Hycli v0.1.1

Highlights

• Fixed private dashboard bootstrap and process-control isolation following the report in #54.
• Retained the offline ACCOUNT_READ guide in MCP bundles.
• Strengthened release-publisher artifact validation.
• Included CLI stdout/evidence fixes and validation for updates to missing gaps.

Contributors and acknowledgements

Thank you to everyone whose code, reports, and proposals helped shape v0.1.1:

• @Hybirdss — maintenance, architecture, integration, regression coverage, native packaging and release preparation; stdout delivery-error handling, malformed evidence-list validation, missing-gap update validation, and release-publisher validation (#3, #4, #70, #71, #72, #73, #74).
• @ytw418 — AI-refusal diagnostics, preservation of previously prepared actions, and preparation-prompt hardening (#13, incorporated through #14).
• @jjigmeok-dev — feedback/community entry points, issue templates, native MCP bundles, and registry metadata tooling (#15, #16, incorporated through #17).
• @seungwonme — session diagnostics, identity verification, and credential-echo regression tests (#26); pagination, browser-session permissions, verified-account reads, browser-suite reliability, OAuth refresh, and API-denial reports/proposals (#21, #22, #23, #24, #41, #42).
• @kayboram — browser-discovery filtering, login-session identity support, and response-contract regression coverage (#53, integrated through #57).
• @sesol-lumen — preflight Bearer-header compatibility and the cross-account preference-cookie output correction (#58, #60, integrated through #63 and #61).
• @122yjs — the detailed macOS native-discovery cancellation and repeated Keychain-prompt report (#49, addressed in #50).
• @mechurisr — the dashboard launch-credential exposure report (#54), incorporated through #67 and #74.

Build and verification

• Release commit: 1955c6b2c01e547a34a9207ac41c9be6a8acef41.
• Build source: GitHub Actions run 40869523374.
• Six native CI matrix jobs passed: Linux, macOS, and Windows, each on x64 and ARM64. CLI, MCP, and installer checks passed in CI.
• Release artifact bytes, metadata, and checksums were audited against that run.

Acceptance limits

• Native browser acceptance: NOT RUN. Browser handoff, authenticated wrong-origin shutdown, settings restart, and browser Quit were not exercised end-to-end. These checks were explicitly waived by the maintainer for this version; they are not reported as passing.
• A separately ignored Chromium test is not a pass.

Platform notices

• Linux x64 and ARM64: glibc 2.39 or newer required. Both CLI ELF binaries have a measured GLIBC symbol floor of 2.39; the MCP bundles embed the identical CLI binaries, and the DEB packages declare libc6 >= 2.39.
• macOS: ad-hoc-signed testing artifacts. These builds are not Developer ID signed or notarized. Gatekeeper acceptance remains unverified.
• Windows: unsigned artifacts. Windows trust prompts may appear.

Distribution

This publication is a GitHub Release. It does not claim publication to an MCP registry.

Hycli 0.1.0

Automate any website, with changes only where you allow them.

Highlights

• Resilient WAF/CAPTCHA Defense & Rendered Escalation: Precise challenge detection without false-positive 200/403 lockouts, coherent browser Fetch Metadata (Sec-Fetch-*, Accept, Referer/Origin), bounded request micro-jitter, 30s circuit breaker auto-recovery, and automatic static HTTP -> rendered Chromium (fetch_rendered) escalation on JS/WAF challenges.
• Multi-Cookie Preflight, JSON-in-JSON Storage & Embedded SSR Islands: Full Set-Cookie header inspection in preflight steps, nested JSON string unwrapping in storage:<key>#<pointer>, sibling subdomain cookie sharing across eTLD+1, and data-target / data-island / data-ssr JSON island extraction.
• Structured Self-Interrogation (self_qa) & Full SiteSpec v2 Parity: Adversarial self-Q&A across all preparation phases and deterministic fast recon (hycli recon).