rechrome 1.38.2 → 1.39.0

package/README.md

@@ -359,56 +359,59 @@ cp .env.example .env.local
 >
 > Shell-set `PLAYWRIGHT_MCP_*` variables take priority over `.env.local`, so you can always override per-command without editing files.
 
-### Small icon uploads from stdin
+### Uploading files
 
-Uploads are disabled by default on every listener. The host owner can add an
-`uploads` object to the intended listener entry in `~/.rechrome/listeners.json`:
+`rech upload <file>` puts a local image into the page: a file picker, an
+`<input type=file>` (hidden ones too), a drag-and-drop zone, or an editor that
+takes pasted images. The file is read on **your** machine and only its bytes are
+sent, so it works the same against a remote host.
 
-```json
-"uploads": {
-  "maxBytes": 2097152,
-  "contentTypes": ["image/png", "image/svg+xml"]
-}
+```bash
+rech upload ./shot.png                     # the chooser a click opened, else the page's only file input
+rech upload ./shot.png --into e42          # a file input, or the button that opens the picker (clicks it)
+rech upload ./shot.png --into 'input#avatar'
+rech upload ./shot.png --drop e17          # a drag-and-drop zone
+rech upload ./shot.png --paste e9          # an editor that takes pasted images (default: the focused element)
+rech upload --name shot.png < ./shot.png   # bytes from stdin instead of a path
 ```
 
-The object enables uploads; omitting it disables them. `uploads: {}` uses the
-same defaults shown above. The owner can lower the byte limit or narrow the type
-list, but cannot exceed the hard **2 MiB** limit or enable other types. Do not
-replace the listener's other fields or share its key. Install the updated daemon
-code before enabling this policy; configuration changes then use the usual
-listener reload mechanism.
+Targets are snapshot refs (`rech snapshot`) or selectors, the same as `rech click`.
+The usual flow for a site's "add image" button is `rech snapshot`, then
+`rech upload ./shot.png --into <the button's ref>`: rech clicks it and fills the file
+chooser that opens. Run the steps in one session (`-s=<name>`) when they span
+several commands.
 
-On the **client machine**, open the website's file chooser with `rech click`, then
-send the icon through stdin in the same profile/session:
+**Types and size:** PNG, JPEG, GIF, WebP and SVG, up to **10 MiB**. Both the client
+and the host check the size, and check the bytes against the type (PNG/JPEG/GIF/WebP
+signatures; UTF-8 SVG without DTD/entities). These checks identify the format; they
+don't sanitize SVG or scan for malware. The host never renders the file.
+
+**Turning uploads on:** they are always on through the local management listener.
+On a shared (scoped) listener they are **off** until the host turns them on:
 
 ```bash
-rech --profile work -s=slack upload --name app-icon.png < ./app-icon.png
-cat ./app-icon.svg | rech --profile work -s=slack upload --name app-icon.svg
+rech listener set <listener> --uploads      # --no-uploads turns them off again
+```
+
+That writes an `uploads` object to the listener's entry in `~/.rechrome/listeners.json`.
+The host can tune it by hand, lowering the byte limit or narrowing the types, but not
+going above the 10 MiB cap or adding other types:
+
+```json
+"uploads": { "maxBytes": 2097152, "contentTypes": ["image/png", "image/jpeg"] }
 ```
 
-`--content-type image/png` or `--content-type image/svg+xml` may be specified;
-otherwise the type is inferred from `--name`. This command is stdin-only: there
-is no positional file path. The shell reads the local file; only its bytes and
-metadata are sent to the listener. Client and server both enforce the byte cap.
-The server checks PNG signatures or UTF-8 SVG markup (rejecting DTD/entities),
-and checks the type against the listener policy. These checks identify the file
-format; they do not sanitize SVG or scan for malware. The host never renders the
-file or resolves anything referenced inside it.
-
-The receiver writes a random `.png`/`.svg` filename with mode 0600 inside a private
-0700 temporary directory, outside the downloadable output tree. It passes only
-that generated path to the existing file-chooser command and removes the directory
-on success, error, or timeout. Neither filenames nor payload fields can select a
-host file. A crash or forced process kill can interrupt cleanup; the files remain
-private OS temporary files. Permission modes apply on POSIX hosts.
-
-Each upload produces one `upload:` JSON audit record with listener, profile,
-original name, byte size, SHA-256, page origin observed immediately before upload,
-and result. It contains no file contents, credentials, page path, query, or fragment.
-Requests rejected before inspection have null values for unavailable fields.
-An HTTP(S) origin must be determined before an upload is attempted. As with other
-browser commands, avoid concurrent tab navigation in the same session. Scoped
-`eval`, `run-code`, host paths, and CLI option overrides remain unavailable.
+**On the host:** the bytes are written under their original file name inside a fresh
+private temporary directory (0700, file 0600), outside the downloadable output tree,
+and the directory is removed afterwards (on success, error or timeout). Neither the
+name, the target nor any other payload field can select a host file or inject code:
+the drop/paste/input steps run as a server-built script that embeds them as JSON
+data. Each upload writes one `upload:` JSON audit record: listener, profile,
+original name, size, SHA-256, delivery mode, the page origin just before the
+upload, and the result. It never contains file contents, credentials, or the page's
+path, query or fragment. An HTTP(S) origin must be known before an upload is
+attempted. Scoped `eval`, `run-code`, host paths and CLI option overrides stay
+unavailable; enabling uploads doesn't change that.
 
 ### Remote access
 
@@ -475,7 +478,7 @@ git clone https://github.com/snomiao/rechrome.git
 cd rechrome
 bun install       # `prepare` also builds vendor/ from vendor-src/, so the checkout has a working CLI
 bun link          # makes this checkout the global rechrome / rech
-bun test ./*.test.ts ./*.spec.ts ./scripts/*.test.ts   # rechrome's own tests (plain `bun test` also finds the vendored forks' suites)
+bun run test      # rechrome's own tests (plain `bun test` also finds the vendored forks' suites)
 ```
 
 To use a different playwright-cli, set `PLAYWRIGHT_CLI=<cmd>` in `.env.local` (for example a

package/listeners.js

@@ -1,13 +1,20 @@
 // @bun
 // scoped-upload.ts
-var MAX_UPLOAD_BYTES = 2 * 1024 * 1024;
-var MAX_REQUEST_BYTES = 3 * 1024 * 1024;
-var UPLOAD_TYPES = ["image/png", "image/svg+xml"];
+var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+var MAX_REQUEST_BYTES = 14 * 1024 * 1024;
+var UPLOAD_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"];
 function validateUploadPolicy(value) {
   const p = value;
   if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
-    throw new Error("uploads must be an object with optional maxBytes (1..2097152) and contentTypes (image/png, image/svg+xml)");
-}
+    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}) and contentTypes (${UPLOAD_TYPES.join(", ")})`);
+}
+var UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read on this machine; only its bytes are sent)
+  (no flag)              the file chooser a click opened, else the page's only <input type=file>
+  --into <ref|selector>  a file input (hidden ones too), or a button that opens a file chooser
+  --drop <ref|selector>  a drag-and-drop zone
+  --paste [ref|selector] an editor that takes pasted images (default: the focused element)
+  --name <file>          read the bytes from stdin instead:  rech upload --name shot.png < shot.png
+Types: ${UPLOAD_TYPES.join(", ")}, up to ${MAX_UPLOAD_BYTES / 1024 / 1024} MiB. Get refs from rech snapshot.`;
 
 // listeners.ts
 import { isIP } from "net";
@@ -109,7 +116,7 @@ async function writeListeners(config) {
 `, { mode: 384 });
   await rename(temp, LISTENERS_FILE);
 }
-var SCOPED_COMMANDS = new Set(["open", "goto", "tab-new", "tab-list", "tab-select", "tab-close", "snapshot", "screenshot", "click", "dblclick", "fill", "type", "press", "hover", "select", "check", "uncheck", "go-back", "go-forward", "reload", "resize", "close", "fill-secret"]);
+var SCOPED_COMMANDS = new Set(["open", "goto", "tab-new", "tab-list", "tab-select", "tab-close", "snapshot", "screenshot", "click", "dblclick", "fill", "type", "press", "hover", "select", "check", "uncheck", "go-back", "go-forward", "reload", "resize", "close", "fill-secret", "console", "dialog-accept", "dialog-dismiss"]);
 function authorizeProfileRequest(listener, body) {
   if (!body || Array.isArray(body) || !body.identity || typeof body.identity.key !== "string" || !body.identity.key || !Array.isArray(body.args) || body.args.some((a) => typeof a !== "string"))
     throw new Error("Scoped requests require identity.key, identity.profile and string args");
@@ -119,9 +126,11 @@ function authorizeProfileRequest(listener, body) {
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile)
     throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (!(args[0] === "upload" && listener.uploads !== undefined) && !SCOPED_COMMANDS.has(args[0]))
+  if (args[0] === "upload" && listener.uploads === undefined)
+    throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
+  if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain=")))))
+  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain=")))))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");

package/listeners.ts

@@ -96,15 +96,17 @@ export async function writeListeners(config: ListenerConfig): Promise<void> {
 
 // Restricted listeners deliberately exclude arbitrary code, host filesystem access,
 // attachment/config overrides, and commands that manage all browser sessions.
-const SCOPED_COMMANDS = new Set(["open", "goto", "tab-new", "tab-list", "tab-select", "tab-close", "snapshot", "screenshot", "click", "dblclick", "fill", "type", "press", "hover", "select", "check", "uncheck", "go-back", "go-forward", "reload", "resize", "close", "fill-secret"]);
+const SCOPED_COMMANDS = new Set(["open", "goto", "tab-new", "tab-list", "tab-select", "tab-close", "snapshot", "screenshot", "click", "dblclick", "fill", "type", "press", "hover", "select", "check", "uncheck", "go-back", "go-forward", "reload", "resize", "close", "fill-secret", "console", "dialog-accept", "dialog-dismiss"]);
 export function authorizeProfileRequest(listener: Listener, body: any): string {
   if (!body || Array.isArray(body) || !body.identity || typeof body.identity.key !== "string" || !body.identity.key || !Array.isArray(body.args) || body.args.some((a: unknown) => typeof a !== "string")) throw new Error("Scoped requests require identity.key, identity.profile and string args");
   const profile = body.identity.profile;
   if (typeof profile !== "string" || listener.profiles === "*" || !listener.profiles.includes(profile)) throw new Error("Profile is not allowed on this listener");
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile) throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (!(args[0] === "upload" && listener.uploads !== undefined) && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
+  if (args[0] === "upload" && listener.uploads === undefined)
+    throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
+  if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
   // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
   if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.38.2",
+  "version": "1.39.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"
@@ -45,7 +45,8 @@
   "type": "module",
   "scripts": {
     "serve": "bun run rechrome.ts serve",
-    "test": "bun test",
+    "test": "bun test ./*.test.ts ./*.spec.ts ./scripts/*.test.ts",
+    "build-playwright": "bash scripts/build-playwright.sh",
     "vendor-cli": "bash scripts/vendor-cli.sh",
     "prepare": "bash scripts/vendor-cli.sh --prepare",
     "check-pack": "bash scripts/check-pack.sh",

package/rechrome.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.js";
+import { prepareUpload, UPLOAD_USAGE, MAX_UPLOAD_BYTES, type UploadPayload } from "./scoped-upload.js";
 import { readListeners, writeListeners as writeListenersFile, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener, type ListenerConfig } from "./listeners.js";
 
 import { file } from "bun";
@@ -2177,8 +2177,14 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
       process.exit(2);
     }
   } else if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
-    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
-    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(UPLOAD_USAGE); process.exit(0); }
+    try {
+      // A path argument is read here; without one the bytes come from stdin (never a terminal).
+      ({ args, upload } = await prepareUpload(args, process.stdin.isTTY ? null : process.stdin));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${UPLOAD_USAGE}`);
+      process.exit(2);
+    }
   }
   const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
   // The daemon already masks the value; this is a second line of defence for an older daemon.
@@ -3333,11 +3339,19 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void> {
   const config = await requireListeners();
-  const listener = setPublicUrl(config, name, opts.clearPublicUrl ? null : opts.publicUrl ?? null);
+  let listener = config.listeners.find(l => l.name === name);
+  if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
+  if (opts.publicUrl !== undefined || opts.clearPublicUrl) listener = setPublicUrl(config, name, opts.clearPublicUrl ? null : opts.publicUrl ?? null);
+  if (opts.uploads !== undefined) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: uploads are always on there.`);
+    // {} = the defaults (every supported image type, the full size cap); hand-tuned limits stay.
+    if (opts.uploads) listener.uploads ??= {}; else delete listener.uploads;
+  }
   await writeListeners(config);
-  console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
+  if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
+  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${(listener.uploads?.maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
 }
 
 const hideKey = (url: string) => url.replace(/([#&?]key=)[^&]*/, "$1…");
@@ -4166,9 +4180,30 @@ const selfCommand = () => [process.execPath, Bun.main];
  */
 const bridgedUrls = new Set<string>();
 
+/**
+ * RECHROME_URL may address one of this machine's own scoped listeners directly (e.g. its tailnet
+ * IP), which refuses management-only commands. Same user, same daemon: go through the loopback
+ * management listener instead. The session is unchanged, since it is keyed by identity, not by
+ * listener. HTTPS is left alone: the daemon's certificate doesn't name 127.0.0.1.
+ */
+export function preferManagementListener(url: string, config: { listeners: Listener[] } | null): string {
+  const { key, host, port, protocol } = parseUrl(url);
+  const own = config?.listeners.find(l => l.key === key);
+  const management = config?.listeners.find(l => l.profiles === "*" && isLoopback(l.host));
+  if (!key || !own || own.profiles === "*" || !management || protocol !== "http") return url;
+  if (own.host !== host.replace(/^\[|\]$/g, "") || own.port !== port) return url;
+  const source = new URL(url);
+  const next = new URL(`http://${listenerAddress(management)}${normalizePrefix(management.prefix)}`);
+  next.search = source.search;
+  const fragment = new URLSearchParams(source.hash.slice(1).replace(/^\?/, ""));
+  fragment.set("key", management.key);
+  next.hash = fragment.toString();
+  return next.toString();
+}
+
 export async function transportUrl(url: string): Promise<string> {
   const parts = shareLinkParts(url);
-  if (!parts?.webrtc) return url;
+  if (!parts?.webrtc) return preferManagementListener(url, await readListeners().catch(() => null));
   const info = await spawnBridge(parts.token, parts.origin, selfCommand());
   const bridged = new URL(`http://127.0.0.1:${info.port}/`);
   new URL(url).searchParams.forEach((v, k) => bridged.searchParams.set(k, v));
@@ -4304,7 +4339,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4446,12 +4481,13 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
       .command("deny <name> <profiles..>", "Remove profiles from a listener", y => y
         .positional("name", { type: "string", demandOption: true }).positional("profiles", { type: "string", array: true, demandOption: true }),
         a => handlers.denyListener(a.name, a.profiles))
-      .command("set <name>", "Record where a reverse proxy exposes a listener", y => y
+      .command("set <name>", "Record where a reverse proxy exposes a listener, or turn uploads on/off", y => y
         .positional("name", { type: "string", demandOption: true })
         .option("public-url", { type: "string", requiresArg: true, describe: "e.g. https://host.example.js.net/rechrome/" })
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl ? true : "Pass --public-url <url> or --clear-public-url"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl }))
+        .option("uploads", { type: "boolean", describe: "Let this listener's links upload images (rech upload); --no-uploads turns it off" })
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, or --uploads/--no-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/rechrome.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { prepareStdinUpload, type UploadPayload } from "./scoped-upload.ts";
+import { prepareUpload, UPLOAD_USAGE, MAX_UPLOAD_BYTES, type UploadPayload } from "./scoped-upload.ts";
 import { readListeners, writeListeners as writeListenersFile, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener, type ListenerConfig } from "./listeners.ts";
 
 import { file } from "bun";
@@ -2177,8 +2177,14 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
       process.exit(2);
     }
   } else if (args.find(a => !/^-s=[a-zA-Z0-9_-]{1,64}$/.test(a)) === "upload") {
-    if (process.stdin.isTTY) throw new Error("upload reads stdin; redirect a PNG/SVG file with < icon.png");
-    ({ args, upload } = await prepareStdinUpload(args, process.stdin));
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(UPLOAD_USAGE); process.exit(0); }
+    try {
+      // A path argument is read here; without one the bytes come from stdin (never a terminal).
+      ({ args, upload } = await prepareUpload(args, process.stdin.isTTY ? null : process.stdin));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${UPLOAD_USAGE}`);
+      process.exit(2);
+    }
   }
   const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
   // The daemon already masks the value; this is a second line of defence for an older daemon.
@@ -3333,11 +3339,19 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void> {
   const config = await requireListeners();
-  const listener = setPublicUrl(config, name, opts.clearPublicUrl ? null : opts.publicUrl ?? null);
+  let listener = config.listeners.find(l => l.name === name);
+  if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
+  if (opts.publicUrl !== undefined || opts.clearPublicUrl) listener = setPublicUrl(config, name, opts.clearPublicUrl ? null : opts.publicUrl ?? null);
+  if (opts.uploads !== undefined) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: uploads are always on there.`);
+    // {} = the defaults (every supported image type, the full size cap); hand-tuned limits stay.
+    if (opts.uploads) listener.uploads ??= {}; else delete listener.uploads;
+  }
   await writeListeners(config);
-  console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
+  if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
+  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${(listener.uploads?.maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
 }
 
 const hideKey = (url: string) => url.replace(/([#&?]key=)[^&]*/, "$1…");
@@ -4166,9 +4180,30 @@ const selfCommand = () => [process.execPath, Bun.main];
  */
 const bridgedUrls = new Set<string>();
 
+/**
+ * RECHROME_URL may address one of this machine's own scoped listeners directly (e.g. its tailnet
+ * IP), which refuses management-only commands. Same user, same daemon: go through the loopback
+ * management listener instead. The session is unchanged, since it is keyed by identity, not by
+ * listener. HTTPS is left alone: the daemon's certificate doesn't name 127.0.0.1.
+ */
+export function preferManagementListener(url: string, config: { listeners: Listener[] } | null): string {
+  const { key, host, port, protocol } = parseUrl(url);
+  const own = config?.listeners.find(l => l.key === key);
+  const management = config?.listeners.find(l => l.profiles === "*" && isLoopback(l.host));
+  if (!key || !own || own.profiles === "*" || !management || protocol !== "http") return url;
+  if (own.host !== host.replace(/^\[|\]$/g, "") || own.port !== port) return url;
+  const source = new URL(url);
+  const next = new URL(`http://${listenerAddress(management)}${normalizePrefix(management.prefix)}`);
+  next.search = source.search;
+  const fragment = new URLSearchParams(source.hash.slice(1).replace(/^\?/, ""));
+  fragment.set("key", management.key);
+  next.hash = fragment.toString();
+  return next.toString();
+}
+
 export async function transportUrl(url: string): Promise<string> {
   const parts = shareLinkParts(url);
-  if (!parts?.webrtc) return url;
+  if (!parts?.webrtc) return preferManagementListener(url, await readListeners().catch(() => null));
   const info = await spawnBridge(parts.token, parts.origin, selfCommand());
   const bridged = new URL(`http://127.0.0.1:${info.port}/`);
   new URL(url).searchParams.forEach((v, k) => bridged.searchParams.set(k, v));
@@ -4304,7 +4339,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4446,12 +4481,13 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
       .command("deny <name> <profiles..>", "Remove profiles from a listener", y => y
         .positional("name", { type: "string", demandOption: true }).positional("profiles", { type: "string", array: true, demandOption: true }),
         a => handlers.denyListener(a.name, a.profiles))
-      .command("set <name>", "Record where a reverse proxy exposes a listener", y => y
+      .command("set <name>", "Record where a reverse proxy exposes a listener, or turn uploads on/off", y => y
         .positional("name", { type: "string", demandOption: true })
         .option("public-url", { type: "string", requiresArg: true, describe: "e.g. https://host.example.ts.net/rechrome/" })
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl ? true : "Pass --public-url <url> or --clear-public-url"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl }))
+        .option("uploads", { type: "boolean", describe: "Let this listener's links upload images (rech upload); --no-uploads turns it off" })
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, or --uploads/--no-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),