1.1.0

A web page can offer its own tools to the browser. From this version they can be called. A name invented by a page is still refused at the door; the page's tool is reached through one tool of ours, and that tool is judged like every other.

The rest is upkeep and repair. Velopack moved for the first time since this project started. The installer is a 64-bit program now, and Windows will show the app's size in Add/Remove Programs, where it showed nothing. One note told a caller its cookies had survived a crash. The measurement says they may not have, and the note says that now.

Added

• ✨ A web page's own tools are callable, through one tool of ours that is judged like the rest. read more
• ✅ The scratch configuration the suite hands the real client is seeded as already onboarded. read more
• ✅ A log event id must be unique in its class, and the scan found a second collision on its first run. read more

Changed

• 🐛 Two client-liveness events shared event id 76, so both moved off it and the id is retired. read more
• 📦 Every release packs full packages only, so an update downloads the whole thing. read more
• 🔧 The relaunch note stops promising that stored state survived, because it may not have. read more
• ⬆️ Velopack rolled 1.2.0 to 1.2.158, and the Windows installer is a 64-bit bootstrapper now. read more
• 📝 A browser server that ends itself loses the same stores as one that is killed. read more
• 📝 The feed is asked once per server start, and a hundred browsers in one session ask nothing. read more
• 🔧 webmcp: true is written into every generated config rather than left to upstream's default. read more
• 📝 Dash style for the whole repository is recorded as an open question rather than settled. read more
• 📝 Three decisions about page-provided tools, with the directions not taken beside them. read more
• 🔧 A session's deletion, what a destroy takes, its upload root and its move are all said now. read more
• ✅ Four arms hold the session-lifetime rules on the published binary's own wire. read more
• 💥 The payload could not be rebuilt until the override's exit was adjudicated. read more
• 📝 The charter's version-chain example prints the chain that ships, and an arm holds it there. read more
• 📝 The README licensing tables name Firefox, the third Playwright package, and today's revision. read more
• 📝 The session ledger is snapshotted again, and a re-snapshot is not an edit. read more
• 🗑️ The idle-CPU axis is retired as not established, and the other three are unchanged. read more
• 📝 The third-party notices name the third Playwright package and both browsers we provision. read more
• 📦 The release manifest records the pulled-forward dependency, and copies the file that pins it. read more
• 📝 Resume is two paths now, and each was timed at 1245 and 1548. read more
• 📝 The cost ratios are re-taken at 1245 and 1548, and the idle-CPU axis is withdrawn. read more
• 📝 Four claims in the payload licensing row did not survive a re-read at 1245 and 1548. read more
• 📝 Disk after a first run is a measured number again: 598 MB. read more
• ⬆️ TUnit moved 1.68.4 -> 1.68.17 and this time the testing platform moved with it, 2.4.0 -> 2.4.1. read more
• ⬆️ The payload rolled to @playwright/mcp 0.0.82, and three browser revisions came with it. read more
• 🗑️ The dated playwright-core override is removed, four days after it was taken. read more
• ✅ The exit test, its positive control and the version ordering underneath them are retired. read more
• 🔒 A web page can add tools to the child's tools/list, and BrowserAI's surface does not move. read more
• 🔧 Two tools left the surface and nobody here judged them out. read more
• 📝 Four re-verification rows are marked [STALE] and owed, and the reason is on each. read more
• 📝 The session ledger is snapshotted for the last time, and the scratch folder is empty. read more

---

Icon	Meaning	Icon	Meaning
✨	new capability	🐛	fix
🔧	behaviour or configuration change	🔒	security or permissions
🗑️	removal or deprecation	💥	breaking, or the reader must act
📝	documentation	✅	tests and the gate
📦	packaging, installer, release pipeline	⚡	performance
♻️	refactor with no behaviour change	⬆️	dependency move

The full changelog for this release: CHANGELOG.md

BrowserAI 1.0.0

BrowserAI is a Windows MCP server that gives an AI agent a real browser, either Chromium or Firefox. It carries its own copy of everything it needs, so there is nothing else to install.

This is the first version fit for real use. It replaces the build of the same number published on 2026-08-17. That build was downloadable for a month. Nobody is known to have installed it apart from the maintainer, and it did not exit when it had nobody left to serve.

There are two programs in the release. BrowserAI.Server.exe is the MCP server your client starts. BrowserAI.exe is a small configuration app. It opens when the install finishes, and it registers the server with your client.

Read README.md first.

Added

• ✨ BrowserAI ships as two executables from this release. read more
• ✨ BrowserAI.exe is the configuration app, and it opens after the install. read more
• ✨ The two registration scopes are offered in OutlookAI's own words. read more
• ✨ BrowserAI.exe --report <path> writes a JSON status report and exits. read more
• ♻️ BrowserAI.Core is the library both executables share. read more
• ✨ Runtime/PeSubsystem reads a binary's subsystem out of its own PE headers. read more
• ✅ RealInstallerTests.TheInstalledMainExecutableOpensOneDialogAndNoConsoleWindow is new. read more
• ✅ ConfigurationAppTests covers the configuration app. read more
• ✅ HouseRuleTests.EveryArmInAFileThatOverridesTheEnvironmentRunsBesideNothing is new. read more
• ✅ The corpus every tree-as-text rule reads is now asserted against git ls-files, in both directions. read more
• ✅ SaturationTests' torn-record arm is scoped to the run's own pids. read more
• 📝 The --treenode-filter trap, in kb/toolchain.md. read more
• 📝 The 2026-08-24 adversarial review is a dated record rather than a file in .work\. read more
• ✅ Every run says whether it could have seen a browser take the foreground. read more
• 📝 The server instructions now say what a full-page screenshot costs, before a model reaches for one. read more
• ✅ The dated records are append-only, and a test says so. read more
• ✨ Six per-run arguments, and four opinions that stopped being arguments. read more
• ✨ browserai_catch_up, the seventh authored tool. read more
• ✨ One time-ordered log, inside browserai.json. read more
• ✨ A required why on every call that names a session. read more
• ✨ Ten tools, reachable for the first time in this product's history or its predecessor's. read more
• 📝 A warning in the server instructions that response mocking can make a page lie to a human. read more
• ✨ browserai_list now says whether each session it reports is being driven, three-valued. read more
• ✨ Liveness is three-valued: Alone, NotAlone(n) or Undetermined(why). read more
• 🔒 A reinstall takes the machine's browsers root for the whole call. read more
• 🔒 The family reinstall's session gate is now unconditional. read more
• 📝 --storage-state together with --user-data-dir is a silent no-op. read more
• 📝 --caps accepts any word at all. read more
• 📝 Two browsers on one profile directory: Chromium refuses and Firefox hangs. read more
• 📝 The user agent is settable from the config on both families. read more
• 📝 Firefox is owed Chromium's rename measurement, and now has it. read more
• 📝 The CsWin32 metadata licence terms are in the repository, quoted verbatim. read more
• ✨ browserai_reinstall_browser gained a third value, shared. read more
• ✨ Firefox is a browser you can ask for. read more
• ✅ A budget gate over every model-facing string, measured off the wire. read more
• ✅ RecordedCountTests, which generalises the one place counting discipline was mechanised. read more
• 🐛 The per-directory session gate refused sessions that nothing was wrong with. read more
• ✅ The suite's torn-log check had never matched a log record. read more
• ✅ A test asserted a durable property on a channel that is not durable. read more
• ✅ Five product source files were outside every scan built on the repository walk. read more
• ✅ A test asserted that the developer's screen was busy. read more
• 🐛 A session another BrowserAI was writing to could not be opened. read more
• 🐛 A child that took longer than sixty seconds to start was reported as a protocol failure. read more
• 🐛 browserai_reinstall_browser could delete the browser tree and wait an hour. read more
• ✅ Both intermittent failures now name their own state. read more
• ✅ CI's four skipped tests are settled rather than rediscovered. read more
• ✅ The build runs on a machine nobody owns. read more
• ✅ The #anchor half of every relative link is checked too. read more
• 📝 Interop\, Sessions\ and Runtime\ have working instructions of their own. read more
• ✨ BrowserAI registers itself with your MCP client when it installs, and unregisters when it goes. read more
• 📦 A registration that could not happen says so, and never breaks the install. read more
• 📦 Installing, updating, repairing and reinstalling all leave exactly one registration. read more
• 📦 The version comes from the git tag and is typed nowhere. read more
• 📦 A build that cannot work out what version it is now fails. read more
• 📝 **This changelog.*...