Skip to content

v1.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jun 10:40
· 321 commits to main since this release
v1.8.0
3b8dddd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Highlights

The headline of this release is WebView node collapsing: get_screen_state now compresses Chromium WebView accessibility trees by ~60% with zero content or tap-target loss — making the huge class of WebView-based and hybrid apps (news readers, e-commerce, in-app browsers, Cordova/Capacitor apps) practical to drive for the first time, instead of drowning the model in thousands of nodes. This release also brings full Claude.ai / Claude Desktop support via custom connectors, cursor pagination for get_screen_state, a new dismiss_keyboard tool, debounced node-cache invalidation for fresher elements after UI transitions, an experimental event channel system, and a security sweep (BouncyCastle, Netty, Testcontainers/docker-java).

🔌 Claude.ai & Claude Desktop Support

This release is fully usable from Claude.ai and Claude Desktop as a custom connector. Because those clients can't attach a custom Authorization header, the MCP bearer token can now be left empty (PR #98), and the README documents the complete custom-connector setup (PR #102).

New Features

  • WebView Node Collapsing (PR #104) — The big one. Chromium WebViews expose one accessibility node per DOM element, which used to explode get_screen_state into thousands of nodes on content-heavy pages — overflowing the model's context and leaving WebView apps effectively undrivable. A new content-preserving layer uses the Chromium chromeRole/targetUrl extras (populated for free by Chrome and the Android System WebView — no root, no injection) to merge non-interactive nodes into their containers with light markdown, cutting node count ~60% on real pages while losing zero text and keeping every tap target. This unlocks the large universe of apps that embed WebViews — news, shopping, hybrid/Cordova/Capacitor apps, in-app browsers. Scoped strictly to web content; native and Compose UIs are untouched. (#92)
  • get_screen_state Pagination (PR #103) — Cursor-based pagination splits large screens into 200-node pages with a continue cursor, bounding output so even big native screens no longer overflow the context window. Complements the WebView collapse. (#92)
  • Optional Auth Tokens → Claude.ai / Claude Desktop (PR #98) — The MCP bearer and event-channel tokens can now be left empty, enabling clients that can't send a custom Authorization header (notably Claude Desktop / Claude.ai custom connectors). Includes UI Clear controls with security-warning banners, --es bearer_token "" ADB support, and one-shot install-time token generation hardened against a TOCTOU race.
  • dismiss_keyboard MCP Tool (PR #101) — Closes the soft keyboard only when one is open (a safe no-op otherwise, unlike press_back which can navigate away), plus post-typing guidance so agents dismiss it before tapping covered elements.
  • Event Channel System — ⚠️ Experimental / Alpha (PR #90) — An opt-in system that forwards device events (notifications, Wi-Fi, geofence) to external endpoints via HTTP POST, with a Claude Code channel plugin to receive them. Requires manual setup to try — endpoints and the receiving plugin must be configured by hand; it is not yet wired for one-click use. Also adds an AppIconCache singleton with background refresh for app-list caching.

Improvements

  • Debounced Node-Cache Invalidation on Window Transitions (PR #100) — Keyboard show/hide, rotation, and dialog/activity transitions shift element bounds and stale the cached id → node map. A new CacheInvalidationDebouncer drops the cache once events settle (250 ms quiet), never mid-animation; TYPE_WINDOW_CONTENT_CHANGED is excluded to avoid thrashing.

Security / Dependencies

  • BouncyCastle → 1.84 (PR #93)
  • Netty → 4.2.15.Final (PR #105) — clears HTTP-smuggling / DoS / SNI / hostname-verification CVEs in the Ktor engine.
  • Testcontainers → 2.0.5 / docker-java 3.7.1 (PR #106) — replaces the older e2e bundle that shaded vulnerable Netty/BouncyCastle; drops the removed junit-jupiter artifact.

Documentation

  • Claude.ai / Claude Desktop Connector Setup (PR #102)
  • README curl Examples (PR #89) — adds the missing Accept header and MCP session init.

What's Changed

  • fix: add missing Accept header and session init to README curl examples by @danielealbano in #89
  • feat: event channel system + docs restructure by @danielealbano in #90
  • feat(auth): make MCP bearer + event-channel auth tokens optional by @danielealbano in #98
  • feat(accessibility): invalidate node cache on settled window transitions by @danielealbano in #100
  • feat(tools): add dismiss_keyboard MCP tool and post-typing guidance by @danielealbano in #101
  • docs(readme): add Claude.ai / Claude Desktop custom connector setup by @danielealbano in #102
  • feat(mcp): paginate get_screen_state to bound output size (#92) by @danielealbano in #103
  • feat(accessibility): collapse WebView nodes in get_screen_state by @danielealbano in #104
  • chore(deps): bump org.bouncycastle:bcpkix-jdk18on from 1.83 to 1.84 in the gradle group across 1 directory by @dependabot[bot] in #93
  • chore(deps): bump the gradle group across 1 directory with 4 updates by @dependabot[bot] in #105
  • chore(deps): bump Testcontainers to 2.0.5 by @danielealbano in #106

New Contributors

Full Changelog: v1.7.0...v1.8.0

Contributors

danielealbano and dependabot
Assets 3
Loading