rechrome 1.46.0 → 1.48.0

package/fill-secret.js

@@ -2,9 +2,239 @@
 // fill-secret.ts
 import { createHmac } from "crypto";
 import { connect } from "net";
-import { readdirSync, readFileSync } from "fs";
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+
+// redact.ts
+import { readFileSync } from "fs";
+function goToJs(src) {
+  let flags = "";
+  for (;; ) {
+    const m = /^\(\?([is]+)\)/.exec(src);
+    if (!m)
+      break;
+    flags += m[1];
+    src = src.slice(m[0].length);
+  }
+  src = src.replaceAll("(?P<", "(?<").replaceAll("\\z", "$").replaceAll("[[:alnum:]]", "[A-Za-z0-9]").replaceAll("[:alnum:]", "A-Za-z0-9").replaceAll("[:alpha:]", "A-Za-z").replaceAll("[:digit:]", "0-9").replaceAll("[:space:]", "\\s");
+  let out = "";
+  const closers = [];
+  let extra = 0;
+  for (let i = 0;i < src.length; i++) {
+    const c = src[i];
+    if (c === "\\") {
+      out += c + (src[i + 1] ?? "");
+      i++;
+      continue;
+    }
+    if (c === "[") {
+      let j = i + 1;
+      if (src[j] === "^")
+        j++;
+      if (src[j] === "]")
+        j++;
+      while (j < src.length && src[j] !== "]") {
+        if (src[j] === "\\")
+          j++;
+        j++;
+      }
+      out += src.slice(i, j + 1);
+      i = j;
+      continue;
+    }
+    if (src.startsWith("(?i)", i)) {
+      out += "(?i:";
+      extra++;
+      i += 3;
+      continue;
+    }
+    if (c === "(") {
+      closers.push(extra);
+      extra = 0;
+      out += c;
+      continue;
+    }
+    if (c === ")") {
+      out += ")".repeat(extra);
+      extra = closers.pop() ?? 0;
+      out += c;
+      continue;
+    }
+    if (c === "|" && extra) {
+      out += ")".repeat(extra) + "|" + "(?i:".repeat(extra);
+      continue;
+    }
+    out += c;
+  }
+  out += ")".repeat(extra);
+  return { source: out, flags: [...new Set(flags)].join("") };
+}
+function loadGitleaksRules(toml) {
+  const c = Bun.TOML.parse(toml);
+  const compile = (r) => {
+    const j = goToJs(r);
+    return new RegExp(j.source, j.flags);
+  };
+  const gAllow = (c.allowlist?.regexes ?? []).map(compile);
+  const gStop = (c.allowlist?.stopwords ?? []).map((s) => s.toLowerCase());
+  const rules = [];
+  for (const r of c.rules) {
+    if (!r.regex)
+      continue;
+    const allow = [...gAllow];
+    const allowMatch = [];
+    const allowLine = [];
+    const stop = [...gStop];
+    for (const a of [...r.allowlists ?? [], ...r.allowlist ? [r.allowlist] : []]) {
+      const into = a.regexTarget === "match" ? allowMatch : a.regexTarget === "line" ? allowLine : allow;
+      for (const x of a.regexes ?? [])
+        into.push(compile(x));
+      for (const s of a.stopwords ?? [])
+        stop.push(String(s).toLowerCase());
+    }
+    const j = goToJs(r.regex);
+    rules.push({
+      id: r.id,
+      re: new RegExp(j.source, j.flags + "gd"),
+      keywords: (r.keywords ?? []).map((k) => k.toLowerCase()),
+      ...r.entropy ? { entropy: r.entropy } : {},
+      ...r.secretGroup ? { group: r.secretGroup } : {},
+      allow,
+      ...allowMatch.length ? { allowMatch } : {},
+      ...allowLine.length ? { allowLine } : {},
+      stop
+    });
+  }
+  return rules;
+}
+var OWN_RULES = [
+  { id: "url-secret-param", re: /[?&](?:access_token|token|key|api_key|apikey|secret|client_secret|password|passwd|pwd|sig|signature)=([^&\s#<>"'|]{6,})/gid, group: 1, keywords: ["="], allow: [/^(?:x+|\*+|\.\.\.|your[-_]?\w*|xxx\w*)$/i], stop: [] },
+  { id: "sk-key", re: /\b(sk-(?:proj-|ant-|or-v1-|svcacct-)?[A-Za-z0-9_-]{20,})/gd, group: 1, keywords: ["sk-"], entropy: 3.5, allow: [], stop: [] },
+  { id: "otp-code", re: /(?:code|\u30B3\u30FC\u30C9|otp|pin|passcode|\u8A8D\u8A3C|\u78BA\u8A8D\u756A\u53F7|\u30EF\u30F3\u30BF\u30A4\u30E0)[^\d\n]{0,20}(?<![\d.])(\d{6})(?![\d.])/gid, group: 1, keywords: [], allow: [], stop: [] }
+];
+var cached;
+function secretRules() {
+  cached ??= [...loadGitleaksRules(readFileSync(new URL("./secret-rules/gitleaks.toml", import.meta.url), "utf8")), ...OWN_RULES];
+  return cached;
+}
+function shannon(s) {
+  const f = new Map;
+  for (const ch of s)
+    f.set(ch, (f.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const n of f.values()) {
+    const p = n / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+function findKnown(text, known) {
+  const forms = new Set;
+  for (const v of known) {
+    if (v.length < 6)
+      continue;
+    forms.add(v);
+    forms.add(JSON.stringify(v).slice(1, -1));
+  }
+  const out = [];
+  for (const f of [...forms].sort((a, b) => b.length - a.length)) {
+    for (let i = text.indexOf(f);i >= 0; i = text.indexOf(f, i + f.length))
+      out.push({ id: "known-secret", start: i, end: i + f.length });
+  }
+  return out;
+}
+var OPAQUE_RUN = /[A-Za-z0-9+/=_-]{4096,}/g;
+function findSecrets(text, opts = {}) {
+  if (text.length >= 4096 && OPAQUE_RUN.test(text)) {
+    OPAQUE_RUN.lastIndex = 0;
+    const out = opts.known?.length ? findKnown(text, opts.known) : [];
+    let at = 0;
+    for (const m of [...text.matchAll(OPAQUE_RUN), { index: text.length, 0: "" }]) {
+      const piece = text.slice(at, m.index);
+      if (piece)
+        for (const h of findSecrets(piece, { ...opts, known: [] }))
+          out.push({ ...h, start: h.start + at, end: h.end + at });
+      at = m.index + m[0].length;
+    }
+    return out;
+  }
+  OPAQUE_RUN.lastIndex = 0;
+  const rules = opts.rules ?? secretRules();
+  const lower = text.toLowerCase();
+  const out = opts.known?.length ? findKnown(text, opts.known) : [];
+  for (const r of rules) {
+    if (r.keywords.length && !r.keywords.some((k) => lower.includes(k)))
+      continue;
+    for (const m of text.matchAll(r.re)) {
+      const gi = r.group ?? m.findIndex((g, i) => i > 0 && !!g);
+      const secret = gi > 0 ? m[gi] : m[0];
+      if (!secret)
+        continue;
+      if (r.entropy && shannon(secret) < r.entropy)
+        continue;
+      if (r.allow.some((a) => a.test(secret)))
+        continue;
+      if (r.allowMatch?.some((a) => a.test(m[0])))
+        continue;
+      if (r.allowLine) {
+        const ls = text.lastIndexOf(`
+`, m.index) + 1;
+        const le = text.indexOf(`
+`, m.index + m[0].length);
+        if (r.allowLine.some((a) => a.test(text.slice(ls, le < 0 ? undefined : le))))
+          continue;
+      }
+      const sl = secret.toLowerCase();
+      if (r.stop.some((s) => sl.includes(s)))
+        continue;
+      const span = r.group ? m.indices?.[r.group] : undefined;
+      if (span)
+        out.push({ id: r.id, start: span[0], end: span[1] });
+      else {
+        let a = m.index;
+        let b = m.index + m[0].length;
+        const edge = /[\s'"`;=:,]/;
+        while (a < b && edge.test(text[a]))
+          a++;
+        for (;; ) {
+          if (b > a && edge.test(text[b - 1]))
+            b--;
+          else if (b - 2 >= a && /\\[nr]/.test(text.slice(b - 2, b)))
+            b -= 2;
+          else
+            break;
+        }
+        out.push({ id: r.id, start: a, end: b });
+      }
+    }
+  }
+  return out;
+}
+function redact(text, opts = {}) {
+  const hits = findSecrets(text, opts).sort((a, b) => a.start - b.start || b.end - a.end);
+  if (!hits.length)
+    return { text, kinds: [] };
+  const spans = [];
+  for (const h of hits) {
+    const last = spans[spans.length - 1];
+    if (last && h.start < last.end) {
+      if (h.end - h.start > last.end - last.start)
+        last.id = h.id;
+      last.end = Math.max(last.end, h.end);
+    } else
+      spans.push({ ...h });
+  }
+  let out = "";
+  let at = 0;
+  for (const s of spans) {
+    out += text.slice(at, s.start) + `[redacted:${s.id}]`;
+    at = s.end;
+  }
+  return { text: out + text.slice(at), kinds: [...new Set(spans.map((s) => s.id))] };
+}
+
+// fill-secret.ts
 var SECRET_MASK = "***";
 var SECRET_MASK_TTL_MS = 15 * 60000;
 var MIN_MASK_LENGTH = 6;
@@ -266,7 +496,7 @@ function daemonSessionSockets(session, env = process.env) {
       if (!/^[0-9a-f]{16}$/.test(h))
         continue;
       try {
-        const cfg = JSON.parse(readFileSync(join(base, h, `${session}.session`), "utf8"));
+        const cfg = JSON.parse(readFileSync2(join(base, h, `${session}.session`), "utf8"));
         if ((cfg?.name ?? session) === session && typeof cfg?.socketPath === "string" && cfg.socketPath)
           out.push(cfg.socketPath);
       } catch {}
@@ -317,7 +547,7 @@ async function runCodeOnSession(opts) {
   for (const path of candidates) {
     let reply;
     try {
-      reply = await socketRequest(path, "run", { args: { _: ["run-code", opts.code] }, cwd: opts.cwd, ...opts.json ? { json: true } : {} });
+      reply = await socketRequest(path, "run", { args: { _: ["run-code", opts.code] }, cwd: opts.cwd, ...opts.json ? { json: true } : {} }, opts.timeoutMs);
     } catch (e) {
       errors.push(e instanceof Error ? e.message : String(e));
       continue;
@@ -329,6 +559,22 @@ async function runCodeOnSession(opts) {
   }
   throw new Error(`could not reach this session's browser (${errors.join("; ")}); run \`rech open <url>\` first`);
 }
+async function runCliOnSession(opts, cliArgs) {
+  const candidates = [...new Set([...sessionSocketCandidates(opts.socketRoot, opts.session), ...daemonSessionSockets(opts.session)])];
+  for (const path of candidates) {
+    let reply;
+    try {
+      reply = await socketRequest(path, "run", { args: { _: cliArgs }, cwd: opts.cwd });
+    } catch {
+      continue;
+    }
+    if (reply.error)
+      throw new Error(reply.error);
+    const r = reply.result;
+    return { isError: !!r?.isError, text: typeof r === "string" ? r : typeof r?.text === "string" ? r.text : "" };
+  }
+  throw new Error("no browser is open in this session");
+}
 function fillSecretOnSession(opts) {
   return runCodeOnSession({ ...opts, code: buildFillCode(opts.ref, opts.value, opts.allowDomains, opts.submit) });
 }
@@ -434,13 +680,27 @@ async function readSecretOnSession(opts) {
     throw new Error("read-secret: the page returned no value");
   return out;
 }
-var READ_STORAGE_USAGE = `Usage: rech read-storage <local|session> <key> [json-path] --allow-domain <glob> | <command>
+var READ_STORAGE_USAGE = `Usage: rech read-storage <local|session> <key> [json-path] --allow-domain <glob> [--goto <url>] | <command>
   Writes the storage value, raw and without a newline, to stdout, which must be a pipe into the
   program that stores it (never a terminal or a file). Never logged; masked in later outputs.
   <local|session>       localStorage or sessionStorage
   <key>                 the storage key, e.g. localConfig_v2
   [json-path]           optional: a path into the JSON value, e.g. teams.T0123.token or teams[T0123].token
-  --allow-domain GLOB   required: the page's host must match, e.g. app.slack.com`;
+  --allow-domain GLOB   required: the page's host must match, e.g. app.slack.com
+  --goto URL            first navigate the attached tab to URL (host must match --allow-domain),
+                        so the value is read from it, e.g. --goto https://app.slack.com/client/T0`;
+function checkGotoUrl(gotoUrl, allowDomains) {
+  let u;
+  try {
+    u = new URL(gotoUrl);
+  } catch {
+    throw new Error("--goto must be an http(s) URL");
+  }
+  if (!/^https?:$/.test(u.protocol))
+    throw new Error("--goto must be an http(s) URL");
+  if (!allowDomains.some((d) => domainGlobToRegExp(d).test(u.hostname.toLowerCase())))
+    throw new Error("--goto URL host must match --allow-domain");
+}
 function parseStoragePath(path) {
   return path.match(/[^.[\]]+/g) ?? [];
 }
@@ -450,6 +710,7 @@ function parseReadStorageArgs(args) {
     throw new Error("Expected read-storage");
   const pos = [];
   const allowDomains = [];
+  let gotoUrl;
   for (let i = 0;i < rest.length; i++) {
     const a = rest[i];
     if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
@@ -460,6 +721,10 @@ function parseReadStorageArgs(args) {
         domainGlobToRegExp(d.trim());
         allowDomains.push(d.trim());
       }
+    } else if (a === "--goto" || a.startsWith("--goto=")) {
+      gotoUrl = a === "--goto" ? rest[++i] : a.slice("--goto=".length);
+      if (!gotoUrl)
+        throw new Error("--goto got an empty URL");
     } else if (a.startsWith("-"))
       throw new Error(`read-storage: unknown option ${a}`);
     else
@@ -474,10 +739,12 @@ function parseReadStorageArgs(args) {
     throw new Error("read-storage: a storage key is required");
   if (!allowDomains.length)
     throw new Error("read-storage needs --allow-domain: name the site the value must come from");
-  return { area, key, path: rawPath ? parseStoragePath(rawPath) : [], allowDomains };
+  if (gotoUrl)
+    checkGotoUrl(gotoUrl, allowDomains);
+  return { area, key, path: rawPath ? parseStoragePath(rawPath) : [], allowDomains, gotoUrl };
 }
 function readStorageWireArgs(req) {
-  return ["read-storage", req.area, req.key, ...req.path.length ? [req.path.join(".")] : [], ...req.allowDomains.map((d) => `--allow-domain=${d}`)];
+  return ["read-storage", req.area, req.key, ...req.path.length ? [req.path.join(".")] : [], ...req.allowDomains.map((d) => `--allow-domain=${d}`), ...req.gotoUrl ? [`--goto=${req.gotoUrl}`] : []];
 }
 function parseReadStorageWire(args) {
   const [cmd, area, key, ...rest] = args;
@@ -485,11 +752,14 @@ function parseReadStorageWire(args) {
     throw new Error("read-storage needs <local|session> <key>");
   const allowDomains = [];
   let path = [];
+  let gotoUrl;
   for (const a of rest) {
     if (a.startsWith("--allow-domain=")) {
       const d = a.slice("--allow-domain=".length);
       domainGlobToRegExp(d);
       allowDomains.push(d);
+    } else if (a.startsWith("--goto=")) {
+      gotoUrl = a.slice("--goto=".length);
     } else if (!a.startsWith("-") && !path.length)
       path = parseStoragePath(a);
     else
@@ -497,31 +767,42 @@ function parseReadStorageWire(args) {
   }
   if (!allowDomains.length)
     throw new Error("read-storage needs --allow-domain");
-  return { area, key, path, allowDomains };
+  if (gotoUrl !== undefined)
+    checkGotoUrl(gotoUrl, allowDomains);
+  return { area, key, path, allowDomains, gotoUrl };
 }
 function buildReadStorageCode(area, key, path, allowDomains) {
   const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
   const store = area === "local" ? "localStorage" : "sessionStorage";
   return `async page => {
-  // One evaluate: the host checked is the origin read, with no navigation in between.
-  const out = await page.evaluate(({ key, path }) => {
-    const host = String(location.hostname).toLowerCase();
+  const allowed = ${JSON.stringify(patterns)};
+  const hostOf = (u) => { const m = /^[a-z][a-z0-9+.-]*:\\/\\/([^/?#]+)/i.exec(String(u || "")); return m ? m[1].replace(/^[^@]*@/, "").replace(/:\\d+$/, "").toLowerCase() : ""; };
+  const ok = (h) => h && allowed.some(p => new RegExp(p, "i").test(h));
+  // The caller has foregrounded the --allow-domain tab; read from whichever of this tab's frames
+  // is on the allowed host (the top frame can be a blank wrapper over the bridge).
+  const frame = page.frames().find(f => ok(hostOf(f.url())));
+  const host = frame ? hostOf(frame.url()) : "";
+  if (!frame)
+    throw new Error("read-storage refused: the foreground tab is not on an --allow-domain host (host " + JSON.stringify(hostOf(page.url())) + ")");
+  // Re-check the host inside the same evaluate that reads, so a navigation between the frame
+  // pick and the read can't hand over another origin's storage.
+  const out = await frame.evaluate(({ key, path, allowed }) => {
+    const m = /^[a-z][a-z0-9+.-]*:\\/\\/([^/?#]+)/i.exec(String(document.URL || ""));
+    const h = m ? m[1].replace(/^[^@]*@/, "").replace(/:\\d+$/, "").toLowerCase() : "";
+    if (!h || !allowed.some(p => new RegExp(p, "i").test(h))) return { moved: true };
     const raw = window.${store}.getItem(key);
-    if (raw === null) return { host, missing: true };
-    if (!path.length) return { host, value: raw };
+    if (raw === null) return { missing: true };
+    if (!path.length) return { value: raw };
     let v;
-    try { v = JSON.parse(raw); } catch { return { host, notjson: true }; }
+    try { v = JSON.parse(raw); } catch { return { notjson: true }; }
     for (const seg of path) {
-      if (v == null || typeof v !== "object") return { host, nopath: true };
+      if (v == null || typeof v !== "object") return { nopath: true };
       v = v[seg];
     }
-    if (v === undefined) return { host, nopath: true };
-    return { host, value: typeof v === "string" ? v : JSON.stringify(v) };
-  }, { key: ${JSON.stringify(key)}, path: ${JSON.stringify(path)} });
-  const host = out.host;
-  const allowed = ${JSON.stringify(patterns)};
-  if (!allowed.some(p => new RegExp(p, "i").test(host)))
-    throw new Error("read-storage refused: the page host " + JSON.stringify(host) + " is not allowed by --allow-domain");
+    if (v === undefined) return { nopath: true };
+    return { value: typeof v === "string" ? v : JSON.stringify(v) };
+  }, { key: ${JSON.stringify(key)}, path: ${JSON.stringify(path)}, allowed });
+  if (out.moved) throw new Error("read-storage refused: the foreground tab is not on an --allow-domain host (it navigated away)");
   if (out.missing) throw new Error("read-storage: no ${store} key " + JSON.stringify(${JSON.stringify(key)}) + " on " + host);
   if (out.notjson) throw new Error("read-storage: the value is not JSON, so the path can't apply");
   if (out.nopath) throw new Error("read-storage: the json-path is not present in the value");
@@ -529,27 +810,41 @@ function buildReadStorageCode(area, key, path, allowDomains) {
 }`;
 }
 async function readStorageOnSession(opts) {
-  const { isError, text } = await runCodeOnSession({ ...opts, code: buildReadStorageCode(opts.area, opts.key, opts.path, opts.allowDomains), json: true });
-  if (isError)
-    throw new Error(text.match(/read-storage(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
-`)[0] : "read-storage: could not read the value"));
-  let raw;
-  try {
-    raw = JSON.parse(text).result;
-  } catch {
-    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  if (opts.gotoUrl) {
+    await runCliOnSession(opts, ["goto", opts.gotoUrl]).catch(() => {});
+    await new Promise((r) => setTimeout(r, 2500));
   }
-  let o = raw;
-  for (let i = 0;i < 2 && typeof o === "string"; i++) {
-    try {
-      o = JSON.parse(o);
-    } catch {
-      o = undefined;
+  let last = "";
+  for (let attempt = 0;attempt < 3; attempt++) {
+    const { isError, text } = await runCodeOnSession({ socketRoot: opts.socketRoot, session: opts.session, cwd: opts.cwd, code: buildReadStorageCode(opts.area, opts.key, opts.path, opts.allowDomains), json: true });
+    if (!isError) {
+      let raw;
+      try {
+        raw = JSON.parse(text).result;
+      } catch {
+        raw = text.match(/### Result\n([^\n]*)/)?.[1];
+      }
+      let o = raw;
+      for (let i = 0;i < 2 && typeof o === "string"; i++) {
+        try {
+          o = JSON.parse(o);
+        } catch {
+          o = undefined;
+        }
+      }
+      if (o && typeof o.host === "string" && typeof o.value === "string")
+        return o;
+      throw new Error("read-storage: the page returned no value");
     }
+    last = text.match(/read-storage(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
+`)[0] : "read-storage: could not read the value");
+    if (!/foreground tab is not on/.test(last))
+      break;
+    await new Promise((r) => setTimeout(r, 1000));
   }
-  if (!o || typeof o.host !== "string" || typeof o.value !== "string")
-    throw new Error("read-storage: the page returned no value");
-  return o;
+  if (/foreground tab is not on/.test(last))
+    last += ". Put the site on the active tab first: rech goto <url on that host>, then rerun read-storage.";
+  throw new Error(last || "read-storage: could not read the value");
 }
 var READ_COOKIE_USAGE = `Usage: rech read-cookie <name> <domain> --allow-domain <domain> | <command>
   Writes the cookie's value, raw and without a newline, to stdout, which must be a pipe into the
@@ -656,6 +951,194 @@ async function readCookieOnSession(opts) {
     throw new Error("read-cookie: the browser returned no value");
   return out;
 }
+var REDACTED_HEADERS = [
+  "set-cookie",
+  "cookie",
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "proxy-authenticate",
+  "x-api-key",
+  "x-csrf-token",
+  "x-xsrf-token"
+];
+var REDACTED_HEADER_PATTERN = "[-_](?:token|secret|api[-_]?key)$";
+var URL_HEADERS = ["location", "content-location"];
+var HEADER_REDACTION = "<redacted>";
+var READ_HEADERS_DEFAULT_SECONDS = 5;
+var READ_HEADERS_MAX_SECONDS = 50;
+var READ_HEADERS_USAGE = `Usage: rech read-headers --allow-domain <host> [--allow-domain <host>]... [--seconds N] [--goto <url>]
+  Captures the status code and response headers (NO bodies) of every request on an --allow-domain
+  host over a capture window, and writes them as a JSON evidence file in the output dir (an array of
+  {url, status, headers}). Credential header values (cookie, set-cookie, authorization,
+  *-authenticate, x-api-key, *-token, *-secret, ...) are redacted, as are URL query values,
+  fragments and userinfo; then the file goes through the secret scanner.
+  --allow-domain GLOB   required: capture only responses whose host matches, e.g. app.example.com
+  --seconds N           capture window in seconds (default ${READ_HEADERS_DEFAULT_SECONDS}, max ${READ_HEADERS_MAX_SECONDS})
+  --goto URL            first navigate the attached tab to URL (host must match --allow-domain),
+                        then capture, so a page load's requests are captured (within the window)`;
+function hostFromUrl(u) {
+  const m = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i.exec(String(u || ""));
+  return m ? m[1].replace(/^[^@]*@/, "").replace(/:\d+$/, "").toLowerCase() : "";
+}
+function redactResponse(e, names, pattern, urlHeaders, mask) {
+  const maskUrl = (u) => {
+    u = u.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@/i, `$1${mask}@`);
+    const hash = u.indexOf("#");
+    const frag = hash >= 0 ? `#${mask}` : "";
+    if (hash >= 0)
+      u = u.slice(0, hash);
+    const q = u.indexOf("?");
+    if (q < 0)
+      return u + frag;
+    const query = u.slice(q + 1).split("&").map((p) => p.includes("=") ? `${p.slice(0, p.indexOf("="))}=${mask}` : p ? mask : p).join("&");
+    return `${u.slice(0, q)}?${query}${frag}`;
+  };
+  const credential = new RegExp(pattern, "i");
+  const raw = e.headers && typeof e.headers === "object" ? e.headers : {};
+  const headers = {};
+  for (const k of Object.keys(raw)) {
+    const n = k.toLowerCase();
+    headers[k] = names.includes(n) || credential.test(n) ? mask : urlHeaders.includes(n) ? maskUrl(String(raw[k])) : String(raw[k]);
+  }
+  const status = Number(e.status);
+  return { url: maskUrl(String(e.url ?? "")), status: Number.isFinite(status) ? status : 0, headers };
+}
+function readHeadersEvidence(captured, mask) {
+  return redact(mask(JSON.stringify(captured.map(redactCaptured), null, 2))).text + `
+`;
+}
+function redactCaptured(e) {
+  return redactResponse(e, REDACTED_HEADERS, REDACTED_HEADER_PATTERN, URL_HEADERS, HEADER_REDACTION);
+}
+function redactHeaders(headers) {
+  return redactCaptured({ headers }).headers;
+}
+function validateSeconds(seconds) {
+  if (!Number.isInteger(seconds) || seconds < 1 || seconds > READ_HEADERS_MAX_SECONDS)
+    throw new Error(`read-headers: --seconds must be an integer between 1 and ${READ_HEADERS_MAX_SECONDS}`);
+  return seconds;
+}
+function parseReadHeadersArgs(args) {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-headers")
+    throw new Error("Expected read-headers");
+  const allowDomains = [];
+  let seconds = READ_HEADERS_DEFAULT_SECONDS;
+  let gotoUrl;
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--allow-domain" || a.startsWith("--allow-domain=")) {
+      const v = a === "--allow-domain" ? rest[++i] : a.slice("--allow-domain=".length);
+      if (!v)
+        throw new Error("--allow-domain got an empty host");
+      for (const d of v.split(",")) {
+        domainGlobToRegExp(d.trim());
+        allowDomains.push(d.trim());
+      }
+    } else if (a === "--seconds" || a.startsWith("--seconds=")) {
+      const v = a === "--seconds" ? rest[++i] : a.slice("--seconds=".length);
+      if (!v)
+        throw new Error("--seconds needs a value");
+      seconds = validateSeconds(Number(v));
+    } else if (a === "--goto" || a.startsWith("--goto=")) {
+      gotoUrl = a === "--goto" ? rest[++i] : a.slice("--goto=".length);
+      if (!gotoUrl)
+        throw new Error("--goto got an empty URL");
+    } else if (a.startsWith("-"))
+      throw new Error(`read-headers: unknown option ${a}`);
+    else
+      throw new Error(`read-headers: unexpected argument ${a}`);
+  }
+  if (!allowDomains.length)
+    throw new Error("read-headers needs --allow-domain: name the host to capture responses from");
+  if (gotoUrl)
+    checkGotoUrl(gotoUrl, allowDomains);
+  return { allowDomains, seconds, gotoUrl };
+}
+function readHeadersWireArgs(req) {
+  return ["read-headers", ...req.allowDomains.map((d) => `--allow-domain=${d}`), `--seconds=${req.seconds}`, ...req.gotoUrl ? [`--goto=${req.gotoUrl}`] : []];
+}
+function parseReadHeadersWire(args) {
+  const [cmd, ...rest] = args;
+  if (cmd !== "read-headers")
+    throw new Error("read-headers expected");
+  const allowDomains = [];
+  let seconds = READ_HEADERS_DEFAULT_SECONDS;
+  let gotoUrl;
+  for (const a of rest) {
+    if (a.startsWith("--allow-domain=")) {
+      const d = a.slice("--allow-domain=".length);
+      domainGlobToRegExp(d);
+      allowDomains.push(d);
+    } else if (a.startsWith("--seconds=")) {
+      seconds = validateSeconds(Number(a.slice("--seconds=".length)));
+    } else if (a.startsWith("--goto=")) {
+      gotoUrl = a.slice("--goto=".length);
+    } else
+      throw new Error(`read-headers: unexpected argument ${a.startsWith("-") ? a : "(positional)"}`);
+  }
+  if (!allowDomains.length)
+    throw new Error("read-headers needs --allow-domain");
+  if (gotoUrl)
+    checkGotoUrl(gotoUrl, allowDomains);
+  return { allowDomains, seconds, gotoUrl };
+}
+function buildReadHeadersCode(allowDomains, seconds, gotoUrl) {
+  const patterns = allowDomains.map((d) => domainGlobToRegExp(d).source);
+  return `async page => {
+  const allowed = ${JSON.stringify(patterns)};
+  const redact = ${redactResponse.toString()};
+  const hostOf = (u) => { const m = /^[a-z][a-z0-9+.-]*:\\/\\/([^/?#]+)/i.exec(String(u || "")); return m ? m[1].replace(/^[^@]*@/, "").replace(/:\\d+$/, "").toLowerCase() : ""; };
+  const ok = (h) => h && allowed.some(p => new RegExp(p, "i").test(h));
+  const captured = [];
+  const onResponse = async (response) => {
+    try {
+      const url = String(response.url());
+      const host = hostOf(url);
+      if (!ok(host)) return;
+      let headers = {};
+      try { headers = await response.allHeaders(); } catch { try { headers = response.headers(); } catch { headers = {}; } }
+      captured.push(redact({ url, status: response.status(), headers }, ${JSON.stringify(REDACTED_HEADERS)}, ${JSON.stringify(REDACTED_HEADER_PATTERN)}, ${JSON.stringify(URL_HEADERS)}, ${JSON.stringify(HEADER_REDACTION)}));
+    } catch {}
+  };
+  page.on("response", onResponse);
+  // The window includes the --goto: the whole capture fits in the one request.
+  const endAt = Date.now() + ${seconds} * 1000;
+  try {
+    ${gotoUrl ? `try { await page.goto(${JSON.stringify(gotoUrl)}, { waitUntil: "load", timeout: ${seconds * 1000} }); } catch {}` : ""}
+    await page.waitForTimeout(Math.max(0, endAt - Date.now()));
+  } finally {
+    try { page.off("response", onResponse); } catch {}
+  }
+  return JSON.stringify({ host: ${JSON.stringify(allowDomains[0] ?? "")}, count: captured.length, captured });
+}`;
+}
+async function readHeadersOnSession(opts) {
+  const timeoutMs = opts.seconds * 1000 + 15000;
+  const { isError, text } = await runCodeOnSession({ socketRoot: opts.socketRoot, session: opts.session, cwd: opts.cwd, code: buildReadHeadersCode(opts.allowDomains, opts.seconds, opts.gotoUrl), json: true, timeoutMs });
+  if (isError)
+    throw new Error(text.match(/read-headers(?: refused)?: [^\n]*/)?.[0] ?? (/no browser is open|could not reach/.test(text) ? text.trim().split(`
+`)[0] : "read-headers: could not capture responses"));
+  let raw;
+  try {
+    raw = JSON.parse(text).result;
+  } catch {
+    raw = text.match(/### Result\n([^\n]*)/)?.[1];
+  }
+  let out = raw;
+  for (let i = 0;i < 2 && typeof out === "string"; i++) {
+    try {
+      out = JSON.parse(out);
+    } catch {
+      out = undefined;
+    }
+  }
+  if (!out || !Array.isArray(out.captured))
+    throw new Error("read-headers: the browser returned no capture");
+  const captured = out.captured.map((e) => redactCaptured(e && typeof e === "object" ? e : {}));
+  return { host: typeof out.host === "string" ? out.host : opts.allowDomains[0] ?? "", captured };
+}
 var PASSWORD_FIELDS = 'input[type=password], input[autocomplete~="current-password" i], input[autocomplete~="new-password" i], input[name*="pass" i], input[id*="pass" i]';
 var PASSWORD_VALUES_CODE = `async page => {
   const values = [];
@@ -704,24 +1187,34 @@ function maskPasswordLines(text) {
 }
 export {
   FILL_SECRET_USAGE,
+  HEADER_REDACTION,
   MIN_MASK_LENGTH,
   READ_COOKIE_USAGE,
+  READ_HEADERS_DEFAULT_SECONDS,
+  READ_HEADERS_MAX_SECONDS,
+  READ_HEADERS_USAGE,
   READ_SECRET_USAGE,
   READ_STORAGE_USAGE,
+  REDACTED_HEADERS,
+  REDACTED_HEADER_PATTERN,
   SECRET_MASK,
   SECRET_MASK_TTL_MS,
   SecretMasker,
+  URL_HEADERS,
   base32Decode,
   buildFillCode,
   buildReadCode,
   buildReadCookieCode,
+  buildReadHeadersCode,
   buildReadStorageCode,
+  checkGotoUrl,
   daemonSessionSockets,
   domainGlobToRegExp,
   fillSecretOnSession,
   fillSecretWireArgs,
   hasSnapshot,
   hostAllowed,
+  hostFromUrl,
   maskPasswordLines,
   maskable,
   parseDotenv,
@@ -729,6 +1222,8 @@ export {
   parseFillSecretWire,
   parseReadCookieArgs,
   parseReadCookieWire,
+  parseReadHeadersArgs,
+  parseReadHeadersWire,
   parseReadSecretArgs,
   parseReadSecretWire,
   parseReadStorageArgs,
@@ -738,11 +1233,18 @@ export {
   passwordValuesOnSession,
   readCookieOnSession,
   readCookieWireArgs,
+  readHeadersEvidence,
+  readHeadersOnSession,
+  readHeadersWireArgs,
   readSecretOnSession,
   readSecretSource,
   readSecretWireArgs,
   readStorageOnSession,
   readStorageWireArgs,
+  redactCaptured,
+  redactHeaders,
+  redactResponse,
+  runCliOnSession,
   runCodeOnSession,
   sessionSocketCandidates,
   socketRequest,