rechrome 1.44.0 → 1.46.0

package/rechrome.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 import { prepareUpload, UPLOAD_USAGE, MAX_UPLOAD_BYTES, type UploadPayload } from "./scoped-upload.ts";
-import { readListeners, writeListeners as writeListenersFile, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, type Listener, type ListenerConfig } from "./listeners.ts";
+import { readListeners, writeListeners as writeListenersFile, listenerAddress, isLoopback, normalizePrefix, serviceUrl, allowProfiles, denyProfiles, rotateListenerKey, setPublicUrl, canonicalProfileKeys, planProfileRemoval, parseIceUrl, iceLabel, rtcListeners, shareRtcListeners, defaultRtcListener, DEFAULT_RTC, DEFAULT_RTC_NOTE, LEGACY_RTC, type IceServer, type Listener, type ListenerConfig, type RtcListener } from "./listeners.ts";
 
 import { file } from "bun";
 import yargs from "yargs";
@@ -10,7 +10,7 @@ import { READ_COOKIE_USAGE, parseReadCookieArgs, readCookieWireArgs, READ_STORAG
 import { createHash, randomBytes } from "crypto";
 import { mkdirSync, fstatSync, appendFileSync, existsSync, realpathSync, accessSync, cpSync, unlinkSync, readFileSync, readdirSync, renameSync, readlinkSync, rmdirSync, constants as fsConstants } from "fs";
 import { hostname, homedir, networkInterfaces } from "os";
-import { isIPv4 } from "net";
+import { isIP, isIPv4 } from "net";
 import { join, basename, dirname, resolve } from "path";
 import { pathToFileURL } from "url";
 import { createRequire } from "node:module";
@@ -1490,7 +1490,7 @@ export function chooseShareListener(profile: string, listeners: Listener[]): str
   throw new ShareListenerError([
     `"${profile}" isn't shared on any listener yet.`,
     scoped.length ? `  Allow it on one:  rech listener allow ${scoped[0].name} ${JSON.stringify(profile)}   (listeners: ${scoped.map(l => l.name).join(", ")})` : "",
-    `  ${scoped.length ? "Or give" : "Give"} it its own link:  rech share ${JSON.stringify(profile)}   (in a terminal it asks who should connect)`,
+    `  ${scoped.length ? "Or share" : "Share"} it:  rech share ${JSON.stringify(profile)} --lan|--tailscale|--webrtc   (in a terminal, rech share asks)`,
   ].filter(Boolean).join("\n"), "none", scoped);
 }
 
@@ -1788,11 +1788,13 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     config = await readListeners(); // setup may have added a listener: never write back a stale copy
     return key;
   };
+  let shownLinks = false;
   if (!selector) {
     // No profile given: show what is already shared, then ask, defaulting to the current one
     // (?profile= in the URL, else PLAYWRIGHT_MCP_PROFILE_DIRECTORY).
     if (interactive && Object.keys(registry).length) {
       printExistingLinks(config?.listeners ?? [], opts.local);
+      shownLinks = true;
       selector = await pickProfile("Share which profile?");
     }
     else {
@@ -1817,6 +1819,12 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
       } else throw error;
     }
   }
+  // On a host, in a terminal, with no listener named: tick the transports for a new share (the
+  // links already handed out are listed first). --save/--local keep the listener-link flow.
+  if (interactive && config && !listener && !opts.save && !opts.local) {
+    if (!shownLinks) printExistingLinks(config.listeners, opts.local);
+    return shareNew([profile], {});
+  }
   const listeners = config?.listeners ?? [];
   // On a host, share through a scoped listener by default, never the management key.
   if (!listener && config) {
@@ -1824,7 +1832,8 @@ async function printProfileUri(selector?: string, listener?: string, opts: { loc
     catch (error) {
       if (!(error instanceof ShareListenerError)) throw error;
       // Not shared yet: give it its own link rather than stopping with instructions.
-      if (!interactive) { if (error.kind === "none") return shareNewLink(profile, opts); throw error; }
+      // No default transport: without a terminal, say how to pick one.
+      if (!interactive) { if (error.kind === "none") throw noTransportError(profile); throw error; }
       const describe = (l: Listener) => `${l.name}  ${l.publicUrl ?? `${listenerAddress(l)}${normalizePrefix(l.prefix)}`}`;
       if (error.kind === "several") {
         listener = (await promptChoice(`"${profile}" is on several listeners. Share through which?`, error.listeners.map(l => ({ label: describe(l), value: l.name })))) ?? undefined;
@@ -3320,14 +3329,86 @@ function printTable(rows: string[][]): void {
 }
 
 async function listListeners(): Promise<void> {
+  const config = await requireListeners();
   const rows = [["NAME", "ADDRESS", "PROFILES", "PUBLIC URL"]];
-  for (const l of (await requireListeners()).listeners)
+  for (const l of config.listeners)
     rows.push([l.name, `${listenerAddress(l)}${normalizePrefix(l.prefix)}`, l.profiles === "*" ? "(all — local management)" : l.profiles.join(", "), l.publicUrl ?? "-"]);
   printTable(rows);
+  console.log("");
+  printTable(rtcListenerRows(config));
+}
+
+/** `rech listener ls`'s WebRTC table. STUN/TURN servers show their username, never the password. */
+export function rtcListenerRows(config: ListenerConfig | null): string[][] {
+  const rows = [["WEBRTC", "SIGNAL SERVER", "STUN/TURN"]];
+  for (const l of rtcListeners(config))
+    rows.push([l.name, l.signal, l.builtin ? `public STUN (built in; ${DEFAULT_RTC_NOTE.split(".")[0]})` : l.ice?.length ? l.ice.map(iceLabel).join(", ") : "public STUN"]);
+  return rows;
+}
+
+/** STUN/TURN servers for a WebRTC listener: --turn URLs, then the URLs held in --turn-env variables. */
+export function iceFromOptions(turn: string[] = [], turnEnv: string[] = [], env: Record<string, string | undefined> = process.env): IceServer[] {
+  const urls = [...turn];
+  for (const name of turnEnv) {
+    const value = env[name];
+    if (!value) throw new Error(`--turn-env ${name}: that environment variable is empty or unset`);
+    urls.push(value);
+  }
+  return urls.map(parseIceUrl);
+}
+
+/** A new WebRTC listener named `name` (or one derived from the signal host), saved to listeners.json. */
+export function addRtcListenerTo(config: ListenerConfig, opts: { name?: string; signal: string; ice?: IceServer[] }): RtcListener {
+  const signal = normalizeSignal(opts.signal);
+  const taken = new Set([...config.listeners.map(l => l.name), ...rtcListeners(config).map(l => l.name), LEGACY_RTC]);
+  let name = opts.name;
+  if (name !== undefined) {
+    if (taken.has(name)) throw new Error(`Listener "${name}" already exists (see rech listener ls)`);
+  } else {
+    const host = new URL(signal).hostname;
+    const base = `webrtc-${(isIP(host.replace(/^\[|\]$/g, "")) ? host : host.split(".")[0]!).replace(/[^a-zA-Z0-9_]+/g, "-").replace(/^-|-$/g, "")}`.slice(0, 36);
+    name = base;
+    for (let i = 2; taken.has(name); i++) name = `${base}-${i}`;
+  }
+  const listener: RtcListener = { name, kind: "webrtc", signal, ...(opts.ice?.length ? { ice: opts.ice } : {}) };
+  (config.rtcListeners ??= []).push(listener);
+  return listener;
+}
+
+/** The WebRTC listener for a signal URL: the default one, an existing one on that server, or a new one. */
+async function ensureRtcListener(signalUrl: string, ice: IceServer[] = []): Promise<string> {
+  const signal = normalizeSignal(signalUrl);
+  const config = await requireListeners();
+  if (!ice.length) {
+    const found = rtcListeners(config).find(l => l.signal === signal);
+    if (found) return found.name;
+  }
+  const listener = addRtcListenerTo(config, { signal, ice });
+  await writeListeners(config);
+  console.log(`Added WebRTC listener "${listener.name}" (${signal}${ice.length ? `; ${ice.map(iceLabel).join(", ")}` : ""}).`);
+  return listener.name;
+}
+
+async function addWebrtcListener(name: string, opts: { webrtc: string; turn?: string[]; turnEnv?: string[] }): Promise<void> {
+  const config = await requireListeners();
+  const listener = addRtcListenerTo(config, { name, signal: opts.webrtc, ice: iceFromOptions(opts.turn, opts.turnEnv) });
+  await writeListeners(config);
+  console.log(`WebRTC listener "${listener.name}" saved (${listener.signal}${listener.ice?.length ? `; ${listener.ice.map(iceLabel).join(", ")}` : ""}).`);
+  console.log(`Share over it: rech share <profile> --via ${listener.name}`);
 }
 
 async function removeListener(name: string): Promise<void> {
   const config = await requireListeners();
+  if (name === DEFAULT_RTC || name === LEGACY_RTC) throw new Error(`"${name}" is built in; it can't be removed. Shares stop using it when they are revoked (rech share revoke <share>).`);
+  const rtc = config.rtcListeners?.find(l => l.name === name);
+  if (rtc) {
+    const using = (await readShares()).shares.filter(s => !s.revokedAt && s.via.includes(name)).map(s => s.label);
+    if (using.length) throw new Error(`Shares still use WebRTC listener "${name}": ${using.join(", ")}. Revoke them first (rech share revoke <share>).`);
+    config.rtcListeners = config.rtcListeners!.filter(l => l !== rtc);
+    await writeListeners(config);
+    console.log("WebRTC listener removed; daemon reloads automatically.");
+    return;
+  }
   const listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error("Unknown listener");
   if (listener.profiles === "*") throw new Error("Keep the local management listener for setup and recovery");
@@ -3408,7 +3489,7 @@ async function rotateKey(name: string): Promise<void> {
   console.log(`New key for ${name}; URLs carrying the old key stop working now. Print new ones with: rech share <profile> --listener ${name}`);
 }
 
-async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void> {
+async function setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void> {
   const config = await requireListeners();
   let listener = config.listeners.find(l => l.name === name);
   if (!listener) throw new Error(`Unknown listener "${name}". See rech listener ls.`);
@@ -3434,7 +3515,9 @@ async function setListener(name: string, opts: { publicUrl?: string; clearPublic
     if (listener.profiles === "*") throw new Error(`"${name}" is the local management listener: read-cookie is always available there.`);
     if (opts.readCookies) listener.readCookies = true; else delete listener.readCookies;
   }
+  if (opts.keepDownloads !== undefined) { if (opts.keepDownloads) listener.keepDownloads = true; else delete listener.keepDownloads; }
   await writeListeners(config);
+  if (opts.keepDownloads !== undefined) console.log(opts.keepDownloads ? `${name}: browser downloads are also kept on this host (each is logged)` : `${name}: browser downloads go to the client only, then are deleted here`);
   if (opts.readCookies !== undefined) console.log(opts.readCookies ? `${name}: read-cookie on. Anyone with this link can copy any cookie (HttpOnly session cookies included) of any site its profiles are signed in to, which is enough to take over those sessions; --allow-domain only checks the domain the caller names. Each read is logged without the value` : `${name}: read-cookie off`);
   if (opts.readSecrets !== undefined) console.log(opts.readSecrets ? `${name}: read-secret on. Anyone with this link can copy the value of any field (saved passwords included) on any site its profiles have open; --allow-domain only checks the site the caller names. Each read is logged without the value` : `${name}: read-secret off`);
   if (opts.publicUrl !== undefined || opts.clearPublicUrl) console.log(listener.publicUrl ? `${name} is reachable at ${listener.publicUrl}` : `${name}: public URL cleared`);
@@ -4054,8 +4137,9 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
     guide?.close();
     console.log(`      Saved token for ${extraDisplay}`);
   }
-  if (bridgeVerified && isTTY && !opts.listen && !opts.skipShare) await setupShareStep(ask, profileEmail);
+  // The share step asks with its own prompts (a hidden one for TURN passwords): free stdin first.
   rl?.close();
+  if (bridgeVerified && isTTY && !opts.listen && !opts.skipShare) await setupShareStep(profileEmail);
   envWatcher?.close();
   if (bridgeVerified)
     console.log(`\nDone! Test with:\n  rech open github.com/snomiao`);
@@ -4065,65 +4149,125 @@ async function setup(opts: SetupOptions = {}): Promise<void> {
 
 const SIGNAL_SELFHOST_DOC = "https://github.com/snomiao/rechrome/blob/main/docs/signal-selfhost.md";
 
-/** The menu of setupShareStep: existing listeners first, then the new kinds. */
-export function shareMenu(listeners: Listener[], choices: ListenChoice[]): { key: string; label: string; listener?: string; kind?: "lan" | "tailscale" | "webrtc" | "webrtc-own" }[] {
-  const menu: ReturnType<typeof shareMenu> = [{ key: "1", label: "Don't add sharing (local access is always on; existing shares stay: rech share ls)" }];
+/** One entry of the share picker: an existing listener (`via`) or a new one to create (`kind`). */
+export type TransportItem = { key: string; label: string; via?: string; kind?: "lan" | "tailscale" | "webrtc" };
+
+/**
+ * The share picker's transports: existing scoped listeners, the WebRTC listeners (the built-in
+ * default included), then new ones for the networks detected here. "local" is always on, so it is
+ * shown above the list, not offered in it. `tailscaleHost`: the machine's MagicDNS name.
+ */
+export function transportMenu(listeners: Listener[], rtc: RtcListener[], choices: ListenChoice[], tailscaleHost?: string): TransportItem[] {
+  const menu: TransportItem[] = [];
+  const add = (item: Omit<TransportItem, "key">) => menu.push({ key: String(menu.length + 1), ...item });
   for (const l of listeners.filter(l => l.profiles !== "*"))
-    menu.push({ key: String(menu.length + 1), label: `Existing listener "${l.name}" (${listenerAddress(l)}${l.publicUrl ? `, ${l.publicUrl}` : ""})`, listener: l.name });
-  const has = (k: string) => choices.some(c => c.kind === k);
-  if (has("lan")) menu.push({ key: String(menu.length + 1), label: "New: LAN (machines on this network)", kind: "lan" });
-  if (has("tailscale")) menu.push({ key: String(menu.length + 1), label: "New: Tailscale only (your tailnet)", kind: "tailscale" });
-  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via rechrome.pages.dev (works across networks, nothing to run)", kind: "webrtc" });
-  menu.push({ key: String(menu.length + 1), label: "New: WebRTC via your own signal server (and TURN)", kind: "webrtc-own" });
+    add({ label: `${l.name}  (${l.publicUrl ?? `${listenerAddress(l)}${normalizePrefix(l.prefix)}`})`, via: l.name });
+  for (const l of rtc)
+    add({ label: `${l.name}  (WebRTC via ${new URL(l.signal).host}${l.builtin ? `; ${DEFAULT_RTC_NOTE.split(".")[0]}` : ""})`, via: l.name });
+  const lan = choices.find(c => c.kind === "lan");
+  if (lan) add({ label: `+ new LAN listener  (http://${lan.address}, machines on this network)`, kind: "lan" });
+  const ts = choices.find(c => c.kind === "tailscale");
+  if (ts) add({ label: `+ new tailscale listener  (${tailscaleHost ?? ts.address}, your tailnet)`, kind: "tailscale" });
+  add({ label: "+ new WebRTC listener…  (your own signal server, optional TURN)", kind: "webrtc" });
   return menu;
 }
 
-/** setup's last step: once the profile works here, offer to share it with other machines. */
-async function setupShareStep(ask: (q: string, def?: string) => Promise<string>, profile: string): Promise<void> {
-  const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+/** The picker's answer: numbers separated by commas or spaces; empty picks nothing. */
+export function parseTransportPicks(answer: string, menu: TransportItem[]): TransportItem[] {
+  const keys = answer.trim().split(/[\s,]+/).filter(Boolean);
+  const picked: TransportItem[] = [];
+  for (const key of keys) {
+    const item = menu.find(m => m.key === key);
+    if (!item) throw new Error(`Enter numbers from 1 to ${menu.length}, separated by commas or spaces (empty: share nothing).`);
+    if (!picked.includes(item)) picked.push(item);
+  }
+  return picked;
+}
+
+/** Ask one line in the terminal; with `hidden`, nothing typed is echoed (passwords). null on EOF. */
+async function askLine(question: string, hidden = false): Promise<string | null> {
+  const { createInterface } = await import("readline");
+  const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: !!process.stdin.isTTY });
+  if (hidden) (rl as any)._writeToOutput = (text: string) => { if (text.startsWith(question)) process.stderr.write(question); };
+  return new Promise(resolve => {
+    let answered = false;
+    rl.question(question, answer => { answered = true; if (hidden) process.stderr.write("\n"); rl.close(); resolve(answer); });
+    rl.once("close", () => { if (!answered) resolve(null); });
+  });
+}
+
+const NO_TRANSPORT_LINES = (profile: string) => [
+  `Pick how other machines reach ${profile} (rech share has no default):`,
+  `  rech share ${profile} --lan             machines on this network`,
+  `  rech share ${profile} --tailscale       your tailnet`,
+  `  rech share ${profile} --webrtc          any network, via the public signal server (${DEFAULT_RTC_NOTE.split(".")[0]})`,
+  `  rech share ${profile} --webrtc=<url>    any network, via your own signal server`,
+  `  rech share ${profile} --via <listener>  an existing listener (rech listener ls)`,
+  `Or run it in a terminal to pick from a list.`,
+];
+export const noTransportError = (profile: string) => new Error(NO_TRANSPORT_LINES(JSON.stringify(profile)).join("\n"));
+
+/**
+ * The share picker (rech share in a terminal, and setup's last step): tick the listeners to
+ * share over, creating new ones as asked. Returns the share's `via`; empty means share nothing.
+ */
+async function pickShareTransports(profiles: string[], label: string): Promise<string[]> {
+  const config = await requireListeners();
   const choices = await detectListenChoices();
-  const menu = shareMenu(listeners, choices);
-  console.log(`\n○ Share ${profile} with other machines?`);
-  for (const m of menu) console.log(`        ${m.key}. ${m.label}`);
-  let pick: (typeof menu)[number] | undefined;
-  while (!pick) {
-    const answer = (await ask("      Choice [1]: ", "1")).trim();
-    pick = menu.find(m => m.key === answer);
-    if (!pick) console.log("      Enter one of the numbers shown above.");
+  const tailscaleHost = choices.some(c => c.kind === "tailscale")
+    ? (JSON.parse(await runTailscale(["status", "--json"]) ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "") : undefined;
+  const menu = transportMenu(config.listeners, rtcListeners(config), choices, tailscaleHost);
+  console.error(`\nShare ${profiles.join(", ")} over (numbers, comma or space separated; empty: nothing):`);
+  console.error(`  [x] local  this machine, always on`);
+  for (const m of menu) console.error(`  [ ] ${m.key.padStart(2)}. ${m.label}`);
+  let picks: TransportItem[] | undefined;
+  while (!picks) {
+    const answer = await askLine("Share over: ");
+    if (answer === null) return [];
+    try { picks = parseTransportPicks(answer, menu); } catch (error) { console.error(error instanceof Error ? error.message : error); }
   }
-  try {
-    if (pick.key === "1") { console.log("✓ Not shared. Later: rech share new " + JSON.stringify(profile)); return; }
-    if (pick.listener) {
-      const config = await requireListeners();
-      allowProfiles(config, pick.listener, [profile]);
-      await writeListeners(config);
-      await printProfileUri(profile, pick.listener);
-      return;
-    }
-    if (pick.kind === "tailscale") {
-      const dns = (JSON.parse(await runTailscale(["status", "--json"]) ?? "null")?.Self?.DNSName as string | undefined)?.replace(/\.$/, "");
-      if (!dns?.endsWith(".ts.net")) console.log(`      ! Tailscale's hostname is ${dns ? `"${dns}", not under ts.net` : "unknown (is tailscale up?)"}; the link uses the tailnet IP.`);
-      else console.log(`      Tailscale hostname: ${dns}`);
-    }
-    let signal: string | undefined;
-    if (pick.kind === "webrtc-own") {
-      console.log(`\n      Run a signal server, then paste its URL here:`);
-      console.log(`        1. Read ${SIGNAL_SELFHOST_DOC}`);
-      console.log(`           (A: Cloudflare Workers is the easiest; C: Tailscale Funnel needs no domain).`);
-      console.log(`        2. Deploy it and open its URL in a browser to check that it answers.`);
-      console.log(`        3. For TURN (strict NATs), set CF_TURN_KEY_ID and CF_TURN_API_TOKEN in the daemon's env (see "TURN" in that doc).`);
-      while (!signal) {
-        const raw = (await ask("      Signal server URL (empty: cancel): ")).trim();
-        if (!raw) { console.log("      Not shared. Later: rech share new <profile> --signal <url>"); return; }
-        try { signal = normalizeSignal(raw); } catch (error) { console.log(`      ${error instanceof Error ? error.message : error}`); continue; }
-        const ok = await fetch(signal, { signal: AbortSignal.timeout(5000) }).then(() => true).catch(() => false);
-        if (!ok) console.log(`      ! ${signal} did not answer; the share is made anyway, check the server before sending the link.`);
-      }
+  const via: string[] = [];
+  for (const pick of picks) {
+    if (pick.via) via.push(pick.via);
+    else if (pick.kind === "lan") via.push(await shareTransportListener("lan", profiles, label));
+    else if (pick.kind === "tailscale") {
+      if (!tailscaleHost?.endsWith(".ts.net")) console.error(`! Tailscale's hostname is ${tailscaleHost ? `"${tailscaleHost}", not under ts.net` : "unknown (is tailscale up?)"}; the link uses the tailnet IP.`);
+      via.push(await shareTransportListener("tailscale", profiles, label));
+    } else {
+      const rtc = await askNewRtcListener();
+      if (rtc) via.push(rtc);
     }
-    const via = pick.kind === "webrtc" || pick.kind === "webrtc-own" ? WEBRTC : pick.kind!;
-    await shareNew([profile], { via: [via], ...(signal ? { signal } : {}) });
-  } catch (error) {
-    console.error(`      Sharing failed: ${error instanceof Error ? error.message : error}. Setup itself is saved; retry with rech share new ${JSON.stringify(profile)}.`);
+  }
+  return [...new Set(via)];
+}
+
+/** "+ new WebRTC listener…": a signal URL (the public one by default) and an optional TURN URL. */
+async function askNewRtcListener(): Promise<string | null> {
+  console.error(`  A signal server introduces the two machines; the browser traffic itself is end-to-end encrypted.`);
+  console.error(`  Default: ${DEFAULT_SIGNAL} (${DEFAULT_RTC_NOTE}). Self-hosting: ${SIGNAL_SELFHOST_DOC}`);
+  let signal: string | undefined;
+  while (!signal) {
+    const raw = await askLine(`  Signal server URL [${DEFAULT_SIGNAL}]: `);
+    if (raw === null) return null;
+    try { signal = normalizeSignal(raw.trim() || DEFAULT_SIGNAL); } catch (error) { console.error(`  ${error instanceof Error ? error.message : error}`); continue; }
+    const ok = await fetch(signal, { signal: AbortSignal.timeout(5000) }).then(() => true).catch(() => false);
+    if (!ok) console.error(`  ! ${signal} did not answer; the listener is saved anyway, check the server before sending the link.`);
+  }
+  const ice: IceServer[] = [];
+  while (true) {
+    const raw = await askLine(`  TURN server, e.g. turns://user:pass@turn.example.com:5349 (hidden; empty: none, STUN only): `, true);
+    if (!raw?.trim()) break;
+    try { ice.push(parseIceUrl(raw)); break; } catch (error) { console.error(`  ${error instanceof Error ? error.message : error}`); }
+  }
+  return ensureRtcListener(signal, ice);
+}
+
+/** setup's last step: once the profile works here, offer to share it with other machines. */
+async function setupShareStep(profile: string): Promise<void> {
+  console.log(`\n○ Share ${profile} with other machines? (local access is always on; existing shares stay: rech share ls)`);
+  try { await shareNew([profile], {}); }
+  catch (error) {
+    console.error(`      Sharing failed: ${error instanceof Error ? error.message : error}. Setup itself is saved; retry with rech share ${JSON.stringify(profile)}.`);
   }
 }
 
@@ -4137,7 +4281,7 @@ async function shareTransportListener(selector: string, profiles: string[], labe
   const config = await requireListeners();
   const named = config.listeners.find(l => l.name === selector);
   if (named) {
-    if (named.profiles === "*") throw new Error(`"${selector}" is the local management listener; share over lan, tailscale or webrtc instead.`);
+    if (named.profiles === "*") throw new Error(`"${selector}" is the local management listener; share over --lan, --tailscale or --webrtc instead.`);
     return named.name;
   }
   const address = chooseListenAddress(await detectListenChoices(), selector);
@@ -4151,29 +4295,58 @@ async function shareTransportListener(selector: string, profiles: string[], labe
 }
 
 /** Where a share's invite can be used, as full links (each holds the secret). */
-async function shareLinks(share: Share): Promise<{ via: string; link: string }[]> {
-  const listeners = (await readListeners().catch(() => null))?.listeners ?? [];
+async function shareLinks(share: Share): Promise<{ via: string; link: string; signal?: string }[]> {
+  const config = await readListeners().catch(() => null);
   return share.via.map(via => {
-    if (via === WEBRTC) return { via: "webrtc", link: inviteLink(share, share.signal ?? DEFAULT_SIGNAL) };
-    const l = listeners.find(x => x.name === via);
+    const rtc = shareRtcListeners({ via: [via], signal: share.signal }, config)[0];
+    if (rtc) return { via: rtc.name, link: inviteLink(share, rtc.signal), signal: rtc.signal };
+    const l = config?.listeners.find(x => x.name === via);
     if (!l) return { via, link: "(listener removed)" };
     return { via: l.name, link: inviteLink(share, l.publicUrl ?? `http://${listenerAddress(l)}${normalizePrefix(l.prefix)}`) };
   });
 }
 
-function printInvite(share: Share, links: { via: string; link: string }[]): void {
+function printInvite(share: Share, links: { via: string; link: string; signal?: string }[]): void {
   const expiry = share.inviteExpiresAt ? `unused, it expires ${fmtDate(share.inviteExpiresAt)}` : "it never expires unused";
   console.log(`Share "${share.label}": ${share.profiles.join(", ")}`);
   console.log(`Invite for ${share.maxDevices === 1 ? "one device" : `${share.maxDevices} devices`} (${expiry}; secret: send it privately):\n`);
-  for (const { via, link } of links) console.log(`  ${links.length > 1 ? `${via.padEnd(10)} ` : ""}${link}`);
-  const rtc = links.find(l => l.via === "webrtc");
-  if (rtc && share.signal === DEFAULT_SIGNAL) console.log(`\n  or in a terminal:  rech connect ${share.invite}`);
-  console.log(`\nThe other machine runs: rech connect '<link>'`);
+  const width = Math.max(...links.map(l => l.via.length));
+  for (const { via, link } of links) console.log(`  ${links.length > 1 ? `${via.padEnd(width)}  ` : ""}${link}`);
+  if (links.some(l => l.signal === DEFAULT_SIGNAL)) {
+    console.log(`\n  or in a terminal:  rech connect ${share.invite}`);
+    console.log(`  ${new URL(DEFAULT_SIGNAL).host} is ${DEFAULT_RTC_NOTE}`);
+  }
+  console.log(`\nThe other machine runs: rech connect '<link>'${links.length > 1 ? " (any one of them)" : ""}`);
   if (share.approve) console.log(`Each new device waits for you: rech share approve ${share.label}`);
   console.log(`Share expires: ${fmtDay(share.expiresAt)}${share.expiresAt ? ` (renew: rech share renew ${share.label})` : ""}`);
 }
 
-export type ShareNewOptions = { name?: string; via?: string[]; signal?: string; expires?: string; inviteTtl?: string; devices?: number; approve?: boolean };
+export type ShareNewOptions = { name?: string; via?: string[]; webrtc?: string[]; lan?: boolean; tailscale?: boolean; signal?: string; expires?: string; inviteTtl?: string; devices?: number; approve?: boolean };
+
+/**
+ * The transports named on the command line, in order: --via entries (comma-separated), then
+ * --lan, --tailscale and each --webrtc. A bare --webrtc is "webrtc" (resolved to the built-in
+ * listener, or to --signal / RECH_SIGNAL); --webrtc=<url> is that signal server's listener.
+ */
+export function transportTokens(opts: Pick<ShareNewOptions, "via" | "webrtc" | "lan" | "tailscale" | "signal">): string[] {
+  const tokens = (opts.via ?? []).flatMap(v => v.split(",")).map(v => v.trim()).filter(Boolean);
+  if (opts.lan) tokens.push("lan");
+  if (opts.tailscale) tokens.push("tailscale");
+  for (const w of opts.webrtc ?? []) tokens.push(w.trim() ? `webrtc=${w.trim()}` : WEBRTC);
+  // --signal on its own names a WebRTC transport too (on that server).
+  if (opts.signal && !tokens.length) tokens.push(WEBRTC);
+  return [...new Set(tokens)];
+}
+
+/** One transport token to a share `via` entry, creating the listener it needs. */
+async function resolveTransport(token: string, profiles: string[], label: string, signal?: string): Promise<string> {
+  if (token === WEBRTC) return signal ? ensureRtcListener(signal) : DEFAULT_RTC;
+  if (token.startsWith("webrtc=")) return ensureRtcListener(token.slice("webrtc=".length));
+  if (/^https?:\/\//i.test(token)) return ensureRtcListener(token);
+  const config = await readListeners().catch(() => null);
+  if (rtcListeners(config).some(l => l.name === token)) return token;
+  return shareTransportListener(token, profiles, label);
+}
 
 async function shareNew(selectors: string[], opts: ShareNewOptions): Promise<void> {
   if (!selectors.length) throw new Error("Which profiles? rech share new <profile..>   (see rech profile)");
@@ -4186,19 +4359,29 @@ async function shareNew(selectors: string[], opts: ShareNewOptions): Promise<voi
   // Fail on the name before binding any listener for it.
   if (taken.has(label)) throw new Error(`A share named "${label}" already exists. Pick another --name, or: rech share rotate ${label}`);
   if (!/^[a-z0-9][a-z0-9_-]{0,39}$/.test(label)) throw new Error(`Share names use a-z, 0-9, "-" and "_" (up to 40), e.g. alice or ci-bot; got "${label}"`);
-  const wanted = (opts.via?.length ? opts.via : [WEBRTC]).flatMap(v => v.split(",")).map(v => v.trim()).filter(Boolean);
-  const via: string[] = [];
-  for (const v of wanted) via.push(v === WEBRTC ? WEBRTC : await shareTransportListener(v, profiles, label));
-  const expires = opts.expires ?? (via.includes(WEBRTC) ? "30d" : "never");
+  // No default transport: name one, or pick in a terminal.
+  const tokens = transportTokens(opts);
+  let via: string[];
+  if (tokens.length) {
+    via = [];
+    for (const t of tokens) via.push(await resolveTransport(t, profiles, label, opts.signal ?? process.env.RECH_SIGNAL));
+    via = [...new Set(via)];
+  } else {
+    if (!isInteractive()) throw noTransportError(profiles.length === 1 ? profiles[0]! : "<profile>");
+    via = await pickShareTransports(profiles, label);
+    if (!via.length) { console.error(`Nothing shared. Later: rech share ${JSON.stringify(profiles[0])}`); return; }
+  }
+  const rtc = shareRtcListeners({ via }, await readListeners().catch(() => null));
+  const expires = opts.expires ?? (rtc.length ? "30d" : "never");
   const expiresMs = parseDuration(expires);
   const share = await updateShares(config => createShare(config, {
-    label, profiles, via, signal: opts.signal ?? process.env.RECH_SIGNAL,
+    label, profiles, via,
     expiresAt: expiresMs ? Date.now() + expiresMs : undefined,
     inviteTtlMs: parseDuration(opts.inviteTtl ?? "24h"),
     maxDevices: opts.devices ?? 1, approve: opts.approve,
   }));
   // The daemon answers WebRTC peers with node-datachannel: install it now, not on the first peer.
-  if (via.includes(WEBRTC)) await loadRTC().catch(error => console.error(`[rech] warning: ${error instanceof Error ? error.message : error}`));
+  if (rtc.length) await loadRTC().catch(error => console.error(`[rech] warning: ${error instanceof Error ? error.message : error}`));
   printInvite(share, await shareLinks(share));
 }
 
@@ -4423,7 +4606,7 @@ async function sessionCommand(action: string, name?: string): Promise<void> {
 async function signalServe(opts: { host?: string; port?: number }): Promise<void> {
   const server = startSignalRelay({ host: opts.host ?? "127.0.0.1", port: opts.port ?? 8787, log });
   console.log(`rech signal server (rech-signal-1) on http://${server.hostname}:${server.port}/`);
-  console.log(`Put HTTPS in front of it, then share through it: rech share new <profile> --signal https://<your-host>/`);
+  console.log(`Put HTTPS in front of it, then share through it: rech share <profile> --webrtc=https://<your-host>/`);
 }
 
 async function status(): Promise<void> {
@@ -4509,6 +4692,7 @@ export type RechHandlers = {
   status(): Promise<void>;
   listListeners(): Promise<void>;
   addListener(name: string, opts: { listen: string; profile: string[]; port?: number; prefix?: string }): Promise<void>;
+  addWebrtcListener(name: string, opts: { webrtc: string; turn?: string[]; turnEnv?: string[] }): Promise<void>;
   removeListener(name: string): Promise<void>;
   listProfiles(): Promise<void>;
   removeProfile(selector: string, opts: { yes?: boolean; close?: boolean }): Promise<void>;
@@ -4520,7 +4704,7 @@ export type RechHandlers = {
   allowListener(name: string, profiles: string[]): Promise<void>;
   denyListener(name: string, profiles: string[]): Promise<void>;
   rotateKey(name: string): Promise<void>;
-  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean }): Promise<void>;
+  setListener(name: string, opts: { publicUrl?: string; clearPublicUrl?: boolean; uploads?: boolean; hostUploadDirs?: string[]; noHostUploads?: boolean; readSecrets?: boolean; readCookies?: boolean; keepDownloads?: boolean }): Promise<void>;
   setup(opts: SetupOptions): Promise<void>;
   tray(action?: string): Promise<void>;
   provisionProfile(name: string, opts: { headed: boolean; experimental: boolean }): Promise<void>;
@@ -4573,7 +4757,8 @@ Examples:
   rech setup --profile you@example.com         set up Chrome on this machine
   rech open https://example.com                open a page in this project's session
   rech screenshot                              saved to <project>/.rechrome/output/
-  rech share new you@example.com               invite link for another machine (WebRTC, no open port)
+  rech share                                   pick a profile and how to share it (in a terminal)
+  rech share you@example.com --webrtc          invite link for another machine (WebRTC, no open port)
   rech connect '<link>'                        use that link in this project
   rech share ls                                shares, devices, expiry
 
@@ -4614,11 +4799,14 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         throw new Error(`To share "${a.name}" with another machine: rech share ${JSON.stringify(a.name)}. To list profiles: rech profile`);
       })
     // Share with and connect from other machines
-    .command("share [profiles..]", "Share profiles: `share new <profile..>` makes an invite link (WebRTC by default); `share ls` lists all", y => y
+    .command("share [profiles..]", "Share profiles: `share <profile> --lan|--tailscale|--webrtc[=url]|--via <listener>` makes an invite link (no default: a terminal asks); `share ls` lists all", y => y
       .positional("profiles", { type: "string", array: true, describe: "new <profile..> | ls | devices|approve|allow|deny|rotate|renew|revoke|rm <share> […]; or a profile for its legacy listener link" })
       .option("name", { type: "string", requiresArg: true, describe: "With new: the share's name (default: from the first profile)" })
-      .option("via", { type: "string", array: true, requiresArg: true, describe: "With new: webrtc (default) | lan | tailscale | <IP> | <listener>; repeat or comma-separate for several" })
-      .option("signal", { type: "string", requiresArg: true, describe: `With new: signal server for webrtc (default ${DEFAULT_SIGNAL}, or RECH_SIGNAL)` })
+      .option("via", { type: "string", array: true, requiresArg: true, describe: "Share over these: lan | tailscale | webrtc | <IP> | <listener> (rech listener ls); repeat or comma-separate for several" })
+      .option("lan", { type: "boolean", describe: "Share over this network (a LAN listener, made if needed)" })
+      .option("tailscale", { type: "boolean", describe: "Share over your tailnet (a tailscale listener, made if needed)" })
+      .option("webrtc", { type: "string", describe: `Share over WebRTC: bare = ${DEFAULT_RTC} (${DEFAULT_SIGNAL}, best effort); --webrtc=<signal-url> = that server's listener (made if needed); repeatable` })
+      .option("signal", { type: "string", requiresArg: true, describe: `Signal server for a bare --webrtc / --via webrtc (else RECH_SIGNAL, else ${DEFAULT_SIGNAL})` })
       .option("expires", { type: "string", requiresArg: true, describe: "With new/renew: 30d, 2w, 24h, never (new default: 30d over webrtc, else never)" })
       .option("invite-ttl", { type: "string", requiresArg: true, describe: "With new: an unused invite stops working after this (default 24h)" })
       .option("devices", { type: "number", requiresArg: true, describe: "With new: how many devices may redeem the invite (default 1)" })
@@ -4631,7 +4819,16 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
       a => {
         const profiles = (a.profiles ?? []) as string[];
         const [action, target, ...rest] = profiles;
-        if (action === "new") return handlers.shareNew(profiles.slice(1), { name: a.name, via: a.via as string[] | undefined, signal: a.signal, expires: a.expires, inviteTtl: a.inviteTtl, devices: a.devices, approve: a.approve });
+        const webrtc = a.webrtc === undefined ? undefined : ([a.webrtc].flat() as string[]).map(String);
+        const transport = { via: a.via as string[] | undefined, webrtc, lan: a.lan, tailscale: a.tailscale, signal: a.signal };
+        const newOpts = { name: a.name, ...transport, expires: a.expires, inviteTtl: a.inviteTtl, devices: a.devices, approve: a.approve };
+        if (action === "new") return handlers.shareNew(profiles.slice(1), newOpts);
+        // Transport flags make a share (an invite link) for the named profiles.
+        if (transportTokens(transport).length && !(action && SHARE_ACTIONS.has(action)) && !(profiles.length === 1 && ["ls", "list"].includes(profiles[0]))) {
+          if (a.all || a.listener) throw new Error("--lan/--tailscale/--webrtc/--via make a new share; --all and --listener print an existing listener's link. Use one or the other.");
+          if (!profiles.length) throw new Error("Which profiles? rech share <profile..> --lan|--tailscale|--webrtc|--via <listener>   (see rech profile)");
+          return handlers.shareNew(profiles, newOpts);
+        }
         if (action && SHARE_ACTIONS.has(action)) {
           if (!target) throw new Error(`Which share? rech share ${action} <share>   (see rech share ls)`);
           if (action === "devices") return handlers.shareDevices(target, a.rm);
@@ -4655,13 +4852,23 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
       a => a.global || a.project ? handlers.connect(a.url, { global: a.global, project: a.project }) : handlers.connect(a.url))
     .command(["listener", "listeners"], "Control who can connect: listeners, allowed profiles, keys, public URLs", y => y
       .command(["ls", "list", "$0"], "List listeners (keys hidden)", {}, () => handlers.listListeners())
-      .command("add <name>", "Expose registered profiles on an address (local for a proxy, lan, tailscale, IP)", y => y
+      .command("add <name>", "Expose registered profiles on an address (local for a proxy, lan, tailscale, IP), or add a WebRTC signal server (--webrtc)", y => y
         .positional("name", { type: "string", demandOption: true })
-        .option("listen", { type: "string", requiresArg: true, demandOption: true, describe: "local | lan | tailscale | <detected IP>" })
-        .option("profile", { type: "string", array: true, requiresArg: true, demandOption: true, describe: "Allowed profile; repeat for several" })
+        .option("listen", { type: "string", requiresArg: true, describe: "local | lan | tailscale | <detected IP>" })
+        .option("profile", { type: "string", array: true, requiresArg: true, describe: "Allowed profile; repeat for several" })
         .option("port", portOption)
-        .option("prefix", { type: "string", requiresArg: true, describe: "URL path prefix, e.g. rechrome" }),
-        a => handlers.addListener(a.name, { listen: a.listen, profile: a.profile, port: a.port, prefix: a.prefix }))
+        .option("prefix", { type: "string", requiresArg: true, describe: "URL path prefix, e.g. rechrome" })
+        .option("webrtc", { type: "string", requiresArg: true, describe: "A WebRTC listener on this signal server, e.g. https://signal.example.com/ (shares name it with --via)" })
+        .option("turn", { type: "string", array: true, requiresArg: true, describe: "With --webrtc: a STUN/TURN server, e.g. turns://user:pass@turn.example.com:5349; repeatable" })
+        .option("turn-env", { type: "string", array: true, requiresArg: true, describe: "With --webrtc: read a TURN URL from this environment variable (keeps the password out of shell history); repeatable" })
+        .check(a => a.webrtc !== undefined
+          ? (a.listen || a.profile || a.port || a.prefix ? "--webrtc takes no --listen/--profile/--port/--prefix" : true)
+          : a.turn || a.turnEnv ? "--turn/--turn-env go with --webrtc <signal-url>"
+          : a.listen && a.profile?.length ? true : "Pass --listen <where> --profile <profile>, or --webrtc <signal-url>")
+        .example("rech listener add home --webrtc=https://signal.example.com/ --turn-env MY_TURN_URL", ""),
+        a => a.webrtc !== undefined
+          ? handlers.addWebrtcListener(a.name, { webrtc: a.webrtc, turn: a.turn as string[] | undefined, turnEnv: a.turnEnv as string[] | undefined })
+          : handlers.addListener(a.name, { listen: a.listen!, profile: a.profile as string[], port: a.port, prefix: a.prefix }))
       .command("allow <name> <profiles..>", "Allow more profiles on a listener", y => y
         .positional("name", { type: "string", demandOption: true }).positional("profiles", { type: "string", array: true, demandOption: true }),
         a => handlers.allowListener(a.name, a.profiles))
@@ -4676,9 +4883,10 @@ export function rechCli(argv: string[], handlers: RechHandlers) {
         .option("host-upload-dir", { type: "string", array: true, requiresArg: true, describe: "Off by default. Also let links upload files already on this host, from inside this directory (rech upload --host <path>); repeatable" })
         .option("read-secrets", { type: "boolean", describe: "Off by default. Let this listener's links copy any field's value (saved passwords too) or localStorage/sessionStorage value (app tokens) into a pipe (rech read-secret, read-storage): only for links you trust with those accounts. --no-read-secrets turns it off" })
         .option("read-cookies", { type: "boolean", describe: "Off by default. Let this listener's links copy any cookie, HttpOnly session cookies too (rech read-cookie): enough to take over the profiles' signed-in sessions, so only for links you trust with those accounts. --no-read-cookies turns it off" })
+        .option("keep-downloads", { type: "boolean", describe: "Off by default: browser downloads go to the client, then are deleted here. --keep-downloads also keeps them on this host" })
         .option("host-uploads", { type: "boolean", describe: "--no-host-uploads turns host-path uploads off again" })
-        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, or --host-upload-dir/--no-host-uploads"),
-        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}) }))
+        .check(a => a.publicUrl !== undefined || a.clearPublicUrl || a.uploads !== undefined || a.hostUploadDir?.length || a.hostUploads === false || a.readSecrets !== undefined || a.readCookies !== undefined || a.keepDownloads !== undefined ? true : "Pass --public-url <url>, --clear-public-url, --uploads/--no-uploads, --host-upload-dir/--no-host-uploads, --read-secrets/--read-cookies, or --keep-downloads"),
+        a => handlers.setListener(a.name, { publicUrl: a.publicUrl, clearPublicUrl: a.clearPublicUrl, ...(a.uploads !== undefined ? { uploads: a.uploads } : {}), ...(a.hostUploadDir?.length ? { hostUploadDirs: a.hostUploadDir as string[] } : {}), ...(a.hostUploads === false ? { noHostUploads: true } : {}), ...(a.readSecrets !== undefined ? { readSecrets: a.readSecrets } : {}), ...(a.readCookies !== undefined ? { readCookies: a.readCookies } : {}), ...(a.keepDownloads !== undefined ? { keepDownloads: a.keepDownloads } : {}) }))
       .command("port [name]", "Print a listener's port (for a proxy command)", y => y.positional("name", { type: "string" }),
         a => handlers.listenerPort(a.name))
       .command("rotate-key <name>", "Give a listener a new key (old URLs stop working)", y => y.positional("name", { type: "string", demandOption: true }),
@@ -4729,7 +4937,7 @@ if (import.meta.main) {
   const handlers: RechHandlers = {
     serve: async () => { const { serve } = await import("./serve.ts"); serve(); }, // long-lived; watcher intentionally kept alive
     status,
-    listListeners, addListener, removeListener, printProfileUri,
+    listListeners, addListener, addWebrtcListener, removeListener, printProfileUri,
     listProfiles: async () => {
       const raw = process.env[ENV_KEY];
       const url = raw ? await transportUrl(raw) : raw;