rechrome 1.35.0 → 1.36.0

package/README.md

@@ -243,6 +243,7 @@ cp .env.example .env.local
 | `PLAYWRIGHT_MCP_EXTENSION_ID`       | Chrome extension ID (client overrides server)                                                                                       | —                |
 | `PLAYWRIGHT_MCP_EXTENSION_TOKEN`    | Chrome extension token — profile-specific, get it from the extension's status page (client overrides server)                        | —                |
 | `PLAYWRIGHT_MCP_USER_DATA_DIR`      | Chrome user data directory — use to pin connections to a specific Chrome install (client overrides server)                          | —                |
+| `RECHROME_PROFILE` | Default profile selector for browser commands, equivalent to `--profile`. An explicit flag wins; blank values are ignored. Remote listeners still enforce their allowlist. | — |
 | `PLAYWRIGHT_MCP_PROFILE_DIRECTORY`  | Chrome profile — accepts directory name (`Profile 2`), display name (`Snowstar`), or **email** (`you@example.com`) (client overrides server) | —         |
 
 > **Multi-profile tip:** Each project's `.env.local` can specify a different Chrome profile via the `?profile=` query param in `RECHROME_URL`. The server resolves display names and email addresses to the actual Chrome profile directory automatically (reads `~/Library/Application Support/Google/Chrome/Local State`).
@@ -254,6 +255,57 @@ cp .env.example .env.local
 >
 > Shell-set `PLAYWRIGHT_MCP_*` variables take priority over `.env.local`, so you can always override per-command without editing files.
 
+### Small icon uploads from stdin
+
+Uploads are disabled by default on every listener. The host owner can add an
+`uploads` object to the intended listener entry in `~/.rechrome/listeners.json`:
+
+```json
+"uploads": {
+  "maxBytes": 2097152,
+  "contentTypes": ["image/png", "image/svg+xml"]
+}
+```
+
+The object enables uploads; omitting it disables them. `uploads: {}` uses the
+same defaults shown above. The owner can lower the byte limit or narrow the type
+list, but cannot exceed the hard **2 MiB** limit or enable other types. Do not
+replace the listener's other fields or share its key. Install the updated daemon
+code before enabling this policy; configuration changes then use the usual
+listener reload mechanism.
+
+On the **client machine**, open the website's file chooser with `rech click`, then
+send the icon through stdin in the same profile/session:
+
+```bash
+rech --profile work -s=slack upload --name app-icon.png < ./app-icon.png
+cat ./app-icon.svg | rech --profile work -s=slack upload --name app-icon.svg
+```
+
+`--content-type image/png` or `--content-type image/svg+xml` may be specified;
+otherwise the type is inferred from `--name`. This command is stdin-only: there
+is no positional file path. The shell reads the local file; only its bytes and
+metadata are sent to the listener. Client and server both enforce the byte cap.
+The server checks PNG signatures or UTF-8 SVG markup (rejecting DTD/entities),
+and checks the type against the listener policy. These checks identify the file
+format; they do not sanitize SVG or scan for malware. The host never renders the
+file or resolves anything referenced inside it.
+
+The receiver writes a random `.png`/`.svg` filename with mode 0600 inside a private
+0700 temporary directory, outside the downloadable output tree. It passes only
+that generated path to the existing file-chooser command and removes the directory
+on success, error, or timeout. Neither filenames nor payload fields can select a
+host file. A crash or forced process kill can interrupt cleanup; the files remain
+private OS temporary files. Permission modes apply on POSIX hosts.
+
+Each upload produces one `upload:` JSON audit record with listener, profile,
+original name, byte size, SHA-256, page origin observed immediately before upload,
+and result. It contains no file contents, credentials, page path, query, or fragment.
+Requests rejected before inspection have null values for unavailable fields.
+An HTTP(S) origin must be determined before an upload is attempted. As with other
+browser commands, avoid concurrent tab navigation in the same session. Scoped
+`eval`, `run-code`, host paths, and CLI option overrides remain unavailable.
+
 ### Remote access
 
 `rech setup --profile <profile> --listen tailscale` exposes that profile through a
@@ -345,3 +397,25 @@ PRs upstream are welcome. Once these features land in the official packages we w
 ## License
 
 MIT
+
+### Bridge connection diagnostics and recovery
+
+Each connection attempt records fixed phase names (launch, retry, WebSocket
+accepted, initialized, timeout/close) in its own private `.bridge.jsonl` file under
+`~/.cache/ms-playwright/bridge`, or `PLAYWRIGHT_MCP_BRIDGE_LOG_DIR` when configured
+for the Playwright process. Records contain an attempt ID, PID and timing only;
+no URLs, tokens, page text or raw error messages. CLI startup stderr is retained
+separately in a unique `.err` file for each launch and is not the sanitized log.
+
+A failed automated connection page retires itself at its deadline only if it
+still shows the original connection URL. The profile's worker can remove an older
+page for the same attempt and relay; it excludes other attempts, attached tabs,
+and tabs that navigated away. Automatic recovery no longer reloads the extension,
+which could disconnect other working lanes. A genuinely unresponsive worker can
+still require an explicit operator-approved extension reload.
+
+This source change requires rebuilding the vendored Playwright bundle and
+reloading the updated extension before use. It does not modify a running daemon
+or extension. The draft PR records isolated-browser validation and negative
+controls; passing recovery tests does not establish the original intermittent
+timeout's root cause.

package/extension/lib/background.mjs

@@ -566,7 +566,10 @@ class PlaywrightExtension {
   _onMessage(message, sender, sendResponse) {
     switch (message.type) {
       case "connectionRequested":
-        this._pendingConnections.create(sender.tab.id, message.mcpRelayUrl, message.protocolVersion).then(
+        (async () => {
+          if (message.recoveryAttempt) await this._retireSupersededPages(sender);
+          await this._pendingConnections.create(sender.tab.id, message.mcpRelayUrl, message.protocolVersion);
+        })().then(
           () => sendResponse({ success: true }),
           (error) => sendResponse({ success: false, error: error.message })
         );
@@ -606,6 +609,27 @@ class PlaywrightExtension {
         return false;
     }
   }
+  // The single worker coordinates recovery within this profile. It never reloads
+  // itself or touches live groups: only sibling connect pages for the same relay
+  // attempt can be retired. A different lane/attempt is outside this ownership.
+  async _retireSupersededPages(sender) {
+    var _a;
+    const current = new URL(sender.url || ((_a = sender.tab) == null ? void 0 : _a.url) || "about:blank");
+    const attempt = current.searchParams.get("attempt");
+    const relay = current.searchParams.get("mcpRelayUrl");
+    if (current.protocol !== "chrome-extension:" || current.host !== chrome.runtime.id || current.pathname !== "/connect.html" || !/^[0-9a-f-]{36}$/.test(attempt || "") || !relay) return;
+    const attached = new Set([...this._activeGroups].flatMap((g) => g.connectedTabIds()));
+    const tabs = await chrome.tabs.query({});
+    await Promise.all(tabs.map(async (tab) => {
+      var _a2;
+      if (tab.id === void 0 || tab.id === ((_a2 = sender.tab) == null ? void 0 : _a2.id) || attached.has(tab.id) || !tab.url) return;
+      const other = new URL(tab.url);
+      if (other.protocol !== current.protocol || other.host !== current.host || other.pathname !== current.pathname || other.searchParams.get("attempt") !== attempt || other.searchParams.get("mcpRelayUrl") !== relay) return;
+      const latest = await chrome.tabs.get(tab.id).catch(() => void 0);
+      if ((latest == null ? void 0 : latest.url) === tab.url) await chrome.tabs.remove(tab.id).catch(() => {
+      });
+    }));
+  }
   async _connectTab(selectorTabId, tab, clientName) {
     try {
       await Promise.race([
@@ -655,3 +679,6 @@ class PlaywrightExtension {
   }
 }
 new PlaywrightExtension();
+export {
+  PlaywrightExtension
+};

package/extension/lib/ui/connect.js

@@ -4,18 +4,12 @@
 import { c as clientExports, j as jsxRuntimeExports, r as reactExports, A as AuthTokenSection, T as TabItem, B as Button, g as getOrCreateAuthToken } from "./authToken.js";
 const SUPPORTED_PROTOCOL_VERSION = 2;
 const BACKGROUND_RESPONSE_TIMEOUT_MS = 1e4;
-const SELF_RELOAD_GUARD_KEY = "connect-self-reload-at";
-const SELF_RELOAD_MIN_INTERVAL_MS = 6e4;
-function attemptExtensionSelfReload() {
-  if (new URLSearchParams(window.location.search).get("selfReload") !== "1")
-    return false;
-  const last = Number(localStorage.getItem(SELF_RELOAD_GUARD_KEY) || 0);
-  const now = Date.now();
-  if (now - last < SELF_RELOAD_MIN_INTERVAL_MS)
-    return false;
-  localStorage.setItem(SELF_RELOAD_GUARD_KEY, String(now));
-  chrome.runtime.reload();
-  return true;
+async function retireExpiredAttempt(originalUrl) {
+  const params = new URL(originalUrl).searchParams;
+  if (!/^[0-9a-f-]{36}$/.test(params.get("attempt") || "")) return;
+  const tab = await chrome.tabs.getCurrent();
+  if ((tab == null ? void 0 : tab.id) !== void 0 && tab.url === originalUrl)
+    await chrome.tabs.remove(tab.id);
 }
 async function sendMessageWithTimeout(message, simulateHang = false) {
   let timer;
@@ -41,6 +35,17 @@ const ConnectApp = () => {
     setStatus({ type: "error", message });
   }, []);
   reactExports.useEffect(() => {
+    const originalUrl = window.location.href;
+    const expiry = Number(new URL(originalUrl).searchParams.get("expires"));
+    let connected = false;
+    const onConnected = () => {
+      connected = true;
+    };
+    window.addEventListener("bridge-connected", onConnected);
+    const expiryTimer = Number.isFinite(expiry) && expiry > 0 ? setTimeout(() => {
+      if (!connected) void retireExpiredAttempt(originalUrl).catch(() => {
+      });
+    }, Math.max(0, Math.min(expiry - Date.now(), 2147483647))) : void 0;
     const runAsync = async () => {
       const params = new URLSearchParams(window.location.search);
       const relayUrl = params.get("mcpRelayUrl");
@@ -89,13 +94,12 @@ const ConnectApp = () => {
       let response;
       try {
         response = await sendMessageWithTimeout(
-          { type: "connectionRequested", mcpRelayUrl: relayUrl, protocolVersion: requestedVersion },
+          { type: "connectionRequested", mcpRelayUrl: relayUrl, protocolVersion: requestedVersion, recoveryAttempt },
           params.get("testHangOnce") === "1" && !recoveryAttempt
         );
       } catch (error) {
         if (hasAutomationToken && !recoveryAttempt) {
-          const reloading = attemptExtensionSelfReload();
-          setError(reloading ? "Extension service worker is not responding. Reloading extension and retrying…" : "Extension service worker is not responding. Retrying once…");
+          setError("Extension service worker is not responding. Retrying once…");
           return;
         }
         setError(`Extension service worker did not recover: ${error.message}`);
@@ -108,7 +112,7 @@ const ConnectApp = () => {
       const expectedToken = getOrCreateAuthToken();
       const token = params.get("token");
       if (token === expectedToken) {
-        await handleConnectToTab(void 0, info);
+        connected = !!await handleConnectToTab(void 0, info);
         return;
       }
       if (token) {
@@ -125,7 +129,11 @@ const ConnectApp = () => {
       chrome.runtime.sendMessage({ type: "keepalive" }).catch(() => {
       });
     }, 2e4);
-    return () => clearInterval(keepalive);
+    return () => {
+      clearInterval(keepalive);
+      clearTimeout(expiryTimer);
+      window.removeEventListener("bridge-connected", onConnected);
+    };
   }, []);
   const loadTabs = reactExports.useCallback(async () => {
     const response = await chrome.runtime.sendMessage({ type: "getTabs" });
@@ -144,6 +152,8 @@ const ConnectApp = () => {
       });
       if (response == null ? void 0 : response.success) {
         setStatus({ type: "connected", message: `"${clientName}" connected.` });
+        window.dispatchEvent(new Event("bridge-connected"));
+        return true;
       } else {
         setStatus({
           type: "error",
@@ -154,8 +164,7 @@ const ConnectApp = () => {
       const recoveryAttempt = new URLSearchParams(window.location.search).get("recoveryAttempt") === "1";
       const hasAutomationToken = !!new URLSearchParams(window.location.search).get("token");
       if (hasAutomationToken && !recoveryAttempt) {
-        const reloading = attemptExtensionSelfReload();
-        setError(reloading ? "Extension service worker stopped during connection. Reloading extension and retrying…" : "Extension service worker stopped during connection. Retrying once…");
+        setError("Extension service worker stopped during connection. Retrying once…");
         return;
       }
       setStatus({
@@ -163,6 +172,7 @@ const ConnectApp = () => {
         message: `"${clientName}" failed to connect: ${e}`
       });
     }
+    return false;
   }, [clientInfo, setError]);
   reactExports.useEffect(() => {
     const listener = (message) => {

package/listeners.js

@@ -1,4 +1,14 @@
 // @bun
+// scoped-upload.ts
+var MAX_UPLOAD_BYTES = 2 * 1024 * 1024;
+var MAX_REQUEST_BYTES = 3 * 1024 * 1024;
+var UPLOAD_TYPES = ["image/png", "image/svg+xml"];
+function validateUploadPolicy(value) {
+  const p = value;
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
+    throw new Error("uploads must be an object with optional maxBytes (1..2097152) and contentTypes (image/png, image/svg+xml)");
+}
+
 // listeners.ts
 import { isIP } from "net";
 import { createHash, randomBytes } from "crypto";
@@ -54,6 +64,8 @@ function validateListeners(value) {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some((p) => typeof p !== "string" || !p.trim() || p.includes("\x00") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
+    if (l.uploads !== undefined)
+      validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
       throw new Error("Listener names, addresses, and credentials must be unique");
@@ -92,12 +104,16 @@ function authorizeProfileRequest(listener, body) {
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile)
     throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (!SCOPED_COMMANDS.has(args[0]))
+  if (!(args[0] === "upload" && listener.uploads !== undefined) && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
   if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page")))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
+  if (args[0] === "upload" && (args.length !== 1 || !body.upload))
+    throw new Error("Upload requires stdin bytes; host paths are unavailable");
+  if (args[0] !== "upload" && body.upload !== undefined)
+    throw new Error("Unexpected upload payload");
   return profile;
 }
 function canReadProfileFile(listener, path) {

package/listeners.ts

@@ -1,3 +1,4 @@
+import { validateUploadPolicy, type UploadPolicy } from "./scoped-upload.ts";
 import { isIP } from "net";
 import { createHash, randomBytes } from "crypto";
 import { homedir } from "os";
@@ -5,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy };
 export type ListenerConfig = { version: 1; listeners: Listener[] };
 export const LISTENERS_FILE = join(homedir(), ".rechrome", "listeners.json");
 export const isLoopback = (host: string) => host === "::1" || /^127\./.test(host);
@@ -54,6 +55,7 @@ export function validateListeners(value: unknown): ListenerConfig {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some(p => typeof p !== "string" || !p.trim() || p.includes("\0") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
+    if (l.uploads !== undefined) validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -85,9 +87,12 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
   if (typeof profile !== "string" || listener.profiles === "*" || !listener.profiles.includes(profile)) throw new Error("Profile is not allowed on this listener");
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile) throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (!SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (!(args[0] === "upload" && listener.uploads !== undefined) && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
   if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page"))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
+  // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
+  if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");
+  if (args[0] !== "upload" && body.upload !== undefined) throw new Error("Unexpected upload payload");
   return profile;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"
@@ -25,7 +25,9 @@
     "rechrome.ts",
     "serve.js",
     "serve.ts",
-    "vendor"
+    "vendor",
+    "scoped-upload.ts",
+    "scoped-upload.js"
   ],
   "type": "module",
   "scripts": {
@@ -34,7 +36,7 @@
     "vendor-cli": "bash scripts/vendor-cli.sh",
     "prepare": "bash scripts/vendor-cli.sh --prepare",
     "check-pack": "bash scripts/check-pack.sh",
-    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bash scripts/check-pack.sh"
+    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bash scripts/check-pack.sh"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/rechrome.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.js";
 import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener } from "./listeners.js";
 
 import { file } from "bun";
@@ -1509,11 +1510,7 @@ async function shareSet(snapshot: string[], opts: { listener?: string; local?: b
   // A one-profile link names its profile, so the other machine needs no --profile.
   const only = snapshot.length === 1 ? `?profile=${encodeURIComponent(snapshot[0])}` : "";
   const local = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}${only}`;
-  let ready = false;
-  for (let i = 0; i < 20 && !ready; i++) {
-    ready = await fetch(serviceUrl(local, "ping"), { headers: { Authorization: `Bearer ${listener.key}` }, signal: AbortSignal.timeout(1000) }).then(r => r.ok).catch(() => false);
-    if (!ready) await Bun.sleep(250);
-  }
+  const ready = await waitForListener(listener);
   if (!ready) console.error(`[rech] warning: listener "${name}" is not answering yet; check the daemon with rech status.`);
   if (opts.tailscaleServe && !listener.publicUrl) {
     const publicUrl = await exposeWithTailscaleServe(listener);
@@ -1570,6 +1567,32 @@ async function exposeWithTailscaleServe(listener: Listener): Promise<string | nu
   return (await detectTailscaleServe(listener.port, prefix)).routeUrl;
 }
 
+/** The daemon reloads listeners.json about every second: wait (up to ~5s) until this listener answers. */
+async function waitForListener(listener: Listener): Promise<boolean> {
+  const url = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}`;
+  for (let i = 0; i < 20; i++) {
+    if (await fetch(serviceUrl(url, "ping"), { headers: { Authorization: `Bearer ${listener.key}` }, signal: AbortSignal.timeout(1000) }).then(r => r.ok).catch(() => false)) return true;
+    await Bun.sleep(250);
+  }
+  return false;
+}
+
+/**
+ * Ask how other machines will reach a link: "tailscale-serve", a detected network address
+ * (plain HTTP), "127.0.0.1" for the user's own proxy, or `extra` choices; null when cancelled.
+ */
+async function askReachability(question: string, extra: { label: string; value: string }[] = []): Promise<string | null> {
+  const serve = !!tailscaleBinary();
+  // With Tailscale Serve on offer, a plain-HTTP Tailscale IP would only be a worse duplicate.
+  const networks = (await detectListenChoices()).filter(c => c.kind !== "local" && !(serve && c.kind === "tailscale"));
+  return promptChoice(question, [
+    ...(serve ? [{ label: "Tailscale: HTTPS, only your tailnet", value: "tailscale-serve" }] : []),
+    ...networks.map(c => ({ label: `${c.label.split(" — ")[0]} network: http://${c.address}, plain HTTP`, value: c.address })),
+    { label: "My own reverse proxy", value: "127.0.0.1" },
+    ...extra,
+  ], 0);
+}
+
 /**
  * Give one profile its own link. In a terminal, ask how the other machines will reach it
  * (Tailscale Serve, a detected network, or the user's own proxy); without one, create a
@@ -1580,14 +1603,7 @@ async function shareNewLink(profile: string, opts: { local?: boolean; save?: boo
   const name = uniqueShareName(profileSlug(profile), (await requireListeners()).listeners, served);
   let host = "127.0.0.1", tailscaleServe = false;
   if (isInteractive()) {
-    const serve = !!tailscaleBinary();
-    // With Tailscale Serve on offer, a plain-HTTP Tailscale IP would only be a worse duplicate.
-    const networks = (await detectListenChoices()).filter(c => c.kind !== "local" && !(serve && c.kind === "tailscale"));
-    const how = await promptChoice(`How will your other machines reach it?`, [
-      ...(serve ? [{ label: "Tailscale: HTTPS, only your tailnet", value: "tailscale-serve" }] : []),
-      ...networks.map(c => ({ label: `${c.label.split(" — ")[0]} network: http://${c.address}, plain HTTP`, value: c.address })),
-      { label: "My own reverse proxy", value: "127.0.0.1" },
-    ], 0);
+    const how = await askReachability(`How will your other machines reach it?`);
     if (!how) throw new Error("Cancelled; nothing shared.");
     tailscaleServe = how === "tailscale-serve";
     host = tailscaleServe ? "127.0.0.1" : how;
@@ -1726,6 +1742,31 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     const serve = await detectTailscaleServe(pending.port, normalizePrefix(pending.prefix));
     if (serve.routeUrl && !serve.funnel) { pending.publicUrl = serve.routeUrl; await writeListeners(config); }
   }
+  // Still only reachable from this machine (no proxy recorded or detected): a link like that is
+  // useless to hand out, so ask how other machines reach it, or say how to expose it.
+  if (config && pending && pending.profiles !== "*" && !pending.publicUrl && isLoopback(pending.host) && !opts.local) {
+    const steps = () => { for (const line of listenerNextSteps(pending, profile)) console.error(line); };
+    if (!interactive) {
+      console.error(`[rech] this link only works on this machine: listener "${pending.name}" is on ${listenerAddress(pending)} and no proxy is recorded.`);
+      steps();
+    } else {
+      const KEEP = "\0keep";
+      const how = await askReachability(`Link "${pending.name}" only works on this machine (${listenerAddress(pending)}). How will your other machines reach it?`,
+        [{ label: "Nothing: keep it on this machine", value: KEEP }]);
+      if (!how) throw cancelled();
+      if (how === "tailscale-serve") {
+        const routeUrl = await exposeWithTailscaleServe(pending);
+        if (routeUrl) { pending.publicUrl = routeUrl; await writeListeners(config); }
+      } else if (how === "127.0.0.1") steps();
+      else if (how !== KEEP) {
+        // Same key and prefix, now bound on that network; links already handed out change host.
+        pending.host = how;
+        await writeListeners(config);
+        if (!(await waitForListener(pending))) console.error(`[rech] warning: listener "${pending.name}" is not answering on ${listenerAddress(pending)} yet; check the daemon with rech status.`);
+        uri = profileConnectionUri(profile, undefined, config.listeners, pending.name);
+      }
+    }
+  }
   const publicUrl = pending?.publicUrl;
   if (publicUrl && !opts.local) uri = rebaseConnectionUrl(publicUrl, uri);
   console.log(uri);
@@ -1768,6 +1809,7 @@ async function callServe(
   overrideEnv?: Record<string, string>,
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
+  upload?: UploadPayload,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1786,7 +1828,7 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env }),
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -1972,7 +2014,12 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity);
+  let upload: UploadPayload | undefined;
+  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
+    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+  }
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -3618,6 +3665,7 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
 
 Environment:
   ${ENV_KEY}      connection URL; read from the nearest .rechrome/.env.local or .env.local
+  RECHROME_PROFILE  default browser profile selector; --profile overrides it
   RECH_IDENTITY     session key: worktree (default) | branch | cwd
   RECH_TOKEN        extension token for \`rech setup\` (same as --token)
   RECH_SETUP_AGENT  setup hints: codex | claude | none (auto-detected)
@@ -3808,7 +3856,7 @@ if (import.meta.main) {
     if (separator !== -1) args = args.slice(0, separator);
     try {
       const extracted = extractGlobalProfileArg(args);
-      profileSelector = extracted.selector;
+      profileSelector = extracted.selector ?? (process.env.RECHROME_PROFILE?.trim() || undefined);
       args = extracted.args;
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));

package/rechrome.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.ts";
 import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener } from "./listeners.ts";
 
 import { file } from "bun";
@@ -1509,11 +1510,7 @@ async function shareSet(snapshot: string[], opts: { listener?: string; local?: b
   // A one-profile link names its profile, so the other machine needs no --profile.
   const only = snapshot.length === 1 ? `?profile=${encodeURIComponent(snapshot[0])}` : "";
   const local = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}${only}`;
-  let ready = false;
-  for (let i = 0; i < 20 && !ready; i++) {
-    ready = await fetch(serviceUrl(local, "ping"), { headers: { Authorization: `Bearer ${listener.key}` }, signal: AbortSignal.timeout(1000) }).then(r => r.ok).catch(() => false);
-    if (!ready) await Bun.sleep(250);
-  }
+  const ready = await waitForListener(listener);
   if (!ready) console.error(`[rech] warning: listener "${name}" is not answering yet; check the daemon with rech status.`);
   if (opts.tailscaleServe && !listener.publicUrl) {
     const publicUrl = await exposeWithTailscaleServe(listener);
@@ -1570,6 +1567,32 @@ async function exposeWithTailscaleServe(listener: Listener): Promise<string | nu
   return (await detectTailscaleServe(listener.port, prefix)).routeUrl;
 }
 
+/** The daemon reloads listeners.json about every second: wait (up to ~5s) until this listener answers. */
+async function waitForListener(listener: Listener): Promise<boolean> {
+  const url = `http://${listener.key}@${listenerAddress(listener)}${normalizePrefix(listener.prefix)}`;
+  for (let i = 0; i < 20; i++) {
+    if (await fetch(serviceUrl(url, "ping"), { headers: { Authorization: `Bearer ${listener.key}` }, signal: AbortSignal.timeout(1000) }).then(r => r.ok).catch(() => false)) return true;
+    await Bun.sleep(250);
+  }
+  return false;
+}
+
+/**
+ * Ask how other machines will reach a link: "tailscale-serve", a detected network address
+ * (plain HTTP), "127.0.0.1" for the user's own proxy, or `extra` choices; null when cancelled.
+ */
+async function askReachability(question: string, extra: { label: string; value: string }[] = []): Promise<string | null> {
+  const serve = !!tailscaleBinary();
+  // With Tailscale Serve on offer, a plain-HTTP Tailscale IP would only be a worse duplicate.
+  const networks = (await detectListenChoices()).filter(c => c.kind !== "local" && !(serve && c.kind === "tailscale"));
+  return promptChoice(question, [
+    ...(serve ? [{ label: "Tailscale: HTTPS, only your tailnet", value: "tailscale-serve" }] : []),
+    ...networks.map(c => ({ label: `${c.label.split(" — ")[0]} network: http://${c.address}, plain HTTP`, value: c.address })),
+    { label: "My own reverse proxy", value: "127.0.0.1" },
+    ...extra,
+  ], 0);
+}
+
 /**
  * Give one profile its own link. In a terminal, ask how the other machines will reach it
  * (Tailscale Serve, a detected network, or the user's own proxy); without one, create a
@@ -1580,14 +1603,7 @@ async function shareNewLink(profile: string, opts: { local?: boolean; save?: boo
   const name = uniqueShareName(profileSlug(profile), (await requireListeners()).listeners, served);
   let host = "127.0.0.1", tailscaleServe = false;
   if (isInteractive()) {
-    const serve = !!tailscaleBinary();
-    // With Tailscale Serve on offer, a plain-HTTP Tailscale IP would only be a worse duplicate.
-    const networks = (await detectListenChoices()).filter(c => c.kind !== "local" && !(serve && c.kind === "tailscale"));
-    const how = await promptChoice(`How will your other machines reach it?`, [
-      ...(serve ? [{ label: "Tailscale: HTTPS, only your tailnet", value: "tailscale-serve" }] : []),
-      ...networks.map(c => ({ label: `${c.label.split(" — ")[0]} network: http://${c.address}, plain HTTP`, value: c.address })),
-      { label: "My own reverse proxy", value: "127.0.0.1" },
-    ], 0);
+    const how = await askReachability(`How will your other machines reach it?`);
     if (!how) throw new Error("Cancelled; nothing shared.");
     tailscaleServe = how === "tailscale-serve";
     host = tailscaleServe ? "127.0.0.1" : how;
@@ -1726,6 +1742,31 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     const serve = await detectTailscaleServe(pending.port, normalizePrefix(pending.prefix));
     if (serve.routeUrl && !serve.funnel) { pending.publicUrl = serve.routeUrl; await writeListeners(config); }
   }
+  // Still only reachable from this machine (no proxy recorded or detected): a link like that is
+  // useless to hand out, so ask how other machines reach it, or say how to expose it.
+  if (config && pending && pending.profiles !== "*" && !pending.publicUrl && isLoopback(pending.host) && !opts.local) {
+    const steps = () => { for (const line of listenerNextSteps(pending, profile)) console.error(line); };
+    if (!interactive) {
+      console.error(`[rech] this link only works on this machine: listener "${pending.name}" is on ${listenerAddress(pending)} and no proxy is recorded.`);
+      steps();
+    } else {
+      const KEEP = "\0keep";
+      const how = await askReachability(`Link "${pending.name}" only works on this machine (${listenerAddress(pending)}). How will your other machines reach it?`,
+        [{ label: "Nothing: keep it on this machine", value: KEEP }]);
+      if (!how) throw cancelled();
+      if (how === "tailscale-serve") {
+        const routeUrl = await exposeWithTailscaleServe(pending);
+        if (routeUrl) { pending.publicUrl = routeUrl; await writeListeners(config); }
+      } else if (how === "127.0.0.1") steps();
+      else if (how !== KEEP) {
+        // Same key and prefix, now bound on that network; links already handed out change host.
+        pending.host = how;
+        await writeListeners(config);
+        if (!(await waitForListener(pending))) console.error(`[rech] warning: listener "${pending.name}" is not answering on ${listenerAddress(pending)} yet; check the daemon with rech status.`);
+        uri = profileConnectionUri(profile, undefined, config.listeners, pending.name);
+      }
+    }
+  }
   const publicUrl = pending?.publicUrl;
   if (publicUrl && !opts.local) uri = rebaseConnectionUrl(publicUrl, uri);
   console.log(uri);
@@ -1768,6 +1809,7 @@ async function callServe(
   overrideEnv?: Record<string, string>,
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
+  upload?: UploadPayload,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1786,7 +1828,7 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env }),
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -1972,7 +2014,12 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity);
+  let upload: UploadPayload | undefined;
+  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
+    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+  }
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -3618,6 +3665,7 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
 
 Environment:
   ${ENV_KEY}      connection URL; read from the nearest .rechrome/.env.local or .env.local
+  RECHROME_PROFILE  default browser profile selector; --profile overrides it
   RECH_IDENTITY     session key: worktree (default) | branch | cwd
   RECH_TOKEN        extension token for \`rech setup\` (same as --token)
   RECH_SETUP_AGENT  setup hints: codex | claude | none (auto-detected)
@@ -3808,7 +3856,7 @@ if (import.meta.main) {
     if (separator !== -1) args = args.slice(0, separator);
     try {
       const extracted = extractGlobalProfileArg(args);
-      profileSelector = extracted.selector;
+      profileSelector = extracted.selector ?? (process.env.RECHROME_PROFILE?.trim() || undefined);
       args = extracted.args;
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));