商业产业 Hacker News AI 2026-10-10T08:15 正文 ok 941 words

Show HN：Chrome Relay——让编码 Agent 在你的真实 Chrome 中使用后台标签页

英文标题：🔶 Show HN: Chrome Relay – background tabs in your real Chrome for coding agents

Chrome Relay 是一款面向 Claude Code、Codex、Cursor 和 Paseo 等编码 Agent 的 macOS 工具，可让它们通过命令行操作用户日常使用的 Google Chrome，并复用真实登录状态。它通过 Chrome 扩展、localhost Relay 服务和 CLI 协同工作，在不抢占前台焦点的隐藏后台标签页中执行操作，单条命令延迟约 0.15 秒。项目采用多重本地访问控制，包括本机密钥、Agent 应用进程识别、Chrome 扩展 Origin 校验及完整审计日志，以限制其他本地工具和网页接入。对开发者而言，这提供了一种无需向 Agent 暴露密码、又能自动完成已登录网站流程的浏览器自动化方案，但不构成对本机恶意软件的安全边界。

打开原文相关 6 · 机会 1

1.2 KB

25.0 KB

638 B

986 B

1.0 KB

588 B

553 B

119.9 KB

中文

网站： https://agent-chrome-relay.aindeev.com

让你的编码 Agent（Claude Code、Codex、Cursor、Paseo）通过命令行使用你日常使用的 Chrome及其真实登录状态，并在后台标签页中工作：不会抢占焦点、没有弹窗，每条命令约需 0.15 秒。

agent-browser --cdp "$(chrome-relay url you@company.com)" open https://app.example.com/
agent-browser snapshot -i          # the page's buttons, links and fields, each with a ref like @e5
agent-browser click @e5
agent-browser close

这是选择性启用的：不会有人替你安装扩展，而且它只会在由设备所有者自行配置的 Mac 上运行。

agent-browser (CLI) ──ws──▶ relay (127.0.0.1:9333, LaunchAgent) ──ws──▶ Chrome Relay extension ──chrome.debugger──▶ agent tab

扩展（extension/、MV3；每个加载该扩展的 Chrome 配置文件各一个）：在折叠的“Agents”标签页组中，以非活动状态打开每个 Agent 标签页，并通过 chrome.debugger 在其中执行 DevTools 命令。它不使用远程调试端口，因此 Chrome 不会显示“Allow remote debugging?”。但在 Agent 工作期间，Chrome 会显示“Chrome Relay started debugging this browser”。
Relay（relay/relay.mjs）：为每个 Agent 提供一个 DevTools 端点。每个 Agent 只能看到和控制自己打开的标签页；任何可能使浏览器置前或获得焦点的命令都会被拦截。
CLI（bin/chrome-relay）：用于设置、获取连接 URL、诊断和审计追踪。

设置（每台 Mac 一次，约 2 分钟）

最快的方法：将此提示词粘贴到 Claude Code、Codex 或 Cursor 中，让你的 Agent 完成设置。手动操作如下：

需要 macOS、Google Chrome、Node.js 20+ 以及 agent-browser（npm i -g agent-browser）。

git clone https://github.com/aindeev/agent-chrome-relay
cd agent-chrome-relay
bin/chrome-relay setup     # secret, background service, identities, `chrome-relay` on PATH, Claude Code skill

然后，对于 Agent 应使用的每个 Chrome 配置文件：打开 chrome://extensions，启用 Developer mode，选择 Load unpacked，然后选取克隆目录中的 extension 文件夹。使用 chrome-relay doctor 检查配置。

执行 git pull 后，运行 chrome-relay update（重启 Relay，并在每个配置文件中重新加载扩展）。如需移除，运行 chrome-relay uninstall，然后在每个配置文件中删除该扩展。

Claude Code：setup 会将 skill（skill/SKILL.md）链接到 ~/.claude/skills/chrome-relay，因此每个仓库都可使用它。对于 Codex、Cursor 和其他工具，将其指向同一文件即可，例如在全局 ~/.codex/AGENTS.md 中加入一行：“For any browser step that needs my logins, follow <path>/agent-chrome-relay/skill/SKILL.md.” 仓库内的 CLAUDE.md/AGENTS.md 只需添加一行指向该 skill 的说明。

每次 Agent 连接均会经过两项检查：

此 Mac 的密钥：在设置时生成于 ~/.chrome-relay/token（权限模式为 600），并嵌入在 chrome-relay url 输出的 URL 中。
获准的 Agent 应用：连接进程必须来自 Claude Code、Codex、Cursor 或 Paseo。Relay 会查找该进程（lsof、ps），检查这些应用在其子进程中设置的标识（CLAUDECODE、CODEX_*、CURSOR_*、PASEO_AGENT_ID），然后继续检查其父进程。

携带浏览器 Origin 标头的连接（即来自网页的连接）即使拥有密钥也会被拒绝。只有此检出目录中的扩展可以作为扩展连接：Chrome 会根据未打包扩展的文件夹推导其 ID，setup 会将该 ID 记录在 ~/.chrome-relay/config.json 中，Relay 会检查连接的 Origin: chrome-extension://<id>（网页无法伪造），且连接进程必须是 Chrome。

这可以将其他本地工具、网页和意外操作排除在外。但它并非针对已以你的身份在系统中运行的恶意软件的安全边界；此类软件可能读取密钥并伪造标识。

Agent 永远不会输入凭据。当网站经由 Google 跳转，且正确的账户已经登录时，扩展会自行点击账户及 Continue/Allow（通过页面脚本执行，因此即使页面上存在 1Password 的框架也能工作）。如果遇到密码、通行密钥、两步验证页面，或账户未登录，跳转将停止，Agent 会收到 SIGN-IN NEEDED: ...，并请求你在自己的窗口中完成登录。

网站使用哪个 Google 账户由 ~/.chrome-relay/identities.json（通过 chrome-relay identities 管理）决定：其中包括你的 Chrome 配置文件（由设置过程填充）、可手动设置的 sites.rules，以及每次成功跳转后由 Relay 填充的 sites.learned。默认使用该配置文件自身的账户。

每一项 Agent 操作都会记录在 ~/.chrome-relay/audit/YYYY-MM-DD.jsonl；可使用 chrome-relay audit 读取：记录内容包括谁进行了连接（应用、Claude/Paseo 会话 ID、工作目录、AGENT_BROWSER_SESSION）、页面、带坐标的点击、特殊按键、Agent 自身脚本、截图、上传、弹窗、登录点击及被拦截的页面。输入的文本仅以字符数形式存储，URL 会移除查询字符串。

弹窗和 target=_blank 链接会作为归属同一 Agent 的新隐藏标签页打开；通过 postMessage 向打开者回传信息并自行关闭的弹窗登录流程仍可正常工作。消息 Origin 以 Relay 观察到每个标签页加载的 Origin 为准（绝不采用页面自行声明的 Origin），并会强制执行 targetOrigin。一项安全兜底机制会接管 Agent 页面仍然打开的任何标签页，并将焦点交还给你此前使用的标签页。
1Password：当页面包含另一扩展的框架（登录表单上的 1Password 菜单）时，Chrome 会使扩展的 debugger 与页面断开。Agent 的命令会等待扩展重新附加。
自动清理：沉默 30 分钟的 Agent 标签页会被关闭。Relay 重启时，扩展会关闭其打开的 Agent 标签页（按标签页 ID 跟踪，因此绝不会触及你自己的标签页组）。
后台标签页中的真实输入：每个 Agent 标签页均启用了焦点模拟，因此点击和输入都会正确生效。

cd relay && npm install && npm test # who may connect: secret, allowed apps, Chrome-only extension, audit

日志：chrome-relay logs（~/.chrome-relay/relay.log）。测试扩展变更时：编辑 extension/，然后运行 chrome-relay update。CHROME_RELAY_HOME 和 CHROME_RELAY_PORT 可覆盖数据文件夹和端口设置。

由 Alexey Indeev 制作，他是 Spare 的联合创始人兼 CTO。我在 The Leveraged Mind 撰写有关如何借助 AI 实现更多能力的内容，无论你是否编程。

如有问题、想法或 Bug，请提交 issue，或通过 X 联系。

MIT。参见 LICENSE。

English / 原文

Website: https://agent-chrome-relay.aindeev.com

Lets your coding agents (Claude Code, Codex, Cursor, Paseo) use your everyday Chrome , with your real logins, from the command line, in background tabs : nothing takes focus, no dialogs, ~0.15s per command.

agent-browser --cdp "$(chrome-relay url you@company.com)" open https://app.example.com/
agent-browser snapshot -i          # the page's buttons, links and fields, each with a ref like @e5
agent-browser click @e5
agent-browser close

It's opt-in: nothing installs the extension for you, and it only runs on Macs whose owner set it up.

agent-browser (CLI) ──ws──▶ relay (127.0.0.1:9333, LaunchAgent) ──ws──▶ Chrome Relay extension ──chrome.debugger──▶ agent tab

Extension (extension/, MV3, one per Chrome profile you load it in): opens each agent tab inactive in a collapsed "Agents" tab group and runs DevTools commands in it via chrome.debugger. No remote-debugging port, so Chrome never shows "Allow remote debugging?". Chrome does show "Chrome Relay started debugging this browser" while agents work.
Relay (relay/relay.mjs): a DevTools endpoint per agent. Each agent sees and controls only the tabs it opened; commands that could raise or focus the browser are swallowed.
CLI (bin/chrome-relay): setup, the connection URL, diagnostics, audit trail.

Setup (once per Mac, ~2 minutes)

Fastest: paste this prompt into Claude Code, Codex or Cursor and let your agent do it. By hand:

Needs macOS, Google Chrome, Node.js 20+ and agent-browser (npm i -g agent-browser).

git clone https://github.com/aindeev/agent-chrome-relay
cd agent-chrome-relay
bin/chrome-relay setup     # secret, background service, identities, `chrome-relay` on PATH, Claude Code skill

Then, in each Chrome profile agents should use : open chrome://extensions, turn on Developer mode , Load unpacked , and pick the extension folder of your clone. Check with chrome-relay doctor.

After git pull: chrome-relay update (restarts the relay, reloads the extension in every profile). To remove: chrome-relay uninstall, then remove the extension in each profile.

Claude Code: setup links the skill (skill/SKILL.md) into ~/.claude/skills/chrome-relay, so every repo gets it. Codex, Cursor and others: point them at the same file, e.g. a line in your global ~/.codex/AGENTS.md: "For any browser step that needs my logins, follow<path>/agent-chrome-relay/skill/SKILL.md." A repo's CLAUDE.md/AGENTS.md only needs a one-line pointer to the skill.

Two checks on every agent connection:

This Mac's secret : generated at setup in ~/.chrome-relay/token (mode 600) and embedded in the URL that chrome-relay url prints.
An allowed agent app : the connecting process must come from Claude Code, Codex, Cursor or Paseo. The relay looks the process up (lsof, ps) and checks the markers those apps set in their child processes (CLAUDECODE, CODEX_*, CURSOR_*, PASEO_AGENT_ID), then its parent processes.

Connections that carry a browser Origin header (a web page) are refused even with the secret. Only this checkout's extension may connect as the extension: Chrome derives an unpacked extension's ID from its folder, setup records that ID in ~/.chrome-relay/config.json, the relay checks the connection's Origin: chrome-extension://<id> (which pages cannot fake), and the connecting process must be Chrome.

This keeps other local tools, web pages and accidents out. It is not a boundary against malware already running as you, which could read the secret and fake the markers.

Agents never type credentials. When a site bounces through Google and the right account is already signed in , the extension clicks the account and Continue/Allow itself (page scripting, so it works even with 1Password's frame on the page). A password, passkey, 2-step screen or signed-out account stops the hop, and the agent gets SIGN-IN NEEDED: ... and asks you to sign in in your own window.

Which Google account a site uses comes from ~/.chrome-relay/identities.json (chrome-relay identities): your Chrome profiles (filled in by setup), optional hand-set sites.rules, and sites.learned, which the relay fills in after each successful hop. Default: the profile's own account.

Every agent action is recorded in ~/.chrome-relay/audit/YYYY-MM-DD.jsonl; read it with chrome-relay audit: who connected (app, Claude/Paseo session id, working folder, AGENT_BROWSER_SESSION), pages, clicks with positions, special keys, the agent's own scripts, screenshots, uploads, popups, sign-in clicks and blocked pages. Typed text is stored only as a character count, and URLs lose their query string.

Popups andtarget=_blank links open as new hidden tabs owned by the same agent; popup sign-in flows that postMessage back to the opener and close themselves keep working. Message origins are the ones the relay saw each tab load (never what the page claims), and targetOrigin is enforced. A safety net adopts any tab an agent page opens anyway and hands focus back to the tab you were on.
1Password : Chrome drops an extension's debugger from a page that contains another extension's frame (1Password's menu on login forms). The agent's commands wait while the extension re-attaches.
Self-cleaning : tabs of an agent silent for 30 minutes are closed. When the relay restarts, the extension closes the agent tabs it opened (tracked by tab id, so your own tab groups are never touched).
Real input in background tabs : focus emulation is on in every agent tab, so clicks and typing land.

cd relay && npm install && npm test # who may connect: secret, allowed apps, Chrome-only extension, audit

Logs: chrome-relay logs (~/.chrome-relay/relay.log). Testing extension changes: edit extension/, then chrome-relay update. CHROME_RELAY_HOME and CHROME_RELAY_PORT override the data folder and port.

Made by Alexey Indeev , co-founder and CTO of Spare. I write about building more with AI, whether you code or not, at The Leveraged Mind.

Questions, ideas or bugs: open an issue or reach out on X.

MIT. See LICENSE.