipe" });
+    let timedOut = false;
+    const timeout = setTimeout(() => { timedOut = true; proc.kill(); }, 2000);
     try {
-      const output = await new Response(proc.stdout).text();
-      return await proc.exited === 0 ? output : null;
+      const [output, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+      if (await proc.exited === 0) return { output };
+      const reason = timedOut ? "no answer within 2s" : (stderr.trim() || output.trim()).split("\n")[0] || `exit ${proc.exitCode}`;
+      return { error: `\`tailscale ${args.join(" ")}\`: ${reason}` };
     } finally { clearTimeout(timeout); }
-  } catch { return null; }
+  } catch (error) { return { error: String(error) }; }
+}
+
+/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
+async function runTailscale(args: string[]): Promise<string | null> {
+  const result = await runTailscaleDetailed(args);
+  return "output" in result ? result.output : null;
 }
 
 export async function detectListenChoices(): Promise<ListenChoice[]> {
@@ -514,32 +531,71 @@ async function removeTailscaleServeRoutes(listener: { port: number; prefix?: str
   }
 }
 
+type HealthListener = Pick<Listener, "name" | "port" | "prefix" | "profiles">;
+
+/**
+ * Read-only Tailscale Serve health for the listeners: `absent` (no Tailscale here), `unresponsive`
+ * (installed, but its CLI doesn't answer — e.g. not running, or the Mac app's GUI binary), or
+ * `ok` with each shared listener's route plus the routes to re-point or remove.
+ */
+export type TailscaleHealth =
+  | { state: "absent" }
+  | { state: "unresponsive"; error: string }
+  | { state: "ok"; routes: { listener: string; port: number; url: string | null }[]; repair: ServeRepair[]; stale: ServeStale[] };
+
+export async function inspectTailscaleServe(listeners: HealthListener[]): Promise<TailscaleHealth> {
+  const [serve, status] = await Promise.all([runTailscaleDetailed(["serve", "status", "--json"]), runTailscale(["status", "--json"])]);
+  if (!("output" in serve)) return serve.missing ? { state: "absent" } : { state: "unresponsive", error: serve.error };
+  let serveStatus: unknown, dnsName: string | null = null;
+  try { serveStatus = JSON.parse(serve.output || "null"); } catch { return { state: "unresponsive", error: "`tailscale serve status --json` printed no JSON" }; }
+  try { dnsName = (JSON.parse(status ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") || null; } catch { /* not connected */ }
+  const routes = listeners.filter(l => l.profiles !== "*")
+    .map(l => ({ listener: l.name, port: l.port, url: findTailscaleServeRoute(dnsName, serveStatus, l.port, normalizePrefix(l.prefix)) }));
+  return { state: "ok", routes, ...planTailscaleServeRepairs(serveStatus, listeners) };
+}
+
+const httpsPortOf = (hostPort: string) => hostPort.split(/:(?=\d+$)/)[1] ?? "443";
+
+/** Problems in a health report, one line each with the command that fixes it; empty when healthy. */
+export function tailscaleHealthProblems(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  if (health.state === "unresponsive") return [`Tailscale is installed but its CLI doesn't answer, so Serve routes go unchecked: ${health.error}`];
+  return [
+    ...health.repair.map(r => `${r.hostPort}${r.mount} proxies to 127.0.0.1:${r.from}, but the listener is on ${r.to} (clients get HTTP 502). Fix: tailscale serve --bg --https=${httpsPortOf(r.hostPort)} --set-path=${r.mount} ${r.proxy}`),
+    ...health.stale.map(st => `${st.hostPort}${st.mount} proxies to 127.0.0.1:${st.port}, where no listener runs (clients get HTTP 502). Remove it: tailscale serve --https=${httpsPortOf(st.hostPort)} --set-path=${st.mount} off`),
+  ];
+}
+
+/** The `tailscale:` block of `rech status` / `rech share ls`: each shared listener's route, then problems. */
+export function formatTailscaleHealth(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  const lines = health.state === "ok"
+    ? health.routes.map(r => r.url ? `✓ ${r.listener} → ${r.url} (127.0.0.1:${r.port})` : `- ${r.listener}: no Tailscale Serve route (fine if another proxy exposes it)`)
+    : [];
+  lines.push(...tailscaleHealthProblems(health).map(p => `⚠ ${p}`));
+  return lines.map((line, i) => `${i ? " ".repeat(11) : "tailscale: "}${line}`);
+}
+
 /**
  * Daemon health check: keep Tailscale Serve routes pointed at the listeners' current ports.
  * Re-points a moved listener's route on this node; only reports stale routes (removing a
- * route is the user's call). Returns log lines, empty when healthy or Tailscale is absent.
+ * route is the user's call) and a Tailscale CLI that doesn't answer. Returns log lines, empty
+ * when healthy or Tailscale is absent.
  */
-export async function checkTailscaleServe(listeners: { port: number; prefix?: string }[]): Promise<string[]> {
+export async function checkTailscaleServe(listeners: HealthListener[]): Promise<string[]> {
+  const health = await inspectTailscaleServe(listeners);
   const binary = tailscaleBinary();
-  if (!binary) return [];
-  const raw = await runTailscale(["serve", "status", "--json"]);
-  if (!raw) return [];
-  let serveStatus: unknown;
-  try { serveStatus = JSON.parse(raw); } catch { return []; }
-  const { repair, stale } = planTailscaleServeRepairs(serveStatus, listeners);
+  if (health.state !== "ok" || !binary) return tailscaleHealthProblems(health).map(p => `tailscale serve: ${p}`);
   const lines: string[] = [];
-  for (const r of repair) {
-    const httpsPort = r.hostPort.split(/:(?=\d+$)/)[1] ?? "443";
-    const args = ["serve", "--bg", `--https=${httpsPort}`, `--set-path=${r.mount}`, r.proxy];
+  for (const r of health.repair) {
+    const args = ["serve", "--bg", `--https=${httpsPortOf(r.hostPort)}`, `--set-path=${r.mount}`, r.proxy];
     const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "pipe", windowsHide: true });
     const ok = await proc.exited === 0;
     lines.push(ok
       ? `tailscale serve: re-pointed ${r.hostPort}${r.mount} from 127.0.0.1:${r.from} to ${r.to}`
       : `tailscale serve: ${r.hostPort}${r.mount} points at 127.0.0.1:${r.from}, listener is on ${r.to}; re-pointing failed (${(await new Response(proc.stderr).text()).trim()}). Run: tailscale ${args.join(" ")}`);
   }
-  for (const s of stale) {
-    lines.push(`tailscale serve: ${s.hostPort}${s.mount} proxies to 127.0.0.1:${s.port}, where no listener runs (clients get HTTP 502). Remove it: tailscale serve --https=${s.hostPort.split(/:(?=\d+$)/)[1] ?? "443"} --set-path=${s.mount} off`);
-  }
+  lines.push(...tailscaleHealthProblems({ ...health, repair: [] }).map(p => `tailscale serve: ${p}`));
   return lines;
 }
 
@@ -2718,6 +2774,9 @@ async function provisionExtensionToken(opts: {
     `--profile-directory=${profileDir}`,
     `--load-extension=${dist}`,
     `--disable-extensions-except=${dist}`,
+    // Chromium 137+ ignores --load-extension unless this feature is off (Chrome for Testing
+    // too): the extension silently never loads and status.html is an error page.
+    "--disable-features=DisableLoadExtensionCommandLineSwitch",
     "--remote-debugging-port=0",
     "--no-first-run",
     "--no-default-browser-check",
@@ -2725,40 +2784,70 @@ async function provisionExtensionToken(opts: {
   ];
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
+  // Headless can't answer a Keychain prompt, so first launch could stall on it (as Playwright does).
+  if (process.platform === "darwin") args.push("--use-mock-keychain");
   args.push("about:blank");
   const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
+  // Every step is bounded: a stuck Chrome must end in an error, never a silent hang.
+  const within = <T>(ms: number, what: string, work: Promise<T>) => Promise.race([work,
+    Bun.sleep(ms).then(() => { throw new Error(`${what} took over ${ms / 1000}s`); })]);
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
     let port: number | null = null;
-    for (let i = 0; i < 100; i++) {
+    for (let i = 0; i < 300; i++) {
       await Bun.sleep(100);
       const line = (await file(portFile).text().catch(() => "")).split("\n")[0]?.trim();
       if (line && /^\d+$/.test(line)) { port = parseInt(line); break; }
       if (proc.exitCode !== null) throw new Error("Chrome exited before opening the DevTools port");
     }
-    if (!port) throw new Error("Chrome DevTools port not found (extension may have failed to load)");
-    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json();
+    if (!port) throw new Error("Chrome didn't open its DevTools port within 30s");
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(5000) })).json();
     cdp = new CDPClient(ver.webSocketDebuggerUrl as string);
-    await cdp.open();
-    const { targetId } = await cdp.send("Target.createTarget", { url: `chrome-extension://${EXTENSION_ID}/status.html` });
+    await within(5000, "Connecting to Chrome DevTools", cdp.open());
+    // Wait for the extension's service worker: if it never shows, the extension didn't load.
+    const extensionUrl = `chrome-extension://${EXTENSION_ID}/`;
+    let loaded = false;
+    for (let i = 0; i < 50 && !loaded; i++) {
+      const { targetInfos } = await cdp.send("Target.getTargets");
+      loaded = (targetInfos as { url: string }[]).some(t => t.url.startsWith(extensionUrl));
+      if (!loaded) await Bun.sleep(200);
+    }
+    if (!loaded) throw new Error(`The extension at ${dist} didn't load in Chrome for Testing (no ${extensionUrl} target within 10s)`);
+    const { targetId } = await cdp.send("Target.createTarget", { url: `${extensionUrl}status.html` });
     const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
     // The extension page may still be loading; retry the write until localStorage reflects it.
-    let ok = false;
+    let ok = false, last = "";
     const expr = `(()=>{try{localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
-    for (let i = 0; i < 50; i++) {
-      const r = await cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId).catch(() => null);
-      if (r?.result?.value === token) { ok = true; break; }
-      await Bun.sleep(100);
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline) {
+      const r = await within(3000, "Runtime.evaluate", cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId)).catch(e => ({ error: String(e) }));
+      const value = (r as any)?.result?.value;
+      if (value === token) { ok = true; break; }
+      last = typeof value === "string" ? value : (r as any)?.error ?? (r as any)?.result?.description ?? "";
+      await Bun.sleep(200);
     }
-    if (!ok) throw new Error(`Could not seed auth token into chrome-extension://${EXTENSION_ID}/ (is the extension loading?)`);
+    if (!ok) throw new Error(`Could not seed auth token into ${extensionUrl}${last ? ` (${last})` : ""}`);
     // Graceful close flushes localStorage to the profile's leveldb before we kill Chrome.
-    await cdp.send("Browser.close").catch(() => {});
+    await within(5000, "Browser.close", cdp.send("Browser.close")).catch(() => {});
+    await within(5000, "Chrome exit", proc.exited).catch(() => {});
   } finally {
     cdp?.close();
+    await stopThrowawayChrome(proc, userDataDir);
+  }
+}
+
+/**
+ * Stop a Chrome we launched on a throwaway user-data-dir: SIGTERM, then SIGKILL, then any helper
+ * still holding that exact --user-data-dir (scoped to it, so never the user's own Chrome).
+ */
+async function stopThrowawayChrome(proc: ReturnType<typeof Bun.spawn>, userDataDir: string): Promise<void> {
+  if (proc.exitCode === null) {
     try { proc.kill(); } catch {}
-    await proc.exited.catch(() => {});
+    const exited = await Promise.race([proc.exited.then(() => true, () => true), Bun.sleep(3000).then(() => false)]);
+    if (!exited) { try { proc.kill("SIGKILL"); } catch {} await Promise.race([proc.exited.catch(() => {}), Bun.sleep(2000)]); }
   }
+  if (process.platform !== "win32") Bun.spawnSync(["pkill", "-9", "-f", `--user-data-dir=${userDataDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}( |$)`], { stdout: "ignore", stderr: "ignore" });
 }
 
 async function provisionProfile(name: string, opts: { headed?: boolean } = {}): Promise<void> {
@@ -2952,6 +3041,8 @@ async function urlList(): Promise<void> {
   printTable(rows);
   const wide = config.listeners.filter(l => l.profiles !== "*" && l.profiles.length > 1);
   if (wide.length) console.log(`\nOne key covers several profiles on: ${wide.map(l => `${l.name} (${(l.profiles as string[]).length})`).join(", ")}. Anyone with such a link can use each of them.`);
+  const tailscale = formatTailscaleHealth(await inspectTailscaleServe(config.listeners));
+  if (tailscale.length) console.log(`\n${tailscale.join("\n")}`);
   console.log(`\nPrint a full URL (contains the secret key): rech share <profile>, or rech share --all`);
 }
 
@@ -2961,14 +3052,42 @@ async function saveProjectUrl(url: string): Promise<string> {
   mkdirSync(dataDir, { recursive: true });
   const gitignore = join(dataDir, ".gitignore");
   if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
-  const envPath = join(dataDir, ".env.local");
+  return writeEnvUrl(join(dataDir, ".env.local"), url);
+}
+
+/** Write RECHROME_URL to ~/.rechrome/.env.local: the default for every project without its own. */
+async function saveGlobalUrl(url: string): Promise<string> {
+  mkdirSync(dirname(GLOBAL_ENV_FILE), { recursive: true });
+  return writeEnvUrl(GLOBAL_ENV_FILE, url);
+}
+
+/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
+async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
   await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
   await chmod(envPath, 0o600);
   return envPath;
 }
 
-async function connect(url: string): Promise<void> {
+/**
+ * What would shadow the machine-wide RECHROME_URL from `cwd`: the shell's own RECHROME_URL, or the
+ * nearest project env file that sets one (searched the way loadNearestEnv walks). Null when none does.
+ */
+export function nearerUrlSource(cwd: string, inherited: boolean, globalFile = GLOBAL_ENV_FILE): string | null {
+  if (inherited) return "your shell's RECHROME_URL";
+  const globalReal = (() => { try { return realpathSync(globalFile); } catch { return globalFile; } })();
+  for (let dir = cwd; ; dir = dirname(dir)) {
+    for (const path of [join(dir, ".rechrome", ".env.local"), join(dir, ".env.local")]) {
+      if (path === globalFile || path === globalReal) return null;
+      const text = (() => { try { return readFileSync(path, "utf8"); } catch { return ""; } })();
+      if (text.split("\n").some(line => line.trimStart().startsWith(`${ENV_KEY}=`))) return path;
+    }
+    if (dirname(dir) === dir) return null;
+  }
+}
+
+async function connect(url: string, opts: { global?: boolean; project?: boolean } = {}): Promise<void> {
+  if (opts.global && opts.project) throw new Error("Pass --global or --project, not both.");
   const parsed = parseUrl(url);
   if (!parsed.key) throw new Error("That URL has no key (#key=…). Ask the host for the full URL from: rech share <profile>");
   const response = await fetch(serviceUrl(url, "ping"), { headers: { Authorization: `Bearer ${parsed.key}` }, signal: AbortSignal.timeout(5000) })
@@ -2978,8 +3097,24 @@ async function connect(url: string): Promise<void> {
   const body = await response.json().catch(() => ({})) as { listener?: string; profiles?: string[] | "*" };
   if (parsed.profileDirectory && Array.isArray(body.profiles) && !body.profiles.includes(parsed.profileDirectory))
     throw new Error(`Connected, but listener "${body.listener}" does not allow profile "${parsed.profileDirectory}".`);
-  const saved = await saveProjectUrl(url);
-  console.log(`Connected to ${serviceUrl(url)}${body.listener ? ` (listener ${body.listener})` : ""}. Saved RECHROME_URL to ${saved}`);
+  // Where to save: the flag, else ask in a terminal (this project by default), else this project.
+  let global = !!opts.global;
+  if (!opts.global && !opts.project && isInteractive()) {
+    const { dataDir } = await getClientIdentity();
+    const choice = await promptChoice("Use this link for:", [
+      { label: `This project only  (${join(dataDir, ".env.local")})`, value: "project" },
+      { label: `Every project on this machine without its own link  (${GLOBAL_ENV_FILE})`, value: "global" },
+    ], 0);
+    if (!choice) throw new Error("Cancelled; nothing saved.");
+    global = choice === "global";
+  }
+  // A machine running its own daemon would stop reaching its own Chrome from every project without a link.
+  if (global && !(await isLocalDaemon(url)) && (await readListeners().catch(() => null))?.listeners.length)
+    console.error(`[rech] warning: this machine runs its own rech daemon. Projects without their own RECHROME_URL will now use ${serviceUrl(url)}, not this machine's Chrome. Undo: remove ${ENV_KEY} from ${GLOBAL_ENV_FILE}`);
+  const saved = global ? await saveGlobalUrl(url) : await saveProjectUrl(url);
+  console.log(`Connected to ${serviceUrl(url)}${body.listener ? ` (listener ${body.listener})` : ""}. Saved RECHROME_URL ${global ? "for every project on this machine" : "for this project"}: ${saved}`);
+  const shadow = global ? nearerUrlSource(process.cwd(), inheritedEnvKeys.has(ENV_KEY)) : null;
+  if (shadow) console.log(`Note: here, ${shadow} takes precedence over it. Remove that, or run rech connect --project to update it.`);
   if (Array.isArray(body.profiles) && body.profiles.length > 1) {
     console.log(`This link shares ${body.profiles.length} profiles:`);
     for (const p of body.profiles) console.log(`  ${p}${p === parsed.profileDirectory ? "  (default)" : ""}`);
@@ -3403,7 +3538,12 @@ async function status(): Promise<void> {
     : null;
   // Show the URL this client connects to; through a proxy, the daemon's bind is on another port.
   const details = [pingBody?.listener && `listener ${pingBody.listener}`, pingBody?.bind && `bind ${pingBody.bind}`].filter(Boolean).join(", ");
-  console.log(`serve:    ${ping ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}` : `not reachable at ${serviceUrl(url)}`}`);
+  // Any HTTP answer is not the daemon: a proxy's 404/502 means the link's listener is gone or moved.
+  const answered = pingResponse?.ok || pingResponse?.status === 401;
+  console.log(`serve:    ${!ping ? `not reachable at ${serviceUrl(url)}`
+    : answered ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}`
+    : `✗ ${serviceUrl(url)} answers HTTP ${pingResponse?.status ?? ping.status}, not a rechrome daemon — this link's listener was likely removed or moved; ask its host for a fresh link (\`rech share <profile>\`), then \`rech connect '<url>'\``}`);
+  if (rechromeUrlSource) console.log(`config:   ${rechromeUrlSource === "environment" ? "RECHROME_URL from the environment" : rechromeUrlSource}${rechromeUrlSource === GLOBAL_ENV_FILE ? "  (machine-wide)" : ""}`);
   if (pingResponse?.status === 401)
     console.log(`auth:     ✗ key rejected — ask the host for a fresh URL (\`rech share <profile>\`), then \`rech connect '<url>'\``);
   // daemonManager().id — there is no PM_BIN constant. Referencing one threw a
@@ -3426,7 +3566,11 @@ async function status(): Promise<void> {
   const current = effective ? await resolveProfileEmail(effective).catch(() => effective) : undefined;
   const allowed = pingBody?.profiles === "*" ? "all registered profiles" : pingBody?.profiles?.join(", ");
   console.log(`profile:  ${current ?? "(none selected; add ?profile= to the URL or pass --profile)"}${allowed ? `  — this listener serves: ${allowed}` : ""}`);
-  if (isHost) console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  if (isHost) {
+    const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+    for (const line of formatTailscaleHealth(await inspectTailscaleServe(listeners))) console.log(line);
+    console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  }
 }
 
 
@@ -3442,7 +3586,7 @@ export type RechHandlers = {
   printProfileUri(selector?: string, listener?: string, opts?: { local?: boolean; save?: boolean; all?: boolean }): Promise<void>;
   urlList(): Promise<void>;
   shareProfiles(selectors: string[], opts: { listener?: string; local?: boolean; save?: boolean }): Promise<void>;
-  connect(url: string): Promise<void>;
+  connect(url: string, opts?: { global?: boolean; project?: boolean }): Promise<void>;
   listenerPort(name?: string): Promise<void>;
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
@@ -3537,10 +3681,14 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         }
         return handlers.printProfileUri(profiles[0], a.listener, a.all ? { local: a.local, save: a.save, all: true } : { local: a.local, save: a.save });
       })
-    .command("connect <url>", "Use a URL from another machine in this project (checks it first)", y => y
+    .command("connect <url>", "Use a URL from another machine (checks it first; asks: this project or every project)", y => y
       .positional("url", { type: "string", demandOption: true, describe: "The URL printed by `rech share <profile>` on the machine with Chrome. Quote it: it contains #" })
-      .example("rech connect 'https://host.example.js.net/rechrome/?profile=you%40example.com#key=…'", ""),
-      a => handlers.connect(a.url))
+      .option("project", { type: "boolean", describe: "Save it for this project only (.rechrome/.env.local); the default without a terminal" })
+      .option("global", { type: "boolean", describe: "Save it for every project on this machine without its own link (~/.rechrome/.env.local)" })
+      .conflicts("project", "global")
+      .example("rech connect 'https://host.example.js.net/rechrome/?profile=you%40example.com#key=…'", "")
+      .example("rech connect --global '<url>'", "An agent machine: one link for every folder, /tmp included"),
+      a => a.global || a.project ? handlers.connect(a.url, { global: a.global, project: a.project }) : handlers.connect(a.url))
     .command(["listener", "listeners"], "Control who can connect: listeners, allowed profiles, keys, public URLs", y => y
       .command(["ls", "list", "$0"], "List listeners (keys hidden)", {}, () => handlers.listListeners())
       .command("add <name>", "Expose registered profiles on an address (local for a proxy, lan, tailscale, IP)", y => y

package/rechrome.ts

@@ -84,6 +84,8 @@ async function saveTokenEntry(profileEmail: string, entry: TokenEntry): Promise<
 }
 
 const envFile = join(import.meta.dir, ".env.local");
+/** Machine-wide RECHROME_URL from `rech connect --global`: read from every folder, after the project's own files. */
+export const GLOBAL_ENV_FILE = join(RECH_DIR, ".env.local");
 const globalEnvFile = join(HOME || "~", ".env.local");
 
 // Capture inherited values once so explicit environment overrides survive reloads,
@@ -127,10 +129,15 @@ const bunLoaded = bunAutoloadedKeys(process.env,
     .map(name => { try { return readFileSync(join(process.cwd(), name), "utf8"); } catch { return ""; } }));
 const inheritedEnvKeys = new Set(Object.keys(process.env).filter(key => !bunLoaded.has(key)));
 
+/** Where RECHROME_URL came from: "environment", an env file's path, or undefined when unset. */
+export let rechromeUrlSource: string | undefined;
+
 // Walk CWD→root loading env files nearest-first; inherited environment wins over files.
 // At each level .rechrome/.env.local is checked before .env.local (rechrome-specific overrides general).
-export async function loadNearestEnv(extraFallbacks: string[] = []) {
+// The machine-wide file comes last, so it also applies outside $HOME (e.g. an agent's /tmp scratch dir).
+export async function loadNearestEnv(extraFallbacks: string[] = [GLOBAL_ENV_FILE]) {
   const seen = new Set<string>(inheritedEnvKeys);
+  rechromeUrlSource = seen.has(ENV_KEY) ? "environment" : undefined;
   const applyFile = async (path: string) => {
     const raw = await file(path).text().catch(() => "");
     for (const line of raw.split("\n")) {
@@ -138,6 +145,7 @@ export async function loadNearestEnv(extraFallbacks: string[] = []) {
       if (!m || m[1].startsWith("#")) continue;
       if (seen.has(m[1])) continue;
       seen.add(m[1]);
+      if (m[1] === ENV_KEY) rechromeUrlSource = path;
       process.env[m[1]] = m[2].replace(/^["']|["']$/g, "");
     }
   };
@@ -382,18 +390,27 @@ export function buildListenChoices(interfaces: ReturnType<typeof networkInterfac
 const TAILSCALE_ENV = { ...process.env, TAILSCALE_BE_CLI: "1" };
 const tailscaleBinary = () => Bun.which("tailscale") || (existsSync("/Applications/Tailscale.app/Contents/MacOS/Tailscale") ? "/Applications/Tailscale.app/Contents/MacOS/Tailscale" : null);
 
-/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
-async function runTailscale(args: string[]): Promise<string | null> {
+/** Run the Tailscale CLI read-only: its output, or why it gave none (missing, failed, slow). */
+async function runTailscaleDetailed(args: string[]): Promise<{ output: string } | { error: string; missing?: true }> {
   const binary = tailscaleBinary();
-  if (!binary) return null;
+  if (!binary) return { error: "not installed", missing: true };
   try {
-    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "pipe", stderr: "ignore" });
-    const timeout = setTimeout(() => proc.kill(), 2000);
+    const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "pipe", stderr: "pipe" });
+    let timedOut = false;
+    const timeout = setTimeout(() => { timedOut = true; proc.kill(); }, 2000);
     try {
-      const output = await new Response(proc.stdout).text();
-      return await proc.exited === 0 ? output : null;
+      const [output, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+      if (await proc.exited === 0) return { output };
+      const reason = timedOut ? "no answer within 2s" : (stderr.trim() || output.trim()).split("\n")[0] || `exit ${proc.exitCode}`;
+      return { error: `\`tailscale ${args.join(" ")}\`: ${reason}` };
     } finally { clearTimeout(timeout); }
-  } catch { return null; }
+  } catch (error) { return { error: String(error) }; }
+}
+
+/** Run the Tailscale CLI read-only; null when it is missing, disconnected, or slow. */
+async function runTailscale(args: string[]): Promise<string | null> {
+  const result = await runTailscaleDetailed(args);
+  return "output" in result ? result.output : null;
 }
 
 export async function detectListenChoices(): Promise<ListenChoice[]> {
@@ -514,32 +531,71 @@ async function removeTailscaleServeRoutes(listener: { port: number; prefix?: str
   }
 }
 
+type HealthListener = Pick<Listener, "name" | "port" | "prefix" | "profiles">;
+
+/**
+ * Read-only Tailscale Serve health for the listeners: `absent` (no Tailscale here), `unresponsive`
+ * (installed, but its CLI doesn't answer — e.g. not running, or the Mac app's GUI binary), or
+ * `ok` with each shared listener's route plus the routes to re-point or remove.
+ */
+export type TailscaleHealth =
+  | { state: "absent" }
+  | { state: "unresponsive"; error: string }
+  | { state: "ok"; routes: { listener: string; port: number; url: string | null }[]; repair: ServeRepair[]; stale: ServeStale[] };
+
+export async function inspectTailscaleServe(listeners: HealthListener[]): Promise<TailscaleHealth> {
+  const [serve, status] = await Promise.all([runTailscaleDetailed(["serve", "status", "--json"]), runTailscale(["status", "--json"])]);
+  if (!("output" in serve)) return serve.missing ? { state: "absent" } : { state: "unresponsive", error: serve.error };
+  let serveStatus: unknown, dnsName: string | null = null;
+  try { serveStatus = JSON.parse(serve.output || "null"); } catch { return { state: "unresponsive", error: "`tailscale serve status --json` printed no JSON" }; }
+  try { dnsName = (JSON.parse(status ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") || null; } catch { /* not connected */ }
+  const routes = listeners.filter(l => l.profiles !== "*")
+    .map(l => ({ listener: l.name, port: l.port, url: findTailscaleServeRoute(dnsName, serveStatus, l.port, normalizePrefix(l.prefix)) }));
+  return { state: "ok", routes, ...planTailscaleServeRepairs(serveStatus, listeners) };
+}
+
+const httpsPortOf = (hostPort: string) => hostPort.split(/:(?=\d+$)/)[1] ?? "443";
+
+/** Problems in a health report, one line each with the command that fixes it; empty when healthy. */
+export function tailscaleHealthProblems(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  if (health.state === "unresponsive") return [`Tailscale is installed but its CLI doesn't answer, so Serve routes go unchecked: ${health.error}`];
+  return [
+    ...health.repair.map(r => `${r.hostPort}${r.mount} proxies to 127.0.0.1:${r.from}, but the listener is on ${r.to} (clients get HTTP 502). Fix: tailscale serve --bg --https=${httpsPortOf(r.hostPort)} --set-path=${r.mount} ${r.proxy}`),
+    ...health.stale.map(st => `${st.hostPort}${st.mount} proxies to 127.0.0.1:${st.port}, where no listener runs (clients get HTTP 502). Remove it: tailscale serve --https=${httpsPortOf(st.hostPort)} --set-path=${st.mount} off`),
+  ];
+}
+
+/** The `tailscale:` block of `rech status` / `rech share ls`: each shared listener's route, then problems. */
+export function formatTailscaleHealth(health: TailscaleHealth): string[] {
+  if (health.state === "absent") return [];
+  const lines = health.state === "ok"
+    ? health.routes.map(r => r.url ? `✓ ${r.listener} → ${r.url} (127.0.0.1:${r.port})` : `- ${r.listener}: no Tailscale Serve route (fine if another proxy exposes it)`)
+    : [];
+  lines.push(...tailscaleHealthProblems(health).map(p => `⚠ ${p}`));
+  return lines.map((line, i) => `${i ? " ".repeat(11) : "tailscale: "}${line}`);
+}
+
 /**
  * Daemon health check: keep Tailscale Serve routes pointed at the listeners' current ports.
  * Re-points a moved listener's route on this node; only reports stale routes (removing a
- * route is the user's call). Returns log lines, empty when healthy or Tailscale is absent.
+ * route is the user's call) and a Tailscale CLI that doesn't answer. Returns log lines, empty
+ * when healthy or Tailscale is absent.
  */
-export async function checkTailscaleServe(listeners: { port: number; prefix?: string }[]): Promise<string[]> {
+export async function checkTailscaleServe(listeners: HealthListener[]): Promise<string[]> {
+  const health = await inspectTailscaleServe(listeners);
   const binary = tailscaleBinary();
-  if (!binary) return [];
-  const raw = await runTailscale(["serve", "status", "--json"]);
-  if (!raw) return [];
-  let serveStatus: unknown;
-  try { serveStatus = JSON.parse(raw); } catch { return []; }
-  const { repair, stale } = planTailscaleServeRepairs(serveStatus, listeners);
+  if (health.state !== "ok" || !binary) return tailscaleHealthProblems(health).map(p => `tailscale serve: ${p}`);
   const lines: string[] = [];
-  for (const r of repair) {
-    const httpsPort = r.hostPort.split(/:(?=\d+$)/)[1] ?? "443";
-    const args = ["serve", "--bg", `--https=${httpsPort}`, `--set-path=${r.mount}`, r.proxy];
+  for (const r of health.repair) {
+    const args = ["serve", "--bg", `--https=${httpsPortOf(r.hostPort)}`, `--set-path=${r.mount}`, r.proxy];
     const proc = Bun.spawn([binary, ...args], { env: TAILSCALE_ENV, stdout: "ignore", stderr: "pipe", windowsHide: true });
     const ok = await proc.exited === 0;
     lines.push(ok
       ? `tailscale serve: re-pointed ${r.hostPort}${r.mount} from 127.0.0.1:${r.from} to ${r.to}`
       : `tailscale serve: ${r.hostPort}${r.mount} points at 127.0.0.1:${r.from}, listener is on ${r.to}; re-pointing failed (${(await new Response(proc.stderr).text()).trim()}). Run: tailscale ${args.join(" ")}`);
   }
-  for (const s of stale) {
-    lines.push(`tailscale serve: ${s.hostPort}${s.mount} proxies to 127.0.0.1:${s.port}, where no listener runs (clients get HTTP 502). Remove it: tailscale serve --https=${s.hostPort.split(/:(?=\d+$)/)[1] ?? "443"} --set-path=${s.mount} off`);
-  }
+  lines.push(...tailscaleHealthProblems({ ...health, repair: [] }).map(p => `tailscale serve: ${p}`));
   return lines;
 }
 
@@ -2718,6 +2774,9 @@ async function provisionExtensionToken(opts: {
     `--profile-directory=${profileDir}`,
     `--load-extension=${dist}`,
     `--disable-extensions-except=${dist}`,
+    // Chromium 137+ ignores --load-extension unless this feature is off (Chrome for Testing
+    // too): the extension silently never loads and status.html is an error page.
+    "--disable-features=DisableLoadExtensionCommandLineSwitch",
     "--remote-debugging-port=0",
     "--no-first-run",
     "--no-default-browser-check",
@@ -2725,40 +2784,70 @@ async function provisionExtensionToken(opts: {
   ];
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
+  // Headless can't answer a Keychain prompt, so first launch could stall on it (as Playwright does).
+  if (process.platform === "darwin") args.push("--use-mock-keychain");
   args.push("about:blank");
   const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
   let cdp: CDPClient | null = null;
+  // Every step is bounded: a stuck Chrome must end in an error, never a silent hang.
+  const within = <T>(ms: number, what: string, work: Promise<T>) => Promise.race([work,
+    Bun.sleep(ms).then(() => { throw new Error(`${what} took over ${ms / 1000}s`); })]);
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
     let port: number | null = null;
-    for (let i = 0; i < 100; i++) {
+    for (let i = 0; i < 300; i++) {
       await Bun.sleep(100);
       const line = (await file(portFile).text().catch(() => "")).split("\n")[0]?.trim();
       if (line && /^\d+$/.test(line)) { port = parseInt(line); break; }
       if (proc.exitCode !== null) throw new Error("Chrome exited before opening the DevTools port");
     }
-    if (!port) throw new Error("Chrome DevTools port not found (extension may have failed to load)");
-    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json();
+    if (!port) throw new Error("Chrome didn't open its DevTools port within 30s");
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(5000) })).json();
     cdp = new CDPClient(ver.webSocketDebuggerUrl as string);
-    await cdp.open();
-    const { targetId } = await cdp.send("Target.createTarget", { url: `chrome-extension://${EXTENSION_ID}/status.html` });
+    await within(5000, "Connecting to Chrome DevTools", cdp.open());
+    // Wait for the extension's service worker: if it never shows, the extension didn't load.
+    const extensionUrl = `chrome-extension://${EXTENSION_ID}/`;
+    let loaded = false;
+    for (let i = 0; i < 50 && !loaded; i++) {
+      const { targetInfos } = await cdp.send("Target.getTargets");
+      loaded = (targetInfos as { url: string }[]).some(t => t.url.startsWith(extensionUrl));
+      if (!loaded) await Bun.sleep(200);
+    }
+    if (!loaded) throw new Error(`The extension at ${dist} didn't load in Chrome for Testing (no ${extensionUrl} target within 10s)`);
+    const { targetId } = await cdp.send("Target.createTarget", { url: `${extensionUrl}status.html` });
     const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
     // The extension page may still be loading; retry the write until localStorage reflects it.
-    let ok = false;
+    let ok = false, last = "";
     const expr = `(()=>{try{localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
-    for (let i = 0; i < 50; i++) {
-      const r = await cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId).catch(() => null);
-      if (r?.result?.value === token) { ok = true; break; }
-      await Bun.sleep(100);
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline) {
+      const r = await within(3000, "Runtime.evaluate", cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId)).catch(e => ({ error: String(e) }));
+      const value = (r as any)?.result?.value;
+      if (value === token) { ok = true; break; }
+      last = typeof value === "string" ? value : (r as any)?.error ?? (r as any)?.result?.description ?? "";
+      await Bun.sleep(200);
     }
-    if (!ok) throw new Error(`Could not seed auth token into chrome-extension://${EXTENSION_ID}/ (is the extension loading?)`);
+    if (!ok) throw new Error(`Could not seed auth token into ${extensionUrl}${last ? ` (${last})` : ""}`);
     // Graceful close flushes localStorage to the profile's leveldb before we kill Chrome.
-    await cdp.send("Browser.close").catch(() => {});
+    await within(5000, "Browser.close", cdp.send("Browser.close")).catch(() => {});
+    await within(5000, "Chrome exit", proc.exited).catch(() => {});
   } finally {
     cdp?.close();
+    await stopThrowawayChrome(proc, userDataDir);
+  }
+}
+
+/**
+ * Stop a Chrome we launched on a throwaway user-data-dir: SIGTERM, then SIGKILL, then any helper
+ * still holding that exact --user-data-dir (scoped to it, so never the user's own Chrome).
+ */
+async function stopThrowawayChrome(proc: ReturnType<typeof Bun.spawn>, userDataDir: string): Promise<void> {
+  if (proc.exitCode === null) {
     try { proc.kill(); } catch {}
-    await proc.exited.catch(() => {});
+    const exited = await Promise.race([proc.exited.then(() => true, () => true), Bun.sleep(3000).then(() => false)]);
+    if (!exited) { try { proc.kill("SIGKILL"); } catch {} await Promise.race([proc.exited.catch(() => {}), Bun.sleep(2000)]); }
   }
+  if (process.platform !== "win32") Bun.spawnSync(["pkill", "-9", "-f", `--user-data-dir=${userDataDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}( |$)`], { stdout: "ignore", stderr: "ignore" });
 }
 
 async function provisionProfile(name: string, opts: { headed?: boolean } = {}): Promise<void> {
@@ -2952,6 +3041,8 @@ async function urlList(): Promise<void> {
   printTable(rows);
   const wide = config.listeners.filter(l => l.profiles !== "*" && l.profiles.length > 1);
   if (wide.length) console.log(`\nOne key covers several profiles on: ${wide.map(l => `${l.name} (${(l.profiles as string[]).length})`).join(", ")}. Anyone with such a link can use each of them.`);
+  const tailscale = formatTailscaleHealth(await inspectTailscaleServe(config.listeners));
+  if (tailscale.length) console.log(`\n${tailscale.join("\n")}`);
   console.log(`\nPrint a full URL (contains the secret key): rech share <profile>, or rech share --all`);
 }
 
@@ -2961,14 +3052,42 @@ async function saveProjectUrl(url: string): Promise<string> {
   mkdirSync(dataDir, { recursive: true });
   const gitignore = join(dataDir, ".gitignore");
   if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
-  const envPath = join(dataDir, ".env.local");
+  return writeEnvUrl(join(dataDir, ".env.local"), url);
+}
+
+/** Write RECHROME_URL to ~/.rechrome/.env.local: the default for every project without its own. */
+async function saveGlobalUrl(url: string): Promise<string> {
+  mkdirSync(dirname(GLOBAL_ENV_FILE), { recursive: true });
+  return writeEnvUrl(GLOBAL_ENV_FILE, url);
+}
+
+/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
+async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
   await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
   await chmod(envPath, 0o600);
   return envPath;
 }
 
-async function connect(url: string): Promise<void> {
+/**
+ * What would shadow the machine-wide RECHROME_URL from `cwd`: the shell's own RECHROME_URL, or the
+ * nearest project env file that sets one (searched the way loadNearestEnv walks). Null when none does.
+ */
+export function nearerUrlSource(cwd: string, inherited: boolean, globalFile = GLOBAL_ENV_FILE): string | null {
+  if (inherited) return "your shell's RECHROME_URL";
+  const globalReal = (() => { try { return realpathSync(globalFile); } catch { return globalFile; } })();
+  for (let dir = cwd; ; dir = dirname(dir)) {
+    for (const path of [join(dir, ".rechrome", ".env.local"), join(dir, ".env.local")]) {
+      if (path === globalFile || path === globalReal) return null;
+      const text = (() => { try { return readFileSync(path, "utf8"); } catch { return ""; } })();
+      if (text.split("\n").some(line => line.trimStart().startsWith(`${ENV_KEY}=`))) return path;
+    }
+    if (dirname(dir) === dir) return null;
+  }
+}
+
+async function connect(url: string, opts: { global?: boolean; project?: boolean } = {}): Promise<void> {
+  if (opts.global && opts.project) throw new Error("Pass --global or --project, not both.");
   const parsed = parseUrl(url);
   if (!parsed.key) throw new Error("That URL has no key (#key=…). Ask the host for the full URL from: rech share <profile>");
   const response = await fetch(serviceUrl(url, "ping"), { headers: { Authorization: `Bearer ${parsed.key}` }, signal: AbortSignal.timeout(5000) })
@@ -2978,8 +3097,24 @@ async function connect(url: string): Promise<void> {
   const body = await response.json().catch(() => ({})) as { listener?: string; profiles?: string[] | "*" };
   if (parsed.profileDirectory && Array.isArray(body.profiles) && !body.profiles.includes(parsed.profileDirectory))
     throw new Error(`Connected, but listener "${body.listener}" does not allow profile "${parsed.profileDirectory}".`);
-  const saved = await saveProjectUrl(url);
-  console.log(`Connected to ${serviceUrl(url)}${body.listener ? ` (listener ${body.listener})` : ""}. Saved RECHROME_URL to ${saved}`);
+  // Where to save: the flag, else ask in a terminal (this project by default), else this project.
+  let global = !!opts.global;
+  if (!opts.global && !opts.project && isInteractive()) {
+    const { dataDir } = await getClientIdentity();
+    const choice = await promptChoice("Use this link for:", [
+      { label: `This project only  (${join(dataDir, ".env.local")})`, value: "project" },
+      { label: `Every project on this machine without its own link  (${GLOBAL_ENV_FILE})`, value: "global" },
+    ], 0);
+    if (!choice) throw new Error("Cancelled; nothing saved.");
+    global = choice === "global";
+  }
+  // A machine running its own daemon would stop reaching its own Chrome from every project without a link.
+  if (global && !(await isLocalDaemon(url)) && (await readListeners().catch(() => null))?.listeners.length)
+    console.error(`[rech] warning: this machine runs its own rech daemon. Projects without their own RECHROME_URL will now use ${serviceUrl(url)}, not this machine's Chrome. Undo: remove ${ENV_KEY} from ${GLOBAL_ENV_FILE}`);
+  const saved = global ? await saveGlobalUrl(url) : await saveProjectUrl(url);
+  console.log(`Connected to ${serviceUrl(url)}${body.listener ? ` (listener ${body.listener})` : ""}. Saved RECHROME_URL ${global ? "for every project on this machine" : "for this project"}: ${saved}`);
+  const shadow = global ? nearerUrlSource(process.cwd(), inheritedEnvKeys.has(ENV_KEY)) : null;
+  if (shadow) console.log(`Note: here, ${shadow} takes precedence over it. Remove that, or run rech connect --project to update it.`);
   if (Array.isArray(body.profiles) && body.profiles.length > 1) {
     console.log(`This link shares ${body.profiles.length} profiles:`);
     for (const p of body.profiles) console.log(`  ${p}${p === parsed.profileDirectory ? "  (default)" : ""}`);
@@ -3403,7 +3538,12 @@ async function status(): Promise<void> {
     : null;
   // Show the URL this client connects to; through a proxy, the daemon's bind is on another port.
   const details = [pingBody?.listener && `listener ${pingBody.listener}`, pingBody?.bind && `bind ${pingBody.bind}`].filter(Boolean).join(", ");
-  console.log(`serve:    ${ping ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}` : `not reachable at ${serviceUrl(url)}`}`);
+  // Any HTTP answer is not the daemon: a proxy's 404/502 means the link's listener is gone or moved.
+  const answered = pingResponse?.ok || pingResponse?.status === 401;
+  console.log(`serve:    ${!ping ? `not reachable at ${serviceUrl(url)}`
+    : answered ? `running  ${serviceUrl(url)}${details ? `  (${details})` : ""}`
+    : `✗ ${serviceUrl(url)} answers HTTP ${pingResponse?.status ?? ping.status}, not a rechrome daemon — this link's listener was likely removed or moved; ask its host for a fresh link (\`rech share <profile>\`), then \`rech connect '<url>'\``}`);
+  if (rechromeUrlSource) console.log(`config:   ${rechromeUrlSource === "environment" ? "RECHROME_URL from the environment" : rechromeUrlSource}${rechromeUrlSource === GLOBAL_ENV_FILE ? "  (machine-wide)" : ""}`);
   if (pingResponse?.status === 401)
     console.log(`auth:     ✗ key rejected — ask the host for a fresh URL (\`rech share <profile>\`), then \`rech connect '<url>'\``);
   // daemonManager().id — there is no PM_BIN constant. Referencing one threw a
@@ -3426,7 +3566,11 @@ async function status(): Promise<void> {
   const current = effective ? await resolveProfileEmail(effective).catch(() => effective) : undefined;
   const allowed = pingBody?.profiles === "*" ? "all registered profiles" : pingBody?.profiles?.join(", ");
   console.log(`profile:  ${current ?? "(none selected; add ?profile= to the URL or pass --profile)"}${allowed ? `  — this listener serves: ${allowed}` : ""}`);
-  if (isHost) console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  if (isHost) {
+    const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+    for (const line of formatTailscaleHealth(await inspectTailscaleServe(listeners))) console.log(line);
+    console.log(`\nMore: rech profile (profiles) · rech share ls (who can connect, and where)`);
+  }
 }
 
 
@@ -3442,7 +3586,7 @@ export type RechHandlers = {
   printProfileUri(selector?: string, listener?: string, opts?: { local?: boolean; save?: boolean; all?: boolean }): Promise<void>;
   urlList(): Promise<void>;
   shareProfiles(selectors: string[], opts: { listener?: string; local?: boolean; save?: boolean }): Promise<void>;
-  connect(url: string): Promise<void>;
+  connect(url: string, opts?: { global?: boolean; project?: boolean }): Promise<void>;
   listenerPort(name?: string): Promise<void>;
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
@@ -3537,10 +3681,14 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         }
         return handlers.printProfileUri(profiles[0], a.listener, a.all ? { local: a.local, save: a.save, all: true } : { local: a.local, save: a.save });
       })
-    .command("connect <url>", "Use a URL from another machine in this project (checks it first)", y => y
+    .command("connect <url>", "Use a URL from another machine (checks it first; asks: this project or every project)", y => y
       .positional("url", { type: "string", demandOption: true, describe: "The URL printed by `rech share <profile>` on the machine with Chrome. Quote it: it contains #" })
-      .example("rech connect 'https://host.example.ts.net/rechrome/?profile=you%40example.com#key=…'", ""),
-      a => handlers.connect(a.url))
+      .option("project", { type: "boolean", describe: "Save it for this project only (.rechrome/.env.local); the default without a terminal" })
+      .option("global", { type: "boolean", describe: "Save it for every project on this machine without its own link (~/.rechrome/.env.local)" })
+      .conflicts("project", "global")
+      .example("rech connect 'https://host.example.ts.net/rechrome/?profile=you%40example.com#key=…'", "")
+      .example("rech connect --global '<url>'", "An agent machine: one link for every folder, /tmp included"),
+      a => a.global || a.project ? handlers.connect(a.url, { global: a.global, project: a.project }) : handlers.connect(a.url))
     .command(["listener", "listeners"], "Control who can connect: listeners, allowed profiles, keys, public URLs", y => y
       .command(["ls", "list", "$0"], "List listeners (keys hidden)", {}, () => handlers.listListeners())
       .command("add <name>", "Expose registered profiles on an address (local for a proxy, lan, tailscale, IP)", y => y