human-browser 4.5.0 → 4.6.0

package/SKILL.md

@@ -1000,4 +1000,41 @@ cost: $0.58
 viewer: https://humanbrowser.cloud/a/s_xyz?k=...
 ```
 
+#### Zombie protection (v78+)
+
+Two server-side mechanisms prevent client timeouts from accumulating zombie sessions and exhausting `HB_MAX_SESSIONS_PER_TOKEN` (default 10):
+
+**Profile mutex on /spawn:** if the same `(token, profile)` already has an active session, `/spawn` returns the EXISTING session info with `"reused": true` instead of creating a new one. To force a fresh session anyway, pass `body.force_new: true`. Ephemeral spawns (no profile) bypass the check.
+
+```jsonc
+// Second /spawn with profile=main → reuse existing
+{
+  "sessionId": "s_existing...",
+  "password": "...",
+  "viewerUrl": "...",
+  "profile": "main",
+  "reused": true,
+  "createdAt": 1778529919000,
+  "lastActivityMs": 1778530100000
+}
+```
+
+**Auto-die after done:** once an agent emits `ev:done`, the session-server waits 5 minutes (`HB_DONE_GRACE_MS`, default 300000) for either a new `/run` or a new WS client to attach. If neither arrives → the session-server exits and spawner-router reaps the slot. Failed sessions (state=error) use a shorter 2-min grace (`HB_ERROR_GRACE_MS`). The 3-hour spawner-router idle reaper still exists as a backstop for sessions that never reached done.
+
+#### Admin session control (v78+, master skill token only)
+
+```bash
+# List all active sessions across all tokens
+curl -sX GET https://agent.humanbrowser.cloud/admin/sessions \
+  -H "Authorization: Bearer $HUMANBROWSER_SKILL_TOKEN"
+# → { "sessions": [{ sessionId, tokenHash, tokenOwner, profile, viewerUrl,
+#                    httpPort, cdpPort, wsClients, ready, exited,
+#                    lastActivityMs, ageMs, lastTaskAt, spawnedAt }], total, max }
+
+# Force-stop a specific session
+curl -sX DELETE https://agent.humanbrowser.cloud/admin/sessions/s_xxx \
+  -H "Authorization: Bearer $HUMANBROWSER_SKILL_TOKEN"
+# → { "ok": true, "sessionId": "s_xxx", "reason": "admin-kill" }
+```
+
 > **Note on multi-turn**: the A2A spec describes an `input-required` state for tasks that need follow-up input. The current cloud build runs every task to terminal in one shot — multi-turn resumption is reserved in the protocol but not yet wired up server-side. Use `tasks/cancel` and submit a fresh task if you need to redirect.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "human-browser",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Stealth browser for AI agents. Bypasses Cloudflare, DataDome, PerimeterX. Residential IPs from 10+ countries. iPhone 15 Pro fingerprint. Drop-in Playwright replacement — launchHuman() just works.",
   "keywords": [
     "browser-automation",