v1.1.4

Fixes

• Desktop browser sessions work again. Bundles @testingbot/automation-mcp 0.1.8. 0.1.7 sent the legacy JSON-Wire platform capability alongside the W3C platformName, and the webdriver client rejects any top-level capability that is neither standard W3C nor colon-namespaced as soon as an extension capability (tb:options) is present. Every desktop session failed client-side with Invalid or unsupported WebDriver capabilities found ("platform") before a request reached the hub. Mobile sessions were unaffected, which is why the failure looked like "desktop is broken, mobile works". See testingbot/automation-mcp#4.

  Note on who was actually affected: the dependency range ^0.1.7 already admitted 0.1.8, so a fresh npm install @testingbot/mcp-server picked up the fix on its own. The .mcpb bundle did not — build-mcpb.sh runs npm ci --omit=dev, which installs exactly what the lockfile pins. This release refreshes that pin, which is the substance of the change.

• screenResolution is applied again. TestingBot reads the kebab-case screen-resolution key inside tb:options; the camelCase spelling was dropped silently and desktop VMs stayed at the 1280x1024 default.

• tb_navigate no longer returns on a half-built DOM. New waitUntil (load / domcontentloaded / none) and timeoutMs parameters confirm document.readyState directly instead of trusting the session's pageLoadStrategy, which on pages with slow third-party resources returned early. A timeout warns rather than failing the call, since the navigation itself succeeded.

• tb_listSessions no longer points at a tool that doesn't exist. Its description referenced tb_appiumEndpoint, which was never registered; it now points at appium_session_management (action: 'list'), which actually owns mobile sessions.

Breaking

• Node 20 is now the minimum (was 18). engines.node, preflight(), and the README all claimed 18, but the bundled @testingbot/automation-mcp hard-fails its own preflight below 20 — so a Node 18 install succeeded and then died at startup with an error pointing at the dependency rather than the runtime. Node 18 has been end-of-life since April 2025. Anyone affected was already non-functional; they now get an accurate error at the right layer, and npm warns at install time.

Security

• Secret-bearing tool arguments are redacted in logs. The CallTool handler logs { tool, args } wholesale, and args.text — tb_type's payload, i.e. whatever gets typed into a login form — was not covered. Now redacted along with args.capabilities, args.remoteServerUrl, and generic *.secret / *.token / *.accessKey. Only reachable under debug or dev logging, as the default level is error.

• Credentials no longer reach the appium-mcp child. The env filter stripped TESTINGBOT_KEY/TESTINGBOT_SECRET/TB_KEY/TB_SECRET but not TESTINGBOT_USERNAME/TESTINGBOT_ACCESS_KEY, which getConfig() also accepts. Anyone configured via those names passed them into the child process, contradicting the design that the child receives credentials only baked into the injected hub URL.

Internal

• SessionManager survives closeAll() — the shutdown flag latched on permanently, leaving the manager dead to all later registrations. Relevant here because server-factory.ts calls addAutomationTools a second time on reconnect.
• Locator fixes upstream: ids starting with a digit get CSS's hex escape, by: "class" with multiple classes builds a compound selector, and "+" is pressable.

Full changelog: v1.1.3...v1.1.4