rechrome 1.37.2 → 1.38.1

package/README.md

@@ -64,6 +64,39 @@ verbatim: `rech --version` prints rechrome's version, `rech pw --version` playwr
 Commands from the same git worktree share one browser session, so tabs you open persist
 between calls; another worktree gets its own. `-s=<name>` opens a named sub-session.
 
+#### Passwords and 2FA codes: `fill-secret`
+
+`rech fill <ref> <password>` puts the password in the command line, the daemon log and the output.
+`fill-secret` keeps it out of all three:
+
+```bash
+rech fill-secret e7 --from-env SITE_PASSWORD --allow-domain '*.app.example.com'
+rech fill-secret e9 --totp-from-env SITE_TOTP_SEED --env-file ~/secrets/.env --allow-domain '*.app.example.com' --submit
+printf '%s\n' "$PW" | rech fill-secret e7 --from-stdin
+```
+
+The client reads the value (or computes the TOTP code from a base32 seed: SHA1, 6 digits, 30 s; the
+seed never leaves the client) and sends it outside the command's arguments. The daemon hands it to
+the browser over the session's local socket. `--allow-domain` is checked against the host of the
+field's own frame (an allowed page can't lend its host to a cross-origin iframe), and the fill goes
+to that exact element, so it fails rather than types into a page that navigated after the check.
+Snapshots echo input values, so the daemon shows `***` for the value in this and every later output,
+log line and saved snapshot file: passwords until the daemon restarts, TOTP codes for 15 minutes.
+Profile-scoped listeners accept `fill-secret` with its own flags.
+
+Every password field is masked in snapshots, whoever filled it (you, Chrome's autofill, or
+`fill-secret`): when an output carries a snapshot, the daemon reads the live values of all
+`input[type=password]` fields in every frame (plus fields marked as passwords by `autocomplete` or a
+name/id containing "pass", which covers a "show password" toggle) and masks them, and also blanks
+any textbox whose name reads like a password field (password, PIN, パスワード…). If that check can't
+be completed, the snapshot is withheld (inline and as a file) instead of passed through.
+
+Limits: the masking stops accidental echoes, not someone who can run `eval`/`run-code` on the
+session and deliberately reads the field back encoded. A snapshot file is scrubbed right after the
+browser writes it, not before (downloads wait for the scrub). The check reads the page right after
+the snapshot, so a page script that clears or replaces a neutrally-labelled password field in
+between can slip past; closing that needs redaction inside playwright's snapshot code. Not yet supported on a Windows daemon.
+
 ### 3. Where things are kept
 
 | Where | What |
@@ -280,6 +313,8 @@ prompting for stdin, then uses the default configuration save location.
 > the extension auto-loaded and the token auto-seeded — zero GUI, zero TTY. It is *not* your real
 > Chrome (branded Google Chrome 149+ rejects `--load-extension`), so it has no logins/cookies; use it
 > for clean QA fixtures, and `rech setup` for your real, logged-in Chrome.
+> After provisioning, `rech --profile <name> open https://example.com` automatically launches
+> that managed browser with the bridge loaded; no separate browser launch is needed.
 
 ## Configuration
 

package/fill-secret.js

@@ -0,0 +1,405 @@
+// @bun
+// fill-secret.ts
+import { createHmac } from "crypto";
+import { connect } from "net";
+import { readdirSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var SECRET_MASK = "***";
+var SECRET_MASK_TTL_MS = 15 * 60000;
+var FILL_SECRET_USAGE = `Usage: rech fill-secret <ref> (--from-env VAR | --from-stdin | --totp-from-env VAR | --totp-from-stdin)
+                         [--env-file <path>] [--allow-domain <glob>]... [--submit]
+  Fills <ref> (from \`rech snapshot\`) with a secret the daemon never logs or echoes.
+  --from-env VAR        the value of env var VAR on this machine
+  --from-stdin          the first line of stdin
+  --totp-from-env VAR   the current 6-digit TOTP code (RFC 6238, SHA1, 30s) for the base32 seed in VAR;
+                        only the code leaves this machine, never the seed
+  --totp-from-stdin     the same, seed read from stdin
+  --env-file PATH       look VAR up in this dotenv file instead of the environment
+  --allow-domain GLOB   refuse unless the page host matches, e.g. '*.app.example.com' (repeatable)
+  --submit              press Enter after filling`;
+function parseFillSecretArgs(args) {
+  let ref;
+  let source;
+  let totp = false;
+  const allowDomains = [];
+  let submit = false;
+  let envFile;
+  const setSource = (s, isTotp) => {
+    if (source)
+      throw new Error("fill-secret takes exactly one of --from-env, --from-stdin, --totp-from-env, --totp-from-stdin");
+    source = s;
+    totp = isTotp;
+  };
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    const eq = a.indexOf("=");
+    const flag = a.startsWith("--") && eq > 0 ? a.slice(0, eq) : a;
+    const value = () => {
+      if (a.startsWith("--") && eq > 0)
+        return a.slice(eq + 1);
+      const next = args[++i];
+      if (next === undefined || next.startsWith("--"))
+        throw new Error(`${flag} needs a value`);
+      return next;
+    };
+    if (flag === "--from-env")
+      setSource({ kind: "env", name: value() }, false);
+    else if (flag === "--totp-from-env")
+      setSource({ kind: "env", name: value() }, true);
+    else if (flag === "--from-stdin")
+      setSource({ kind: "stdin" }, false);
+    else if (flag === "--totp-from-stdin")
+      setSource({ kind: "stdin" }, true);
+    else if (flag === "--allow-domain") {
+      const globs = value().split(",").map((s) => s.trim());
+      if (globs.some((g) => !g))
+        throw new Error("--allow-domain got an empty host");
+      allowDomains.push(...globs);
+    } else if (flag === "--submit")
+      submit = true;
+    else if (flag === "--env-file")
+      envFile = value();
+    else if (a.startsWith("-"))
+      throw new Error(`fill-secret: unknown option ${a}`);
+    else if (ref === undefined)
+      ref = a;
+    else
+      throw new Error("fill-secret takes the secret from --from-env/--from-stdin, never as an argument");
+  }
+  if (!ref)
+    throw new Error("fill-secret needs a target ref, e.g. e12 (see `rech snapshot`)");
+  if (!source)
+    throw new Error("fill-secret needs --from-env VAR, --from-stdin, --totp-from-env VAR or --totp-from-stdin");
+  if (envFile) {
+    if (source.kind !== "env")
+      throw new Error("--env-file goes with --from-env / --totp-from-env");
+    source.envFile = envFile;
+  }
+  if (source.kind === "env" && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(source.name))
+    throw new Error(`fill-secret: "${source.name}" is not an environment variable name`);
+  for (const d of allowDomains)
+    domainGlobToRegExp(d);
+  return { ref, source, totp, allowDomains, submit };
+}
+function fillSecretWireArgs(req) {
+  return ["fill-secret", req.ref, ...req.allowDomains.map((d) => `--allow-domain=${d}`), ...req.submit ? ["--submit"] : [], ...req.totp ? ["--totp"] : []];
+}
+async function readSecretSource(source, env = process.env, stdin = () => Bun.stdin.text()) {
+  if (source.kind === "env") {
+    const v = source.envFile ? parseDotenv(await Bun.file(source.envFile).text().catch(() => {
+      throw new Error(`fill-secret: cannot read ${source.envFile}`);
+    }))[source.name] : env[source.name];
+    if (!v)
+      throw new Error(`fill-secret: ${source.name} is not set or empty${source.envFile ? ` in ${source.envFile}` : ""}`);
+    return v;
+  }
+  const text = await stdin();
+  const v = text.replace(/\r?\n[\s\S]*$/, "");
+  if (!v)
+    throw new Error("fill-secret: nothing on stdin");
+  return v;
+}
+function parseDotenv(text) {
+  const out = {};
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
+    if (!m)
+      continue;
+    let v = m[2];
+    const q = v[0];
+    if ((q === '"' || q === "'") && v.lastIndexOf(q) > 0) {
+      v = v.slice(1, v.lastIndexOf(q));
+      if (q === '"')
+        v = v.replace(/\\n/g, `
+`).replace(/\\(["\\])/g, "$1");
+    } else
+      v = v.replace(/\s+#.*$/, "");
+    out[m[1]] = v;
+  }
+  return out;
+}
+function base32Decode(input) {
+  const s = input.replace(/[\s-]/g, "").replace(/=+$/, "").toUpperCase();
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  let bits = 0, acc = 0;
+  const out = [];
+  for (const ch of s) {
+    const v = alphabet.indexOf(ch);
+    if (v < 0)
+      throw new Error("TOTP seed is not valid base32");
+    acc = acc << 5 | v;
+    bits += 5;
+    if (bits >= 8) {
+      bits -= 8;
+      out.push(acc >>> bits & 255);
+    }
+  }
+  if (!out.length)
+    throw new Error("TOTP seed is empty");
+  return Buffer.from(out);
+}
+function totpCode(seedBase32, timeMs = Date.now(), opts = {}) {
+  const { digits = 6, period = 30, algorithm = "sha1" } = opts;
+  const counter = Math.floor(timeMs / 1000 / period);
+  const msg = Buffer.alloc(8);
+  msg.writeBigUInt64BE(BigInt(counter));
+  const mac = createHmac(algorithm, base32Decode(seedBase32)).update(msg).digest();
+  const offset = mac[mac.length - 1] & 15;
+  const bin = (mac[offset] & 127) << 24 | mac[offset + 1] << 16 | mac[offset + 2] << 8 | mac[offset + 3];
+  return String(bin % 10 ** digits).padStart(digits, "0");
+}
+function totpWaitMs(timeMs = Date.now(), period = 30, minLeftMs = 5000) {
+  const left = period * 1000 - timeMs % (period * 1000);
+  return left < minLeftMs ? left + 50 : 0;
+}
+function domainGlobToRegExp(glob) {
+  const g = glob.trim().toLowerCase();
+  if (!/^(\*\.)?[a-z0-9-]+(\.[a-z0-9-]+)*$/.test(g))
+    throw new Error(`--allow-domain "${glob}" is not a host or *.host glob`);
+  const esc = (s) => s.replace(/[.]/g, "\\.");
+  return g.startsWith("*.") ? new RegExp(`^(?:[a-z0-9-]+\\.)+${esc(g.slice(2))}$`, "i") : new RegExp(`^${esc(g)}$`, "i");
+}
+function hostAllowed(host, globs) {
+  return globs.length === 0 || globs.some((g) => domainGlobToRegExp(g).test(host));
+}
+function parseFillSecretWire(args) {
+  const [cmd, ref, ...rest] = args;
+  if (cmd !== "fill-secret" || !ref || ref.startsWith("-"))
+    throw new Error("fill-secret needs a target ref");
+  const allowDomains = [];
+  let submit = false, totp = false;
+  for (const a of rest) {
+    if (a === "--submit")
+      submit = true;
+    else if (a === "--totp")
+      totp = true;
+    else if (a.startsWith("--allow-domain=")) {
+      const d = a.slice("--allow-domain=".length);
+      domainGlobToRegExp(d);
+      allowDomains.push(d);
+    } else
+      throw new Error(`fill-secret: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+  }
+  return { ref, allowDomains, submit, totp };
+}
+function buildFillCode(ref, value, allowDomains, submit) {
+  const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
+  const locator = /^(f\d+)?e\d+$/.test(ref) ? `page.locator(${JSON.stringify(`aria-ref=${ref}`)})` : `page.locator(${JSON.stringify(ref)})`;
+  return `async page => {
+  const el = await ${locator}.elementHandle({ timeout: 10000 });
+  try {
+    const host = String(await el.evaluate(e => e.ownerDocument.location.hostname)).toLowerCase();
+    const allowed = ${JSON.stringify(patterns)};
+    if (allowed.length && !allowed.some(p => new RegExp(p, "i").test(host)))
+      throw new Error("fill-secret refused: the field's page host " + JSON.stringify(host) + " is not allowed by --allow-domain ${allowDomains.join(",").replace(/[^a-z0-9*.,-]/gi, "")}");
+    await el.fill(${JSON.stringify(value)}, { timeout: 10000 });
+    ${submit ? `await el.press("Enter", { timeout: 10000 });` : ""}
+    return "filled " + ${JSON.stringify(ref)} + " on " + host;
+  } finally {
+    await el.dispose().catch(() => {});
+  }
+}`;
+}
+
+class SecretMasker {
+  ttlMs;
+  now;
+  values = new Map;
+  constructor(ttlMs = SECRET_MASK_TTL_MS, now = () => Date.now()) {
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+  add(value, ttlMs = this.ttlMs) {
+    if (value)
+      this.values.set(value, this.now() + ttlMs);
+  }
+  get active() {
+    this.prune();
+    return this.values.size > 0;
+  }
+  mask(text) {
+    if (!text)
+      return text;
+    this.prune();
+    for (const v of [...this.values.keys()].sort((a, b) => b.length - a.length)) {
+      text = text.replaceAll(v, SECRET_MASK);
+      const lit = JSON.stringify(v).slice(1, -1);
+      if (lit !== v)
+        text = text.replaceAll(lit, SECRET_MASK);
+    }
+    return text;
+  }
+  prune() {
+    const t = this.now();
+    for (const [v, exp] of this.values)
+      if (exp <= t)
+        this.values.delete(v);
+  }
+}
+function sessionSocketCandidates(socketRoot, session) {
+  let names = [];
+  try {
+    names = readdirSync(socketRoot);
+  } catch {
+    return [];
+  }
+  return names.filter((n) => n === `${session}.sock` || n.length === session.length + 22 && /^[0-9a-f]{16}-/.test(n) && n.slice(17) === `${session}.sock`).map((n) => join(socketRoot, n));
+}
+function daemonSessionSockets(session, env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir();
+  const bases = env.PLAYWRIGHT_DAEMON_SESSION_DIR ? [env.PLAYWRIGHT_DAEMON_SESSION_DIR] : process.platform === "win32" ? [...new Set([
+    join(env.USERPROFILE || home, "AppData", "Local", "ms-playwright", "daemon"),
+    ...env.LOCALAPPDATA ? [join(env.LOCALAPPDATA, "ms-playwright", "daemon")] : []
+  ])] : process.platform === "darwin" ? [join(home, "Library", "Caches", "ms-playwright", "daemon")] : [join(env.XDG_CACHE_HOME || join(home, ".cache"), "ms-playwright", "daemon")];
+  const out = [];
+  for (const base of bases) {
+    let hashes = [];
+    try {
+      hashes = readdirSync(base);
+    } catch {
+      continue;
+    }
+    for (const h of hashes) {
+      if (!/^[0-9a-f]{16}$/.test(h))
+        continue;
+      try {
+        const cfg = JSON.parse(readFileSync(join(base, h, `${session}.session`), "utf8"));
+        if ((cfg?.name ?? session) === session && typeof cfg?.socketPath === "string" && cfg.socketPath)
+          out.push(cfg.socketPath);
+      } catch {}
+    }
+  }
+  return [...new Set(out)];
+}
+function socketRequest(path, method, params, timeoutMs = 30000) {
+  return new Promise((resolve, reject) => {
+    const sock = connect(path);
+    let buf = "";
+    const timer = setTimeout(() => {
+      sock.destroy();
+      reject(new Error("timeout"));
+    }, timeoutMs);
+    sock.setEncoding("utf8");
+    sock.on("connect", () => sock.write(`${JSON.stringify({ id: 1, method, params })}
+`));
+    sock.on("data", (d) => {
+      buf += d;
+      const nl = buf.indexOf(`
+`);
+      if (nl < 0)
+        return;
+      clearTimeout(timer);
+      sock.destroy();
+      try {
+        resolve(JSON.parse(buf.slice(0, nl)));
+      } catch {
+        reject(new Error("unreadable cliDaemon response"));
+      }
+    });
+    sock.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    sock.on("close", () => {
+      clearTimeout(timer);
+      reject(new Error("cliDaemon closed the connection"));
+    });
+  });
+}
+async function runCodeOnSession(opts) {
+  const candidates = [...new Set([...sessionSocketCandidates(opts.socketRoot, opts.session), ...daemonSessionSockets(opts.session)])];
+  if (!candidates.length)
+    throw new Error("no browser is open in this session; run `rech open <url>` first");
+  const errors = [];
+  for (const path of candidates) {
+    let reply;
+    try {
+      reply = await socketRequest(path, "run", { args: { _: ["run-code", opts.code] }, cwd: opts.cwd, ...opts.json ? { json: true } : {} });
+    } catch (e) {
+      errors.push(e instanceof Error ? e.message : String(e));
+      continue;
+    }
+    if (reply.error)
+      throw new Error(reply.error);
+    const r = reply.result;
+    return { isError: !!r?.isError, text: typeof r === "string" ? r : typeof r?.text === "string" ? r.text : "" };
+  }
+  throw new Error(`could not reach this session's browser (${errors.join("; ")}); run \`rech open <url>\` first`);
+}
+function fillSecretOnSession(opts) {
+  return runCodeOnSession({ ...opts, code: buildFillCode(opts.ref, opts.value, opts.allowDomains, opts.submit) });
+}
+var PASSWORD_FIELDS = 'input[type=password], input[autocomplete~="current-password" i], input[autocomplete~="new-password" i], input[name*="pass" i], input[id*="pass" i]';
+var PASSWORD_VALUES_CODE = `async page => {
+  const values = [];
+  let failedFrames = 0;
+  for (const frame of page.frames()) {
+    try { values.push(...await frame.$$eval(${JSON.stringify(PASSWORD_FIELDS)}, els => els.map(e => e.value))); } catch { failedFrames++; }
+  }
+  return { values: values.filter(Boolean), failedFrames };
+}`;
+async function passwordValuesOnSession(opts) {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: PASSWORD_VALUES_CODE, json: true });
+  if (isError)
+    throw new Error("password scan failed");
+  const { values, failedFrames } = parseScanResult(text);
+  if (failedFrames)
+    throw new Error(`password scan could not read ${failedFrames} frame(s)`);
+  return values;
+}
+function parseScanResult(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text).result;
+  } catch {
+    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  }
+  let value = raw;
+  if (typeof raw === "string") {
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      value = undefined;
+    }
+  }
+  if (!value || !Array.isArray(value.values) || typeof value.failedFrames !== "number")
+    throw new Error("password scan returned no result");
+  return { values: value.values.filter((v) => typeof v === "string" && v.length > 0), failedFrames: value.failedFrames };
+}
+function withholdSnapshots(text, reason) {
+  return text.replace(/### Snapshot\n[\s\S]*?(?=\n### |$)/g, `### Snapshot
+[rech] snapshot withheld: ${reason}. Retry the command.`);
+}
+var hasSnapshot = (text) => /### Snapshot|\.ya?ml\b/.test(text);
+var PASSWORD_LINE = /^(\s*-\s*textbox\s+"[^"\n]*(?:password|passwd|passcode|\bpin\b|\u30D1\u30B9\u30EF\u30FC\u30C9|\u6697\u8A3C)[^"\n]*"[^\n:]*):[ \t]+\S.*$/gim;
+function maskPasswordLines(text) {
+  return text.replace(PASSWORD_LINE, `$1: ${SECRET_MASK}`);
+}
+export {
+  FILL_SECRET_USAGE,
+  SECRET_MASK,
+  SECRET_MASK_TTL_MS,
+  SecretMasker,
+  base32Decode,
+  buildFillCode,
+  daemonSessionSockets,
+  domainGlobToRegExp,
+  fillSecretOnSession,
+  fillSecretWireArgs,
+  hasSnapshot,
+  hostAllowed,
+  maskPasswordLines,
+  parseDotenv,
+  parseFillSecretArgs,
+  parseFillSecretWire,
+  parseScanResult,
+  passwordValuesOnSession,
+  readSecretSource,
+  runCodeOnSession,
+  sessionSocketCandidates,
+  socketRequest,
+  totpCode,
+  totpWaitMs,
+  withholdSnapshots
+};