Ghostfox v0.5.0 — Behavioral Authenticity + Safety

v0.5.0: The reliability release.

New Tools:

• confirm_action — safety gate for irreversible actions on sensitive pages
• page_dismiss_modal — auto-dismiss cookie banners, newsletter popups, overlays

page_a11y Enhancements:

• danger_zone — flags financial/medical/legal/auth pages so agents slow down
• suspicious_elements — prompt injection pattern detection + hidden content flagging
• login_state — strong-signal detection (no more false positives)

Improved Tool Descriptions (all 21 tools):

• Every tool now documents: what it does, when to use it, what it returns, and when to prefer a newer alternative
• CSS selector tools now explain they're legacy and recommend ref-based alternatives

Platform:

• LICENSE: pure MIT (GitHub auto-detectable)
• glama.json: correct Glama platform format
• NOTICE: dual-license + third-party credits

Ghostfox v0.4.0 — session awareness

Agents now see session health in every a11y snapshot.

page_a11y now returns:

• login_state: "logged-in" | "logged-out" | "unknown" — detected from login buttons vs user-menu signals
• page_url + page_title — full page context
• elements — same as before (stable refs, roles, names, values, shadow DOM + iframe piercing)

No more acting blind on a dead session.

Ghostfox v0.3.1 — gap closing

Closes four known gaps from the v0.3.0 launch:

• page_read_ref — full-value read by ref, no 200-char truncation
• page_wait_for — poll until selector visible (replaces sleep guessing)
• page_upload_file — upload local files to input[type=file] via synthetic DataTransfer
• a11y walker pierces same-origin iframes in addition to shadow roots

Engine unchanged; this release ships the runtime binary.

Ghostfox v0.3.0 — eyes for agents

The release that came from a live soak test: driving Reddit end-to-end exposed every blindness of selector-based automation — so we built the fix.

New: page_a11y — the semantic snapshot
One call returns every visible interactive element with a stable ref, role (button/link/textbox/...), accessible name and CURRENT value — and it walks shadow DOM, so web-component UIs (Reddit's shreddit-*, modern frameworks) are fully visible. The title field that hides inside a custom element's shadow root shows up as textbox "Title" like any other field.

New: act by ref — no selectors

• page_click_ref — clicks by ref, scrolls into view first
• page_type_ref — types by ref into plain inputs AND rich editors (Lexical/Draft/ProseMirror) via the editor-native paste path, with fire-then-verify receipts for async editors

Proven the day it was born: the Reddit composer that defeated selector automation for hours was reduced to 4 tool calls (a11y snapshot → type title → type body → click Post). The launch post that shipped with this release was posted by it.

Also in 0.2.1 (earlier today): page_eval, headful sessions, fill receipts, stale-context recovery, scroll-into-view clicks.

Prebuilt engine: unchanged from v0.2.0 (six platforms on that release's assets). This release ships the runtime binary; engine builds for this tag run in CI and attach automatically.

Ghostfox v0.2.1 — see what the agent sees

Reliability release from a real-world soak test (driving Reddit end-to-end with logged-in sessions).

New

• page_eval MCP tool — JS introspection in the main frame; diagnose forms and state like the devtools console
• Headful sessions — session_create {"headful": true} opens a real window (humans watching agents, debugging, manual-login-then-automate flows)
• Fill receipts — page_fill now returns landed_chars vs requested: silent page swaps can't eat a fill unnoticed

Fixed

• evaluate: stale execution contexts are cleared and retried against the replacement (live-reloading pages no longer poison subsequent operations)
• click: elements are scrolled into view before mouse dispatch — below-the-fold buttons work
• Page.close uses the juggler method this build implements
• Firefox UA major read from the engine's application.ini (152), not hardcoded

Prebuilt engine: unchanged from v0.2.0 (six platforms on that release). This release ships the runtime binary.

Ghostfox v0.2.0 — touch-coherent personas + evidence tooling

Second release — the stack now matches the hosted platforms' evidence story and closes the mobile gap.

Highlights

• Touch-coherent Android personas: navigator.maxTouchPoints at the C++ level (engine patch), coarse pointer + touch events via the engine's touch override, portrait viewports from the identity
• page_screenshot (viewport + full page) saved as evidence
• Live view (GHOSTFOX_LIVE_VIEW_PORT): watch your agent work
• captcha_solve hook (2captcha)
• Major fix: iframe contexts no longer hijack page evaluation
• Python package: pip install ghostfox (installer + client)
• Docker: ghcr.io/autokeren/ghostfox

Prebuilt engine (Linux x86_64) — unpack, set GHOSTFOX_HOME at the ghostfox/ folder.
Runtime — prebuilt ghostcloak-mcp attached; or cargo build from runtime/.

Verified: 500/500 identity coherence (incl. Android), 4/4 live-target probe ok (datacenter IP), E2E MCP round-trip incl. screenshots + evidence.

Testing/research tool. Do not use against targets you don't have permission to test.

Ghostfox v0.1.0 — first flight

First release of the monorepo.

What's inside

• Ghostfox engine: Firefox 152.0.4-beta.30 + Camoufox anti-detect patches, rebranded, original artwork
• Ghostfox runtime: Rust MCP server (ghostcloak-mcp) — build from source: cd runtime && cargo build --release

Prebuilt engine (Linux x86_64)
Unpack, then point GHOSTFOX_HOME at the unpacked ghostfox/ folder. See the README quickstart.

Verified: identity coherence 500/500, full MCP round-trip E2E (create → open → fill → click), navigator.webdriver false, engine-level spoofing (UA/cores/screen/tz/locale match the identity).

Known issues: CreepJS-class fingerprint test sites can crash the engine (upstream bug); Google may serve challenges on datacenter IPs.

This is a testing / research tool. Do not use against targets you don't have permission to test.