rechrome 1.35.1 → 1.36.0

package/README.md

@@ -243,6 +243,7 @@ cp .env.example .env.local
 | `PLAYWRIGHT_MCP_EXTENSION_ID`       | Chrome extension ID (client overrides server)                                                                                       | —                |
 | `PLAYWRIGHT_MCP_EXTENSION_TOKEN`    | Chrome extension token — profile-specific, get it from the extension's status page (client overrides server)                        | —                |
 | `PLAYWRIGHT_MCP_USER_DATA_DIR`      | Chrome user data directory — use to pin connections to a specific Chrome install (client overrides server)                          | —                |
+| `RECHROME_PROFILE` | Default profile selector for browser commands, equivalent to `--profile`. An explicit flag wins; blank values are ignored. Remote listeners still enforce their allowlist. | — |
 | `PLAYWRIGHT_MCP_PROFILE_DIRECTORY`  | Chrome profile — accepts directory name (`Profile 2`), display name (`Snowstar`), or **email** (`you@example.com`) (client overrides server) | —         |
 
 > **Multi-profile tip:** Each project's `.env.local` can specify a different Chrome profile via the `?profile=` query param in `RECHROME_URL`. The server resolves display names and email addresses to the actual Chrome profile directory automatically (reads `~/Library/Application Support/Google/Chrome/Local State`).
@@ -254,6 +255,57 @@ cp .env.example .env.local
 >
 > Shell-set `PLAYWRIGHT_MCP_*` variables take priority over `.env.local`, so you can always override per-command without editing files.
 
+### Small icon uploads from stdin
+
+Uploads are disabled by default on every listener. The host owner can add an
+`uploads` object to the intended listener entry in `~/.rechrome/listeners.json`:
+
+```json
+"uploads": {
+  "maxBytes": 2097152,
+  "contentTypes": ["image/png", "image/svg+xml"]
+}
+```
+
+The object enables uploads; omitting it disables them. `uploads: {}` uses the
+same defaults shown above. The owner can lower the byte limit or narrow the type
+list, but cannot exceed the hard **2 MiB** limit or enable other types. Do not
+replace the listener's other fields or share its key. Install the updated daemon
+code before enabling this policy; configuration changes then use the usual
+listener reload mechanism.
+
+On the **client machine**, open the website's file chooser with `rech click`, then
+send the icon through stdin in the same profile/session:
+
+```bash
+rech --profile work -s=slack upload --name app-icon.png < ./app-icon.png
+cat ./app-icon.svg | rech --profile work -s=slack upload --name app-icon.svg
+```
+
+`--content-type image/png` or `--content-type image/svg+xml` may be specified;
+otherwise the type is inferred from `--name`. This command is stdin-only: there
+is no positional file path. The shell reads the local file; only its bytes and
+metadata are sent to the listener. Client and server both enforce the byte cap.
+The server checks PNG signatures or UTF-8 SVG markup (rejecting DTD/entities),
+and checks the type against the listener policy. These checks identify the file
+format; they do not sanitize SVG or scan for malware. The host never renders the
+file or resolves anything referenced inside it.
+
+The receiver writes a random `.png`/`.svg` filename with mode 0600 inside a private
+0700 temporary directory, outside the downloadable output tree. It passes only
+that generated path to the existing file-chooser command and removes the directory
+on success, error, or timeout. Neither filenames nor payload fields can select a
+host file. A crash or forced process kill can interrupt cleanup; the files remain
+private OS temporary files. Permission modes apply on POSIX hosts.
+
+Each upload produces one `upload:` JSON audit record with listener, profile,
+original name, byte size, SHA-256, page origin observed immediately before upload,
+and result. It contains no file contents, credentials, page path, query, or fragment.
+Requests rejected before inspection have null values for unavailable fields.
+An HTTP(S) origin must be determined before an upload is attempted. As with other
+browser commands, avoid concurrent tab navigation in the same session. Scoped
+`eval`, `run-code`, host paths, and CLI option overrides remain unavailable.
+
 ### Remote access
 
 `rech setup --profile <profile> --listen tailscale` exposes that profile through a
@@ -345,3 +397,25 @@ PRs upstream are welcome. Once these features land in the official packages we w
 ## License
 
 MIT
+
+### Bridge connection diagnostics and recovery
+
+Each connection attempt records fixed phase names (launch, retry, WebSocket
+accepted, initialized, timeout/close) in its own private `.bridge.jsonl` file under
+`~/.cache/ms-playwright/bridge`, or `PLAYWRIGHT_MCP_BRIDGE_LOG_DIR` when configured
+for the Playwright process. Records contain an attempt ID, PID and timing only;
+no URLs, tokens, page text or raw error messages. CLI startup stderr is retained
+separately in a unique `.err` file for each launch and is not the sanitized log.
+
+A failed automated connection page retires itself at its deadline only if it
+still shows the original connection URL. The profile's worker can remove an older
+page for the same attempt and relay; it excludes other attempts, attached tabs,
+and tabs that navigated away. Automatic recovery no longer reloads the extension,
+which could disconnect other working lanes. A genuinely unresponsive worker can
+still require an explicit operator-approved extension reload.
+
+This source change requires rebuilding the vendored Playwright bundle and
+reloading the updated extension before use. It does not modify a running daemon
+or extension. The draft PR records isolated-browser validation and negative
+controls; passing recovery tests does not establish the original intermittent
+timeout's root cause.

package/extension/lib/background.mjs

@@ -566,7 +566,10 @@ class PlaywrightExtension {
   _onMessage(message, sender, sendResponse) {
     switch (message.type) {
       case "connectionRequested":
-        this._pendingConnections.create(sender.tab.id, message.mcpRelayUrl, message.protocolVersion).then(
+        (async () => {
+          if (message.recoveryAttempt) await this._retireSupersededPages(sender);
+          await this._pendingConnections.create(sender.tab.id, message.mcpRelayUrl, message.protocolVersion);
+        })().then(
           () => sendResponse({ success: true }),
           (error) => sendResponse({ success: false, error: error.message })
         );
@@ -606,6 +609,27 @@ class PlaywrightExtension {
         return false;
     }
   }
+  // The single worker coordinates recovery within this profile. It never reloads
+  // itself or touches live groups: only sibling connect pages for the same relay
+  // attempt can be retired. A different lane/attempt is outside this ownership.
+  async _retireSupersededPages(sender) {
+    var _a;
+    const current = new URL(sender.url || ((_a = sender.tab) == null ? void 0 : _a.url) || "about:blank");
+    const attempt = current.searchParams.get("attempt");
+    const relay = current.searchParams.get("mcpRelayUrl");
+    if (current.protocol !== "chrome-extension:" || current.host !== chrome.runtime.id || current.pathname !== "/connect.html" || !/^[0-9a-f-]{36}$/.test(attempt || "") || !relay) return;
+    const attached = new Set([...this._activeGroups].flatMap((g) => g.connectedTabIds()));
+    const tabs = await chrome.tabs.query({});
+    await Promise.all(tabs.map(async (tab) => {
+      var _a2;
+      if (tab.id === void 0 || tab.id === ((_a2 = sender.tab) == null ? void 0 : _a2.id) || attached.has(tab.id) || !tab.url) return;
+      const other = new URL(tab.url);
+      if (other.protocol !== current.protocol || other.host !== current.host || other.pathname !== current.pathname || other.searchParams.get("attempt") !== attempt || other.searchParams.get("mcpRelayUrl") !== relay) return;
+      const latest = await chrome.tabs.get(tab.id).catch(() => void 0);
+      if ((latest == null ? void 0 : latest.url) === tab.url) await chrome.tabs.remove(tab.id).catch(() => {
+      });
+    }));
+  }
   async _connectTab(selectorTabId, tab, clientName) {
     try {
       await Promise.race([
@@ -655,3 +679,6 @@ class PlaywrightExtension {
   }
 }
 new PlaywrightExtension();
+export {
+  PlaywrightExtension
+};

package/extension/lib/ui/connect.js

@@ -4,18 +4,12 @@
 import { c as clientExports, j as jsxRuntimeExports, r as reactExports, A as AuthTokenSection, T as TabItem, B as Button, g as getOrCreateAuthToken } from "./authToken.js";
 const SUPPORTED_PROTOCOL_VERSION = 2;
 const BACKGROUND_RESPONSE_TIMEOUT_MS = 1e4;
-const SELF_RELOAD_GUARD_KEY = "connect-self-reload-at";
-const SELF_RELOAD_MIN_INTERVAL_MS = 6e4;
-function attemptExtensionSelfReload() {
-  if (new URLSearchParams(window.location.search).get("selfReload") !== "1")
-    return false;
-  const last = Number(localStorage.getItem(SELF_RELOAD_GUARD_KEY) || 0);
-  const now = Date.now();
-  if (now - last < SELF_RELOAD_MIN_INTERVAL_MS)
-    return false;
-  localStorage.setItem(SELF_RELOAD_GUARD_KEY, String(now));
-  chrome.runtime.reload();
-  return true;
+async function retireExpiredAttempt(originalUrl) {
+  const params = new URL(originalUrl).searchParams;
+  if (!/^[0-9a-f-]{36}$/.test(params.get("attempt") || "")) return;
+  const tab = await chrome.tabs.getCurrent();
+  if ((tab == null ? void 0 : tab.id) !== void 0 && tab.url === originalUrl)
+    await chrome.tabs.remove(tab.id);
 }
 async function sendMessageWithTimeout(message, simulateHang = false) {
   let timer;
@@ -41,6 +35,17 @@ const ConnectApp = () => {
     setStatus({ type: "error", message });
   }, []);
   reactExports.useEffect(() => {
+    const originalUrl = window.location.href;
+    const expiry = Number(new URL(originalUrl).searchParams.get("expires"));
+    let connected = false;
+    const onConnected = () => {
+      connected = true;
+    };
+    window.addEventListener("bridge-connected", onConnected);
+    const expiryTimer = Number.isFinite(expiry) && expiry > 0 ? setTimeout(() => {
+      if (!connected) void retireExpiredAttempt(originalUrl).catch(() => {
+      });
+    }, Math.max(0, Math.min(expiry - Date.now(), 2147483647))) : void 0;
     const runAsync = async () => {
       const params = new URLSearchParams(window.location.search);
       const relayUrl = params.get("mcpRelayUrl");
@@ -89,13 +94,12 @@ const ConnectApp = () => {
       let response;
       try {
         response = await sendMessageWithTimeout(
-          { type: "connectionRequested", mcpRelayUrl: relayUrl, protocolVersion: requestedVersion },
+          { type: "connectionRequested", mcpRelayUrl: relayUrl, protocolVersion: requestedVersion, recoveryAttempt },
           params.get("testHangOnce") === "1" && !recoveryAttempt
         );
       } catch (error) {
         if (hasAutomationToken && !recoveryAttempt) {
-          const reloading = attemptExtensionSelfReload();
-          setError(reloading ? "Extension service worker is not responding. Reloading extension and retrying…" : "Extension service worker is not responding. Retrying once…");
+          setError("Extension service worker is not responding. Retrying once…");
           return;
         }
         setError(`Extension service worker did not recover: ${error.message}`);
@@ -108,7 +112,7 @@ const ConnectApp = () => {
       const expectedToken = getOrCreateAuthToken();
       const token = params.get("token");
       if (token === expectedToken) {
-        await handleConnectToTab(void 0, info);
+        connected = !!await handleConnectToTab(void 0, info);
         return;
       }
       if (token) {
@@ -125,7 +129,11 @@ const ConnectApp = () => {
       chrome.runtime.sendMessage({ type: "keepalive" }).catch(() => {
       });
     }, 2e4);
-    return () => clearInterval(keepalive);
+    return () => {
+      clearInterval(keepalive);
+      clearTimeout(expiryTimer);
+      window.removeEventListener("bridge-connected", onConnected);
+    };
   }, []);
   const loadTabs = reactExports.useCallback(async () => {
     const response = await chrome.runtime.sendMessage({ type: "getTabs" });
@@ -144,6 +152,8 @@ const ConnectApp = () => {
       });
       if (response == null ? void 0 : response.success) {
         setStatus({ type: "connected", message: `"${clientName}" connected.` });
+        window.dispatchEvent(new Event("bridge-connected"));
+        return true;
       } else {
         setStatus({
           type: "error",
@@ -154,8 +164,7 @@ const ConnectApp = () => {
       const recoveryAttempt = new URLSearchParams(window.location.search).get("recoveryAttempt") === "1";
       const hasAutomationToken = !!new URLSearchParams(window.location.search).get("token");
       if (hasAutomationToken && !recoveryAttempt) {
-        const reloading = attemptExtensionSelfReload();
-        setError(reloading ? "Extension service worker stopped during connection. Reloading extension and retrying…" : "Extension service worker stopped during connection. Retrying once…");
+        setError("Extension service worker stopped during connection. Retrying once…");
         return;
       }
       setStatus({
@@ -163,6 +172,7 @@ const ConnectApp = () => {
         message: `"${clientName}" failed to connect: ${e}`
       });
     }
+    return false;
   }, [clientInfo, setError]);
   reactExports.useEffect(() => {
     const listener = (message) => {

package/listeners.js

@@ -1,4 +1,14 @@
 // @bun
+// scoped-upload.ts
+var MAX_UPLOAD_BYTES = 2 * 1024 * 1024;
+var MAX_REQUEST_BYTES = 3 * 1024 * 1024;
+var UPLOAD_TYPES = ["image/png", "image/svg+xml"];
+function validateUploadPolicy(value) {
+  const p = value;
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
+    throw new Error("uploads must be an object with optional maxBytes (1..2097152) and contentTypes (image/png, image/svg+xml)");
+}
+
 // listeners.ts
 import { isIP } from "net";
 import { createHash, randomBytes } from "crypto";
@@ -54,6 +64,8 @@ function validateListeners(value) {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some((p) => typeof p !== "string" || !p.trim() || p.includes("\x00") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
+    if (l.uploads !== undefined)
+      validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
       throw new Error("Listener names, addresses, and credentials must be unique");
@@ -92,12 +104,16 @@ function authorizeProfileRequest(listener, body) {
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile)
     throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (!SCOPED_COMMANDS.has(args[0]))
+  if (!(args[0] === "upload" && listener.uploads !== undefined) && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
   if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page")))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
+  if (args[0] === "upload" && (args.length !== 1 || !body.upload))
+    throw new Error("Upload requires stdin bytes; host paths are unavailable");
+  if (args[0] !== "upload" && body.upload !== undefined)
+    throw new Error("Unexpected upload payload");
   return profile;
 }
 function canReadProfileFile(listener, path) {

package/listeners.ts

@@ -1,3 +1,4 @@
+import { validateUploadPolicy, type UploadPolicy } from "./scoped-upload.ts";
 import { isIP } from "net";
 import { createHash, randomBytes } from "crypto";
 import { homedir } from "os";
@@ -5,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy };
 export type ListenerConfig = { version: 1; listeners: Listener[] };
 export const LISTENERS_FILE = join(homedir(), ".rechrome", "listeners.json");
 export const isLoopback = (host: string) => host === "::1" || /^127\./.test(host);
@@ -54,6 +55,7 @@ export function validateListeners(value: unknown): ListenerConfig {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some(p => typeof p !== "string" || !p.trim() || p.includes("\0") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
+    if (l.uploads !== undefined) validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -85,9 +87,12 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
   if (typeof profile !== "string" || listener.profiles === "*" || !listener.profiles.includes(profile)) throw new Error("Profile is not allowed on this listener");
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile) throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (!SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (!(args[0] === "upload" && listener.uploads !== undefined) && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
   if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page"))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
+  // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
+  if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");
+  if (args[0] !== "upload" && body.upload !== undefined) throw new Error("Unexpected upload payload");
   return profile;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"
@@ -25,7 +25,9 @@
     "rechrome.ts",
     "serve.js",
     "serve.ts",
-    "vendor"
+    "vendor",
+    "scoped-upload.ts",
+    "scoped-upload.js"
   ],
   "type": "module",
   "scripts": {
@@ -34,7 +36,7 @@
     "vendor-cli": "bash scripts/vendor-cli.sh",
     "prepare": "bash scripts/vendor-cli.sh --prepare",
     "check-pack": "bash scripts/check-pack.sh",
-    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bash scripts/check-pack.sh"
+    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bash scripts/check-pack.sh"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/rechrome.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.js";
 import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener } from "./listeners.js";
 
 import { file } from "bun";
@@ -1808,6 +1809,7 @@ async function callServe(
   overrideEnv?: Record<string, string>,
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
+  upload?: UploadPayload,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1826,7 +1828,7 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env }),
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -2012,7 +2014,12 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity);
+  let upload: UploadPayload | undefined;
+  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
+    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+  }
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -3658,6 +3665,7 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
 
 Environment:
   ${ENV_KEY}      connection URL; read from the nearest .rechrome/.env.local or .env.local
+  RECHROME_PROFILE  default browser profile selector; --profile overrides it
   RECH_IDENTITY     session key: worktree (default) | branch | cwd
   RECH_TOKEN        extension token for \`rech setup\` (same as --token)
   RECH_SETUP_AGENT  setup hints: codex | claude | none (auto-detected)
@@ -3848,7 +3856,7 @@ if (import.meta.main) {
     if (separator !== -1) args = args.slice(0, separator);
     try {
       const extracted = extractGlobalProfileArg(args);
-      profileSelector = extracted.selector;
+      profileSelector = extracted.selector ?? (process.env.RECHROME_PROFILE?.trim() || undefined);
       args = extracted.args;
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));

package/rechrome.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.ts";
 import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener } from "./listeners.ts";
 
 import { file } from "bun";
@@ -1808,6 +1809,7 @@ async function callServe(
   overrideEnv?: Record<string, string>,
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
+  upload?: UploadPayload,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1826,7 +1828,7 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env }),
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -2012,7 +2014,12 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity);
+  let upload: UploadPayload | undefined;
+  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
+    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+  }
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -3658,6 +3665,7 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
 
 Environment:
   ${ENV_KEY}      connection URL; read from the nearest .rechrome/.env.local or .env.local
+  RECHROME_PROFILE  default browser profile selector; --profile overrides it
   RECH_IDENTITY     session key: worktree (default) | branch | cwd
   RECH_TOKEN        extension token for \`rech setup\` (same as --token)
   RECH_SETUP_AGENT  setup hints: codex | claude | none (auto-detected)
@@ -3848,7 +3856,7 @@ if (import.meta.main) {
     if (separator !== -1) args = args.slice(0, separator);
     try {
       const extracted = extractGlobalProfileArg(args);
-      profileSelector = extracted.selector;
+      profileSelector = extracted.selector ?? (process.env.RECHROME_PROFILE?.trim() || undefined);
       args = extracted.args;
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));

package/scoped-upload.js

@@ -0,0 +1,165 @@
+// @bun
+// scoped-upload.ts
+import { createHash, randomBytes } from "crypto";
+import { mkdtemp, writeFile, rm } from "fs/promises";
+import { join } from "path";
+import { tmpdir } from "os";
+var MAX_UPLOAD_BYTES = 2 * 1024 * 1024;
+var MAX_REQUEST_BYTES = 3 * 1024 * 1024;
+var UPLOAD_TYPES = ["image/png", "image/svg+xml"];
+function validateUploadPolicy(value) {
+  const p = value;
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
+    throw new Error("uploads must be an object with optional maxBytes (1..2097152) and contentTypes (image/png, image/svg+xml)");
+}
+function validName(name) {
+  return typeof name === "string" && name.length > 0 && name.length <= 128 && name !== "." && name !== ".." && !name.startsWith("-") && !/[\\/:\x00-\x1f\x7f]/.test(name);
+}
+function matchesType(bytes, type) {
+  if (type === "image/png")
+    return bytes.length >= 33 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) && bytes.readUInt32BE(8) === 13 && bytes.toString("ascii", 12, 16) === "IHDR";
+  if (type === "image/svg+xml") {
+    let text;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      return false;
+    }
+    if (/<!DOCTYPE|<!ENTITY/i.test(text))
+      return false;
+    text = text.trim().replace(/^<\?xml\s[^?]*\?>\s*/, "").replace(/^(?:<!--[\s\S]*?-->\s*)+/, "");
+    return /^<svg(?:\s|\/?>)/.test(text) && /(?:<\/svg\s*>|\/>)\s*$/.test(text);
+  }
+  return false;
+}
+async function prepareStdinUpload(args, input) {
+  const sessions = args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a));
+  const options = args.filter((a) => !sessions.includes(a));
+  if (options.shift() !== "upload")
+    throw new Error("Expected upload command");
+  const fields = {};
+  while (options.length) {
+    const option = options.shift();
+    const match = option.match(/^--(name|content-type)(?:=(.*))?$/);
+    if (!match || fields[match[1]] !== undefined)
+      throw new Error("Usage: rech upload --name icon.png [--content-type image/png] < icon.png (stdin only; no path argument)");
+    const value = match[2] ?? options.shift();
+    if (!value || value.startsWith("--"))
+      throw new Error(`Missing value for --${match[1]}`);
+    fields[match[1]] = value;
+  }
+  if (!validName(fields.name))
+    throw new Error("upload requires --name with a plain filename (no path)");
+  const contentType = fields["content-type"] ?? (fields.name.toLowerCase().endsWith(".png") ? "image/png" : fields.name.toLowerCase().endsWith(".svg") ? "image/svg+xml" : "");
+  if (!UPLOAD_TYPES.includes(contentType))
+    throw new Error("Upload content type must be image/png or image/svg+xml");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of input) {
+    size += chunk.byteLength;
+    if (size > MAX_UPLOAD_BYTES)
+      throw new Error("Upload exceeds 2 MiB");
+    chunks.push(Buffer.from(chunk));
+  }
+  const bytes = Buffer.concat(chunks);
+  if (!matchesType(bytes, contentType))
+    throw new Error("Upload bytes do not match the content type (PNG or UTF-8 SVG without DTD/entities required)");
+  return { args: ["upload", ...sessions], upload: { name: fields.name, contentType, data: bytes.toString("base64") } };
+}
+function currentPageOrigin(output) {
+  const current = output.split(`
+`).filter((line) => /^- \d+: \(current\) /.test(line));
+  const url = current.length === 1 ? current[0].match(/\]\((.*)\)(?: \[crashed\])?$/)?.[1] : undefined;
+  if (!url)
+    throw new Error("Could not determine the upload page origin");
+  const parsed = new URL(url);
+  if (!["http:", "https:"].includes(parsed.protocol))
+    throw new Error("Uploads require an HTTP(S) page");
+  return parsed.origin;
+}
+async function receiveUpload(options) {
+  const record = { name: null, size: null, sha256: null, origin: null, result: "rejected" };
+  let dir;
+  try {
+    const p = options.payload;
+    if (validName(p?.name))
+      record.name = p.name;
+    if (options.policy === undefined)
+      throw new Error("Uploads are disabled on this listener");
+    validateUploadPolicy(options.policy);
+    if (options.args.length !== 1 || options.args[0] !== "upload")
+      throw new Error("Upload takes stdin bytes, not host paths or CLI options");
+    if (!p || !validName(p.name) || typeof p.contentType !== "string" || typeof p.data !== "string" || Object.keys(p).some((k) => !["name", "contentType", "data"].includes(k)))
+      throw new Error("Invalid upload payload");
+    const limit = options.policy.maxBytes ?? MAX_UPLOAD_BYTES;
+    if (p.data.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data))
+      throw new Error("Upload exceeds maxBytes or has invalid base64");
+    const bytes = Buffer.from(p.data, "base64");
+    record.size = bytes.length;
+    record.sha256 = createHash("sha256").update(bytes).digest("hex");
+    if (!bytes.length || bytes.length > limit || bytes.toString("base64") !== p.data)
+      throw new Error("Upload is empty, exceeds maxBytes, or is not canonical base64");
+    if (!(options.policy.contentTypes ?? UPLOAD_TYPES).includes(p.contentType) || !matchesType(bytes, p.contentType))
+      throw new Error("Upload content type is not allowed or does not match the bytes");
+    const tabs = await options.run(["tab-list"]);
+    if (tabs.status !== 0)
+      throw new Error("Could not inspect the upload page");
+    record.origin = currentPageOrigin(tabs.stdout);
+    dir = await mkdtemp(join(tmpdir(), "rech-upload-"));
+    const path = join(dir, randomBytes(16).toString("hex") + (p.contentType === "image/png" ? ".png" : ".svg"));
+    await writeFile(path, bytes, { mode: 384, flag: "wx" });
+    record.result = "failed";
+    const result = await options.run(["upload", path]);
+    record.result = result.status === 0 && !/^### Error\b/m.test(result.stdout) ? "completed" : "failed";
+    return {
+      ...result,
+      status: record.result === "completed" ? 0 : 1,
+      stdout: result.stdout.replaceAll(path, p.name),
+      stderr: result.stderr.replaceAll(path, p.name)
+    };
+  } catch (error) {
+    return { status: 1, stdout: "", stderr: (error instanceof Error ? error.message : "Upload failed") + `
+` };
+  } finally {
+    try {
+      if (dir)
+        await rm(dir, { recursive: true, force: true });
+    } finally {
+      options.audit(record);
+    }
+  }
+}
+async function readRequestJson(req) {
+  const reader = req.body?.getReader();
+  if (!reader)
+    throw new Error("Empty request");
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > MAX_REQUEST_BYTES)
+        throw new Error("Request exceeds 3 MiB");
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+export {
+  MAX_REQUEST_BYTES,
+  MAX_UPLOAD_BYTES,
+  UPLOAD_TYPES,
+  currentPageOrigin,
+  prepareStdinUpload,
+  readRequestJson,
+  receiveUpload,
+  validateUploadPolicy
+};