Skip to content

v3.0.0 — Enterprise Hardening, Part 2

Latest
Latest

Choose a tag to compare

View all tags
@shanewas shanewas released this 18 Jul 13:13
· 1 commit to master since this release
Immutable release. Only release title and notes can be modified.
v3.0.0
bd4e640

Large enterprise-readiness pass. One breaking change; everything else additive or behavior-preserving. Full detail in CHANGELOG.md.

⚠️ Breaking

  • MCP approval gate is now fail-closed by default. Sensitive actions (execute_js, stealth_launch, navigate to unknown domains, run_workflow, stealth_replay) return MCP_APPROVAL_REQUIRED until approved. Set STEALTH_APPROVAL_MODE=permissive to restore the previous auto-approve behavior.

Highlights

  • Auditability: success audit records, HMAC-keyed tamper-evidence chain (verify_audit_chain), log rotation/retention, recursive + token redaction.
  • Dashboard RBAC: per-user viewer/operator roles, attributable operator audit log, boot refuses the default password, /metrics + /api/usage.
  • Supply chain: hash-pinned universal lockfile, blocking pip-audit + bandit + gitleaks, SBOM + build-provenance attestation, SHA-pinned Actions, py.typed.
  • CI is now a real gate: blocking mypy, coverage 55%, Python 3.10–3.13 + cross-OS matrix.
  • Reliability: launch driver-leak fix, opt-in respect_robots, per-session request budget.
  • Architecture: inverted layering resolved, dashboard HTML + MCP handlers extracted, stable from core import AgentBrowser facade.
  • Governance/compliance: acceptable-use, governance, DCO, incident-response, key-management, data-handling, backup/DR docs.

CI green on master (Python 3.10–3.13 + ubuntu/windows/macOS, blocking mypy + pip-audit + bandit) before release.

Assets 3
Loading