Releases

Releases

Current: v1.9.0 (2026-10-08). Distribution channels: Homebrew (brew install slabbdev/tap/navette, macOS arm64), crates.io (cargo install navette-browser), ghcr.io (ghcr.io/slabbdev/navette, amd64 + arm64), and the official MCP registry (io.github.slabbdev/navette). Release notes live under Releases on GitHub; this page is the narrative history.

v1.9.0 (2026-10-08) — native keyboard input, verified

• Native key input on macOS, verified: show_window is the focus gate (the ghost's window becomes a titled, key window — the Window Server must confirm isKeyWindow before any CGEvent is posted, so a keystroke can never land in someone else's app); single characters ride with an attached unicode string, so the delivered e.key is what the agent asked for on any keyboard layout (verified on AZERTY: a, Enter, Z, Tab, ArrowLeft all landed isTrusted: true in native mode); delivery is verified in-page before mode: native is ever reported — anything less falls back to synthetic, honestly.
• All three engines ship attempt-first native input: SendInput (Windows, verified end-to-end), XTEST (Linux/X11), CGEvents (macOS, verified).
• NAVETTE_EVAL_TIMEOUT_SECS (default 20, clamped 5–300) for slow/contended environments (#7 mitigation).

v1.8.1 (2026-10-08) — session isolation, CI-enforced

• Session isolation, CI-enforced on every engine: each session gets its own WebView2 profile + InPrivate on Windows (InPrivate alone shares one profile across controllers — measured), non-persistent WKWebsiteDataStore on macOS, isolated WebContexts on Linux; a cross-session cookie leak now fails the build on all three OSes.
• Security hardening: constant-time token comparison, DNS-rebinding Host guard (non-local Host → 403, /health exempt), proxy-credential redaction in logs, docs/SECURITY.md.
• demo/signed-webhook — sealed counterparty events, fraud analysis as a diff (HMAC-chained mock, closes #5); tollbooth dataset went CC BY 4.0 with x402/paywall signals.

v1.8.0 (2026-10-08) — visible windows, pointer events, the kit

• session_show/session_hide bring a ghost session on-screen with its page state intact for one-time human logins (OAuth, 2FA, captchas), then park it off-screen again.
• /click dispatches pointerover/pointerdown/pointerup before the mouse events — Radix/headless-UI components open like they do for a human.
• macOS /wait boolean-stringification bug fixed (the bridge reports 1, the probe expected true — every present selector "timed out").
• Internals: the backend contract is now the webviewkit kit, compile-enforced per backend.
• Tollbooth round 2: the walled-web bench measures x402/paywall signals alongside robots.txt AI clauses and llms.txt (200 URLs × 5 categories). A full working recipe — publish on a site with no API — ships as demo/dailydev.

v1.7.0 (2026-10-07) — native keyboard + operator release

• POST /key attempts real OS-level events first (CGEvent / SendInput / XTEST — isTrusted: true) and falls back automatically to synthetic dispatch, reporting which mode ran. Windows verified end-to-end; macOS and headless Linux fall back cleanly (issue #3).
• Operator flags: --token (Bearer auth), --proxy (HTTP CONNECT / SOCKS5), --user-agent (per-serve override).
• Idle-release watchdog: serve --idle-release MIN — sessions drop, daemon stays resident, next request re-warms (~100 ms).
• 18 MCP tools including file upload (page-side DataTransfer) and scroll; published on crates.io as navette-browser; bench workflow across all three engines; CI green on all three OSes.

v1.6.0 — operator + linux-arm64

--token, --proxy, --user-agent landed; linux-arm64 release asset.

v1.5.0 — idle-release + tollbooth

Idle-release watchdog, the tollbooth bench harness, the native-vs-ML extraction trade documented.

v1.4.1 — containers + registries

Container image (ghcr, amd64+arm64), --help/--version, brew tap, official MCP registry listing.

v1.3.0 — full platform parity

Native screenshots per engine, cookie state export/import, viewport control, resident daemon everywhere, hover + key, auto-handled dialogs.

Post-1.9.0 (main branch)

• Per-site memory (sites/) — machine recipes + acquired pages, skill wiring, bench (−98.8% bytes vs cold exploration), the hard close-of-pass rule.
• Passkey ceremony plumbing — WKUIDelegate panel runner, kit capability, per-session auth state; the measured wall (Team ID signing) and the retest path are documented in Secrets and Logins and Roadmap and Known Gaps.
• daily.dev recipe — feed, post+comments, search, profile, bookmarks, notifications; selectors + JS live-verified.
• n8n community node 0.3.x — action-first names, AI-agent tool support, the self-driving "Browse for me (AI)" operation; see n8n Integration.