Skip to content

v1.0.2 — browser-use-agent rescore + cross-platform evidence

Choose a tag to compare

View all tags
@pleasedodisturb pleasedodisturb released this 29 May 09:26
· 10 commits to main since this release
v1.0.2
fe0d2b9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release on top of v1.0. Closes follow-up work without changing v1.0's 7-MCP composite framing.

Highlights

🐞 Vendor bug: browser-use 0.12.7 MCP-agent path is broken

  • Setting OPENAI_API_KEY or ANTHROPIC_API_KEY in env makes browser-use's MCP server hang for 30s on the first browser_navigate, then return Root CDP client not initialized on every CDP-dependent tool
  • Same binary with env-LLM-keys unset (direct mode) scores 5.87 and passes S1/S2/S3/S8
  • Bisection isolates the bug to browser-use itself — reproducible without our harness via direct JSON-RPC
  • Scored as tool-bug per FAIRNESS-06, composite 0.00
  • Tracked upstream: browser-use/browser-use#4846

🌐 Cross-platform finding: Obscura Linux x86_64 phantom listener

  • obscura serve engine prints Obscura CDP server listening on ws://127.0.0.1:9222 but ss -ltn confirms the port is never bound
  • Cloud-scrape fallback blocked by SSRF guard on 127.0.0.1
  • v1.0 macOS composite of 3.27 stands; Linux is INSTALL_FAILED pending vendor fix
  • Full bisection: results/2026-05-29-linux/obscura/DEEP_ANALYSIS.md

🔬 BrowserMCP exploratory + real Chrome TLS fingerprint baseline

  • BrowserMCP works end-to-end on real Chrome (S1+S2 navigate + accessibility-tree snapshot at ~50ms/navigate)
  • Captured the operator's REAL Chrome TLS fingerprint as the production baseline for the deferred G-739 work:
    • ja3_digest: 16f5c1035ce7f60fdd6afe5224275811
    • ja4_hash: 3fc5444b6956
    • GREASE values present (0x5A5A in cipher list) — confirms real Chrome, not headless
  • New bug discovered: server.close recurses infinitely on shutdown without Chrome connection → RangeError: Maximum call stack size exceeded
  • Exploratory writeup: results/2026-05-29-browsermcp/EXPLORATORY.md

🔧 Harness portability finding (bonus)

  • v1.0's ulimit -v 4G is enforced strictly on Linux but loosely on macOS, so any Node-22 MCP child hits WASM OOM on Linux startup
  • Documented in docs/RUNNING_ON_LINUX.md (Hetzner Docker recipe + ulimit fix + per-MCP Linux status table)
  • Not patched in v1.0.x — preserves the v1.0 macOS-locked methodology

Sanity gates

  • pytest -q → 309/309 baseline holds
  • python3 -m bench.wave_close_check → all_pass=True (candidate_count=7, rubric_columns=8, terminal_craft_commits=0, no_new_mcps=True)
  • git diff v1.0 -- scoring/score.py scoring/rubric.md .mcp.json → 0 lines (sacrosanct triad byte-for-byte unchanged)

What didn't change

The published v1.0 tier matrix (PRIMARY / SECONDARY / SANDBOX-ONLY / SKIP) is byte-for-byte intact. v1.0.x is additive evidence + a corrected SKIPPED row, not a re-baseline. The macOS Obscura composite of 3.27 stands. The 7 v1.0 candidates' composites are unchanged.

Tracking

Topic Repo issue Linear Upstream
browser-use-agent rescore trigger #8 G-735 browser-use#4846
Obscura Linux A/B #9 G-737 —
Bot-detection adversary set #10 G-738 —
TLS fingerprint per MCP #11 G-739 —

Cost ledger

~$9 total for the cross-platform investigation:

  • v1.0.1 browser-use-agent rescore: ~$6 (Anthropic pass $3 + OpenAI pass $3 — both burned on outer Claude session retries against broken CDP)
  • v1.0.2 Obscura Linux: ~$3 (one Claude Code pass after ulimit fix)
  • v1.0.2 BrowserMCP probe: $0 (direct JSON-RPC, no LLM session)
Assets 2
Loading