rechrome 1.43.2 → 1.44.0

package/fill-secret.js

@@ -434,6 +434,123 @@ async function readSecretOnSession(opts) {
     throw new Error("read-secret: the page returned no value");
   return out;
 }
+var READ_STORAGE_USAGE = `Usage: rech read-storage <local|session> <key> [json-path] --allow-domain <glob> | <command>
+  Writes the storage value, raw and without a newline, to stdout, which must be a pipe into the
+  program that stores it (never a terminal or a file). Never logged; masked in later outputs.
+  <local|session>       localStorage or sessionStorage
+  <key>                 the storage key, e.g. localConfig_v2
+  [json-path]           optional: a path into the JSON value, e.g. teams.T0123.token or teams[T0123].token
+  --allow-domain GLOB   required: the page's host must match, e.g. app.slack.com`;
+function parseStoragePath(path) {
+  return path.match(/[^.[\]]+/g) ?? [];
+}
+function parseReadStorageArgs(args) {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-storage")
+    throw new Error("Expected read-storage");
+  const pos = [];
+  const allowDomains = [];
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v)
+        throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) {
+        domainGlobToRegExp(d.trim());
+        allowDomains.push(d.trim());
+      }
+    } else if (a.startsWith("-"))
+      throw new Error(`read-storage: unknown option ${a}`);
+    else
+      pos.push(a);
+  }
+  if (pos.length < 2 || pos.length > 3)
+    throw new Error("read-storage needs <local|session> <key> [json-path]");
+  const [area, key, rawPath] = pos;
+  if (area !== "local" && area !== "session")
+    throw new Error("read-storage: first argument must be 'local' or 'session'");
+  if (!key)
+    throw new Error("read-storage: a storage key is required");
+  if (!allowDomains.length)
+    throw new Error("read-storage needs --allow-domain: name the site the value must come from");
+  return { area, key, path: rawPath ? parseStoragePath(rawPath) : [], allowDomains };
+}
+function readStorageWireArgs(req) {
+  return ["read-storage", req.area, req.key, ...req.path.length ? [req.path.join(".")] : [], ...req.allowDomains.map((d) => `--allow-domain=${d}`)];
+}
+function parseReadStorageWire(args) {
+  const [cmd, area, key, ...rest] = args;
+  if (cmd !== "read-storage" || area !== "local" && area !== "session" || !key || key.startsWith("-"))
+    throw new Error("read-storage needs <local|session> <key>");
+  const allowDomains = [];
+  let path = [];
+  for (const a of rest) {
+    if (a.startsWith("--allow-domain=")) {
+      const d = a.slice("--allow-domain=".length);
+      domainGlobToRegExp(d);
+      allowDomains.push(d);
+    } else if (!a.startsWith("-") && !path.length)
+      path = parseStoragePath(a);
+    else
+      throw new Error(`read-storage: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+  }
+  if (!allowDomains.length)
+    throw new Error("read-storage needs --allow-domain");
+  return { area, key, path, allowDomains };
+}
+function buildReadStorageCode(area, key, path, allowDomains) {
+  const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
+  const store = area === "local" ? "localStorage" : "sessionStorage";
+  return `async page => {
+  // One evaluate: the host checked is the origin read, with no navigation in between.
+  const out = await page.evaluate(({ key, path }) => {
+    const host = String(location.hostname).toLowerCase();
+    const raw = window.${store}.getItem(key);
+    if (raw === null) return { host, missing: true };
+    if (!path.length) return { host, value: raw };
+    let v;
+    try { v = JSON.parse(raw); } catch { return { host, notjson: true }; }
+    for (const seg of path) {
+      if (v == null || typeof v !== "object") return { host, nopath: true };
+      v = v[seg];
+    }
+    if (v === undefined) return { host, nopath: true };
+    return { host, value: typeof v === "string" ? v : JSON.stringify(v) };
+  }, { key: ${JSON.stringify(key)}, path: ${JSON.stringify(path)} });
+  const host = out.host;
+  const allowed = ${JSON.stringify(patterns)};
+  if (!allowed.some(p => new RegExp(p, "i").test(host)))
+    throw new Error("read-storage refused: the page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+  if (out.missing) throw new Error("read-storage: no ${store} key " + JSON.stringify(${JSON.stringify(key)}) + " on " + host);
+  if (out.notjson) throw new Error("read-storage: the value is not JSON, so the path can't apply");
+  if (out.nopath) throw new Error("read-storage: the json-path is not present in the value");
+  return JSON.stringify({ host, value: out.value });
+}`;
+}
+async function readStorageOnSession(opts) {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadStorageCode(opts.area, opts.key, opts.path, opts.allowDomains), json: true });
+  if (isError)
+    throw new Error(text.match(/read-storage(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
+`)[0] : "read-storage: could not read the value"));
+  let raw;
+  try {
+    raw = JSON.parse(text).result;
+  } catch {
+    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  }
+  let o = raw;
+  for (let i = 0;i < 2 && typeof o === "string"; i++) {
+    try {
+      o = JSON.parse(o);
+    } catch {
+      o = undefined;
+    }
+  }
+  if (!o || typeof o.host !== "string" || typeof o.value !== "string")
+    throw new Error("read-storage: the page returned no value");
+  return o;
+}
 var READ_COOKIE_USAGE = `Usage: rech read-cookie <name> <domain> --allow-domain <domain> | <command>
   Writes the cookie's value, raw and without a newline, to stdout, which must be a pipe into the
   program that stores it (never a terminal or a file). Never logged; masked in later outputs.
@@ -590,6 +707,7 @@ export {
   MIN_MASK_LENGTH,
   READ_COOKIE_USAGE,
   READ_SECRET_USAGE,
+  READ_STORAGE_USAGE,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
@@ -597,6 +715,7 @@ export {
   buildFillCode,
   buildReadCode,
   buildReadCookieCode,
+  buildReadStorageCode,
   daemonSessionSockets,
   domainGlobToRegExp,
   fillSecretOnSession,
@@ -612,13 +731,18 @@ export {
   parseReadCookieWire,
   parseReadSecretArgs,
   parseReadSecretWire,
+  parseReadStorageArgs,
+  parseReadStorageWire,
   parseScanResult,
+  parseStoragePath,
   passwordValuesOnSession,
   readCookieOnSession,
   readCookieWireArgs,
   readSecretOnSession,
   readSecretSource,
   readSecretWireArgs,
+  readStorageOnSession,
+  readStorageWireArgs,
   runCodeOnSession,
   sessionSocketCandidates,
   socketRequest,

package/fill-secret.ts

@@ -443,6 +443,108 @@ export async function readSecretOnSession(opts: { socketRoot: string; session: s
   return out;
 }
 
+// ---------- read-storage: a localStorage/sessionStorage value to a pipe ----------
+//
+// Same contract as read-secret: value only in `secretOut`, never logged, masked later, client
+// pipe-only. For the live app token in storage (Slack's localConfig_v2 teams[T...].token). Reads
+// via page-level evaluate, so it works over the extension bridge. localStorage is per-origin, so
+// the session's page must be on the allowed host.
+
+export const READ_STORAGE_USAGE = `Usage: rech read-storage <local|session> <key> [json-path] --allow-domain <glob> | <command>
+  Writes the storage value, raw and without a newline, to stdout, which must be a pipe into the
+  program that stores it (never a terminal or a file). Never logged; masked in later outputs.
+  <local|session>       localStorage or sessionStorage
+  <key>                 the storage key, e.g. localConfig_v2
+  [json-path]           optional: a path into the JSON value, e.g. teams.T0123.token or teams[T0123].token
+  --allow-domain GLOB   required: the page's host must match, e.g. app.slack.com`;
+
+/** Split "teams[T0123].token" / "teams.T0123.token" into ["teams","T0123","token"]. */
+export function parseStoragePath(path: string): string[] {
+  return path.match(/[^.[\]]+/g) ?? [];
+}
+
+export function parseReadStorageArgs(args: string[]): { area: "local" | "session"; key: string; path: string[]; allowDomains: string[] } {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-storage") throw new Error("Expected read-storage");
+  const pos: string[] = [];
+  const allowDomains: string[] = [];
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i]!;
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v) throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) { domainGlobToRegExp(d.trim()); allowDomains.push(d.trim()); }
+    } else if (a.startsWith("-")) throw new Error(`read-storage: unknown option ${a}`);
+    else pos.push(a);
+  }
+  if (pos.length < 2 || pos.length > 3) throw new Error("read-storage needs <local|session> <key> [json-path]");
+  const [area, key, rawPath] = pos;
+  if (area !== "local" && area !== "session") throw new Error("read-storage: first argument must be 'local' or 'session'");
+  if (!key) throw new Error("read-storage: a storage key is required");
+  if (!allowDomains.length) throw new Error("read-storage needs --allow-domain: name the site the value must come from");
+  return { area, key, path: rawPath ? parseStoragePath(rawPath) : [], allowDomains };
+}
+
+export function readStorageWireArgs(req: { area: string; key: string; path: string[]; allowDomains: string[] }): string[] {
+  return ["read-storage", req.area, req.key, ...(req.path.length ? [req.path.join(".")] : []), ...req.allowDomains.map(d => `--allow-domain=${d}`)];
+}
+
+export function parseReadStorageWire(args: string[]): { area: "local" | "session"; key: string; path: string[]; allowDomains: string[] } {
+  const [cmd, area, key, ...rest] = args;
+  if (cmd !== "read-storage" || (area !== "local" && area !== "session") || !key || key.startsWith("-")) throw new Error("read-storage needs <local|session> <key>");
+  const allowDomains: string[] = [];
+  let path: string[] = [];
+  for (const a of rest) {
+    if (a.startsWith("--allow-domain=")) { const d = a.slice("--allow-domain=".length); domainGlobToRegExp(d); allowDomains.push(d); }
+    else if (!a.startsWith("-") && !path.length) path = parseStoragePath(a);
+    else throw new Error(`read-storage: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+  }
+  if (!allowDomains.length) throw new Error("read-storage needs --allow-domain");
+  return { area, key, path, allowDomains };
+}
+
+/** run-code reading storage[key], optionally walking a JSON path; returns {host,value} JSON. */
+export function buildReadStorageCode(area: "local" | "session", key: string, path: string[], allowDomains: string[]): string {
+  const patterns = allowDomains.map(d => domainGlobToRegExp(d).source);
+  const store = area === "local" ? "localStorage" : "sessionStorage";
+  return `async page => {
+  // One evaluate: the host checked is the origin read, with no navigation in between.
+  const out = await page.evaluate(({ key, path }) => {
+    const host = String(location.hostname).toLowerCase();
+    const raw = window.${store}.getItem(key);
+    if (raw === null) return { host, missing: true };
+    if (!path.length) return { host, value: raw };
+    let v;
+    try { v = JSON.parse(raw); } catch { return { host, notjson: true }; }
+    for (const seg of path) {
+      if (v == null || typeof v !== "object") return { host, nopath: true };
+      v = v[seg];
+    }
+    if (v === undefined) return { host, nopath: true };
+    return { host, value: typeof v === "string" ? v : JSON.stringify(v) };
+  }, { key: ${JSON.stringify(key)}, path: ${JSON.stringify(path)} });
+  const host = out.host;
+  const allowed = ${JSON.stringify(patterns)};
+  if (!allowed.some(p => new RegExp(p, "i").test(host)))
+    throw new Error("read-storage refused: the page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+  if (out.missing) throw new Error("read-storage: no ${store} key " + JSON.stringify(${JSON.stringify(key)}) + " on " + host);
+  if (out.notjson) throw new Error("read-storage: the value is not JSON, so the path can't apply");
+  if (out.nopath) throw new Error("read-storage: the json-path is not present in the value");
+  return JSON.stringify({ host, value: out.value });
+}`;
+}
+
+export async function readStorageOnSession(opts: { socketRoot: string; session: string; cwd: string; area: "local" | "session"; key: string; path: string[]; allowDomains: string[] }): Promise<{ host: string; value: string }> {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadStorageCode(opts.area, opts.key, opts.path, opts.allowDomains), json: true });
+  if (isError) throw new Error(text.match(/read-storage(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split("\n")[0]! : "read-storage: could not read the value"));
+  let raw: unknown;
+  try { raw = JSON.parse(text).result; } catch { raw = text.match(/### Result\n([^\n]*)/)?.[1]; }
+  let o: any = raw;
+  for (let i = 0; i < 2 && typeof o === "string"; i++) { try { o = JSON.parse(o); } catch { o = undefined; } }
+  if (!o || typeof o.host !== "string" || typeof o.value !== "string") throw new Error("read-storage: the page returned no value");
+  return o;
+}
+
 // ---------- read-cookie: a cookie value (incl. HttpOnly) to a pipe ----------
 //
 // Same contract as read-secret: the value travels only in the response's `secretOut`, is never

package/listeners.js

@@ -136,11 +136,13 @@ function authorizeProfileRequest(listener, body) {
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] === "read-secret" && listener.readSecrets !== true)
     throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] === "read-storage" && listener.readSecrets !== true)
+    throw new Error(`read-storage is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
   if (args[0] === "read-cookie" && listener.readCookies !== true)
     throw new Error(`read-cookie is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-cookies`);
-  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && !SCOPED_COMMANDS.has(args[0]))
+  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && args[0] !== "read-storage" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain="))))
+  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain=")) && !(args[0] === "read-storage" && a.startsWith("--allow-domain="))))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");

package/listeners.ts

@@ -111,10 +111,12 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] === "read-secret" && listener.readSecrets !== true)
     throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] === "read-storage" && listener.readSecrets !== true)
+    throw new Error(`read-storage is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
   if (args[0] === "read-cookie" && listener.readCookies !== true)
     throw new Error(`read-cookie is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-cookies`);
-  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain=")))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
+  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && args[0] !== "read-storage" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain=")) && !(args[0] === "read-storage" && a.startsWith("--allow-domain=")))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
   // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
   if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.43.2",
+  "version": "1.44.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -6,7 +6,7 @@ import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
 import { redact } from "./redact.js";
-import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
+import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_STORAGE_USAGE, parseReadStorageArgs, readStorageWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
@@ -2189,6 +2189,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     console.error(`[rech] read-cookie: wrote ${res.secretOut.length} characters to stdout`);
     process.exit(0);
   }
+  if (args[cmdIdx] === "read-storage") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_STORAGE_USAGE); process.exit(0); }
+    let swire: string[];
+    try {
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-storage writes the value to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      swire = readStorageWireArgs(parseReadStorageArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_STORAGE_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...swire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-storage: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-storage: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "read-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
     let wire: string[];
@@ -4537,6 +4557,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
                      copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech read-cookie <name> <domain> --allow-domain <domain> | <command>
                      copy a cookie (incl. HttpOnly) into a pipe, never shown or logged
+  rech read-storage <local|session> <key> [json-path] --allow-domain <host> | <command>
+                     copy a localStorage/sessionStorage value into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4652,7 +4674,7 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
-        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
         .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),

package/rechrome.ts

@@ -6,7 +6,7 @@ import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.ts";
 import { redact } from "./redact.ts";
-import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
+import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_STORAGE_USAGE, parseReadStorageArgs, readStorageWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
@@ -2189,6 +2189,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     console.error(`[rech] read-cookie: wrote ${res.secretOut.length} characters to stdout`);
     process.exit(0);
   }
+  if (args[cmdIdx] === "read-storage") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_STORAGE_USAGE); process.exit(0); }
+    let swire: string[];
+    try {
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-storage writes the value to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      swire = readStorageWireArgs(parseReadStorageArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_STORAGE_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...swire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-storage: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-storage: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "read-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
     let wire: string[];
@@ -4537,6 +4557,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
                      copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech read-cookie <name> <domain> --allow-domain <domain> | <command>
                      copy a cookie (incl. HttpOnly) into a pipe, never shown or logged
+  rech read-storage <local|session> <key> [json-path] --allow-domain <host> | <command>
+                     copy a localStorage/sessionStorage value into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4652,7 +4674,7 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
-        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
         .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),

package/serve.js

@@ -24,7 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.js";
-import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
+import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadStorageWire, readStorageOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -961,6 +961,22 @@ export async function serve() {
         }
       }
 
+      // read-storage: a localStorage/sessionStorage value, page-level; secretOut only.
+      if (filteredArgs[0] === "read-storage") {
+        try {
+          const { area, key, path, allowDomains } = parseReadStorageWire(filteredArgs);
+          const { host, value } = await readStorageOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, area, key, path, allowDomains });
+          if (!value) throw new Error(`read-storage: ${area} ${key} on ${host} is empty`);
+          secretMasker.add(value, Infinity);
+          log(`exit: 0 | read-storage ${area} ${key}${path.length ? " " + path.join(".") : ""} on ${host} (${value.length} chars, value not logged)`);
+          return Response.json({ status: 0, stdout: "", stderr: "", files: [], secretOut: value });
+        } catch (error) {
+          const message = secretMasker.mask(error instanceof Error ? error.message : String(error));
+          log(`exit: 1 | read-storage: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // read-cookie: like read-secret, the value goes back only in secretOut. See fill-secret.js.
       if (filteredArgs[0] === "read-cookie") {
         try {

package/serve.ts

@@ -24,7 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.ts";
-import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
+import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadStorageWire, readStorageOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -961,6 +961,22 @@ export async function serve() {
         }
       }
 
+      // read-storage: a localStorage/sessionStorage value, page-level; secretOut only.
+      if (filteredArgs[0] === "read-storage") {
+        try {
+          const { area, key, path, allowDomains } = parseReadStorageWire(filteredArgs);
+          const { host, value } = await readStorageOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, area, key, path, allowDomains });
+          if (!value) throw new Error(`read-storage: ${area} ${key} on ${host} is empty`);
+          secretMasker.add(value, Infinity);
+          log(`exit: 0 | read-storage ${area} ${key}${path.length ? " " + path.join(".") : ""} on ${host} (${value.length} chars, value not logged)`);
+          return Response.json({ status: 0, stdout: "", stderr: "", files: [], secretOut: value });
+        } catch (error) {
+          const message = secretMasker.mask(error instanceof Error ? error.message : String(error));
+          log(`exit: 1 | read-storage: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // read-cookie: like read-secret, the value goes back only in secretOut. See fill-secret.ts.
       if (filteredArgs[0] === "read-cookie") {
         try {