rechrome 1.39.1 → 1.41.0

package/README.md

@@ -386,14 +386,30 @@ and the host check the size, and check the bytes against the type (PNG/JPEG/GIF/
 signatures; UTF-8 SVG without DTD/entities). These checks identify the format; they
 don't sanitize SVG or scan for malware. The host never renders the file.
 
-**Turning uploads on:** they are always on through the local management listener.
-On a shared (scoped) listener they are **off** until the host turns them on:
+**On by default:** uploads are on for every listener, shared ones too. The client
+reads the file and sends only its bytes, and the host never reads a path for an
+upload, so a link holder can only upload files they already have. Each upload is
+logged in the daemon log with its name, size, sha256 and the page's origin. The
+host can turn them off for a shared listener:
 
 ```bash
-rech listener set <listener> --uploads      # --no-uploads turns them off again
+rech listener set <listener> --no-uploads   # writes "uploads": false; --uploads turns them on again
 ```
 
-That writes an `uploads` object to the listener's entry in `~/.rechrome/listeners.json`.
+**Files already on the host (opt-in):** off by default. The host can let a shared
+listener's links upload files that are already on the host, but only from
+directories it names:
+
+```bash
+rech listener set <listener> --host-upload-dir ~/shots   # repeatable; --no-host-uploads turns it off
+rech upload --host /Users/me/shots/a.png                  # on the client: sends the path, not bytes
+```
+
+The host resolves symlinks and refuses anything outside those directories, anything
+that isn't a regular file, and anything over the size cap. The log line also records
+the host path.
+
+An `uploads` object in the listener's entry in `~/.rechrome/listeners.json` sets limits.
 The host can tune it by hand, lowering the byte limit or narrowing the types, but not
 going above the 10 MiB cap or adding other types:
 

package/fill-secret.js

@@ -7,6 +7,8 @@ import { homedir } from "os";
 import { join } from "path";
 var SECRET_MASK = "***";
 var SECRET_MASK_TTL_MS = 15 * 60000;
+var MIN_MASK_LENGTH = 6;
+var maskable = (value) => !!value && value.length >= MIN_MASK_LENGTH;
 var FILL_SECRET_USAGE = `Usage: rech fill-secret <ref> (--from-env VAR | --from-stdin | --totp-from-env VAR | --totp-from-stdin)
                          [--env-file <path>] [--allow-domain <glob>]... [--submit]
   Fills <ref> (from \`rech snapshot\`) with a secret the daemon never logs or echoes.
@@ -211,7 +213,7 @@ class SecretMasker {
     this.now = now;
   }
   add(value, ttlMs = this.ttlMs) {
-    if (value)
+    if (maskable(value))
       this.values.set(value, this.now() + ttlMs);
   }
   get active() {
@@ -378,6 +380,7 @@ function maskPasswordLines(text) {
 }
 export {
   FILL_SECRET_USAGE,
+  MIN_MASK_LENGTH,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
@@ -390,6 +393,7 @@ export {
   hasSnapshot,
   hostAllowed,
   maskPasswordLines,
+  maskable,
   parseDotenv,
   parseFillSecretArgs,
   parseFillSecretWire,

package/fill-secret.ts

@@ -19,6 +19,12 @@ import { join } from "path";
 
 export const SECRET_MASK = "***";
 export const SECRET_MASK_TTL_MS = 15 * 60_000;
+/** Shorter values are never masked: masking "1" everywhere would turn every 1 in every output
+ *  into ***, corrupting ids and refs for the daemon's lifetime. A TOTP code (6 digits) still is.
+ *  A short value is kept out of fill-secret's own reply by dropping the echoed code that holds it,
+ *  and out of its error message by an exact replace; anything the page itself shows is not masked. */
+export const MIN_MASK_LENGTH = 6;
+export const maskable = (value: string | undefined | null): value is string => !!value && value.length >= MIN_MASK_LENGTH;
 
 // ---------- client side ----------
 
@@ -233,7 +239,7 @@ export function buildFillCode(ref: string, value: string, allowDomains: string[]
 export class SecretMasker {
   private values = new Map<string, number>();
   constructor(private ttlMs = SECRET_MASK_TTL_MS, private now = () => Date.now()) {}
-  add(value: string, ttlMs = this.ttlMs) { if (value) this.values.set(value, this.now() + ttlMs); }
+  add(value: string, ttlMs = this.ttlMs) { if (maskable(value)) this.values.set(value, this.now() + ttlMs); }
   get active(): boolean { this.prune(); return this.values.size > 0; }
   mask(text: string): string {
     if (!text) return text;

package/listeners.js

@@ -1,12 +1,13 @@
 // @bun
 // scoped-upload.ts
+import { basename, join, isAbsolute, sep } from "path";
 var MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
 var MAX_REQUEST_BYTES = 14 * 1024 * 1024;
 var UPLOAD_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"];
 function validateUploadPolicy(value) {
   const p = value;
-  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))))
-    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}) and contentTypes (${UPLOAD_TYPES.join(", ")})`);
+  if (!p || typeof p !== "object" || Array.isArray(p) || Object.keys(p).some((k) => !["maxBytes", "contentTypes", "hostDirs"].includes(k)) || p.maxBytes !== undefined && (!Number.isSafeInteger(p.maxBytes) || p.maxBytes < 1 || p.maxBytes > MAX_UPLOAD_BYTES) || p.contentTypes !== undefined && (!Array.isArray(p.contentTypes) || !p.contentTypes.length || p.contentTypes.some((t) => !UPLOAD_TYPES.includes(t))) || p.hostDirs !== undefined && (!Array.isArray(p.hostDirs) || !p.hostDirs.length || p.hostDirs.some((d) => typeof d !== "string" || !isAbsolute(d) || d.includes("\x00") || d === sep)))
+    throw new Error(`uploads must be an object with optional maxBytes (1..${MAX_UPLOAD_BYTES}), contentTypes (${UPLOAD_TYPES.join(", ")}) and hostDirs (absolute directories, not /)`);
 }
 var UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read on this machine; only its bytes are sent)
   (no flag)              the file chooser a click opened, else the page's only <input type=file>
@@ -14,16 +15,17 @@ var UPLOAD_USAGE = `Usage: rech upload <file> [how]   (the file is read on this
   --drop <ref|selector>  a drag-and-drop zone
   --paste [ref|selector] an editor that takes pasted images (default: the focused element)
   --name <file>          read the bytes from stdin instead:  rech upload --name shot.png < shot.png
+  --host <path>          a file already on the host (only where its listener allows that directory)
 Types: ${UPLOAD_TYPES.join(", ")}, up to ${MAX_UPLOAD_BYTES / 1024 / 1024} MiB. Get refs from rech snapshot.`;
 
 // listeners.ts
 import { isIP } from "net";
 import { createHash, randomBytes } from "crypto";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 var MAX_RETIRED_PORTS = 32;
-var LISTENERS_FILE = join(homedir(), ".rechrome", "listeners.json");
+var LISTENERS_FILE = join2(homedir(), ".rechrome", "listeners.json");
 var isLoopback = (host) => host === "::1" || /^127\./.test(host);
 var listenerAddress = (l) => `${l.host.includes(":") ? `[${l.host}]` : l.host}:${l.port}`;
 var profileOutputPrefix = (profile) => `profiles/${createHash("sha256").update(profile).digest("hex")}/`;
@@ -72,7 +74,7 @@ function validateListeners(value) {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some((p) => typeof p !== "string" || !p.trim() || p.includes("\x00") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
-    if (l.uploads !== undefined)
+    if (l.uploads !== undefined && l.uploads !== false)
       validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
@@ -110,7 +112,7 @@ async function writeListeners(config) {
     config.retiredPorts = retired;
   else
     delete config.retiredPorts;
-  await mkdir(join(homedir(), ".rechrome"), { recursive: true });
+  await mkdir(join2(homedir(), ".rechrome"), { recursive: true });
   const temp = `${LISTENERS_FILE}.${randomBytes(6).toString("hex")}.tmp`;
   await writeFile(temp, JSON.stringify(config, null, 2) + `
 `, { mode: 384 });
@@ -126,7 +128,7 @@ function authorizeProfileRequest(listener, body) {
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile)
     throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (args[0] === "upload" && listener.uploads === undefined)
+  if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");

package/listeners.ts

@@ -6,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false };
 // retiredPorts: ports of removed listeners, newest last. New listeners skip them so a link
 // saved for a removed listener gets "connection refused", not some other listener's answer.
 export type ListenerConfig = { version: 1; listeners: Listener[]; retiredPorts?: number[] };
@@ -58,7 +58,9 @@ export function validateListeners(value: unknown): ListenerConfig {
     } else if (!Array.isArray(l.profiles) || !l.profiles.length || l.profiles.some(p => typeof p !== "string" || !p.trim() || p.includes("\0") || p === "*")) {
       throw new Error("Listener profiles must be a nonempty list of registered profile keys");
     }
-    if (l.uploads !== undefined) validateUploadPolicy(l.uploads);
+    // Uploads are on unless set to false: the client sends file bytes it already has, and the
+    // host never reads a path for them.
+    if (l.uploads !== undefined && l.uploads !== false) validateUploadPolicy(l.uploads);
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -103,7 +105,7 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
   if (typeof profile !== "string" || listener.profiles === "*" || !listener.profiles.includes(profile)) throw new Error("Profile is not allowed on this listener");
   if (body.env?.PLAYWRIGHT_MCP_PROFILE_DIRECTORY && body.env.PLAYWRIGHT_MCP_PROFILE_DIRECTORY !== profile) throw new Error("Profile override does not match request identity");
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
-  if (args[0] === "upload" && listener.uploads === undefined)
+  if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
   if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.39.1",
+  "version": "1.41.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"
@@ -23,6 +23,9 @@
     "listeners.js",
     "fill-secret.ts",
     "fill-secret.js",
+    "redact.ts",
+    "redact.js",
+    "secret-rules",
     "extension",
     "rechrome.js",
     "rechrome.ts",
@@ -50,7 +53,7 @@
     "vendor-cli": "bash scripts/vendor-cli.sh",
     "prepare": "bash scripts/vendor-cli.sh --prepare",
     "check-pack": "bash scripts/check-pack.sh",
-    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build fill-secret.ts --target=bun --outfile=fill-secret.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bun build secret.ts --target=bun --external node-datachannel --outfile=secret.js && bun build shares.ts --target=bun --external node-datachannel --outfile=shares.js && bun build e2e.ts --target=bun --external node-datachannel --outfile=e2e.js && bun build webrtc.ts --target=bun --external node-datachannel --outfile=webrtc.js && bun build signal-relay.ts --target=bun --external node-datachannel --outfile=signal-relay.js && bash scripts/check-pack.sh"
+    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build fill-secret.ts --target=bun --outfile=fill-secret.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bun build secret.ts --target=bun --external node-datachannel --outfile=secret.js && bun build shares.ts --target=bun --external node-datachannel --outfile=shares.js && bun build e2e.ts --target=bun --external node-datachannel --outfile=e2e.js && bun build webrtc.ts --target=bun --external node-datachannel --outfile=webrtc.js && bun build signal-relay.ts --target=bun --external node-datachannel --outfile=signal-relay.js && bun build redact.ts --target=bun --outfile=redact.js && bash scripts/check-pack.sh"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/rechrome.js

@@ -5,9 +5,10 @@ import { readListeners, writeListeners as writeListenersFile, listenerAddress, i
 import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
+import { redact } from "./redact.js";
 import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, rmdirSync, constants as fsConstants } from "fs";
+import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
@@ -16,7 +17,7 @@ import { createRequire } from "node:module";
 import { spawn as cpSpawn } from "child_process";
 import { readFile, writeFile, rename, chmod, mkdir, stat } from "node:fs/promises";
 import { isDeprecatedPm2Fallback, listsProcess, oxmgrInstallCommand, pickDaemonManager, PM2_DEPRECATION, type DaemonManager } from "./daemon-manager.js";
-import { DEFAULT_SIGNAL, WEBRTC, createShare, findDevice, findShare, inviteLink, inviteProblem, parseDuration, readShares, updateShares, type Share } from "./shares.js";
+import { DEFAULT_SIGNAL, WEBRTC, createShare, normalizeSignal, findDevice, findShare, inviteLink, inviteProblem, parseDuration, readShares, updateShares, type Share } from "./shares.js";
 import { bearerOf, looksLikeToken, newToken, parseToken, redactSecrets } from "./secret.js";
 import { WebrtcClient, loadRTC, runBridge, spawnBridge } from "./webrtc.js";
 import { startSignalRelay } from "./signal-relay.js";
@@ -642,7 +643,7 @@ export async function getOrCreateUrl(persist = true): Promise<string> {
     const envRaw = await file(globalEnvFile).text().catch(() => "");
     const lines = envRaw.trimEnd().split("\n").filter(l => !l.startsWith(`${ENV_KEY}=`));
     const content = [...lines, newLine, ""].join("\n");
-    await Bun.write(globalEnvFile, content);
+    await writeAtomic(globalEnvFile, content, 0o600); // holds the management key
   }
   process.env[ENV_KEY] = url;
   return url;
@@ -1779,7 +1780,7 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     if (!picked.startsWith(SETUP)) return picked;
     const dir = picked.slice(SETUP.length);
     console.error(`[rech] ${dir} isn't set up yet; running rech setup --profile ${JSON.stringify(dir)} first.`);
-    await setup({ profile: dir });
+    await setup({ profile: dir, skipShare: true });
     const after = await readTokenRegistry();
     const key = unregisteredChromeProfiles(after, { [dir]: {} }).length ? undefined : canonicalProfileKeys(after).find(k => after[k].profileDir === dir);
     if (process.exitCode || !key) throw new Error(`Setup didn't register ${dir}; nothing shared. Retry with: rech setup --profile ${JSON.stringify(dir)}`);
@@ -2188,7 +2189,13 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   }
   const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
   // The daemon already masks the value; this is a second line of defence for an older daemon.
-  const scrub = (s: string) => secret && s ? s.replaceAll(secret, SECRET_MASK) : s;
+  // Then any secret-shaped string (API keys, tokens) in page text, unless RECH_REDACT=0.
+  const scrub = (s: string) => {
+    if (!s) return s;
+    if (secret) s = s.replaceAll(secret, SECRET_MASK);
+    if (process.env.RECH_REDACT === "0") return s;
+    try { return redact(s).text; } catch { return s; } // missing rules must not swallow output
+  };
   const { files, existingSession } = served;
   const status = served.status, stdout = scrub(served.stdout), stderr = scrub(served.stderr);
   if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
@@ -2240,9 +2247,8 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     // Saved files belong to the project: <project>/.rechrome/output. The folder also holds
     // .env.local (secrets), so it is git-ignored as a whole when first created.
     const dlDir = join(identity.dataDir, "output");
+    await ensureProjectDir(identity.dataDir);
     mkdirSync(dlDir, { recursive: true });
-    const gitignorePath = join(identity.dataDir, ".gitignore");
-    if (!existsSync(gitignorePath)) await Bun.write(gitignorePath, "*\n");
     for (const name of files) {
       const fileRes = await fetch(serviceUrl(url, `files/${name}`), {
         headers: { Authorization: `Bearer ${parseUrl(url).key}` },
@@ -2731,7 +2737,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
   const envRaw = await file(globalEnvFile).text().catch(() => "");
   const lines = envRaw.trimEnd().split("\n");
   const filtered = lines.filter(l => !l.startsWith(`${ENV_KEY}=`));
-  await Bun.write(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"));
+  await writeAtomic(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"), 0o600);
 
   const home = HOME;
   const bunBin = Bun.which("bun") ?? process.execPath;
@@ -3339,7 +3345,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3347,11 +3353,23 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
   if (opts.uploads !== undefined) {
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: uploads are always on there.`);
     // {} = the defaults (every supported image type, the full size cap); hand-tuned limits stay.
-    if (opts.uploads) listener.uploads ??= {}; else delete listener.uploads;
+    if (opts.uploads) listener.uploads = listener.uploads || {}; else listener.uploads = false;
+  }
+  if (opts.hostUploadDirs?.length || opts.noHostUploads) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener; host-path uploads are set on shared listeners.`);
+    if (listener.uploads === false) throw new Error(`Uploads are off on "${name}"; turn them on first: rech listener set ${name} --uploads`);
+    const policy = listener.uploads ?? {};
+    if (opts.noHostUploads) delete policy.hostDirs;
+    else policy.hostDirs = [...new Set([...(policy.hostDirs ?? []), ...opts.hostUploadDirs!.map(d => realpathSync(resolve(d)))])];
+    listener.uploads = policy;
   }
   await writeListeners(config);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
-  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${(listener.uploads?.maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
+  if (opts.hostUploadDirs?.length || opts.noHostUploads) {
+    const dirs = (listener.uploads || {}).hostDirs;
+    console.log(dirs?.length ? `${name}: host-path uploads allowed from ${dirs.join(", ")} (rech upload --host <path>; each is logged)` : `${name}: host-path uploads off`);
+  }
+  if (opts.uploads !== undefined) console.log(opts.uploads ? `${name}: uploads on (rech upload <file>; images up to ${((listener.uploads || {}).maxBytes ?? MAX_UPLOAD_BYTES) / 1024 / 1024} MiB)` : `${name}: uploads off`);
 }
 
 const hideKey = (url: string) => url.replace(/([#&?]key=)[^&]*/, "$1…");
@@ -3406,9 +3424,7 @@ async function warnSecretFile(path: string | undefined): Promise<void> {
 /** Write RECHROME_URL to this project's .rechrome/.env.local (the folder git-ignores itself). */
 async function saveProjectUrl(url: string): Promise<string> {
   const { dataDir } = await getClientIdentity();
-  mkdirSync(dataDir, { recursive: true });
-  const gitignore = join(dataDir, ".gitignore");
-  if (!existsSync(gitignore)) await Bun.write(gitignore, "*\n");
+  await ensureProjectDir(dataDir);
   return writeEnvUrl(join(dataDir, ".env.local"), url);
 }
 
@@ -3418,11 +3434,46 @@ async function saveGlobalUrl(url: string): Promise<string> {
   return writeEnvUrl(GLOBAL_ENV_FILE, url);
 }
 
+/** Write a file whole or not at all: a temp file beside it, then rename (atomic on one filesystem). */
+export async function writeAtomic(path: string, data: string, mode?: number): Promise<void> {
+  // A symlinked .env.local stays a link: write the file it points to.
+  // Follow links by hand: realpath fails on a dangling one, whose target we still create.
+  for (let hops = 0; hops < 8; hops++) {
+    let target: string;
+    try { target = readlinkSync(path); } catch { break; } // not a link, or not there yet
+    path = resolve(dirname(path), target);
+  }
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, data, mode === undefined ? {} : { mode });
+    if (mode !== undefined) await chmod(tmp, mode);
+    renameSync(tmp, path);
+  } catch (error) { try { unlinkSync(tmp); } catch { /* never written */ } throw error; }
+}
+
+export const PROJECT_DIR_README = `# .rechrome/
+
+rech's state for this project (like .git/). It ignores itself: see .gitignore.
+
+- .env.local  RECHROME_URL for this project. Holds a key: keep it private.
+- output/     files rech commands saved (screenshots, snapshots, downloads).
+
+Safe to delete; rech recreates it. More: https://github.com/snomiao/rechrome
+`;
+
+/** Create <project>/.rechrome with its .gitignore ("*") and README, so a key in it is never committed. */
+export async function ensureProjectDir(dir: string): Promise<void> {
+  mkdirSync(dir, { recursive: true });
+  const gitignore = join(dir, ".gitignore");
+  if (!existsSync(gitignore)) await writeAtomic(gitignore, "*\n");
+  const readme = join(dir, "README.md");
+  if (!existsSync(readme)) await writeAtomic(readme, PROJECT_DIR_README);
+}
+
 /** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
-  await writeFile(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), { mode: 0o600 });
-  await chmod(envPath, 0o600);
+  await writeAtomic(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), 0o600);
   await recordSavedLink(envPath).catch(() => {}); // only bookkeeping for later warnings
   return envPath;
 }
@@ -3644,18 +3695,10 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   const scheme = previous.protocol;
   let url = `${scheme}://${management.key}@${listenerAddress(management)}${normalizePrefix(management.prefix)}`;
   const { host, port, protocol, key: serveKey } = parseUrl(url);
+  // Connect the profile locally first; who else may reach it is asked at the end (setupShareStep),
+  // once the bridge works. --listen still picks the exposure up front, for scripts.
   let desiredBind = management.host;
   if (opts.listen) desiredBind = chooseListenAddress(listenChoices, opts.listen);
-  else if (isTTY) {
-    console.log("\n      Where should this profile be accessible? (Other profiles keep their listeners.)");
-    listenChoices.forEach((choice, index) => console.log(`        ${index + 1}. ${choice.label} — ${choice.address}`));
-    while (true) {
-      const answer = (await ask("      Choice [1]: ", "1")).trim();
-      const choice = /^\d+$/.test(answer) ? listenChoices[Number(answer) - 1] : undefined;
-      if (choice) { desiredBind = choice.address; break; }
-      console.log("      Enter one of the numbers shown above.");
-    }
-  }
   const pingManagement = () => fetch(serviceUrl(url, "ping"), {
     headers: { Authorization: `Bearer ${serveKey}` }, signal: AbortSignal.timeout(2000),
   }).then(async r => r.ok && (await r.json()).multiListener === true).catch(() => false);
@@ -3894,7 +3937,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
   )).trim();
   if (saveChoice !== "4") {
     const globalEnvPath = saveChoice === "3" ? homeEnvPath : saveChoice === "2" ? pwdRechPath : pwdEnvPath;
-    if (saveChoice === "2") mkdirSync(join(process.cwd(), ".rechrome"), { recursive: true });
+    if (saveChoice === "2") await ensureProjectDir(join(process.cwd(), ".rechrome"));
     const existedBefore = await file(globalEnvPath).exists();
     const existing = await file(globalEnvPath).text().catch(() => "");
     const keysToRemove = ["PLAYWRIGHT_MCP_USER_DATA_DIR", "PLAYWRIGHT_MCP_EXTENSION_ID", "PLAYWRIGHT_MCP_EXTENSION_TOKEN", "PLAYWRIGHT_MCP_PROFILE_DIRECTORY"];
@@ -3902,7 +3945,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     const rechIdx = lines.findIndex(l => l.startsWith("RECHROME_URL="));
     if (rechIdx >= 0) lines[rechIdx] = newLine;
     else lines.push(newLine);
-    await Bun.write(globalEnvPath, lines.join("\n").trim() + "\n");
+    await writeAtomic(globalEnvPath, lines.join("\n").trim() + "\n", 0o600);
     console.log(`\n${existedBefore ? "Updated" : "Created"} ${globalEnvPath}`);
   }
 
@@ -3938,6 +3981,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
+  if (bridgeVerified && isTTY && !opts.listen && !opts.skipShare) await setupShareStep(ask, profileEmail);
   rl?.close();
   envWatcher?.close();
   if (bridgeVerified)
@@ -3946,6 +3990,70 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     console.error(`\nSetup was saved, but the selected profile did not pass the bridge check. Reload the extension at chrome://extensions and run \`rech setup --profile ${profileEmail}\` again.`);
 }
 
+const SIGNAL_SELFHOST_DOC = "https://github.com/snomiao/rechrome/blob/main/docs/signal-selfhost.md";
+
+/** The menu of setupShareStep: existing listeners first, then the new kinds. */
+export function shareMenu(listeners: Listener[], choices: ListenChoice[]): { key: string; label: string; listener?: string; kind?: "lan" | "tailscale" | "webrtc" | "webrtc-own" }[] {
+  const menu: ReturnType<typeof shareMenu> = [{ key: "1", label: "Don't add sharing (local access is always on; existing shares stay: rech share ls)" }];
+  for (const l of listeners.filter(l => l.profiles !== "*"))
+    menu.push({ key: String(menu.length + 1), label: `Existing listener "${l.name}" (${listenerAddress(l)}${l.publicUrl ? `, ${l.publicUrl}` : ""})`, listener: l.name });
+  const has = (k: string) => choices.some(c => c.kind === k);
+  if (has("lan")) menu.push({ key: String(menu.length + 1), label: "New: LAN (machines on this network)", kind: "lan" });
+  if (has("tailscale")) menu.push({ key: String(menu.length + 1), label: "New: Tailscale only (your tailnet)", kind: "tailscale" });
+  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via rechrome.pages.dev (works across networks, nothing to run)", kind: "webrtc" });
+  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via your own signal server (and TURN)", kind: "webrtc-own" });
+  return menu;
+}
+
+/** setup's last step: once the profile works here, offer to share it with other machines. */
+async function setupShareStep(ask: (q: string, def?: string) => Promise<string>, profile: string): Promise<void> {
+  const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+  const choices = await detectListenChoices();
+  const menu = shareMenu(listeners, choices);
+  console.log(`\n○ Share ${profile} with other machines?`);
+  for (const m of menu) console.log(`        ${m.key}. ${m.label}`);
+  let pick: (typeof menu)[number] | undefined;
+  while (!pick) {
+    const answer = (await ask("      Choice [1]: ", "1")).trim();
+    pick = menu.find(m => m.key === answer);
+    if (!pick) console.log("      Enter one of the numbers shown above.");
+  }
+  try {
+    if (pick.key === "1") { console.log("✓ Not shared. Later: rech share new " + JSON.stringify(profile)); return; }
+    if (pick.listener) {
+      const config = await requireListeners();
+      allowProfiles(config, pick.listener, [profile]);
+      await writeListeners(config);
+      await printProfileUri(profile, pick.listener);
+      return;
+    }
+    if (pick.kind === "tailscale") {
+      const dns = (JSON.parse(await runTailscale(["status", "--json"]) ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "");
+      if (!dns?.endsWith(".js.net")) console.log(`      ! Tailscale's hostname is ${dns ? `"${dns}", not under ts.net` : "unknown (is tailscale up?)"}; the link uses the tailnet IP.`);
+      else console.log(`      Tailscale hostname: ${dns}`);
+    }
+    let signal: string | undefined;
+    if (pick.kind === "webrtc-own") {
+      console.log(`\n      Run a signal server, then paste its URL here:`);
+      console.log(`        1. Read ${SIGNAL_SELFHOST_DOC}`);
+      console.log(`           (A: Cloudflare Workers is the easiest; C: Tailscale Funnel needs no domain).`);
+      console.log(`        2. Deploy it and open its URL in a browser to check that it answers.`);
+      console.log(`        3. For TURN (strict NATs), set CF_TURN_KEY_ID and CF_TURN_API_TOKEN in the daemon's env (see "TURN" in that doc).`);
+      while (!signal) {
+        const raw = (await ask("      Signal server URL (empty: cancel): ")).trim();
+        if (!raw) { console.log("      Not shared. Later: rech share new <profile> --signal <url>"); return; }
+        try { signal = normalizeSignal(raw); } catch (error) { console.log(`      ${error instanceof Error ? error.message : error}`); continue; }
+        const ok = await fetch(signal, { signal: AbortSignal.timeout(5000) }).then(() => true).catch(() => false);
+        if (!ok) console.log(`      ! ${signal} did not answer; the share is made anyway, check the server before sending the link.`);
+      }
+    }
+    const via = pick.kind === "webrtc" || pick.kind === "webrtc-own" ? WEBRTC : pick.kind!;
+    await shareNew([profile], { via: [via], ...(signal ? { signal } : {}) });
+  } catch (error) {
+    console.error(`      Sharing failed: ${error instanceof Error ? error.message : error}. Setup itself is saved; retry with rech share new ${JSON.stringify(profile)}.`);
+  }
+}
+
 // ---- shares: invite links, devices, transports (see shares.js) ----------------------------
 
 const fmtDate = (ms?: number) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "-";
@@ -4322,7 +4430,7 @@ async function status(): Promise<void> {
 }
 
 
-export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean };
+export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean; /** Called from `rech share`, which shares the profile itself. */ skipShare?: boolean };
 export type RechHandlers = {
   serve(): Promise<void> | void;
   status(): Promise<void>;
@@ -4339,7 +4447,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4485,9 +4593,11 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .positional("name", { type: "string", demandOption: true })
         .option("public-url", { type: "string", requiresArg: true, describe: "e.g. https://host.example.js.net/rechrome/" })
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
-        .option("uploads", { type: "boolean", describe: "Let this listener's links upload images (rech upload); --no-uploads turns it off" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, or --uploads/--no-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}) }))
+        .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
+        .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
+        .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),