rechrome 1.37.2 → 1.38.0

package/rechrome.ts

@@ -5,6 +5,7 @@ import { readListeners, writeListeners, listenerAddress, isLoopback, normalizePr
 import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.ts";
+import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
@@ -1869,6 +1870,7 @@ async function callServe(
   precomputedIdentity?: { key: string; label: string; profile?: string },
   throwOnFailure = false,
   upload?: UploadPayload,
+  secret?: string,
 ): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
@@ -1887,7 +1889,8 @@ async function callServe(
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
     // dataDir is a client-local path; the daemon (possibly remote) only needs the session identity.
-    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}) }),
+    // `secret` (fill-secret only) rides in its own field so it is never part of the logged args.
+    body: JSON.stringify({ args, identity: { key: identity.key, label: identity.label, profile: identity.profile }, env, ...(upload ? { upload } : {}), ...(secret ? { secret } : {}) }),
     signal: AbortSignal.timeout(70_000),
   }).catch(async (e) => {
     if (throwOnFailure) throw new Error("Cannot reach the rechrome daemon. Check that it is running.");
@@ -2099,12 +2102,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
 
   const resolvedEnv = await getClientEnv({ extensionId, extensionToken, profileDirectory: effectiveProfile, userDataDir, loadExtension });
   const effectiveEnv = { ...resolvedEnv, ...overrideEnv };
+  let secret: string | undefined;
   let upload: UploadPayload | undefined;
-  if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
+  const cmdIdx = args.findIndex(a => !a.startsWith("-s="));
+  if (args[cmdIdx] === "fill-secret") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(FILL_SECRET_USAGE); process.exit(0); }
+    try {
+      ({ args, secret } = await prepareFillSecret(args));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${FILL_SECRET_USAGE}`);
+      process.exit(2);
+    }
+  } else if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
     if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
     ({ args, upload } = await prepareStdinUpload(args, process.stdin));
   }
-  const { status, stdout, stderr, files, existingSession } = await callServe(url, args, overrideEnv, identity, false, upload);
+  const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
+  // The daemon already masks the value; this is a second line of defence for an older daemon.
+  const scrub = (s: string) => secret && s ? s.replaceAll(secret, SECRET_MASK) : s;
+  const { files, existingSession } = served;
+  const status = served.status, stdout = scrub(served.stdout), stderr = scrub(served.stderr);
   if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
     // Close the failed session so the retry gets a fresh cliDaemon and relay. callServe re-reads
     // the extension's live token from the profile, so a re-minted token heals here too.
@@ -2171,6 +2188,22 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   process.exit(status);
 }
 
+/** Swap the client-side fill-secret args for the wire form and read the value (or TOTP code). */
+async function prepareFillSecret(args: string[]): Promise<{ args: string[]; secret: string }> {
+  const sessionArgs = args.filter(a => a.startsWith("-s="));
+  const req = parseFillSecretArgs(args.filter(a => !a.startsWith("-s=")).slice(1));
+  const raw = await readSecretSource(req.source);
+  let secret = raw;
+  if (req.totp) {
+    const wait = totpWaitMs();
+    if (wait) { console.error(`[rech] TOTP code expires in under 5s; waiting ${Math.ceil(wait / 1000)}s for the next one`); await Bun.sleep(wait); }
+    secret = totpCode(raw); // only the code leaves this machine, never the seed
+  }
+  if (!req.allowDomains.length) console.error("[rech] fill-secret: no --allow-domain given; the value will be typed into whatever page is active");
+  const wire = fillSecretWireArgs(req);
+  return { args: [...wire, ...sessionArgs], secret };
+}
+
 /** The daemon's Playwright CLI predates `open --wait` (rechrome <= 1.35.1 bundled one). */
 export function cliRejectsWaitOption(output: string): boolean {
   return /Unknown options?:?[^\n]*?['"`]?--wait\b/i.test(output);
@@ -2883,45 +2916,90 @@ function findChromiumForTesting(): string | null {
 // Minimal Chrome DevTools Protocol client over a WebSocket — just enough to create a
 // target, attach to it, and evaluate JS. Used to seed the auth token into a managed
 // profile's extension localStorage without pulling in the full Playwright dependency.
-class CDPClient {
+export class CDPClient {
   private ws: WebSocket;
   private nextId = 0;
-  private pending = new Map<number, { resolve: (v: any) => void; reject: (e: any) => void }>();
+  private pending = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();
   private opened: Promise<void>;
-  constructor(url: string) {
+  constructor(url: string, private timeoutMs = 30_000) {
     this.ws = new WebSocket(url);
     this.opened = new Promise<void>((resolve, reject) => {
-      this.ws.addEventListener("open", () => resolve(), { once: true });
-      this.ws.addEventListener("error", () => reject(new Error("CDP WebSocket error")), { once: true });
+      const timer = setTimeout(() => { reject(new Error("CDP WebSocket connection timed out")); this.close(); }, timeoutMs);
+      this.ws.addEventListener("open", () => { clearTimeout(timer); resolve(); }, { once: true });
+      const fail = () => {
+        clearTimeout(timer);
+        const error = new Error("CDP WebSocket closed or failed");
+        reject(error);
+        for (const p of this.pending.values()) p.reject(error);
+        this.pending.clear();
+      };
+      this.ws.addEventListener("error", fail);
+      this.ws.addEventListener("close", fail);
     });
     this.ws.addEventListener("message", (ev: MessageEvent) => {
       let msg: any;
       try { msg = JSON.parse(typeof ev.data === "string" ? ev.data : ""); } catch { return; }
       const p = msg.id != null ? this.pending.get(msg.id) : undefined;
       if (!p) return;
-      this.pending.delete(msg.id);
       if (msg.error) p.reject(new Error(msg.error.message || JSON.stringify(msg.error)));
       else p.resolve(msg.result);
     });
   }
   async open(): Promise<void> { await this.opened; }
   send(method: string, params: Record<string, any> = {}, sessionId?: string): Promise<any> {
+    if (this.ws.readyState !== WebSocket.OPEN) return Promise.reject(new Error("CDP WebSocket is not open"));
     const id = ++this.nextId;
-    const payload: any = { id, method, params };
-    if (sessionId) payload.sessionId = sessionId;
     return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
-      this.ws.send(JSON.stringify(payload));
-      setTimeout(() => { if (this.pending.delete(id)) reject(new Error(`CDP ${method} timed out`)); }, 15_000);
+      const finish = (callback: (value: any) => void, value: any) => {
+        clearTimeout(timer);
+        this.pending.delete(id);
+        callback(value);
+      };
+      const timer = setTimeout(() => finish(reject, new Error(`CDP ${method} timed out`)), this.timeoutMs);
+      this.pending.set(id, { resolve: v => finish(resolve, v), reject: e => finish(reject, e) });
+      try { this.ws.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) })); }
+      catch (error) { finish(reject, error); }
     });
   }
-  close(): void { try { this.ws.close(); } catch {} }
+  close(): void {
+    for (const p of this.pending.values()) p.reject(new Error("CDP client closed"));
+    this.pending.clear();
+    try { this.ws.close(); } catch {}
+  }
+}
+
+async function waitForExit(exited: Promise<unknown>, timeoutMs: number): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout>;
+  try {
+    return await Promise.race([exited.then(() => true), new Promise<boolean>(resolve => { timer = setTimeout(() => resolve(false), timeoutMs); })]);
+  } finally { clearTimeout(timer!); }
+}
+
+export async function seedExtensionToken(cdp: Pick<CDPClient, "send">, token: string): Promise<void> {
+  const { targetId } = await cdp.send("Target.createTarget", { url: `chrome-extension://${EXTENSION_ID}/status.html` });
+  const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
+  // The extension page may still be loading; retry the write until localStorage reflects it.
+  let ok = false;
+  const expr = `(()=>{try{if(location.origin!==${JSON.stringify(`chrome-extension://${EXTENSION_ID}`)})return 'ERR:Extension page not loaded';localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
+  let lastError = "Extension page is not ready";
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    const r = await cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId);
+    lastError = r?.exceptionDetails?.text || String(r?.result?.value ?? "No evaluation result");
+    if (r?.result?.value === token) { ok = true; break; }
+    // A target opened before the extension finishes loading can remain on Chrome's
+    // error document forever. Evaluating it again cannot finish the navigation.
+    const navigation = await cdp.send("Page.navigate", { url: `chrome-extension://${EXTENSION_ID}/status.html` }, sessionId);
+    if (navigation.errorText) lastError = navigation.errorText;
+    await Bun.sleep(1_000);
+  }
+  if (!ok) throw new Error(`Could not seed auth token into chrome-extension://${EXTENSION_ID}/: ${lastError}`);
 }
 
 // Launch a throwaway Chrome against a dedicated user-data-dir with the unpacked extension
 // loaded, then seed `token` into the extension's localStorage (the value `connect.html` checks
 // for token-bypass). Headless by default; never touches the user's real Chrome/profiles.
-async function provisionExtensionToken(opts: {
+export async function provisionExtensionToken(opts: {
   userDataDir: string; profileDir: string; dist: string; token: string; headed?: boolean;
 }): Promise<void> {
   // Branded Google Chrome 149+ rejects --load-extension ("not allowed in Google Chrome"), so a
@@ -2944,73 +3022,80 @@ async function provisionExtensionToken(opts: {
     "--no-first-run",
     "--no-default-browser-check",
     "--disable-background-timer-throttling",
+    "--disable-background-networking",
+    "--disable-component-update",
+    "--disable-search-engine-choice-screen",
+    // Match Playwright's unattended macOS launch: no interactive keychain prompt.
+    "--password-store=basic",
+    "--use-mock-keychain",
   ];
   if (!opts.headed) args.push("--headless=new");
   if (process.platform === "linux") args.push("--no-sandbox");
-  // Headless can't answer a Keychain prompt, so first launch could stall on it (as Playwright does).
-  if (process.platform === "darwin") args.push("--use-mock-keychain");
   args.push("about:blank");
-  const proc = Bun.spawn([chromeBin, ...args], { stdout: "ignore", stderr: "ignore", windowsHide: true });
+  // Own a separate process group so escalation cannot touch the user's Chrome.
+  const proc = cpSpawn(chromeBin, args, { detached: process.platform !== "win32", stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
+  let stderr = "";
+  proc.stderr?.on("data", data => { stderr = (stderr + data.toString()).slice(-8_192); });
+  let launchError: Error | undefined;
+  const exited = new Promise<void>(resolve => {
+    proc.once("exit", () => resolve());
+    proc.once("error", error => { launchError = error; resolve(); });
+  });
+  const signal = (value: NodeJS.Signals) => {
+    if (!proc.pid) return;
+    try {
+      if (process.platform === "win32") proc.kill(value);
+      else process.kill(-proc.pid, value);
+    } catch {}
+  };
+  const interrupted = (value: NodeJS.Signals) => {
+    signal("SIGKILL");
+    console.error(`Profile provisioning interrupted (${value})`);
+    process.exit(value === "SIGINT" ? 130 : 143);
+  };
+  const onInt = () => interrupted("SIGINT");
+  const onTerm = () => interrupted("SIGTERM");
+  process.once("SIGINT", onInt);
+  process.once("SIGTERM", onTerm);
   let cdp: CDPClient | null = null;
-  // Every step is bounded: a stuck Chrome must end in an error, never a silent hang.
-  const within = <T>(ms: number, what: string, work: Promise<T>) => Promise.race([work,
-    Bun.sleep(ms).then(() => { throw new Error(`${what} took over ${ms / 1000}s`); })]);
+  let phase = "Chrome startup";
   try {
     // Chrome writes the chosen port to DevToolsActivePort once the debug server is up.
     let port: number | null = null;
-    for (let i = 0; i < 300; i++) {
+    for (let i = 0; i < 600; i++) {
       await Bun.sleep(100);
       const line = (await file(portFile).text().catch(() => "")).split("\n")[0]?.trim();
       if (line && /^\d+$/.test(line)) { port = parseInt(line); break; }
-      if (proc.exitCode !== null) throw new Error("Chrome exited before opening the DevTools port");
+      if (launchError) throw launchError;
+      if (proc.exitCode !== null || proc.signalCode !== null) throw new Error(`Chrome exited before opening the DevTools port (${proc.exitCode ?? proc.signalCode})`);
     }
-    if (!port) throw new Error("Chrome didn't open its DevTools port within 30s");
-    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(5000) })).json();
+    if (!port) throw new Error("Chrome DevTools port not found (extension may have failed to load)");
+    phase = "Chrome DevTools discovery";
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(30_000) })).json();
+    phase = "Chrome DevTools connection";
     cdp = new CDPClient(ver.webSocketDebuggerUrl as string);
-    await within(5000, "Connecting to Chrome DevTools", cdp.open());
-    // Wait for the extension's service worker: if it never shows, the extension didn't load.
-    const extensionUrl = `chrome-extension://${EXTENSION_ID}/`;
-    let loaded = false;
-    for (let i = 0; i < 50 && !loaded; i++) {
-      const { targetInfos } = await cdp.send("Target.getTargets");
-      loaded = (targetInfos as { url: string }[]).some(t => t.url.startsWith(extensionUrl));
-      if (!loaded) await Bun.sleep(200);
-    }
-    if (!loaded) throw new Error(`The extension at ${dist} didn't load in Chrome for Testing (no ${extensionUrl} target within 10s)`);
-    const { targetId } = await cdp.send("Target.createTarget", { url: `${extensionUrl}status.html` });
-    const { sessionId } = await cdp.send("Target.attachToTarget", { targetId, flatten: true });
-    // The extension page may still be loading; retry the write until localStorage reflects it.
-    let ok = false, last = "";
-    const expr = `(()=>{try{localStorage.setItem('auth-token',${JSON.stringify(token)});return localStorage.getItem('auth-token');}catch(e){return 'ERR:'+e.message}})()`;
-    const deadline = Date.now() + 10_000;
-    while (Date.now() < deadline) {
-      const r = await within(3000, "Runtime.evaluate", cdp.send("Runtime.evaluate", { expression: expr, returnByValue: true }, sessionId)).catch(e => ({ error: String(e) }));
-      const value = (r as any)?.result?.value;
-      if (value === token) { ok = true; break; }
-      last = typeof value === "string" ? value : (r as any)?.error ?? (r as any)?.result?.description ?? "";
-      await Bun.sleep(200);
-    }
-    if (!ok) throw new Error(`Could not seed auth token into ${extensionUrl}${last ? ` (${last})` : ""}`);
+    await cdp.open();
+    phase = "Extension token seeding";
+    await seedExtensionToken(cdp, token);
     // Graceful close flushes localStorage to the profile's leveldb before we kill Chrome.
-    await within(5000, "Browser.close", cdp.send("Browser.close")).catch(() => {});
-    await within(5000, "Chrome exit", proc.exited).catch(() => {});
+    phase = "Chrome shutdown";
+    await cdp.send("Browser.close").catch(() => {});
+    if (!await waitForExit(exited, 30_000)) throw new Error("Chrome did not exit after flushing the auth token");
+    if (readExtensionTokenFromProfile(userDataDir, profileDir, EXTENSION_ID) !== token)
+      throw new Error("Chrome exited without persisting the extension auth token");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`${phase}: ${message}${stderr.trim() ? `\nChrome stderr:\n${stderr.trim()}` : ""}`.replaceAll(token, "[redacted]"));
   } finally {
     cdp?.close();
-    await stopThrowawayChrome(proc, userDataDir);
-  }
-}
-
-/**
- * Stop a Chrome we launched on a throwaway user-data-dir: SIGTERM, then SIGKILL, then any helper
- * still holding that exact --user-data-dir (scoped to it, so never the user's own Chrome).
- */
-async function stopThrowawayChrome(proc: ReturnType<typeof Bun.spawn>, userDataDir: string): Promise<void> {
-  if (proc.exitCode === null) {
-    try { proc.kill(); } catch {}
-    const exited = await Promise.race([proc.exited.then(() => true, () => true), Bun.sleep(3000).then(() => false)]);
-    if (!exited) { try { proc.kill("SIGKILL"); } catch {} await Promise.race([proc.exited.catch(() => {}), Bun.sleep(2000)]); }
+    signal("SIGTERM");
+    if (!await waitForExit(exited, 2_000)) signal("SIGKILL");
+    // Also reap helpers that survived the browser parent exiting.
+    signal("SIGKILL");
+    await waitForExit(exited, 2_000);
+    process.removeListener("SIGINT", onInt);
+    process.removeListener("SIGTERM", onTerm);
   }
-  if (process.platform !== "win32") Bun.spawnSync(["pkill", "-9", "-f", `--user-data-dir=${userDataDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}( |$)`], { stdout: "ignore", stderr: "ignore" });
 }
 
 async function provisionProfile(name: string, opts: { headed?: boolean } = {}): Promise<void> {
@@ -3029,7 +3114,7 @@ async function provisionProfile(name: string, opts: { headed?: boolean } = {}):
   console.log(`      extension:     ${dist}`);
   console.log(`      Launching ${opts.headed ? "headed" : "headless"} Chrome to seed the auth token...`);
   await provisionExtensionToken({ userDataDir, profileDir: name, dist, token, headed: opts.headed });
-  console.log(`      Token seeded (${token.slice(0, 6)}…)`);
+  console.log("      Token seeded");
 
   // [2/3] Daemon URL — reuse the running daemon's key; warn (don't fail) if it isn't up yet.
   console.log(`\n[2/3] Building RECHROME_URL`);
@@ -4140,6 +4225,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
       open, goto, click, fill, screenshot, eval, tab-list…  (\`rech pw --help\` lists all)
       --profile <p>  as another registered profile (email, name or folder); put it first
       --isolate      in a throwaway session, e.g. for a login flow
+  rech fill-secret <ref> --from-env VAR | --totp-from-env VAR [--env-file f] [--allow-domain '*.example.com']
+                     type a password / TOTP code without it reaching argv, logs or output
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 

package/serve.js

@@ -5,8 +5,8 @@ import { bearerOf, safeEqual } from "./secret.js";
 import { WebrtcHost } from "./webrtc.js";
 import { file } from "bun";
 import { createHash, randomBytes, X509Certificate } from "crypto";
-import { mkdirSync, lstatSync, chmodSync, unlinkSync, accessSync, readdirSync, realpathSync, constants as fsConstants } from "fs";
-import { join, resolve, relative, isAbsolute } from "path";
+import { mkdirSync, lstatSync, statSync, chmodSync, unlinkSync, accessSync, readdirSync, realpathSync, existsSync, readFileSync, constants as fsConstants } from "fs";
+import { join, resolve, relative, isAbsolute, sep } from "path";
 import { tmpdir } from "os";
 import {
   log,
@@ -24,6 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.js";
+import { SecretMasker, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -87,6 +88,18 @@ const sessionTimeouts = new Map<string, number>(); // per-session consecutive-ti
 // Most-recently-used non-iso sessions, so the deep health probe can target something real
 // instead of spawning a fresh session (which could open a browser window).
 const recentSessions = new Map<string, number>();
+// Values typed by `fill-secret`, masked in every output, log line and served text file for a
+// while afterwards: snapshots echo input values (passwords included). See fill-secret.js.
+const secretMasker = new SecretMasker();
+const TEXT_OUTPUT = /\.(?:ya?ml|json|md|txt|log)$/i;
+// /run commands in flight, with the (real) output dir each writes to once known. A snapshot file
+// exists on disk before its command has checked it for password values, so a text download waits
+// until no command writing to its directory is in flight.
+const runsInFlight = new Map<Promise<void>, string | undefined>();
+// Only the CLI's own artifacts are ever scrubbed or deleted, never a file a page merely names.
+const CLI_TEXT_ARTIFACT = /(^|\/)\.playwright-cli(-multi-tab)?\/[^/]+\.(?:ya?ml|json|md|txt|log)$/;
+// Artifacts that could not be checked AND could not be deleted: never served.
+const deniedFiles = new Set<string>();
 function noteSession(sess: string, now: number): void {
   recentSessions.set(sess, now);
   if (recentSessions.size > 64) {
@@ -738,6 +751,15 @@ export async function serve() {
         if (!(await f.exists())) return new Response("Not found", { status: 404 });
         const real = realpathSync(resolved);
         if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
+        if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+        if (TEXT_OUTPUT.test(real)) {
+          const busy = () => [...runsInFlight].filter(([, dir]) => !dir || real.startsWith(dir + sep)).map(([p]) => p);
+          for (let pending = busy(); pending.length; pending = busy()) await Promise.all(pending); // re-check: new runs may start
+          // Synchronous from the last check on: no await, so no new run can start and write here.
+          if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+          if (!existsSync(real)) return new Response("Not found", { status: 404 }); // withheld
+          return new Response(maskPasswordLines(secretMasker.mask(readFileSync(real, "utf8"))));
+        }
         return new Response(f);
       }
 
@@ -782,6 +804,10 @@ export async function serve() {
       const denied = authCheck(req, key);
       if (denied) return denied;
       markActivity(); // a real command: this serve is not idle
+      let runDone = () => {};
+      const running = new Promise<void>((r) => { runDone = r; });
+      runsInFlight.set(running, undefined); // dir not known yet: holds every text download
+      try { return await (async () => {
 
       let body: any;
       try { body = await readRequestJson(req); }
@@ -827,6 +853,7 @@ export async function serve() {
       const outputPrefix = scopedProfile ? profileOutputPrefix(scopedProfile) + (cred?.kind === "device" ? `d-${cred.device.id}/` : "") : "";
       const runWorkDir = scopedProfile ? join(workDir, outputPrefix) : workDir;
       mkdirSync(runWorkDir, { recursive: true });
+      runsInFlight.set(running, realpathSync(runWorkDir));
       let args: string[];
       let sessionId: string;
       let clientName = "";
@@ -894,6 +921,27 @@ export async function serve() {
 
       log(`run: rech ${filteredArgs.join(" ")} (session=${namespacedSession})`);
 
+      // fill-secret: the value arrives in body.secret, never in args; it is handed to the live
+      // session over its socket (no child argv) and never logged. See fill-secret.js.
+      if (filteredArgs[0] === "fill-secret") {
+        const secret = !Array.isArray(body) && typeof body.secret === "string" ? body.secret : "";
+        try {
+          const { ref, allowDomains, submit, totp } = parseFillSecretWire(filteredArgs);
+          if (!secret) throw new Error("fill-secret: the request carried no secret (this client is older than the daemon?)");
+          secretMasker.add(secret, totp ? undefined : Infinity);
+          const reply = await fillSecretOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, ref, value: secret, allowDomains, submit });
+          // Drop the echoed run-code body (it embeds the value, masked or not, and is noise).
+          const text = secretMasker.mask(reply.text).replace(/### Ran Playwright code\n```js\n[\s\S]*?\n```\n?/, "").trim();
+          const status = reply.isError ? 1 : 0;
+          log(`exit: ${status} | fill-secret ${ref}`);
+          return Response.json(reply.isError ? { status, stdout: "", stderr: `${text}\n`, files: [] } : { status, stdout: `${text}\n`, stderr: "", files: [] });
+        } catch (error) {
+          const message = secretMasker.mask(secret ? (error instanceof Error ? error.message : String(error)).replaceAll(secret, "***") : (error instanceof Error ? error.message : String(error)));
+          log(`exit: 1 | fill-secret: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // For open commands, default to about:blank to avoid leaving connect.html visible
       const isOpenCmd = filteredArgs[0] === "open";
       const isOpenNoUrl = isOpenCmd && filteredArgs.length === 1;
@@ -1041,7 +1089,7 @@ export async function serve() {
           reject(new Error("timeout"));
         }, TIMEOUT);
       });
-      const [status, stdout, rawStderr] = await Promise.race([
+      let [status, stdout, rawStderr] = await Promise.race([
         Promise.all([
           proc.exited,
           new Response(proc.stdout).text(),
@@ -1058,7 +1106,7 @@ export async function serve() {
         ? configuredHandshakeTimeout
         : 30_000;
       const tccNote = explainExtensionNotFound(`${stdout}\n${rawStderr}`, chromeAccessProblem);
-      const stderr = (tccNote ?? "") + inferSilentExtensionFailure({
+      let stderr = (tccNote ?? "") + inferSilentExtensionFailure({
         status,
         stdout,
         stderr: rawStderr,
@@ -1068,6 +1116,24 @@ export async function serve() {
         handshakeTimeoutMs,
       });
 
+      // Snapshots print every input's value, password fields included (e.g. ones Chrome
+      // autofilled). Read the live password values and mask them before anything is logged,
+      // returned or left on disk; the label-based pass catches what the scan misses.
+      // Fails closed: a snapshot that can't be fully checked is withheld, not passed through.
+      const rawOutput = `${stdout}\n${stderr}`; // artifact paths come from the unmasked text
+      const snapshotOut = hasSnapshot(rawOutput);
+      let withheld = "";
+      if (snapshotOut) {
+        try {
+          for (const v of await passwordValuesOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir })) secretMasker.add(v, Infinity);
+        } catch (error) {
+          withheld = "could not check it for password values";
+          log(`snapshot withheld: ${secretMasker.mask(error instanceof Error ? error.message : String(error)).split("\n")[0]}`);
+        }
+      }
+      stdout = maskPasswordLines(secretMasker.mask(stdout));
+      stderr = maskPasswordLines(secretMasker.mask(stderr));
+      if (withheld) { stdout = withholdSnapshots(stdout, withheld); stderr = withholdSnapshots(stderr, withheld); }
       log(`exit: ${status}${stdout.trim() ? ` | ${stdout.trim().slice(0, 200)}` : ""}`);
 
       // Relay self-heal (see notes at SESSION_CLOSE_TIMEOUTS). A command that RETURNS usually
@@ -1105,12 +1171,8 @@ export async function serve() {
       }
 
       // Detect files mentioned in output
-      const filePattern = /[\w./-]+\.(?:png|jpe?g|pdf|json|yml)\b/gi;
-      const mentionedFiles = [
-        ...new Set(
-          [...stdout.matchAll(filePattern), ...stderr.matchAll(filePattern)].map((m) => m[0]),
-        ),
-      ];
+      const filePattern = /[\w./-]+\.(?:png|jpe?g|pdf|json|ya?ml)\b/gi;
+      const mentionedFiles = [...new Set([...rawOutput.matchAll(filePattern)].map((m) => m[0]))];
       const outputFiles: string[] = [];
       for (const f of mentionedFiles) {
         if (!isUnderDir(runWorkDir, f)) continue;
@@ -1130,6 +1192,35 @@ export async function serve() {
         }
       }
 
+      // A file the command was told to write (`snapshot --filename=x.yml`) is its own artifact too.
+      const ownFilenames = filteredArgs.flatMap((a, i) => a.startsWith("--filename=") ? [a.slice(11)] : a === "--filename" && filteredArgs[i + 1] ? [filteredArgs[i + 1]!] : []);
+      // Snapshot files echo input values: scrub them on disk too, not only on download. Only
+      // files this command wrote (a page can merely mention an existing file's name). One that
+      // can't be checked or scrubbed is deleted, or, failing that, never served.
+      // The command's own --filename targets count even when the output doesn't name them.
+      const ownTargets = ownFilenames.filter(n => isUnderDir(runWorkDir, n) && existsSync(join(runWorkDir, n)));
+      if (snapshotOut || secretMasker.active) for (const f of [...new Set([...outputFiles, ...ownTargets])]) {
+        const ownFile = ownFilenames.some(n => resolve(runWorkDir, n) === resolve(runWorkDir, f));
+        if (!ownFile && !CLI_TEXT_ARTIFACT.test(f.replaceAll("\\", "/"))) continue;
+        const path = join(runWorkDir, f);
+        let mtimeMs = 0;
+        try { mtimeMs = statSync(path).mtimeMs; } catch { continue; }
+        if (mtimeMs < commandStartedAt - 1000) continue;
+        try {
+          // Unchecked: withhold every snapshot file, and anything the command was told to write.
+          if (withheld && (ownFile || /\.ya?ml$/i.test(f))) throw new Error("withheld");
+          // Text vs binary by content, not name: `snapshot --filename=x.png` writes text.
+          const bytes = new Uint8Array(await file(path).arrayBuffer());
+          if (bytes.subarray(0, 8192).includes(0)) continue; // binary (e.g. a screenshot)
+          const text = new TextDecoder().decode(bytes);
+          const masked = maskPasswordLines(secretMasker.mask(text));
+          if (masked !== text) await Bun.write(path, masked);
+        } catch {
+          try { unlinkSync(path); } catch { try { deniedFiles.add(realpathSync(path)); } catch {} }
+          if (outputFiles.includes(f)) outputFiles.splice(outputFiles.indexOf(f), 1);
+        }
+      }
+
       const rebrand = (s: string) => s.replaceAll("npx playwright-cli", "rech");
       return Response.json({
         status,
@@ -1139,6 +1230,7 @@ export async function serve() {
         // a cross-OS daemon↔client (e.g. Windows daemon serving a Linux container client).
         files: outputFiles.map((p) => (outputPrefix + p).replaceAll("\\", "/")),
       });
+      })(); } finally { runsInFlight.delete(running); runDone(); }
   };
 
   // WebRTC: the same handler, reached over an encrypted DataChannel. Each request carries the