v2.0.1 — running-browser detection actually works
Running 2.0.0 for real on a live machine exposed three defects in ech-browsers.sh, one of which meant an advertised safety property had never worked. Recommended upgrade for anyone on 2.0.0.
Fixed
The "will not edit a running Chromium" guard never fired. It tested [ -e SingletonLock ], but that lock is a symlink to hostname-pid — not a real path — so -e follows it and returns false every time. Only -L can see a dangling symlink.
A sandboxed browser's lock records its namespace pid. Testing that against host pids is not merely unreliable but actively wrong: a stale Flatpak lock named pid 2, and pid 2 is kthreadd, alive on every Linux system ever booted. That is why a closed browser was reported as running. Both detectors now look for an open file descriptor under the profile — the only evidence that survives sandboxing — and consult lock files only for non-sandboxed profiles.
The descriptor scan then failed silently under pipefail. find -print -quit | grep -q . lets grep close the pipe on first match, find dies of SIGPIPE with status 141, and pipefail reports the pipeline as failed — so the check returned "not running" precisely when it had found something. It passed in isolation because that shell had no pipefail.
Hand-set prefs were duplicated rather than replaced. Applying to a profile that already had ECH configured by hand left every pref defined twice — harmless while the values agreed, a silent conflict the moment they did not. Pre-existing copies are now commented out as // PANOPTES-SUPERSEDED, and --revert restores them.
Tor Browser and Mullvad Browser tarball paths added to the skip table, so the report names them explicitly. Safety never rested on that list — the browser table is an allowlist and an unlisted profile is never written to — but a skip you cannot see in the output is not a skip anyone should have to take on faith.
Added
The README now explains what ECH is and why it matters: that HTTPS leaves the hostname in the clear, that encrypting DNS hides the question while SNI announces the answer, and that ECH and secure DNS are one mechanism rather than two features. It also says plainly what ECH does not do — your IP is still visible, the site has to publish a config, traffic analysis survives — because overselling it helps nobody.