rechrome 1.40.0 → 1.42.0

package/README.md

@@ -97,6 +97,25 @@ browser writes it, not before (downloads wait for the scrub). The check reads th
 the snapshot, so a page script that clears or replaces a neutrally-labelled password field in
 between can slip past; closing that needs redaction inside playwright's snapshot code. Not yet supported on a Windows daemon.
 
+#### Copying a secret out of a page: `read-secret`
+
+The reverse of `fill-secret`, for moving a secret that a page shows (an app's signing
+secret, an API key) into a vault without it appearing anywhere:
+
+```bash
+rech read-secret e12 --allow-domain api.example.com | vault-put my-app/signing-secret
+```
+
+- `--allow-domain` is required. The field's own page host must match it.
+- The value goes back in its own response field. It is never in a log line, a file or
+  another command's output, and is masked in every later output.
+- stdout must be a pipe: a terminal or a file redirect is refused before the host is asked.
+- A label ref means its input, as with `fill`. A non-field element gives its text.
+- On a shared (scoped) listener it is off until the host runs
+  `rech listener set <listener> --read-secrets`. Each read is logged without the value.
+  Turn it on only for links you trust with every account in their profiles: the caller picks
+  `--allow-domain`, so the link can read any field it can reach, saved passwords included.
+
 ### 3. Where things are kept
 
 | Where | What |

package/fill-secret.js

@@ -332,6 +332,108 @@ async function runCodeOnSession(opts) {
 function fillSecretOnSession(opts) {
   return runCodeOnSession({ ...opts, code: buildFillCode(opts.ref, opts.value, opts.allowDomains, opts.submit) });
 }
+var READ_SECRET_USAGE = `Usage: rech read-secret <ref|selector> --allow-domain <glob> [--allow-domain <glob>]... | <vault command>
+  Writes the field's current value, raw and without a newline, to stdout, which must be a pipe
+  into the program that stores it (never a terminal or a file). The value is never logged and
+  is masked in later outputs.
+  --allow-domain GLOB   required: refuse unless the field's page host matches, e.g. app.slack.com`;
+function parseReadSecretArgs(args) {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-secret")
+    throw new Error("Expected read-secret");
+  let ref;
+  const allowDomains = [];
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v)
+        throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) {
+        domainGlobToRegExp(d.trim());
+        allowDomains.push(d.trim());
+      }
+    } else if (a.startsWith("-"))
+      throw new Error(`read-secret: unknown option ${a}`);
+    else if (ref === undefined)
+      ref = a;
+    else
+      throw new Error("read-secret takes one target");
+  }
+  if (!ref)
+    throw new Error("read-secret needs a target ref (from rech snapshot) or a selector");
+  if (!allowDomains.length)
+    throw new Error("read-secret needs --allow-domain: name the site the secret must come from");
+  return { ref, allowDomains };
+}
+function readSecretWireArgs(req) {
+  return ["read-secret", req.ref, ...req.allowDomains.map((d) => `--allow-domain=${d}`)];
+}
+function parseReadSecretWire(args) {
+  const [cmd, ref, ...rest] = args;
+  if (cmd !== "read-secret" || !ref || ref.startsWith("-"))
+    throw new Error("read-secret needs a target ref");
+  const allowDomains = [];
+  for (const a of rest) {
+    if (!a.startsWith("--allow-domain="))
+      throw new Error(`read-secret: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+    const d = a.slice("--allow-domain=".length);
+    domainGlobToRegExp(d);
+    allowDomains.push(d);
+  }
+  if (!allowDomains.length)
+    throw new Error("read-secret needs --allow-domain");
+  return { ref, allowDomains };
+}
+function buildReadCode(ref, allowDomains) {
+  const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
+  const locator = /^(f\d+)?e\d+$/.test(ref) ? `page.locator(${JSON.stringify(`aria-ref=${ref}`)})` : `page.locator(${JSON.stringify(ref)})`;
+  return `async page => {
+  const el = await ${locator}.elementHandle({ timeout: 10000 });
+  try {
+    const host = String(await el.evaluate(e => e.ownerDocument.location.hostname)).toLowerCase();
+    const allowed = ${JSON.stringify(patterns)};
+    if (!allowed.some(p => new RegExp(p, "i").test(host)))
+      throw new Error("read-secret refused: the field's page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+    // Like fill: a label ref means its control. A field reads as its value; anything else (a
+    // secret shown as text after "Show") as its text.
+    // A page getter can throw an error that quotes the value: report a fixed message instead.
+    let value;
+    try {
+      value = await el.evaluate(e => {
+        const t = e.tagName === "LABEL" && e.control ? e.control : e;
+        return t.tagName === "INPUT" || t.tagName === "TEXTAREA" || t.tagName === "SELECT" ? String(t.value) : String(t.textContent ?? "").trim();
+      });
+    } catch { throw new Error("read-secret: could not read the field"); }
+    return JSON.stringify({ host, value });
+  } finally {
+    await el.dispose().catch(() => {});
+  }
+}`;
+}
+async function readSecretOnSession(opts) {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadCode(opts.ref, opts.allowDomains), json: true });
+  if (isError)
+    throw new Error(text.match(/read-secret refused: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
+`)[0] : "read-secret: could not read the field (is the ref from a fresh rech snapshot?)"));
+  let raw;
+  try {
+    raw = JSON.parse(text).result;
+  } catch {
+    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  }
+  let out = raw;
+  for (let i = 0;i < 2 && typeof out === "string"; i++) {
+    try {
+      out = JSON.parse(out);
+    } catch {
+      out = undefined;
+    }
+  }
+  if (!out || typeof out.host !== "string" || typeof out.value !== "string")
+    throw new Error("read-secret: the page returned no value");
+  return out;
+}
 var PASSWORD_FIELDS = 'input[type=password], input[autocomplete~="current-password" i], input[autocomplete~="new-password" i], input[name*="pass" i], input[id*="pass" i]';
 var PASSWORD_VALUES_CODE = `async page => {
   const values = [];
@@ -381,11 +483,13 @@ function maskPasswordLines(text) {
 export {
   FILL_SECRET_USAGE,
   MIN_MASK_LENGTH,
+  READ_SECRET_USAGE,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
   base32Decode,
   buildFillCode,
+  buildReadCode,
   daemonSessionSockets,
   domainGlobToRegExp,
   fillSecretOnSession,
@@ -397,9 +501,13 @@ export {
   parseDotenv,
   parseFillSecretArgs,
   parseFillSecretWire,
+  parseReadSecretArgs,
+  parseReadSecretWire,
   parseScanResult,
   passwordValuesOnSession,
+  readSecretOnSession,
   readSecretSource,
+  readSecretWireArgs,
   runCodeOnSession,
   sessionSocketCandidates,
   socketRequest,

package/fill-secret.ts

@@ -21,7 +21,8 @@ export const SECRET_MASK = "***";
 export const SECRET_MASK_TTL_MS = 15 * 60_000;
 /** Shorter values are never masked: masking "1" everywhere would turn every 1 in every output
  *  into ***, corrupting ids and refs for the daemon's lifetime. A TOTP code (6 digits) still is.
- *  The fill-secret command's own output is still scrubbed of its value, whatever the length. */
+ *  A short value is kept out of fill-secret's own reply by dropping the echoed code that holds it,
+ *  and out of its error message by an exact replace; anything the page itself shows is not masked. */
 export const MIN_MASK_LENGTH = 6;
 export const maskable = (value: string | undefined | null): value is string => !!value && value.length >= MIN_MASK_LENGTH;
 
@@ -347,6 +348,101 @@ export function fillSecretOnSession(opts: { socketRoot: string; session: string;
   return runCodeOnSession({ ...opts, code: buildFillCode(opts.ref, opts.value, opts.allowDomains, opts.submit) });
 }
 
+// ---------- read-secret: a field's value to a pipe ----------
+//
+// The reverse of fill-secret, for moving a secret a page shows (an API signing secret in a
+// password-type field) into a vault without it appearing anywhere. The page host must match a
+// required --allow-domain; the value travels only in the response's `secretOut` field, is never
+// logged, is masked in every later output, and the client writes it raw to a pipe only, never
+// to a terminal. On a profile-scoped listener it is refused unless the host turned it on.
+
+export const READ_SECRET_USAGE = `Usage: rech read-secret <ref|selector> --allow-domain <glob> [--allow-domain <glob>]... | <vault command>
+  Writes the field's current value, raw and without a newline, to stdout, which must be a pipe
+  into the program that stores it (never a terminal or a file). The value is never logged and
+  is masked in later outputs.
+  --allow-domain GLOB   required: refuse unless the field's page host matches, e.g. app.slack.com`;
+
+/** Client args → the wire args (same shape); --allow-domain is required. */
+export function parseReadSecretArgs(args: string[]): { ref: string; allowDomains: string[] } {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-secret") throw new Error("Expected read-secret");
+  let ref: string | undefined;
+  const allowDomains: string[] = [];
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i]!;
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v) throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) { domainGlobToRegExp(d.trim()); allowDomains.push(d.trim()); }
+    } else if (a.startsWith("-")) throw new Error(`read-secret: unknown option ${a}`);
+    else if (ref === undefined) ref = a;
+    else throw new Error("read-secret takes one target");
+  }
+  if (!ref) throw new Error("read-secret needs a target ref (from rech snapshot) or a selector");
+  if (!allowDomains.length) throw new Error("read-secret needs --allow-domain: name the site the secret must come from");
+  return { ref, allowDomains };
+}
+
+export function readSecretWireArgs(req: { ref: string; allowDomains: string[] }): string[] {
+  return ["read-secret", req.ref, ...req.allowDomains.map(d => `--allow-domain=${d}`)];
+}
+
+/** Parse what the daemon received; exactly the shape readSecretWireArgs sends. */
+export function parseReadSecretWire(args: string[]): { ref: string; allowDomains: string[] } {
+  const [cmd, ref, ...rest] = args;
+  if (cmd !== "read-secret" || !ref || ref.startsWith("-")) throw new Error("read-secret needs a target ref");
+  const allowDomains: string[] = [];
+  for (const a of rest) {
+    if (!a.startsWith("--allow-domain=")) throw new Error(`read-secret: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+    const d = a.slice("--allow-domain=".length);
+    domainGlobToRegExp(d);
+    allowDomains.push(d);
+  }
+  if (!allowDomains.length) throw new Error("read-secret needs --allow-domain");
+  return { ref, allowDomains };
+}
+
+/** run-code that checks the field's own document host, then returns {host, value} as JSON. */
+export function buildReadCode(ref: string, allowDomains: string[]): string {
+  const patterns = allowDomains.map(d => domainGlobToRegExp(d).source);
+  const locator = /^(f\d+)?e\d+$/.test(ref) ? `page.locator(${JSON.stringify(`aria-ref=${ref}`)})` : `page.locator(${JSON.stringify(ref)})`;
+  return `async page => {
+  const el = await ${locator}.elementHandle({ timeout: 10000 });
+  try {
+    const host = String(await el.evaluate(e => e.ownerDocument.location.hostname)).toLowerCase();
+    const allowed = ${JSON.stringify(patterns)};
+    if (!allowed.some(p => new RegExp(p, "i").test(host)))
+      throw new Error("read-secret refused: the field's page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+    // Like fill: a label ref means its control. A field reads as its value; anything else (a
+    // secret shown as text after "Show") as its text.
+    // A page getter can throw an error that quotes the value: report a fixed message instead.
+    let value;
+    try {
+      value = await el.evaluate(e => {
+        const t = e.tagName === "LABEL" && e.control ? e.control : e;
+        return t.tagName === "INPUT" || t.tagName === "TEXTAREA" || t.tagName === "SELECT" ? String(t.value) : String(t.textContent ?? "").trim();
+      });
+    } catch { throw new Error("read-secret: could not read the field"); }
+    return JSON.stringify({ host, value });
+  } finally {
+    await el.dispose().catch(() => {});
+  }
+}`;
+}
+
+/** Read the field on the session's live browser. The returned value must never be logged. */
+export async function readSecretOnSession(opts: { socketRoot: string; session: string; cwd: string; ref: string; allowDomains: string[] }): Promise<{ host: string; value: string }> {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadCode(opts.ref, opts.allowDomains), json: true });
+  // Pass on only the messages this code writes itself (they hold the host, never the value).
+  if (isError) throw new Error(text.match(/read-secret refused: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split("\n")[0]! : "read-secret: could not read the field (is the ref from a fresh rech snapshot?)"));
+  let raw: unknown;
+  try { raw = JSON.parse(text).result; } catch { raw = text.match(/### Result\n([^\n]*)/)?.[1]; }
+  let out: any = raw;
+  for (let i = 0; i < 2 && typeof out === "string"; i++) { try { out = JSON.parse(out); } catch { out = undefined; } }
+  if (!out || typeof out.host !== "string" || typeof out.value !== "string") throw new Error("read-secret: the page returned no value");
+  return out;
+}
+
 // ---------- password fields in snapshots ----------
 //
 // Snapshots print every input's value, and that includes password fields Chrome autofilled

package/listeners.js

@@ -76,6 +76,8 @@ function validateListeners(value) {
     }
     if (l.uploads !== undefined && l.uploads !== false)
       validateUploadPolicy(l.uploads);
+    if (l.readSecrets !== undefined && typeof l.readSecrets !== "boolean")
+      throw new Error("readSecrets must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
       throw new Error("Listener names, addresses, and credentials must be unique");
@@ -130,9 +132,11 @@ function authorizeProfileRequest(listener, body) {
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
   if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
-  if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0]))
+  if (args[0] === "read-secret" && listener.readSecrets !== true)
+    throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] !== "upload" && args[0] !== "read-secret" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain=")))))
+  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain="))))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");

package/listeners.ts

@@ -6,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false; readSecrets?: boolean };
 // retiredPorts: ports of removed listeners, newest last. New listeners skip them so a link
 // saved for a removed listener gets "connection refused", not some other listener's answer.
 export type ListenerConfig = { version: 1; listeners: Listener[]; retiredPorts?: number[] };
@@ -61,6 +61,7 @@ export function validateListeners(value: unknown): ListenerConfig {
     // Uploads are on unless set to false: the client sends file bytes it already has, and the
     // host never reads a path for them.
     if (l.uploads !== undefined && l.uploads !== false) validateUploadPolicy(l.uploads);
+    if (l.readSecrets !== undefined && typeof l.readSecrets !== "boolean") throw new Error("readSecrets must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -107,8 +108,10 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
   if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
-  if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
+  if (args[0] === "read-secret" && listener.readSecrets !== true)
+    throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] !== "upload" && args[0] !== "read-secret" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
   // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
   if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.40.0",
+  "version": "1.42.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"
@@ -23,6 +23,9 @@
     "listeners.js",
     "fill-secret.ts",
     "fill-secret.js",
+    "redact.ts",
+    "redact.js",
+    "secret-rules",
     "extension",
     "rechrome.js",
     "rechrome.ts",
@@ -50,7 +53,7 @@
     "vendor-cli": "bash scripts/vendor-cli.sh",
     "prepare": "bash scripts/vendor-cli.sh --prepare",
     "check-pack": "bash scripts/check-pack.sh",
-    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build fill-secret.ts --target=bun --outfile=fill-secret.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bun build secret.ts --target=bun --external node-datachannel --outfile=secret.js && bun build shares.ts --target=bun --external node-datachannel --outfile=shares.js && bun build e2e.ts --target=bun --external node-datachannel --outfile=e2e.js && bun build webrtc.ts --target=bun --external node-datachannel --outfile=webrtc.js && bun build signal-relay.ts --target=bun --external node-datachannel --outfile=signal-relay.js && bash scripts/check-pack.sh"
+    "prepublishOnly": "bash scripts/vendor-cli.sh && sed 's/\\.ts/\\.js/g' rechrome.ts > rechrome.js && sed 's/\\.ts/\\.js/g' serve.ts > serve.js && bun build extension-token.ts --target=bun --outfile=extension-token.js && bun build daemon-manager.ts --target=bun --outfile=daemon-manager.js && bun build listeners.ts --target=bun --outfile=listeners.js && bun build fill-secret.ts --target=bun --outfile=fill-secret.js && bun build scoped-upload.ts --target=bun --outfile=scoped-upload.js && bun build secret.ts --target=bun --external node-datachannel --outfile=secret.js && bun build shares.ts --target=bun --external node-datachannel --outfile=shares.js && bun build e2e.ts --target=bun --external node-datachannel --outfile=e2e.js && bun build webrtc.ts --target=bun --external node-datachannel --outfile=webrtc.js && bun build signal-relay.ts --target=bun --external node-datachannel --outfile=signal-relay.js && bun build redact.ts --target=bun --outfile=redact.js && bash scripts/check-pack.sh"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/rechrome.js

@@ -5,9 +5,10 @@ import { readListeners, writeListeners as writeListenersFile, listenerAddress, i
 import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
-import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
+import { redact } from "./redact.js";
+import { READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
+import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
@@ -642,7 +643,7 @@ export async function getOrCreateUrl(persist = true): Promise<string> {
     const envRaw = await file(globalEnvFile).text().catch(() => "");
     const lines = envRaw.trimEnd().split("\n").filter(l => !l.startsWith(`${ENV_KEY}=`));
     const content = [...lines, newLine, ""].join("\n");
-    await Bun.write(globalEnvFile, content);
+    await writeAtomic(globalEnvFile, content, 0o600); // holds the management key
   }
   process.env[ENV_KEY] = url;
   return url;
@@ -1779,7 +1780,7 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     if (!picked.startsWith(SETUP)) return picked;
     const dir = picked.slice(SETUP.length);
     console.error(`[rech] ${dir} isn't set up yet; running rech setup --profile ${JSON.stringify(dir)} first.`);
-    await setup({ profile: dir });
+    await setup({ profile: dir, skipShare: true });
     const after = await readTokenRegistry();
     const key = unregisteredChromeProfiles(after, { [dir]: {} }).length ? undefined : canonicalProfileKeys(after).find(k => after[k].profileDir === dir);
     if (process.exitCode || !key) throw new Error(`Setup didn't register ${dir}; nothing shared. Retry with: rech setup --profile ${JSON.stringify(dir)}`);
@@ -1931,7 +1932,7 @@ async function callServe(
   throwOnFailure = false,
   upload?: UploadPayload,
   secret?: string,
-): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
+): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean; secretOut?: string }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
   // and run() has already done so for its log line. Recomputing here would double those git
@@ -2168,6 +2169,29 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   let secret: string | undefined;
   let upload: UploadPayload | undefined;
   const cmdIdx = args.findIndex(a => !a.startsWith("-s="));
+  if (args[cmdIdx] === "read-secret") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
+    let wire: string[];
+    try {
+      // Only a pipe: a terminal would show the secret, and a file would keep it. Checked before
+      // asking the host for it.
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-secret writes the secret to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      wire = readSecretWireArgs(parseReadSecretArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_SECRET_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...wire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-secret: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    // Wait until the pipe has taken all of it before exiting.
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-secret: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "fill-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(FILL_SECRET_USAGE); process.exit(0); }
     try {
@@ -2188,7 +2212,13 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   }
   const served = await callServe(url, args, overrideEnv, identity, false, upload, secret);
   // The daemon already masks the value; this is a second line of defence for an older daemon.
-  const scrub = (s: string) => secret && s ? s.replaceAll(secret, SECRET_MASK) : s;
+  // Then any secret-shaped string (API keys, tokens) in page text, unless RECH_REDACT=0.
+  const scrub = (s: string) => {
+    if (!s) return s;
+    if (secret) s = s.replaceAll(secret, SECRET_MASK);
+    if (process.env.RECH_REDACT === "0") return s;
+    try { return redact(s).text; } catch { return s; } // missing rules must not swallow output
+  };
   const { files, existingSession } = served;
   const status = served.status, stdout = scrub(served.stdout), stderr = scrub(served.stderr);
   if (!opts.bridgeRetried && isBridgeTimeout(args, { status, stderr })) {
@@ -2730,7 +2760,7 @@ export async function daemonInstall(serveUrl: string): Promise<void> {
   const envRaw = await file(globalEnvFile).text().catch(() => "");
   const lines = envRaw.trimEnd().split("\n");
   const filtered = lines.filter(l => !l.startsWith(`${ENV_KEY}=`));
-  await Bun.write(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"));
+  await writeAtomic(globalEnvFile, [...filtered, envAssignment(ENV_KEY, keepProfileParam(serveUrl, lines.find(l => l.startsWith(`${ENV_KEY}=`))?.slice(ENV_KEY.length + 1))), ""].join("\n"), 0o600);
 
   const home = HOME;
   const bunBin = Bun.which("bun") ?? process.execPath;
@@ -3338,7 +3368,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3356,7 +3386,12 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     else policy.hostDirs = [...new Set([...(policy.hostDirs ?? []), ...opts.hostUploadDirs!.map(d => realpathSync(resolve(d)))])];
     listener.uploads = policy;
   }
+  if (opts.readSecrets !== undefined) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-secret is always available there.`);
+    if (opts.readSecrets) listener.readSecrets = true; else delete listener.readSecrets;
+  }
   await writeListeners(config);
+  if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
   if (opts.hostUploadDirs?.length || opts.noHostUploads) {
     const dirs = (listener.uploads || {}).hostDirs;
@@ -3427,7 +3462,6 @@ async function saveGlobalUrl(url: string): Promise<string> {
   return writeEnvUrl(GLOBAL_ENV_FILE, url);
 }
 
-/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 /** Write a file whole or not at all: a temp file beside it, then rename (atomic on one filesystem). */
 export async function writeAtomic(path: string, data: string, mode?: number): Promise<void> {
   // A symlinked .env.local stays a link: write the file it points to.
@@ -3464,6 +3498,7 @@ export async function ensureProjectDir(dir: string): Promise<void> {
   if (!existsSync(readme)) await writeAtomic(readme, PROJECT_DIR_README);
 }
 
+/** Replace RECHROME_URL in an env file, keeping its other lines; owner-only, since the URL holds a key. */
 async function writeEnvUrl(envPath: string, url: string): Promise<string> {
   const lines = (await file(envPath).text().catch(() => "")).split("\n").filter(l => l.trim() && !l.startsWith(`${ENV_KEY}=`));
   await writeAtomic(envPath, [...lines, envAssignment(ENV_KEY, url), ""].join("\n"), 0o600);
@@ -3974,7 +4009,7 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
-  if (bridgeVerified && isTTY && !opts.listen) await setupShareStep(ask, profileEmail);
+  if (bridgeVerified && isTTY && !opts.listen && !opts.skipShare) await setupShareStep(ask, profileEmail);
   rl?.close();
   envWatcher?.close();
   if (bridgeVerified)
@@ -4423,7 +4458,7 @@ async function status(): Promise<void> {
 }
 
 
-export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean };
+export type SetupOptions = { profile?: string; token?: string; listen?: string; prefix?: string; port?: number; yes?: boolean; /** Called from `rech share`, which shares the profile itself. */ skipShare?: boolean };
 export type RechHandlers = {
   serve(): Promise<void> | void;
   status(): Promise<void>;
@@ -4440,7 +4475,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4473,6 +4508,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
       --isolate      in a throwaway session, e.g. for a login flow
   rech fill-secret <ref> --from-env VAR | --totp-from-env VAR [--env-file f] [--allow-domain '*.example.com']
                      type a password / TOTP code without it reaching argv, logs or output
+  rech read-secret <ref> --allow-domain <host> | <vault command>
+                     copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4588,9 +4625,10 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),