v11.1.6: Fix smart_crawl Cloudflare bypass

Fix: smart_crawl uses extraction_type=html internally. CF Turnstile challenge pages return 200 with 40KB+ HTML, bypassing _is_js_shell detection. Crawl never escalated to the stealthy browser. Fix: add CF challenge markers to JS shell detection. Verified: smart_crawl on nowsecure.nl now uses http->stealthy escalation. 806 tests.

v11.1.5: Response.css() no longer silently returns [] on errors

Fix: removed broad except Exception: return [] from Response.css(). Errors now propagate instead of being silently swallowed. Follow-up to #3.

The broad except was hiding:

• ImportError when cssselect is missing (fixed in v11.1.4 by adding cssselect as dependency)
• SelectorSyntaxError for invalid CSS selectors (now propagates so users know their selector is wrong)

The action layer validates CSS selectors upstream via validate_css_selector(), so invalid selectors are caught before reaching css().

805 tests (1 new: test_response_css_invalid_selector_raises).

v11.1.0: Next-gen stealth engine + memory optimization

Stealth fetch: next-generation anti-detection + memory optimization

Six novel innovations based on 2026 anti-detection research (31-target benchmark, CDP protocol analysis, Cloudflare v9 behavioral scoring).

1. System Chrome auto-detection (channel=chrome)

The biggest single win from the benchmark. Uses system-installed Google Chrome instead of bundled Chromium. Real TLS fingerprint (JA4) that matches real users. Falls back to Chromium if Chrome not installed.

2. Coherent fingerprint profiles + JS-layer patches

4 internally consistent fingerprint identities. JS init script patches signals patchright does NOT handle:

• HeadlessChrome UA fix (both JS property and HTTP header)
• navigator.webdriver = undefined (patchright sets false)
• Canvas noise (getImageData + toDataURL interception, per-session deterministic)
• Permissions API consistency
• WebGL, plugins, platform, window.chrome (bundled Chromium only)

Injection via wait_until=commit + page.evaluate (patchright-compatible: CDP addScriptToEvaluateOnNewDocument and add_init_script both broken by patchright's Runtime.enable patch).

3. Human behavior simulation

Cloudflare v9 ML model weights behavioral telemetry. Bezier curve mouse movement (15-30 steps, ease-in-out, overshoot+correction), natural scroll, dwell time (1-2.5s). ~1.5-2.5s total, stealthy+humanize only.

4. CF Turnstile solver with human mouse movement

Moves mouse to checkbox via Bezier curve before clicking. Passes behavioral scoring.

5. Memory optimization

• --renderer-process-limit=1 (saves ~100-200MB per avoided process)
• --js-flags=--max-old-space-size=512 (caps V8 heap at 512MB vs default 4GB)
• Memory.simulatePressureNotification via CDP after each fetch (triggers Chrome GC + cache drop, ~5ms, non-disruptive)
• CDP session leak fix: detached after use

Live verification (real-world results)

bot.sannysoft.com: ALL checks pass (HEADCHR_UA, WebDriver, Chrome, Plugins, PHANTOM_*, SELENIUM, CHR_DEBUG_TOOLS)

Hard sites (content extracted):

• CanadianInsider (CF Turnstile, hardest 31-site benchmark target): 200 OK, 78 KB
• Medium (CF interstitial): 200 OK, 93 KB
• StackOverflow (CF): 200 OK, 1.1 MB, full question page
• NowSecure (CF challenge): 200 OK, 180 KB
• Glassdoor (DataDome): 200 OK, 849 KB

Stealth signals:

• navigator.webdriver: undefined (patched)
• navigator.userAgent: Chrome/150 (no HeadlessChrome)
• Canvas fingerprint: different per session (noise working)
• Memory: RSS decreased over 5 sequential fetches (no leak)

804 tests (43 new in test_stealth_v11.py).

v11.0.3: Self-healing entry point + stale process cleanup

Reliability: self-healing entry point + stale process cleanup

1. Self-healing CLI (cli.py)

New entry point catches ImportError on broken installs and auto-runs repair.py (writes inline if missing). Users never see a raw ModuleNotFoundError traceback again. A broken install auto-recovers on the next hound command.

2. Stale process cleanup

The detached Windows helper now kills ALL hound.exe processes before running pip, not just in the --reinstall path. Prevents stale servers (e.g. Pi extension singleton) from surviving an update and running old code.

3. Doctor stale process detection

hound --doctor now includes a 'no stale servers' check. Reports running PIDs and suggests the kill command.

4. Doctor browser deps fix

Removed curl_cffi from the browser deps check (no longer a dependency since v11.0.0).

761 tests (8 new).

v11.0.2: Fix smart_fetch and smart_crawl broken

Fix: smart_fetch and smart_crawl completely broken

The scrapling removal in v11.0.0 broke smart_fetch and smart_crawl. follow_redirects defaults to the string 'safe' (scrapling's API), but primp expects a bool. The string was passed directly to primp.Client.get() causing a TypeError on every fetch.

Fix: HTTPSession.get() coerces follow_redirects from string to bool before passing to primp.

v11.0.1: Fix self-update for new core deps

Fix: self-update installs core deps

The v10.x self-update used --no-deps to avoid pulling the heavy [all] extras. This was correct when the core dep tree didn't change between versions.

v11.0.0 added markdownify as a new core dep. --no-deps skipped it. After updating from v10.4.1, import master_fetch crashed with ModuleNotFoundError because markdownify wasn't installed.

Fix: drop --no-deps from the primary update pass. pip install hound-mcp==TARGET (no --no-deps, no [all]) installs hound-mcp + any missing core deps, but does NOT pull the heavy [all] extras.

753 tests pass.

v11.0.0: Scrapling dependency removed entirely

Scrapling dependency removed entirely

Hound no longer depends on scrapling. All scrapling functionality is replaced with hound's own modules using the underlying libraries directly (primp, patchright, browserforge, trafilatura, lxml, markdownify).

New modules:

• fetcher.py: Response class + HTTPSession (primp-based HTTP fetch with TLS impersonation)
• browser.py: StealthyBrowser + DynamicBrowser (patchright-based) + Cloudflare Turnstile solver
• extractor.py: Content extraction (trafilatura + markdownify)

Dependency changes:

• scrapling removed from core deps entirely
• curl_cffi, msgspec, protego, click, apify-fingerprint-datapoints removed (scrapling transitive deps)
• markdownify added to core deps (HTML->markdown fallback)
• patchright, playwright, browserforge remain in [all] extra

753 tests pass (29 new tests for the replacement modules).

v10.5.0: Termux/Android support + HTTP-only graceful degradation

Termux/Android install fix + HTTP-only graceful degradation

The lean install (pip install hound-mcp) no longer pulls playwright (which has no wheels for Termux/aarch64). Browser deps moved to the [all] extra with loose pins.

When browser deps are unavailable, hound runs in HTTP-only mode: fetch, search, and crawl work via httpx + trafilatura. Stealthy browser escalation and screenshot are disabled with clear error messages.

What works in HTTP-only mode: web_fetch (HTTP tier), web_search, web_crawl, cache_clear, hound_version
Disabled: stealthy browser escalation, web_screenshot, persistent browser sessions

Doctor adds a browser deps check (non-blocking, reports HTTP-only mode when missing).

742 tests pass (18 new graceful degradation tests).

Hound 10.4.1

Removed Internet Archive fallback (slow, unreliable). Added hound --reinstall. Fixed doctor [all] extras check. 724 tests.

Hound 10.4.0

Universal error detection: 4xx/5xx no longer treated as real content. Clean error messages. Pi extension hardening (lazy exe resolution, AbortSignal, version sync, git install fix).