rechrome 1.39.1 → 1.40.0

package/README.md

@@ -386,14 +386,30 @@ and the host check the size, and check the bytes against the type (PNG/JPEG/GIF/
 signatures; UTF-8 SVG without DTD/entities). These checks identify the format; they
 don't sanitize SVG or scan for malware. The host never renders the file.
 
-**Turning uploads on:** they are always on through the local management listener.
-On a shared (scoped) listener they are **off** until the host turns them on:
+**On by default:** uploads are on for every listener, shared ones too. The client
+reads the file and sends only its bytes, and the host never reads a path for an
+upload, so a link holder can only upload files they already have. Each upload is
+logged in the daemon log with its name, size, sha256 and the page's origin. The
+host can turn them off for a shared listener:
 
 ```bash
-rech listener set <listener> --uploads      # --no-uploads turns them off again
+rech listener set <listener> --no-uploads   # writes "uploads": false; --uploads turns them on again
 ```
 
-That writes an `uploads` object to the listener's entry in `~/.rechrome/listeners.json`.
+**Files already on the host (opt-in):** off by default. The host can let a shared
+listener's links upload files that are already on the host, but only from
+directories it names:
+
+```bash
+rech listener set <listener> --host-upload-dir ~/shots   # repeatable; --no-host-uploads turns it off
+rech upload --host /Users/me/shots/a.png                  # on the client: sends the path, not bytes
+```
+
+The host resolves symlinks and refuses anything outside those directories, anything
+that isn't a regular file, and anything over the size cap. The log line also records
+the host path.
+
+An `uploads` object in the listener's entry in `~/.rechrome/listeners.json` sets limits.
 The host can tune it by hand, lowering the byte limit or narrowing the types, but not
 going above the 10 MiB cap or adding other types:
 

package/fill-secret.js

@@ -7,6 +7,8 @@ import { homedir } from "os";
 import { join } from "path";
 var SECRET_MASK = "***";
 var SECRET_MASK_TTL_MS = 15 * 60000;
+var MIN_MASK_LENGTH = 6;
+var maskable = (value) => !!value && value.length >= MIN_MASK_LENGTH;
 var FILL_SECRET_USAGE = `Usage: rech fill-secret <ref> (--from-env VAR | --from-stdin | --totp-from-env VAR | --totp-from-stdin)
                          [--env-file <path>] [--allow-domain <glob>]... [--submit]
   Fills <ref> (from \`rech snapshot\`) with a secret the daemon never logs or echoes.
@@ -211,7 +213,7 @@ class SecretMasker {
     this.now = now;
   }
   add(value, ttlMs = this.ttlMs) {
-    if (value)
+    if (maskable(value))
       this.values.set(value, this.now() + ttlMs);
   }
   get active() {
@@ -378,6 +380,7 @@ function maskPasswordLines(text) {
 }
 export {
   FILL_SECRET_USAGE,
+  MIN_MASK_LENGTH,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
@@ -390,6 +393,7 @@ export {
   hasSnapshot,
   hostAllowed,
   maskPasswordLines,
+  maskable,
   parseDotenv,
   parseFillSecretArgs,
   parseFillSecretWire,

package/fill-secret.ts

@@ -19,6 +19,11 @@ import { join } from "path";
 
 export const SECRET_MASK = "***";
 export const SECRET_MASK_TTL_MS = 15 * 60_000;
+/** Shorter values are never masked: masking "1" everywhere would turn every 1 in every output
+ *  into ***, corrupting ids and refs for the daemon's lifetime. A TOTP code (6 digits) still is.
+ *  The fill-secret command's own output is still scrubbed of its value, whatever the length. */
+export const MIN_MASK_LENGTH = 6;
+export const maskable = (value: string | undefined | null): value is string => !!value && value.length >= MIN_MASK_LENGTH;
 
 // ---------- client side ----------
 
@@ -233,7 +238,7 @@ export function buildFillCode(ref: string, value: string, allowDomains: string[]
 export class SecretMasker {
   private values = new Map<string, number>();
   constructor(private ttlMs = SECRET_MASK_TTL_MS, private now = () => Date.now()) {}
-  add(value: string, ttlMs = this.ttlMs) { if (value) this.values.set(value, this.now() + ttlMs); }
+  add(value: string, ttlMs = this.ttlMs) { if (maskable(value)) this.values.set(value, this.now() + ttlMs); }
   get active(): boolean { this.prune(); return this.values.size > 0; }
   mask(text: string): string {
     if (!text) return text;

package/listeners.js

@@ -1,12 +1,13 @@
 // @bun
 // scoped-upload.ts
+import { basename, join, isAbsolute, sep } from "path";
 var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
 var MAX_REQUEST_BYTES = 14 * 1024 * 1024;
 var UPLOAD_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"];
 function validateUploadPolicy(value) {
   const p = value;
-  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
-    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}) and contentTypes (${UPLOAD_TYPES.join(", ")})`);
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes", "hostDirs"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))) || p.hostDirs !== undefined && (!Array.isArray(p.hostDirs) || !p.hostDirs.length || p.hostDirs.some((d) => typeof d !== "string" || !isAbsolute(d) || d.includes("\x00") || d === sep)))
+    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}), contentTypes (${UPLOAD_TYPES.join(", ")}) and hostDirs (absolute directories, not /)`);
 }
 var UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read on this machine; only its bytes are sent)
   (no flag)              the file chooser a click opened, else the page's only <input type=file>
@@ -14,16 +15,17 @@ var UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read on this
   --drop <ref|selector>  a drag-and-drop zone
   --paste [ref|selector] an editor that takes pasted images (default: the focused element)
   --name <file>          read the bytes from stdin instead:  rech upload --name shot.png < shot.png
+  --host <path>          a file already on the host (only where its listener allows that directory)
 Types: ${UPLOAD_TYPES.join(", ")}, up to ${MAX_UPLOAD_BYTES / 1024 / 1024} MiB. Get refs from rech snapshot.`;
 
 // listeners.ts
 import { isIP } from "net";
 import { createHash, randomBytes } from "crypto";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 var MAX_RETIRED_PORTS = 32;
-var LISTENERS_FILE = join(homedir(), ".rechrome", "listeners.json");
+var LISTENERS_FILE = join2(homedir(), ".rechrome", "listeners.json");
 var isLoopback = (host) => host === "::1" || /^127\./.test(host);
 var listenerAddress = (l) => `${l.host.includes(":") ? `[${l.host}]` : l.host}:${l.port}`;
 var profileOutputPrefix = (profile) => `profiles/${createHash("sha256").update(profile).digest("hex")}/`;
@@ -72,7 +74,7 @@ function validateListeners(value) {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some((p) => typeof p !== "string" || !p.trim() || p.includes("\x00") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
-    if (l.uploads !== undefined)
+    if (l.uploads !== undefined && l.uploads !== false)
       validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
@@ -110,7 +112,7 @@ async function writeListeners(config) {
     config.retiredPorts = retired;
   else
     delete config.retiredPorts;
-  await mkdir(join(homedir(), ".rechrome"), { recursive: true });
+  await mkdir(join2(homedir(), ".rechrome"), { recursive: true });
   const temp = `${LISTENERS_FILE}.${randomBytes(6).toString("hex")}.tmp`;
   await writeFile(temp, JSON.stringify(config, null, 2) + `
 `, { mode: 384 });
@@ -126,7 +128,7 @@ function authorizeProfileRequest(listener, body) {
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile)
     throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (args[0] === "upload" && listener.uploads === undefined)
+  if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");

package/listeners.ts

@@ -6,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false };
 // retiredPorts: ports of removed listeners, newest last. New listeners skip them so a link
 // saved for a removed listener gets "connection refused", not some other listener's answer.
 export type ListenerConfig = { version: 1; listeners: Listener[]; retiredPorts?: number[] };
@@ -58,7 +58,9 @@ export function validateListeners(value: unknown): ListenerConfig {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some(p => typeof p !== "string" || !p.trim() || p.includes("\0") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
-    if (l.uploads !== undefined) validateUploadPolicy(l.uploads);
+    // Uploads are on unless set to false: the client sends file bytes it already has, and the
+    // host never reads a path for them.
+    if (l.uploads !== undefined && l.uploads !== false) validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -103,7 +105,7 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
   if (typeof profile !== "string" || listener.profiles === "*" || !listener.profiles.includes(profile)) throw new Error("Profile is not allowed on this listener");
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile) throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (args[0] === "upload" && listener.uploads === undefined)
+  if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
   if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.39.1",
+  "version": "1.40.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -7,7 +7,7 @@ import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
 import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
+import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
@@ -16,7 +16,7 @@ import { createRequire } from "node:module";
 import { spawn as cpSpawn } from "child_process";
 import { readFile, writeFile, rename, chmod, mkdir, stat } from "node:fs/promises";
 import { isDeprecatedPm2Fallback, listsProcess, oxmgrInstallCommand, pickDaemonManager, PM2_DEPRECATION, type DaemonManager } from "./daemon-manager.js";
-import { DEFAULT_SIGNAL, WEBRTC, createShare, findDevice, findShare, inviteLink, inviteProblem, parseDuration, readShares, updateShares, type Share } from "./shares.js";
+import { DEFAULT_SIGNAL, WEBRTC, createShare, normalizeSignal, findDevice, findShare, inviteLink, inviteProblem, parseDuration, readShares, updateShares, type Share } from "./shares.js";
 import { bearerOf, looksLikeToken, newToken, parseToken, redactSecrets } from "./secret.js";
 import { WebrtcClient, loadRTC, runBridge, spawnBridge } from "./webrtc.js";
 import { startSignalRelay } from "./signal-relay.js";
@@ -2240,9 +2240,8 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     // Saved files belong to the project: <project>/.rechrome/output. The folder also holds
     // .env.local (secrets), so it is git-ignored as a whole when first created.
     const dlDir = join(identity.dataDir, "output");
+    await ensureProjectDir(identity.dataDir);
     mkdirSync(dlDir, { recursive: true });
-    const gitignorePath = join(identity.dataDir, ".gitignore");
-    if (!existsSync(gitignorePath)) await Bun.write(gitignorePath, "*\n");
     for (const name of files) {
       const fileRes = await fetch(serviceUrl(url, `files/${name}`), {
         headers: { Authorization: `Bearer ${parseUrl(url).key}` },
@@ -3339,7 +3338,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3347,11 +3346,23 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
   if (opts.uploads !== undefined) {
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: uploads are always on there.`);
     // {} = the defaults (every supported image type, the full size cap); hand-tuned limits stay.
-    if (opts.uploads) listener.uploads ??= {}; else delete listener.uploads;
+    if (opts.uploads) listener.uploads = listener.uploads || {}; else listener.uploads = false;
+  }
+  if (opts.hostUploadDirs?.length || opts.noHostUploads) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener; host-path uploads are set on shared listeners.`);
+    if (listener.uploads === false) throw new Error(`Uploads are off on "${name}"; turn them on first: rech listener set ${name} --uploads`);
+    const policy = listener.uploads ?? {};
+    if (opts.noHostUploads) delete policy.hostDirs;
+    else policy.hostDirs = [...new Set([...(policy.hostDirs ?? []), ...opts.hostUploadDirs!.map(d => realpathSync(resolve(d)))])];
+    listener.uploads = policy;
   }
   await writeListeners(config);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
-  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${(listener.uploads?.maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
+  if (opts.hostUploadDirs?.length || opts.noHostUploads) {
+    const dirs = (listener.uploads || {}).hostDirs;
+    console.log(dirs?.length ? `${name}: host-path uploads allowed from ${dirs.join(", ")} (rech upload --host <path>; each is logged)` : `${name}: host-path uploads off`);
+  }
+  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${((listener.uploads || {}).maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
 }
 
 const hideKey = (url: string) => url.replace(/([#&?]key=)[^&]*/, "$1…");
@@ -3406,9 +3417,7 @@ async function warnSecretFile(path: string | undefined): Promise<void> {
 /** Write RECHROME_URL to this project's .rechrome/.env.local (the folder git-ignores itself). */
 async function saveProjectUrl(url: string): Promise<string> {
   const { dataDir } = await getClientIdentity();
-  mkdirSync(dataDir, { recursive: true });
-  const gitignore = join(dataDir, ".gitignore");
-  if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
+  await ensureProjectDir(dataDir);
   return writeEnvUrl(join(dataDir, ".env.local"), url);
 }
 
@@ -3419,10 +3428,45 @@ async function saveGlobalUrl(url: string): Promise<string> {
 }
 
 /** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
+/** Write a file whole or not at all: a temp file beside it, then rename (atomic on one filesystem). */
+export async function writeAtomic(path: string, data: string, mode?: number): Promise<void> {
+  // A symlinked .env.local stays a link: write the file it points to.
+  // Follow links by hand: realpath fails on a dangling one, whose target we still create.
+  for (let hops = 0; hops < 8; hops++) {
+    let target: string;
+    try { target = readlinkSync(path); } catch { break; } // not a link, or not there yet
+    path = resolve(dirname(path), target);
+  }
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, data, mode === undefined ? {} : { mode });
+    if (mode !== undefined) await chmod(tmp, mode);
+    renameSync(tmp, path);
+  } catch (error) { try { unlinkSync(tmp); } catch { /* never written */ } throw error; }
+}
+
+export const PROJECT_DIR_README = `# .rechrome/
+
+rech's state for this project (like .git/). It ignores itself: see .gitignore.
+
+- .env.local  RECHROME_URL for this project. Holds a key: keep it private.
+- output/     files rech commands saved (screenshots, snapshots, downloads).
+
+Safe to delete; rech recreates it. More: https://github.com/snomiao/rechrome
+`;
+
+/** Create <project>/.rechrome with its .gitignore ("*") and README, so a key in it is never committed. */
+export async function ensureProjectDir(dir: string): Promise<void> {
+  mkdirSync(dir, { recursive: true });
+  const gitignore = join(dir, ".gitignore");
+  if (!existsSync(gitignore)) await writeAtomic(gitignore, "*\n");
+  const readme = join(dir, "README.md");
+  if (!existsSync(readme)) await writeAtomic(readme, PROJECT_DIR_README);
+}
+
 async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
-  await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
-  await chmod(envPath, 0o600);
+  await writeAtomic(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), 0o600);
   await recordSavedLink(envPath).catch(() => {}); // only bookkeeping for later warnings
   return envPath;
 }
@@ -3644,18 +3688,10 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   const scheme = previous.protocol;
   let url = `${scheme}://${management.key}@${listenerAddress(management)}${normalizePrefix(management.prefix)}`;
   const { host, port, protocol, key: serveKey } = parseUrl(url);
+  // Connect the profile locally first; who else may reach it is asked at the end (setupShareStep),
+  // once the bridge works. --listen still picks the exposure up front, for scripts.
   let desiredBind = management.host;
   if (opts.listen) desiredBind = chooseListenAddress(listenChoices, opts.listen);
-  else if (isTTY) {
-    console.log("\n      Where should this profile be accessible? (Other profiles keep their listeners.)");
-    listenChoices.forEach((choice, index) => console.log(`        ${index + 1}. ${choice.label} — ${choice.address}`));
-    while (true) {
-      const answer = (await ask("      Choice [1]: ", "1")).trim();
-      const choice = /^\d+$/.test(answer) ? listenChoices[Number(answer) - 1] : undefined;
-      if (choice) { desiredBind = choice.address; break; }
-      console.log("      Enter one of the numbers shown above.");
-    }
-  }
   const pingManagement = () => fetch(serviceUrl(url, "ping"), {
     headers: { Authorization: `Bearer ${serveKey}` }, signal: AbortSignal.timeout(2000),
   }).then(async r => r.ok && (await r.json()).multiListener === true).catch(() => false);
@@ -3894,7 +3930,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   )).trim();
   if (saveChoice !== "4") {
     const globalEnvPath = saveChoice === "3" ? homeEnvPath : saveChoice === "2" ? pwdRechPath : pwdEnvPath;
-    if (saveChoice === "2") mkdirSync(join(process.cwd(), ".rechrome"), { recursive: true });
+    if (saveChoice === "2") await ensureProjectDir(join(process.cwd(), ".rechrome"));
     const existedBefore = await file(globalEnvPath).exists();
     const existing = await file(globalEnvPath).text().catch(() => "");
     const keysToRemove = ["PLAYWRIGHT_MCP_USER_DATA_DIR", "PLAYWRIGHT_MCP_EXTENSION_ID", "PLAYWRIGHT_MCP_EXTENSION_TOKEN", "PLAYWRIGHT_MCP_PROFILE_DIRECTORY"];
@@ -3902,7 +3938,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     const rechIdx = lines.findIndex(l => l.startsWith("RECHROME_URL="));
     if (rechIdx >= 0) lines[rechIdx] = newLine;
     else lines.push(newLine);
-    await Bun.write(globalEnvPath, lines.join("\n").trim() + "\n");
+    await writeAtomic(globalEnvPath, lines.join("\n").trim() + "\n", 0o600);
     console.log(`\n${existedBefore ? "Updated" : "Created"} ${globalEnvPath}`);
   }
 
@@ -3938,6 +3974,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
+  if (bridgeVerified && isTTY && !opts.listen) await setupShareStep(ask, profileEmail);
   rl?.close();
   envWatcher?.close();
   if (bridgeVerified)
@@ -3946,6 +3983,70 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     console.error(`\nSetup was saved, but the selected profile did not pass the bridge check. Reload the extension at chrome://extensions and run \`rech setup --profile ${profileEmail}\` again.`);
 }
 
+const SIGNAL_SELFHOST_DOC = "https://github.com/snomiao/rechrome/blob/main/docs/signal-selfhost.md";
+
+/** The menu of setupShareStep: existing listeners first, then the new kinds. */
+export function shareMenu(listeners: Listener[], choices: ListenChoice[]): { key: string; label: string; listener?: string; kind?: "lan" | "tailscale" | "webrtc" | "webrtc-own" }[] {
+  const menu: ReturnType<typeof shareMenu> = [{ key: "1", label: "Don't add sharing (local access is always on; existing shares stay: rech share ls)" }];
+  for (const l of listeners.filter(l => l.profiles !== "*"))
+    menu.push({ key: String(menu.length + 1), label: `Existing listener "${l.name}" (${listenerAddress(l)}${l.publicUrl ? `, ${l.publicUrl}` : ""})`, listener: l.name });
+  const has = (k: string) => choices.some(c => c.kind === k);
+  if (has("lan")) menu.push({ key: String(menu.length + 1), label: "New: LAN (machines on this network)", kind: "lan" });
+  if (has("tailscale")) menu.push({ key: String(menu.length + 1), label: "New: Tailscale only (your tailnet)", kind: "tailscale" });
+  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via rechrome.pages.dev (works across networks, nothing to run)", kind: "webrtc" });
+  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via your own signal server (and TURN)", kind: "webrtc-own" });
+  return menu;
+}
+
+/** setup's last step: once the profile works here, offer to share it with other machines. */
+async function setupShareStep(ask: (q: string, def?: string) => Promise<string>, profile: string): Promise<void> {
+  const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+  const choices = await detectListenChoices();
+  const menu = shareMenu(listeners, choices);
+  console.log(`\n○ Share ${profile} with other machines?`);
+  for (const m of menu) console.log(`        ${m.key}. ${m.label}`);
+  let pick: (typeof menu)[number] | undefined;
+  while (!pick) {
+    const answer = (await ask("      Choice [1]: ", "1")).trim();
+    pick = menu.find(m => m.key === answer);
+    if (!pick) console.log("      Enter one of the numbers shown above.");
+  }
+  try {
+    if (pick.key === "1") { console.log("✓ Not shared. Later: rech share new " + JSON.stringify(profile)); return; }
+    if (pick.listener) {
+      const config = await requireListeners();
+      allowProfiles(config, pick.listener, [profile]);
+      await writeListeners(config);
+      await printProfileUri(profile, pick.listener);
+      return;
+    }
+    if (pick.kind === "tailscale") {
+      const dns = (JSON.parse(await runTailscale(["status", "--json"]) ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "");
+      if (!dns?.endsWith(".js.net")) console.log(`      ! Tailscale's hostname is ${dns ? `"${dns}", not under ts.net` : "unknown (is tailscale up?)"}; the link uses the tailnet IP.`);
+      else console.log(`      Tailscale hostname: ${dns}`);
+    }
+    let signal: string | undefined;
+    if (pick.kind === "webrtc-own") {
+      console.log(`\n      Run a signal server, then paste its URL here:`);
+      console.log(`        1. Read ${SIGNAL_SELFHOST_DOC}`);
+      console.log(`           (A: Cloudflare Workers is the easiest; C: Tailscale Funnel needs no domain).`);
+      console.log(`        2. Deploy it and open its URL in a browser to check that it answers.`);
+      console.log(`        3. For TURN (strict NATs), set CF_TURN_KEY_ID and CF_TURN_API_TOKEN in the daemon's env (see "TURN" in that doc).`);
+      while (!signal) {
+        const raw = (await ask("      Signal server URL (empty: cancel): ")).trim();
+        if (!raw) { console.log("      Not shared. Later: rech share new <profile> --signal <url>"); return; }
+        try { signal = normalizeSignal(raw); } catch (error) { console.log(`      ${error instanceof Error ? error.message : error}`); continue; }
+        const ok = await fetch(signal, { signal: AbortSignal.timeout(5000) }).then(() => true).catch(() => false);
+        if (!ok) console.log(`      ! ${signal} did not answer; the share is made anyway, check the server before sending the link.`);
+      }
+    }
+    const via = pick.kind === "webrtc" || pick.kind === "webrtc-own" ? WEBRTC : pick.kind!;
+    await shareNew([profile], { via: [via], ...(signal ? { signal } : {}) });
+  } catch (error) {
+    console.error(`      Sharing failed: ${error instanceof Error ? error.message : error}. Setup itself is saved; retry with rech share new ${JSON.stringify(profile)}.`);
+  }
+}
+
 // ---- shares: invite links, devices, transports (see shares.js) ----------------------------
 
 const fmtDate = (ms?: number) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "-";
@@ -4339,7 +4440,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4485,9 +4586,11 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .positional("name", { type: "string", demandOption: true })
         .option("public-url", { type: "string", requiresArg: true, describe: "e.g. https://host.example.js.net/rechrome/" })
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
-        .option("uploads", { type: "boolean", describe: "Let this listener's links upload images (rech upload); --no-uploads turns it off" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, or --uploads/--no-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}) }))
+        .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
+        .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
+        .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/rechrome.ts

@@ -7,7 +7,7 @@ import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.ts";
 import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
+import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
@@ -16,7 +16,7 @@ import { createRequire } from "node:module";
 import { spawn as cpSpawn } from "child_process";
 import { readFile, writeFile, rename, chmod, mkdir, stat } from "node:fs/promises";
 import { isDeprecatedPm2Fallback, listsProcess, oxmgrInstallCommand, pickDaemonManager, PM2_DEPRECATION, type DaemonManager } from "./daemon-manager.ts";
-import { DEFAULT_SIGNAL, WEBRTC, createShare, findDevice, findShare, inviteLink, inviteProblem, parseDuration, readShares, updateShares, type Share } from "./shares.ts";
+import { DEFAULT_SIGNAL, WEBRTC, createShare, normalizeSignal, findDevice, findShare, inviteLink, inviteProblem, parseDuration, readShares, updateShares, type Share } from "./shares.ts";
 import { bearerOf, looksLikeToken, newToken, parseToken, redactSecrets } from "./secret.ts";
 import { WebrtcClient, loadRTC, runBridge, spawnBridge } from "./webrtc.ts";
 import { startSignalRelay } from "./signal-relay.ts";
@@ -2240,9 +2240,8 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     // Saved files belong to the project: <project>/.rechrome/output. The folder also holds
     // .env.local (secrets), so it is git-ignored as a whole when first created.
     const dlDir = join(identity.dataDir, "output");
+    await ensureProjectDir(identity.dataDir);
     mkdirSync(dlDir, { recursive: true });
-    const gitignorePath = join(identity.dataDir, ".gitignore");
-    if (!existsSync(gitignorePath)) await Bun.write(gitignorePath, "*\n");
     for (const name of files) {
       const fileRes = await fetch(serviceUrl(url, `files/${name}`), {
         headers: { Authorization: `Bearer ${parseUrl(url).key}` },
@@ -3339,7 +3338,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3347,11 +3346,23 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
   if (opts.uploads !== undefined) {
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: uploads are always on there.`);
     // {} = the defaults (every supported image type, the full size cap); hand-tuned limits stay.
-    if (opts.uploads) listener.uploads ??= {}; else delete listener.uploads;
+    if (opts.uploads) listener.uploads = listener.uploads || {}; else listener.uploads = false;
+  }
+  if (opts.hostUploadDirs?.length || opts.noHostUploads) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener; host-path uploads are set on shared listeners.`);
+    if (listener.uploads === false) throw new Error(`Uploads are off on "${name}"; turn them on first: rech listener set ${name} --uploads`);
+    const policy = listener.uploads ?? {};
+    if (opts.noHostUploads) delete policy.hostDirs;
+    else policy.hostDirs = [...new Set([...(policy.hostDirs ?? []), ...opts.hostUploadDirs!.map(d => realpathSync(resolve(d)))])];
+    listener.uploads = policy;
   }
   await writeListeners(config);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
-  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${(listener.uploads?.maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
+  if (opts.hostUploadDirs?.length || opts.noHostUploads) {
+    const dirs = (listener.uploads || {}).hostDirs;
+    console.log(dirs?.length ? `${name}: host-path uploads allowed from ${dirs.join(", ")} (rech upload --host <path>; each is logged)` : `${name}: host-path uploads off`);
+  }
+  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${((listener.uploads || {}).maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
 }
 
 const hideKey = (url: string) => url.replace(/([#&?]key=)[^&]*/, "$1…");
@@ -3406,9 +3417,7 @@ async function warnSecretFile(path: string | undefined): Promise<void> {
 /** Write RECHROME_URL to this project's .rechrome/.env.local (the folder git-ignores itself). */
 async function saveProjectUrl(url: string): Promise<string> {
   const { dataDir } = await getClientIdentity();
-  mkdirSync(dataDir, { recursive: true });
-  const gitignore = join(dataDir, ".gitignore");
-  if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
+  await ensureProjectDir(dataDir);
   return writeEnvUrl(join(dataDir, ".env.local"), url);
 }
 
@@ -3419,10 +3428,45 @@ async function saveGlobalUrl(url: string): Promise<string> {
 }
 
 /** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
+/** Write a file whole or not at all: a temp file beside it, then rename (atomic on one filesystem). */
+export async function writeAtomic(path: string, data: string, mode?: number): Promise<void> {
+  // A symlinked .env.local stays a link: write the file it points to.
+  // Follow links by hand: realpath fails on a dangling one, whose target we still create.
+  for (let hops = 0; hops < 8; hops++) {
+    let target: string;
+    try { target = readlinkSync(path); } catch { break; } // not a link, or not there yet
+    path = resolve(dirname(path), target);
+  }
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, data, mode === undefined ? {} : { mode });
+    if (mode !== undefined) await chmod(tmp, mode);
+    renameSync(tmp, path);
+  } catch (error) { try { unlinkSync(tmp); } catch { /* never written */ } throw error; }
+}
+
+export const PROJECT_DIR_README = `# .rechrome/
+
+rech's state for this project (like .git/). It ignores itself: see .gitignore.
+
+- .env.local  RECHROME_URL for this project. Holds a key: keep it private.
+- output/     files rech commands saved (screenshots, snapshots, downloads).
+
+Safe to delete; rech recreates it. More: https://github.com/snomiao/rechrome
+`;
+
+/** Create <project>/.rechrome with its .gitignore ("*") and README, so a key in it is never committed. */
+export async function ensureProjectDir(dir: string): Promise<void> {
+  mkdirSync(dir, { recursive: true });
+  const gitignore = join(dir, ".gitignore");
+  if (!existsSync(gitignore)) await writeAtomic(gitignore, "*\n");
+  const readme = join(dir, "README.md");
+  if (!existsSync(readme)) await writeAtomic(readme, PROJECT_DIR_README);
+}
+
 async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
-  await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
-  await chmod(envPath, 0o600);
+  await writeAtomic(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), 0o600);
   await recordSavedLink(envPath).catch(() => {}); // only bookkeeping for later warnings
   return envPath;
 }
@@ -3644,18 +3688,10 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   const scheme = previous.protocol;
   let url = `${scheme}://${management.key}@${listenerAddress(management)}${normalizePrefix(management.prefix)}`;
   const { host, port, protocol, key: serveKey } = parseUrl(url);
+  // Connect the profile locally first; who else may reach it is asked at the end (setupShareStep),
+  // once the bridge works. --listen still picks the exposure up front, for scripts.
   let desiredBind = management.host;
   if (opts.listen) desiredBind = chooseListenAddress(listenChoices, opts.listen);
-  else if (isTTY) {
-    console.log("\n      Where should this profile be accessible? (Other profiles keep their listeners.)");
-    listenChoices.forEach((choice, index) => console.log(`        ${index + 1}. ${choice.label} — ${choice.address}`));
-    while (true) {
-      const answer = (await ask("      Choice [1]: ", "1")).trim();
-      const choice = /^\d+$/.test(answer) ? listenChoices[Number(answer) - 1] : undefined;
-      if (choice) { desiredBind = choice.address; break; }
-      console.log("      Enter one of the numbers shown above.");
-    }
-  }
   const pingManagement = () => fetch(serviceUrl(url, "ping"), {
     headers: { Authorization: `Bearer ${serveKey}` }, signal: AbortSignal.timeout(2000),
   }).then(async r => r.ok && (await r.json()).multiListener === true).catch(() => false);
@@ -3894,7 +3930,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   )).trim();
   if (saveChoice !== "4") {
     const globalEnvPath = saveChoice === "3" ? homeEnvPath : saveChoice === "2" ? pwdRechPath : pwdEnvPath;
-    if (saveChoice === "2") mkdirSync(join(process.cwd(), ".rechrome"), { recursive: true });
+    if (saveChoice === "2") await ensureProjectDir(join(process.cwd(), ".rechrome"));
     const existedBefore = await file(globalEnvPath).exists();
     const existing = await file(globalEnvPath).text().catch(() => "");
     const keysToRemove = ["PLAYWRIGHT_MCP_USER_DATA_DIR", "PLAYWRIGHT_MCP_EXTENSION_ID", "PLAYWRIGHT_MCP_EXTENSION_TOKEN", "PLAYWRIGHT_MCP_PROFILE_DIRECTORY"];
@@ -3902,7 +3938,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     const rechIdx = lines.findIndex(l => l.startsWith("RECHROME_URL="));
     if (rechIdx >= 0) lines[rechIdx] = newLine;
     else lines.push(newLine);
-    await Bun.write(globalEnvPath, lines.join("\n").trim() + "\n");
+    await writeAtomic(globalEnvPath, lines.join("\n").trim() + "\n", 0o600);
     console.log(`\n${existedBefore ? "Updated" : "Created"} ${globalEnvPath}`);
   }
 
@@ -3938,6 +3974,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
+  if (bridgeVerified && isTTY && !opts.listen) await setupShareStep(ask, profileEmail);
   rl?.close();
   envWatcher?.close();
   if (bridgeVerified)
@@ -3946,6 +3983,70 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     console.error(`\nSetup was saved, but the selected profile did not pass the bridge check. Reload the extension at chrome://extensions and run \`rech setup --profile ${profileEmail}\` again.`);
 }
 
+const SIGNAL_SELFHOST_DOC = "https://github.com/snomiao/rechrome/blob/main/docs/signal-selfhost.md";
+
+/** The menu of setupShareStep: existing listeners first, then the new kinds. */
+export function shareMenu(listeners: Listener[], choices: ListenChoice[]): { key: string; label: string; listener?: string; kind?: "lan" | "tailscale" | "webrtc" | "webrtc-own" }[] {
+  const menu: ReturnType<typeof shareMenu> = [{ key: "1", label: "Don't add sharing (local access is always on; existing shares stay: rech share ls)" }];
+  for (const l of listeners.filter(l => l.profiles !== "*"))
+    menu.push({ key: String(menu.length + 1), label: `Existing listener "${l.name}" (${listenerAddress(l)}${l.publicUrl ? `, ${l.publicUrl}` : ""})`, listener: l.name });
+  const has = (k: string) => choices.some(c => c.kind === k);
+  if (has("lan")) menu.push({ key: String(menu.length + 1), label: "New: LAN (machines on this network)", kind: "lan" });
+  if (has("tailscale")) menu.push({ key: String(menu.length + 1), label: "New: Tailscale only (your tailnet)", kind: "tailscale" });
+  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via rechrome.pages.dev (works across networks, nothing to run)", kind: "webrtc" });
+  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via your own signal server (and TURN)", kind: "webrtc-own" });
+  return menu;
+}
+
+/** setup's last step: once the profile works here, offer to share it with other machines. */
+async function setupShareStep(ask: (q: string, def?: string) => Promise<string>, profile: string): Promise<void> {
+  const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+  const choices = await detectListenChoices();
+  const menu = shareMenu(listeners, choices);
+  console.log(`\n○ Share ${profile} with other machines?`);
+  for (const m of menu) console.log(`        ${m.key}. ${m.label}`);
+  let pick: (typeof menu)[number] | undefined;
+  while (!pick) {
+    const answer = (await ask("      Choice [1]: ", "1")).trim();
+    pick = menu.find(m => m.key === answer);
+    if (!pick) console.log("      Enter one of the numbers shown above.");
+  }
+  try {
+    if (pick.key === "1") { console.log("✓ Not shared. Later: rech share new " + JSON.stringify(profile)); return; }
+    if (pick.listener) {
+      const config = await requireListeners();
+      allowProfiles(config, pick.listener, [profile]);
+      await writeListeners(config);
+      await printProfileUri(profile, pick.listener);
+      return;
+    }
+    if (pick.kind === "tailscale") {
+      const dns = (JSON.parse(await runTailscale(["status", "--json"]) ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "");
+      if (!dns?.endsWith(".ts.net")) console.log(`      ! Tailscale's hostname is ${dns ? `"${dns}", not under ts.net` : "unknown (is tailscale up?)"}; the link uses the tailnet IP.`);
+      else console.log(`      Tailscale hostname: ${dns}`);
+    }
+    let signal: string | undefined;
+    if (pick.kind === "webrtc-own") {
+      console.log(`\n      Run a signal server, then paste its URL here:`);
+      console.log(`        1. Read ${SIGNAL_SELFHOST_DOC}`);
+      console.log(`           (A: Cloudflare Workers is the easiest; C: Tailscale Funnel needs no domain).`);
+      console.log(`        2. Deploy it and open its URL in a browser to check that it answers.`);
+      console.log(`        3. For TURN (strict NATs), set CF_TURN_KEY_ID and CF_TURN_API_TOKEN in the daemon's env (see "TURN" in that doc).`);
+      while (!signal) {
+        const raw = (await ask("      Signal server URL (empty: cancel): ")).trim();
+        if (!raw) { console.log("      Not shared. Later: rech share new <profile> --signal <url>"); return; }
+        try { signal = normalizeSignal(raw); } catch (error) { console.log(`      ${error instanceof Error ? error.message : error}`); continue; }
+        const ok = await fetch(signal, { signal: AbortSignal.timeout(5000) }).then(() => true).catch(() => false);
+        if (!ok) console.log(`      ! ${signal} did not answer; the share is made anyway, check the server before sending the link.`);
+      }
+    }
+    const via = pick.kind === "webrtc" || pick.kind === "webrtc-own" ? WEBRTC : pick.kind!;
+    await shareNew([profile], { via: [via], ...(signal ? { signal } : {}) });
+  } catch (error) {
+    console.error(`      Sharing failed: ${error instanceof Error ? error.message : error}. Setup itself is saved; retry with rech share new ${JSON.stringify(profile)}.`);
+  }
+}
+
 // ---- shares: invite links, devices, transports (see shares.ts) ----------------------------
 
 const fmtDate = (ms?: number) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "-";
@@ -4339,7 +4440,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4485,9 +4586,11 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .positional("name", { type: "string", demandOption: true })
         .option("public-url", { type: "string", requiresArg: true, describe: "e.g. https://host.example.ts.net/rechrome/" })
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
-        .option("uploads", { type: "boolean", describe: "Let this listener's links upload images (rech upload); --no-uploads turns it off" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, or --uploads/--no-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}) }))
+        .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
+        .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
+        .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/scoped-upload.js

@@ -1,8 +1,9 @@
 // @bun
 // scoped-upload.ts
 import { createHash, randomBytes } from "crypto";
-import { mkdtemp, writeFile, rm } from "fs/promises";
-import { basename, join } from "path";
+import { mkdtemp, writeFile, rm, realpath, stat, open } from "fs/promises";
+import { constants as fsConstants } from "fs";
+import { basename, join, isAbsolute, sep } from "path";
 import { tmpdir } from "os";
 var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
 var MAX_REQUEST_BYTES = 14 * 1024 * 1024;
@@ -11,8 +12,8 @@ var EXTENSION_TYPES = { png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg",
 var UPLOAD_MODES = ["auto", "chooser", "into", "drop", "paste"];
 function validateUploadPolicy(value) {
   const p = value;
-  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
-    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}) and contentTypes (${UPLOAD_TYPES.join(", ")})`);
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes", "hostDirs"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))) || p.hostDirs !== undefined && (!Array.isArray(p.hostDirs) || !p.hostDirs.length || p.hostDirs.some((d) => typeof d !== "string" || !isAbsolute(d) || d.includes("\x00") || d === sep)))
+    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}), contentTypes (${UPLOAD_TYPES.join(", ")}) and hostDirs (absolute directories, not /)`);
 }
 function validName(name) {
   return typeof name === "string" && name.length > 0 && name.length <= 128 && name !== "." && name !== ".." && !name.startsWith("-") && !/[\\/:\x00-\x1f\x7f]/.test(name);
@@ -49,6 +50,7 @@ var UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read on this
   --drop <ref|selector>  a drag-and-drop zone
   --paste [ref|selector] an editor that takes pasted images (default: the focused element)
   --name <file>          read the bytes from stdin instead:  rech upload --name shot.png < shot.png
+  --host <path>          a file already on the host (only where its listener allows that directory)
 Types: ${UPLOAD_TYPES.join(", ")}, up to ${MAX_UPLOAD_BYTES / 1024 / 1024} MiB. Get refs from rech snapshot.`;
 async function prepareUpload(args, stdin, readLocal = (path) => Bun.file(path).bytes()) {
   const sessions = args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a));
@@ -64,7 +66,7 @@ async function prepareUpload(args, stdin, readLocal = (path) => Bun.file(path).b
   };
   while (options.length) {
     const option = options.shift();
-    const match = option.match(/^--(name|content-type|into|drop|paste|chooser)(?:=(.*))?$/);
+    const match = option.match(/^--(name|content-type|into|drop|paste|chooser|host)(?:=(.*))?$/);
     if (!match) {
       if (option.startsWith("-") || path !== undefined)
         throw new Error(path !== undefined ? `One file per upload; unexpected ${option}` : `Unknown option ${option}`);
@@ -91,6 +93,24 @@ async function prepareUpload(args, stdin, readLocal = (path) => Bun.file(path).b
   }
   if (target !== undefined && !validTarget(target))
     throw new Error("Upload target must be a snapshot ref (e12) or a selector");
+  if (fields.host !== undefined) {
+    if (path !== undefined || fields.name !== undefined)
+      throw new Error("--host takes the host file instead of a local file or --name");
+    if (!isAbsolute(fields.host))
+      throw new Error("--host needs an absolute path on the host");
+    const hostName = basename(fields.host);
+    if (!validName(hostName))
+      throw new Error("The host file name must be a plain name");
+    const hostType = fields["content-type"] ?? EXTENSION_TYPES[hostName.toLowerCase().split(".").pop() ?? ""] ?? "";
+    if (!UPLOAD_TYPES.includes(hostType))
+      throw new Error(`Upload content type must be one of ${UPLOAD_TYPES.join(", ")} (from the file extension, or --content-type)`);
+    const upload = { name: hostName, contentType: hostType, hostPath: fields.host };
+    if (mode !== "auto")
+      upload.mode = mode;
+    if (target !== undefined)
+      upload.target = target;
+    return { args: ["upload", ...sessions], upload };
+  }
   if (path === undefined && !stdin)
     throw new Error(`upload needs a file.`);
   const name = fields.name ?? (path !== undefined ? basename(path) : undefined);
@@ -185,6 +205,45 @@ function currentPageOrigin(output) {
 function cleanOutput(text, path, dir, name) {
   return text.replace(/### Ran Playwright code\n```js\n[\s\S]*?\n```\n*/g, "").replaceAll(path, name).replaceAll(dir, "<upload>");
 }
+async function readHostFile(path, hostDirs, limit) {
+  if (!hostDirs?.length)
+    throw new Error("Host-path uploads are off on this listener (the host can allow a directory: rech listener set <name> --host-upload-dir <dir>)");
+  if (!isAbsolute(path) || path.includes("\x00"))
+    throw new Error("Host upload path must be absolute");
+  const roots = (await Promise.all(hostDirs.map((d) => realpath(d).catch(() => null)))).filter((r) => !!r);
+  const inside = (real) => roots.some((root) => real.startsWith(root.endsWith(sep) ? root : root + sep));
+  const resolveInside = async () => {
+    let real;
+    try {
+      real = await realpath(path);
+    } catch {
+      throw new Error("Host upload file not found");
+    }
+    if (!inside(real))
+      throw new Error("Host upload path is outside the listener's allowed directories");
+    return real;
+  };
+  const handle = await open(await resolveInside(), fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+  try {
+    const info = await handle.stat();
+    if (!info.isFile())
+      throw new Error("Host upload path is not a regular file");
+    const now = await stat(await resolveInside());
+    if (now.dev !== info.dev || now.ino !== info.ino)
+      throw new Error("Host upload file changed while it was being opened");
+    if (info.size > limit)
+      throw new Error("Upload is empty or exceeds maxBytes");
+    const buf = Buffer.alloc(limit + 1);
+    let n = 0;
+    for (let r;n < buf.length && (r = await handle.read(buf, n, buf.length - n, n)).bytesRead > 0; )
+      n += r.bytesRead;
+    if (n > limit)
+      throw new Error("Upload is empty or exceeds maxBytes");
+    return buf.subarray(0, n);
+  } finally {
+    await handle.close();
+  }
+}
 async function receiveUpload(options) {
   const record = { name: null, size: null, sha256: null, origin: null, result: "rejected" };
   let dir;
@@ -199,16 +258,27 @@ async function receiveUpload(options) {
     validateUploadPolicy(options.policy);
     if (options.args.length !== 1 || options.args[0] !== "upload")
       throw new Error("Upload takes file bytes, not host paths or CLI options");
-    if (!p || !validName(p.name) || typeof p.contentType !== "string" || typeof p.data !== "string" || Object.keys(p).some((k) => !["name", "contentType", "data", "mode", "target"].includes(k)) || p.mode !== undefined && !UPLOAD_MODES.includes(p.mode) || p.target !== undefined && !validTarget(p.target) || (p.mode === "into" || p.mode === "drop") && p.target === undefined || (p.mode === "auto" || p.mode === "chooser") && p.target !== undefined)
+    const fromHost = p?.hostPath !== undefined;
+    if (!p || !validName(p.name) || typeof p.contentType !== "string" || (fromHost ? p.data !== undefined || typeof p.hostPath !== "string" : typeof p.data !== "string") || Object.keys(p).some((k) => !["name", "contentType", "data", "hostPath", "mode", "target"].includes(k)) || p.mode !== undefined && !UPLOAD_MODES.includes(p.mode) || p.target !== undefined && !validTarget(p.target) || (p.mode === "into" || p.mode === "drop") && p.target === undefined || (p.mode === "auto" || p.mode === "chooser") && p.target !== undefined)
       throw new Error("Invalid upload payload");
     const limit = options.policy.maxBytes ?? MAX_UPLOAD_BYTES;
-    if (p.data.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data))
-      throw new Error("Upload exceeds maxBytes or has invalid base64");
-    const bytes = Buffer.from(p.data, "base64");
+    let bytes;
+    if (fromHost) {
+      record.hostPath = p.hostPath.slice(0, 512);
+      bytes = await readHostFile(p.hostPath, options.policy.hostDirs, limit);
+      if (basename(p.hostPath) !== p.name)
+        throw new Error("Host upload name must be the file's own name");
+    } else {
+      if (p.data.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data))
+        throw new Error("Upload exceeds maxBytes or has invalid base64");
+      bytes = Buffer.from(p.data, "base64");
+      if (bytes.toString("base64") !== p.data)
+        throw new Error("Upload is not canonical base64");
+    }
     record.size = bytes.length;
     record.sha256 = createHash("sha256").update(bytes).digest("hex");
-    if (!bytes.length || bytes.length > limit || bytes.toString("base64") !== p.data)
-      throw new Error("Upload is empty, exceeds maxBytes, or is not canonical base64");
+    if (!bytes.length || bytes.length > limit)
+      throw new Error("Upload is empty or exceeds maxBytes");
     if (!(options.policy.contentTypes ?? UPLOAD_TYPES).includes(p.contentType) || !matchesType(bytes, p.contentType))
       throw new Error("Upload content type is not allowed or does not match the bytes");
     const tabs = await options.run(["tab-list"]);
@@ -287,6 +357,7 @@ export {
   currentPageOrigin,
   prepareStdinUpload,
   prepareUpload,
+  readHostFile,
   readRequestJson,
   receiveUpload,
   uploadScript,

package/scoped-upload.ts

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { mkdtemp, writeFile, rm } from 'node:fs/promises';
-import { basename, join } from 'node:path';
+import { mkdtemp, writeFile, rm, realpath, stat, open } from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import { basename, join, isAbsolute, sep } from 'node:path';
 import { tmpdir } from 'node:os';
 
 export const MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
@@ -16,17 +17,20 @@ const EXTENSION_TYPES: Record<string, string> = { png: 'image/png', jpg: 'image/
  */
 export const UPLOAD_MODES = ['auto', 'chooser', 'into', 'drop', 'paste'] as const;
 export type UploadMode = typeof UPLOAD_MODES[number];
-export type UploadPolicy = { maxBytes?: number; contentTypes?: string[] };
-export type UploadPayload = { name: string; contentType: string; data: string; mode?: UploadMode; target?: string };
+/** hostDirs: opt-in, off by default. Lets a link holder upload a file that is already on the
+ *  host, inside one of these directories (rech upload --host <path>). */
+export type UploadPolicy = { maxBytes?: number; contentTypes?: string[]; hostDirs?: string[] };
+export type UploadPayload = { name: string; contentType: string; data?: string; hostPath?: string; mode?: UploadMode; target?: string };
 export type UploadResult = { status: number; stdout: string; stderr: string };
-export type UploadAudit = { name: string | null; size: number | null; sha256: string | null; origin: string | null; result: string; mode?: UploadMode };
+export type UploadAudit = { name: string | null; size: number | null; sha256: string | null; origin: string | null; result: string; mode?: UploadMode; hostPath?: string };
 
 export function validateUploadPolicy(value: unknown): asserts value is UploadPolicy {
   const p = value as UploadPolicy;
-  if (!p || typeof p !== 'object' || Array.isArray(p) || Object.keys(p).some(k => !['maxBytes', 'contentTypes'].includes(k))
+  if (!p || typeof p !== 'object' || Array.isArray(p) || Object.keys(p).some(k => !['maxBytes', 'contentTypes', 'hostDirs'].includes(k))
     || (p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES))
-    || (p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some(t => !UPLOAD_TYPES.includes(t as any)))))
-    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}) and contentTypes (${UPLOAD_TYPES.join(', ')})`);
+    || (p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some(t => !UPLOAD_TYPES.includes(t as any))))
+    || (p.hostDirs !== undefined && (!Array.isArray(p.hostDirs) || !p.hostDirs.length || p.hostDirs.some(d => typeof d !== 'string' || !isAbsolute(d) || d.includes('\0') || d === sep))))
+    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}), contentTypes (${UPLOAD_TYPES.join(', ')}) and hostDirs (absolute directories, not /)`);
 }
 
 function validName(name: unknown): name is string {
@@ -62,6 +66,7 @@ export const UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read
   --drop <ref|selector>  a drag-and-drop zone
   --paste [ref|selector] an editor that takes pasted images (default: the focused element)
   --name <file>          read the bytes from stdin instead:  rech upload --name shot.png < shot.png
+  --host <path>          a file already on the host (only where its listener allows that directory)
 Types: ${UPLOAD_TYPES.join(', ')}, up to ${MAX_UPLOAD_BYTES / 1024 / 1024} MiB. Get refs from rech snapshot.`;
 
 /**
@@ -78,7 +83,7 @@ export async function prepareUpload(args: string[], stdin: AsyncIterable<Uint8Ar
   const setMode = (next: UploadMode) => { if (mode !== 'auto') throw new Error(`Pick one of --into, --drop, --paste.`); mode = next; };
   while (options.length) {
     const option = options.shift()!;
-    const match = option.match(/^--(name|content-type|into|drop|paste|chooser)(?:=(.*))?$/);
+    const match = option.match(/^--(name|content-type|into|drop|paste|chooser|host)(?:=(.*))?$/);
     if (!match) {
       if (option.startsWith('-') || path !== undefined) throw new Error(path !== undefined ? `One file per upload; unexpected ${option}` : `Unknown option ${option}`);
       path = option;
@@ -94,6 +99,19 @@ export async function prepareUpload(args: string[], stdin: AsyncIterable<Uint8Ar
     fields[flag] = value;
   }
   if (target !== undefined && !validTarget(target)) throw new Error('Upload target must be a snapshot ref (e12) or a selector');
+  if (fields.host !== undefined) {
+    // A file on the host: send only its path; the host reads it if its listener allows that directory.
+    if (path !== undefined || fields.name !== undefined) throw new Error('--host takes the host file instead of a local file or --name');
+    if (!isAbsolute(fields.host)) throw new Error('--host needs an absolute path on the host');
+    const hostName = basename(fields.host);
+    if (!validName(hostName)) throw new Error('The host file name must be a plain name');
+    const hostType = fields['content-type'] ?? EXTENSION_TYPES[hostName.toLowerCase().split('.').pop() ?? ''] ?? '';
+    if (!UPLOAD_TYPES.includes(hostType as any)) throw new Error(`Upload content type must be one of ${UPLOAD_TYPES.join(', ')} (from the file extension, or --content-type)`);
+    const upload: UploadPayload = { name: hostName, contentType: hostType, hostPath: fields.host };
+    if (mode !== 'auto') upload.mode = mode;
+    if (target !== undefined) upload.target = target;
+    return { args: ['upload', ...sessions], upload };
+  }
   if (path === undefined && !stdin) throw new Error(`upload needs a file.`);
   const name = fields.name ?? (path !== undefined ? basename(path) : undefined);
   if (!validName(name)) throw new Error(path !== undefined ? 'The file name must be a plain name; rename the file or pass --name' : 'Reading stdin needs --name with a plain filename (no path)');
@@ -195,6 +213,39 @@ function cleanOutput(text: string, path: string, dir: string, name: string): str
 /** No payload field is ever used as a host path. run() is a server-owned CLI runner,
  * not caller-supplied code. Audit records the selected origin immediately before upload.
  */
+/**
+ * A host file for `rech upload --host`: only when the listener lists hostDirs, and only a regular
+ * file whose real path (symlinks resolved) is inside one of them.
+ */
+export async function readHostFile(path: string, hostDirs: string[] | undefined, limit: number): Promise<Buffer> {
+  if (!hostDirs?.length) throw new Error('Host-path uploads are off on this listener (the host can allow a directory: rech listener set <name> --host-upload-dir <dir>)');
+  if (!isAbsolute(path) || path.includes('\0')) throw new Error('Host upload path must be absolute');
+  const roots = (await Promise.all(hostDirs.map(d => realpath(d).catch(() => null)))).filter((r): r is string => !!r);
+  const inside = (real: string) => roots.some(root => real.startsWith(root.endsWith(sep) ? root : root + sep));
+  const resolveInside = async () => {
+    let real: string;
+    try { real = await realpath(path); } catch { throw new Error('Host upload file not found'); }
+    if (!inside(real)) throw new Error('Host upload path is outside the listener\'s allowed directories');
+    return real;
+  };
+  // Open once, then prove the opened file is the one an allowed path names now (same device and
+  // inode), so swapping in a symlink between the check and the open can't reach outside. Read from
+  // that descriptor only, at most limit + 1 bytes, so a file growing after the check can't either.
+  const handle = await open(await resolveInside(), fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+  try {
+    const info = await handle.stat();
+    if (!info.isFile()) throw new Error('Host upload path is not a regular file');
+    const now = await stat(await resolveInside());
+    if (now.dev !== info.dev || now.ino !== info.ino) throw new Error('Host upload file changed while it was being opened');
+    if (info.size > limit) throw new Error("Upload is empty or exceeds maxBytes");
+    const buf = Buffer.alloc(limit + 1);
+    let n = 0;
+    for (let r; n < buf.length && (r = await handle.read(buf, n, buf.length - n, n)).bytesRead > 0;) n += r.bytesRead;
+    if (n > limit) throw new Error('Upload is empty or exceeds maxBytes');
+    return buf.subarray(0, n);
+  } finally { await handle.close(); }
+}
+
 export async function receiveUpload(options: {
   policy: UploadPolicy | undefined; payload: unknown; args: string[];
   run: (args: string[]) => Promise<UploadResult>; audit: (event: UploadAudit) => void;
@@ -208,18 +259,27 @@ export async function receiveUpload(options: {
     if (options.policy === undefined) throw new Error('Uploads are disabled on this listener');
     validateUploadPolicy(options.policy);
     if (options.args.length !== 1 || options.args[0] !== 'upload') throw new Error('Upload takes file bytes, not host paths or CLI options');
-    if (!p || !validName(p.name) || typeof p.contentType !== 'string' || typeof p.data !== 'string'
-      || Object.keys(p).some(k => !['name', 'contentType', 'data', 'mode', 'target'].includes(k))
+    const fromHost = p?.hostPath !== undefined;
+    if (!p || !validName(p.name) || typeof p.contentType !== 'string' || (fromHost ? p.data !== undefined || typeof p.hostPath !== 'string' : typeof p.data !== 'string')
+      || Object.keys(p).some(k => !['name', 'contentType', 'data', 'hostPath', 'mode', 'target'].includes(k))
       || (p.mode !== undefined && !UPLOAD_MODES.includes(p.mode)) || (p.target !== undefined && !validTarget(p.target))
       || ((p.mode === 'into' || p.mode === 'drop') && p.target === undefined) || ((p.mode === 'auto' || p.mode === 'chooser') && p.target !== undefined))
       throw new Error('Invalid upload payload');
     const limit = options.policy.maxBytes ?? MAX_UPLOAD_BYTES;
-    if (p.data.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data))
-      throw new Error('Upload exceeds maxBytes or has invalid base64');
-    const bytes = Buffer.from(p.data, 'base64');
+    let bytes: Buffer;
+    if (fromHost) {
+      record.hostPath = p.hostPath!.slice(0, 512);
+      bytes = await readHostFile(p.hostPath!, options.policy.hostDirs, limit);
+      if (basename(p.hostPath!) !== p.name) throw new Error('Host upload name must be the file\'s own name');
+    } else {
+      if (p.data!.length > 4 * Math.ceil(limit / 3) || /[^A-Za-z0-9+/=]/.test(p.data!))
+        throw new Error('Upload exceeds maxBytes or has invalid base64');
+      bytes = Buffer.from(p.data!, 'base64');
+      if (bytes.toString('base64') !== p.data) throw new Error('Upload is not canonical base64');
+    }
     record.size = bytes.length;
     record.sha256 = createHash('sha256').update(bytes).digest('hex');
-    if (!bytes.length || bytes.length > limit || bytes.toString('base64') !== p.data) throw new Error('Upload is empty, exceeds maxBytes, or is not canonical base64');
+    if (!bytes.length || bytes.length > limit) throw new Error('Upload is empty or exceeds maxBytes');
     if (!(options.policy.contentTypes ?? UPLOAD_TYPES).includes(p.contentType) || !matchesType(bytes, p.contentType))
       throw new Error('Upload content type is not allowed or does not match the bytes');
     const tabs = await options.run(['tab-list']);

package/serve.js

@@ -1039,7 +1039,7 @@ export async function serve() {
       if (filteredArgs[0] === "upload") {
         const result = await receiveUpload({
           // The management key can already run any code, so uploads need no extra opt-in there.
-          policy: listener.uploads ?? (listener.profiles === "*" ? {} : undefined), payload: body.upload, args: filteredArgs,
+          policy: listener.uploads === false ? undefined : listener.uploads ?? {}, payload: body.upload, args: filteredArgs,
           audit: event => log(`upload: ${JSON.stringify({ listener: listener.name, profile: scopedProfile ?? body.identity?.profile ?? null, ...event })}`),
           run: async uploadArgs => {
             const child = Bun.spawn([bin, ...binArgs, ...uploadArgs, `-s=${namespacedSession}`], {

package/serve.ts

@@ -1039,7 +1039,7 @@ export async function serve() {
       if (filteredArgs[0] === "upload") {
         const result = await receiveUpload({
           // The management key can already run any code, so uploads need no extra opt-in there.
-          policy: listener.uploads ?? (listener.profiles === "*" ? {} : undefined), payload: body.upload, args: filteredArgs,
+          policy: listener.uploads === false ? undefined : listener.uploads ?? {}, payload: body.upload, args: filteredArgs,
           audit: event => log(`upload: ${JSON.stringify({ listener: listener.name, profile: scopedProfile ?? body.identity?.profile ?? null, ...event })}`),
           run: async uploadArgs => {
             const child = Bun.spawn([bin, ...binArgs, ...uploadArgs, `-s=${namespacedSession}`], {

package/webrtc.js

@@ -466,13 +466,16 @@ class WebrtcHost {
         this.log(`webrtc ${room.cred.label}: another host took this room over; not reconnecting`);
         return;
       }
-      room.retry = setTimeout(() => void this.connect(room), room.backoff);
+      if (room.openedAt && Date.now() - room.openedAt >= STABLE_MS)
+        room.backoff = 1000;
+      room.openedAt = undefined;
+      room.retry = setTimeout(() => void this.connect(room), reconnectDelay(room.backoff));
       room.backoff = Math.min(room.backoff * 2, 30000);
     });
     room.signal = sock;
     try {
       await sock.open();
-      room.backoff = 1000;
+      room.openedAt = Date.now();
     } catch (error) {
       this.log(`webrtc ${room.cred.label}: ${error instanceof Error ? error.message : error}`);
     }
@@ -861,9 +864,14 @@ async function spawnBridge(token, signal, entry, dir = BRIDGE_DIR) {
   throw new Error(`the local WebRTC bridge did not start${tail ? `:
 ${tail}` : ""}`);
 }
+var STABLE_MS = 60000;
+function reconnectDelay(backoff, random = Math.random) {
+  return Math.round(backoff * (0.75 + random() * 0.5));
+}
 export {
   BRIDGE_DIR,
   SIGNAL_PROTO,
+  STABLE_MS,
   WEBRTC_RUNTIME_DIR,
   WebrtcClient,
   WebrtcHost,
@@ -873,6 +881,7 @@ export {
   liveBridge,
   loadRTC,
   readBridge,
+  reconnectDelay,
   runBridge,
   signalSocketUrl,
   spawnBridge

package/webrtc.ts

@@ -210,7 +210,7 @@ export type HostHandler = (req: Request, token: string) => Promise<Response>;
 
 /** Keeps one signal room per credential and serves each joining peer through `handler`. */
 export class WebrtcHost {
-  private rooms = new Map<string, { cred: HostCredential; signal?: SignalSocket; peers: Map<string, { pc: any; channel?: SealedChannel }>; backoff: number; stopped: boolean; retry?: ReturnType<typeof setTimeout> }>();
+  private rooms = new Map<string, { cred: HostCredential; signal?: SignalSocket; peers: Map<string, { pc: any; channel?: SealedChannel }>; backoff: number; openedAt?: number; stopped: boolean; retry?: ReturnType<typeof setTimeout> }>();
   constructor(private handler: HostHandler, private log: Log) {}
 
   /** Open rooms for new credentials, close rooms for ones that are gone. */
@@ -245,11 +245,15 @@ export class WebrtcHost {
       (code, reason) => {
         if (room.stopped) return;
         if (code === 1000 && /replaced/.test(reason)) { this.log(`webrtc ${room.cred.label}: another host took this room over; not reconnecting`); return; }
-        room.retry = setTimeout(() => void this.connect(room), room.backoff);
+        // Only a connection that stayed up resets the back-off: a server that accepts and then
+        // drops us must not be hit every second.
+        if (room.openedAt && Date.now() - room.openedAt >= STABLE_MS) room.backoff = 1000;
+        room.openedAt = undefined;
+        room.retry = setTimeout(() => void this.connect(room), reconnectDelay(room.backoff));
         room.backoff = Math.min(room.backoff * 2, 30_000);
       });
     room.signal = sock;
-    try { await sock.open(); room.backoff = 1000; }
+    try { await sock.open(); room.openedAt = Date.now(); }
     catch (error) { this.log(`webrtc ${room.cred.label}: ${error instanceof Error ? error.message : error}`); }
   }
 
@@ -533,3 +537,11 @@ export async function spawnBridge(token: string, signal: string, entry: string[]
   const tail = existsSync(logPath) ? readFileSync(logPath, "utf8").trim().split("\n").slice(-3).join("\n") : "";
   throw new Error(`the local WebRTC bridge did not start${tail ? `:\n${tail}` : ""}`);
 }
+
+/** How long a signal connection must stay up before the reconnect back-off starts over. */
+export const STABLE_MS = 60_000;
+/** The back-off with ±25% jitter, so hosts dropped together (a signal server restart) don't
+ *  all reconnect in the same instant. */
+export function reconnectDelay(backoff: number, random = Math.random): number {
+  return Math.round(backoff * (0.75 + random() * 0.5));
+}