Skip to content

Hx0 HawkEye v1.0.6 · 0906版本更新

Latest
Latest

Choose a tag to compare

View all tags
@asaotomo asaotomo released this 26 Aug 23:18
· 12 commits to main since this release
v1.0.6
925c76f

v1.0.6 重点更新 / Highlights

0906版本更新： 本次重点优化 Agent 长任务执行与稳定性：修复切换标签页后仍操作旧页、关闭任务页面异常退出、文件发现误触发下载和检查点超限阻断新任务；完善目标/计划进度保留、中断恢复与防重复提交，优化历史同步，并将标题与记忆整理移至后台；增强联网搜索、页面数值证据与 Firefox 输入可靠性，新增 Ctrl+H 抓包界面快捷键，同时同步中英文用户手册与 Chrome/Firefox 发行包。

0906 release update: This update focuses on long-running Agent tasks and reliability: it fixes actions targeting the old tab after a switch, failures after closing the task tab, unintended downloads during file discovery, and checkpoint limits blocking new tasks. It improves Goal/Plan progress retention, interruption recovery and duplicate-submission protection, reduces history synchronization, and moves title and memory maintenance to the background. It also strengthens web research, page-metric evidence and Firefox input handling, adds the Ctrl+H capture-UI shortcut, and synchronizes the bilingual manual and Chrome/Firefox release packages.

中文概览 / Chinese overview

Hx0 鹰眼 v1.0.6 中文重点更新概览

English overview / 英文概览

Hx0 HawkEye v1.0.6 English key updates overview

1. 鹰眼浏览器自动化 MCP（PRO）/ HawkEye Browser Automation MCP (PRO)

Codex、Cursor、LM Studio 等支持 MCP 的 Agent Host 接入 hx0-hawkeye 后，可由 Host 中的模型自动调用 browser_navigate、browser_type、browser_snapshot，以及鹰眼抓包、重放、变异、编解码、TLS、敏感信息与证据工具，在用户真实浏览器中完成任务。它定位类似“面向安全专版的 Playwright MCP”，支持 stdio、Streamable HTTP 和 legacy SSE；本地 Server 仅监听回环地址。此能力独立于扩展内 AI 任务台。

After an MCP-capable Agent Host such as Codex, Cursor, or LM Studio connects to hx0-hawkeye, the model running in that Host can autonomously call browser_navigate, browser_type, browser_snapshot, plus HawkEye capture, replay, mutation, codec, TLS, sensitive-data, and evidence tools in the user's real browser. Positioned like a security-specialized Playwright MCP, it supports stdio, Streamable HTTP, and legacy SSE. The local server listens only on the loopback interface. This capability is separate from the in-extension AI Task Console.

Codex、Cursor 或 LM Studio 等 Agent Host 通过 HawkEye MCP 自动控制浏览器 / Agent Host controlling a browser through HawkEye MCP

2. 浏览器级 Agent（仅 PRO）/ Browser-level Agent (PRO only)

Agent 模式仅在有效试用或专业版授权下可用。它以用户当前真实 HTTP(S) 标签页与登录态为任务上下文，自主规划并多轮执行导航、复杂控件、iframe 与 Shadow DOM 交互、视觉截图、附件处理、抓包研判、重放验证、联网研究、原生下载和证据整理。它不是普通聊天，也不是一次性 AI 报告。

Agent Mode requires an active trial or Professional license. It uses the user's current real HTTP(S) tab and authenticated session as task context, then autonomously plans and performs multi-turn navigation, complex-control, iframe, and Shadow DOM interaction, visual screenshots, attachment handling, traffic analysis, replay validation, public-web research, native downloads, and evidence organization. It is neither a regular chat surface nor a one-shot AI report.

Agent 中文界面 / Agent UI in Chinese

v1.0.6 浏览器级 Agent 中文界面

Agent English UI / Agent 英文界面

v1.0.6 Browser-level Agent English UI

实机任务执行 / Live task execution

浏览器级 Agent 在真实浏览器中调用安全与页面工具 / Browser-level Agent calling security and page tools in a real browser

实机任务结果 / Live task result

浏览器级 Agent 汇总 ICP 备案与 HTTPS 证书结果 / Browser-level Agent reporting ICP filing and HTTPS certificate findings

3. 相比 v1.0.5 向社区版开放 / Opened to Community since v1.0.5

中文

  • 智能代理分流器：按站点规则把命中请求转发到 Burp、Yakit 或其他上游代理，未命中流量保持原网络路径。
  • 全量深度搜索：覆盖完整请求与响应内容，帮助定位页面、接口和数据线索。
  • 敏感信息匹配：支持内置规则、自定义正则、关键词库与批量导入导出。

English

  • Smart Proxy Router: routes matching requests to Burp, Yakit, or another upstream proxy according to site rules while leaving unmatched traffic on its original network path.
  • Full Deep Search: searches complete request and response content to locate page, endpoint, and data evidence.
  • Sensitive Information Matching: includes built-in rules, custom regular expressions, keyword libraries, and batch import/export.

4. 极致性能与低占用 / Extreme performance and low resource use

中文

  • Firefox webRequest 监听器按功能状态动态注册与卸载，避免不必要的常驻监听。
  • DOM 快照采用单次线性遍历、视口外元素早过滤、有界输出和 ref 缓存。
  • Agent / MCP 使用紧凑传输、通知批处理和观察器复用；大结果通过 next_cursor 无损续读。
  • Chrome / Firefox 最终发行包及真实浏览器运行时均已完成回归测试，存储空间不足时会明确标记正文截断，保留任务指令与操作检查点。

English

  • Firefox webRequest listeners are registered and removed dynamically according to feature state, avoiding unnecessary always-on listeners.
  • DOM snapshots use one-pass linear traversal, early rejection of off-screen elements, bounded output, and ref caching.
  • Agent and MCP use compact transport, batched notifications, and observer reuse; large results continue losslessly through next_cursor.
  • Final Chrome and Firefox release packages and real-browser runtimes passed regression testing. When storage pressure requires shortening response bodies, truncation is marked explicitly while task instructions and operation checkpoints are retained.

5. Skills 更新与严格门控 / Skills update and strict authorization gates

中文

  • 内置 19 个渗透测试子模块和 28 个 CTF 子模块已更新至 v1.0.6 契约。
  • Agent 新会话默认关闭 Skills。
  • 用户必须先在「高级设置」启用允许的 Skill / 子模块，再在当前 Agent 会话点击 Skills。
  • Agent 只能按当前目标适时调用允许列表内的 Skill；任何未同时通过两道授权的 Skill 都不能被调用。

English

  • The 19 built-in penetration-testing submodules and 28 CTF submodules are updated to the v1.0.6 runtime contract.
  • Skills are disabled by default in every new Agent conversation.
  • Users must first enable allowed Skills or submodules in Advanced Settings, then click Skills in the current Agent conversation.
  • Agent may invoke only allowlisted Skills when relevant to the current goal. A Skill that has not passed both authorization gates cannot be called.

6. 抓包界面快捷键 / Capture UI shortcut

中文

  • 默认组合为 Ctrl+H；Mac 上是 Control+H（⌃H），不是 Command，也不是 Option。网页获得焦点即可使用，不必先点开弹窗。
  • Chrome：打开或收起抓包侧栏。Chrome 不允许扩展自行改快捷键，请到 chrome://extensions/shortcuts 找到「打开或收起 Hx0 鹰眼抓包界面」后改绑。
  • Firefox：打开或收起页面内抓包浮窗（不是直接打开原生侧边栏）。浮窗里可点「收起到侧边栏」；再按一次同一快捷键关闭。可在弹窗高级设置点「录制」后按下新组合。

English

  • Default combo is Ctrl+H; on Mac this is Control+H (⌃H), not Command or Option. It works while the page has focus—you do not need to open the popup first.
  • Chrome: toggles the capture side panel. Chrome does not let extensions change this shortcut; rebind “Toggle the Hx0 HawkEye capture panel” at chrome://extensions/shortcuts.
  • Firefox: toggles the in-page capture float (not the native sidebar). Use “Dock to sidebar” inside the float, and press the same shortcut again to close. Record a new combo in Advanced Settings.

安装 / Installation

中文

本版本提供 Chrome 与 Firefox 两个 ZIP 安装包。

  • Chrome / Edge / Chromium： 解压 Chrome ZIP → 打开 chrome://extensions（Edge 使用 edge://extensions）→ 开启开发者模式 → 点击“加载已解压的扩展程序” → 选择直接包含 manifest.json 的目录。
  • Firefox： 解压 Firefox ZIP → 打开 about:debugging#/runtime/this-firefox → 点击“临时载入附加组件” → 选择 manifest.json。Firefox 重启后需要重新临时载入。

Chrome 可能禁用非商店来源的 CRX；ZIP 为 Chrome 与 Firefox 提供一致、可检查的离线安装路径。升级前请先导出重要数据并关闭鹰眼侧栏，替换原固定目录内容后再重新加载扩展。

English

This release provides separate ZIP packages for Chrome and Firefox.

  • Chrome / Edge / Chromium: extract the Chrome ZIP → open chrome://extensions (use edge://extensions in Edge) → enable Developer mode → click Load unpacked → select the directory that directly contains manifest.json.
  • Firefox: extract the Firefox ZIP → open about:debugging#/runtime/this-firefox → click Load Temporary Add-on → select manifest.json. The temporary add-on must be loaded again after Firefox restarts.

Chrome may disable CRX packages installed outside the store. ZIP packages provide a consistent, inspectable offline installation path for Chrome and Firefox. Before upgrading, export important data and close HawkEye sidebars; replace the contents of the existing fixed directory, then reload the extension.

SHA-256

07b9f009444ce69891d1da3c761babd42bfd0fc8eaa7ca457b3360d7327968de  Hx0-HawkEye-Chrome-V1.0.6-Official.Release.zip
51f007639ec0bc7f343daf3440f1ac806ecaca1875e07b4c78f6e353b5b53f2f  Hx0-HawkEye-Firefox-V1.0.6-Official.Release.zip

仅在自有或明确授权目标上使用。AI / Agent / MCP 的数据路径、自动脱敏限制与用户权利，以扩展内《用户协议与隐私政策》为准。

Use HawkEye only on systems you own or are explicitly authorized to test. For AI / Agent / MCP data paths, automatic-redaction limitations, and user rights, refer to the in-extension User Agreement and Privacy Policy.

Assets 4
Loading