rechrome 1.43.2 → 1.45.0

package/README.md

@@ -398,6 +398,23 @@ cp .env.example .env.local
 >
 > Shell-set `PLAYWRIGHT_MCP_*` variables take priority over `.env.local`, so you can always override per-command without editing files.
 
+### Downloading files
+
+A file the page downloads (a link, an export button) goes to **your** machine. Any type
+works. It lands in `<project>/.rechrome/output/` with the command's other files. The host
+saves it in a private folder, hands it to the client once, and then deletes it. A download
+that is never fetched is deleted after 10 minutes. Each download is logged on the host
+with its name, size and sha256.
+
+Keeping a copy on the host is opt-in, per listener:
+
+```bash
+rech listener set <listener> --keep-downloads    # --no-keep-downloads: back to client-only
+```
+
+A download that finishes after its command has returned is reported, and handed over,
+by the next command on that tab.
+
 ### Uploading files
 
 `rech upload <file>` puts a local image into the page: a file picker, an

package/fill-secret.js

@@ -434,6 +434,123 @@ async function readSecretOnSession(opts) {
     throw new Error("read-secret: the page returned no value");
   return out;
 }
+var READ_STORAGE_USAGE = `Usage: rech read-storage <local|session> <key> [json-path] --allow-domain <glob> | <command>
+  Writes the storage value, raw and without a newline, to stdout, which must be a pipe into the
+  program that stores it (never a terminal or a file). Never logged; masked in later outputs.
+  <local|session>       localStorage or sessionStorage
+  <key>                 the storage key, e.g. localConfig_v2
+  [json-path]           optional: a path into the JSON value, e.g. teams.T0123.token or teams[T0123].token
+  --allow-domain GLOB   required: the page's host must match, e.g. app.slack.com`;
+function parseStoragePath(path) {
+  return path.match(/[^.[\]]+/g) ?? [];
+}
+function parseReadStorageArgs(args) {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-storage")
+    throw new Error("Expected read-storage");
+  const pos = [];
+  const allowDomains = [];
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v)
+        throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) {
+        domainGlobToRegExp(d.trim());
+        allowDomains.push(d.trim());
+      }
+    } else if (a.startsWith("-"))
+      throw new Error(`read-storage: unknown option ${a}`);
+    else
+      pos.push(a);
+  }
+  if (pos.length < 2 || pos.length > 3)
+    throw new Error("read-storage needs <local|session> <key> [json-path]");
+  const [area, key, rawPath] = pos;
+  if (area !== "local" && area !== "session")
+    throw new Error("read-storage: first argument must be 'local' or 'session'");
+  if (!key)
+    throw new Error("read-storage: a storage key is required");
+  if (!allowDomains.length)
+    throw new Error("read-storage needs --allow-domain: name the site the value must come from");
+  return { area, key, path: rawPath ? parseStoragePath(rawPath) : [], allowDomains };
+}
+function readStorageWireArgs(req) {
+  return ["read-storage", req.area, req.key, ...req.path.length ? [req.path.join(".")] : [], ...req.allowDomains.map((d) => `--allow-domain=${d}`)];
+}
+function parseReadStorageWire(args) {
+  const [cmd, area, key, ...rest] = args;
+  if (cmd !== "read-storage" || area !== "local" && area !== "session" || !key || key.startsWith("-"))
+    throw new Error("read-storage needs <local|session> <key>");
+  const allowDomains = [];
+  let path = [];
+  for (const a of rest) {
+    if (a.startsWith("--allow-domain=")) {
+      const d = a.slice("--allow-domain=".length);
+      domainGlobToRegExp(d);
+      allowDomains.push(d);
+    } else if (!a.startsWith("-") && !path.length)
+      path = parseStoragePath(a);
+    else
+      throw new Error(`read-storage: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+  }
+  if (!allowDomains.length)
+    throw new Error("read-storage needs --allow-domain");
+  return { area, key, path, allowDomains };
+}
+function buildReadStorageCode(area, key, path, allowDomains) {
+  const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
+  const store = area === "local" ? "localStorage" : "sessionStorage";
+  return `async page => {
+  // One evaluate: the host checked is the origin read, with no navigation in between.
+  const out = await page.evaluate(({ key, path }) => {
+    const host = String(location.hostname).toLowerCase();
+    const raw = window.${store}.getItem(key);
+    if (raw === null) return { host, missing: true };
+    if (!path.length) return { host, value: raw };
+    let v;
+    try { v = JSON.parse(raw); } catch { return { host, notjson: true }; }
+    for (const seg of path) {
+      if (v == null || typeof v !== "object") return { host, nopath: true };
+      v = v[seg];
+    }
+    if (v === undefined) return { host, nopath: true };
+    return { host, value: typeof v === "string" ? v : JSON.stringify(v) };
+  }, { key: ${JSON.stringify(key)}, path: ${JSON.stringify(path)} });
+  const host = out.host;
+  const allowed = ${JSON.stringify(patterns)};
+  if (!allowed.some(p => new RegExp(p, "i").test(host)))
+    throw new Error("read-storage refused: the page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+  if (out.missing) throw new Error("read-storage: no ${store} key " + JSON.stringify(${JSON.stringify(key)}) + " on " + host);
+  if (out.notjson) throw new Error("read-storage: the value is not JSON, so the path can't apply");
+  if (out.nopath) throw new Error("read-storage: the json-path is not present in the value");
+  return JSON.stringify({ host, value: out.value });
+}`;
+}
+async function readStorageOnSession(opts) {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadStorageCode(opts.area, opts.key, opts.path, opts.allowDomains), json: true });
+  if (isError)
+    throw new Error(text.match(/read-storage(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
+`)[0] : "read-storage: could not read the value"));
+  let raw;
+  try {
+    raw = JSON.parse(text).result;
+  } catch {
+    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  }
+  let o = raw;
+  for (let i = 0;i < 2 && typeof o === "string"; i++) {
+    try {
+      o = JSON.parse(o);
+    } catch {
+      o = undefined;
+    }
+  }
+  if (!o || typeof o.host !== "string" || typeof o.value !== "string")
+    throw new Error("read-storage: the page returned no value");
+  return o;
+}
 var READ_COOKIE_USAGE = `Usage: rech read-cookie <name> <domain> --allow-domain <domain> | <command>
   Writes the cookie's value, raw and without a newline, to stdout, which must be a pipe into the
   program that stores it (never a terminal or a file). Never logged; masked in later outputs.
@@ -590,6 +707,7 @@ export {
   MIN_MASK_LENGTH,
   READ_COOKIE_USAGE,
   READ_SECRET_USAGE,
+  READ_STORAGE_USAGE,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
@@ -597,6 +715,7 @@ export {
   buildFillCode,
   buildReadCode,
   buildReadCookieCode,
+  buildReadStorageCode,
   daemonSessionSockets,
   domainGlobToRegExp,
   fillSecretOnSession,
@@ -612,13 +731,18 @@ export {
   parseReadCookieWire,
   parseReadSecretArgs,
   parseReadSecretWire,
+  parseReadStorageArgs,
+  parseReadStorageWire,
   parseScanResult,
+  parseStoragePath,
   passwordValuesOnSession,
   readCookieOnSession,
   readCookieWireArgs,
   readSecretOnSession,
   readSecretSource,
   readSecretWireArgs,
+  readStorageOnSession,
+  readStorageWireArgs,
   runCodeOnSession,
   sessionSocketCandidates,
   socketRequest,

package/fill-secret.ts

@@ -443,6 +443,108 @@ export async function readSecretOnSession(opts: { socketRoot: string; session: s
   return out;
 }
 
+// ---------- read-storage: a localStorage/sessionStorage value to a pipe ----------
+//
+// Same contract as read-secret: value only in `secretOut`, never logged, masked later, client
+// pipe-only. For the live app token in storage (Slack's localConfig_v2 teams[T...].token). Reads
+// via page-level evaluate, so it works over the extension bridge. localStorage is per-origin, so
+// the session's page must be on the allowed host.
+
+export const READ_STORAGE_USAGE = `Usage: rech read-storage <local|session> <key> [json-path] --allow-domain <glob> | <command>
+  Writes the storage value, raw and without a newline, to stdout, which must be a pipe into the
+  program that stores it (never a terminal or a file). Never logged; masked in later outputs.
+  <local|session>       localStorage or sessionStorage
+  <key>                 the storage key, e.g. localConfig_v2
+  [json-path]           optional: a path into the JSON value, e.g. teams.T0123.token or teams[T0123].token
+  --allow-domain GLOB   required: the page's host must match, e.g. app.slack.com`;
+
+/** Split "teams[T0123].token" / "teams.T0123.token" into ["teams","T0123","token"]. */
+export function parseStoragePath(path: string): string[] {
+  return path.match(/[^.[\]]+/g) ?? [];
+}
+
+export function parseReadStorageArgs(args: string[]): { area: "local" | "session"; key: string; path: string[]; allowDomains: string[] } {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-storage") throw new Error("Expected read-storage");
+  const pos: string[] = [];
+  const allowDomains: string[] = [];
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i]!;
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v) throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) { domainGlobToRegExp(d.trim()); allowDomains.push(d.trim()); }
+    } else if (a.startsWith("-")) throw new Error(`read-storage: unknown option ${a}`);
+    else pos.push(a);
+  }
+  if (pos.length < 2 || pos.length > 3) throw new Error("read-storage needs <local|session> <key> [json-path]");
+  const [area, key, rawPath] = pos;
+  if (area !== "local" && area !== "session") throw new Error("read-storage: first argument must be 'local' or 'session'");
+  if (!key) throw new Error("read-storage: a storage key is required");
+  if (!allowDomains.length) throw new Error("read-storage needs --allow-domain: name the site the value must come from");
+  return { area, key, path: rawPath ? parseStoragePath(rawPath) : [], allowDomains };
+}
+
+export function readStorageWireArgs(req: { area: string; key: string; path: string[]; allowDomains: string[] }): string[] {
+  return ["read-storage", req.area, req.key, ...(req.path.length ? [req.path.join(".")] : []), ...req.allowDomains.map(d => `--allow-domain=${d}`)];
+}
+
+export function parseReadStorageWire(args: string[]): { area: "local" | "session"; key: string; path: string[]; allowDomains: string[] } {
+  const [cmd, area, key, ...rest] = args;
+  if (cmd !== "read-storage" || (area !== "local" && area !== "session") || !key || key.startsWith("-")) throw new Error("read-storage needs <local|session> <key>");
+  const allowDomains: string[] = [];
+  let path: string[] = [];
+  for (const a of rest) {
+    if (a.startsWith("--allow-domain=")) { const d = a.slice("--allow-domain=".length); domainGlobToRegExp(d); allowDomains.push(d); }
+    else if (!a.startsWith("-") && !path.length) path = parseStoragePath(a);
+    else throw new Error(`read-storage: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+  }
+  if (!allowDomains.length) throw new Error("read-storage needs --allow-domain");
+  return { area, key, path, allowDomains };
+}
+
+/** run-code reading storage[key], optionally walking a JSON path; returns {host,value} JSON. */
+export function buildReadStorageCode(area: "local" | "session", key: string, path: string[], allowDomains: string[]): string {
+  const patterns = allowDomains.map(d => domainGlobToRegExp(d).source);
+  const store = area === "local" ? "localStorage" : "sessionStorage";
+  return `async page => {
+  // One evaluate: the host checked is the origin read, with no navigation in between.
+  const out = await page.evaluate(({ key, path }) => {
+    const host = String(location.hostname).toLowerCase();
+    const raw = window.${store}.getItem(key);
+    if (raw === null) return { host, missing: true };
+    if (!path.length) return { host, value: raw };
+    let v;
+    try { v = JSON.parse(raw); } catch { return { host, notjson: true }; }
+    for (const seg of path) {
+      if (v == null || typeof v !== "object") return { host, nopath: true };
+      v = v[seg];
+    }
+    if (v === undefined) return { host, nopath: true };
+    return { host, value: typeof v === "string" ? v : JSON.stringify(v) };
+  }, { key: ${JSON.stringify(key)}, path: ${JSON.stringify(path)} });
+  const host = out.host;
+  const allowed = ${JSON.stringify(patterns)};
+  if (!allowed.some(p => new RegExp(p, "i").test(host)))
+    throw new Error("read-storage refused: the page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+  if (out.missing) throw new Error("read-storage: no ${store} key " + JSON.stringify(${JSON.stringify(key)}) + " on " + host);
+  if (out.notjson) throw new Error("read-storage: the value is not JSON, so the path can't apply");
+  if (out.nopath) throw new Error("read-storage: the json-path is not present in the value");
+  return JSON.stringify({ host, value: out.value });
+}`;
+}
+
+export async function readStorageOnSession(opts: { socketRoot: string; session: string; cwd: string; area: "local" | "session"; key: string; path: string[]; allowDomains: string[] }): Promise<{ host: string; value: string }> {
+  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadStorageCode(opts.area, opts.key, opts.path, opts.allowDomains), json: true });
+  if (isError) throw new Error(text.match(/read-storage(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split("\n")[0]! : "read-storage: could not read the value"));
+  let raw: unknown;
+  try { raw = JSON.parse(text).result; } catch { raw = text.match(/### Result\n([^\n]*)/)?.[1]; }
+  let o: any = raw;
+  for (let i = 0; i < 2 && typeof o === "string"; i++) { try { o = JSON.parse(o); } catch { o = undefined; } }
+  if (!o || typeof o.host !== "string" || typeof o.value !== "string") throw new Error("read-storage: the page returned no value");
+  return o;
+}
+
 // ---------- read-cookie: a cookie value (incl. HttpOnly) to a pipe ----------
 //
 // Same contract as read-secret: the value travels only in the response's `secretOut`, is never

package/listeners.js

@@ -80,6 +80,8 @@ function validateListeners(value) {
       throw new Error("readSecrets must be true or false");
     if (l.readCookies !== undefined && typeof l.readCookies !== "boolean")
       throw new Error("readCookies must be true or false");
+    if (l.keepDownloads !== undefined && typeof l.keepDownloads !== "boolean")
+      throw new Error("keepDownloads must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
       throw new Error("Listener names, addresses, and credentials must be unique");
@@ -136,11 +138,13 @@ function authorizeProfileRequest(listener, body) {
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] === "read-secret" && listener.readSecrets !== true)
     throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] === "read-storage" && listener.readSecrets !== true)
+    throw new Error(`read-storage is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
   if (args[0] === "read-cookie" && listener.readCookies !== true)
     throw new Error(`read-cookie is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-cookies`);
-  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && !SCOPED_COMMANDS.has(args[0]))
+  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && args[0] !== "read-storage" && !SCOPED_COMMANDS.has(args[0]))
     throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain="))))
+  if (body.args.filter((a) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain=")) && !(args[0] === "read-storage" && a.startsWith("--allow-domain="))))
     throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank")
     throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");

package/listeners.ts

@@ -6,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false; readSecrets?: boolean; readCookies?: boolean };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean };
 // retiredPorts: ports of removed listeners, newest last. New listeners skip them so a link
 // saved for a removed listener gets "connection refused", not some other listener's answer.
 export type ListenerConfig = { version: 1; listeners: Listener[]; retiredPorts?: number[] };
@@ -63,6 +63,7 @@ export function validateListeners(value: unknown): ListenerConfig {
     if (l.uploads !== undefined && l.uploads !== false) validateUploadPolicy(l.uploads);
     if (l.readSecrets !== undefined && typeof l.readSecrets !== "boolean") throw new Error("readSecrets must be true or false");
     if (l.readCookies !== undefined && typeof l.readCookies !== "boolean") throw new Error("readCookies must be true or false");
+    if (l.keepDownloads !== undefined && typeof l.keepDownloads !== "boolean") throw new Error("keepDownloads must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);
@@ -111,10 +112,12 @@ export function authorizeProfileRequest(listener: Listener, body: any): string {
     throw new Error(`Uploads are off on listener "${listener.name}". The host can turn them on: rech listener set ${listener.name} --uploads`);
   if (args[0] === "read-secret" && listener.readSecrets !== true)
     throw new Error(`read-secret is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
+  if (args[0] === "read-storage" && listener.readSecrets !== true)
+    throw new Error(`read-storage is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-secrets`);
   if (args[0] === "read-cookie" && listener.readCookies !== true)
     throw new Error(`read-cookie is off on listener "${listener.name}". The host can turn it on: rech listener set ${listener.name} --read-cookies`);
-  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
-  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain=")))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
+  if (args[0] !== "upload" && args[0] !== "read-secret" && args[0] !== "read-cookie" && args[0] !== "read-storage" && !SCOPED_COMMANDS.has(args[0])) throw new Error("Command is unavailable on profile-scoped listeners; use the local management listener for arbitrary code or host access");
+  if (body.args.filter((a: string) => a.startsWith("-s=")).length > 1 || args.slice(1).some((a: string) => a.startsWith("-") && !(args[0] === "screenshot" && a === "--full-page") && !(args[0] === "console" && a === "--clear") && !(args[0] === "fill-secret" && (a === "--submit" || a === "--totp" || a.startsWith("--allow-domain="))) && !(args[0] === "read-secret" && a.startsWith("--allow-domain=")) && !(args[0] === "read-cookie" && a.startsWith("--allow-domain=")) && !(args[0] === "read-storage" && a.startsWith("--allow-domain=")))) throw new Error("CLI option overrides are unavailable on profile-scoped listeners");
   if (["open", "goto", "tab-new"].includes(args[0]) && args[1] && !/^https?:\/\//i.test(args[1]) && args[1] !== "about:blank") throw new Error("Scoped navigation accepts only HTTP(S) or about:blank");
   // Upload is handled by the byte-only receiver; the caller cannot supply host paths.
   if (args[0] === "upload" && (args.length !== 1 || !body.upload)) throw new Error("Upload requires stdin bytes; host paths are unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.43.2",
+  "version": "1.45.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -6,7 +6,7 @@ import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.js";
 import { redact } from "./redact.js";
-import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
+import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_STORAGE_USAGE, parseReadStorageArgs, readStorageWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.js";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
@@ -2189,6 +2189,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     console.error(`[rech] read-cookie: wrote ${res.secretOut.length} characters to stdout`);
     process.exit(0);
   }
+  if (args[cmdIdx] === "read-storage") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_STORAGE_USAGE); process.exit(0); }
+    let swire: string[];
+    try {
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-storage writes the value to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      swire = readStorageWireArgs(parseReadStorageArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_STORAGE_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...swire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-storage: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-storage: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "read-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
     let wire: string[];
@@ -3388,7 +3408,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3414,7 +3434,9 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-cookie is always available there.`);
     if (opts.readCookies) listener.readCookies = true; else delete listener.readCookies;
   }
+  if (opts.keepDownloads !== undefined) { if (opts.keepDownloads) listener.keepDownloads = true; else delete listener.keepDownloads; }
   await writeListeners(config);
+  if (opts.keepDownloads !== undefined) console.log(opts.keepDownloads ? `${name}: browser downloads are also kept on this host (each is logged)` : `${name}: browser downloads go to the client only, then are deleted here`);
   if (opts.readCookies !== undefined) console.log(opts.readCookies ? `${name}: read-cookie on. Anyone with this link can copy any cookie (HttpOnly session cookies included) of any site its profiles are signed in to, which is enough to take over those sessions; --allow-domain only checks the domain the caller names. Each read is logged without the value` : `${name}: read-cookie off`);
   if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
@@ -4500,7 +4522,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4537,6 +4559,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
                      copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech read-cookie <name> <domain> --allow-domain <domain> | <command>
                      copy a cookie (incl. HttpOnly) into a pipe, never shown or logged
+  rech read-storage <local|session> <key> [json-path] --allow-domain <host> | <command>
+                     copy a localStorage/sessionStorage value into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4652,11 +4676,12 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
-        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
+        .option("keep-downloads", { type: "boolean", describe: "Off by default: browser downloads go to the client, then are deleted here. --keep-downloads also keeps them on this host" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined || a.keepDownloads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, --host-upload-dir/--no-host-uploads, --read-secrets/--read-cookies, or --keep-downloads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}), ...(a.keepDownloads !== undefined ? { keepDownloads: a.keepDownloads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/rechrome.ts

@@ -6,7 +6,7 @@ import { file } from "bun";
 import yargs from "yargs";
 import { readExtensionTokenFromProfile } from "./extension-token.ts";
 import { redact } from "./redact.ts";
-import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
+import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_STORAGE_USAGE, parseReadStorageArgs, readStorageWireArgs, READ_SECRET_USAGE, parseReadSecretArgs, readSecretWireArgs, FILL_SECRET_USAGE, SECRET_MASK, parseFillSecretArgs, fillSecretWireArgs, readSecretSource, totpCode, totpWaitMs } from "./fill-secret.ts";
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
@@ -2189,6 +2189,26 @@ async function run(url: string, args: string[], overrideEnv?: Record<string, str
     console.error(`[rech] read-cookie: wrote ${res.secretOut.length} characters to stdout`);
     process.exit(0);
   }
+  if (args[cmdIdx] === "read-storage") {
+    if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_STORAGE_USAGE); process.exit(0); }
+    let swire: string[];
+    try {
+      const out = fstatSync(1);
+      if (!out.isFIFO() && !out.isSocket()) throw new Error("read-storage writes the value to stdout, which must be a pipe into the program that stores it (not a terminal or a file)");
+      swire = readStorageWireArgs(parseReadStorageArgs(args.slice(cmdIdx)));
+    } catch (err) {
+      console.error(`[rech] ${err instanceof Error ? err.message : String(err)}\n${READ_STORAGE_USAGE}`);
+      process.exit(2);
+    }
+    const res = await callServe(url, [...args.filter(a => a.startsWith("-s=")), ...swire], overrideEnv, identity);
+    if (res.status !== 0 || typeof res.secretOut !== "string") {
+      process.stderr.write(res.stderr || (res.status === 0 ? "[rech] read-storage: this daemon is older than the client (no value returned)\n" : ""));
+      process.exit(res.status || 1);
+    }
+    await new Promise<void>((done, fail) => process.stdout.write(res.secretOut!, e => e ? fail(e) : done()));
+    console.error(`[rech] read-storage: wrote ${res.secretOut.length} characters to stdout`);
+    process.exit(0);
+  }
   if (args[cmdIdx] === "read-secret") {
     if (args.some(a => a === "--help" || a === "-h")) { console.log(READ_SECRET_USAGE); process.exit(0); }
     let wire: string[];
@@ -3388,7 +3408,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3414,7 +3434,9 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-cookie is always available there.`);
     if (opts.readCookies) listener.readCookies = true; else delete listener.readCookies;
   }
+  if (opts.keepDownloads !== undefined) { if (opts.keepDownloads) listener.keepDownloads = true; else delete listener.keepDownloads; }
   await writeListeners(config);
+  if (opts.keepDownloads !== undefined) console.log(opts.keepDownloads ? `${name}: browser downloads are also kept on this host (each is logged)` : `${name}: browser downloads go to the client only, then are deleted here`);
   if (opts.readCookies !== undefined) console.log(opts.readCookies ? `${name}: read-cookie on. Anyone with this link can copy any cookie (HttpOnly session cookies included) of any site its profiles are signed in to, which is enough to take over those sessions; --allow-domain only checks the domain the caller names. Each read is logged without the value` : `${name}: read-cookie off`);
   if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
@@ -4500,7 +4522,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4537,6 +4559,8 @@ const HELP_EPILOGUE = `Browser commands (sent to this project's Chrome session):
                      copy a field's value (e.g. an API secret) into a pipe, never shown or logged
   rech read-cookie <name> <domain> --allow-domain <domain> | <command>
                      copy a cookie (incl. HttpOnly) into a pipe, never shown or logged
+  rech read-storage <local|session> <key> [json-path] --allow-domain <host> | <command>
+                     copy a localStorage/sessionStorage value into a pipe, never shown or logged
   rech pw <args>     forward verbatim to playwright-cli, e.g. \`rech pw --version\`
   rech --version     rechrome's version
 
@@ -4652,11 +4676,12 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("clear-public-url", { type: "boolean", conflicts: "public-url" })
         .option("uploads", { type: "boolean", describe: "Uploads of images the link holder sends (rech upload) are on by default; --no-uploads turns them off" })
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
-        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) into a pipe (rech read-secret): only for links you trust with those accounts. --no-read-secrets turns it off" })
+        .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
+        .option("keep-downloads", { type: "boolean", describe: "Off by default: browser downloads go to the client, then are deleted here. --keep-downloads also keeps them on this host" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined || a.keepDownloads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, --host-upload-dir/--no-host-uploads, --read-secrets/--read-cookies, or --keep-downloads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}), ...(a.keepDownloads !== undefined ? { keepDownloads: a.keepDownloads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/serve.js

@@ -24,7 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.js";
-import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
+import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadStorageWire, readStorageOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.js";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -100,6 +100,32 @@ const runsInFlight = new Map<Promise<void>, string | undefined>();
 const CLI_TEXT_ARTIFACT = /(^|\/)\.playwright-cli(-multi-tab)?\/[^/]+\.(?:ya?ml|json|md|txt|log)$/;
 // Artifacts that could not be checked AND could not be deleted: never served.
 const deniedFiles = new Set<string>();
+// Browser downloads go to the client: a download waits here (real path → cleanup timer) until the
+// client fetches it once, then the host copy is deleted. A listener with keepDownloads: true
+// keeps them on the host instead (opt-in).
+const pendingDownloads = new Map<string, ReturnType<typeof setTimeout>>();
+const DOWNLOAD_PICKUP_MS = 10 * 60_000;
+// playwright-cli's line for a finished download (tools/backend/response.js).
+const DOWNLOADED_LINE = /^- Downloaded file (.+?) to "(.+)"$/gm;
+// Where the CLI saves downloads: its output dir under the session's cwd (context.js outputDir).
+const CLI_OUTPUT_DIRS = new Set([".playwright-cli", ".playwright-mcp"]);
+
+/**
+ * The downloads the CLI itself reported: `- Downloaded file …` lines inside its own `### Events`
+ * section only, with paths in its output dir. The rest of the output carries page-controlled text
+ * (snapshots, console messages, eval results), and a page that prints a look-alike line must not
+ * be able to make the host forward and delete a file of its choosing.
+ */
+export function reportedDownloads(output: string): { name: string; rel: string }[] {
+  const out: { name: string; rel: string }[] = [];
+  for (const m of output.matchAll(/^### Events\n([\s\S]*?)(?=^### |(?![\s\S]))/gm)) {
+    for (const [, name, rel] of m[1]!.matchAll(DOWNLOADED_LINE)) {
+      const first = rel!.replaceAll("\\", "/").split("/")[0]!;
+      if (CLI_OUTPUT_DIRS.has(first)) out.push({ name: name!, rel: rel! });
+    }
+  }
+  return out;
+}
 function noteSession(sess: string, now: number): void {
   recentSessions.set(sess, now);
   if (recentSessions.size > 64) {
@@ -752,6 +778,19 @@ export async function serve() {
         const real = realpathSync(resolved);
         if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
         if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+        const pickup = pendingDownloads.get(real);
+        if (pickup) {
+          // Handed over once, then gone from the host.
+          clearTimeout(pickup);
+          pendingDownloads.delete(real);
+          // Streamed, then deleted once fully sent (or when the client hangs up).
+          const done = () => { try { unlinkSync(real); } catch { /* already gone */ } };
+          const reader = file(real).stream().getReader();
+          return new Response(new ReadableStream({
+            async pull(c) { const { done: end, value } = await reader.read(); if (end) { c.close(); done(); } else c.enqueue(value); },
+            cancel() { void reader.cancel(); done(); },
+          }));
+        }
         if (TEXT_OUTPUT.test(real)) {
           const busy = () => [...runsInFlight].filter(([, dir]) => !dir || real.startsWith(dir + sep)).map(([p]) => p);
           for (let pending = busy(); pending.length; pending = busy()) await Promise.all(pending); // re-check: new runs may start
@@ -961,6 +1000,22 @@ export async function serve() {
         }
       }
 
+      // read-storage: a localStorage/sessionStorage value, page-level; secretOut only.
+      if (filteredArgs[0] === "read-storage") {
+        try {
+          const { area, key, path, allowDomains } = parseReadStorageWire(filteredArgs);
+          const { host, value } = await readStorageOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, area, key, path, allowDomains });
+          if (!value) throw new Error(`read-storage: ${area} ${key} on ${host} is empty`);
+          secretMasker.add(value, Infinity);
+          log(`exit: 0 | read-storage ${area} ${key}${path.length ? " " + path.join(".") : ""} on ${host} (${value.length} chars, value not logged)`);
+          return Response.json({ status: 0, stdout: "", stderr: "", files: [], secretOut: value });
+        } catch (error) {
+          const message = secretMasker.mask(error instanceof Error ? error.message : String(error));
+          log(`exit: 1 | read-storage: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // read-cookie: like read-secret, the value goes back only in secretOut. See fill-secret.js.
       if (filteredArgs[0] === "read-cookie") {
         try {
@@ -1106,6 +1161,7 @@ export async function serve() {
       }
 
       const commandStartedAt = Date.now();
+      const runStartedAt = Date.now(); // downloads must be newer than this
       const proc = Bun.spawn([bin, ...binArgs, ...filteredArgs, `-s=${namespacedSession}`], {
         cwd: runWorkDir,
         stdin: "ignore",
@@ -1228,6 +1284,29 @@ export async function serve() {
         }
       }
 
+      // Browser downloads, whatever their type: forwarded to the client and logged.
+      for (const { name, rel } of reportedDownloads(rawOutput)) {
+        if (!isUnderDir(runWorkDir, rel)) continue;
+        const path = resolve(runWorkDir, rel);
+        if (!existsSync(path)) continue;
+        // Only a regular file really inside the work dir: never follow a link to delete elsewhere.
+        const real = realpathSync(path);
+        if (!isUnderDir(realpathSync(runWorkDir), real) || !lstatSync(real).isFile()) continue;
+        // Written during this command: an older file named by a replayed line is left alone.
+        if (statSync(real).mtimeMs < runStartedAt - 2000) continue;
+        const f = relative(runWorkDir, path).replaceAll("\\", "/");
+        if (!outputFiles.includes(f)) outputFiles.push(f);
+        const hash = createHash("sha256");
+        let size = 0;
+        for await (const chunk of file(real).stream()) { hash.update(chunk); size += chunk.byteLength; }
+        const keep = listener.keepDownloads === true;
+        log(`download: ${JSON.stringify({ listener: listener.name, name: name.slice(0, 256), size, sha256: hash.digest("hex"), kept: keep })}`);
+        if (keep) continue;
+        clearTimeout(pendingDownloads.get(real));
+        // Never fetched (the client went away): delete it anyway.
+        pendingDownloads.set(real, setTimeout(() => { pendingDownloads.delete(real); try { unlinkSync(real); } catch {} }, DOWNLOAD_PICKUP_MS));
+      }
+
       // A file the command was told to write (`snapshot --filename=x.yml`) is its own artifact too.
       const ownFilenames = filteredArgs.flatMap((a, i) => a.startsWith("--filename=") ? [a.slice(11)] : a === "--filename" && filteredArgs[i + 1] ? [filteredArgs[i + 1]!] : []);
       // Snapshot files echo input values: scrub them on disk too, not only on download. Only

package/serve.ts

@@ -24,7 +24,7 @@ import {
   checkTailscaleServe,
   chromeDataAccessHint,
 } from "./rechrome.ts";
-import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
+import { SecretMasker, parseReadCookieWire, readCookieOnSession, parseReadStorageWire, readStorageOnSession, parseReadSecretWire, readSecretOnSession, parseFillSecretWire, fillSecretOnSession, passwordValuesOnSession, hasSnapshot, maskPasswordLines, withholdSnapshots } from "./fill-secret.ts";
 
 const TAILSCALE_BIN = process.env.TAILSCALE_BIN || "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const CERT_RENEW_THRESHOLD_DAYS = 7;
@@ -100,6 +100,32 @@ const runsInFlight = new Map<Promise<void>, string | undefined>();
 const CLI_TEXT_ARTIFACT = /(^|\/)\.playwright-cli(-multi-tab)?\/[^/]+\.(?:ya?ml|json|md|txt|log)$/;
 // Artifacts that could not be checked AND could not be deleted: never served.
 const deniedFiles = new Set<string>();
+// Browser downloads go to the client: a download waits here (real path → cleanup timer) until the
+// client fetches it once, then the host copy is deleted. A listener with keepDownloads: true
+// keeps them on the host instead (opt-in).
+const pendingDownloads = new Map<string, ReturnType<typeof setTimeout>>();
+const DOWNLOAD_PICKUP_MS = 10 * 60_000;
+// playwright-cli's line for a finished download (tools/backend/response.ts).
+const DOWNLOADED_LINE = /^- Downloaded file (.+?) to "(.+)"$/gm;
+// Where the CLI saves downloads: its output dir under the session's cwd (context.ts outputDir).
+const CLI_OUTPUT_DIRS = new Set([".playwright-cli", ".playwright-mcp"]);
+
+/**
+ * The downloads the CLI itself reported: `- Downloaded file …` lines inside its own `### Events`
+ * section only, with paths in its output dir. The rest of the output carries page-controlled text
+ * (snapshots, console messages, eval results), and a page that prints a look-alike line must not
+ * be able to make the host forward and delete a file of its choosing.
+ */
+export function reportedDownloads(output: string): { name: string; rel: string }[] {
+  const out: { name: string; rel: string }[] = [];
+  for (const m of output.matchAll(/^### Events\n([\s\S]*?)(?=^### |(?![\s\S]))/gm)) {
+    for (const [, name, rel] of m[1]!.matchAll(DOWNLOADED_LINE)) {
+      const first = rel!.replaceAll("\\", "/").split("/")[0]!;
+      if (CLI_OUTPUT_DIRS.has(first)) out.push({ name: name!, rel: rel! });
+    }
+  }
+  return out;
+}
 function noteSession(sess: string, now: number): void {
   recentSessions.set(sess, now);
   if (recentSessions.size > 64) {
@@ -752,6 +778,19 @@ export async function serve() {
         const real = realpathSync(resolved);
         if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
         if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+        const pickup = pendingDownloads.get(real);
+        if (pickup) {
+          // Handed over once, then gone from the host.
+          clearTimeout(pickup);
+          pendingDownloads.delete(real);
+          // Streamed, then deleted once fully sent (or when the client hangs up).
+          const done = () => { try { unlinkSync(real); } catch { /* already gone */ } };
+          const reader = file(real).stream().getReader();
+          return new Response(new ReadableStream({
+            async pull(c) { const { done: end, value } = await reader.read(); if (end) { c.close(); done(); } else c.enqueue(value); },
+            cancel() { void reader.cancel(); done(); },
+          }));
+        }
         if (TEXT_OUTPUT.test(real)) {
           const busy = () => [...runsInFlight].filter(([, dir]) => !dir || real.startsWith(dir + sep)).map(([p]) => p);
           for (let pending = busy(); pending.length; pending = busy()) await Promise.all(pending); // re-check: new runs may start
@@ -961,6 +1000,22 @@ export async function serve() {
         }
       }
 
+      // read-storage: a localStorage/sessionStorage value, page-level; secretOut only.
+      if (filteredArgs[0] === "read-storage") {
+        try {
+          const { area, key, path, allowDomains } = parseReadStorageWire(filteredArgs);
+          const { host, value } = await readStorageOnSession({ socketRoot: tmpSocketRoot(), session: namespacedSession, cwd: runWorkDir, area, key, path, allowDomains });
+          if (!value) throw new Error(`read-storage: ${area} ${key} on ${host} is empty`);
+          secretMasker.add(value, Infinity);
+          log(`exit: 0 | read-storage ${area} ${key}${path.length ? " " + path.join(".") : ""} on ${host} (${value.length} chars, value not logged)`);
+          return Response.json({ status: 0, stdout: "", stderr: "", files: [], secretOut: value });
+        } catch (error) {
+          const message = secretMasker.mask(error instanceof Error ? error.message : String(error));
+          log(`exit: 1 | read-storage: ${message.split("\n")[0]}`);
+          return Response.json({ status: 1, stdout: "", stderr: `[rech] ${message}\n`, files: [] });
+        }
+      }
+
       // read-cookie: like read-secret, the value goes back only in secretOut. See fill-secret.ts.
       if (filteredArgs[0] === "read-cookie") {
         try {
@@ -1106,6 +1161,7 @@ export async function serve() {
       }
 
       const commandStartedAt = Date.now();
+      const runStartedAt = Date.now(); // downloads must be newer than this
       const proc = Bun.spawn([bin, ...binArgs, ...filteredArgs, `-s=${namespacedSession}`], {
         cwd: runWorkDir,
         stdin: "ignore",
@@ -1228,6 +1284,29 @@ export async function serve() {
         }
       }
 
+      // Browser downloads, whatever their type: forwarded to the client and logged.
+      for (const { name, rel } of reportedDownloads(rawOutput)) {
+        if (!isUnderDir(runWorkDir, rel)) continue;
+        const path = resolve(runWorkDir, rel);
+        if (!existsSync(path)) continue;
+        // Only a regular file really inside the work dir: never follow a link to delete elsewhere.
+        const real = realpathSync(path);
+        if (!isUnderDir(realpathSync(runWorkDir), real) || !lstatSync(real).isFile()) continue;
+        // Written during this command: an older file named by a replayed line is left alone.
+        if (statSync(real).mtimeMs < runStartedAt - 2000) continue;
+        const f = relative(runWorkDir, path).replaceAll("\\", "/");
+        if (!outputFiles.includes(f)) outputFiles.push(f);
+        const hash = createHash("sha256");
+        let size = 0;
+        for await (const chunk of file(real).stream()) { hash.update(chunk); size += chunk.byteLength; }
+        const keep = listener.keepDownloads === true;
+        log(`download: ${JSON.stringify({ listener: listener.name, name: name.slice(0, 256), size, sha256: hash.digest("hex"), kept: keep })}`);
+        if (keep) continue;
+        clearTimeout(pendingDownloads.get(real));
+        // Never fetched (the client went away): delete it anyway.
+        pendingDownloads.set(real, setTimeout(() => { pendingDownloads.delete(real); try { unlinkSync(real); } catch {} }, DOWNLOAD_PICKUP_MS));
+      }
+
       // A file the command was told to write (`snapshot --filename=x.yml`) is its own artifact too.
       const ownFilenames = filteredArgs.flatMap((a, i) => a.startsWith("--filename=") ? [a.slice(11)] : a === "--filename" && filteredArgs[i + 1] ? [filteredArgs[i + 1]!] : []);
       // Snapshot files echo input values: scrub them on disk too, not only on download. Only