rechrome 1.35.1 → 1.36.1

package/rechrome.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.ts";
 import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener } from "./listeners.ts";
 
 import { file } from "bun";
@@ -827,18 +828,53 @@ const CHROME_LOCAL_STATE_PATHS = () => {
 
 type ChromeProfileInfo = { user_name?: string; name?: string };
 
+/**
+ * macOS privacy (TCC) blocks a process launched by launchd/oxmgr from Chrome's data folder unless
+ * its binary has Full Disk Access; a Terminal or agent session inherits the grant. Turn that EPERM
+ * into the fix. Undefined for any other error (or platform).
+ */
+export function chromeDataAccessHint(error: unknown, execPath = process.execPath, platform = process.platform): string | undefined {
+  const code = (error as { code?: string } | null)?.code;
+  const message = error instanceof Error ? error.message : String(error);
+  if (platform !== "darwin" || !(code === "EPERM" || code === "EACCES" || /EPERM|operation not permitted/i.test(message))) return undefined;
+  return `macOS privacy settings (TCC) block ${execPath} from reading Chrome's profile folder. ` +
+    `Grant it Full Disk Access: System Settings → Privacy & Security → Full Disk Access → +, press ⌘⇧G, paste ${execPath}, ` +
+    `then restart rech serve. Or run rech serve from Terminal, which already has access (see docs/macos-daemon.md).`;
+}
+
+/** Why the last readChromeProfileCache() returned null (undefined when it succeeded). */
+let profileCacheProblem: string | undefined;
+
 export async function readChromeProfileCache(): Promise<Record<string, ChromeProfileInfo> | null> {
+  profileCacheProblem = undefined;
+  const problems: string[] = [];
   for (const statePath of CHROME_LOCAL_STATE_PATHS()) {
     const f = file(statePath);
     if (!(await f.exists())) continue;
     try {
       const data = JSON.parse(await f.text());
-      return data?.profile?.info_cache ?? null;
-    } catch {}
+      if (data?.profile?.info_cache) return data.profile.info_cache;
+      problems.push(`${statePath} has no profile list`);
+    } catch (error) {
+      const hint = chromeDataAccessHint(error);
+      problems.push(`${statePath} is unreadable (${error instanceof Error ? error.message : String(error)})${hint ? `. ${hint}` : ""}`);
+    }
   }
+  profileCacheProblem = problems.join("; ") || "Chrome's Local State file was not found";
   return null;
 }
 
+/**
+ * Say so (once per process) when profile emails/names are unavailable, so a bare folder name
+ * like "Profile 1" is never mistaken for the whole story.
+ */
+let warnedProfileCache = false;
+export function warnIfProfileNamesUnavailable(cache: Record<string, ChromeProfileInfo> | null): void {
+  if (cache || warnedProfileCache) return;
+  warnedProfileCache = true;
+  console.error(`[rech] Chrome profile emails and names are unavailable (${profileCacheProblem ?? "Local State not read"}); profiles are shown by folder name only.`);
+}
+
 export function resolveChromeProfileSelector(
   profiles: Array<[string, ChromeProfileInfo]>,
   selector: string,
@@ -1306,6 +1342,7 @@ async function listRemoteProfiles(url: string): Promise<void> {
 
 async function listProfiles(): Promise<void> {
   const [cache, registry, root] = await Promise.all([readChromeProfileCache(), readTokenRegistry(), findChromeUserDataDir()]);
+  warnIfProfileNamesUnavailable(cache);
   const profiles = buildProfileRows(cache, registry, root);
   const listeners = await readListeners();
   const url = process.env[ENV_KEY];
@@ -1405,7 +1442,7 @@ export function registeredProfileChoices(registry: Record<string, TokenEntry>, c
     const info = !userDataDir || defaultDirs.includes(userDataDir) ? cache?.[dir] : undefined;
     const names = [info?.name, info?.user_name, key].filter((n): n is string => !!n && n !== dir);
     const shown = [...new Set(names)];
-    return { label: shown.length ? `${shown.join(" · ")}  [${dir}]` : dir, value: key };
+    return { label: shown.length ? `${shown.join(" · ")}  [${dir}]` : `${dir}  (no email or name known)`, value: key };
   });
 }
 
@@ -1639,6 +1676,7 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
   const interactive = isInteractive();
   const registry = await readTokenRegistry();
   const cache = await readChromeProfileCache();
+  warnIfProfileNamesUnavailable(cache);
   const cancelled = () => new Error("Cancelled; nothing shared.");
   let config = await readListeners();
   const current = resolveEffectiveProfile(url ? parseUrl(url).profileDirectory : undefined);
@@ -1808,6 +1846,7 @@ async function callServe(
   overrideEnv?: Record<string, string>,
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
+  upload?: UploadPayload,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1826,7 +1865,7 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env }),
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -1997,7 +2036,16 @@ export function unknownCommandHint(output: string, rechCommands: Iterable<string
   ].join("\n");
 }
 
-async function run(url: string, args: string[], overrideEnv?: Record<string, string>, opts: { verbatim?: boolean } = {}) {
+/**
+ * An `open` whose extension bridge never connected. Typical right after Chrome restarts: the
+ * relay's connect page reaches no live worker, yet a fresh bridge moments later connects at once
+ * (seen 2026-10-17: a timeout, then `rech setup`'s probe connected in 0.1s). Worth one retry.
+ */
+export function isBridgeTimeout(args: string[], result: { status: number; stderr?: string }): boolean {
+  return args.find(a => !a.startsWith("-")) === "open" && result.status !== 0 && /Extension connection timeout/i.test(result.stderr ?? "");
+}
+
+async function run(url: string, args: string[], overrideEnv?: Record<string, string>, opts: { verbatim?: boolean; bridgeRetried?: boolean } = {}) {
   // Match the underlying CLI's command names while accepting the short forms humans
   // naturally try. Keep this client-side so old and new serve daemons behave alike.
   args = normalizeCommandArgs(args);
@@ -2012,7 +2060,19 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity);
+  let upload: UploadPayload | undefined;
+  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
+    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+  }
+  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
+  if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
+    // Close the failed session so the retry gets a fresh cliDaemon and relay. callServe re-reads
+    // the extension's live token from the profile, so a re-minted token heals here too.
+    console.error(`[rech] the Chrome extension bridge did not answer (common right after Chrome restarts); retrying once with a fresh connection…`);
+    await callServe(url, [...args.filter(a => /^-s=/.test(a)), "close"], overrideEnv, identity).catch(() => {});
+    return run(url, args, overrideEnv, { ...opts, bridgeRetried: true });
+  }
 
   const isOpenWithUrl = args[0] === "open" && args.length > 1;
   if (existingSession && isOpenWithUrl) {
@@ -2032,9 +2092,12 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
       // The daemon resolves registered profiles' bridge tokens itself and then asks for a reload;
       // only blame a missing install when neither side had credentials.
       const hasToken = !!effectiveEnv["PLAYWRIGHT_MCP_EXTENSION_TOKEN"] || /reload the .*extension/i.test(stderr);
+      const profileArg = displayProfile ? ` --profile ${JSON.stringify(displayProfile)}` : "";
       const last = hasToken
-        ? `  -x: extension did not connect (reload it at chrome://extensions; then verify its token) -> extension[degraded]`
-        : `  -> extension[not installed]  (run: rech setup)`;
+        ? `  -x: extension did not connect${opts.bridgeRetried ? " (also after an automatic retry)" : ""} -> extension[degraded]\n` +
+          `[rech] reload "Playwright MCP Bridge" at chrome://extensions${displayProfile ? ` in ${displayProfile}'s window` : ""}, then retry; ` +
+          `or run \`rech setup${profileArg}\`, which re-detects the extension and token and verifies the connection.`
+        : `  -> extension[not installed]  (run: rech setup${profileArg})`;
       console.error(`[rech] rech-client -> rech-server[ok] -> playwright[ok]\n${last}`);
     }
     if (stderr.includes("Browser '") && stderr.includes("is not open")) {
@@ -2069,6 +2132,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   process.exit(status);
 }
 
+/** The daemon's Playwright CLI predates `open --wait` (rechrome <= 1.35.1 bundled one). */
+export function cliRejectsWaitOption(output: string): boolean {
+  return /Unknown options?:?[^\n]*?['"`]?--wait\b/i.test(output);
+}
+
+/**
+ * setup's bridge probe: open about:blank without waiting for a load. The daemon owns the CLI and
+ * may be older than this client, so feature-check by behavior: if the CLI rejects `--wait`, probe
+ * again without it rather than reporting a broken bridge.
+ */
+export async function probeBridgeOpen<T extends { status: number; stdout: string; stderr: string }>(
+  call: (args: string[]) => Promise<T>,
+  note: (message: string) => void = () => {},
+): Promise<T> {
+  const probe = await call(["open", "about:blank", "--wait", "none"]);
+  if (probe.status === 0 || !cliRejectsWaitOption(`${probe.stderr}\n${probe.stdout}`)) return probe;
+  note("The daemon's Playwright CLI does not support `open --wait`; probing without it (update rechrome on the daemon host).");
+  return call(["open", "about:blank"]);
+}
+
 export type SetupPhase = "extension" | "token" | "bridge" | "error" | "save" | "ready";
 
 export function createSetupGuide(extDistDir: string, profileDisplay: string) {
@@ -2529,6 +2612,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
     [ENV_KEY]: serveUrl,
     PWMCP_TEST_CONNECTION_TIMEOUT: process.env.PWMCP_TEST_CONNECTION_TIMEOUT || "30000",
     PLAYWRIGHT_CLI: resolvedPlaywrightCli,
+    RECH_SERVE_MANAGED: "1", // the manager restarts it; never idle-self-exit (see serve.ts)
   };
   if (process.env.RECH_HOST) daemonEnv.RECH_HOST = process.env.RECH_HOST;
   if (isReadable(process.env.RECH_TLS_CERT)) daemonEnv.RECH_TLS_CERT = process.env.RECH_TLS_CERT!;
@@ -3287,7 +3371,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   console.log(`✓ [1/5] Local management daemon verified; requested profile access: ${desiredBind}`);
 
   const cache = await readChromeProfileCache();
-  if (!cache) { console.error("      Chrome profiles not found"); rl?.close(); process.exit(1); }
+  if (!cache) { console.error(`      Chrome profiles not found: ${profileCacheProblem ?? "Local State not read"}`); rl?.close(); process.exit(1); }
   const userDataDir = await findChromeUserDataDir();
 
   async function pickProfile(exclude: Set<string>): Promise<[string, ChromeProfileInfo] | null> {
@@ -3413,12 +3497,9 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.takeRetry();
     guide?.update("bridge", "Extension and token detected. Testing the browser connection…");
     try {
-      const probe = await callServe(
-        rechUrl.toString(),
-        [`-s=${probeSession}`, "open", "about:blank", "--wait", "none"],
-        probeEnv,
-        probeIdentity,
-        true,
+      const probe = await probeBridgeOpen(
+        args => callServe(rechUrl.toString(), [`-s=${probeSession}`, ...args], probeEnv, probeIdentity, true),
+        note => console.log(`      ${note}`),
       );
       bridgeVerified = probe.status === 0;
       if (bridgeVerified) {
@@ -3574,7 +3655,7 @@ async function status(): Promise<void> {
     ? await fetch(serviceUrl(url, "ping"), { headers: { Authorization: `Bearer ${parsed.key}` }, signal: AbortSignal.timeout(2000) }).catch(() => null)
     : null;
   const pingBody = pingResponse?.ok
-    ? await pingResponse.json().catch(() => null) as { bind?: string; listener?: string; profiles?: string[] | "*"; degraded?: boolean; consecutiveTimeouts?: number } | null
+    ? await pingResponse.json().catch(() => null) as { bind?: string; listener?: string; profiles?: string[] | "*"; degraded?: boolean; consecutiveTimeouts?: number; chromeAccessProblem?: string } | null
     : null;
   // Show the URL this client connects to; through a proxy, the daemon's bind is on another port.
   const details = [pingBody?.listener && `listener ${pingBody.listener}`, pingBody?.bind && `bind ${pingBody.bind}`].filter(Boolean).join(", ");
@@ -3595,6 +3676,8 @@ async function status(): Promise<void> {
   // No oxmgr/pm2 on PATH must not take down `rech status`: report it instead of throwing.
   let mgr: DaemonManager | undefined;
   if (isHost) try { mgr = daemonManager(); } catch { /* reported below */ }
+  if (pingBody?.chromeAccessProblem)
+    console.log(`chrome:   ⚠ daemon ${pingBody.chromeAccessProblem}`);
   if (pingBody?.degraded)
     console.log(`relay:    ⚠ degraded (${pingBody.consecutiveTimeouts} consecutive command timeouts) — if it persists, the daemon self-restarts; ${isHost ? `force it now with \`${mgr?.id ?? "oxmgr"} restart ${PM_PROCESS_NAME}\`` : "the daemon host can restart it"}`);
   if (isHost) {
@@ -3658,6 +3741,7 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
 
 Environment:
   ${ENV_KEY}      connection URL; read from the nearest .rechrome/.env.local or .env.local
+  RECHROME_PROFILE  default browser profile selector; --profile overrides it
   RECH_IDENTITY     session key: worktree (default) | branch | cwd
   RECH_TOKEN        extension token for \`rech setup\` (same as --token)
   RECH_SETUP_AGENT  setup hints: codex | claude | none (auto-detected)
@@ -3848,7 +3932,7 @@ if (import.meta.main) {
     if (separator !== -1) args = args.slice(0, separator);
     try {
       const extracted = extractGlobalProfileArg(args);
-      profileSelector = extracted.selector;
+      profileSelector = extracted.selector ?? (process.env.RECHROME_PROFILE?.trim() || undefined);
       args = extracted.args;
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));

package/scoped-upload.js

@@ -0,0 +1,165 @@
+// @bun
+// scoped-upload.ts
+import { createHash, randomBytes } from "crypto";
+import { mkdtemp, writeFile, rm } from "fs/promises";
+import { join } from "path";
+import { tmpdir } from "os";
+var MAX_UPLOAD_BYTES = 2 * 1024 * 1024;
+var MAX_REQUEST_BYTES = 3 * 1024 * 1024;
+var UPLOAD_TYPES = ["image/png", "image/svg+xml"];
+function validateUploadPolicy(value) {
+  const p = value;
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
+    throw new Error("uploads must be an object with optional maxBytes (1..2097152) and contentTypes (image/png, image/svg+xml)");
+}
+function validName(name) {
+  return typeof name === "string" && name.length > 0 && name.length <= 128 && name !== "." && name !== ".." && !name.startsWith("-") && !/[\\/:\x00-\x1f\x7f]/.test(name);
+}
+function matchesType(bytes, type) {
+  if (type === "image/png")
+    return bytes.length >= 33 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) && bytes.readUInt32BE(8) === 13 && bytes.toString("ascii", 12, 16) === "IHDR";
+  if (type === "image/svg+xml") {
+    let text;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      return false;
+    }
+    if (/<!DOCTYPE|<!ENTITY/i.test(text))
+      return false;
+    text = text.trim().replace(/^<\?xml\s[^?]*\?>\s*/, "").replace(/^(?:<!--[\s\S]*?-->\s*)+/, "");
+    return /^<svg(?:\s|\/?>)/.test(text) && /(?:<\/svg\s*>|\/>)\s*$/.test(text);
+  }
+  return false;
+}
+async function prepareStdinUpload(args, input) {
+  const sessions = args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a));
+  const options = args.filter((a) => !sessions.includes(a));
+  if (options.shift() !== "upload")
+    throw new Error("Expected upload command");
+  const fields = {};
+  while (options.length) {
+    const option = options.shift();
+    const match = option.match(/^--(name|content-type)(?:=(.*))?$/);
+    if (!match || fields[match[1]] !== undefined)
+      throw new Error("Usage: rech upload --name icon.png [--content-type image/png] < icon.png (stdin only; no path argument)");
+    const value = match[2] ?? options.shift();
+    if (!value || value.startsWith("--"))
+      throw new Error(`Missing value for --${match[1]}`);
+    fields[match[1]] = value;
+  }
+  if (!validName(fields.name))
+    throw new Error("upload requires --name with a plain filename (no path)");
+  const contentType = fields["content-type"] ?? (fields.name.toLowerCase().endsWith(".png") ? "image/png" : fields.name.toLowerCase().endsWith(".svg") ? "image/svg+xml" : "");
+  if (!UPLOAD_TYPES.includes(contentType))
+    throw new Error("Upload content type must be image/png or image/svg+xml");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of input) {
+    size += chunk.byteLength;
+    if (size > MAX_UPLOAD_BYTES)
+      throw new Error("Upload exceeds 2 MiB");
+    chunks.push(Buffer.from(chunk));
+  }
+  const bytes = Buffer.concat(chunks);
+  if (!matchesType(bytes, contentType))
+    throw new Error("Upload bytes do not match the content type (PNG or UTF-8 SVG without DTD/entities required)");
+  return { args: ["upload", ...sessions], upload: { name: fields.name, contentType, data: bytes.toString("base64") } };
+}
+function currentPageOrigin(output) {
+  const current = output.split(`
+`).filter((line) => /^- \d+: \(current\) /.test(line));
+  const url = current.length === 1 ? current[0].match(/\]\((.*)\)(?: \[crashed\])?$/)?.[1] : undefined;
+  if (!url)
+    throw new Error("Could not determine the upload page origin");
+  const parsed = new URL(url);
+  if (!["http:", "https:"].includes(parsed.protocol))
+    throw new Error("Uploads require an HTTP(S) page");
+  return parsed.origin;
+}
+async function receiveUpload(options) {
+  const record = { name: null, size: null, sha256: null, origin: null, result: "rejected" };
+  let dir;
+  try {
+    const p = options.payload;
+    if (validName(p?.name))
+      record.name = p.name;
+    if (options.policy === undefined)
+      throw new Error("Uploads are disabled on this listener");
+    validateUploadPolicy(options.policy);
+    if (options.args.length !== 1 || options.args[0] !== "upload")
+      throw new Error("Upload takes stdin bytes, not host paths or CLI options");
+    if (!p || !validName(p.name) || typeof p.contentType !== "string" || typeof p.data !== "string" || Object.keys(p).some((k) => !["name", "contentType", "data"].includes(k)))
+      throw new Error("Invalid upload payload");
+    const limit = options.policy.maxBytes ?? MAX_UPLOAD_BYTES;
+    if (p.data.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data))
+      throw new Error("Upload exceeds maxBytes or has invalid base64");
+    const bytes = Buffer.from(p.data, "base64");
+    record.size = bytes.length;
+    record.sha256 = createHash("sha256").update(bytes).digest("hex");
+    if (!bytes.length || bytes.length > limit || bytes.toString("base64") !== p.data)
+      throw new Error("Upload is empty, exceeds maxBytes, or is not canonical base64");
+    if (!(options.policy.contentTypes ?? UPLOAD_TYPES).includes(p.contentType) || !matchesType(bytes, p.contentType))
+      throw new Error("Upload content type is not allowed or does not match the bytes");
+    const tabs = await options.run(["tab-list"]);
+    if (tabs.status !== 0)
+      throw new Error("Could not inspect the upload page");
+    record.origin = currentPageOrigin(tabs.stdout);
+    dir = await mkdtemp(join(tmpdir(), "rech-upload-"));
+    const path = join(dir, randomBytes(16).toString("hex") + (p.contentType === "image/png" ? ".png" : ".svg"));
+    await writeFile(path, bytes, { mode: 384, flag: "wx" });
+    record.result = "failed";
+    const result = await options.run(["upload", path]);
+    record.result = result.status === 0 && !/^### Error\b/m.test(result.stdout) ? "completed" : "failed";
+    return {
+      ...result,
+      status: record.result === "completed" ? 0 : 1,
+      stdout: result.stdout.replaceAll(path, p.name),
+      stderr: result.stderr.replaceAll(path, p.name)
+    };
+  } catch (error) {
+    return { status: 1, stdout: "", stderr: (error instanceof Error ? error.message : "Upload failed") + `
+` };
+  } finally {
+    try {
+      if (dir)
+        await rm(dir, { recursive: true, force: true });
+    } finally {
+      options.audit(record);
+    }
+  }
+}
+async function readRequestJson(req) {
+  const reader = req.body?.getReader();
+  if (!reader)
+    throw new Error("Empty request");
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > MAX_REQUEST_BYTES)
+        throw new Error("Request exceeds 3 MiB");
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+export {
+  MAX_REQUEST_BYTES,
+  MAX_UPLOAD_BYTES,
+  UPLOAD_TYPES,
+  currentPageOrigin,
+  prepareStdinUpload,
+  readRequestJson,
+  receiveUpload,
+  validateUploadPolicy
+};

package/scoped-upload.ts

@@ -0,0 +1,140 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+export const MAX_UPLOAD_BYTES = 2 * 1024 * 1024;
+// Base64 plus metadata. Bound JSON input before parsing, not just decoded bytes.
+export const MAX_REQUEST_BYTES = 3 * 1024 * 1024;
+export const UPLOAD_TYPES = ['image/png', 'image/svg+xml'] as const;
+export type UploadPolicy = { maxBytes?: number; contentTypes?: string[] };
+export type UploadPayload = { name: string; contentType: string; data: string };
+export type UploadResult = { status: number; stdout: string; stderr: string };
+export type UploadAudit = { name: string | null; size: number | null; sha256: string | null; origin: string | null; result: string };
+
+export function validateUploadPolicy(value: unknown): asserts value is UploadPolicy {
+  const p = value as UploadPolicy;
+  if (!p || typeof p !== 'object' || Array.isArray(p) || Object.keys(p).some(k => !['maxBytes', 'contentTypes'].includes(k))
+    || (p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES))
+    || (p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some(t => !UPLOAD_TYPES.includes(t as any)))))
+    throw new Error('uploads must be an object with optional maxBytes (1..2097152) and contentTypes (image/png, image/svg+xml)');
+}
+
+function validName(name: unknown): name is string {
+  return typeof name === 'string' && name.length > 0 && name.length <= 128
+    && name !== '.' && name !== '..' && !name.startsWith('-') && !/[\\/:\x00-\x1f\x7f]/.test(name);
+}
+
+function matchesType(bytes: Buffer, type: string): boolean {
+  if (type === 'image/png') return bytes.length >= 33 && bytes.subarray(0, 8).equals(Buffer.from([137,80,78,71,13,10,26,10]))
+    && bytes.readUInt32BE(8) === 13 && bytes.toString('ascii', 12, 16) === 'IHDR';
+  if (type === 'image/svg+xml') {
+    let text: string;
+    try { text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); } catch { return false; }
+    // Sniff only; never parse/render SVG or resolve XML entities on the host.
+    if (/<!DOCTYPE|<!ENTITY/i.test(text)) return false;
+    text = text.trim().replace(/^<\?xml\s[^?]*\?>\s*/, '').replace(/^(?:<!--[\s\S]*?-->\s*)+/, '');
+    return /^<svg(?:\s|\/?>)/.test(text) && /(?:<\/svg\s*>|\/>)\s*$/.test(text);
+  }
+  return false;
+}
+
+export async function prepareStdinUpload(args: string[], input: AsyncIterable<Uint8Array>): Promise<{ args: string[]; upload: UploadPayload }> {
+  const sessions = args.filter(a => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a));
+  const options = args.filter(a => !sessions.includes(a));
+  if (options.shift() !== 'upload') throw new Error('Expected upload command');
+  const fields: Record<string, string> = {};
+  while (options.length) {
+    const option = options.shift()!;
+    const match = option.match(/^--(name|content-type)(?:=(.*))?$/);
+    if (!match || fields[match[1]] !== undefined) throw new Error('Usage: rech upload --name icon.png [--content-type image/png] < icon.png (stdin only; no path argument)');
+    const value = match[2] ?? options.shift();
+    if (!value || value.startsWith('--')) throw new Error(`Missing value for --${match[1]}`);
+    fields[match[1]] = value;
+  }
+  if (!validName(fields.name)) throw new Error('upload requires --name with a plain filename (no path)');
+  const contentType = fields['content-type'] ?? (fields.name.toLowerCase().endsWith('.png') ? 'image/png' : fields.name.toLowerCase().endsWith('.svg') ? 'image/svg+xml' : '');
+  if (!UPLOAD_TYPES.includes(contentType as any)) throw new Error('Upload content type must be image/png or image/svg+xml');
+  const chunks: Buffer[] = [];
+  let size = 0;
+  for await (const chunk of input) {
+    size += chunk.byteLength;
+    if (size > MAX_UPLOAD_BYTES) throw new Error('Upload exceeds 2 MiB');
+    chunks.push(Buffer.from(chunk));
+  }
+  const bytes = Buffer.concat(chunks);
+  if (!matchesType(bytes, contentType)) throw new Error('Upload bytes do not match the content type (PNG or UTF-8 SVG without DTD/entities required)');
+  return { args: ['upload', ...sessions], upload: { name: fields.name, contentType, data: bytes.toString('base64') } };
+}
+
+export function currentPageOrigin(output: string): string {
+  const current = output.split('\n').filter(line => /^- \d+: \(current\) /.test(line));
+  const url = current.length === 1 ? current[0].match(/\]\((.*)\)(?: \[crashed\])?$/)?.[1] : undefined;
+  if (!url) throw new Error('Could not determine the upload page origin');
+  const parsed = new URL(url);
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('Uploads require an HTTP(S) page');
+  return parsed.origin;
+}
+
+/** No payload field is ever used as a host path. run() is a server-owned CLI runner,
+ * not caller-supplied code. Audit records the selected origin immediately before upload.
+ */
+export async function receiveUpload(options: {
+  policy: UploadPolicy | undefined; payload: unknown; args: string[];
+  run: (args: string[]) => Promise<UploadResult>; audit: (event: UploadAudit) => void;
+}): Promise<UploadResult> {
+  const record: UploadAudit = { name: null, size: null, sha256: null, origin: null, result: 'rejected' };
+  let dir: string | undefined;
+  try {
+    const p = options.payload as UploadPayload;
+    if (validName(p?.name)) record.name = p.name;
+    if (options.policy === undefined) throw new Error('Uploads are disabled on this listener');
+    validateUploadPolicy(options.policy);
+    if (options.args.length !== 1 || options.args[0] !== 'upload') throw new Error('Upload takes stdin bytes, not host paths or CLI options');
+    if (!p || !validName(p.name) || typeof p.contentType !== 'string' || typeof p.data !== 'string'
+      || Object.keys(p).some(k => !['name', 'contentType', 'data'].includes(k))) throw new Error('Invalid upload payload');
+    const limit = options.policy.maxBytes ?? MAX_UPLOAD_BYTES;
+    if (p.data.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data))
+      throw new Error('Upload exceeds maxBytes or has invalid base64');
+    const bytes = Buffer.from(p.data, 'base64');
+    record.size = bytes.length;
+    record.sha256 = createHash('sha256').update(bytes).digest('hex');
+    if (!bytes.length || bytes.length > limit || bytes.toString('base64') !== p.data) throw new Error('Upload is empty, exceeds maxBytes, or is not canonical base64');
+    if (!(options.policy.contentTypes ?? UPLOAD_TYPES).includes(p.contentType) || !matchesType(bytes, p.contentType))
+      throw new Error('Upload content type is not allowed or does not match the bytes');
+    const tabs = await options.run(['tab-list']);
+    if (tabs.status !== 0) throw new Error('Could not inspect the upload page');
+    record.origin = currentPageOrigin(tabs.stdout);
+    dir = await mkdtemp(join(tmpdir(), 'rech-upload-')); // 0700; never served by /files
+    const path = join(dir, randomBytes(16).toString('hex') + (p.contentType === 'image/png' ? '.png' : '.svg'));
+    await writeFile(path, bytes, { mode: 0o600, flag: 'wx' });
+    record.result = 'failed';
+    const result = await options.run(['upload', path]);
+    record.result = result.status === 0 && !/^### Error\b/m.test(result.stdout) ? 'completed' : 'failed';
+    return { ...result, status: record.result === 'completed' ? 0 : 1,
+      stdout: result.stdout.replaceAll(path, p.name), stderr: result.stderr.replaceAll(path, p.name) };
+  } catch (error) {
+    return { status: 1, stdout: '', stderr: (error instanceof Error ? error.message : 'Upload failed') + '\n' };
+  } finally {
+    try { if (dir) await rm(dir, { recursive: true, force: true }); }
+    finally { options.audit(record); }
+  }
+}
+
+export async function readRequestJson(req: Request): Promise<any> {
+  const reader = req.body?.getReader();
+  if (!reader) throw new Error('Empty request');
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_REQUEST_BYTES) throw new Error('Request exceeds 3 MiB');
+      chunks.push(value);
+    }
+  } catch (error) { await reader.cancel().catch(() => {}); throw error; }
+  finally { reader.releaseLock(); }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}