rechrome 1.37.1 → 1.38.0

package/serve.ts

@@ -5,8 +5,8 @@ import { bearerOf, safeEqual } from "./secret.ts";
 import { WebrtcHost } from "./webrtc.ts";
 import { file } from "bun";
 import { createHash, randomBytes, X509Certificate } from "crypto";
-import { mkdirSync, lstatSync, chmodSync, unlinkSync, accessSync, readdirSync, realpathSync, constants as fsConstants } from "fs";
-import { join, resolve, relative, isAbsolute } from "path";
+import { mkdirSync, lstatSync, statSync, chmodSync, unlinkSync, accessSync, readdirSync, realpathSync, existsSync, readFileSync, constants as fsConstants } from "fs";
+import { join, resolve, relative, isAbsolute, sep } from "path";
 import { tmpdir } from "os";
 import {
   log,
@@ -24,6 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.ts";
+import { SecretMasker, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -87,6 +88,18 @@ const sessionTimeouts = new Map<string, number>(); // per-session consecutive-ti
 // Most-recently-used non-iso sessions, so the deep health probe can target something real
 // instead of spawning a fresh session (which could open a browser window).
 const recentSessions = new Map<string, number>();
+// Values typed by `fill-secret`, masked in every output, log line and served text file for a
+// while afterwards: snapshots echo input values (passwords included). See fill-secret.ts.
+const secretMasker = new SecretMasker();
+const TEXT_OUTPUT = /\.(?:ya?ml|json|md|txt|log)$/i;
+// /run commands in flight, with the (real) output dir each writes to once known. A snapshot file
+// exists on disk before its command has checked it for password values, so a text download waits
+// until no command writing to its directory is in flight.
+const runsInFlight = new Map<Promise<void>, string | undefined>();
+// Only the CLI's own artifacts are ever scrubbed or deleted, never a file a page merely names.
+const CLI_TEXT_ARTIFACT = /(^|\/)\.playwright-cli(-multi-tab)?\/[^/]+\.(?:ya?ml|json|md|txt|log)$/;
+// Artifacts that could not be checked AND could not be deleted: never served.
+const deniedFiles = new Set<string>();
 function noteSession(sess: string, now: number): void {
   recentSessions.set(sess, now);
   if (recentSessions.size > 64) {
@@ -738,6 +751,15 @@ export async function serve() {
         if (!(await f.exists())) return new Response("Not found", { status: 404 });
         const real = realpathSync(resolved);
         if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
+        if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+        if (TEXT_OUTPUT.test(real)) {
+          const busy = () => [...runsInFlight].filter(([, dir]) => !dir || real.startsWith(dir + sep)).map(([p]) => p);
+          for (let pending = busy(); pending.length; pending = busy()) await Promise.all(pending); // re-check: new runs may start
+          // Synchronous from the last check on: no await, so no new run can start and write here.
+          if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+          if (!existsSync(real)) return new Response("Not found", { status: 404 }); // withheld
+          return new Response(maskPasswordLines(secretMasker.mask(readFileSync(real, "utf8"))));
+        }
         return new Response(f);
       }
 
@@ -782,6 +804,10 @@ export async function serve() {
       const denied = authCheck(req, key);
       if (denied) return denied;
       markActivity(); // a real command: this serve is not idle
+      let runDone = () => {};
+      const running = new Promise<void>((r) => { runDone = r; });
+      runsInFlight.set(running, undefined); // dir not known yet: holds every text download
+      try { return await (async () => {
 
       let body: any;
       try { body = await readRequestJson(req); }
@@ -827,6 +853,7 @@ export async function serve() {
       const outputPrefix = scopedProfile ? profileOutputPrefix(scopedProfile) + (cred?.kind === "device" ? `d-${cred.device.id}/` : "") : "";
       const runWorkDir = scopedProfile ? join(workDir, outputPrefix) : workDir;
       mkdirSync(runWorkDir, { recursive: true });
+      runsInFlight.set(running, realpathSync(runWorkDir));
       let args: string[];
       let sessionId: string;
       let clientName = "";
@@ -894,6 +921,27 @@ export async function serve() {
 
       log(`run: rech ${filteredArgs.join(" ")} (session=${namespacedSession})`);
 
+      // fill-secret: the value arrives in body.secret, never in args; it is handed to the live
+      // session over its socket (no child argv) and never logged. See fill-secret.ts.
+      if (filteredArgs[0] === "fill-secret") {
+        const secret = !Array.isArray(body) && typeof body.secret === "string" ? body.secret : "";
+        try {
+          const { ref, allowDomains, submit, totp } = parseFillSecretWire(filteredArgs);
+          if (!secret) throw new Error("fill-secret: the request carried no secret (this client is older than the daemon?)");
+          secretMasker.add(secret, totp ? undefined : Infinity);
+          const reply = await fillSecretOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, ref, value: secret, allowDomains, submit });
+          // Drop the echoed run-code body (it embeds the value, masked or not, and is noise).
+          const text = secretMasker.mask(reply.text).replace(/### Ran Playwright code\n```js\n[\s\S]*?\n```\n?/, "").trim();
+          const status = reply.isError ? 1 : 0;
+          log(`exit: ${status} | fill-secret ${ref}`);
+          return Response.json(reply.isError ? { status, stdout: "", stderr: `${text}\n`, files: [] } : { status, stdout: `${text}\n`, stderr: "", files: [] });
+        } catch (error) {
+          const message = secretMasker.mask(secret ? (error instanceof Error ? error.message : String(error)).replaceAll(secret, "***") : (error instanceof Error ? error.message : String(error)));
+          log(`exit: 1 | fill-secret: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // For open commands, default to about:blank to avoid leaving connect.html visible
       const isOpenCmd = filteredArgs[0] === "open";
       const isOpenNoUrl = isOpenCmd && filteredArgs.length === 1;
@@ -1041,7 +1089,7 @@ export async function serve() {
           reject(new Error("timeout"));
         }, TIMEOUT);
       });
-      const [status, stdout, rawStderr] = await Promise.race([
+      let [status, stdout, rawStderr] = await Promise.race([
         Promise.all([
           proc.exited,
           new Response(proc.stdout).text(),
@@ -1058,7 +1106,7 @@ export async function serve() {
         ? configuredHandshakeTimeout
         : 30_000;
       const tccNote = explainExtensionNotFound(`${stdout}\n${rawStderr}`, chromeAccessProblem);
-      const stderr = (tccNote ?? "") + inferSilentExtensionFailure({
+      let stderr = (tccNote ?? "") + inferSilentExtensionFailure({
         status,
         stdout,
         stderr: rawStderr,
@@ -1068,6 +1116,24 @@ export async function serve() {
         handshakeTimeoutMs,
       });
 
+      // Snapshots print every input's value, password fields included (e.g. ones Chrome
+      // autofilled). Read the live password values and mask them before anything is logged,
+      // returned or left on disk; the label-based pass catches what the scan misses.
+      // Fails closed: a snapshot that can't be fully checked is withheld, not passed through.
+      const rawOutput = `${stdout}\n${stderr}`; // artifact paths come from the unmasked text
+      const snapshotOut = hasSnapshot(rawOutput);
+      let withheld = "";
+      if (snapshotOut) {
+        try {
+          for (const v of await passwordValuesOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir })) secretMasker.add(v, Infinity);
+        } catch (error) {
+          withheld = "could not check it for password values";
+          log(`snapshot withheld: ${secretMasker.mask(error instanceof Error ? error.message : String(error)).split("\n")[0]}`);
+        }
+      }
+      stdout = maskPasswordLines(secretMasker.mask(stdout));
+      stderr = maskPasswordLines(secretMasker.mask(stderr));
+      if (withheld) { stdout = withholdSnapshots(stdout, withheld); stderr = withholdSnapshots(stderr, withheld); }
       log(`exit: ${status}${stdout.trim() ? ` | ${stdout.trim().slice(0, 200)}` : ""}`);
 
       // Relay self-heal (see notes at SESSION_CLOSE_TIMEOUTS). A command that RETURNS usually
@@ -1105,12 +1171,8 @@ export async function serve() {
       }
 
       // Detect files mentioned in output
-      const filePattern = /[\w./-]+\.(?:png|jpe?g|pdf|json|yml)\b/gi;
-      const mentionedFiles = [
-        ...new Set(
-          [...stdout.matchAll(filePattern), ...stderr.matchAll(filePattern)].map((m) => m[0]),
-        ),
-      ];
+      const filePattern = /[\w./-]+\.(?:png|jpe?g|pdf|json|ya?ml)\b/gi;
+      const mentionedFiles = [...new Set([...rawOutput.matchAll(filePattern)].map((m) => m[0]))];
       const outputFiles: string[] = [];
       for (const f of mentionedFiles) {
         if (!isUnderDir(runWorkDir, f)) continue;
@@ -1130,6 +1192,35 @@ export async function serve() {
         }
       }
 
+      // A file the command was told to write (`snapshot --filename=x.yml`) is its own artifact too.
+      const ownFilenames = filteredArgs.flatMap((a, i) => a.startsWith("--filename=") ? [a.slice(11)] : a === "--filename" && filteredArgs[i + 1] ? [filteredArgs[i + 1]!] : []);
+      // Snapshot files echo input values: scrub them on disk too, not only on download. Only
+      // files this command wrote (a page can merely mention an existing file's name). One that
+      // can't be checked or scrubbed is deleted, or, failing that, never served.
+      // The command's own --filename targets count even when the output doesn't name them.
+      const ownTargets = ownFilenames.filter(n => isUnderDir(runWorkDir, n) && existsSync(join(runWorkDir, n)));
+      if (snapshotOut || secretMasker.active) for (const f of [...new Set([...outputFiles, ...ownTargets])]) {
+        const ownFile = ownFilenames.some(n => resolve(runWorkDir, n) === resolve(runWorkDir, f));
+        if (!ownFile && !CLI_TEXT_ARTIFACT.test(f.replaceAll("\\", "/"))) continue;
+        const path = join(runWorkDir, f);
+        let mtimeMs = 0;
+        try { mtimeMs = statSync(path).mtimeMs; } catch { continue; }
+        if (mtimeMs < commandStartedAt - 1000) continue;
+        try {
+          // Unchecked: withhold every snapshot file, and anything the command was told to write.
+          if (withheld && (ownFile || /\.ya?ml$/i.test(f))) throw new Error("withheld");
+          // Text vs binary by content, not name: `snapshot --filename=x.png` writes text.
+          const bytes = new Uint8Array(await file(path).arrayBuffer());
+          if (bytes.subarray(0, 8192).includes(0)) continue; // binary (e.g. a screenshot)
+          const text = new TextDecoder().decode(bytes);
+          const masked = maskPasswordLines(secretMasker.mask(text));
+          if (masked !== text) await Bun.write(path, masked);
+        } catch {
+          try { unlinkSync(path); } catch { try { deniedFiles.add(realpathSync(path)); } catch {} }
+          if (outputFiles.includes(f)) outputFiles.splice(outputFiles.indexOf(f), 1);
+        }
+      }
+
       const rebrand = (s: string) => s.replaceAll("npx playwright-cli", "rech");
       return Response.json({
         status,
@@ -1139,6 +1230,7 @@ export async function serve() {
         // a cross-OS daemon↔client (e.g. Windows daemon serving a Linux container client).
         files: outputFiles.map((p) => (outputPrefix + p).replaceAll("\\", "/")),
       });
+      })(); } finally { runsInFlight.delete(running); runDone(); }
   };
 
   // WebRTC: the same handler, reached over an encrypted DataChannel. Each request carries the

package/skills/rechrome-setup/SKILL.md

@@ -5,6 +5,8 @@ description: Set up or repair rechrome access to a selected Chrome profile, espe
 
 # Rechrome setup on macOS
 
+For authorized native Windows UI work over winrpc, use [Windows desktop UI](../windows-desktop-ui/SKILL.md). It documents the delegated winrpc route and profile verification; do not apply the macOS picker shortcuts there.
+
 Use this workflow when the user requests rechrome setup for an existing Chrome profile. Complete the CLI and browser steps together; opening the guide alone is not completion.
 
 ## Choose the browser and profile

package/skills/windows-desktop-ui/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: windows-desktop-ui
+description: Operate a remote Windows desktop through a delegated winrpc client, especially to install the rechrome Bridge in an explicitly selected Chrome profile. Use for authorized native Windows UI work, not ordinary browser commands once rech works.
+---
+
+# Windows desktop UI via winrpc
+
+## Route and scope
+
+Use the authorized winrpc executor lane on the controller host. The controlling lane sends small, exact AHK v2 scripts; the executor runs each request and returns its result and a private screenshot path. `WINRPC_URL` and `WINRPC_TOKEN` stay on the controller host. Do not copy them to other machines, print them, include them in messages, or invoke CLI help with credential-bearing arguments (a client previously echoed a token in help output). Have the executor read the existing private environment in-process and issue HTTP requests without logging authorization headers.
+
+Obtain authorization for the target profile, extension and task. Existing task authorization covers its routine steps; do not repeatedly ask the user to click things or reapprove them. Ask for permission or missing information when scope must change. Never assume authorization to restart Chrome, enable debugging flags, alter policy, access logins, create credentials, or change other profiles. Do not read unrelated tab contents.
+
+## Preflight and locking
+
+- Windows SSH gives a non-interactive session, often session 0. It is suitable for diagnostics and CLI calls, not launching GUI automation directly. winrpc must already run on the interactive desktop; use `POST /ahk-eval?gui=1` through the executor.
+- Read the installed winrpc README and implementation when its behavior is uncertain. The observed installation was `C:\tmp\winrpc`; the source is [symval/winrpc](https://github.com/symval/winrpc).
+- Check `GET /health` and `GET /lock`. Normal `/ahk-eval` requests acquire the cross-process `C:\tmp\im-ui.lock` automatically. The AHK lock was observed to be held per request; keep scripts short. The README's 60-second timeout applies to `/shell`, not a documented AHK lock TTL. Never force-unlock or use `readonly=1` to bypass locking for UI actions.
+- The observed API has no acquire/hold endpoint across requests. Use per-action locks, passive screenshots between actions, and coordinator-confirmed exclusive desktop access. If someone requires a continuous lock, explain this limitation before proceeding. Do not silently claim the lock is held between calls. Passive screenshots do not acquire it.
+- Take a screenshot **before** any action. After each small action, capture another screenshot and inspect it before sending the next action. Send scripts as exact UTF-8 files: semicolons in AHK start comments, so do not flatten scripts into semicolon-separated chat prose.
+- The observed `/screenshot` captured only 1280x720 of a 1920x1080 desktop at 150% scaling. If edges are missing, use a DPI-aware passive capture through `/shell`; do not change display settings. Confirm bounds and scaling before using coordinates. In AHK v2, call `DllCall("SetThreadDpiAwarenessContext", "ptr", -4, "ptr")` and use `CoordMode("Mouse", "Screen")` for coordinates measured from a physical-pixel capture.
+
+## Prove the Chrome profile
+
+Do not infer the profile from the foreground window or its display-name chip. Navigate the intended window to `chrome://version` and inspect **Profile Path**. For example, `User Data\Profile 1`; tasks must use their explicitly requested folder. Record that window's HWND and Chrome PID for this run. Never reuse old handles or PIDs from this runbook.
+
+To navigate reliably, activate the verified HWND, wait about 500 ms, press Ctrl+L, wait about 300 ms, then paste the exact URL from the clipboard. Preserve the previous clipboard with `ClipboardAll()`, wait for the paste to complete, and restore it without printing its contents. Capture and inspect the address bar **before Enter**. Press Enter only when it contains the intended URL exactly and the same verified window remains active.
+
+Direct `SendText` immediately after Ctrl+L can lose initial characters from `chrome://extensions/` and submit a search. Clipboard paste with focus delays works reliably. Never click resulting search results as a workaround.
+
+## Load only the requested extension
+
+1. In the verified profile, navigate to `chrome://extensions/` using the paste/check/Enter sequence. Inspect the extension list and Developer mode state. Leave Developer mode unchanged if already enabled; otherwise enable it only as part of the authorized unpacked-install task.
+2. Confirm the extension is not already installed; do not blindly add or reload it. For rechrome, verify the installed manifest and expected ID. The Bridge ID is `mmlmfjhmonkocbjadbfplnigmagldckm`.
+3. Click **Load unpacked** once and capture the native folder picker. The usual directory is `C:\Users\<user>\.rechrome\extension`, not `.rechrome\ext`; verify the actual manifest path before selecting it.
+4. Identify the picker before entering text. A Windows Chrome file picker can be a **different Chrome PID** from the main browser. The observed picker was class `#32770`, had its own HWND/PID, and its owner was the verified Profile HWND. Guard on the freshly observed dialog HWND, exact localized title, class, `chrome.exe`, and **owner HWND**, rather than requiring equality with the main browser PID. `DllCall("GetWindow", "ptr", dialogHwnd, "uint", 4, "ptr")` obtains `GW_OWNER`. For a title mismatch, a read-only title-codepoint probe can distinguish encoding artifacts from a different dialog. If the owner chain is unfamiliar, inspect it rather than weakening the guard.
+5. Paste the exact directory into the **Folder** field, restoring the clipboard afterward. Do not submit yet. Capture and verify the entire path; Japanese fonts may render backslashes as yen signs.
+6. Click **Select Folder** once. Capture the result: correct extension name/ID, enabled state, and no load error. A successful AHK exit alone proves none of these.
+
+## Finish setup and verify
+
+Keep setup output private: it can contain bearer URLs and extension tokens. Never capture the setup guide. Report sanitized milestones instead.
+
+Run `rech setup --profile "Profile 1" --listen local` for a local-only task; preserve the requested listener scope for other tasks. If setup must open GUI pages, run it in the user's interactive session through a **user-level Interactive scheduled task**, not session 0. Use the actual Windows identity SID for the principal; `USERDOMAIN` may be `WORKGROUP` and not a valid account domain. Keep the process alive through token detection, Bridge verification, and registration. Back up configuration before changing its save destination; do not overwrite unrelated defaults or create remote sharing without authorization.
+
+Rechrome 1.35.1 passed unsupported `--wait none` to its bundled CLI's setup probe. The corrected probe is `open about:blank` in an isolated session, followed by cleanup of that session. If an old build reports `Unknown option: --wait`, use the reviewed corrected package/source; reloading the extension does not fix this parser error. Never patch `node_modules` in place.
+
+After setup verifies the Bridge and saves registration, run **one harmless open** using the installed client and selected profile, for example:
+
+```powershell
+rech --profile "Profile 1" -s=install-check open https://example.com
+```
+
+Use a fresh verification session name when appropriate. Confirm exit 0 and the expected page title. Report the host, exact profile selector, installed version, and whether sharing/defaults changed. A loopback listener on the Windows host is usable by a CLI over SSH on that host; it is not automatically accessible to a remote client. Do not publish a credential-bearing link in the report. Retain only necessary installation/verification evidence and remove other temporary screenshots.
+
+## Stop and recovery rules
+
+Stop before acting on another profile, a login/security prompt, an unfamiliar dialog, or unexpected user activity. Preserve the screen, release only locks owned by the request, and report what happened. Do not dismiss prompts, restart Chrome, retry blindly, or change policy. A failed identity guard permits read-only diagnostics within the authorized task; correct the guard only after evidence establishes the dialog's relationship to the verified browser. Respect any stricter retry limit in the current request. If further scope or permission is needed, ask for it; do not default to asking the user to perform routine UI steps manually.
+
+## Routes that did not solve persistent unpacked installation
+
+- **CDP `Extensions.loadUnpacked`:** requires the appropriate remote-debugging/unsafe-extension flags. Current Chromium [marks the install as CDP-created](https://github.com/chromium/chromium/blob/main/chrome/browser/devtools/protocol/extensions_handler.cc), then [removes CDP-created extension preferences at startup](https://github.com/chromium/chromium/blob/main/extensions/browser/extension_prefs.cc) (`CleanUpCdpInstalledExtensions`). This is not the persistent install path for the user's existing browser. Do not restart it to test persistence.
+- **`--load-extension`:** branded Chrome removed this switch beginning in Chrome 137; Chromium/Chrome for Testing behavior is different. See the [Chrome team's announcement](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/1-g8EFx2BBY). Do not replace the user's browser/profile with a managed test browser to evade this constraint.
+- **Registry/enterprise policy:** not a single-profile arbitrary unpacked-folder installation mechanism. [External installation](https://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions) uses update URLs; enterprise distribution requires a separate deployment design. Do not add machine-wide policy, host a CRX, or forge Secure Preferences for this task.