cdp-tunnel 3.3.9 → 3.5.0

package/extension-new/config-page-preview.html

@@ -295,6 +295,11 @@
       margin-bottom: 2px;
     }
 
+    .auth-badge {
+      font-size: 11px;
+      cursor: help;
+    }
+
     .conn-config-url {
       font-size: 11px;
       color: #6b7280;

package/extension-new/config-page.js

@@ -103,14 +103,16 @@
       var isActive = conn.enabled && statusClass === 'connected';
       var cdpAddr = getCdpAddress(conn.url, conn.mode);
       var statusHtml = getStatusHtml(statusClass);
+      var hasKey = (conn.url || '').indexOf('key=') >= 0;
+      var maskedUrl = maskUrl(conn.url);
       html +=
         '<div class="conn-config-item' + (isActive ? ' active' : '') + '" data-id="' + conn.id + '">' +
           '<input type="checkbox" class="conn-toggle" data-id="' + conn.id + '"' + (conn.enabled ? ' checked' : '') + ' title="启用/禁用">' +
           '<span class="status-dot ' + statusClass + '" title="' + statusClass + '"></span>' +
           '<div class="conn-config-info">' +
-            '<div class="conn-config-tag">' + (conn.mode === 'takeover' ? '🔗 ' : '🆕 ') + escapeHtml(conn.tag) + '</div>' +
-            '<div class="conn-config-url" title="' + escapeAttr(conn.url) + '">WS:  ' + escapeHtml(conn.url) + '</div>' +
-            (cdpAddr ? '<div class="conn-config-cdp">CDP: <span class="cdp-addr" data-cdp="' + escapeAttr(cdpAddr) + '">' + escapeHtml(cdpAddr) + '</span> <button class="btn-copy-cdp" data-cdp="' + escapeAttr(cdpAddr) + '" title="复制 CDP 地址">📋</button></div>' : '') +
+            '<div class="conn-config-tag">' + (conn.mode === 'takeover' ? '🔗 ' : '🆕 ') + escapeHtml(conn.tag) + (hasKey ? ' <span class="auth-badge" title="带 API Key 鉴权">🔑</span>' : '') + '</div>' +
+            '<div class="conn-config-url" title="' + escapeAttr(maskedUrl) + '">WS:  ' + escapeHtml(maskedUrl) + '</div>' +
+            (cdpAddr ? '<div class="conn-config-cdp">CDP: <span class="cdp-addr" data-cdp="' + escapeAttr(cdpAddr) + '">' + escapeHtml(cdpAddr.replace(/(key=)(cdp_[a-f0-9]{8})[a-f0-9]*/, '$1$2••••')) + '</span> <button class="btn-copy-cdp" data-cdp="' + escapeAttr(cdpAddr) + '" title="复制 CDP 地址（含 key）">📋</button></div>' : '') +
             '<div class="conn-config-status">' + statusHtml + '</div>' +
           '</div>' +
           '<button class="btn-delete" data-id="' + conn.id + '" title="删除">删除</button>' +
@@ -313,7 +315,16 @@
     var host = match[1];
     var port = parseInt(match[2], 10);
     if (mode === 'takeover') port += 1;
-    return 'http://' + host + ':' + port;
+    // 保留 key（如果 URL 里带了 ?key=xxx，CDP 客户端连接也需要带）
+    var keyMatch = (wsUrl || '').match(/[?&]key=([^&]+)/);
+    var keyParam = keyMatch ? '?key=' + keyMatch[1] : '';
+    return 'http://' + host + ':' + port + keyParam;
+  }
+
+  // 显示 URL 时隐藏 key 的明文（防截图泄露），但保留可识别性
+  function maskUrl(wsUrl) {
+    if (!wsUrl) return '';
+    return wsUrl.replace(/([?&]key=)(cdp_[a-f0-9]{8})[a-f0-9]*/, '$1$2••••');
   }
 
   function init() {

package/extension-new/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "CDP Bridge",
-  "version": "3.3.9",
+  "version": "3.5.0",
   "description": "Chrome DevTools Protocol Bridge for Playwright/Puppeteer automation",
   "permissions": [
     "debugger",

package/extension-new/utils/config.js

@@ -1,5 +1,5 @@
 var Config = {
-  WS_URL: 'ws://localhost:9221/plugin',
+  WS_URL: 'ws://localhost:43226/plugin',
   RECONNECT_DELAY: 3000,
   DEBUGGER_VERSION: '1.3',
   HEARTBEAT_INTERVAL: 25000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdp-tunnel",
-  "version": "3.3.9",
+  "version": "3.5.0",
   "description": "Bridge Chrome's debugger API to WebSocket — control your existing browser with Playwright/Puppeteer via CDP",
   "main": "server/proxy-server.js",
   "bin": "./cli/index.js",

package/server/modules/config.js

@@ -1,8 +1,13 @@
 const CONFIG = {
+  // 主端口：create 模式 + 扩展入口（/plugin）。
+  // 同时是端口池的逻辑第 0 个端口（pool_{PORT}），与 POOL_START-POOL_START+POOL_SIZE-1 行为一致。
   PORT: process.env.PORT ? parseInt(process.env.PORT) : 9221,
+  // takeover 唯一端口：接管用户已打开的 tab（不分组、断开不关 tab、全局仅一个连接）
   TAKEOVER_PORT: process.env.TAKEOVER_PORT ? parseInt(process.env.TAKEOVER_PORT) : 9220,
+  // 端口池 create 端口范围（9231-9239），每个端口 = 一个独立隔离浏览器
   POOL_START: process.env.POOL_START ? parseInt(process.env.POOL_START) : 9231,
   POOL_SIZE: process.env.POOL_SIZE ? parseInt(process.env.POOL_SIZE) : 9,
+  // 端口池的 takeover 端口（与 TAKEOVER_PORT 同值，由端口池的 _startTakeoverPort 实际监听）
   POOL_TAKEOVER_PORT: process.env.POOL_TAKEOVER_PORT ? parseInt(process.env.POOL_TAKEOVER_PORT) : 9220,
   HEARTBEAT_INTERVAL: 30000,
   STATUS_PRINT_INTERVAL: 60000,

package/server/modules/port-pool.js

@@ -26,7 +26,6 @@ class PortPoolManager {
     this.createWss = [];          // [WebSocket.Server] 每个 create 端口一个
     this.portSessions = [];       // [PortSession] 每个 create 端口一个
     this.takeoverServer = null;
-    this.takeoverWss = null;
     this.targetToPort = new Map();   // targetId → portIndex（事件路由用）
     this.sessionToPort = new Map();  // CDP sessionId → portIndex
   }
@@ -51,16 +50,29 @@ class PortPoolManager {
   };
 
   start() {
-    // 启动 create 端口（9222-9230）
+    // 端口池第 0 个端口 = 主端口（9221），复用主 server 的 /client 入口（不另开 http.Server）
+    this._setupMainPortSession(0, CONFIG.PORT);
+
+    // 启动 create 端口（9231-9239），portIndex 从 1 开始（0 留给主端口）
     for (let i = 0; i < CONFIG.POOL_SIZE; i++) {
       const port = CONFIG.POOL_START + i;
-      this._startCreatePort(i, port);
+      this._startCreatePort(i + 1, port);
     }
 
     // 启动 takeover 端口（9220）
     this._startTakeoverPort();
 
-    console.log(`\n[PORT POOL] Started: takeover=${CONFIG.POOL_TAKEOVER_PORT}, create=${CONFIG.POOL_START}-${CONFIG.POOL_START + CONFIG.POOL_SIZE - 1}`);
+    console.log(`\n[PORT POOL] Started: takeover=${CONFIG.POOL_TAKEOVER_PORT}, create=${CONFIG.PORT}(main) + ${CONFIG.POOL_START}-${CONFIG.POOL_START + CONFIG.POOL_SIZE - 1}`);
+  }
+
+  /**
+   * 主端口（9221）作为端口池第 0 个端口：只建 PortSession，不开 http.Server。
+   * 9221 的 HTTP 和 upgrade 由主 proxy-server 处理，但走端口池的隔离逻辑。
+   */
+  _setupMainPortSession(portIndex, port) {
+    const session = new PortPoolManager.PortSession(portIndex, port);
+    this.portSessions[portIndex] = session;
+    console.log(`[CREATE PORT ${portIndex}] Main port ${port} (reuses main server)`);
   }
 
   _startCreatePort(portIndex, port) {
@@ -140,7 +152,7 @@ class PortPoolManager {
     const url = new URL(req.url, `http://localhost:${session.port}`);
     const path = url.pathname;
 
-    if (path === '/json/version') {
+    if (path === '/json/version' || path === '/json/version/') {
       // 返回版本信息，webSocketDebuggerUrl 指向当前端口
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({
@@ -152,7 +164,7 @@ class PortPoolManager {
       return;
     }
 
-    if (path === '/json' || path === '/json/list') {
+    if (path === '/json' || path === '/json/' || path === '/json/list' || path === '/json/list/') {
       // 返回这个端口创建的 tab 列表
       // 从 session.targetIds 构建（这些是 createTarget 时记录的）
       const targets = [];
@@ -186,9 +198,27 @@ class PortPoolManager {
   _handleClientConnect(ws, req, session) {
     session.clients.add(ws);
 
-    const pluginWs = this.mainProxy.getPluginConnection();
+    // 鉴权：从 URL 提取 key，找到对应的 plugin（一 key 一浏览器）
+    let apiKey = null;
+    try {
+      const url = new URL(req.url, `http://localhost:${session.port}`);
+      apiKey = url.searchParams.get('key') || null;
+    } catch {}
+
+    // 如果有 SaaS 鉴权（HAS_SAAS），校验 key
+    if (this.mainProxy.validateClientKey) {
+      const valid = this.mainProxy.validateClientKey(apiKey);
+      if (!valid) {
+        ws.close(4001, 'Invalid or missing API key');
+        return;
+      }
+    }
+
+    ws.apiKey = apiKey;  // 记录到 ws，后续命令转发时带上
+
+    const pluginWs = this.mainProxy.getPluginConnection(apiKey);
     if (!pluginWs) {
-      ws.close(1011, 'No extension connected');
+      ws.close(1011, apiKey ? 'No browser connected for this key' : 'No extension connected');
       return;
     }
 
@@ -352,6 +382,17 @@ class PortPoolManager {
         msg.result.targetInfos = msg.result.targetInfos.filter(t => session.targetIds.has(t.targetId));
       }
 
+      // 如果是 closeTarget 响应，清理该 target 的所有映射
+      if (pending && pending.method === 'Target.closeTarget' && pending.params && pending.params.targetId) {
+        const closedTid = pending.params.targetId;
+        session.targetIds.delete(closedTid);
+        session.targetUrls.delete(closedTid);
+        this.targetToPort.delete(closedTid);
+        // sessionId → client 映射在 targetCreated/attachedToTarget 时建立，
+        // 但端口池层不维护 sessionId ↔ targetId 反查表，故此处不清理 sessionToClient
+        // （session 级隔离下，client 断开时整体清理即可）
+      }
+
       // 恢复原始 id，发给发起请求的 client
       const response = { ...msg, id: pending ? pending.originalId : this._parseOriginalId(originalId) };
       delete response.__portIndex;
@@ -368,11 +409,36 @@ class PortPoolManager {
 
     // 2. 事件消息（无 id）：按 targetId 或 sessionId 路由
     if (msg.method && msg.params) {
-      // 诊断：打印所有未匹配到的事件
+      // 提取 targetId（attachedToTarget 的在 params.targetInfo.targetId）
       let targetId = null;
       if (msg.params.targetId) targetId = msg.params.targetId;
       else if (msg.params.targetInfo && msg.params.targetInfo.targetId) targetId = msg.params.targetInfo.targetId;
 
+      // 关键：attachedToTarget 事件带 sessionId 时，必须注册 sessionToPort，
+      // 否则后续该 session 的 Page.*/Runtime.* 事件无法路由（Playwright evaluate 会卡死）。
+      // 这一步独立于 targetId 是否已知——auto-attach 场景下 targetId 可能尚未在 targetToPort 注册。
+      // 归属端口：优先用 targetId 查 targetToPort；查不到时，找唯一一个 pendingCreate 的端口，
+      // 再查不到则归到端口 0（POOL_SIZE=0 时只有端口 0；多端口时靠 createTarget 响应补注册 targetId→port）
+      if (msg.method === 'Target.attachedToTarget' && msg.params.sessionId) {
+        let portIdx = this.targetToPort.get(targetId);
+        if (portIdx === undefined) {
+          // 找 pendingCreate 的端口（createTarget 响应还没到，但事件先到了）
+          for (let pi = 0; pi < this.portSessions.length; pi++) {
+            if (this.portSessions[pi] && this.portSessions[pi].pendingCreate) { portIdx = pi; break; }
+          }
+        }
+        if (portIdx === undefined) portIdx = 0;  // 兜底：归到主端口
+        const sess = this.portSessions[portIdx];
+        if (sess) {
+          if (targetId) {
+            sess.targetIds.add(targetId);
+            this.targetToPort.set(targetId, portIdx);
+          }
+          this.sessionToPort.set(msg.params.sessionId, portIdx);
+          sess.sessionToClient.delete(msg.params.sessionId);  // auto-attach：广播
+        }
+      }
+
       if (targetId) {
         const portIndex = this.targetToPort.get(targetId);
         if (portIndex !== undefined) {
@@ -392,13 +458,37 @@ class PortPoolManager {
               sess.targetUrls.set(targetId, 'about:blank');
               this.targetToPort.set(targetId, pi);
               if (msg.method === 'Target.attachedToTarget') sess.pendingCreate = false;
+              // attachedToTarget 事件带 sessionId：必须注册 sessionToPort/sessionToClient，
+              // 否则后续 Page.*/Runtime.* 等 session 事件无法路由（Playwright newPage 会卡死）
+              if (msg.method === 'Target.attachedToTarget' && msg.params && msg.params.sessionId) {
+                this.sessionToPort.set(msg.params.sessionId, pi);
+                // auto-attach 场景无特定发起 client，广播给该端口所有 client
+                sess.sessionToClient.delete(msg.params.sessionId);
+              }
               this._broadcastToPort(pi, msg);
               return true;
             }
           }
-          // pendingCreate 没匹配到——记录但不广播（避免 sessionId 串）
-          // targetId 会在 createTarget 响应时注册
-          return true;
+          // pendingCreate 没匹配到——仍需处理 setAutoAttach 自动触发的 attachedToTarget
+          // （Playwright/Puppeteer 的 newPage 走的就是这条路径，不走 createTarget lock）
+          // 用 targetToPort 找到归属端口；若 targetId 也未知，广播给所有端口（保守）
+          if (msg.method === 'Target.attachedToTarget' && msg.params && msg.params.sessionId) {
+            const knownPort = this.targetToPort.get(targetId);
+            const portIdx = knownPort !== undefined ? knownPort : 0;
+            const sess = this.portSessions[portIdx];
+            if (sess) {
+              sess.targetIds.add(targetId);
+              this.targetToPort.set(targetId, portIdx);
+              this.sessionToPort.set(msg.params.sessionId, portIdx);
+              sess.sessionToClient.delete(msg.params.sessionId);  // auto-attach：广播
+              this._broadcastToPort(portIdx, msg);
+            }
+            return true;
+          }
+          // targetCreated 无 pendingCreate 且非 attachedToTarget：记录但不广播
+          if (msg.method === 'Target.targetCreated') {
+            return true;
+          }
         }
       }
 
@@ -408,10 +498,13 @@ class PortPoolManager {
         if (portIndex !== undefined) {
           const sess = this.portSessions[portIndex];
           if (sess) {
-            // 精确路由：只发给持有这个 sessionId 的 client（不广播）
+            // 精确路由：有特定 owner 就单播，否则广播给该端口所有 client
+            // （auto-attach 场景无 owner，Playwright/Puppeteer 需要 Page.* 事件）
             const ownerWs = sess.sessionToClient.get(msg.sessionId);
             if (ownerWs && ownerWs.readyState === WebSocket.OPEN) {
               ownerWs.send(JSON.stringify(msg));
+            } else {
+              this._broadcastToPort(portIndex, msg);
             }
             return true;
           }

package/server/proxy-server.js

@@ -23,8 +23,9 @@ const TAKEOVER_PORT = CONFIG.TAKEOVER_PORT;
 let portPool = null;
 const { logCDP, logEvent, clearLog, logStatus, logConnectionEvent, flushAllLogs, logDisconnect } = require('./modules/logger');
 
+let validateApiKey = null;
 try {
-    const { validateApiKey } = require('./saas/auth');
+    validateApiKey = require('./saas/auth').validateApiKey;
     var HAS_SAAS = true;
 } catch (e) {
     var HAS_SAAS = false;
@@ -319,7 +320,19 @@ function resolvePluginFromUrl(url) {
 
 async function handleHttpRequest(req, res) {
     const url = new URL(req.url, `http://localhost:${PORT}`);
-    
+
+    // 主端口（9221）的 /json/version、/json/list 委托端口池 session[0]，
+    // 语义与 9231-9239 一致：只返回本端口（pool_9221）创建的 target。
+    // takeover（9220，req._takeoverMode=true）不走这条——它要看用户全部 tab。
+    if (!req._takeoverMode && portPool && portPool.portSessions[0] &&
+        (url.pathname === '/json/version' || url.pathname === '/json/version/' ||
+         url.pathname === '/json' || url.pathname === '/json/' ||
+         url.pathname === '/json/list' || url.pathname === '/json/list/' ||
+         url.pathname === '/json/new')) {
+        portPool._handleHttp(req, res, portPool.portSessions[0]);
+        return;
+    }
+
     if (url.pathname === '/json/browsers' || url.pathname === '/json/browsers/') {
         const browsers = [];
         for (const pluginWs of pluginConnections) {
@@ -465,6 +478,19 @@ wss.on('connection', (ws, req) => {
         }
     }
 
+    // 主端口（9221）的 create 连接走端口池第 0 个 session（与 9231-9239 行为一致）
+    // 注意：takeover（9220，req._takeoverMode=true）不走端口池，保留原 handleClientConnection 逻辑
+    if (!req._takeoverMode && portPool && portPool.portSessions[0]) {
+        const isMainPortClient = path === '/client' ||
+                                 path.startsWith('/client/') ||
+                                 path.startsWith('/devtools/browser/') ||
+                                 path.startsWith('/devtools/page/');
+        if (isMainPortClient) {
+            portPool._handleClientConnect(ws, req, portPool.portSessions[0]);
+            return;
+        }
+    }
+
     const clientInfo = {
         ip: req.socket.remoteAddress,
         port: req.socket.remotePort
@@ -473,6 +499,7 @@ wss.on('connection', (ws, req) => {
     if (path === '/plugin') {
         handlePluginConnection(ws, clientInfo, req);
     } else if (path === '/client' || path.startsWith('/client/') || path.startsWith('/client-') || path.startsWith('/devtools/browser/')) {
+        // 仅 takeover（9220）会走到这里；create 已被上面的端口池分支拦截
         const customClientId = path.startsWith('/client-') ? path.replace('/client-', '') : null;
         let targetPluginId = null;
         if (pathParts[0] === 'client' && pathParts[1]) {
@@ -483,6 +510,7 @@ wss.on('connection', (ws, req) => {
         const mode = req._takeoverMode ? 'takeover' : 'create';
         handleClientConnection(ws, clientInfo, customClientId, targetPluginId, mode);
     } else if (path.startsWith('/devtools/page/')) {
+        // 仅 takeover 会走到这里
         const targetId = path.replace('/devtools/page/', '');
         const mode = req._takeoverMode ? 'takeover' : 'create';
         handlePageConnection(ws, clientInfo, targetId, mode);
@@ -715,11 +743,19 @@ function handlePluginConnection(ws, clientInfo, request) {
             }
         }
 
+        if (HAS_SAAS && process.env.REQUIRE_AUTH === 'true' && !apiKey) {
+            // 强制鉴权模式：plugin 必须带 key
+            logConnectionEvent('PLUGIN_AUTH_FAIL', 'No API key (REQUIRE_AUTH=true)');
+            ws.close(4001, 'API key required');
+            return;
+        }
+
         if (HAS_SAAS && apiKey) {
             const keyInfo = validateApiKey(apiKey);
             if (keyInfo) {
                 ws.userId = keyInfo.userId;
                 ws.apiKeyId = keyInfo.keyId;
+                ws.apiKey = apiKey;  // 记录 key 字符串，供 client 连接时反查 plugin
                 logConnectionEvent('PLUGIN_AUTHED', `userId=${keyInfo.userId} keyName=${keyInfo.keyName}`);
             } else {
                 logConnectionEvent('PLUGIN_AUTH_FAIL', 'Invalid API key');
@@ -835,12 +871,18 @@ function handlePluginConnection(ws, clientInfo, request) {
             const extVersion = parsed.version || 'unknown';
             ws.extVersion = extVersion;
             const match = extVersion === PKG_VERSION;
-            const level = match ? 'info' : 'warn';
             const label = match ? '✅' : '⚠️ VERSION MISMATCH';
             const msg = `[VERSION CHECK] ${label} server=${PKG_VERSION} extension=${extVersion}`;
             console.log(msg);
             logCDP('VERSION', msg);
             if (!match) {
+                // STRICT_VERSION=true（生产环境）：版本不一致直接拒绝，避免老扩展与新 proxy 不兼容
+                if (process.env.STRICT_VERSION === 'true') {
+                    console.log(`  ↳ STRICT_VERSION=true，拒绝连接`);
+                    logConnectionEvent('PLUGIN_VERSION_REJECTED', `server=${PKG_VERSION} extension=${extVersion}`);
+                    ws.close(4002, `Version mismatch: server=${PKG_VERSION} extension=${extVersion}`);
+                    return;
+                }
                 console.log(`  ↳ Run "cdp-tunnel update" or reload the extension to sync versions`);
             }
             getNamespace(ws).cachedBrowserVersion = null;
@@ -2101,10 +2143,25 @@ server.listen(PORT, '0.0.0.0');
 
 // v3.0 端口池启动（唯一模式）
 portPool = new PortPoolManager({
-    getPluginConnection: () => {
+    getPluginConnection: (apiKey) => {
+        // 鉴权模式：按 key 找对应的 plugin（一 key 一浏览器）
+        if (apiKey) {
+            for (const ws of pluginConnections) {
+                if (ws.readyState === WebSocket.OPEN && ws.apiKey === apiKey) return ws;
+            }
+            return null;
+        }
+        // 无鉴权模式（本地开发）：返回第一个 plugin
         for (const ws of pluginConnections) return ws;
         return null;
     },
+    validateClientKey: (apiKey) => {
+        // 无 SaaS 或未开启强制鉴权时放行（本地开发模式）
+        if (!HAS_SAAS || process.env.REQUIRE_AUTH !== 'true') return true;
+        // 开启强制鉴权：必须有有效 key
+        if (!apiKey) return false;
+        return !!validateApiKey(apiKey);
+    },
     handlePluginUpgrade: (req, socket, head) => {
         wss.handleUpgrade(req, socket, head, (ws) => {
             wss.emit('connection', ws, req);

package/server/saas/auth.js

@@ -85,7 +85,7 @@ function validateApiKey(key) {
     const apiKey = db.prepare('SELECT * FROM api_keys WHERE key = ? AND active = 1').get(key);
     if (!apiKey) return null;
     // 更新最后使用时间
-    db.prepare('UPDATE api_keys SET last_used_at = datetime("now") WHERE id = ?').run(apiKey.id);
+    db.prepare("UPDATE api_keys SET last_used_at = datetime('now') WHERE id = ?").run(apiKey.id);
     return { userId: apiKey.user_id, keyId: apiKey.id, keyName: apiKey.name };
 }
 

package/server/saas/key-manager.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * API Key 管理工具（手动创建/列出/删除 key）
+ *
+ * 一 key = 一浏览器。创建后把带 key 的地址给用户填进扩展。
+ *
+ * 用法：
+ *   node server/saas/key-manager.js create [name]       创建 key
+ *   node server/saas/key-manager.js list                列出所有 key
+ *   node server/saas/key-manager.js revoke <keyId>      吊销 key
+ *
+ * 创建后会输出一个地址，格式：
+ *   ws://localhost:9221/plugin?key=ak_xxxxxxxx
+ * 上云后把 localhost 换成云域名。
+ */
+
+const auth = require('./auth');
+
+const command = process.argv[2];
+const arg = process.argv[3];
+
+// 用来管理 key 的内置用户（绕过注册系统）
+const BUILTIN_USER = { id: 'builtin-admin', email: 'admin@local', displayName: 'Admin' };
+
+function ensureBuiltinUser() {
+  const db = require('./db');
+  const existing = db.prepare('SELECT id FROM users WHERE id = ?').get(BUILTIN_USER.id);
+  if (!existing) {
+    db.prepare('INSERT INTO users (id, email, password_hash, display_name) VALUES (?, ?, ?, ?)')
+      .run(BUILTIN_USER.id, BUILTIN_USER.email, 'builtin-no-login', BUILTIN_USER.displayName);
+  }
+  return BUILTIN_USER;
+}
+
+function main() {
+  try {
+    if (command === 'create' || !command) {
+      ensureBuiltinUser();
+      const name = arg || ('browser-' + Date.now().toString(36));
+      const keyInfo = auth.createApiKey(BUILTIN_USER.id, name);
+      const port = process.env.PORT || 9221;
+      const host = process.env.EXTERNAL_HOST || `localhost:${port}`;
+      console.log('\n✅ Key 创建成功\n');
+      console.log(`  Key ID:    ${keyInfo.keyId}`);
+      console.log(`  名称:      ${name}`);
+      console.log(`  Key:       ${keyInfo.key}`);
+      console.log(`\n  扩展连接地址（填进扩展配置页）:`);
+      console.log(`  \x1b[32mws://${host}/plugin?key=${keyInfo.key}\x1b[0m`);
+      console.log(`\n  CDP 客户端连接地址:`);
+      console.log(`  \x1b[32mws://${host}/client?key=${keyInfo.key}\x1b[0m`);
+      console.log('');
+      return;
+    }
+
+    if (command === 'list') {
+      ensureBuiltinUser();
+      const keys = auth.listApiKeys(BUILTIN_USER.id);
+      if (keys.length === 0) {
+        console.log('\n（没有 key，用 create 创建）\n');
+        return;
+      }
+      console.log('\n=== API Keys ===\n');
+      keys.forEach(k => {
+        const status = k.active ? '✅' : '❌';
+        const lastUsed = k.last_used_at ? k.last_used_at : '从未';
+        console.log(`  ${status} ${k.name}`);
+        console.log(`     ID: ${k.id}`);
+        console.log(`     最后使用: ${lastUsed}`);
+        console.log(`     创建: ${k.created_at}`);
+        console.log('');
+      });
+      return;
+    }
+
+    if (command === 'revoke') {
+      if (!arg) {
+        console.log('用法: node key-manager.js revoke <keyId>');
+        process.exit(1);
+      }
+      ensureBuiltinUser();
+      auth.revokeApiKey(arg, BUILTIN_USER.id);
+      console.log(`\n✅ Key ${arg} 已吊销\n`);
+      return;
+    }
+
+    console.log('用法:');
+    console.log('  node server/saas/key-manager.js create [name]    创建 key');
+    console.log('  node server/saas/key-manager.js list             列出所有 key');
+    console.log('  node server/saas/key-manager.js revoke <keyId>   吊销 key');
+  } catch (e) {
+    console.error('错误:', e.message);
+    process.exit(1);
+  }
+}
+
+main();