@surething/cockpit 1.0.233 → 1.0.234

package/chrome-extension/background.js

@@ -1,23 +1,23 @@
 /**
  * Cockpit Bridge - Background Service Worker
  *
- * iframe Cookie 注入：用 declarativeNetRequest 动态规则在网络层注入 Cookie 头
- * 不修改全局 Cookie 存储，只在请求层面补上 Cookie
+ * iframe Cookie injection: use declarativeNetRequest dynamic rules to inject the Cookie header at the network layer
+ * Does not modify the global cookie store; only adds the Cookie at the request level
  */
 
 // =========================================================================
-// iframe Cookie 注入
+// iframe Cookie injection
 //
-// 思路：iframe 跨站请求不带 SameSite=Lax Cookie。
-// 用 chrome.cookies.getAll 读取目标域名的全部 Cookie，
-// 通过 declarativeNetRequest 动态规则在网络层 set Cookie 请求头。
-// 不修改 Cookie 存储，只影响请求头。
+// Idea: cross-site requests from an iframe do not carry SameSite=Lax cookies.
+// Use chrome.cookies.getAll to read all cookies for the target domain,
+// then set the Cookie request header at the network layer via declarativeNetRequest dynamic rules.
+// The cookie store is not modified; only request headers are affected.
 //
-// 动态规则用 requestDomains 限定域名，tabIds 限定 Cockpit 标签页，
-// resourceTypes 覆盖 sub_frame + 子资源（XHR/script/css/image 等）。
+// The dynamic rules use requestDomains to scope the domain, tabIds to scope the Cockpit tab,
+// and resourceTypes to cover sub_frame + sub-resources (XHR/script/css/image, etc.).
 // =========================================================================
 
-// 启动时清理上次残留的 session 规则（插件重载后内存中的 map 丢失，但规则仍生效）
+// On startup, clean up session rules left over from last time (after the extension reloads, the in-memory map is lost but the rules are still in effect)
 chrome.declarativeNetRequest.getSessionRules().then(rules => {
   if (rules.length) {
     const ids = rules.map(r => r.id);
@@ -27,23 +27,23 @@ chrome.declarativeNetRequest.getSessionRules().then(rules => {
 });
 
 // =========================================================================
-// Cockpit iframe 追踪 + Cookie 注入时序保证
+// Cockpit iframe tracking + cookie injection ordering guarantee
 //
-// 双层保证机制：
-//   Layer 1: externally_connectable（BrowserBubble → background 直连）
-//     → await prepareCookies() 返回后才设置 iframe src
-//     → Cookie 规则 100% 在首次请求前就绪
+// Two-layer guarantee mechanism:
+//   Layer 1: externally_connectable (BrowserBubble → background direct connection)
+//     → the iframe src is only set after `await prepareCookies()` returns
+//     → cookie rules are 100% ready before the first request
 //
-//   Layer 2: webNavigation.onBeforeNavigate（兜底 + frame 追踪）
-//     → 记录带 _cockpit=1 的 frame，供 content script check-frame 查询
-//     → 同时触发 injectCookiesForUrl 作为兜底（刷新场景等）
+//   Layer 2: webNavigation.onBeforeNavigate (fallback + frame tracking)
+//     → records frames carrying _cockpit=1, for content script check-frame queries
+//     → also triggers injectCookiesForUrl as a fallback (refresh scenarios, etc.)
 //
-// DNR 静态规则 #3 在网络层剥离 _cockpit=1 参数，服务端永远看不到。
+// DNR static rule #3 strips the _cockpit=1 parameter at the network layer, so the server never sees it.
 // =========================================================================
 const cockpitFrames = new Set(); // "tabId-frameId"
 
 chrome.webNavigation.onBeforeNavigate.addListener((details) => {
-  // 只关注 iframe（frameId > 0）
+  // Only care about iframes (frameId > 0)
   if (details.frameId === 0) return;
 
   const key = `${details.tabId}-${details.frameId}`;
@@ -51,8 +51,8 @@ chrome.webNavigation.onBeforeNavigate.addListener((details) => {
   if (details.url.includes('_cockpit=1')) {
     cockpitFrames.add(key);
 
-    // 兜底注入：仅在 externally_connectable 未预创建规则时才触发
-    // 避免重复调用 injectCookiesForUrl 导致「先删旧规则 → 异步创建新规则」的间隙
+    // Fallback injection: only triggers when externally_connectable has not pre-created the rules
+    // Avoids duplicate injectCookiesForUrl calls causing a gap of "delete old rules first → asynchronously create new rules"
     try {
       const domain = new URL(details.url).hostname;
       const ruleKey = `${domain}:${details.tabId || 'all'}`;
@@ -68,7 +68,7 @@ chrome.webNavigation.onBeforeNavigate.addListener((details) => {
   }
 });
 
-// tab 关闭时清理该 tab 的所有记录
+// When a tab is closed, clean up all records for that tab
 chrome.tabs.onRemoved.addListener((tabId) => {
   for (const key of cockpitFrames) {
     if (key.startsWith(`${tabId}-`)) {
@@ -77,7 +77,7 @@ chrome.tabs.onRemoved.addListener((tabId) => {
   }
 });
 
-// 已注入 Cookie 的域名 → rule ID 列表映射
+// Map of domains that already have injected cookies → list of rule IDs
 let nextRuleId = 1000;
 const domainRuleMap = new Map(); // "domain:tabId" → [ruleId, ruleId]
 
@@ -88,7 +88,7 @@ async function injectCookiesForUrl(url, tabId) {
     const domain = urlObj.hostname;
     const key = `${domain}:${tabId || 'all'}`;
 
-    // 已有规则则先清理
+    // If rules already exist, clean them up first
     if (domainRuleMap.has(key)) {
       const oldIds = domainRuleMap.get(key);
       await chrome.declarativeNetRequest.updateSessionRules({
@@ -96,24 +96,24 @@ async function injectCookiesForUrl(url, tabId) {
       });
     }
 
-    // 读取该域名及所有父域名的 Cookie
-    // 例如 api.github.com 需要收集：
-    //   domain=api.github.com  (精确匹配)
-    //   domain=.github.com     (父域名，通过 getAll({ domain: 'github.com' }) 拿到)
-    //   domain=.com 不需要（公共后缀，也不会有 Cookie）
+    // Read cookies for this domain and all of its parent domains
+    // e.g. api.github.com needs to collect:
+    //   domain=api.github.com  (exact match)
+    //   domain=.github.com     (parent domain, obtained via getAll({ domain: 'github.com' }))
+    //   domain=.com is not needed (public suffix, and it cannot have cookies anyway)
     const domainParts = domain.split('.');
     const domainsToQuery = [];
     for (let i = 0; i < domainParts.length - 1; i++) {
       domainsToQuery.push(domainParts.slice(i).join('.'));
     }
-    // 去重收集所有 Cookie
-    const cookieMap = new Map(); // name+domain+path → cookie（去重）
+    // Collect all cookies with deduplication
+    const cookieMap = new Map(); // name+domain+path → cookie (deduplicated)
     for (const d of domainsToQuery) {
       const result = await chrome.cookies.getAll({ domain: d });
       for (const c of result) {
-        // 验证 Cookie 的 domain 确实能匹配当前域名
-        // .github.com 匹配 api.github.com ✓
-        // .example.com 不匹配 api.github.com ✗
+        // Verify the cookie's domain actually matches the current domain
+        // .github.com matches api.github.com ✓
+        // .example.com does not match api.github.com ✗
         const cookieDomain = c.domain.startsWith('.') ? c.domain.slice(1) : c.domain;
         if (domain === cookieDomain || domain.endsWith('.' + cookieDomain)) {
           cookieMap.set(`${c.name}|${c.domain}|${c.path}`, c);
@@ -126,9 +126,9 @@ async function injectCookiesForUrl(url, tabId) {
       return;
     }
 
-    // 筛选被浏览器拦截的 Cookie（Lax/Strict/未设置）
-    // 浏览器只自动发送 SameSite=None 的，其余需要我们追加
-    // 用 append 不会覆盖浏览器发的 None 版本，同名 Cookie 共存等同于正常顶层访问
+    // Filter for cookies blocked by the browser (Lax/Strict/unset)
+    // The browser only auto-sends SameSite=None cookies; the rest we need to append ourselves
+    // Using append does not override the None versions the browser sends; same-name cookies coexisting is equivalent to a normal top-level visit
     const blockedCookies = cookies.filter(c => c.sameSite !== 'none');
 
     if (!blockedCookies.length) {
@@ -136,9 +136,9 @@ async function injectCookiesForUrl(url, tabId) {
       return;
     }
 
-    // 按 Cookie 的生效域名分组
-    // .google.com 的 Cookie → requestDomains: ['google.com']（覆盖 accounts.google.com 等所有子域名）
-    // console.cloud.google.com 的 Cookie → requestDomains: ['console.cloud.google.com']
+    // Group cookies by their effective domain
+    // Cookies for .google.com → requestDomains: ['google.com'] (covers accounts.google.com and all other subdomains)
+    // Cookies for console.cloud.google.com → requestDomains: ['console.cloud.google.com']
     const domainGroups = new Map(); // effectiveDomain → [cookie, ...]
     for (const c of blockedCookies) {
       const effectiveDomain = c.domain.startsWith('.') ? c.domain.slice(1) : c.domain;
@@ -166,14 +166,14 @@ async function injectCookiesForUrl(url, tabId) {
         ],
       };
 
-      // 规则 A: sub_frame（iframe 文档加载）
+      // Rule A: sub_frame (iframe document load)
       const ruleIdA = nextRuleId++;
       const conditionA = {
         requestDomains: [effectiveDomain],
         resourceTypes: ['sub_frame'],
       };
 
-      // 规则 B: 子资源（XHR/script/css 等，仅 iframe 内发起）
+      // Rule B: sub-resources (XHR/script/css etc., only those initiated inside the iframe)
       const ruleIdB = nextRuleId++;
       const conditionB = {
         requestDomains: [effectiveDomain],
@@ -212,7 +212,7 @@ async function injectCookiesForUrl(url, tabId) {
   }
 }
 
-// 监听消息
+// Listen for messages
 chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
   if (message.type === 'cockpit:reload') {
     chrome.runtime.reload();
@@ -225,7 +225,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     return true;
   }
 
-  // content script 查询当前 frame 是否为 Cockpit iframe（处理重定向场景）
+  // content script asks whether the current frame is a Cockpit iframe (handles redirect scenarios)
   if (message.type === 'cockpit:check-frame') {
     const key = `${sender.tab?.id}-${sender.frameId}`;
     const isCockpit = cockpitFrames.has(key);
@@ -234,8 +234,8 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     return;
   }
 
-  // evaluate：在 main world 执行 JS（绕过页面 CSP 限制）
-  // allFrames: true → 在所有 frame 中执行（解决跨域 iframe 访问问题）
+  // evaluate: run JS in the main world (bypasses the page's CSP restrictions)
+  // allFrames: true → execute in all frames (solves the cross-origin iframe access problem)
   if (message.type === 'cockpit:evaluate') {
     const tabId = sender.tab?.id;
     const frameId = sender.frameId ?? 0;
@@ -250,13 +250,15 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
       target,
       world: 'MAIN',
       func: async (code) => {
-        // Chrome extension messaging 在 sendResponse 的 structured clone 边界
-        // 存在一个隐性约 8 KiB 的截断点（复现于 session 6910d071 的 evaluate
-        // 输出精确停在 8192 字节）。为避免大结果被默默截掉，我们在 MAIN
-        // world 里先评估结果；如果序列化后 > CHUNK_THRESHOLD，把完整负载
-        // 暂存到页面 window 上的一个 Map，只把一个 descriptor 返回给上层。
-        // cock-browser CLI 会识别这个 descriptor 并通过 evaluate_chunk
-        // action 分块读取、拼回完整内容，对调用方透明。
+        // Chrome extension messaging has an implicit ~8 KiB truncation point at
+        // sendResponse's structured clone boundary (reproduced in session 6910d071
+        // where evaluate output stopped exactly at 8192 bytes). To avoid large
+        // results being silently truncated, we evaluate the result in the MAIN
+        // world first; if the serialized form is > CHUNK_THRESHOLD, we stash the
+        // full payload in a Map on the page's window and only return a descriptor
+        // to the upper layer. The cock-browser CLI recognizes this descriptor and
+        // reads it in chunks via the evaluate_chunk action, reassembling the full
+        // content — transparent to the caller.
         const CHUNK_THRESHOLD = 6000;
 
         const maybeChunk = (data) => {
@@ -269,7 +271,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
                 ? ''
                 : JSON.stringify(data);
           } catch {
-            // 不可序列化（循环引用等）— 原样返回，让上层照原路径处理
+            // Not serializable (circular references, etc.) — return as-is and let the upper layer handle it via the original path
             return { ok: true, data };
           }
           if (!serialized || serialized.length <= CHUNK_THRESHOLD) {
@@ -278,7 +280,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
           const W = window;
           if (!W.__cockpit_eval_stash_v1__) W.__cockpit_eval_stash_v1__ = new Map();
           const stash = W.__cockpit_eval_stash_v1__;
-          // 10 min GC：避免长会话页面堆积大 payload
+          // 10 min GC: prevents large payloads from piling up on long-lived session pages
           const cutoff = Date.now() - 10 * 60 * 1000;
           for (const [k, v] of stash) {
             if (v.created < cutoff) stash.delete(k);
@@ -297,14 +299,14 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
           };
         };
 
-        // 层 1: 直接 eval — 覆盖表达式、多语句、IIFE、模板字面量等
-        // eval 自动返回最后一个表达式的值（类似 CDP replMode）
+        // Layer 1: direct eval — covers expressions, multiple statements, IIFEs, template literals, etc.
+        // eval automatically returns the value of the last expression (similar to CDP replMode)
         try {
           const result = (0, eval)(code);
           const data = result instanceof Promise ? await result : result;
           return maybeChunk(data);
         } catch (e1) {
-          // 层 2: AsyncFunction fallback — 覆盖含顶层 await 的代码
+          // Layer 2: AsyncFunction fallback — covers code containing top-level await
           try {
             const AF = Object.getPrototypeOf(async function(){}).constructor;
             const data = await new AF(code)();
@@ -318,7 +320,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     })
       .then(results => {
         if (message.allFrames) {
-          // 多 frame：收集所有非 undefined 结果
+          // Multiple frames: collect all non-undefined results
           const all = (results || [])
             .map((r, i) => ({ frameId: r.frameId, ...r.result }))
             .filter(r => r.ok && r.data !== undefined);
@@ -333,7 +335,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     return true; // async sendResponse
   }
 
-  // 截图：automation.js 请求截取当前标签页可见区域
+  // Screenshot: automation.js requests a capture of the current tab's visible area
   if (message.type === 'cockpit:capture-tab') {
     const tabId = sender.tab?.id;
     if (!tabId) {
@@ -349,14 +351,15 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 });
 
 // =========================================================================
-// externally_connectable: Cockpit 页面直连通信
+// externally_connectable: direct communication from the Cockpit page
 //
-// BrowserBubble 在设置 iframe src 前，直接调用
+// Before setting the iframe src, BrowserBubble directly calls
 //   chrome.runtime.sendMessage(extensionId, { type: 'prepare-iframe', url })
-// 等待 Cookie 规则就绪后再渲染 iframe，彻底消除时序竞争。
+// and waits for the cookie rules to be ready before rendering the iframe,
+// completely eliminating the timing race.
 // =========================================================================
 chrome.runtime.onMessageExternal.addListener((message, sender, sendResponse) => {
-  // 安全校验：只接受 localhost 消息
+  // Security check: only accept messages from localhost
   if (!sender.url || !/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\//.test(sender.url)) {
     sendResponse({ ok: false, error: 'unauthorized' });
     return;
@@ -382,8 +385,8 @@ chrome.runtime.onMessageExternal.addListener((message, sender, sendResponse) =>
 });
 
 // =========================================================================
-// [调试] onSendHeaders = 所有修改完成后、实际发送到服务器的最终头
-//        extraHeaders = 才能看到 Cookie 头（Chrome 79+ 限制）
+// [调试] onSendHeaders = the final headers actually sent to the server, after all modifications are done
+//        extraHeaders = required in order to see the Cookie header (Chrome 79+ restriction)
 // =========================================================================
 chrome.webRequest.onSendHeaders.addListener(
   (details) => {

package/chrome-extension/content.js

@@ -1,22 +1,22 @@
 /**
  * Cockpit Bridge - Content Script
  *
- * 注入到所有页面（包括 iframe 内），但只在 Cockpit 直属 iframe 中激活。
+ * Injected into all pages (including inside iframes), but only activates in iframes directly owned by Cockpit.
  *
- * 功能：
- * 1. 拦截 target="_blank" 链接点击 → postMessage 通知父页面创建新气泡
- * 2. 重写 window.open → postMessage 通知父页面创建新气泡
- * 3. 监听页面 URL 变化（pushState/replaceState/popstate）→ 通知父页面更新当前气泡 URL
+ * Features:
+ * 1. Intercept target="_blank" link clicks → postMessage notifies the parent page to create a new bubble
+ * 2. Override window.open → postMessage notifies the parent page to create a new bubble
+ * 3. Watch page URL changes (pushState/replaceState/popstate) → notify the parent page to update the current bubble's URL
  *
- * 识别 Cockpit iframe 的方式：
- * BrowserBubble 在 iframe src 上追加 _cockpit=1 参数，
- * DNR 静态规则在网络层剥离该参数（服务端看不到），
- * background 通过 webNavigation.onBeforeNavigate 记录带 _cockpit=1 的 frame，
- * content script 通过 check-frame 消息查询 background 确认身份。
+ * How Cockpit iframes are identified:
+ * BrowserBubble appends a _cockpit=1 parameter to the iframe src,
+ * a static DNR rule strips that parameter at the network layer (the server never sees it),
+ * background records frames carrying _cockpit=1 via webNavigation.onBeforeNavigate,
+ * and the content script confirms its identity by querying background with a check-frame message.
  *
- * Cookie 预注入的方式：
- * BrowserBubble 通过 externally_connectable 直接调用 background 的 prepare-iframe，
- * await 返回后 Cookie 规则已就绪，再设置 iframe src。无时序竞争。
+ * How cookies are pre-injected:
+ * BrowserBubble calls background's prepare-iframe directly via externally_connectable;
+ * once the await returns, the cookie rules are ready, and only then is the iframe src set. No timing race.
  */
 
 (function () {
@@ -25,16 +25,16 @@
   const LOG_PREFIX = '[Cockpit Bridge]';
 
   // ====================================================================
-  // 顶层页面：仅在 Cockpit 页面暴露 extension ID（供 externally_connectable 使用）
+  // Top-level page: expose the extension ID only on Cockpit pages (for externally_connectable to use)
   // ====================================================================
   if (window === window.top) {
     if (/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(window.location.origin)) {
-      // 通过 DOM 属性暴露 extension ID（CSP 安全，不需要内联脚本）
+      // Expose the extension ID via DOM attributes (CSP-safe, no inline script needed)
       const id = chrome.runtime.id;
       const version = (() => { try { return chrome.runtime.getManifest().version; } catch { return 'unknown'; } })();
 
-      // 通过 <meta> 标签暴露 bridge 信息（DOM 共享，跨 isolated world）
-      // 不修改 <html> 属性，避免 React hydration mismatch
+      // Expose bridge info via a <meta> tag (DOM is shared across isolated worlds)
+      // Do not modify <html> attributes, to avoid React hydration mismatch
       function injectBridgeMeta() {
         const head = document.head || document.documentElement;
         const meta = document.createElement('meta');
@@ -55,23 +55,23 @@
   }
 
   // ====================================================================
-  // iframe 内：查询 background 确认是否为 Cockpit iframe
+  // Inside an iframe: query background to confirm whether this is a Cockpit iframe
   // ====================================================================
 
-  // 保存真实 parent 引用（在伪装脚本覆盖之前，isolated world 不受影响）
+  // Save a reference to the real parent (before the disguise script overrides it; the isolated world is unaffected)
   const realParent = window.parent;
 
-  // DNR 已在网络层剥离 _cockpit=1 参数，content script 看不到该参数。
-  // 统一通过 background 的 cockpitFrames 追踪集合来确认身份。
+  // DNR has already stripped the _cockpit=1 parameter at the network layer, so the content script cannot see it.
+  // Identity is always confirmed through background's cockpitFrames tracking set.
   chrome.runtime.sendMessage({ type: 'cockpit:check-frame' }, (response) => {
-    if (chrome.runtime.lastError) return; // 插件未就绪，忽略
+    if (chrome.runtime.lastError) return; // Extension not ready yet, ignore
     if (response?.isCockpit) {
       activateCockpitBridge();
     }
   });
 
   // ====================================================================
-  // Bridge 激活逻辑
+  // Bridge activation logic
   // ====================================================================
   function activateCockpitBridge() {
     console.log(LOG_PREFIX,
@@ -83,29 +83,29 @@
     );
 
     // ----------------------------------------------------------------
-    // 0a. 伪装为顶层窗口（注入外部脚本到 main world，绕过 CSP）
-    //     CSP 允许 chrome-extension:// 源，因此用外部脚本替代内联脚本
+    // 0a. Disguise as the top-level window (inject an external script into the main world, bypassing CSP)
+    //     CSP allows chrome-extension:// origins, so an external script is used instead of an inline one
     // ----------------------------------------------------------------
     const disguiseScript = document.createElement('script');
     disguiseScript.src = chrome.runtime.getURL('disguise.js');
     (document.documentElement || document).prepend(disguiseScript);
     disguiseScript.onload = () => disguiseScript.remove();
 
-    // 注入网络拦截到 Main World（必须在页面脚本之前执行）
+    // Inject network interception into the Main World (must run before any page scripts)
     const networkScript = document.createElement('script');
     networkScript.src = chrome.runtime.getURL('network-capture.js');
     (document.documentElement || document).prepend(networkScript);
     networkScript.onload = () => networkScript.remove();
 
     // ----------------------------------------------------------------
-    // 1. Cookie 补充注入：SPA 导航后域名可能变化，通知 background 补充规则
-    //    首次加载的 Cookie 已由 externally_connectable 预注入
+    // 1. Supplemental cookie injection: the domain may change after SPA navigation, so notify background to add rules
+    //    Cookies for the initial load were already pre-injected via externally_connectable
     // ----------------------------------------------------------------
 
     const COCKPIT_MSG_PREFIX = 'cockpit:';
 
     // ----------------------------------------------------------------
-    // 2. 向父页面发送消息（使用真实 parent 引用）
+    // 2. Send messages to the parent page (using the saved real parent reference)
     // ----------------------------------------------------------------
     function notifyParent(type, data) {
       try {
@@ -118,7 +118,7 @@
     }
 
     // ----------------------------------------------------------------
-    // 3. 拦截 <a target="_blank"> 点击
+    // 3. Intercept <a target="_blank"> clicks
     // ----------------------------------------------------------------
     document.addEventListener(
       'click',
@@ -144,7 +144,7 @@
     );
 
     // ----------------------------------------------------------------
-    // 4. 重写 window.open → 拦截并通知
+    // 4. Override window.open → intercept and notify
     // ----------------------------------------------------------------
     const originalOpen = window.open;
     window.open = function (url, target, features) {
@@ -163,7 +163,7 @@
     };
 
     // ----------------------------------------------------------------
-    // 5. 监听页面内导航（SPA pushState / replaceState / popstate）
+    // 5. Watch in-page navigation (SPA pushState / replaceState / popstate)
     // ----------------------------------------------------------------
     let lastUrl = window.location.href;
 
@@ -173,10 +173,10 @@
         console.log(LOG_PREFIX, 'URL 变化:', lastUrl, '→', currentUrl);
         lastUrl = currentUrl;
         notifyParent('navigate', { url: currentUrl });
-        // URL 变化时重新注入 Cookie（可能域名或路径 Cookie 不同）
+        // Re-inject cookies when the URL changes (cookies may differ per domain or path)
         try {
           chrome.runtime.sendMessage({ type: 'cockpit:inject-cookies', url: currentUrl });
-        } catch (e) { /* 忽略 */ }
+        } catch (e) { /* ignore */ }
       }
     }
 
@@ -197,7 +197,7 @@
     window.addEventListener('hashchange', checkUrlChange);
 
     // ----------------------------------------------------------------
-    // 6. 页面加载完成后通知当前 URL
+    // 6. Notify the current URL once the page has finished loading
     // ----------------------------------------------------------------
     if (document.readyState === 'loading') {
       document.addEventListener('DOMContentLoaded', function () {
@@ -208,9 +208,9 @@
     }
 
     // ----------------------------------------------------------------
-    // 7. 加载自动化层（automation.js）用于 CLI 控制
-    //    通过 import() 在 isolated world 中加载（保留 chrome.runtime 访问）
-    //    automation.js 监听 cockpit:cmd postMessage，执行 DOM 操作并返回结果
+    // 7. Load the automation layer (automation.js) for CLI control
+    //    Loaded via import() in the isolated world (keeps chrome.runtime access)
+    //    automation.js listens for cockpit:cmd postMessages, performs DOM operations, and returns results
     // ----------------------------------------------------------------
     import(chrome.runtime.getURL('automation.js'))
       .then(mod => {

package/chrome-extension/disguise.js

@@ -1,9 +1,9 @@
 /**
- * 伪装为顶层窗口（注入到 iframe 的 main world）
- * 让网站 JS 无法检测到自己在 iframe 内
+ * Disguise as the top-level window (injected into the iframe's main world)
+ * so the site's JS cannot detect that it is running inside an iframe.
  *
- * 由 content.js 通过 <script src="chrome-extension://xxx/disguise.js"> 加载，
- * 绕过 CSP 对内联脚本的限制。
+ * Loaded by content.js via <script src="chrome-extension://xxx/disguise.js">,
+ * bypassing CSP restrictions on inline scripts.
  */
 (function () {
   try {

package/chrome-extension/network-capture.js

@@ -1,15 +1,15 @@
 /**
- * Network Capture - Main World 网络拦截
+ * Network Capture - Main World network interception
  *
- * 注入到 iframe 的 main world（和 disguise.js 同方式），
- * 拦截真实的 fetch / XMLHttpRequest，通过 CustomEvent 把
- * 捕获的请求条目发送回 Isolated World 的 automation.js。
+ * Injected into the iframe's main world (same way as disguise.js),
+ * intercepts the real fetch / XMLHttpRequest, and sends captured
+ * request entries back to automation.js in the Isolated World via CustomEvent.
  *
- * 通信协议：
- *   Main → Isolated:  cockpit:network-entry   { ...entry }       请求发起时立即发送（占位）
- *   Main → Isolated:  cockpit:network-update  { id, status, ... } 响应完成时发送（补全字段）
+ * Communication protocol:
+ *   Main → Isolated:  cockpit:network-entry   { ...entry }       sent immediately when the request starts (placeholder)
+ *   Main → Isolated:  cockpit:network-update  { id, status, ... } sent when the response completes (fills in the fields)
  *   Isolated → Main:  cockpit:network-recording { active, filters }
- *   Isolated → Main:  cockpit:network-bridge-ready  (触发 buffer flush)
+ *   Isolated → Main:  cockpit:network-bridge-ready  (triggers buffer flush)
  */
 (function () {
   'use strict';
@@ -17,14 +17,14 @@
   let networkReqId = 0;
   const MAX_BODY_SIZE = 128 * 1024;
 
-  // 录制状态（由 Isolated World 的 automation.js 同步过来）
+  // Recording state (synced over from automation.js in the Isolated World)
   let recording = { active: false, filters: {} };
 
-  // Bridge 就绪前缓存条目，防止 automation.js 还没 import 完时丢条目
+  // Buffer entries until the bridge is ready, so entries aren't lost while automation.js is still importing
   let entryBuffer = [];
   let bridgeReady = false;
 
-  // ── 事件监听 ────────────────────────────────────────────
+  // ── Event listeners ─────────────────────────────────────
 
   window.addEventListener('cockpit:network-recording', function (e) {
     recording = e.detail;
@@ -38,7 +38,7 @@
     }
   });
 
-  // ── 工具函数 ────────────────────────────────────────────
+  // ── Utility functions ───────────────────────────────────
 
   function shouldCaptureBody(method, url, status) {
     if (!recording.active) return false;
@@ -74,7 +74,7 @@
     window.dispatchEvent(new CustomEvent('cockpit:network-update', { detail: update }));
   }
 
-  // ── Fetch 拦截 ──────────────────────────────────────────
+  // ── Fetch interception ──────────────────────────────────
 
   var originalFetch = window.fetch;
   window.fetch = async function () {
@@ -98,7 +98,7 @@
       responseHeaders: null, responseBody: null, responseSize: null,
       recorded: wantBody,
     };
-    // 立即 emit 占位条目，保持请求发起顺序
+    // Emit a placeholder entry immediately to preserve request start order
     emitEntry(entry);
 
     try {
@@ -131,7 +131,7 @@
     }
   };
 
-  // ── XMLHttpRequest 拦截 ─────────────────────────────────
+  // ── XMLHttpRequest interception ─────────────────────────
 
   var XHROpen = XMLHttpRequest.prototype.open;
   var XHRSend = XMLHttpRequest.prototype.send;
@@ -163,7 +163,7 @@
         responseHeaders: null, responseBody: null, responseSize: null,
         recorded: wantBody,
       };
-      // 立即 emit 占位条目，保持请求发起顺序
+      // Emit a placeholder entry immediately to preserve request start order
       emitEntry(entry);
       var entryMethod = entry.method;
       var entryUrl = entry.url;