agentic-stealth-browser 2.6.0__tar.gz → 2.7.0__tar.gz

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/CHANGELOG.md

@@ -9,6 +9,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.7.0] — Enterprise Hardening (2026-07-18)
+
+Auditability, supply-chain, and business-facing hardening from a full enterprise
+audit. No breaking changes; no runtime behavior change on existing flows.
+
+### Added
+- **Acceptable Use Policy** (`ACCEPTABLE_USE.md`) + a `## Legal & Acceptable Use`
+  section in the README — authorized-use scope, prohibited uses (ToS/robots/CFAA/
+  GDPR-CCPA), operator responsibility, and rate-limit good-citizenship, for an
+  anti-bot tool that enterprise/legal review can pass through procurement.
+- **Compliance docs** (`docs/`): `INCIDENT_RESPONSE.md` (credential/key-compromise
+  playbook, triage severities, post-incident), `KEY_MANAGEMENT.md` (secret
+  inventory + env sourcing + rotation), `DATA_HANDLING.md` (what is persisted,
+  data-controller statement, retention + deletion posture).
+- **Navigation success/failure metrics** (`core/agent_browser.py`): `safe_goto`
+  now emits `requests_success` / `requests_failed` counters and calls
+  `metrics.record_error("navigation", …)` on failure, so `MetricsCollector`'s
+  `success_rate` reflects real traffic instead of being permanently 100%.
+
+### Changed
+- **Dependency lower bounds** (`pyproject.toml`): the seven previously-unpinned
+  runtime deps and the four dev deps now carry `>=` floors set to
+  CVE-safe/current releases (e.g. `aiohttp>=3.10.11`, `cryptography>=43.0.1`,
+  `jinja2>=3.1.5`), so a fresh install can no longer resolve a known-vulnerable
+  release. No upper caps — existing installs are unaffected.
+- **README claims hedged** for an enterprise audience: the tagline and the
+  "zero-flag" line are now framed as a point-in-time canary snapshot, not a
+  guarantee.
+- `pyproject.toml` version 2.6.0 → 2.7.0; MCP `clientInfo.version` handshake
+  strings in the two stdio adapters aligned to 2.7.0.
+
+### Security
+- **Release-metadata gate** (`.github/workflows/publish.yml`): the build job now
+  runs `twine check --strict dist/*` before upload, so malformed metadata can no
+  longer burn an immutable PyPI version.
+- **SECURITY.md supported-versions table** corrected from a stale `0.8.x` to
+  `2.7.x` (`< 2.7` unsupported), with a note that the table is updated every
+  release.
+
+### Testing
+- The five live-Chromium attach tests in `tests/test_attach_over_cdp.py` are now
+  marked `@pytest.mark.e2e`, so the default (non-e2e) CI run no longer errors when
+  a browser is unavailable and the deterministic subset stays green.
+
 ## [2.6.0] — Stealth & MCP Hardening (2026-07-12)
 
 ### Added

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-stealth-browser
-Version: 2.6.0
+Version: 2.7.0
 Summary: Production-grade, human-mimicking browser automation framework for autonomous agents. Survives modern anti-bot systems.
 Author-email: Shane W <shanewas@users.noreply.github.com>
 License-Expression: MIT
@@ -23,23 +23,23 @@ Classifier: Framework :: AsyncIO
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: playwright
-Requires-Dist: aiohttp
-Requires-Dist: cryptography
-Requires-Dist: pyyaml
-Requires-Dist: fastapi
-Requires-Dist: jinja2
-Requires-Dist: uvicorn
+Requires-Dist: playwright>=1.45
+Requires-Dist: aiohttp>=3.10.11
+Requires-Dist: cryptography>=43.0.1
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: fastapi>=0.115.0
+Requires-Dist: jinja2>=3.1.5
+Requires-Dist: uvicorn>=0.32.0
 Provides-Extra: dev
-Requires-Dist: pytest; extra == "dev"
-Requires-Dist: pytest-asyncio; extra == "dev"
-Requires-Dist: pytest-cov; extra == "dev"
-Requires-Dist: httpx; extra == "dev"
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pytest-cov>=5.0; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
 Dynamic: license-file
 
 # Agentic Stealth Browser
 
-**Playwright gets detected. This doesn't.**
+**Playwright gets detected. This is much harder to detect.**
 
 [![CI](https://github.com/shanewas/agentic-stealth-browser/actions/workflows/ci.yml/badge.svg)](https://github.com/shanewas/agentic-stealth-browser/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
@@ -51,6 +51,10 @@ Dynamic: license-file
   <img src="assets/hn-demo.gif" alt="Agentic Stealth Browser Demo" width="90%">
 </p>
 
+## Legal & Acceptable Use
+
+This is an anti-bot-evasion tool. Read the [Acceptable Use Policy](ACCEPTABLE_USE.md) before use — you are responsible for using it lawfully and within the target site's Terms of Service.
+
 ## What is this
 
 A production-grade stealth browser automation library for Python, built on Playwright.
@@ -95,7 +99,8 @@ Sites don't just check your User-Agent anymore. They check *everything*:
 | **Account warming** | Nothing | 14-day graduated ramp-up per account |
 
 Result: **passes bot.sannysoft.com, pixelscan.net, and CreepJS** with zero flags in
-headless mode (detection canaries run every 4 hours via `docs/canary.md`).
+headless mode as of the latest 4-hourly canary run (detection canaries run every 4 hours
+via `docs/canary.md`).
 
 ---
 

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/README.md

@@ -1,6 +1,6 @@
 # Agentic Stealth Browser
 
-**Playwright gets detected. This doesn't.**
+**Playwright gets detected. This is much harder to detect.**
 
 [![CI](https://github.com/shanewas/agentic-stealth-browser/actions/workflows/ci.yml/badge.svg)](https://github.com/shanewas/agentic-stealth-browser/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
@@ -12,6 +12,10 @@
   <img src="assets/hn-demo.gif" alt="Agentic Stealth Browser Demo" width="90%">
 </p>
 
+## Legal & Acceptable Use
+
+This is an anti-bot-evasion tool. Read the [Acceptable Use Policy](ACCEPTABLE_USE.md) before use — you are responsible for using it lawfully and within the target site's Terms of Service.
+
 ## What is this
 
 A production-grade stealth browser automation library for Python, built on Playwright.
@@ -56,7 +60,8 @@ Sites don't just check your User-Agent anymore. They check *everything*:
 | **Account warming** | Nothing | 14-day graduated ramp-up per account |
 
 Result: **passes bot.sannysoft.com, pixelscan.net, and CreepJS** with zero flags in
-headless mode (detection canaries run every 4 hours via `docs/canary.md`).
+headless mode as of the latest 4-hourly canary run (detection canaries run every 4 hours
+via `docs/canary.md`).
 
 ---
 

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/SECURITY.md

@@ -4,8 +4,10 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.8.x   | :white_check_mark: |
-| < 0.8   | :x:                |
+| 2.7.x   | :white_check_mark: |
+| < 2.7   | :x:                |
+
+This table is updated as part of every release; a release is not complete until the current minor version appears here.
 
 ## Reporting a Vulnerability
 

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/agentic_stealth_browser.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-stealth-browser
-Version: 2.6.0
+Version: 2.7.0
 Summary: Production-grade, human-mimicking browser automation framework for autonomous agents. Survives modern anti-bot systems.
 Author-email: Shane W <shanewas@users.noreply.github.com>
 License-Expression: MIT
@@ -23,23 +23,23 @@ Classifier: Framework :: AsyncIO
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: playwright
-Requires-Dist: aiohttp
-Requires-Dist: cryptography
-Requires-Dist: pyyaml
-Requires-Dist: fastapi
-Requires-Dist: jinja2
-Requires-Dist: uvicorn
+Requires-Dist: playwright>=1.45
+Requires-Dist: aiohttp>=3.10.11
+Requires-Dist: cryptography>=43.0.1
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: fastapi>=0.115.0
+Requires-Dist: jinja2>=3.1.5
+Requires-Dist: uvicorn>=0.32.0
 Provides-Extra: dev
-Requires-Dist: pytest; extra == "dev"
-Requires-Dist: pytest-asyncio; extra == "dev"
-Requires-Dist: pytest-cov; extra == "dev"
-Requires-Dist: httpx; extra == "dev"
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pytest-cov>=5.0; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
 Dynamic: license-file
 
 # Agentic Stealth Browser
 
-**Playwright gets detected. This doesn't.**
+**Playwright gets detected. This is much harder to detect.**
 
 [![CI](https://github.com/shanewas/agentic-stealth-browser/actions/workflows/ci.yml/badge.svg)](https://github.com/shanewas/agentic-stealth-browser/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
@@ -51,6 +51,10 @@ Dynamic: license-file
   <img src="assets/hn-demo.gif" alt="Agentic Stealth Browser Demo" width="90%">
 </p>
 
+## Legal & Acceptable Use
+
+This is an anti-bot-evasion tool. Read the [Acceptable Use Policy](ACCEPTABLE_USE.md) before use — you are responsible for using it lawfully and within the target site's Terms of Service.
+
 ## What is this
 
 A production-grade stealth browser automation library for Python, built on Playwright.
@@ -95,7 +99,8 @@ Sites don't just check your User-Agent anymore. They check *everything*:
 | **Account warming** | Nothing | 14-day graduated ramp-up per account |
 
 Result: **passes bot.sannysoft.com, pixelscan.net, and CreepJS** with zero flags in
-headless mode (detection canaries run every 4 hours via `docs/canary.md`).
+headless mode as of the latest 4-hourly canary run (detection canaries run every 4 hours
+via `docs/canary.md`).
 
 ---
 

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/agentic_stealth_browser.egg-info/SOURCES.txt

@@ -46,6 +46,9 @@ core/py.typed
 core/session_checkpoint.py
 core/types.py
 docs/ATTACH_OVER_CDP.md
+docs/DATA_HANDLING.md
+docs/INCIDENT_RESPONSE.md
+docs/KEY_MANAGEMENT.md
 docs/README.md
 docs/agentic-stealth-browser-analysis-report.md
 docs/canary.md

agentic_stealth_browser-2.7.0/agentic_stealth_browser.egg-info/requires.txt

@@ -0,0 +1,13 @@
+playwright>=1.45
+aiohttp>=3.10.11
+cryptography>=43.0.1
+pyyaml>=6.0.2
+fastapi>=0.115.0
+jinja2>=3.1.5
+uvicorn>=0.32.0
+
+[dev]
+pytest>=8.0
+pytest-asyncio>=0.23
+pytest-cov>=5.0
+httpx>=0.27

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/core/agent_browser.py

@@ -1272,6 +1272,7 @@ class AgentBrowser:
                 self.account_warming.record_page_visit(url)
             self.connection_pool.release_context(domain)
             self.adaptive_tuner.record_feedback(blocked=False, platform=platform)
+            self.metrics.increment("requests_success")
             return True
         except Exception as e:
             # P3: Record failure to all tracking systems
@@ -1284,6 +1285,8 @@ class AgentBrowser:
             self.logger.log_error(
                 "safe_goto_failed", str(e), {"url": url, "platform": platform}
             )
+            self.metrics.increment("requests_failed")
+            self.metrics.record_error("navigation", str(e))
             return False
 
     async def load_cookies(self, cookies_path: str):

agentic_stealth_browser-2.7.0/docs/DATA_HANDLING.md

@@ -0,0 +1,19 @@
+# Data Handling & Retention
+
+## What the tool persists
+
+- Scraped results (wherever the operator's workflow writes them)
+- Cookies under `sessions/`
+- Screenshots under `checkpoints/`
+
+## Data controller
+
+The operator running this tool is the data controller for any data it collects or persists. The maintainers are not.
+
+## Retention recommendation
+
+By default, retain persisted files no longer than necessary for the operator's task — 30 days is a reasonable starting point unless the operator's own policy or applicable law requires otherwise.
+
+## Deletion
+
+Deletion is the operator's responsibility. Documented deletion means removing the relevant files under `sessions/` and `checkpoints/`.

agentic_stealth_browser-2.7.0/docs/INCIDENT_RESPONSE.md

@@ -0,0 +1,22 @@
+# Security Incident Response
+
+## Reporting
+
+See [SECURITY.md](../SECURITY.md) for how to report a vulnerability.
+
+## Credential / Key Compromise
+
+1. Rotate the leaked secret.
+2. Invalidate live dashboard sessions by rotating `DashboardSettings.secret_key`.
+3. Delete affected session cookie files under `sessions/`.
+4. Force re-login for all operators.
+
+## Triage Severity
+
+- **SEV1** — key/credential leak
+- **SEV2** — data exposure
+- **SEV3** — availability
+
+## Post-Incident
+
+Record the incident in the CHANGELOG Security section.

agentic_stealth_browser-2.7.0/docs/KEY_MANAGEMENT.md

@@ -0,0 +1,9 @@
+# Key Management
+
+| Secret | Source | Rotation procedure |
+|---|---|---|
+| Cookie encryption key | env var | Generate a new key, re-encrypt or discard existing session cookie files under `sessions/`, force re-login. |
+| Dashboard `secret_key` (`DashboardSettings.secret_key`) | env var | Set a new value, restart the dashboard process — this invalidates all live dashboard sessions. |
+| HMAC / audit keys | env var | Generate a new key, redeploy, allow a short overlap window if signed artifacts must remain verifiable during rotation. |
+
+Keys must come from environment variables and must never be committed to the repository. Rotation should be performed immediately on suspected compromise (see [docs/INCIDENT_RESPONSE.md](INCIDENT_RESPONSE.md)) and periodically as routine hygiene.

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/production/adapters/agentic_stealth_mcp.py

@@ -119,7 +119,7 @@ class AgenticStealthMCPAdapter:
                     "protocolVersion": "2024-11-05",
                     "clientInfo": {
                         "name": "agentic-stealth-browser-dashboard",
-                        "version": "2.6.0",
+                        "version": "2.7.0",
                     },
                     "capabilities": {},
                 },

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/production/adapters/playwright_mcp.py

@@ -133,7 +133,7 @@ class PlaywrightMCPAdapter:
                     "protocolVersion": "2024-11-05",
                     "clientInfo": {
                         "name": "agentic-stealth-browser",
-                        "version": "2.6.0",
+                        "version": "2.7.0",
                     },
                     "capabilities": {},
                 },

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-stealth-browser"
-version = "2.6.0"
+version = "2.7.0"
 description = "Production-grade, human-mimicking browser automation framework for autonomous agents. Survives modern anti-bot systems."
 readme = "README.md"
 license = "MIT"
@@ -26,21 +26,21 @@ classifiers = [
     "Framework :: AsyncIO",
 ]
 dependencies = [
-    "playwright",
-    "aiohttp",
-    "cryptography",
-    "pyyaml",
-    "fastapi",
-    "jinja2",
-    "uvicorn",
+    "playwright>=1.45",
+    "aiohttp>=3.10.11",
+    "cryptography>=43.0.1",
+    "pyyaml>=6.0.2",
+    "fastapi>=0.115.0",
+    "jinja2>=3.1.5",
+    "uvicorn>=0.32.0",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "pytest",
-    "pytest-asyncio",
-    "pytest-cov",
-    "httpx",
+    "pytest>=8.0",
+    "pytest-asyncio>=0.23",
+    "pytest-cov>=5.0",
+    "httpx>=0.27",
 ]
 
 [project.scripts]

{agentic_stealth_browser-2.6.0 → agentic_stealth_browser-2.7.0}/tests/test_attach_over_cdp.py

@@ -251,6 +251,7 @@ async def remote_chromium(tmp_path):
         await _kill_if_alive()
 
 
+@pytest.mark.e2e
 async def test_attach_over_cdp_live_new_context(remote_chromium):
     port, proc = remote_chromium
     ab = AgentBrowser(session_name="t-attach", anonymous=True, ephemeral=True)
@@ -284,6 +285,7 @@ async def test_attach_over_cdp_live_new_context(remote_chromium):
     assert proc.returncode is None
 
 
+@pytest.mark.e2e
 async def test_attach_over_cdp_reports_stealth_install_failure(
     remote_chromium, monkeypatch
 ):
@@ -321,6 +323,7 @@ async def test_attach_over_cdp_reports_stealth_install_failure(
     assert proc.returncode is None
 
 
+@pytest.mark.e2e
 async def test_attach_over_cdp_stealth_not_requested(remote_chromium):
     """When apply_stealth=False, stealth_applied is False but no error is set."""
     port, proc = remote_chromium
@@ -358,6 +361,7 @@ async def test_teardown_mode_init_is_none():
     assert ab._teardown_mode is None
 
 
+@pytest.mark.e2e
 async def test_teardown_mode_set_to_attached_owned(remote_chromium):
     """attach_over_cdp(new_context=True) sets ATTACHED_OWNED_CTX."""
     from core.agent_browser import TeardownMode
@@ -371,6 +375,7 @@ async def test_teardown_mode_set_to_attached_owned(remote_chromium):
     assert proc.returncode is None
 
 
+@pytest.mark.e2e
 async def test_teardown_mode_set_to_attached_adopted(remote_chromium):
     """attach_over_cdp(adopt existing) sets ATTACHED_ADOPTED_CTX."""
     from core.agent_browser import TeardownMode

agentic_stealth_browser-2.6.0/agentic_stealth_browser.egg-info/requires.txt

@@ -1,13 +0,0 @@
-playwright
-aiohttp
-cryptography
-pyyaml
-fastapi
-jinja2
-uvicorn
-
-[dev]
-pytest
-pytest-asyncio
-pytest-cov
-httpx