agentic-stealth-browser 2.7.0__tar.gz → 3.0.0__tar.gz

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/CHANGELOG.md

@@ -9,6 +9,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.0] — Enterprise Hardening, Part 2 (2026-07-18)
+
+A large enterprise-readiness pass across reliability, auditability, security/
+supply-chain, observability, and maintainability. One breaking change (MCP
+approval default); everything else is additive or behavior-preserving.
+
+### Breaking
+- **MCP approval gate is now fail-closed by default.** Sensitive actions
+  (`execute_js`, `stealth_launch`, navigate to unknown domains, `run_workflow`,
+  `stealth_replay`) return `MCP_APPROVAL_REQUIRED` until approved. Set
+  `STEALTH_APPROVAL_MODE=permissive` to restore the previous auto-approve
+  behavior. (`production/mcp_server.py`; covered by `tests/test_approval_mode.py`.)
+
+### Added
+- **Auditability:** success-path audit records at every AgentBrowser choke point
+  and the MCP scrape handler; a `level` field on every entry; log rotation +
+  retention purge (`AGENTIC_AUDIT_*` env); an **HMAC-keyed tamper-evidence chain**
+  (`AGENTIC_AUDIT_HMAC_KEY`) with `verify_audit_chain()`; recursive secret
+  redaction into list/tuple values; GitHub/Slack/JWT token redaction patterns.
+- **Observability:** recovery `blocks_total`/`rotations_total`/`captcha_total`
+  counters; a scrapeable `GET /metrics` Prometheus endpoint and `GET /api/usage`
+  business rollup on the dashboard; `docs/SLO.md` and `docs/RUNBOOK.md`.
+- **Dashboard RBAC:** per-user viewer/operator roles replacing the single shared
+  password; mutating routes require the operator role; attributable operator
+  actions persisted to an append-only `audit.jsonl`; boot refuses the default
+  `change-me` password; `cookie_secure` defaults on.
+- **Supply chain:** a hash-pinned, universal `requirements.lock`; a blocking
+  `pip-audit` CVE job; blocking `bandit` SAST (baseline-ratcheted); a `gitleaks`
+  secret-scan workflow; CycloneDX SBOM + build-provenance attestation on publish;
+  `py.typed` markers for every shipped package; a post-publish PyPI install smoke.
+- **Compliance/governance:** `ACCEPTABLE_USE.md`, `GOVERNANCE.md`, `ROADMAP.md`,
+  `SUPPORT.md`, `DCO.txt` + sign-off, `docs/RELEASING.md`, `docs/INCIDENT_RESPONSE.md`,
+  `docs/KEY_MANAGEMENT.md`, `docs/DATA_HANDLING.md`, `docs/BACKUP_RESTORE.md` +
+  `scripts/backup_sessions.py`.
+- **Reliability:** a launch-failure driver-leak guard in `__aenter__`; an opt-in
+  `respect_robots` guard (stdlib `robotparser`) on `safe_goto`/MCP navigate; an
+  `AGENTIC_MAX_REQUESTS_PER_SESSION` per-session navigation budget; a `perf`-marked
+  concurrency load smoke test.
+- **API:** a stable public facade — `from core import AgentBrowser`.
+
+### Changed
+- **CI is now a real gate:** blocking (relaxed) `mypy` on `core/` and on the five
+  MCP security modules; coverage gate raised to **55%** over a widened package set;
+  a Python **3.10–3.13** test matrix plus ubuntu/windows/macOS import-smoke; all
+  GitHub Actions pinned to commit SHAs; the three previously-excluded test files
+  un-gated; the nightly job no longer masks failures.
+- **Architecture:** `rate_limiter.py`/`metrics.py` moved into `core/` (inverted
+  layering resolved, back-compat shims kept); ~830 lines of dashboard HTML extracted
+  to `production/templates/*.html`; the 18 `_tool_stealth_*` MCP handlers extracted
+  to a `_MCPToolHandlers` mixin; the 5 exception classes moved to `core/errors.py`.
+- Swallowed (`pass`-only) exception handlers now log at debug with `exc_info`.
+- Removed the dead `plugin_system` capability flag and unused `otel_export.py`.
+
+### Security
+- Dependency lower bounds pinned to CVE-safe floors; Docker installs from the
+  hash-pinned lockfile and runs as a non-root user; `twine check --strict` before
+  every PyPI upload; `SECURITY.md` supported-versions corrected.
+
 ## [2.7.0] — Enterprise Hardening (2026-07-18)
 
 Auditability, supply-chain, and business-facing hardening from a full enterprise

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/CONTRIBUTING.md

@@ -36,10 +36,9 @@ pytest tests/ -v
 # Run specific test files
 pytest tests/test_stealth_modules.py -v
 pytest tests/test_contract_agent_browser.py -v
-pytest tests/test_recovery_phase1.py -v
 
-# Run with coverage
-pytest tests/ --cov=core --cov=stealth --cov=recovery --cov=behavior
+# Run with coverage (CI-equivalent; coverage gate ratchets +5 each release)
+python -m pytest tests/ -m "not e2e and not live_network" --ignore=tests/test_basic.py -q --cov=core --cov=stealth --cov=behavior --cov=recovery --cov=proxy --cov=production --cov=sessions --cov=workflows --cov=audit --cov=mcp_security --cov-fail-under=55
 ```
 
 ---
@@ -200,7 +199,7 @@ agentic-stealth-browser/
 ### New Recovery Strategy
 
 1. Update `PLATFORM_STRATEGIES` in `recovery/anti_block_orchestrator.py`
-2. Add tests to `tests/test_recovery_phase1.py`
+2. Add tests to `tests/test_recovery_state_machine.py`
 3. Document rate limiting behavior changes in README.md or relevant code comments
 
 ### New Human Behavior
@@ -235,3 +234,11 @@ If you discover a security vulnerability:
 ## License
 
 By contributing, you agree that your contributions will be licensed under the MIT License.
+
+All contributions must be signed off under the [Developer Certificate of Origin](DCO.txt). Add a `Signed-off-by: Your Name <you@example.com>` line to each commit (use `git commit -s`).
+
+## Deprecation Policy
+
+The public API surface is: the SDK (`production.sdk.client.StealthClient`), MCP tool names (`stealth_launch`, `stealth_navigate`, `stealth_scrape`, `stealth_close`), the `agentic-stealth-browser` CLI and its flags, and the `plugins.BasePlugin` protocol.
+
+A deprecated public symbol, flag, or tool emits a `DeprecationWarning` (or documented equivalent) for at least one full MINOR release before removal. Every deprecation and removal is listed in the CHANGELOG under `Deprecated` / `Removed`.

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-stealth-browser
-Version: 2.7.0
+Version: 3.0.0
 Summary: Production-grade, human-mimicking browser automation framework for autonomous agents. Survives modern anti-bot systems.
 Author-email: Shane W <shanewas@users.noreply.github.com>
 License-Expression: MIT
@@ -55,6 +55,10 @@ Dynamic: license-file
 
 This is an anti-bot-evasion tool. Read the [Acceptable Use Policy](ACCEPTABLE_USE.md) before use — you are responsible for using it lawfully and within the target site's Terms of Service.
 
+This software is for lawful, **authorized** automation and testing only; you are responsible for compliance with applicable laws, target Terms of Service, and **robots.txt** directives.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND; the authors accept no liability for misuse. See [LICENSE](LICENSE).
+
 ## What is this
 
 A production-grade stealth browser automation library for Python, built on Playwright.
@@ -75,7 +79,7 @@ playwright install --with-deps chromium
 ```
 
 ```python
-from core.agent_browser import AgentBrowser
+from core import AgentBrowser
 
 async with AgentBrowser(session_name="demo") as browser:
     await browser.launch(headless=True)
@@ -126,6 +130,10 @@ This library is opinionated and has real limits. Operators should know them up f
 - **Login credentials are not shipped.** Examples that touch authenticated endpoints
   stop at the search/listing stage.
 
+### Cost controls
+
+Set `AGENTIC_MAX_REQUESTS_PER_SESSION=<n>` to cap navigations per session (`safe_goto` returns `False` once exceeded).
+
 ---
 
 ## Quick Start
@@ -143,7 +151,7 @@ agentic-stealth-browser dashboard
 ### Python SDK
 
 ```python
-from core.agent_browser import AgentBrowser
+from core import AgentBrowser
 
 async with AgentBrowser(
     session_name="my-session",
@@ -300,6 +308,12 @@ Additional references: [CHANGELOG.md](CHANGELOG.md) · [Workflow Library](workfl
 └── tests/          Contract + integration tests (live E2E opt-in)
 ```
 
+## Governance & Support
+
+- [Governance](GOVERNANCE.md)
+- [Roadmap](ROADMAP.md)
+- [Support](SUPPORT.md)
+
 ## License
 
 MIT. See [LICENSE](LICENSE) and [CHANGELOG.md](CHANGELOG.md).

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/README.md

@@ -16,6 +16,10 @@
 
 This is an anti-bot-evasion tool. Read the [Acceptable Use Policy](ACCEPTABLE_USE.md) before use — you are responsible for using it lawfully and within the target site's Terms of Service.
 
+This software is for lawful, **authorized** automation and testing only; you are responsible for compliance with applicable laws, target Terms of Service, and **robots.txt** directives.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND; the authors accept no liability for misuse. See [LICENSE](LICENSE).
+
 ## What is this
 
 A production-grade stealth browser automation library for Python, built on Playwright.
@@ -36,7 +40,7 @@ playwright install --with-deps chromium
 ```
 
 ```python
-from core.agent_browser import AgentBrowser
+from core import AgentBrowser
 
 async with AgentBrowser(session_name="demo") as browser:
     await browser.launch(headless=True)
@@ -87,6 +91,10 @@ This library is opinionated and has real limits. Operators should know them up f
 - **Login credentials are not shipped.** Examples that touch authenticated endpoints
   stop at the search/listing stage.
 
+### Cost controls
+
+Set `AGENTIC_MAX_REQUESTS_PER_SESSION=<n>` to cap navigations per session (`safe_goto` returns `False` once exceeded).
+
 ---
 
 ## Quick Start
@@ -104,7 +112,7 @@ agentic-stealth-browser dashboard
 ### Python SDK
 
 ```python
-from core.agent_browser import AgentBrowser
+from core import AgentBrowser
 
 async with AgentBrowser(
     session_name="my-session",
@@ -261,6 +269,12 @@ Additional references: [CHANGELOG.md](CHANGELOG.md) · [Workflow Library](workfl
 └── tests/          Contract + integration tests (live E2E opt-in)
 ```
 
+## Governance & Support
+
+- [Governance](GOVERNANCE.md)
+- [Roadmap](ROADMAP.md)
+- [Support](SUPPORT.md)
+
 ## License
 
 MIT. See [LICENSE](LICENSE) and [CHANGELOG.md](CHANGELOG.md).

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 2.7.x   | :white_check_mark: |
-| < 2.7   | :x:                |
+| 3.0.x   | :white_check_mark: |
+| < 3.0   | :x:                |
 
 This table is updated as part of every release; a release is not complete until the current minor version appears here.
 
@@ -31,6 +31,10 @@ When using this framework in production:
 6. **Isolate accounts** — Never share proxies or browser contexts across accounts
 7. **Keep dependencies updated** — Regularly update Playwright and Python dependencies
 
+## MCP Approval Mode
+
+The MCP server ships fail-closed: sensitive actions (`execute_js`, `stealth_launch`, navigate to unknown domains, `run_workflow`, `stealth_replay`) return `MCP_APPROVAL_REQUIRED` until approved. Set `STEALTH_APPROVAL_MODE=permissive` to auto-approve all sensitive actions (previous default; not recommended for shared/production deployments).
+
 ## Known Limitations
 
 - TLS fingerprint spoofing is limited to browser launch arguments; true ClientHello manipulation requires lower-level network stack access

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/agentic_stealth_browser.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-stealth-browser
-Version: 2.7.0
+Version: 3.0.0
 Summary: Production-grade, human-mimicking browser automation framework for autonomous agents. Survives modern anti-bot systems.
 Author-email: Shane W <shanewas@users.noreply.github.com>
 License-Expression: MIT
@@ -55,6 +55,10 @@ Dynamic: license-file
 
 This is an anti-bot-evasion tool. Read the [Acceptable Use Policy](ACCEPTABLE_USE.md) before use — you are responsible for using it lawfully and within the target site's Terms of Service.
 
+This software is for lawful, **authorized** automation and testing only; you are responsible for compliance with applicable laws, target Terms of Service, and **robots.txt** directives.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND; the authors accept no liability for misuse. See [LICENSE](LICENSE).
+
 ## What is this
 
 A production-grade stealth browser automation library for Python, built on Playwright.
@@ -75,7 +79,7 @@ playwright install --with-deps chromium
 ```
 
 ```python
-from core.agent_browser import AgentBrowser
+from core import AgentBrowser
 
 async with AgentBrowser(session_name="demo") as browser:
     await browser.launch(headless=True)
@@ -126,6 +130,10 @@ This library is opinionated and has real limits. Operators should know them up f
 - **Login credentials are not shipped.** Examples that touch authenticated endpoints
   stop at the search/listing stage.
 
+### Cost controls
+
+Set `AGENTIC_MAX_REQUESTS_PER_SESSION=<n>` to cap navigations per session (`safe_goto` returns `False` once exceeded).
+
 ---
 
 ## Quick Start
@@ -143,7 +151,7 @@ agentic-stealth-browser dashboard
 ### Python SDK
 
 ```python
-from core.agent_browser import AgentBrowser
+from core import AgentBrowser
 
 async with AgentBrowser(
     session_name="my-session",
@@ -300,6 +308,12 @@ Additional references: [CHANGELOG.md](CHANGELOG.md) · [Workflow Library](workfl
 └── tests/          Contract + integration tests (live E2E opt-in)
 ```
 
+## Governance & Support
+
+- [Governance](GOVERNANCE.md)
+- [Roadmap](ROADMAP.md)
+- [Support](SUPPORT.md)
+
 ## License
 
 MIT. See [LICENSE](LICENSE) and [CHANGELOG.md](CHANGELOG.md).

{agentic_stealth_browser-2.7.0 → agentic_stealth_browser-3.0.0}/agentic_stealth_browser.egg-info/SOURCES.txt

@@ -16,14 +16,17 @@ agentic_stealth_browser.egg-info/requires.txt
 agentic_stealth_browser.egg-info/top_level.txt
 ai/__init__.py
 ai/ai_hooks.py
+ai/py.typed
 assets/hn-demo.gif
 audit/__init__.py
 audit/logger.py
+audit/py.typed
 behavior/__init__.py
 behavior/adaptive_tuner.py
 behavior/human_behavior.py
 behavior/orchestration.py
 behavior/persona_rotator.py
+behavior/py.typed
 canary/__init__.py
 canary/badge_gen.py
 canary/dashboard_gen.py
@@ -41,15 +44,22 @@ core/account_warming.py
 core/agent_browser.py
 core/connection_pool.py
 core/error_messages.py
+core/errors.py
 core/feature_flags.py
+core/metrics.py
 core/py.typed
+core/rate_limiter.py
 core/session_checkpoint.py
 core/types.py
 docs/ATTACH_OVER_CDP.md
+docs/BACKUP_RESTORE.md
 docs/DATA_HANDLING.md
 docs/INCIDENT_RESPONSE.md
 docs/KEY_MANAGEMENT.md
 docs/README.md
+docs/RELEASING.md
+docs/RUNBOOK.md
+docs/SLO.md
 docs/agentic-stealth-browser-analysis-report.md
 docs/canary.md
 docs/canary/README.md
@@ -69,7 +79,9 @@ examples/recipes/README.md
 examples/recipes/linkedin.md
 linkedin/__init__.py
 linkedin/actions.py
+linkedin/py.typed
 plugins/__init__.py
+plugins/py.typed
 plugins/template/__init__.py
 plugins/template/plugin.py
 production/Dockerfile
@@ -82,13 +94,14 @@ production/deprecations.py
 production/docker-compose.yml
 production/docker-healthcheck.py
 production/hermes_dashboard.py
+production/mcp_handlers.py
 production/mcp_input_validator.py
 production/mcp_server.py
 production/mcp_session_isolation.py
 production/metrics.py
-production/otel_export.py
 production/policy_engine.py
 production/profiler.py
+production/py.typed
 production/rate_limiter.py
 production/workflow_orchestrator.py
 production/adapters/__init__.py
@@ -99,14 +112,20 @@ production/adapters/cdp_bridge.py
 production/adapters/playwright_mcp.py
 production/sdk/__init__.py
 production/sdk/client.py
+production/templates/dashboard.html
+production/templates/login.html
 proxy/__init__.py
 proxy/proxy_manager.py
+proxy/py.typed
 recovery/__init__.py
 recovery/anti_block_orchestrator.py
 recovery/detectors.py
 recovery/explain_blocked.py
+recovery/py.typed
 scraping/__init__.py
+scraping/py.typed
 scraping/scraper.py
+scripts/backup_sessions.py
 scripts/canary_run.py
 scripts/evaluate_stealth.py
 scripts/generate-demo-gif.py
@@ -118,6 +137,7 @@ scripts/perf_benchmark.py
 scripts/setup_rbb.sh
 sessions/__init__.py
 sessions/cookie_manager.py
+sessions/py.typed
 sessions/session_manager.py
 stealth/__init__.py
 stealth/advanced_stealth.py
@@ -126,6 +146,7 @@ stealth/firefox_adapter.py
 stealth/headers.py
 stealth/presets.py
 stealth/profiles.py
+stealth/py.typed
 stealth/tls_fingerprint.py
 stealth/tls_ja3_ja4.py
 tests/debug_nowsecure.py
@@ -139,6 +160,7 @@ tests/test_adapter_agentic_stealth_mcp.py
 tests/test_adapter_cdp_bridge.py
 tests/test_adapter_playwright_mcp.py
 tests/test_adaptive_tuner.py
+tests/test_approval_mode.py
 tests/test_attach_over_cdp.py
 tests/test_backend_adapter_contract.py
 tests/test_basic.py
@@ -147,6 +169,7 @@ tests/test_connection_pool.py
 tests/test_contract_agent_browser.py
 tests/test_cookie_manager_unit.py
 tests/test_dashboard_protocol_bridge.py
+tests/test_dashboard_rbac.py
 tests/test_detectors.py
 tests/test_differential.py
 tests/test_docker_config.py
@@ -156,7 +179,9 @@ tests/test_golden_master.py
 tests/test_hermes_dashboard.py
 tests/test_human_behavior_fuzz.py
 tests/test_integration_modules.py
+tests/test_launch_leak.py
 tests/test_linkedin_actions.py
+tests/test_load_smoke.py
 tests/test_mcp_contract.py
 tests/test_mcp_server_runtime.py
 tests/test_mcp_stealth_workflows.py
@@ -173,6 +198,7 @@ tests/test_recorder.py
 tests/test_recovery.py
 tests/test_recovery_phase1.py
 tests/test_recovery_state_machine.py
+tests/test_redaction_tokens.py
 tests/test_rehearsal_validation.py
 tests/test_selector_auto_heal.py
 tests/test_session_checkpoint.py
@@ -191,6 +217,7 @@ tests/stealth_harness/test_stealth.py
 workflows/__init__.py
 workflows/action_interpreter.py
 workflows/player.py
+workflows/py.typed
 workflows/recorder.py
 workflows/recovery.py
 workflows/schema.py