Wraith v0.3.2 — pip-install fix (pin mcp<2)

Fixed

• Pin mcp>=1,<2. wraith.mcp uses the v1 FastMCP API, which mcp 2.x renamed
  to MCPServer; an unpinned pip install wraith pulled 2.x and broke the
  import. (The lockfile already pinned v1, so CI/uv were unaffected — a plain
  pip install was not.)

Wraith v0.3.1 — revoke a drop + review hardening

Added

• Revoke a drop — wraith profile revoke <code> (and deaddrop.burn) delete
  a sealed blob at the relay without reading it. Whoever holds the secret can
  burn a drop they mis-sent or whose code leaked. It grants no new power (a GET
  already destroys on read); it just makes the cancel explicit.
• wraith profile receive --out <file> saves the pulled jar as Playwright
  storageState JSON. receive now requires an action (--open or --out) and
  refuses before the network call, so a one-shot drop is never consumed with
  nowhere to put the jar.

Changed

• The relay is now a SQLite-backed Durable Object (one per slot) instead of
  KV, so read-and-delete is atomic — two racing pickups of a leaked code can no
  longer both read the blob. Deploys on the Workers Free plan; no KV namespace.
• PUT is idempotent (a retry re-sending the identical sealed bytes succeeds
  instead of a first-writer-wins collision); a consuming GET is no longer
  auto-retried (a retry after a lost response would lose the jar).

Fixed

• find_chrome_profile() now detects the modern Default/Network/Cookies
  layout, so Chrome auto-detection works without --profile.
• Chrome cookie decryption resolves Local State from the real profile
  directory under the Network/ layout (Windows decryption no longer fails).
• An all-app-bound (v20) Chrome store now surfaces the --from login guidance
  (new AppBoundCookieError) instead of a misleading "no cookies" result.
• profile sync reports Chrome keychain / app-bound failures as clean CLI
  errors instead of a traceback (ChromeCookieError derives from
  NotImplementedError, which the handler now catches).

Wraith v0.3.0 — profile sync over an encrypted dead-drop

Added

• Profile sync — move a domain-scoped login from a laptop to a remote
  Wraith, the way Browser Use's "sync your local cookies to cloud" works, but
  end-to-end encrypted with no account and no inbound port.
  • wraith.chrome: opt-in decryptor for Chrome/Chromium cookies across macOS
    (Keychain), Linux (Secret Service / peanuts), and Windows (DPAPI); refuses
    app-bound v20 values with guidance to use --from login.
  • wraith.deaddrop: an anonymous, login-free transport. One ephemeral secret
    per transfer derives an unguessable relay slot and a ChaCha20-Poly1305 key;
    the sealed blob is size-padded, slot-bound, and freshness-gated. The relay
    client retries transient failures (timeouts, 429, 5xx) with backoff and
    guards the relay's body cap (DropTooLarge). A dumb Cloudflare Worker relay
    (deploy/worker.js) stores one ciphertext per slot for ~10 minutes, hands it
    over exactly once, and rate-limits per IP (DROP_LIMITER, 120/60s) to stop
    storage-abuse floods.
  • wraith.profile + wraith profile sync / wraith profile receive CLI: pick
    a source (chrome/firefox/zen/login), scope to a domain, print a
    one-shot pairing code. Clean, actionable errors for spent/expired/oversize
    drops.
  • receive_profile MCP tool: the remote pulls the jar and injects it — a
    cross-machine identity borrow, no password ever seen by the agent.
• Declared cryptography as a direct dependency (Chrome decryption + dead-drop
  AEAD/HKDF); it was only a transitive pyjwt[crypto] extra before.

Wraith v0.2.0

Wraith v0.2.0 adds generic opaque secret capabilities for browser field fills.

Highlights

• Register process-local secret providers for library and embedded MCP use.
• Fill fields through fill_secret(index, capability) without sending plaintext through tool inputs or outputs.
• Bind capabilities to exact origins, field kinds, expiry times, and use limits.
• Share use and taint state across wrappers for one browser context.
• Block screenshots and storage-state exports after secret use by default.
• Redact editable values from agent snapshots.
• Document the Instinct browser findings and current integration boundary.
• Test the release across Python 3.10, 3.11, 3.12, and 3.13.

Instinct boundary

Wraith does not include an Instinct Vault provider. Instinct must expose a provider or broker adapter that Wraith can reach. The tested Instinct vault_fill plus execute-js path can expose plaintext, so it is not a safe adapter.

See the README and SECURITY policy for provider examples and threat limits.

Wraith v0.1.0

Wraith — the identity-borrowing stealth browser for autonomous agents.

browser-use-style agent ergonomics on top of real stealth: Camoufox (Firefox) engine, WAAP challenge-clearing, identity borrowing, residential proxies — drivable by any agent over MCP.

Highlights

• Stealth engine — Camoufox primary + patchright fallback (viewport=None, geoip).
• clear_challenge() — passes WAAP JS challenges (Reblaze/Cloudflare/Incapsula/…), _abck validity, proxy auto-rotation on 474/481/492.
• Multi-vendor detection — Cloudflare, Akamai, DataDome, PerimeterX, Kasada, Imperva, Reblaze/Link11, AWS WAF, reCAPTCHA, hCaptcha, SiteMinder.
• Identity borrowing — inject a warmed session from a real Firefox/Zen profile (beats reCAPTCHA-v3 reputation).
• Proxies — ProxyPool + DataImpulse residential provider.
• Agent layer — indexed snapshot() + index actions; MCP server (9 tools).
• 158 tests, CI green.

Responsible use: for your own accounts/data, authorized testing, research, and personal automation. Respect site ToS and the law. See the README.