v1.4.2

Fixed

• AutoBrowserTool works again on Python 3.14. The synchronous path — what LangChain and CrewAI call for .invoke() — used asyncio.get_event_loop().run_until_complete(), and since 3.14 get_event_loop() raises RuntimeError: There is no current event loop rather than creating one. auto-browser-langchain advertises 3.14 in requires-python and its classifiers, and nothing tested the package at all, so this shipped unnoticed. Now uses asyncio.run(), which is correct on every supported version; callers already inside an event loop should await _arun via ainvoke (#110).
• python -m app.harness.run no longer crashes when a task fails to converge. The run record's candidate field is present but null unless the run succeeded, and payload.get("candidate", {}) returns None rather than the {} default when a key exists with a null value — so the summary line raised AttributeError instead of printing, exactly when an operator was reading the output to find out why the run failed. The --json path was unaffected (#108).

Changed

• The auth-profile containment guards are now pinned by tests. BrowserAuthProfileService handles stored browser auth state (cookies, session tokens) and was the least-covered module in the controller at 22%; its guards were correct but untested, so a refactor that weakened one would have shipped green. Rejection behaviour is now covered for Zip Slip member names, symlink/hardlink/device archive members, containment on a separator boundary rather than a raw string prefix, the profile-name whitelist, and archive-path traversal — plus the end-to-end property that a malicious archive writes nothing outside the root. Each guard's test was verified by breaking the guard and confirming the failure (#105).
• The MCP stdio bridge's failure paths are covered. app/mcp_stdio.py — what uvx auto-browser-mcp runs — went from 58% to 99%, covering HTTP errors being returned rather than raised (so the server's JSON-RPC error reaches the client instead of a transport crash), teardown swallowing a dead connection, batch/non-object rejection, unreachable-endpoint handling, and protocol-version fallback when the response header is absent (#106).
• The quality gates now cover the whole repo instead of the controller. make lint ran on a hardcoded path list that excluded client/, integrations/, benchmarks/ and examples/ — including two packages published to PyPI — and four real errors had accumulated there unseen; all are fixed and the scope is now the repo. A root ruff.toml gives the previously-unlinted areas the controller's settings rather than Ruff's bare defaults. auto-browser-langchain went from zero tests to 94% with a CI job that runs 3.11 and 3.14, and auto-browser-client gained a coverage gate at 85% (it measures 90%) — the controller had enforced 80% while the packages users actually install enforced nothing (#110).
• Version parity across all nine version strings is machine-enforced. The release workflow only ever verified the tag against the three published pyproject.toml files, which is how v1.4.0 shipped with the runtime version strings still at 1.3.1. scripts/check_version_parity.py now checks every location and reports all offenders (#110).
• Roadmap corrected: MCP resources/subscribe push notifications were listed under "Next" but shipped in v1.1.0 (#107).