rechrome 1.41.0 → 1.42.0

package/README.md

@@ -97,6 +97,25 @@ browser writes it, not before (downloads wait for the scrub). The check reads th
 the snapshot, so a page script that clears or replaces a neutrally-labelled password field in
 between can slip past; closing that needs redaction inside playwright's snapshot code. Not yet supported on a Windows daemon.
 
+#### Copying a secret out of a page: `read-secret`
+
+The reverse of `fill-secret`, for moving a secret that a page shows (an app's signing
+secret, an API key) into a vault without it appearing anywhere:
+
+```bash
+rech read-secret e12 --allow-domain api.example.com | vault-put my-app/signing-secret
+```
+
+- `--allow-domain` is required. The field's own page host must match it.
+- The value goes back in its own response field. It is never in a log line, a file or
+  another command's output, and is masked in every later output.
+- stdout must be a pipe: a terminal or a file redirect is refused before the host is asked.
+- A label ref means its input, as with `fill`. A non-field element gives its text.
+- On a shared (scoped) listener it is off until the host runs
+  `rech listener set <listener> --read-secrets`. Each read is logged without the value.
+  Turn it on only for links you trust with every account in their profiles: the caller picks
+  `--allow-domain`, so the link can read any field it can reach, saved passwords included.
+
 ### 3. Where things are kept
 
 | Where | What |

package/fill-secret.js

@@ -332,6 +332,108 @@ async function runCodeOnSession(opts) {
 function fillSecretOnSession(opts) {
   return runCodeOnSession({ ...opts, code: buildFillCode(opts.ref, opts.value, opts.allowDomains, opts.submit) });
 }
+var READ_SECRET_USAGE = `Usage: rech read-secret <ref|selector> --allow-domain <glob> [--allow-domain <glob>]... | <vault command>
+  Writes the field's current value, raw and without a newline, to stdout, which must be a pipe
+  into the program that stores it (never a terminal or a file). The value is never logged and
+  is masked in later outputs.
+  --allow-domain GLOB   required: refuse unless the field's page host matches, e.g. app.slack.com`;
+function parseReadSecretArgs(args) {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-secret")
+    throw new Error("Expected read-secret");
+  let ref;
+  const allowDomains = [];
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v)
+        throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) {
+        domainGlobToRegExp(d.trim());
+        allowDomains.push(d.trim());
+      }
+    } else if (a.startsWith("-"))
+      throw new Error(`read-secret: unknown option ${a}`);
+    else if (ref === undefined)
+      ref = a;
+    else
+      throw new Error("read-secret takes one target");
+  }
+  if (!ref)
+    throw new Error("read-secret needs a target ref (from rech snapshot) or a selector");
+  if (!allowDomains.length)
+    throw new Error("read-secret needs --allow-domain: name the site the secret must come from");
+  return { ref, allowDomains };
+}
+function readSecretWireArgs(req) {
+  return ["read-secret", req.ref, ...req.allowDomains.map((d) => `--allow-domain=${d}`)];
+}
+function parseReadSecretWire(args) {
+  const [cmd, ref, ...rest] = args;
+  if (cmd !== "read-secret" || !ref || ref.startsWith("-"))
+    throw new Error("read-secret needs a target ref");
+  const allowDomains = [];
+  for (const a of rest) {
+    if (!a.startsWith("--allow-domain="))
+      throw new Error(`read-secret: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+    const d = a.slice("--allow-domain=".length);
+    domainGlobToRegExp(d);
+    allowDomains.push(d);
+  }
+  if (!allowDomains.length)
+    throw new Error("read-secret needs --allow-domain");
+  return { ref, allowDomains };
+}
+function buildReadCode(ref, allowDomains) {
+  const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
+  const locator = /^(f\d+)?e\d+$/.test(ref) ? `page.locator(${JSON.stringify(`aria-ref=${ref}`)})` : `page.locator(${JSON.stringify(ref)})`;
+  return `async page => {
+  const el = await ${locator}.elementHandle({ timeout: 10000 });
+  try {
+    const host = String(await el.evaluate(e => e.ownerDocument.location.hostname)).toLowerCase();
+    const allowed = ${JSON.stringify(patterns)};
+    if (!allowed.some(p => new RegExp(p, "i").test(host)))
+      throw new Error("read-secret refused: the field's page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+    // Like fill: a label ref means its control. A field reads as its value; anything else (a
+    // secret shown as text after "Show") as its text.
+    // A page getter can throw an error that quotes the value: report a fixed message instead.
+    let value;
+    try {
+      value = await el.evaluate(e => {
+        const t = e.tagName === "LABEL" && e.control ? e.control : e;
+        return t.tagName === "INPUT" || t.tagName === "TEXTAREA" || t.tagName === "SELECT" ? String(t.value) : String(t.textContent ?? "").trim();
+      });
+    } catch { throw new Error("read-secret: could not read the field"); }
+    return JSON.stringify({ host, value });
+  } finally {
+    await el.dispose().catch(() => {});
+  }
+}`;
+}
+async function readSecretOnSession(opts) {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadCode(opts.ref, opts.allowDomains), json: true });
+  if (isError)
+    throw new Error(text.match(/read-secret refused: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
+`)[0] : "read-secret: could not read the field (is the ref from a fresh rech snapshot?)"));
+  let raw;
+  try {
+    raw = JSON.parse(text).result;
+  } catch {
+    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  }
+  let out = raw;
+  for (let i = 0;i < 2 && typeof out === "string"; i++) {
+    try {
+      out = JSON.parse(out);
+    } catch {
+      out = undefined;
+    }
+  }
+  if (!out || typeof out.host !== "string" || typeof out.value !== "string")
+    throw new Error("read-secret: the page returned no value");
+  return out;
+}
 var PASSWORD_FIELDS = 'input[type=password], input[autocomplete~="current-password" i], input[autocomplete~="new-password" i], input[name*="pass" i], input[id*="pass" i]';
 var PASSWORD_VALUES_CODE = `async page => {
   const values = [];
@@ -381,11 +483,13 @@ function maskPasswordLines(text) {
 export {
   FILL_SECRET_USAGE,
   MIN_MASK_LENGTH,
+  READ_SECRET_USAGE,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
   base32Decode,
   buildFillCode,
+  buildReadCode,
   daemonSessionSockets,
   domainGlobToRegExp,
   fillSecretOnSession,
@@ -397,9 +501,13 @@ export {
   parseDotenv,
   parseFillSecretArgs,
   parseFillSecretWire,
+  parseReadSecretArgs,
+  parseReadSecretWire,
   parseScanResult,
   passwordValuesOnSession,
+  readSecretOnSession,
   readSecretSource,
+  readSecretWireArgs,
   runCodeOnSession,
   sessionSocketCandidates,
   socketRequest,

package/fill-secret.ts

@@ -348,6 +348,101 @@ export function fillSecretOnSession(opts: { socketRoot: string; session: string;
   return runCodeOnSession({ ...opts, code: buildFillCode(opts.ref, opts.value, opts.allowDomains, opts.submit) });
 }
 
+// ---------- read-secret: a field's value to a pipe ----------
+//
+// The reverse of fill-secret, for moving a secret a page shows (an API signing secret in a
+// password-type field) into a vault without it appearing anywhere. The page host must match a
+// required --allow-domain; the value travels only in the response's `secretOut` field, is never
+// logged, is masked in every later output, and the client writes it raw to a pipe only, never
+// to a terminal. On a profile-scoped listener it is refused unless the host turned it on.
+
+export const READ_SECRET_USAGE = `Usage: rech read-secret <ref|selector> --allow-domain <glob> [--allow-domain <glob>]... | <vault command>
+  Writes the field's current value, raw and without a newline, to stdout, which must be a pipe
+  into the program that stores it (never a terminal or a file). The value is never logged and
+  is masked in later outputs.
+  --allow-domain GLOB   required: refuse unless the field's page host matches, e.g. app.slack.com`;
+
+/** Client args → the wire args (same shape); --allow-domain is required. */
+export function parseReadSecretArgs(args: string[]): { ref: string; allowDomains: string[] } {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-secret") throw new Error("Expected read-secret");
+  let ref: string | undefined;
+  const allowDomains: string[] = [];
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i]!;
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v) throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) { domainGlobToRegExp(d.trim()); allowDomains.push(d.trim()); }
+    } else if (a.startsWith("-")) throw new Error(`read-secret: unknown option ${a}`);
+    else if (ref === undefined) ref = a;
+    else throw new Error("read-secret takes one target");
+  }
+  if (!ref) throw new Error("read-secret needs a target ref (from rech snapshot) or a selector");
+  if (!allowDomains.length) throw new Error("read-secret needs --allow-domain: name the site the secret must come from");
+  return { ref, allowDomains };
+}
+
+export function readSecretWireArgs(req: { ref: string; allowDomains: string[] }): string[] {
+  return ["read-secret", req.ref, ...req.allowDomains.map(d => `--allow-domain=${d}`)];
+}
+
+/** Parse what the daemon received; exactly the shape readSecretWireArgs sends. */
+export function parseReadSecretWire(args: string[]): { ref: string; allowDomains: string[] } {
+  const [cmd, ref, ...rest] = args;
+  if (cmd !== "read-secret" || !ref || ref.startsWith("-")) throw new Error("read-secret needs a target ref");
+  const allowDomains: string[] = [];
+  for (const a of rest) {
+    if (!a.startsWith("--allow-domain=")) throw new Error(`read-secret: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+    const d = a.slice("--allow-domain=".length);
+    domainGlobToRegExp(d);
+    allowDomains.push(d);
+  }
+  if (!allowDomains.length) throw new Error("read-secret needs --allow-domain");
+  return { ref, allowDomains };
+}
+
+/** run-code that checks the field's own document host, then returns {host, value} as JSON. */
+export function buildReadCode(ref: string, allowDomains: string[]): string {
+  const patterns = allowDomains.map(d => domainGlobToRegExp(d).source);
+  const locator = /^(f\d+)?e\d+$/.test(ref) ? `page.locator(${JSON.stringify(`aria-ref=${ref}`)})` : `page.locator(${JSON.stringify(ref)})`;
+  return `async page => {
+  const el = await ${locator}.elementHandle({ timeout: 10000 });
+  try {
+    const host = String(await el.evaluate(e => e.ownerDocument.location.hostname)).toLowerCase();
+    const allowed = ${JSON.stringify(patterns)};
+    if (!allowed.some(p => new RegExp(p, "i").test(host)))
+      throw new Error("read-secret refused: the field's page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+    // Like fill: a label ref means its control. A field reads as its value; anything else (a
+    // secret shown as text after "Show") as its text.
+    // A page getter can throw an error that quotes the value: report a fixed message instead.
+    let value;
+    try {
+      value = await el.evaluate(e => {
+        const t = e.tagName === "LABEL" && e.control ? e.control : e;
+        return t.tagName === "INPUT" || t.tagName === "TEXTAREA" || t.tagName === "SELECT" ? String(t.value) : String(t.textContent ?? "").trim();
+      });
+    } catch { throw new Error("read-secret: could not read the field"); }
+    return JSON.stringify({ host, value });
+  } finally {
+    await el.dispose().catch(() => {});
+  }
+}`;
+}
+
+/** Read the field on the session's live browser. The returned value must never be logged. */
+export async function readSecretOnSession(opts: { socketRoot: string; session: string; cwd: string; ref: string; allowDomains: string[] }): Promise<{ host: string; value: string }> {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadCode(opts.ref, opts.allowDomains), json: true });
+  // Pass on only the messages this code writes itself (they hold the host, never the value).
+  if (isError) throw new Error(text.match(/read-secret refused: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split("\n")[0]! : "read-secret: could not read the field (is the ref from a fresh rech snapshot?)"));
+  let raw: unknown;
+  try { raw = JSON.parse(text).result; } catch { raw = text.match(/### Result\n([^\n]*)/)?.[1]; }
+  let out: any = raw;
+  for (let i = 0; i < 2 && typeof out === "string"; i++) { try { out = JSON.parse(out); } catch { out = undefined; } }
+  if (!out || typeof out.host !== "string" || typeof out.value !== "string") throw new Error("read-secret: the page returned no value");
+  return out;
+}
+
 // ---------- password fields in snapshots ----------
 //
 // Snapshots print every input's value, and that includes password fields Chrome autofilled

package/listeners.js

@@ -76,6 +76,8 @@ function validateListeners(value) {
     }
     if (l.uploads !== undefined && l.uploads !== false)
       validateUploadPolicy(l.uploads);
+    if (l.readSecrets !== undefined && typeof l.readSecrets !== "boolean")
+      throw new Error("readSecrets must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
       throw new Error("Listener names, addresses, and credentials must be unique");
@@ -130,9 +132,11 @@ function authorizeProfileRequest(listener, body) {
   const args = body.args.filter((a) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
   if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
-  if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0]))
+  if (args[0] === "read-secret" && listener.readSecrets !== true)
+    throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] !== "upload" && args[0] !== "read-secret" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain=")))))
+  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain="))))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");

package/listeners.ts

@@ -6,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false; readSecrets?: boolean };
 // retiredPorts: ports of removed listeners, newest last. New listeners skip them so a link
 // saved for a removed listener gets "connection refused", not some other listener's answer.
 export type ListenerConfig = { version: 1; listeners: Listener[]; retiredPorts?: number[] };
@@ -61,6 +61,7 @@ export function validateListeners(value: unknown): ListenerConfig {
     // Uploads are on unless set to false: the client sends file bytes it already has, and the
     // host never reads a path for them.
     if (l.uploads !== undefined && l.uploads !== false) validateUploadPolicy(l.uploads);
+    if (l.readSecrets !== undefined && typeof l.readSecrets !== "boolean") throw new Error("readSecrets must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -107,8 +108,10 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
   const args = body.args.filter((a: string) => /^-s=[a-zA-Z0-9_-]{1,64}$/.test(a) === false);
   if (args[0] === "upload" && listener.uploads === false)
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
-  if (args[0] !== "upload" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
+  if (args[0] === "read-secret" && listener.readSecrets !== true)
+    throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] !== "upload" && args[0] !== "read-secret" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
   // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
   if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -6,9 +6,9 @@ import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
 import { redact } from "./redact.js";
-import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
+import { READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
+import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
@@ -1932,7 +1932,7 @@ async function callServe(
   throwOnFailure = false,
   upload?: UploadPayload,
   secret?: string,
-): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
+): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean; secretOut?: string }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
   // and run() has already done so for its log line. Recomputing here would double those git
@@ -2169,6 +2169,29 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   let secret: string | undefined;
   let upload: UploadPayload | undefined;
   const cmdIdx = args.findIndex(a => !a.startsWith("-s="));
+  if (args[cmdIdx] === "read-secret") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
+    let wire: string[];
+    try {
+      // Only a pipe: a terminal would show the secret, and a file would keep it. Checked before
+      // asking the host for it.
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-secret writes the secret to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      wire = readSecretWireArgs(parseReadSecretArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_SECRET_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...wire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-secret: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    // Wait until the pipe has taken all of it before exiting.
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-secret: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "fill-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(FILL_SECRET_USAGE); process.exit(0); }
     try {
@@ -3345,7 +3368,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3363,7 +3386,12 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     else policy.hostDirs = [...new Set([...(policy.hostDirs ?? []), ...opts.hostUploadDirs!.map(d => realpathSync(resolve(d)))])];
     listener.uploads = policy;
   }
+  if (opts.readSecrets !== undefined) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-secret is always available there.`);
+    if (opts.readSecrets) listener.readSecrets = true; else delete listener.readSecrets;
+  }
   await writeListeners(config);
+  if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
   if (opts.hostUploadDirs?.length || opts.noHostUploads) {
     const dirs = (listener.uploads || {}).hostDirs;
@@ -4447,7 +4475,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4480,6 +4508,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
       --isolate      in a throwaway session, e.g. for a login flow
   rech fill-secret <ref> --from-env VAR | --totp-from-env VAR [--env-file f] [--allow-domain '*.example.com']
                      type a password / TOTP code without it reaching argv, logs or output
+  rech read-secret <ref> --allow-domain <host> | <vault command>
+                     copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4595,9 +4625,10 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/rechrome.ts

@@ -6,9 +6,9 @@ import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.ts";
 import { redact } from "./redact.ts";
-import { FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
+import { READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
 import { createHash, randomBytes } from "crypto";
-import { mkdirSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
+import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
 import { isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
@@ -1932,7 +1932,7 @@ async function callServe(
   throwOnFailure = false,
   upload?: UploadPayload,
   secret?: string,
-): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean }> {
+): Promise<{ status: number; stdout: string; stderr: string; files?: string[]; existingSession?: boolean; secretOut?: string }> {
   const { key, host, port, protocol, extensionId, extensionToken, profileDirectory, userDataDir, loadExtension } = parseUrl(url);
   // Reuse the caller's identity when provided — computing it shells out to `git` several times,
   // and run() has already done so for its log line. Recomputing here would double those git
@@ -2169,6 +2169,29 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
   let secret: string | undefined;
   let upload: UploadPayload | undefined;
   const cmdIdx = args.findIndex(a => !a.startsWith("-s="));
+  if (args[cmdIdx] === "read-secret") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
+    let wire: string[];
+    try {
+      // Only a pipe: a terminal would show the secret, and a file would keep it. Checked before
+      // asking the host for it.
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-secret writes the secret to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      wire = readSecretWireArgs(parseReadSecretArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_SECRET_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...wire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-secret: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    // Wait until the pipe has taken all of it before exiting.
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-secret: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "fill-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(FILL_SECRET_USAGE); process.exit(0); }
     try {
@@ -3345,7 +3368,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3363,7 +3386,12 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     else policy.hostDirs = [...new Set([...(policy.hostDirs ?? []), ...opts.hostUploadDirs!.map(d => realpathSync(resolve(d)))])];
     listener.uploads = policy;
   }
+  if (opts.readSecrets !== undefined) {
+    if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-secret is always available there.`);
+    if (opts.readSecrets) listener.readSecrets = true; else delete listener.readSecrets;
+  }
   await writeListeners(config);
+  if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
   if (opts.hostUploadDirs?.length || opts.noHostUploads) {
     const dirs = (listener.uploads || {}).hostDirs;
@@ -4447,7 +4475,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4480,6 +4508,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
       --isolate      in a throwaway session, e.g. for a login flow
   rech fill-secret <ref> --from-env VAR | --totp-from-env VAR [--env-file f] [--allow-domain '*.example.com']
                      type a password / TOTP code without it reaching argv, logs or output
+  rech read-secret <ref> --allow-domain <host> | <vault command>
+                     copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4595,9 +4625,10 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/serve.js

@@ -24,7 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.js";
-import { SecretMasker, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
+import { SecretMasker, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -944,6 +944,23 @@ export async function serve() {
         }
       }
 
+      // read-secret: the value goes back only in `secretOut`, never into stdout, a log line or a
+      // file, and is masked in every later output. See fill-secret.js.
+      if (filteredArgs[0] === "read-secret") {
+        try {
+          const { ref, allowDomains } = parseReadSecretWire(filteredArgs);
+          const { host, value } = await readSecretOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, ref, allowDomains });
+          if (!value) throw new Error(`read-secret: ${ref} on ${host} is empty`);
+          secretMasker.add(value, Infinity);
+          log(`exit: 0 | read-secret ${ref} on ${host} (${value.length} chars, value not logged)`);
+          return Response.json({ status: 0, stdout: "", stderr: "", files: [], secretOut: value });
+        } catch (error) {
+          const message = secretMasker.mask(error instanceof Error ? error.message : String(error));
+          log(`exit: 1 | read-secret: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // For open commands, default to about:blank to avoid leaving connect.html visible
       const isOpenCmd = filteredArgs[0] === "open";
       const isOpenNoUrl = isOpenCmd && filteredArgs.length === 1;

package/serve.ts

@@ -24,7 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.ts";
-import { SecretMasker, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
+import { SecretMasker, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -944,6 +944,23 @@ export async function serve() {
         }
       }
 
+      // read-secret: the value goes back only in `secretOut`, never into stdout, a log line or a
+      // file, and is masked in every later output. See fill-secret.ts.
+      if (filteredArgs[0] === "read-secret") {
+        try {
+          const { ref, allowDomains } = parseReadSecretWire(filteredArgs);
+          const { host, value } = await readSecretOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, ref, allowDomains });
+          if (!value) throw new Error(`read-secret: ${ref} on ${host} is empty`);
+          secretMasker.add(value, Infinity);
+          log(`exit: 0 | read-secret ${ref} on ${host} (${value.length} chars, value not logged)`);
+          return Response.json({ status: 0, stdout: "", stderr: "", files: [], secretOut: value });
+        } catch (error) {
+          const message = secretMasker.mask(error instanceof Error ? error.message : String(error));
+          log(`exit: 1 | read-secret: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // For open commands, default to about:blank to avoid leaving connect.html visible
       const isOpenCmd = filteredArgs[0] === "open";
       const isOpenNoUrl = isOpenCmd && filteredArgs.length === 1;