rechrome 1.44.0 → 1.45.0

package/README.md

@@ -398,6 +398,23 @@ cp .env.example .env.local
 >
 > Shell-set `PLAYWRIGHT_MCP_*` variables take priority over `.env.local`, so you can always override per-command without editing files.
 
+### Downloading files
+
+A file the page downloads (a link, an export button) goes to **your** machine. Any type
+works. It lands in `<project>/.rechrome/output/` with the command's other files. The host
+saves it in a private folder, hands it to the client once, and then deletes it. A download
+that is never fetched is deleted after 10 minutes. Each download is logged on the host
+with its name, size and sha256.
+
+Keeping a copy on the host is opt-in, per listener:
+
+```bash
+rech listener set <listener> --keep-downloads    # --no-keep-downloads: back to client-only
+```
+
+A download that finishes after its command has returned is reported, and handed over,
+by the next command on that tab.
+
 ### Uploading files
 
 `rech upload <file>` puts a local image into the page: a file picker, an

package/listeners.js

@@ -80,6 +80,8 @@ function validateListeners(value) {
       throw new Error("readSecrets must be true or false");
     if (l.readCookies !== undefined && typeof l.readCookies !== "boolean")
       throw new Error("readCookies must be true or false");
+    if (l.keepDownloads !== undefined && typeof l.keepDownloads !== "boolean")
+      throw new Error("keepDownloads must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key))
       throw new Error("Listener names, addresses, and credentials must be unique");

package/listeners.ts

@@ -6,7 +6,7 @@ import { join } from "path";
 import { mkdir, readFile, rename, writeFile } from "fs/promises";
 
 // publicUrl: where a reverse proxy (Tailscale Serve, Caddy, nginx, ...) exposes this listener.
-export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false; readSecrets?: boolean; readCookies?: boolean };
+export type Listener = { name: string; host: string; port: number; key: string; profiles: string[] | "*"; prefix?: string; publicUrl?: string; uploads?: UploadPolicy | false; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean };
 // retiredPorts: ports of removed listeners, newest last. New listeners skip them so a link
 // saved for a removed listener gets "connection refused", not some other listener's answer.
 export type ListenerConfig = { version: 1; listeners: Listener[]; retiredPorts?: number[] };
@@ -63,6 +63,7 @@ export function validateListeners(value: unknown): ListenerConfig {
     if (l.uploads !== undefined && l.uploads !== false) validateUploadPolicy(l.uploads);
     if (l.readSecrets !== undefined && typeof l.readSecrets !== "boolean") throw new Error("readSecrets must be true or false");
     if (l.readCookies !== undefined && typeof l.readCookies !== "boolean") throw new Error("readCookies must be true or false");
+    if (l.keepDownloads !== undefined && typeof l.keepDownloads !== "boolean") throw new Error("keepDownloads must be true or false");
     const address = listenerAddress(l);
     if (names.has(l.name) || addresses.has(address) || keys.has(l.key)) throw new Error("Listener names, addresses, and credentials must be unique");
     names.add(l.name); addresses.add(address); keys.add(l.key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.44.0",
+  "version": "1.45.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/rechrome.js

@@ -3408,7 +3408,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3434,7 +3434,9 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-cookie is always available there.`);
     if (opts.readCookies) listener.readCookies = true; else delete listener.readCookies;
   }
+  if (opts.keepDownloads !== undefined) { if (opts.keepDownloads) listener.keepDownloads = true; else delete listener.keepDownloads; }
   await writeListeners(config);
+  if (opts.keepDownloads !== undefined) console.log(opts.keepDownloads ? `${name}: browser downloads are also kept on this host (each is logged)` : `${name}: browser downloads go to the client only, then are deleted here`);
   if (opts.readCookies !== undefined) console.log(opts.readCookies ? `${name}: read-cookie on. Anyone with this link can copy any cookie (HttpOnly session cookies included) of any site its profiles are signed in to, which is enough to take over those sessions; --allow-domain only checks the domain the caller names. Each read is logged without the value` : `${name}: read-cookie off`);
   if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
@@ -4520,7 +4522,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4676,9 +4678,10 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
         .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
+        .option("keep-downloads", { type: "boolean", describe: "Off by default: browser downloads go to the client, then are deleted here. --keep-downloads also keeps them on this host" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined || a.keepDownloads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, --host-upload-dir/--no-host-uploads, --read-secrets/--read-cookies, or --keep-downloads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}), ...(a.keepDownloads !== undefined ? { keepDownloads: a.keepDownloads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/rechrome.ts

@@ -3408,7 +3408,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3434,7 +3434,9 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-cookie is always available there.`);
     if (opts.readCookies) listener.readCookies = true; else delete listener.readCookies;
   }
+  if (opts.keepDownloads !== undefined) { if (opts.keepDownloads) listener.keepDownloads = true; else delete listener.keepDownloads; }
   await writeListeners(config);
+  if (opts.keepDownloads !== undefined) console.log(opts.keepDownloads ? `${name}: browser downloads are also kept on this host (each is logged)` : `${name}: browser downloads go to the client only, then are deleted here`);
   if (opts.readCookies !== undefined) console.log(opts.readCookies ? `${name}: read-cookie on. Anyone with this link can copy any cookie (HttpOnly session cookies included) of any site its profiles are signed in to, which is enough to take over those sessions; --allow-domain only checks the domain the caller names. Each read is logged without the value` : `${name}: read-cookie off`);
   if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
@@ -4520,7 +4522,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4676,9 +4678,10 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
         .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
+        .option("keep-downloads", { type: "boolean", describe: "Off by default: browser downloads go to the client, then are deleted here. --keep-downloads also keeps them on this host" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined || a.keepDownloads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, --host-upload-dir/--no-host-uploads, --read-secrets/--read-cookies, or --keep-downloads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}), ...(a.keepDownloads !== undefined ? { keepDownloads: a.keepDownloads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),

package/serve.js

@@ -100,6 +100,32 @@ const runsInFlight = new Map<Promise<void>, string | undefined>();
 const CLI_TEXT_ARTIFACT = /(^|\/)\.playwright-cli(-multi-tab)?\/[^/]+\.(?:ya?ml|json|md|txt|log)$/;
 // Artifacts that could not be checked AND could not be deleted: never served.
 const deniedFiles = new Set<string>();
+// Browser downloads go to the client: a download waits here (real path → cleanup timer) until the
+// client fetches it once, then the host copy is deleted. A listener with keepDownloads: true
+// keeps them on the host instead (opt-in).
+const pendingDownloads = new Map<string, ReturnType<typeof setTimeout>>();
+const DOWNLOAD_PICKUP_MS = 10 * 60_000;
+// playwright-cli's line for a finished download (tools/backend/response.js).
+const DOWNLOADED_LINE = /^- Downloaded file (.+?) to "(.+)"$/gm;
+// Where the CLI saves downloads: its output dir under the session's cwd (context.js outputDir).
+const CLI_OUTPUT_DIRS = new Set([".playwright-cli", ".playwright-mcp"]);
+
+/**
+ * The downloads the CLI itself reported: `- Downloaded file …` lines inside its own `### Events`
+ * section only, with paths in its output dir. The rest of the output carries page-controlled text
+ * (snapshots, console messages, eval results), and a page that prints a look-alike line must not
+ * be able to make the host forward and delete a file of its choosing.
+ */
+export function reportedDownloads(output: string): { name: string; rel: string }[] {
+  const out: { name: string; rel: string }[] = [];
+  for (const m of output.matchAll(/^### Events\n([\s\S]*?)(?=^### |(?![\s\S]))/gm)) {
+    for (const [, name, rel] of m[1]!.matchAll(DOWNLOADED_LINE)) {
+      const first = rel!.replaceAll("\\", "/").split("/")[0]!;
+      if (CLI_OUTPUT_DIRS.has(first)) out.push({ name: name!, rel: rel! });
+    }
+  }
+  return out;
+}
 function noteSession(sess: string, now: number): void {
   recentSessions.set(sess, now);
   if (recentSessions.size > 64) {
@@ -752,6 +778,19 @@ export async function serve() {
         const real = realpathSync(resolved);
         if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
         if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+        const pickup = pendingDownloads.get(real);
+        if (pickup) {
+          // Handed over once, then gone from the host.
+          clearTimeout(pickup);
+          pendingDownloads.delete(real);
+          // Streamed, then deleted once fully sent (or when the client hangs up).
+          const done = () => { try { unlinkSync(real); } catch { /* already gone */ } };
+          const reader = file(real).stream().getReader();
+          return new Response(new ReadableStream({
+            async pull(c) { const { done: end, value } = await reader.read(); if (end) { c.close(); done(); } else c.enqueue(value); },
+            cancel() { void reader.cancel(); done(); },
+          }));
+        }
         if (TEXT_OUTPUT.test(real)) {
           const busy = () => [...runsInFlight].filter(([, dir]) => !dir || real.startsWith(dir + sep)).map(([p]) => p);
           for (let pending = busy(); pending.length; pending = busy()) await Promise.all(pending); // re-check: new runs may start
@@ -1122,6 +1161,7 @@ export async function serve() {
       }
 
       const commandStartedAt = Date.now();
+      const runStartedAt = Date.now(); // downloads must be newer than this
       const proc = Bun.spawn([bin, ...binArgs, ...filteredArgs, `-s=${namespacedSession}`], {
         cwd: runWorkDir,
         stdin: "ignore",
@@ -1244,6 +1284,29 @@ export async function serve() {
         }
       }
 
+      // Browser downloads, whatever their type: forwarded to the client and logged.
+      for (const { name, rel } of reportedDownloads(rawOutput)) {
+        if (!isUnderDir(runWorkDir, rel)) continue;
+        const path = resolve(runWorkDir, rel);
+        if (!existsSync(path)) continue;
+        // Only a regular file really inside the work dir: never follow a link to delete elsewhere.
+        const real = realpathSync(path);
+        if (!isUnderDir(realpathSync(runWorkDir), real) || !lstatSync(real).isFile()) continue;
+        // Written during this command: an older file named by a replayed line is left alone.
+        if (statSync(real).mtimeMs < runStartedAt - 2000) continue;
+        const f = relative(runWorkDir, path).replaceAll("\\", "/");
+        if (!outputFiles.includes(f)) outputFiles.push(f);
+        const hash = createHash("sha256");
+        let size = 0;
+        for await (const chunk of file(real).stream()) { hash.update(chunk); size += chunk.byteLength; }
+        const keep = listener.keepDownloads === true;
+        log(`download: ${JSON.stringify({ listener: listener.name, name: name.slice(0, 256), size, sha256: hash.digest("hex"), kept: keep })}`);
+        if (keep) continue;
+        clearTimeout(pendingDownloads.get(real));
+        // Never fetched (the client went away): delete it anyway.
+        pendingDownloads.set(real, setTimeout(() => { pendingDownloads.delete(real); try { unlinkSync(real); } catch {} }, DOWNLOAD_PICKUP_MS));
+      }
+
       // A file the command was told to write (`snapshot --filename=x.yml`) is its own artifact too.
       const ownFilenames = filteredArgs.flatMap((a, i) => a.startsWith("--filename=") ? [a.slice(11)] : a === "--filename" && filteredArgs[i + 1] ? [filteredArgs[i + 1]!] : []);
       // Snapshot files echo input values: scrub them on disk too, not only on download. Only

package/serve.ts

@@ -100,6 +100,32 @@ const runsInFlight = new Map<Promise<void>, string | undefined>();
 const CLI_TEXT_ARTIFACT = /(^|\/)\.playwright-cli(-multi-tab)?\/[^/]+\.(?:ya?ml|json|md|txt|log)$/;
 // Artifacts that could not be checked AND could not be deleted: never served.
 const deniedFiles = new Set<string>();
+// Browser downloads go to the client: a download waits here (real path → cleanup timer) until the
+// client fetches it once, then the host copy is deleted. A listener with keepDownloads: true
+// keeps them on the host instead (opt-in).
+const pendingDownloads = new Map<string, ReturnType<typeof setTimeout>>();
+const DOWNLOAD_PICKUP_MS = 10 * 60_000;
+// playwright-cli's line for a finished download (tools/backend/response.ts).
+const DOWNLOADED_LINE = /^- Downloaded file (.+?) to "(.+)"$/gm;
+// Where the CLI saves downloads: its output dir under the session's cwd (context.ts outputDir).
+const CLI_OUTPUT_DIRS = new Set([".playwright-cli", ".playwright-mcp"]);
+
+/**
+ * The downloads the CLI itself reported: `- Downloaded file …` lines inside its own `### Events`
+ * section only, with paths in its output dir. The rest of the output carries page-controlled text
+ * (snapshots, console messages, eval results), and a page that prints a look-alike line must not
+ * be able to make the host forward and delete a file of its choosing.
+ */
+export function reportedDownloads(output: string): { name: string; rel: string }[] {
+  const out: { name: string; rel: string }[] = [];
+  for (const m of output.matchAll(/^### Events\n([\s\S]*?)(?=^### |(?![\s\S]))/gm)) {
+    for (const [, name, rel] of m[1]!.matchAll(DOWNLOADED_LINE)) {
+      const first = rel!.replaceAll("\\", "/").split("/")[0]!;
+      if (CLI_OUTPUT_DIRS.has(first)) out.push({ name: name!, rel: rel! });
+    }
+  }
+  return out;
+}
 function noteSession(sess: string, now: number): void {
   recentSessions.set(sess, now);
   if (recentSessions.size > 64) {
@@ -752,6 +778,19 @@ export async function serve() {
         const real = realpathSync(resolved);
         if (!isUnderDir(realpathSync(workDir), real) || !readable(relative(realpathSync(workDir), real).replaceAll("\\", "/"))) return new Response("Forbidden", { status: 403 });
         if (deniedFiles.has(real)) return new Response("Forbidden", { status: 403 });
+        const pickup = pendingDownloads.get(real);
+        if (pickup) {
+          // Handed over once, then gone from the host.
+          clearTimeout(pickup);
+          pendingDownloads.delete(real);
+          // Streamed, then deleted once fully sent (or when the client hangs up).
+          const done = () => { try { unlinkSync(real); } catch { /* already gone */ } };
+          const reader = file(real).stream().getReader();
+          return new Response(new ReadableStream({
+            async pull(c) { const { done: end, value } = await reader.read(); if (end) { c.close(); done(); } else c.enqueue(value); },
+            cancel() { void reader.cancel(); done(); },
+          }));
+        }
         if (TEXT_OUTPUT.test(real)) {
           const busy = () => [...runsInFlight].filter(([, dir]) => !dir || real.startsWith(dir + sep)).map(([p]) => p);
           for (let pending = busy(); pending.length; pending = busy()) await Promise.all(pending); // re-check: new runs may start
@@ -1122,6 +1161,7 @@ export async function serve() {
       }
 
       const commandStartedAt = Date.now();
+      const runStartedAt = Date.now(); // downloads must be newer than this
       const proc = Bun.spawn([bin, ...binArgs, ...filteredArgs, `-s=${namespacedSession}`], {
         cwd: runWorkDir,
         stdin: "ignore",
@@ -1244,6 +1284,29 @@ export async function serve() {
         }
       }
 
+      // Browser downloads, whatever their type: forwarded to the client and logged.
+      for (const { name, rel } of reportedDownloads(rawOutput)) {
+        if (!isUnderDir(runWorkDir, rel)) continue;
+        const path = resolve(runWorkDir, rel);
+        if (!existsSync(path)) continue;
+        // Only a regular file really inside the work dir: never follow a link to delete elsewhere.
+        const real = realpathSync(path);
+        if (!isUnderDir(realpathSync(runWorkDir), real) || !lstatSync(real).isFile()) continue;
+        // Written during this command: an older file named by a replayed line is left alone.
+        if (statSync(real).mtimeMs < runStartedAt - 2000) continue;
+        const f = relative(runWorkDir, path).replaceAll("\\", "/");
+        if (!outputFiles.includes(f)) outputFiles.push(f);
+        const hash = createHash("sha256");
+        let size = 0;
+        for await (const chunk of file(real).stream()) { hash.update(chunk); size += chunk.byteLength; }
+        const keep = listener.keepDownloads === true;
+        log(`download: ${JSON.stringify({ listener: listener.name, name: name.slice(0, 256), size, sha256: hash.digest("hex"), kept: keep })}`);
+        if (keep) continue;
+        clearTimeout(pendingDownloads.get(real));
+        // Never fetched (the client went away): delete it anyway.
+        pendingDownloads.set(real, setTimeout(() => { pendingDownloads.delete(real); try { unlinkSync(real); } catch {} }, DOWNLOAD_PICKUP_MS));
+      }
+
       // A file the command was told to write (`snapshot --filename=x.yml`) is its own artifact too.
       const ownFilenames = filteredArgs.flatMap((a, i) => a.startsWith("--filename=") ? [a.slice(11)] : a === "--filename" && filteredArgs[i + 1] ? [filteredArgs[i + 1]!] : []);
       // Snapshot files echo input values: scrub them on disk too, not only on download. Only