Pointer-sequence clicks, IPC hang fix, evaluate race fix — community PRs #22, #23, #25.

Post-0.7.0 release incorporating community fixes that landed on main after the
0.7.0 AMO upload (2026-09-09), plus the full multi-harness codebase finally pushed
to GitHub with this release.

• Full Pointer/Mouse Sequence in firefox_click (PR #25, @braklo, fixes #9) — New
  extension/pointer-click.js dispatches the real 11-event sequence
  (pointerover → pointerenter → mouseover → mouseenter → pointermove → mousemove →
  pointerdown → mousedown → focus → pointerup → mouseup → click) at the element centre
  with stable-rect scroll polling and obscuredBy overlay reporting. Div-based and
  Blazor-style controls that listen for pointer/mouse events now respond; result reports
  trusted: false (synthetic events are never trusted). Regression suite
  tests/pointer-click.test.mjs.
• MCP Requests Settle When the Host Closes the Socket (PR #23, @andrei-rizoiu) — New
  mcp/socket-request.js replaces the inline socket state machine in mcp/server.js;
  an unanswered host close now rejects with HOST_CLOSED instead of hanging forever, and
  the host raises its idle socket timeout to commandTimeoutMs + 5s so long commands are
  no longer killed at 60 s. Regression suites tests/mcp-socket-request.test.mjs,
  tests/ipc.test.mjs.
• Evaluate Settings Race (PR #22, @axiomvx-source) and Agent Timeout Override
  (PR #21, @braklo) — code shipped in AMO 0.7.0; their pull requests are merged to
  GitHub with this release.

• Version 0.7.0 → 0.7.1 across package.json, host/package.json, mcp/package.json,
  extension/manifest.json, extension/popup/popup.html, CLAUDE.md, README.md,
  website/extension.html, website/changelog.html.
• Annotated tag v0.7.0 added retroactively on release commit 7f6a841 (AMO 0.7.0 was
  published 2026-09-09 from unpushed git state; tags previously stopped at v0.6.9).
• Website social-card and og-image refresh.
• Web extension artifact built at web-ext-artifacts/claudezilla-0.7.1.zip.

v0.7.0 — The Multi-Harness Release

• Multi-Harness Support: Built-in compatibility for Oh My Pi (OMP), Hermes Agent, and Pi Agent alongside Claude Code.
• Eager & Lazy Tool Discovery: Full tool catalog exposure on startup via --all-tools / CLAUDEZILLA_TOOL_MODE=all for single-discovery MCP clients, while preserving token-saving lazy activation for Claude Code.
• Evaluate Settings Race Fix (PR #22): firefox_evaluate now reliably awaits local storage initialization before checking the allowEvaluate opt-in gate, eliminating false-disabled errors on first command execution (thanks @axiomvx-source).
• Page State Limits & Truncation Metadata (#19): firefox_get_page_state now properly forwards count parameters to content scripts and returns explicit truncated: true and rawLength metadata on length-capped fields, while maintaining strict password masking.
• Configurable Agent Timeout: Added CLAUDEZILLA_AGENT_TIMEOUT_MS env override to support human-in-the-loop workflows where tabs are edited between agent turns without premature reaper cleanup.
• Multi-Harness Installers: install-macos.sh and install-linux.sh now support --target <claude|omp|hermes|pi|all> with safe, automated configuration merges.

Attach existing tabs — three new tools let Claude drive a tab you already have open (firefox_list_all_tabs, firefox_attach_tab, firefox_detach_tab), instead of always opening a new one. Nothing is taken over automatically; it requires an explicit attach action.

Window handling — Claudezilla now reuses your current window by default instead of always opening a dedicated one, with a toggle in the popup to turn this off. Windows also persist correctly across background restarts, fixing an issue where duplicate Claudezilla windows could accumulate over time.

Screenshots — firefox_screenshot can now save directly to disk via an optional path, and a bug that could cause repeated screenshot failures in a single session after one failure is fixed.

Popup — fixed a layout issue causing an unnecessary scrollbar.

Automatic rollback based on version [0.6.6].

Maintenance release focused on stability, security, and AMO compliance. No new MCP tools, no behavior changes for normal use.

What's new

Stability
• Plugged timer leaks in the native host, MCP server, and extension — long-running sessions no longer accumulate retained timers.
• Eliminated a shutdown race that could hang the MCP server during cleanup.
• Unhandled promise rejections no longer crash the MCP server mid-session.
• Fixed a screenshot mutex race that could cause spurious MUTEX_BUSY errors on concurrent captures.

Security
• firefox_evaluate now requires explicit opt-in via the popup's new Security section. Disabled by default. The expression denylist remains as defense-in-depth.
• Watermark shadow DOM rebuilt using safe DOM construction (createElement / replaceChildren / DOMParser) instead of innerHTML.
• Manifest hygiene: dropped unused webRequestBlocking permission, bumped minimum Firefox to 140 (required by tabs.group and data_collection_permissions).
• welcome page and popup also converted to safe DOM construction.

Compatibility
• Supports the --resume <sessionId> parameter passed by Claude Code 2.1.154+, so focus-loop state stays correlated across /clear and process restarts.

Popup polish
• Compact layout — support footer is always visible, no scrolling.
• Renamed "Auto-Loop Detection" to "Auto-Loops".
• Trailing icons on each setting row.

For the full changelog, see https://github.com/boot-industries/claudezilla/blob/main/CHANGELOG.md

Compatibility and polish update for Claude Code 2.1.129–2.1.138.
No new features or permissions; no UI changes.

Improvements:
• Focus loops are now scoped per Claude Code session, so two
concurrent sessions on the same machine no longer collide.
• Smoother handling after Claude Code's /clear command: the MCP
server transparently re-activates the right tool category instead
of returning an "activation required" error.
• The bundled focus-loop plugin's stop hook is hardened with bounded
socket waits and stricter JSON validation, so it can never hang
Claude Code's session exit.
• Plugin metadata polish for Claude Code's --plugin-url direct
installation flow (homepage, bugs, license fields).

Same permissions as v0.6.4. No telemetry. All communication remains
local via Unix socket. See CHANGELOG.md for full details.

Security hardening and improved private browsing.

Security:
- Block dependency lifecycle scripts (ignore-scripts=true)
- Timing-safe auth token comparison
- Explicit Content Security Policy
- Install scripts hardened with --ignore-scripts
- Upgraded @modelcontextprotocol/sdk to 1.29.0

Improvements:
- Private window auto-fallback: if incognito permission isn't granted, automatically falls back to non-private mode with a clear warning instead of failing
- New "private" parameter on firefox_create_window for explicit mode control
- firefox_activate now reports private window availability upfront
- Mode mismatch detection prevents silent wrong-mode tab creation

Fixed critical bug where the native host fails to start on macOS (Homebrew) and Linux (nvm/non-system Node paths). Firefox GUI apps don't inherit shell PATH, so the #!/usr/bin/env node shebang couldn't find Node.js. The installer now resolves the absolute node path and generates a wrapper script. Also cleaned up stale files from the extension package.

Bug fixes for socket path reliability and Windows support, thanks to generous community contributions!

• macOS: Fixed socket path mismatch caused by per-process TMPDIR values. Now uses ~/.claudezilla/ as stable fallback. (Thanks w3cdotorg)
• Windows: Fixed silent connection failure — installer creates a bat wrapper instead of using non-spec args manifest field. (Thanks DerekL)
• CLI now uses centralized socket path resolution instead of hardcoded /tmp/claudezilla.sock.

v0.6.1 — Security hardening + two new features

NEW FEATURES:
• Cookie/consent auto-dismissal — Automatically detects and dismisses GDPR overlays across major CMP platforms (OneTrust, Cookiebot, Quantcast, Didomi, Google). 4-pass detection: CMP selectors → text matching → Shadow DOM traversal → ARIA dialog fallback.
• Lazy tool loading — Only exposes a single activation tool (~50 tokens) at session start instead of all 31 tools (~6,500 tokens). Call firefox_activate() to load tools by category on demand. Saves context for sessions that don't need browser automation.
• Linux support — Portable shebang, headless Firefox profile, XPI sideloading, systemd service unit, and install script. Tested on Ubuntu (aarch64).

SECURITY (15 red-team findings resolved):
• Activation guard prevents tool execution before firefox_activate is called
• Category-scoped enforcement at call time, not just at listing time
• Consent auto-trigger now targets the navigated tab, not the active tab
• Overly broad consent selectors scoped to consent containers
• Generic "OK" button pattern removed from consent text matching
• Domain allowlist regex properly escapes dots to prevent bypass
• goodbye and handleConsent added to host command whitelist
• canNavigate logic inversion fixed

RELIABILITY (9 audit batches):
• Socket listener cleanup prevents file descriptor leaks
• Screenshot mutex uses finally block — can no longer deadlock
• Process-level unhandled rejection handler added
• Domain pattern ReDoS prevention (length + charset validation)
• Installer npm pre-check with clear error messaging

PERFORMANCE:
• Screenshot mutex threshold tightened (3s → 2.5s) for faster error feedback
• Consent detection delay reduced (800ms → 600ms)
• Watermark injection delay reduced (500ms → 350ms)
• Socket idle timeout added (60s) to prevent abandoned connections

v0.6.0 — Annotated Screenshots, Domain Allowlists, Smarter Waiting

NEW:
• Annotated screenshots — firefox_screenshot with annotate:true overlays numbered badges
on interactive elements. Response includes a label map so agents can say "click element
3".
• Domain allowlist — firefox_set_config lets agents restrict navigation to approved
domains with wildcard support. Unauthorized URLs return DOMAIN_BLOCKED.
• Expanded waitFor — now supports text (substring match on page text), url (glob match on
location), and selector modes.
• Page state diff — firefox_diff_page_state compares two snapshots and returns structured
diffs (added/removed/changed elements). No extension round-trip needed.

FIXES:
• Orphan tab timeout increased from 2min to 10min (fewer false positives during long
operations)
• pressKey returns actionable errors for invalid key names
• scroll returns noEffect flag when viewport didn't move
• Watermark and focus glow hidden during screenshot capture
• Fixed CONTENT_SCRIPT_ERROR false positives on JSON/XML/binary tabs
• Network headers stripped from getNetworkRequests (60% smaller payloads)

DOCS:
• Full documentation now live at docs.claudezilla.com

This release fixes four bugs that combined to cause agents to get stuck on stale or non-existent tabs, requiring a full extension
reload to recover.

Bug fixes:

• Session nuke on empty tabs (Critical) — When the last Claudezilla tab was closed externally, the entire session was wiped,
  requiring a full extension reload to resume. The error recovery is now scoped correctly: losing all tabs returns a NO_TABS error
  without destroying the window session.
• Infinite retry on closed tab (Serious) — When a tab was closed while a command was in-flight, the extension returned
  CONTENT_SCRIPT_UNAVAILABLE, causing agents in loops to retry indefinitely on a tab that no longer existed. The extension now
  detects this case and returns TAB_CLOSED with actionable guidance.
• Heartbeat timeout during long operations (Moderate) — The agent heartbeat was only refreshed at command arrival. Long-running
  operations (screenshots, waitFor) could exceed the 120-second orphan threshold during execution, causing the extension to
  prematurely reclaim the agent's tabs. The heartbeat now also refreshes immediately before the operation begins.
• Overly broad error catch in session management (Moderate) — A single try/catch wrapped both window-level and tab-level failures.
  Both paths reset the session state, making recovery impossible without a reload. The scopes are now split: window failures reset
  state; tab failures return a targeted error without destroying the session.

Bug fixes for macOS users.

• Fixed native messaging host path on macOS — installer was writing the manifest to the Linux location
(~/.mozilla/...) instead of ~/Library/Application Support/Mozilla/NativeMessagingHosts/. Caused "No
such native application" error on first launch.
• Fixed missing MCP dependencies — installer now runs npm install in the mcp/ directory automatically.
Fresh clones no longer fail to start the MCP server.
• Fixed tabId type coercion — all tab-targeting tools now accept tabId as either a string or number.
Passing a string (as JSON sometimes does) previously caused "Incorrect argument types" errors from the
Firefox tabs API.

Version 0.5.7 - Critical Bug Fixes + Timeout Flexibility

This release fixes critical bugs and adds timeout configuration for better reliability.

BUG FIXES:
• Screenshot error handling - Errors during capture now properly report to Claude instead of being silently ignored
• Multi-agent coordination - Fixed race condition where multiple agents could claim the same reserved tab slot
• Message ID overflow protection - Replaced numeric IDs with UUIDs to eliminate collision risk

IMPROVEMENTS:
• Per-operation timeout support - All browser automation tools now accept optional timeout parameter (5s-300s range, default: 150s)
• Better error messages - Timeout errors now include operation name and duration for easier debugging

This is a stability and reliability update with no breaking changes. All existing functionality remains backward compatible.

Full changelog: https://github.com/boot-industries/claudezilla/blob/main/CHANGELOG.md

Autonomous installation, bug fixes, and multi-agent improvements.

New:
- Autonomous permissions — Installers auto-configure Claude Code settings and MCP server
- Expanded tab pool — 12 tabs shared across agents (up from 10)
- Screenshot purpose presets — quick-glance, read-text, inspect-ui, full-detail

Fixed:
- Tab ID type mismatch — Tab operations no longer fail with "Tab not found" on valid tabs
- Session cleanup on exit — Tabs are cleaned up immediately when a Claude session ends
- Mercy system slot reservation — Freed slots are now reserved for the waiting agent (30s
TTL)
- Request timeouts extended to 150s for long-running browser operations
- file:// URLs now allowed for local development
- Improved error messages for content script failures

v0.5.5 - Windows Support

New:
• Windows 10/11 support - Now works on Windows with named pipes for IPC
• Path security validation - Prevents injection attacks via null bytes and path traversal

Fixed:
• Support link in popup now opens correctly

Security:
• Environment variable validation for temp directories
• PowerShell installer uses safe JSON serialization

v0.5.4 - Security hardening + performance optimization

Security:
• Expression validation - firefox_evaluate now blocks dangerous patterns (fetch, eval, document.cookie,
localStorage, XMLHttpRequest)
• Agent ID truncation - Privacy-enhanced logging shows truncated IDs in all outputs
• Loop prompt sanitization - Preview field limited to 100 characters

Performance:
• Selector search optimization - 100 element limit per category with early exit
• Screenshot mutex timeout reduced from 5s to 3s for faster multi-agent feedback

v0.5.3: Reconnection resilience + diagnostics

Features:
• Auto-reconnect - Extension automatically reconnects when the native host disconnects (exponential backoff from 1s to 30s, max 10 attempts)
• New firefox_diagnose tool - Comprehensive connection health check that validates socket, auth token, and provides actionable fix recommendations
• MCP retry logic - Automatic retry with exponential backoff for transient connection failures

Improvements:
• Better error messages - Connection errors now show diagnostic info (socket/auth token state) with specific fix instructions
• Updated MCP SDK (0.5.0 → 1.25.2) for Claude Code 2.1.x compatibility

Bug fix:
- Fixed Support link to open https://claudezilla.com/support instead of local page