rechrome 1.37.1 → 1.38.0

package/rechrome.js

@@ -5,6 +5,7 @@ import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePr
 import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
+import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
@@ -1869,6 +1870,7 @@ async function callServe(
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
   upload?: UploadPayload,
+  secret?: string,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1887,7 +1889,8 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
+    // `secret` (fill-secret only) rides in its own field so it is never part of the logged args.
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}), ...(secret ? { secret } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -1933,6 +1936,23 @@ async function callServe(
   }
 }
 
+/** Probe only the temporary setup session; always release it, including on transport errors. */
+export async function probeSetupBridge(
+  url: string,
+  session: string,
+  env: Record<string, string>,
+  identity: { key: string; label: string; profile?: string },
+  run: typeof callServe = callServe,
+): Promise<Awaited<ReturnType<typeof callServe>>> {
+  try {
+    // The bundled CLI has no --wait option. about:blank needs no page-load override.
+    return await run(url, [`-s=${session}`, "open", "about:blank"], env, identity, true);
+  } finally {
+    // Never claim or close an existing worktree session, or mask the probe error with cleanup errors.
+    await run(url, [`-s=${session}`, "close"], env, identity, true).catch(() => {});
+  }
+}
+
 const BOOLEAN_OPEN_FLAGS = new Set(["--headed", "--persistent", "--in-memory", "--extension"]);
 
 export function normalizeCommandArgs(args: string[]): string[] {
@@ -2082,12 +2102,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
+  let secret: string | undefined;
   let upload: UploadPayload | undefined;
-  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+  const cmdIdx = args.findIndex(a => !a.startsWith("-s="));
+  if (args[cmdIdx] === "fill-secret") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(FILL_SECRET_USAGE); process.exit(0); }
+    try {
+      ({ args, secret } = await prepareFillSecret(args));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${FILL_SECRET_USAGE}`);
+      process.exit(2);
+    }
+  } else if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
     if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
     ({ args, upload } = await prepareStdinUpload(args, process.stdin));
   }
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
+  const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
+  // The daemon already masks the value; this is a second line of defence for an older daemon.
+  const scrub = (s: string) => secret && s ? s.replaceAll(secret, SECRET_MASK) : s;
+  const { files, existingSession } = served;
+  const status = served.status, stdout = scrub(served.stdout), stderr = scrub(served.stderr);
   if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
     // Close the failed session so the retry gets a fresh cliDaemon and relay. callServe re-reads
     // the extension's live token from the profile, so a re-minted token heals here too.
@@ -2154,6 +2188,22 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   process.exit(status);
 }
 
+/** Swap the client-side fill-secret args for the wire form and read the value (or TOTP code). */
+async function prepareFillSecret(args: string[]): Promise<{ args: string[]; secret: string }> {
+  const sessionArgs = args.filter(a => a.startsWith("-s="));
+  const req = parseFillSecretArgs(args.filter(a => !a.startsWith("-s=")).slice(1));
+  const raw = await readSecretSource(req.source);
+  let secret = raw;
+  if (req.totp) {
+    const wait = totpWaitMs();
+    if (wait) { console.error(`[rech] TOTP code expires in under 5s; waiting ${Math.ceil(wait / 1000)}s for the next one`); await Bun.sleep(wait); }
+    secret = totpCode(raw); // only the code leaves this machine, never the seed
+  }
+  if (!req.allowDomains.length) console.error("[rech] fill-secret: no --allow-domain given; the value will be typed into whatever page is active");
+  const wire = fillSecretWireArgs(req);
+  return { args: [...wire, ...sessionArgs], secret };
+}
+
 /** The daemon's Playwright CLI predates `open --wait` (rechrome <= 1.35.1 bundled one). */
 export function cliRejectsWaitOption(output: string): boolean {
   return /Unknown options?:?[^\n]*?['"`]?--wait\b/i.test(output);
@@ -2866,45 +2916,90 @@ function findChromiumForTesting(): string | null {
 // Minimal Chrome DevTools Protocol client over a WebSocket — just enough to create a
 // target, attach to it, and evaluate JS. Used to seed the auth token into a managed
 // profile's extension localStorage without pulling in the full Playwright dependency.
-class CDPClient {
+export class CDPClient {
   private ws: WebSocket;
   private nextId = 0;
-  private pending = new Map<number, { resolve: (v: any) => void; reject: (e: any) => void }>();
+  private pending = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();
   private opened: Promise<void>;
-  constructor(url: string) {
+  constructor(url: string, private timeoutMs = 30_000) {
     this.ws = new WebSocket(url);
     this.opened = new Promise<void>((resolve, reject) => {
-      this.ws.addEventListener("open", () => resolve(), { once: true });
-      this.ws.addEventListener("error", () => reject(new Error("CDP WebSocket error")), { once: true });
+      const timer = setTimeout(() => { reject(new Error("CDP WebSocket connection timed out")); this.close(); }, timeoutMs);
+      this.ws.addEventListener("open", () => { clearTimeout(timer); resolve(); }, { once: true });
+      const fail = () => {
+        clearTimeout(timer);
+        const error = new Error("CDP WebSocket closed or failed");
+        reject(error);
+        for (const p of this.pending.values()) p.reject(error);
+        this.pending.clear();
+      };
+      this.ws.addEventListener("error", fail);
+      this.ws.addEventListener("close", fail);
     });
     this.ws.addEventListener("message", (ev: MessageEvent) => {
       let msg: any;
       try { msg = JSON.parse(typeof ev.data === "string" ? ev.data : ""); } catch { return; }
       const p = msg.id != null ? this.pending.get(msg.id) : undefined;
       if (!p) return;
-      this.pending.delete(msg.id);
       if (msg.error) p.reject(new Error(msg.error.message || JSON.stringify(msg.error)));
       else p.resolve(msg.result);
     });
   }
   async open(): Promise<void> { await this.opened; }
   send(method: string, params: Record<string, any> = {}, sessionId?: string): Promise<any> {
+    if (this.ws.readyState !== WebSocket.OPEN) return Promise.reject(new Error("CDP WebSocket is not open"));
     const id = ++this.nextId;
-    const payload: any = { id, method, params };
-    if (sessionId) payload.sessionId = sessionId;
     return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
-      this.ws.send(JSON.stringify(payload));
-      setTimeout(() => { if (this.pending.delete(id)) reject(new Error(`CDP ${method} timed out`)); }, 15_000);
+      const finish = (callback: (value: any) => void, value: any) => {
+        clearTimeout(timer);
+        this.pending.delete(id);
+        callback(value);
+      };
+      const timer = setTimeout(() => finish(reject, new Error(`CDP ${method} timed out`)), this.timeoutMs);
+      this.pending.set(id, { resolve: v => finish(resolve, v), reject: e => finish(reject, e) });
+      try { this.ws.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) })); }
+      catch (error) { finish(reject, error); }
     });
   }
-  close(): void { try { this.ws.close(); } catch {} }
+  close(): void {
+    for (const p of this.pending.values()) p.reject(new Error("CDP client closed"));
+    this.pending.clear();
+    try { this.ws.close(); } catch {}
+  }
+}
+
+async function waitForExit(exited: Promise<unknown>, timeoutMs: number): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout>;
+  try {
+    return await Promise.race([exited.then(() => true), new Promise<boolean>(resolve => { timer = setTimeout(() => resolve(false), timeoutMs); })]);
+  } finally { clearTimeout(timer!); }
+}
+
+export async function seedExtensionToken(cdp: Pick<CDPClient, "send">, token: string): Promise<void> {
+  const { targetId } = await cdp.send("Target.createTarget", { url: `chrome-extension://${EXTENSION_ID}/status.html` });
+  const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
+  // The extension page may still be loading; retry the write until localStorage reflects it.
+  let ok = false;
+  const expr = `(()=>{try{if(location.origin!==${JSON.stringify(`chrome-extension://${EXTENSION_ID}`)})return 'ERR:Extension page not loaded';localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
+  let lastError = "Extension page is not ready";
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    const r = await cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId);
+    lastError = r?.exceptionDetails?.text || String(r?.result?.value ?? "No evaluation result");
+    if (r?.result?.value === token) { ok = true; break; }
+    // A target opened before the extension finishes loading can remain on Chrome's
+    // error document forever. Evaluating it again cannot finish the navigation.
+    const navigation = await cdp.send("Page.navigate", { url: `chrome-extension://${EXTENSION_ID}/status.html` }, sessionId);
+    if (navigation.errorText) lastError = navigation.errorText;
+    await Bun.sleep(1_000);
+  }
+  if (!ok) throw new Error(`Could not seed auth token into chrome-extension://${EXTENSION_ID}/: ${lastError}`);
 }
 
 // Launch a throwaway Chrome against a dedicated user-data-dir with the unpacked extension
 // loaded, then seed `token` into the extension's localStorage (the value `connect.html` checks
 // for token-bypass). Headless by default; never touches the user's real Chrome/profiles.
-async function provisionExtensionToken(opts: {
+export async function provisionExtensionToken(opts: {
   userDataDir: string; profileDir: string; dist: string; token: string; headed?: boolean;
 }): Promise<void> {
   // Branded Google Chrome 149+ rejects --load-extension ("not allowed in Google Chrome"), so a
@@ -2927,75 +3022,82 @@ async function provisionExtensionToken(opts: {
     "--no-first-run",
     "--no-default-browser-check",
     "--disable-background-timer-throttling",
+    "--disable-background-networking",
+    "--disable-component-update",
+    "--disable-search-engine-choice-screen",
+    // Match Playwright's unattended macOS launch: no interactive keychain prompt.
+    "--password-store=basic",
+    "--use-mock-keychain",
   ];
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
-  // Headless can't answer a Keychain prompt, so first launch could stall on it (as Playwright does).
-  if (process.platform === "darwin") args.push("--use-mock-keychain");
   args.push("about:blank");
-  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
+  // Own a separate process group so escalation cannot touch the user's Chrome.
+  const proc = cpSpawn(chromeBin, args, { detached: process.platform !== "win32", stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
+  let stderr = "";
+  proc.stderr?.on("data", data => { stderr = (stderr + data.toString()).slice(-8_192); });
+  let launchError: Error | undefined;
+  const exited = new Promise<void>(resolve => {
+    proc.once("exit", () => resolve());
+    proc.once("error", error => { launchError = error; resolve(); });
+  });
+  const signal = (value: NodeJS.Signals) => {
+    if (!proc.pid) return;
+    try {
+      if (process.platform === "win32") proc.kill(value);
+      else process.kill(-proc.pid, value);
+    } catch {}
+  };
+  const interrupted = (value: NodeJS.Signals) => {
+    signal("SIGKILL");
+    console.error(`Profile provisioning interrupted (${value})`);
+    process.exit(value === "SIGINT" ? 130 : 143);
+  };
+  const onInt = () => interrupted("SIGINT");
+  const onTerm = () => interrupted("SIGTERM");
+  process.once("SIGINT", onInt);
+  process.once("SIGTERM", onTerm);
   let cdp: CDPClient | null = null;
-  // Every step is bounded: a stuck Chrome must end in an error, never a silent hang.
-  const within = <T>(ms: number, what: string, work: Promise<T>) => Promise.race([work,
-    Bun.sleep(ms).then(() => { throw new Error(`${what} took over ${ms / 1000}s`); })]);
+  let phase = "Chrome startup";
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
     let port: number | null = null;
-    for (let i = 0; i < 300; i++) {
+    for (let i = 0; i < 600; i++) {
       await Bun.sleep(100);
       const line = (await file(portFile).text().catch(() => "")).split("\n")[0]?.trim();
       if (line && /^\d+$/.test(line)) { port = parseInt(line); break; }
-      if (proc.exitCode !== null) throw new Error("Chrome exited before opening the DevTools port");
+      if (launchError) throw launchError;
+      if (proc.exitCode !== null || proc.signalCode !== null) throw new Error(`Chrome exited before opening the DevTools port (${proc.exitCode ?? proc.signalCode})`);
     }
-    if (!port) throw new Error("Chrome didn't open its DevTools port within 30s");
-    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(5000) })).json();
+    if (!port) throw new Error("Chrome DevTools port not found (extension may have failed to load)");
+    phase = "Chrome DevTools discovery";
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(30_000) })).json();
+    phase = "Chrome DevTools connection";
     cdp = new CDPClient(ver.webSocketDebuggerUrl as string);
-    await within(5000, "Connecting to Chrome DevTools", cdp.open());
-    // Wait for the extension's service worker: if it never shows, the extension didn't load.
-    const extensionUrl = `chrome-extension://${EXTENSION_ID}/`;
-    let loaded = false;
-    for (let i = 0; i < 50 && !loaded; i++) {
-      const { targetInfos } = await cdp.send("Target.getTargets");
-      loaded = (targetInfos as { url: string }[]).some(t => t.url.startsWith(extensionUrl));
-      if (!loaded) await Bun.sleep(200);
-    }
-    if (!loaded) throw new Error(`The extension at ${dist} didn't load in Chrome for Testing (no ${extensionUrl} target within 10s)`);
-    const { targetId } = await cdp.send("Target.createTarget", { url: `${extensionUrl}status.html` });
-    const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
-    // The extension page may still be loading; retry the write until localStorage reflects it.
-    let ok = false, last = "";
-    const expr = `(()=>{try{localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
-    const deadline = Date.now() + 10_000;
-    while (Date.now() < deadline) {
-      const r = await within(3000, "Runtime.evaluate", cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId)).catch(e => ({ error: String(e) }));
-      const value = (r as any)?.result?.value;
-      if (value === token) { ok = true; break; }
-      last = typeof value === "string" ? value : (r as any)?.error ?? (r as any)?.result?.description ?? "";
-      await Bun.sleep(200);
-    }
-    if (!ok) throw new Error(`Could not seed auth token into ${extensionUrl}${last ? ` (${last})` : ""}`);
+    await cdp.open();
+    phase = "Extension token seeding";
+    await seedExtensionToken(cdp, token);
     // Graceful close flushes localStorage to the profile's leveldb before we kill Chrome.
-    await within(5000, "Browser.close", cdp.send("Browser.close")).catch(() => {});
-    await within(5000, "Chrome exit", proc.exited).catch(() => {});
+    phase = "Chrome shutdown";
+    await cdp.send("Browser.close").catch(() => {});
+    if (!await waitForExit(exited, 30_000)) throw new Error("Chrome did not exit after flushing the auth token");
+    if (readExtensionTokenFromProfile(userDataDir, profileDir, EXTENSION_ID) !== token)
+      throw new Error("Chrome exited without persisting the extension auth token");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`${phase}: ${message}${stderr.trim() ? `\nChrome stderr:\n${stderr.trim()}` : ""}`.replaceAll(token, "[redacted]"));
   } finally {
     cdp?.close();
-    await stopThrowawayChrome(proc, userDataDir);
+    signal("SIGTERM");
+    if (!await waitForExit(exited, 2_000)) signal("SIGKILL");
+    // Also reap helpers that survived the browser parent exiting.
+    signal("SIGKILL");
+    await waitForExit(exited, 2_000);
+    process.removeListener("SIGINT", onInt);
+    process.removeListener("SIGTERM", onTerm);
   }
 }
 
-/**
- * Stop a Chrome we launched on a throwaway user-data-dir: SIGTERM, then SIGKILL, then any helper
- * still holding that exact --user-data-dir (scoped to it, so never the user's own Chrome).
- */
-async function stopThrowawayChrome(proc: ReturnType<typeof Bun.spawn>, userDataDir: string): Promise<void> {
-  if (proc.exitCode === null) {
-    try { proc.kill(); } catch {}
-    const exited = await Promise.race([proc.exited.then(() => true, () => true), Bun.sleep(3000).then(() => false)]);
-    if (!exited) { try { proc.kill("SIGKILL"); } catch {} await Promise.race([proc.exited.catch(() => {}), Bun.sleep(2000)]); }
-  }
-  if (process.platform !== "win32") Bun.spawnSync(["pkill", "-9", "-f", `--user-data-dir=${userDataDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}( |$)`], { stdout: "ignore", stderr: "ignore" });
-}
-
 async function provisionProfile(name: string, opts: { headed?: boolean } = {}): Promise<void> {
   // The name doubles as the on-disk profile directory and the registry/URL key, so keep it a
   // simple token and disallow the reserved real-Chrome names to avoid any cross-talk.
@@ -3012,7 +3114,7 @@ async function provisionProfile(name: string, opts: { headed?: boolean } = {}):
   console.log(`      extension:     ${dist}`);
   console.log(`      Launching ${opts.headed ? "headed" : "headless"} Chrome to seed the auth token...`);
   await provisionExtensionToken({ userDataDir, profileDir: name, dist, token, headed: opts.headed });
-  console.log(`      Token seeded (${token.slice(0, 6)}…)`);
+  console.log("      Token seeded");
 
   // [2/3] Daemon URL — reuse the running daemon's key; warn (don't fail) if it isn't up yet.
   console.log(`\n[2/3] Building RECHROME_URL`);
@@ -3585,10 +3687,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.takeRetry();
     guide?.update("bridge", "Extension and token detected. Testing the browser connection…");
     try {
-      const probe = await probeBridgeOpen(
-        args => callServe(rechUrl.toString(), [`-s=${probeSession}`, ...args], probeEnv, probeIdentity, true),
-        note => console.log(`      ${note}`),
-      );
+      const probe = await probeSetupBridge(rechUrl.toString(), probeSession, probeEnv, probeIdentity);
       bridgeVerified = probe.status === 0;
       if (bridgeVerified) {
         console.log("✓ [4/5] Extension bridge connected successfully");
@@ -3600,9 +3699,6 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     } catch (error) {
       bridgeError = error instanceof Error ? error.message : String(error);
       console.error(`      Extension bridge verification failed: ${bridgeError}`);
-    } finally {
-      // The isolated probe must never claim or close an existing worktree session.
-      await callServe(rechUrl.toString(), [`-s=${probeSession}`, "close"], probeEnv, probeIdentity, true).catch(() => {});
     }
 
     if (bridgeVerified) break;
@@ -4129,6 +4225,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
       open, goto, click, fill, screenshot, eval, tab-list…  (\`rech pw --help\` lists all)
       --profile <p>  as another registered profile (email, name or folder); put it first
       --isolate      in a throwaway session, e.g. for a login flow
+  rech fill-secret <ref> --from-env VAR | --totp-from-env VAR [--env-file f] [--allow-domain '*.example.com']
+                     type a password / TOTP code without it reaching argv, logs or output
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version