Skip to content

v1.2.0 — verifiable witness receipts, isolation hardening

Choose a tag to compare

View all tags
@LvcidPsyche LvcidPsyche released this 10 Jun 15:54
v1.2.0
ad6aa93

Highlights

  • Verifiable Witness receipts. Receipts were always hash-chained at write time; now you can check the chain on demand. GET /sessions/{id}/witness/verify and the read-only browser.verify_witness MCP tool (curated profile) walk the full chain and report the first divergent receipt if the log was altered, reordered, truncated, or unparseable.
  • Sturdier session isolation. Per-session browser containers now get resource caps (ISOLATED_BROWSER_MEM_LIMIT 4g default, ISOLATED_BROWSER_PIDS_LIMIT 2048, ISOLATED_BROWSER_CPUS opt-in), and startup reaps containers orphaned by a crashed controller.
  • Fresh dependency floor. Playwright 1.56 → 1.60 on controller and browser-node together (WS protocol kept aligned), uvicorn 0.49, APScheduler 3.11.2; dev floors raised. Clears the open Dependabot batch.
  • Unified, current user-agent pool. One authoritative CHROME_UA_POOL (Chrome 149, June 2026 stable) now feeds both the fingerprint layer and the USER_AGENT_POOL default, which previously shipped stale Chrome 122–124 strings. Firefox/Safari UAs no longer cycle on the Chromium engine.
  • Quieter failure modes. Cleanup/capture paths that swallowed exceptions now log with context.
  • Security reporting channel. SECURITY.md now points at GitHub private vulnerability reporting.
  • CI host tests now run a Python 3.11 + 3.14 matrix; coverage gate holds at 80% (81% actual).

Full details in CHANGELOG.md.

Assets 2
Loading