diff --git a/cli/src/connect.rs b/cli/src/connect.rs index 11c59fb..b0c11c2 100644 --- a/cli/src/connect.rs +++ b/cli/src/connect.rs @@ -24,14 +24,17 @@ pub const HOST_NAME: &str = "com.agent_browser.connect"; /// that extension talk to this host, and the force-install policy references it. pub const EXTENSION_ID: &str = "ciiljdlhdpfckdcfkphgmfalanpdejep"; -/// Omaha/gupdate update manifest for the signed `ab-connect.crx`. The macOS -/// configuration profile force-installs the extension from here, so no -/// `chrome://extensions` "Load unpacked" GUI step is ever needed. Chrome 142+ -/// removed `--load-extension`, and macOS has blocked local-`.crx` external -/// installs since Chrome 44 — a policy `update_url` is the only GUI-free path -/// left into the real, logged-in profile. -pub const UPDATE_URL: &str = - "https://raw.githubusercontent.com/leeguooooo/agent-browser-stealth/main/extensions/updates.xml"; +/// Update URL the force-install policy points at. MUST be the Chrome Web Store +/// endpoint: Chrome 149 tags any **off-Web-Store** force-installed extension +/// `[BLOCKED]` on an unmanaged browser (verified on macOS — chrome://policy shows +/// `[BLOCKED]…` / "Error, Warning"). Self-hosting a `.crx` therefore does NOT +/// work on consumer Chrome; the extension must be published to the Web Store, and +/// then this policy force-installs it silently (Web Store extensions are allowed). +pub const UPDATE_URL: &str = "https://clients2.google.com/service/update2/crx"; + +/// Public Web Store listing — the guaranteed one-click "Add to Chrome" path, +/// and the fallback when the force-install profile can't be approved headlessly. +pub const STORE_URL: &str = "https://chromewebstore.google.com/detail/ciiljdlhdpfckdcfkphgmfalanpdejep"; /// Stable identifiers for the generated Chrome configuration profile, so a /// re-install replaces (rather than duplicates) it in System Settings. @@ -94,11 +97,14 @@ pub fn run_connect(args: &[String], json: bool) { println!("\n✓ Chrome force-install profile written:\n {}", path.display()); if cfg!(target_os = "macos") { println!( - "\nOne-time step (no file dialog, ever): approve the profile, then restart Chrome.\n\ - System Settings → General → Device Management (or Privacy & Security →\n\ - Profiles) → double-click \"agent-browser connect\" → Install.\n\ - After approval Chrome force-installs the extension on next launch and\n\ - keeps it up to date — no token, no per-use confirmation." + "\nGet the extension into Chrome (one-time). Either:\n\ + A) One click: open {STORE_URL}\n and press \"Add to Chrome\".\n\ + B) Silent: approve the profile, then restart Chrome —\n \ + System Settings → General → Device Management → double-click\n \ + \"agent-browser connect\" → Install. Chrome then force-installs +\n \ + auto-updates it (no token, no per-use confirmation).\n\ + Both need the extension published to the Web Store; until then use\n \ + chrome://extensions → Developer mode → Load unpacked → extensions/ab-connect." ); } } diff --git a/extensions/ab-connect.zip b/extensions/ab-connect.zip new file mode 100644 index 0000000..3d0618b Binary files /dev/null and b/extensions/ab-connect.zip differ diff --git a/extensions/store/SUBMISSION.html b/extensions/store/SUBMISSION.html new file mode 100644 index 0000000..71b28d7 --- /dev/null +++ b/extensions/store/SUBMISSION.html @@ -0,0 +1,133 @@ + + + + + +Chrome Web Store 提交指南 — agent-browser connect + + + +
+

Chrome Web Store 提交指南

+
agent-browser connect · 上传包 extensions/ab-connect.zip · id 锁定为 ciiljdlhdpfckdcfkphgmfalanpdejep
+
+ +

为什么必须走商店:实测 Chrome 149 在非企业托管的 Mac 上,会把"非 Web Store"的 force-install 扩展直接标成 [BLOCKED]。商店扩展不受此限。这也是 codex / claude 扩展都发商店的原因。

+ +
+ 评审风险(务必知道): 本扩展用了 debugger 权限,这是 Chrome Web Store 审核最严的权限之一。理由必须写清楚"只在用户本机、用户主动发指令时驱动用户自己的标签页,无远程服务器"。类似工具(如 claude-in-chrome)能过审,但可能被多问一轮、审核时间偏长(几天到一两周)。 +
+ +

一、前置(你来做,一次性)

+
    +
  1. 用一个 Google 账号登录 https://chrome.google.com/webstore/devconsole
    2. +
  2. 首次需付 $5 一次性开发者注册费
    3. +
  3. (隐私政策需要一个公开 URL,见第四节 —— 我可以帮你开 GitHub Pages 托管 privacy.html)
    4. +
+ +

二、上传

+
    +
  1. devconsole → New item → 上传 extensions/ab-connect.zip
    2. +
  2. 上传后确认分配到的 Item ID = ciiljdlhdpfckdcfkphgmfalanpdejep(因为 manifest 里保留了 key,id 会被锁成这个,native messaging 的 allowed_origins 才对得上)。若 id 不是这个,告诉我,我重签。
    3. +
+ +

三、商店信息(直接复制以下文案)

+ +

名称 / Name

+
agent-browser connect
+ +

简介 / Summary（≤132 字符）

+
Let your own agent-browser CLI drive your logged-in Chrome — a local automation bridge. No remote server, no token.
+ +

详细描述 / Description

+
agent-browser connect is the in-browser half of the open-source agent-browser CLI. It lets the
+command-line tool you installed on this same computer automate the Chrome you're already logged
+into — opening pages, clicking, filling forms, reading the DOM — driven entirely by you.
+
+How it works
+- The extension talks ONLY to the local agent-browser CLI over Chrome native messaging (a local
+  inter-process channel — no network socket, no token, no remote server).
+- When you run an automation command, the extension relays Chrome DevTools Protocol operations to
+  the tab you target, then returns the result to the CLI.
+
+Privacy
+- No analytics, no trackers, no data collection.
+- Nothing is sent to any remote server. The only message peer is the local CLI.
+- Source is open (Apache-2.0): https://github.com/leeguooooo/agent-browser-stealth
+
+You need the agent-browser CLI installed and paired (run: agent-browser extension install) for this
+extension to do anything.
+ +

类别 / Category

+
Developer Tools
+ +

语言 / Language

+
English
+ +

四、隐私实践（Privacy practices 标签页 —— 必填）

+ +

Single purpose（单一用途）

+
Bridge the user's locally-installed agent-browser CLI to their own logged-in Chrome so the CLI can
+automate pages the user is working with, entirely on the user's machine and at the user's command.
+ +

各权限理由 / Permission justifications

+ + + + + + + + + +
权限理由（复制到对应输入框）
debuggerAttaches the Chrome DevTools Protocol to the user's own active tab so the paired local agent-browser CLI can automate it (navigate, click, read DOM) only while the user is running a command. Commands arrive solely from the local CLI via native messaging; there is no remote endpoint.
tabsEnumerate and target the correct open tab to attach automation to.
nativeMessagingThe sole communication channel: a local native-messaging connection to the agent-browser CLI installed on the same machine. No network is used.
storagePersist small local pairing/configuration state for the extension.
alarmsKeep the MV3 service worker alive during longer automation sessions.
webNavigationDetect page loads/navigations so automation can wait for the right moment before acting.
host permissions（若被问）The extension declares none; tab access is mediated through the debugger attach the user initiates.
+ +

数据用途勾选 / Data usage

+ + +

五、隐私政策 URL

+

商店要求一个公开可访问的隐私政策地址。文件已写好:extensions/store/privacy.html。两种托管:

+ + +

六、截图 / Screenshots（至少 1 张，1280×800 或 640×400）

+

可以截一张 CLI + Chrome 并排的演示图。需要的话我用 cua-driver 截一张合规尺寸的图给你。

+ +

七、提交后

+
    +
  1. 提交审核 → 等几天。审核通过且状态变 Published 后告诉我。
    2. +
  2. 我会把 extension install 的 force-install update_url 切到商店地址并发布新 fork;之后用户 extension install → 批准一次描述文件 → 静默装好(商店扩展不再 [BLOCKED]);或者用户在商店页一键 Add to Chrome。
    3. +
+ +
+ 今天的临时可用方案: 在你这台 Mac 上 chrome://extensions → 打开开发者模式 → Load unpacked → 选 extensions/ab-connect,30 秒手动装一次,native messaging + extension connect 立即可用。等商店过审再切静默路径。 +
+ + + + diff --git a/extensions/store/privacy.html b/extensions/store/privacy.html new file mode 100644 index 0000000..70f533a --- /dev/null +++ b/extensions/store/privacy.html @@ -0,0 +1,77 @@ + + + + + +Privacy Policy — agent-browser connect + + + +
+

Privacy Policy — agent-browser connect

+
Chrome extension (id ciiljdlhdpfckdcfkphgmfalanpdejep) · Last updated 2026-06-09
+
+ +

Summary: this extension collects no personal data, contains no analytics or +trackers, and sends nothing to any remote server. It is a local bridge that lets the +user's own agent-browser command-line tool, running on the same computer, drive the +user's logged-in Chrome.

+ +

What the extension does

+

agent-browser connect pairs Chrome with the locally-installed agent-browser CLI over +Chrome native messaging (a local inter-process channel; no network socket, no token). When +the user issues an automation command in the CLI, the extension relays Chrome DevTools Protocol +operations to the tab the user targets. Everything happens on the user's machine, initiated by the +user.

+ +

Data collection & use

+ + + + + + + +
CategoryCollected?Detail
Personally identifiable informationNoNever read, stored, or transmitted.
Browsing historyNoNot collected. Page content is acted on transiently only while the user is running an automation command, and is never stored or sent off-device.
Authentication / cookies / credentialsNoNot read or exported by the extension.
Analytics / telemetryNoThe extension contains no analytics, tracking, or crash-reporting code.
Remote transmissionNoThe extension's only message peer is the local agent-browser CLI via native messaging. It makes no outbound network requests of its own.
+ +

Permissions & why they are needed

+ + + + + + + + +
PermissionPurpose
debuggerAttach the Chrome DevTools Protocol to the user's own tab so the local CLI can automate it, only while the user is actively running a command.
tabsEnumerate and target the correct open tab to automate.
nativeMessagingThe local transport to the paired agent-browser CLI — the extension's sole communication channel.
storagePersist small local pairing/state values.
alarmsKeep the MV3 service worker alive during longer automation sessions.
webNavigationDetect page loads so automation can wait for the right moment.
+ +

Data sharing

+

None. No data is sold, shared, or transferred to third parties. There are no third parties — the +extension talks only to a program the user installed on the same computer.

+ +

Contact

+

Source code, issues, and contact: https://github.com/leeguooooo/agent-browser-stealth

+ + + + diff --git a/extensions/updates.xml b/extensions/updates.xml deleted file mode 100644 index fdc8b88..0000000 --- a/extensions/updates.xml +++ /dev/null @@ -1,13 +0,0 @@ - - - - - - - diff --git a/scripts/pack-extension.sh b/scripts/pack-extension.sh index 10b7bed..3c08abc 100755 --- a/scripts/pack-extension.sh +++ b/scripts/pack-extension.sh @@ -1,34 +1,39 @@ #!/bin/sh -# Re-pack and sign extensions/ab-connect into extensions/ab-connect.crx using the -# stable signing key, then print the extension id. Keeps the crx id (and thus the -# native-messaging allowed_origins + force-install policy) constant across versions. +# Build the Chrome Web Store upload package extensions/ab-connect.zip (and a signed +# extensions/ab-connect.crx for reference) from extensions/ab-connect, keeping the +# extension id constant via the stable signing key + manifest "key". # -# The private key lives at .secrets/ab-connect.pem and is git-ignored. To re-pack -# on another machine / in CI, restore it from a secret first (see RELEASING). +# The id MUST stay ciiljdlhdpfckdcfkphgmfalanpdejep so the native-messaging +# allowed_origins and the force-install policy keep matching. The id is pinned by +# the "key" field in manifest.json (kept in the uploaded zip on purpose). +# +# The private key lives at .secrets/ab-connect.pem and is git-ignored. # # After changing the extension: # 1. bump "version" in extensions/ab-connect/manifest.json -# 2. bump in extensions/updates.xml to match -# 3. run this script -# 4. commit extensions/ab-connect.crx + updates.xml + manifest.json +# 2. run this script +# 3. commit extensions/ab-connect.zip (+ .crx) + manifest.json +# 4. upload ab-connect.zip to the Web Store (see extensions/store/SUBMISSION.html) set -e cd "$(dirname "$0")/.." KEY=.secrets/ab-connect.pem EXT=extensions/ab-connect CHROME="${CHROME_BIN:-/Applications/Google Chrome.app/Contents/MacOS/Google Chrome}" -if [ ! -f "$KEY" ]; then - echo "error: $KEY missing. Restore the signing key (CI secret AB_CONNECT_PEM) before packing." >&2 - exit 1 +# Web Store upload package (zip of the unpacked extension, dotfiles excluded). +rm -f extensions/ab-connect.zip +( cd "$EXT" && zip -rq ../ab-connect.zip . -x '.*' ) +[ -f extensions/ab-connect.zip ] || { echo "error: zip failed" >&2; exit 1; } + +# Signed crx (reference / non-store force-install for managed setups). +if [ -f "$KEY" ]; then + rm -f extensions/ab-connect.crx + "$CHROME" --pack-extension="$PWD/$EXT" --pack-extension-key="$PWD/$KEY" >/dev/null 2>&1 || true + ID=$(openssl rsa -in "$KEY" -pubout -outform DER 2>/dev/null \ + | openssl dgst -sha256 -binary | xxd -p -c256 | head -c32 | tr '0-9a-f' 'a-p') + echo "extension id: $ID" +else + echo "note: $KEY missing — built zip only (no crx)." fi - -rm -f extensions/ab-connect.crx -"$CHROME" --pack-extension="$PWD/$EXT" --pack-extension-key="$PWD/$KEY" >/dev/null 2>&1 || true -[ -f extensions/ab-connect.crx ] || { echo "error: pack failed" >&2; exit 1; } - -ID=$(openssl rsa -in "$KEY" -pubout -outform DER 2>/dev/null \ - | openssl dgst -sha256 -binary | xxd -p -c256 | head -c32 | tr '0-9a-f' 'a-p') -echo "packed extensions/ab-connect.crx" -echo "extension id: $ID" +echo "packed extensions/ab-connect.zip" echo "manifest version: $(grep -o '"version"[^,]*' "$EXT/manifest.json" | head -1)" -echo "updates.xml version: $(grep -o "version='[^']*'" extensions/updates.xml | tail -1)"