Skip to content

v2.4.0 — Attach-Mode Hardening

Choose a tag to compare

View all tags
@shanewas shanewas released this 01 Jun 15:32
· 28 commits to master since this release
Immutable release. Only release title and notes can be modified.
v2.4.0
0975b8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.4.0 — Attach-Mode Hardening

Closes the 4 Clawpatch findings from the PR #437 review: #438, #439, #440, #441.

What's new

  • Two-layer host safety gate in stealth_attach_over_cdp — is_loopback_host (literal/IP/DNS) + is_url_safe (RFC-1918 / link-local / cloud-metadata). Closes DNS-rebinding / hostname→private-IP bypass.
  • fe80::/10 (link-local IPv6) added to _BLOCKED_NETWORKS. Side-effect of the gate refactor.
  • add_init_script install failure now surfaces in the return payload as stealth_applied: false + stealth_error: "<Type>: <message>". New stealth_requested field distinguishes caller intent from actual install result.
  • TeardownMode enum replaces the 3 scattered getattr flag checks in close(). Each branch owns exactly one teardown (LAUNCHED | POOLED | ATTACHED_OWNED_CTX | ATTACHED_ADOPTED_CTX).

New helper

is_loopback_host(url: str) -> bool in production/mcp_server.py — literal/IP/DNS loopback check. Used by the attach loopback gate.

Test coverage

22/22 pass in tests/test_attach_over_cdp.py + tests/test_mcp_url_safety.py. No new regressions.

Install

pip install --upgrade agentic-stealth-browser

Now requires Python 3.10+ (unchanged from 2.3.0).

Assets 3
Loading