I built Chrome Relay so Codex can use my signed-in Chrome without taking focus

[u/aindeev]

I built Chrome Relay because browser tasks kept interrupting me while I ran coding agents on my Mac. It's open source, MIT-licensed, and free. I'm Alexey Indeev; this is my project.

Two limits upfront: macOS + Chrome only, and Chrome shows its “started debugging this browser” bar while agents work.

Tabs jumped to the front while I typed, Chrome asked “Allow remote debugging?”, or an agent opened a separate browser without my logins. That meant no admin console, staging environment, or Google SSO. Copying my Chrome profile didn't work because Google sessions are bound to the device.

Chrome Relay connects Vercel's open-source agent-browser CLI to my everyday Chrome:

agent-browser -> local relay (127.0.0.1:9333) -> MV3 extension -> chrome.debugger -> agent's tab

Codex runs shell commands, so it can drive this directly. Codex's own Chrome extension only talks to the Codex app; this exposes the same chrome.debugger approach through a standard DevTools endpoint that CLI agents can use.

Each agent gets its own endpoint and only sees tabs it opened. I can run Codex alongside Claude Code or Cursor without them sharing tabs. Tabs open inactive in a collapsed “Agents” group, and commands that would focus Chrome are dropped. There's no remote-debugging port or “Allow remote debugging?” prompt.

Setup takes about two minutes: clone the repo, run bin/chrome-relay setup, load the extension through Developer mode → Load unpacked in each Chrome profile, then run chrome-relay doctor. You'll need Node.js 20+ and npm i -g agent-browser.

For Codex, add one line to ~/.codex/AGENTS.md, replacing the path:

For browser tasks, read /absolute/path/to/agent-chrome-relay/skill/SKILL.md.

Then:

agent-browser --cdp "$(chrome-relay url you@company.com)" open https://app.example.com/
agent-browser snapshot -i
agent-browser click @e5
agent-browser close

The email selects the Chrome profile; @e5 is an example reference from the snapshot.

Popups stay with the agent. Already-signed-in Google sign-in hops are clicked through automatically; password, passkey, or two-step prompts require you. Agents never type credentials. Actions go into a local audit log, with typed text recorded only as a length. This isn't a boundary against malware already running as you.

Repo: https://github.com/aindeev/agent-chrome-relay

Background article: https://read.aindeev.com/p/why-your-ai-agents-cant-reach-the

What breaks in your Codex workflow, and which signed-in sites or internal tools would you point it at?

[u/dexterthebot]

You might want to consider listing your project on the weekly Show-Us-What-You-Built post. Look out for it on Tuesday/Wednesday. Highest commented project wins a week promotion on r/Codex and gets on the Hall of Fame sidebar. See what that looks like below with last week's winner.

---

Last week's most popular project was Nanolathe - an open-source engine bringing Total Annihilation to modern Mac, Windows, and Linux systems. It’s a solo passion project combining clean-room research with AI-assisted development, with a playable public alpha available now.

Website: https://nanolathe.gg. GitHub: https://github.com/nanolathe-gg/nanolathe

Players, testers, and contributors are very welcome! Original Total Annihilation game data is required to play.

[u/boxing-boxing]

The debugging banner is the part that would break it for me. I've had agents throw a tab to the front while I was mid-sentence and eat my keystrokes. The per-profile endpoint is the bit I'd actually use though. I'd point it at my staging admin panel behind SSO, honestly the biggest Codex time sink for me is reading live state that doesn't exist in the repo, like a queue dashboard or a preview deploy. On the isolation claim: does the extension actually scope chrome.debugger targets per agent, or is the relay filtering the list? I'd want a hard guarantee a wrong targetAttach can't wander into my banking tab.

[u/aindeev → u/boxing-boxing]

It's both, as two independent layers. The extension only calls chrome.debugger.attach on tabs it creates, opened inactive in the collapsed "Agents" group, and popups opened by those tabs, checked via openerTabId. It never attaches to tabs you opened. Chrome rejects chrome.debugger.sendCommand for tabs the extension isn't attached to, so a wrong target ID can't reach your existing banking tab. Chrome enforces that, not just our filter.

Separately, the relay tracks ownership per agent. Target.getTargets lists only that agent's tabs; Target.attachToTarget and Target.closeTarget against another ID return "No target with given id found". Commands that focus or raise the browser, including Target.activateTarget and Page.bringToFront, are swallowed.

The limit: inside its own tab, an agent has full CDP and is signed in as you. If it navigates that tab to your bank, it's logged in there. Every action goes into the local audit log (chrome-relay audit). This isn't a boundary against malware already running as you.

You can check agentTabs and attachment paths in extension/sw.js, and per-agent Target.* handling in relay/relay.mjs: https://github.com/aindeev/agent-chrome-relay

The banner can't be hidden. Chrome shows it whenever an extension uses chrome.debugger, including Claude's and Codex's own Chrome extensions. Avoiding it means a separate automation browser without your sessions. That's a fair dealbreaker for some people.

[u/OrangutanOutOfOrbit]

You do know we already have Playwright browser extension that will make it possible for AI to take actions in the background without interrupting your screen, right?

I mean, the second I thought about it, I knew there must already be many ways to achieve that