Reference

What changed in each release, and why — this page is the full version history, grouped by minor version, newest first. chrome-use's own feature work lives in the v1.x line; further back is the fork era that predates the rebrand, plus the version numbers merged in periodically from upstream agent-browser.

v1.5.x

• v1.5.265 (October 24, 2026): Conversation rows offer Initial page, Final page and confirmed deletion. First and latest recorded addresses stay separate; missing initial addresses are reported. Fixes Ant Design range drafts lost on blur (#717), preserves native headed-browser fingerprints consistent with workers and documents headless limits (#718). Fixes iOS camera permissions and scanner lifecycle and adds store archive tooling; iOS distribution is separate. Works with extension 0.5.86. Contributors: @leeguooooo.
• v1.5.264 (October 24, 2026): Separate conversation window buttons focus the last recorded agent webpage or reopen its URL after closure, without replaying messages or tasks. Supports narrow panels and both themes (#714). Conversation deletion waits for saved address cleanup, reports failures and blocks late observations from restoring deleted records (#715). Fixes stealth cursor cleanup, extension frame debugger errors, QR security-verification reporting and native-host registration for custom Chrome profiles; makes ClawHub publishing opt-in (#712, #695, #694, #706, #689). Works with extension 0.5.85. Contributors: @leeguooooo, @euvoor, @Jerryx333, @leinaldo.
• v1.5.263 (October 24, 2026): The mobile gateway waits with exponential backoff from 1 to 60 seconds when its selected IP is unavailable, avoiding repeated service restarts. It keeps the requested address and reports readiness only after listening succeeds; other bind errors still fail immediately. Documents network changes and launchd restart throttling (#713). Works with extension 0.5.83. Contributors: @leeguooooo.
• v1.5.262 (October 23, 2026): New messages after a model capacity error or interrupted turn start in the same conversation and model instead of waiting in the paused queue. Older queued messages remain paused until explicitly resumed. Failed tasks are not automatically replayed. Requires extension 0.5.83. Contributors: @leeguooooo.
• v1.5.261 (October 23, 2026): args.ui no longer reports a target on a scrolled page as covered. The isolated-world hit test used DOM.getNodeForLocation, which does not take viewport coordinates, so on a scrolled page (Douyin's post page) it answered for a different spot and clicks fell back to synthetic ones. It now uses elementFromPoint in the isolated world, which takes viewport coordinates, passes through pointer-events: none, and never calls the page's own copy. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.260 (October 23, 2026): args.ui clicks through overlays with pointer-events: none (a select's arrow, an icon over a button) instead of reporting the target covered and falling back to a synthetic click, as seen on Douyin's post page. The --launch stealth script no longer replaces natives a page can check: the Error.prepareStackTrace / captureStackTrace wrappers are gone and the disable-devtool querySelector shim is off unless AGENT_BROWSER_DISABLE_DEVTOOL_SHIM=1; botcheck's patched-natives check passes in --launch mode and stealth-bench --launch passes everything it did before (#703). setOn takes an element, also one not in the page, so adapters no longer mark inputs to name them by selector. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.259 (October 23, 2026): Site adapters can run where the page cannot see them. An adapter that declares "world": "isolated" in @meta runs in the tab's isolated world (same DOM, cookies and storage, its own JS), so its querySelector, fetch and the like never go through a wrapper the page installed. What only page JS has (a React fiber, an app store, the page's own signed fetch) comes through the new args.page(fn, ...args), which runs fn by its source in the main world with JSON args and returns its JSON result. Adapters without the key run as before. The douyin, bilibili-creator, youtube-studio and twitter write adapters in chrome-use-sites move to it. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.258 (October 23, 2026): Every command reads the page from an isolated world. 1.5.257 did this for args.ui and scrollintoview; now snapshot, click, type, fill, hover, find / getby*, get text and the rest do too. chrome-use's own page reads (finding, measuring and hit-testing elements, reading values and text) used to run in the page's main world, where a page wrapping querySelector, getBoundingClientRect, getComputedStyle or innerText sees an <anonymous> caller. Each Runtime.evaluate and DOM.resolveNode chrome-use sends without naming a context now goes to the tab's isolated world (recreated after a navigation; same-process frames fall back to the main world), so the page's own functions are never called. What has to see the page's JS still runs in the main world: your eval, wait --fn, extract, addscript, pushstate, site adapters, the React tools, the vendor probe, site analyze, stealth status, the passkey guard, and fill / value reads on Monaco and CodeMirror. AGENT_BROWSER_MAIN_WORLD=1 puts everything back in the main world. The popup guard no longer leaves window.__chromeUsePopupGuard in the page. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.257 (October 23, 2026): args.ui and scrollintoview read the page without the page seeing it. botcheck 0.2 wraps the page's querySelector, getBoundingClientRect, elementFromPoint, getComputedStyle and friends and looks at who calls them (rebrowser's mainWorldExecution does the same for one function); chrome-use called them from the page's main world, as an <anonymous> caller. args.ui and scrollintoview now find and measure elements in an isolated world and hit-test with CDP's DOM.getNodeForLocation, so the page's own functions are never called. An adapter's own page reads are still the adapter's; other commands follow in later releases. Scrolling an element into view keeps going until it is in view (up to 60 wheel steps), stopping early only when the element no longer moves. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.256 (October 23, 2026): scroll and scrollintoview use the wheel by default. 1.5.255 moved scroll --until to the wheel, but plain scroll and scrollintoview still moved the page with scrollBy / scrollIntoView, which a page sees as scrolling with no input. With humanize on (the default) they now wheel over the element or the page; scrollintoview wheels over the container the element scrolls in, re-measuring after each step. A wheel that moves nothing falls back to the old way; AGENT_BROWSER_HUMANIZE=off keeps it. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.255 (October 23, 2026): Stealth by default for the everyday commands. botcheck (botcheck.leeguoo.com, our own detector for what automation leaves in a page and how its input looks) found that click, type and scroll --until gave themselves away; they now behave like a person by default. Input is humanized at the Fast level everywhere (curved pointer path, landing jitter, varied key gaps) and at the Human level on sites with their own bot checks the vendor detector cannot see (Douyin, TikTok, Xiaohongshu, Bilibili, X, Weibo, Kuaishou, Zhihu, Taobao, Tmall, JD, Pinduoduo, Instagram, Facebook, LinkedIn, YouTube). A click by CSS selector no longer lands on the exact centre every time. type on a web page types with key presses without --key-events, and Chinese or emoji go through an IME composition, a few characters per commit; non-http(s) pages (VS Code and Electron webviews) keep the bulk insert. scroll --until scrolls with the wheel, falling back to scrollBy for a step the wheel does not move. Capitals and shifted symbols wait a human-sized moment after Shift. AGENT_BROWSER_HUMANIZE=off restores the instant behaviour. A running site adapter leaves nothing on window: botcheck found 1.5.253's Symbol.for slot through Object.getOwnPropertySymbols, and the daemon now reaches the run object by its CDP handle; a navigation still ends the run and is reported as interrupted. args.ui.type writes Chinese through an IME composition too. Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.254 (October 22, 2026): Stealth mode switch, on by default. The extension's options page has a Stealth mode switch (ab-connect 0.5.82); while it is on, chrome-use adds nothing of its own to the pages it drives, and features that draw into pages work only with it off. Today that is the agent cursor: its switch is greyed out under stealth mode, and a cursor turned on before this stays dark until stealth mode is off. Inspect & Ask works either way, since you start it yourself. Contributors, reviewers and releases now check every change for anything a page could see ("Stealth first" in AGENTS.md and a pull request template). After a site adapter's args.ui click, hover or scroll, the daemon's pointer is where it left it, so a coordinate-less mouse down no longer presses at the old spot (#698), and the wait between scroll steps varies instead of a fixed 120 ms (#699). Works with extension 0.5.82. Contributors: @leeguooooo.
• v1.5.253 (October 22, 2026): Site adapters can have chrome-use do their input: args.ui. An adapter runs inside the page, so its own el.click(), dispatchEvent and execCommand are isTrusted: false events with no pointer movement and no key presses, which a site's bot checks can see. A write adapter can now call args.ui.click(el), hover, type(el, text, {clear}), typeHere(text), press(key, {repeat}) (chords such as Mod+a) and scroll(el | pixels), with an element or a CSS selector. The daemon wheels the element into view inside its scroll container, picks a point that is really on it, and clicks or types with real CDP input at a human pace (a curved pointer path, press dwell, varied keystroke gaps), whatever the anti-bot detector made of the site. ASCII goes as key presses, capitals and shifted symbols with Shift held; Chinese and emoji go in a few characters at a time after a pause, the way an IME commits them. A call fails with a reason when the element is gone, has no size or is covered, and names what covers it. A request the adapter does not wait for is still served before its result is read, so a last click before the page navigates still lands. The douyin, douyin-creator, bilibili-creator, youtube-studio and twitter write adapters in chrome-use-sites use it and keep their old events on older chrome-use. A running adapter is no longer a named window property: it lived at window.__cu_site_<id> (__cu_eval_<id> for eval --background), which a page script listing Object.getOwnPropertyNames(window) could match on its fixed prefix; it now lives under Symbol.for(<random id>), which Object.keys, getOwnPropertyNames and for…in do not list. type --key-events and args.ui sent H, # or @ with shiftKey false, which no keyboard produces; Shift is now held around them, and !@#$%^&*() use their digit keys (Digit1…) instead of an empty code. The seed for humanized input started from a constant, so every daemon replayed the same pointer paths and keystroke gaps; it now starts from a random value. The at (x,y) WxH in a find … click reply read fractional coordinates as 0 (at (0,205) 0x18 for an element at x 525, 66 wide); the click itself was not affected, and the reply now shows where the element is. After an adapter's input request the page is polled every 100 ms again, instead of adding up to a second per request. Contributors: @leeguooooo.
• v1.5.252 (October 21, 2026): Agent tab groups no longer pile up in Chrome's saved tab groups. Chrome keeps every tab group still open when its window closes or the browser quits as a saved group (signed in, on every device), and no extension can delete one. chrome-use left a project's ✦ group open, collapsed, after its last session ended, so quitting Chrome before the next session or the 30-minute sweep saved it. Now the tabs leave the group when the last session idles out, and tabs cleanup and the automatic sweep do the same for any agent group nobody works in; the tabs stay, the project's next session still takes them over and regroups them, and the sweep still closes them. When Chrome restores the last session, ab-connect 0.5.81 takes the tabs of restored agent groups out of them, which deletes those saved groups too, without closing a tab. Groups saved earlier cannot be removed by chrome-use, and a group whose session is still running when Chrome quits is still saved (#692). Contributors: @leeguooooo.
• v1.5.251 (October 21, 2026): site add takes OpenCLI adapters and plugins. It detects an OpenCLI-format source (an OpenCLI plugin repo such as chrome-use site add darinouyang/opencli-plugin-shipxy, a zip, or a local dir like ~/.opencli/clis) and runs its commands through the OpenCLI runtime chrome-use already ships, over your chrome-use session; they show as (opencli: <source>) in site list. .js modules are supported, and .ts-only plugins on Node 22.13+ (Node's type stripping); YAML-only plugins are refused with a message, since OpenCLI itself stopped loading YAML in 1.8. OpenCLI adapters run as Node code with your user's permissions, not in the page like ours, so a local dir is added directly, while a remote source is pinned to the commit (a zip, or a repo fetched without the GitHub API: its SHA-256) you trusted: at a terminal site add lists its modules and asks, and scripts and agents must pass --trust-node-code. site update re-copies local dirs and never moves a pin; run site add again to review a newer version. On a shared name our adapters still win, then added OpenCLI sources, then the OpenCLI package; site sources and site remove cover them too. Works with extension 0.5.80. Contributors: @leeguooooo.
• v1.5.250 (October 20, 2026): A session no longer takes over the tabs of another session of the project that is still at work. A new session used to take over the tabs of any session whose daemon was not answering, also while that session's agent waited on a command (as when a relay recovery stopped the daemon mid-command). A session now counts as ended only with no daemon, no chrome-use process working with it and no command for two minutes; a daemon that starts or resyncs no longer adopts such a session's tabs, and a tab another session opens meanwhile is not taken as the one a click opened. A command that was sent and never confirmed (daemon still busy past the deadline, reply lost, daemon gone mid-command) exits non-zero with code action_outcome_unknown, is never retried, and says it may have run. New chrome-use session last lists a session's recent commands as completed, failed, running or unknown without running anything or starting a daemon (only the action, the site adapter name and the outcome are recorded), so an unconfirmed side-effecting command can be checked instead of repeated. Relay recovery no longer stops every native host on the machine, which also cut other profiles' relays and ones another session had just restored; it stops only hosts of this install that serve no published relay endpoint (#687). Works with extension 0.5.80. Contributors: @leeguooooo.
• v1.5.249 (October 20, 2026): After a CLI upgrade, a __nm-host Chrome started earlier keeps running the old binary, and one from before 1.5.239 reports no version, so the side panel said the CLI was too old and told you to reinstall even when the binary on disk was current. The extension now reconnects once, while no command or side panel request is running, and shows that notice only if the fresh host still reports no version (ab-connect 0.5.80, #684). Two Rust tests that failed on Windows and intermittently on macOS are platform-independent (#685). Contributors: @Jerryx333, @leeguooooo.
• v1.5.248 (October 20, 2026): hover takes a viewport point like click: hover 767 340 (also 767,340, --coords 767,340 and x=767 y=340, which click now reads too) moves the real pointer there, for a tooltip or badge with no stable selector; the reply names the element that got the trusted move (receivedBy, verified), and a point inside a cross-origin frame is moved to but reported unconfirmed. MCP chrome_use_hover takes x and y. A lone or odd count of numbers, or a numeric "selector" the page rejects, now points at the coordinate form (#662). A page that stops answering is told apart from a lost connection: when a command times out on the extension relay, chrome-use asks the extension about the tab through chrome.tabs, which needs no renderer. If Chrome still answers, the tab is alive and its page is busy (a script blocking the main thread, or a page still loading on a held-open connection): wait and retry, instead of the unhelpful "restart the session and retry". If nothing answers, the connection is gone: open a fresh tab or session. A screenshot of a busy or closed tab says so instead of "screenshot target drifted … unknown target" (#661). Works with extension 0.5.79. Contributors: @leeguooooo.
• v1.5.247 (October 20, 2026): Under the picked elements in the side panel composer, Copy elements puts every picked element's context (page, selector, how to reach it inside frames and shadow roots, source, text, bounds, HTML) on the clipboard, and Copy message adds your words in front, as the agent would get them; nothing is cut to the send limit, and a screenshot or attached image says it is not in the copied text (#680). Images you attach or that come with picked elements already reached Codex, Claude Code, OpenCode and Pi as image input; the message text now also ends with their local file paths ("attached image N" is item N), so an agent handing the task to another session no longer drops them (#680). MCP chrome_use_snapshot takes diff: true; changing filter takes a new full baseline, and a valid delta lists only the refs it shows while the session keeps every live ref. read --help has its own page, and read --filter is a literal, case-insensitive match (not a regex, unlike snapshot --filter). Closed agent tabs no longer leave saved tab groups: right after the extension's worker restarted, for agent pop-ups, and for tabs the cleanup closed directly, tabs used to be closed while still in their group, so groups such as cu-chatdev-* piled up; they now leave the group first, and tabs you own, lent or adopted keep theirs (#674). A click refused because something covers the element is reported as element_occluded instead of a retryable timeout when the cover's text mentions one. Works with extension 0.5.79. Contributors: @leeguooooo.
• v1.5.246 (October 20, 2026): auth login --bwu picks the right vault item among many: bwu lists every login of the site's registrable domain (32 for apple.com), and the login used to stop at "pick one with --item". Among several it now uses the item that signed in to the host last time (recorded only once the site took the login, by id only, in ~/.chrome-use/bwu-items.json), else the one named exactly the page's host, else the one named exactly the host of the page's sign-in frame (App Store Connect signs in through an idmsa.apple.com iframe), and says which and why on stderr, even with --json; otherwise the list shows items named for the page, its sign-in frame or its site first, and --item takes a name in any case. Login walls with auto-login choose the same way. A sign-in frame in its own process that loads after auth login started is now found (with or without --bwu), and the submit no longer fails when that frame goes away with the page. A password manager's inline menu on a background agent tab in your own window used to block every command until you pressed Escape; chrome-use now activates a blank tab in its own agent window, which Bitwarden takes as a tab change and closes the menu, leaving your window, the tab you are on and the focus as they were. A window opened for this holds only that blank tab and stays minimized for the session: the first time it is seen for about a second while it minimizes (measured on macOS), later times nothing shows. An agent window that already holds other agent tabs (--window dedicated) is used as it is and not minimized. A tab you are looking at in your own window is still left to you. auth login also takes the cursor out of each field it filled, so the menu usually closes before it gets in the way. Works with extension 0.5.78. Contributors: @leeguooooo.
• v1.5.245 (October 20, 2026): Extension 0.5.78 gets a warm new look: the side panel, popup, settings page and Inspect & Ask frame share one theme.css with a paper-coloured ground, one clay accent, a system serif for titles and agent replies and monospace for status and metadata; light and dark both pass 4.5:1 text contrast. New icon: a cream pointer on clay, drawn separately for 16px. Agents & models is grouped: agents you can chat with first, installed ones below, missing ones as chips under the list (dashed: configuration found, program missing); a whole row opens its configuration. Contributors: @leeguooooo.
• v1.5.244 (October 20, 2026): Drive the agent chat from your phone: chrome-use mobile. chrome-use mobile serve runs a gateway the chrome-use Remote app (iOS) connects to over your own route: Tailscale, a Cloudflare named tunnel or the LAN; we run no relay for traffic. From the phone: list conversations, start one, send text and up to five images, follow progress live (a reconnect resumes with no missing or repeated events), answer approvals, stop a turn, screenshot the conversation's own browser session (only if it is already running; a phone never opens a browser), list models, and run or switch scheduled tasks. mobile pair --url ws(s)://… prints a QR code valid once within 10 minutes; also mobile devices, mobile revoke <id> (drops it within a second), mobile access <id> full|limited and mobile push-test <id>. It listens on 127.0.0.1:17345 by default; --trust-cf-header is for cloudflared on the same computer, --name sets the computer name the app shows. Every frame is end-to-end encrypted (HMAC handshake, AES-256-GCM per direction, strict sequence numbers), so a tunnel that terminates TLS sees no instructions, page text or screenshots; pairing adds a secret the phone generates, so the link left in the terminal stops working once paired. The phone gets less than the desktop: no full access, conversations it creates go up to writeFiles (Pi: browser tools only), no project folder, executable, configuration, skill or schedule edits, and it cannot raise a conversation's access; conversations with full access, command execution or Pi beyond the browser can be read, stopped and declined, but sending, approving and running them needs mobile access <id> full on the computer. The gateway never forwards /api/v1/*, the stream WebSocket or the panel service's capability, and refuses browser connections. New push notifications when an agent waits for approval, a turn ends, or a scheduled run finishes or fails, at most one per conversation every 10 seconds (each conversation can be muted), through a stateless Cloudflare Worker (https://chrome-use-push.leeguoo.com) that only sees ciphertext. The side panel and another reader polling the same conversation at different positions no longer make every read rescan the whole journal. Works with extension 0.5.77. Contributors: @leeguooooo.
• v1.5.243 (October 19, 2026): Agent tabs are grouped by project, not by session. The project is the side panel conversation's project folder, else the git repository around the working directory, else the working directory, so two terminals in one repository and every new conversation there share one ✦ <project> group instead of each opening another; a name another project already uses gets its parent folder added, once. Each session drives only the tabs it opened: tabs of the project's other running sessions are left to them, so two agents working at once never take each other's tabs, and done in one closes only its own; once a session's daemon has ended, the project's next session takes its tabs over and reuses them. The same page is not opened twice: open switches to the session's tab already on that page (ignoring the #fragment and tracking parameters such as utm_*, fbclid, gclid), in the background and without reloading; open --new-tab opens another. Different projects never share tabs, and your own tabs are never moved or grouped. When the last session of a project idles out, its group collapses at once; its tabs close after 30 idle minutes (AGENT_BROWSER_GROUP_CLEANUP_MS, 0 turns that off). A session's first-connect blank tab that was never used (the session only read, or did nothing) no longer stays behind in its own group: a tab still on about:blank or the new tab page closes when its session idles out, the cleanup closes such tabs of an ended session at once (no 30-minute wait) and the group goes with them, a blank tab never counts as yours even in front, and tabs cleanup clears them too. On upgrade, a session whose tabs are in a group named after it (1.5.236–1.5.242) moves them under its project's group the next time it runs. With the relay down, Chrome is started only when it provably is not running: a connected extension counts as running, and a process list that cannot see the system's processes (as in Codex's macOS sandbox) proves nothing, so a sandboxed agent no longer starts a second Chrome. Tabs left for you (keep, done --keep, the cleanup) are never picked up by another session of the project. Works with extension 0.5.77. Contributors: @leeguooooo.
• v1.5.242 (October 19, 2026): Agents clean up after themselves, and tab groups no longer pile up. At the end of a task the agent runs chrome-use done and decides itself what stays: --keep <tab> leaves a page you still need (a result to look at, a login left for you) as a plain tab outside the ✦ group, and every other tab it opened is closed, without asking you; the skill and usage guide tell agents to do this at the end of every task. Sessions that end without it: once the daemon has exited and the session has been idle for 30 minutes (AGENT_BROWSER_GROUP_CLEANUP_MS, 0 turns it off), the next new session closes its tabs in the background, leaving a tab you are looking at or switched to, ungrouped; tabs you lent and adopted tabs are never closed. A new task in the same terminal and directory continues the previous task's group instead of opening another; status names the session's group. New chrome-use tabs cleanup clears every ended session's group at once (including ⬉ and 🤖 groups from older builds). keep now really takes the tab out of the group. On macOS, opening Inspect & Ask no longer triggers "Apple cannot verify .bun-501-….dylib": ocs now runs in the panel service that launchd starts, outside Chrome's quarantine. The agent cursor no longer slides in from the top-left corner and its tip sits on the click point. Works with extension 0.5.77. Contributors: @leeguooooo.
• v1.5.241 (October 19, 2026): Sites that hold many projects go by project, not by domain: App Store Connect apps (TestFlight included), Vercel, Netlify, Cloudflare Workers and Pages, Firebase/Google Cloud and Sentry projects are read from the URL by a rule table in the CLI; a recent folder whose fastlane (app id), .vercel/project.json, wrangler.toml, .firebaserc or .sentryclirc names the project is preselected as "Matched by project". Remembering defaults to "This app / This project", named by the page title, and never binds such a site whole. Repository remotes behind an ~/.ssh/config host alias (git@github-work:…) match by their HostName. Works with extension 0.5.76. Contributors: @leeguooooo.
• v1.5.240 (October 19, 2026): Repository pages pick their project by repository, not by domain: on github.com/<owner>/<repo> and other code-host pages (GitLab subgroups and self-hosted Gitea, Gogs and GitLab included) the side panel preselects the recent folder whose git remote is that repository, shown as "Matched by repository"; a site-wide binding no longer overrides it, while a project bound to the repository itself still wins. Remembering a project lets you change the scope in place, defaulting to "This repository" on repository pages and never to a whole code host; the options page can change a binding's scope. Works with extension 0.5.75. Contributors: @leeguooooo.
• v1.5.239 (October 19, 2026): The CLI keeps itself current. Background upgrades used to be opt-in and the only signal was a stderr line, so most installs stayed on their first version. When a newer release exists, any command, and the native host whenever Chrome starts it, installs it in place in the background (effective on the next run) and refreshes the skill copies; CHROME_USE_AUTO_UPGRADE=0 turns it off and leaves the notice. A CLI in a folder it cannot write, or a cargo build, is never replaced. On macOS the upgrade runs as a launchd job so that one started from inside Chrome does not install a quarantined binary. The last background upgrade's outcome is kept, and doctor says why a CLI is behind and what to run. Extension 0.5.74 shows version state in its popup and side panel: an outdated CLI (an Update CLI button when it can replace itself, the command otherwise), a failed background upgrade and why, a CLI from before this release that must be reinstalled once; it switches to a newly installed CLI when no agent is working, and announces its own updates. Works with extension 0.5.74. Contributors: @leeguooooo.
• v1.5.238 (October 19, 2026): A link the agent opens in a new tab no longer takes over the tab you are looking at. Since 1.5.236 agent tabs share your window, and Chrome opens a page's target=_blank link or pop-up as the window's front tab. While agent tabs share your window, chrome-use now opens cross-site target=_blank links in a background tab itself, so Chrome neither switches your tab nor comes to the front (AGENT_BROWSER_BACKGROUND_LINKS defaults to cross-site in that mode; off turns it off; the cost is unchanged: a link that redirects back to the page's site loses its SameSite=Strict cookies). For every other tab an agent tab opens (same-site links, window.open), extension 0.5.73 brings back the tab that was in front; the pop-up stays open behind it, adopted by the session (--follow follows it). Until Chrome updates the extension, those still switch your tab and are not adopted. Agent tab groups are marked with a plain ✦ instead of ⬉; a session running during the upgrade opens a new ✦ group, once. Works with extension 0.5.73. Contributors: @leeguooooo.
• v1.5.237 (October 19, 2026): In /resume, the confirmation for a session still running in a terminal no longer overlaps the panel below. Works with extension 0.5.72. Contributors: @leeguooooo.
• v1.5.236 (October 19, 2026): Agent tabs open in your own window again: background tabs that do not take focus, each session in its own tab group whose title starts with ⬉ (⬉ 🔎 track a parcel). The separate agent window had to be found before you could watch or take over; --window dedicated or AGENT_BROWSER_DEDICATED_WINDOW=1 brings it back. Groups made by an older build have no mark, so a session running during the upgrade opens a new ⬉ group next to its old one, once. Contributors: @leeguooooo.
• v1.5.235 (October 17, 2026): On macOS chrome-use installs as ChromeUse.app: a signed, notarized and stapled bundle in <prefix>/share/chrome-use/, with chrome-use a symlink into it. Files and Folders in System Settings keyed the bare binary by its path, with no name or icon, and added an entry for every other copy; the panel service, the agents it runs and the extension's native host now count as one "ChromeUse" with its icon, and its prompts say why access is asked for. upgrade installs into the same directory as before, older tags without the bundle still install the bare binary, and AGENT_BROWSER_NO_APP_BUNDLE=1 opts out. Linux and Windows are unchanged. Contributors: @leeguooooo.
• v1.5.234 (October 17, 2026): Instant scrolling brings background form controls into view despite CSS smooth scrolling; unchanged page/container positions are reported and scrollintoview checks the viewport. Custom comboboxes open and select with trusted pointer input; pick reports hidden form changes when search text clears and warns about unconfirmed choices (#656). Contributors: @leeguooooo.
• v1.5.233 (October 17, 2026): Messages sent while the agent is working no longer show twice (once in the conversation with "Checks not recorded", once in the queue); they stay in the queue until their turn starts. Thermo's tab organizer can add tabs to a group it made earlier, and new groups stay in the tabs' own window. Works with extension 0.5.71. Contributors: @leeguooooo.
• v1.5.232 (October 16, 2026): Picking a button with Pick element no longer clicks it (picking a search button used to submit the search). Works with extension 0.5.70. Contributors: @leeguooooo.
• v1.5.231 (October 16, 2026): A Pick element button in the side-panel composer puts a clicked page element straight into the message box with its screenshot (and file and line when the project's source is found); Shift picks several, Esc cancels. Inspect & Ask goes to the side-panel chat by default, with terminal sessions as the second choice. Options can allow element picking on all sites at once. Works with extension 0.5.69. Contributors: @leeguooooo.
• v1.5.230 (October 16, 2026): Stopping or recovering a conversation no longer reports the outcome as unknown when the agent's process group is still exiting (it was mistaken for another user's processes); /resume shows each session's folder resolved, so a symlinked project matches the site's remembered project. Works with extension 0.5.68. Contributors: @leeguooooo.
• v1.5.229 (October 16, 2026): New chrome-use upgrade -f: no setup prompt, then it stops the side panel conversations and service of an older build so the installed build takes over, even when already up to date; the panel's older-build notice can copy the command. Fixed a conversation an older build was running being unable to read its screenshots, borrow a tab or answer prompts in the panel. Works with extension 0.5.68. Contributors: @leeguooooo.
• v1.5.228 (October 16, 2026): A tidier side panel composer: the attached page and "Agent works in" share one row of chips, Attach images and Conversation options are icons, Full access, recording and Stop & send share one style, and recording is a dot toggle. Works with extension 0.5.67. Contributors: @leeguooooo.
• v1.5.227 (October 16, 2026): /resume groups sessions by project, most recent first, with Show more and search across titles, project names and paths; the current site's project comes first. Fixed every Codex session showing as just now and active elsewhere (Codex Desktop rewrites files when importing sessions). Works with extension 0.5.66. Contributors: @leeguooooo.
• v1.5.226 (October 16, 2026): Stop always ends the agent's whole process group on macOS and Linux; before, depending on timing, child processes were sometimes left running and the turn ended as outcome unknown. Windows already ended the whole job. Works with extension 0.5.65. Contributors: @leeguooooo.
• v1.5.225 (October 16, 2026): A redesigned Agents & models view (card lists, status badges, configuration under its agent, editors closed until needed); the project folder is a visible chip in the composer, "No project folder" or the folder you chose. Works with extension 0.5.65. Contributors: @leeguooooo.
• v1.5.224 (October 16, 2026): Lending fixes: an automatic lend no longer goes to a conversation you switched to meanwhile; a tab taken back in a panel tab is not lent again by the side panel; moving a conversation while its old panel is sending no longer leaves two panels on it. Works with extension 0.5.64. Contributors: @leeguooooo.
• v1.5.223 (October 16, 2026): One side panel and conversation per tab; the side-panel agent works in the tab it sits beside by default (AI badge, take back any time) instead of opening a window; slash completion anywhere in a message, including plugin skills; no raw text keys; an update blocked by an old conversation offers Open and Stop it. Works with extension 0.5.63. Contributors: @leeguooooo.
• v1.5.222 (October 16, 2026): When an older build's panel service still has a conversation running or waiting for your answer, the error now names those conversations so you can answer or stop them before sending again. Works with extension 0.5.62. Contributors: @leeguooooo.
• v1.5.221 (October 16, 2026): A conversation can open as a full-page tab that stays in sync with the side panel, and you can lend the agent one of your tabs (marked with an "AI" badge, taken back at any time, later calls refused). Works with extension 0.5.62. Contributors: @leeguooooo.
• v1.5.220 (October 16, 2026): /resume continues a terminal Codex, Claude Code or OpenCode session in the side panel; a new conversation can run in a project folder (recent folders or the system picker) and sites remember their project; the extension is localized in Chinese; Inspect & Ask replies no longer reach a terminal session of the same name. Works with extension 0.5.61. Contributors: @leeguooooo.
• v1.5.219 (October 15, 2026): The connect profile list marks profiles whose extension is behind the newest build, with how long ago each was last opened and how to update (Chrome only updates a profile's extensions while it is open). The panel service unloads the launchd job that started it, so no idle jobs pile up. Works with extension 0.5.58. Contributors: @leeguooooo.
• v1.5.218 (October 15, 2026): Recovery works on macOS again: the launchd-started panel service now runs in its own session, so after an unconfirmed stop the side panel can prove the old agent process and offer End the old agent process and Continue in a new conversation (broken since 1.5.208). The passkey guard restore also finds a guard moved deeper in the prototype chain. Works with extension 0.5.58. Contributors: @leeguooooo.
• v1.5.217 (October 15, 2026): A browser check counts toward a requirement only when the agent cites the same check (the value must match exactly; operator words, outer quotes and spacing may differ). The passkey guard used by auth login --bwu never reports clean while a guard is still in place. Snapshot refs named by text are not reused for new content. Works with extension 0.5.58 (#634). Contributors: @leeguooooo.
• v1.5.216 (October 15, 2026): Agent panel patch. A requirement counts as checked only when the cited browser check records what the agent describes (paraphrases accepted); an unrelated check is reported as claimed. Redaction keeps protocol fields only at their protocol positions, withholds streamed answers past 256 secrets while still learning split secrets, and refuses messages too large to record. The passkey guard used by auth login --bwu covers existing and cross-site frames and is restored by identity. Object groups are released on cancellation. Works with extension 0.5.58 (#633). Contributors: @leeguooooo.
• v1.5.215 (October 15, 2026): The side panel shows each request as one turn: the page it was sent from, the pages the agent actually acted on, a verdict per browser action, the answer and an outcome. Browser calls run under leases from the panel service, so evidence is linked to steps by action id and nothing runs after Stop. The badge reports only recorded browser checks ("Agent's browser checks passed", "Not checked"), never "Verified". Screenshots, downloads and consented recordings are kept per conversation and checked by SHA-256. An unknown outcome offers Review, End the old agent process (only with proven ownership) and Continue in a new conversation. Secrets are masked before anything reaches the journal; approvals are built by the service from the original input. Task notifications with a toolbar count; HEIC photos are converted to upright JPEG without EXIF. Native fixes: selectors matching several elements are refused (selector_ambiguous), snapshot refs survive name re-renders, rich-text verification ignores zero-width and NBSP formatting, observed clicks report toasts, follow reports tabs it cannot take, and the request log is capped. Codex full access with browser-only tools no longer refuses chrome_use calls. Requires extension 0.5.58 (#631). Contributors: @leeguooooo.
• v1.5.214 (October 15, 2026): Inspect & Ask now matches pages to local projects and sessions. The first pick on a site (or a path of it) shows one card naming the session, its folder, the project and the evidence; Hand over makes it the default, Only this tab applies to one tab. Only local evidence preselects: a committed .chrome-use/inspect.json (single-label wildcards, per-path pathScope, shared sourceRoots) or the local dev server's folder, with exactly one session there. Test environments rank by CI source paths and by how the deployed revision relates to each worktree. New chrome-use inspect link/unlink/list lets a session claim a site; claims on a site owned by another session wait for your OK in the browser. Every send carries the path and target the panel showed, so a single-page route change, an accepted claim, an unlink or a rebinding refuses instead of redirecting. The side panel keeps stop and send together. Requires extension 0.5.57 (#628). Contributors: @leeguooooo.
• v1.5.213 (October 14, 2026): Adds Inspect & Ask. Press Alt+Shift+C (or Inspect element in the toolbar popup), click elements, write what should change, and send it with each element's source file:line, screenshot and styles through ocs to the Claude Code, Codex or Pi session already working on that project, on local dev servers and test-environment domains. Source locations come from code-inspector-plugin's data-insp-path marks, with React 18 and Vue dev metadata as fallbacks; absolute CI marks match by path suffix inside the bound project only. Multi-select, area select, parent/child, animation pause, per-element notes and a screenshot pen, Copy as Markdown and Open in editor. The first send on a site picks the project and session; source-mark setup and test-build marks are proposed with the exact changes and run only after you agree. The input box runs in the extension's own frame behind a one-time secret, every send re-checks its visibility, and picking never triggers page buttons or links. Deliveries carry batch ids, are never replayed, and report storage and wake separately. Requires extension 0.5.56 (#626). Contributors: @leeguooooo.
• v1.5.212 (October 14, 2026): Windows gains full agent-panel parity: four conversational adapters, CLI model inspection, configuration transactions, skills/imports, images, per-conversation options, schedules and panel MCP. No administrator access is needed. Owned Windows Jobs confirm complete process-tree exit; protected user/SYSTEM ACLs secure private state, atomic configuration replacement preserves permissions and verifies file identities. Native exe and cmd/bat entry points are supported; environment names such as Path are matched without case sensitivity. Dedicated Windows tests exercise the full native-host pipeline. Extension 0.5.55 limits model probes to the selected CLI. Contributors: @leeguooooo.
• v1.5.211 (October 14, 2026): Extension 0.5.55 stops starting Codex whenever the side panel opens. A new chat defaulted to Codex and read its model list, so Claude Code users ran the Codex CLI on every open, and a Mac with an outdated Codex build answered each time with "codex contains malware". The panel now remembers the agent you chose, or the one from your latest conversation, and reads models only for that agent. When a CLI is killed the moment it starts, as Gatekeeper and XProtect do, the panel says the system blocked it and suggests updating or reinstalling instead of "Model metadata unavailable". Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.210 (October 14, 2026): Extension 0.5.54 adds panel skill selection and a shared library with folder, ZIP and HTTPS Git imports. Selected skills and assets stay with messages across queueing and retries. Paste, drop or choose up to five images, sent through each agent's native protocol and kept with history. Per-conversation tool scope, Codex/Claude reasoning effort and Codex service tier leave global settings unchanged; old processes exit before changed options take effect. Interval, daily, weekday and five-field cron prompts run in independent background sessions with history and notifications. Missed periods coalesce; active or unknown runs are not replayed, and cross-adapter scheduling cannot gain tools or approval authority. Fixes default-effort restoration on Codex resume, missing run history blocking other tasks and wrapped archive imports. The Windows panel remains read-only. Extension 0.5.54 has passed Google review and is publicly available. Contributors: @leeguooooo.
• v1.5.209 (October 14, 2026): Extension 0.5.53 gives the toolbar popup (shown when Chrome has no side panel) the side panel's colours, system dark mode and a Settings button. The Web Store listing gets four new screenshots, a promo tile and a marquee, rendered from the real side panel by scripts/store-screenshots.sh. README illustrations move to WebP (4.4 MB down to 180 KB) and the README shows the side panel; the docs site's VIP badge drops from 1.38 MB to 6.6 KB, and unused images and old extension zips are removed. Store publication follows Google review. Contributors: @leeguooooo.
• v1.5.208 (October 14, 2026): macOS no longer blocks an agent's library with "Apple could not verify '.bun-501-….dylib' is free of malware". Agents started from the side panel inherited Chrome's file quarantine, so OpenCode, Claude Code and other Bun-built CLIs had the native libraries they unpack to $TMPDIR/.bun-<uid>-*.dylib quarantined and refused. The panel's agent service now starts through launchd, outside Chrome's process tree, and on start clears the quarantine from .bun-* libraries earlier runs left behind. Contributors: @leeguooooo.
• v1.5.207 (October 14, 2026): Extension 0.5.52 folds consecutive tool calls in the side panel into one group that stays open while a step runs and then collapses to "4 steps · 1 failed", keeping the reply in view; a group you opened stays open. Running steps show a spinner, a step left open when a response ended no longer looks busy, and three dots show the agent is still working when nothing else does. The toolbar uses one icon set, queued messages read as pending bubbles, tables get rounded borders, and the empty state offers three example tasks that fill the message box without sending. Agents & models shows a status dot per agent (signed in, signed out, installed, not installed), highlights the agent being configured, suggests reported model IDs and reasoning effort levels, and previews changes as old → new. The extension settings page uses the side panel's colours and follows the system dark mode. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.206 (October 14, 2026): When the extension declines to open a tab before creating anything, open now reports first tab refused … Nothing was opened or attached. (code first_tab_refused) instead of an unknown outcome that sent you looking for a blank tab that was never opened. After a refused first open, including profile not open, tab list --all in that session no longer fails with Browser not launched; it falls back to the read-only listing a fresh session uses, still attaching to and creating nothing. Contributors: @leeguooooo.
• v1.5.205 (October 13, 2026): Your own tabs in the agent window no longer make every later open fail with "the shared agent window contains user tabs". That window becomes yours, its agent tabs keep working, and new agent tabs go to one fresh agent window that later sessions share; your tabs are never moved or closed. After a native host disconnect the extension retries after 1 second, backing off to at most 30 seconds, and command and event waits end instead of hanging. Requires extension 0.5.51; Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.204 (October 13, 2026): Extension 0.5.49 adds a conversation menu with a "This site · x.com" / "All" switch. A conversation belongs to the main domain of the page its first message came from, so mobile.x.com conversations show on x.com. Entries show the agent, site and age, and the view choice is remembered. Earlier conversations have no site and appear under All. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.203 (October 13, 2026): Extension 0.5.47 renders panel replies as Markdown: headings, bold and italic, inline and fenced code, lists, quotes, tables and links instead of raw markup; nothing is treated as HTML and only http(s) links are clickable. Browser tool rows read "Browser · open" with the URL, action or command instead of internal names like mcp__chrome_use__chrome_use_open, and blank-only replies no longer leave a gap. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.202 (October 13, 2026): Deleting a panel conversation cleans up its browser session. A session could keep a tab record that close can never verify (an old target id, or a tab opened before Chrome restarted), leaving its daemon running. Delete now tries close, then close --forget-untracked, then session stop --force for that conversation’s own session; only a plain close reports tabs closed, otherwise the panel says a tab may remain. Contributors: @leeguooooo.
• v1.5.201 (October 13, 2026): Extension 0.5.46 fixes slow panel operations being cut off: the local panel service limited every request to 10 seconds and closed the connection without an answer, so a cold OpenCode model check could fail on first load and a delete that waits for the agent and closes its tabs could run over. Model checks now get 30 seconds and deletes 45, an overrun returns an error, and each layer waits longer than the one below. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.200 (October 13, 2026): Extension 0.5.45 fixes "status unavailable" for some agents in Agents & models: the local service runs at most two CLI checks at once, so with four chat agents two failed; the panel now queues them. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.199 (October 13, 2026): The Pi model menu accepts OpenRouter aliases such as openrouter/~anthropic/claude-opus-latest, and a model id that still cannot be used is skipped instead of failing the whole menu. Contributors: @leeguooooo.
• v1.5.198 (October 13, 2026): Pi lists every configured model, and with more than 256 the model check in the panel failed; the menu now keeps the first 256 and marks the list partial. When OpenCode refuses a prompt, the panel shows its reason, such as a retired default model, instead of only "OpenCode refused the prompt". Contributors: @leeguooooo.
• v1.5.197 (October 13, 2026): Extension 0.5.44 adds OpenCode and Pi to the panel. OpenCode runs over its Agent Client Protocol (opencode acp) with streamed replies, tool rows, stop, queue, resume without replayed history and permission cards; full access allows them, otherwise the toggle reads "CLI permissions" and OpenCode applies its own rules, possibly without asking; deletion calls OpenCode's session/delete; the user's other OpenCode MCP servers stay enabled (#590). Pi runs over its RPC mode with the conversation id as its session id and the session file in the conversation folder, so resume is exact and deletion removes it; Pi never asks before tools run, so without full access it gets only the browser tools ("Browser only"), and with it all tools; the user's other Pi MCP servers are off for panel conversations and extension dialogs are cancelled. The panel lists only the agents the installed CLI can run. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.196 (October 13, 2026): Extension 0.5.43 makes "this page" mean the tab you are looking at: the panel sends the active web tab with each message as a removable chip, and the agent acts on it directly instead of listing every tab. Agents are told the chrome_use tools are already connected, so they skip reading skills, memories and docs through the shell. Tool rows show the command and output or MCP arguments and result; reasoning and untyped items are no longer listed as tools. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.195 (October 13, 2026): Extension 0.5.42 turns the panel's model field into a menu filled from the agent CLI's own catalog, with "Default model" (the CLI's configured model) first; a custom model ID in the + menu overrides it, and one CLI probe serves both the menu and Agents & models. Agents without a chat adapter (Pi, Gemini CLI, OpenCode and others) read "chat not supported in the panel yet". A delete whose tab close cannot be confirmed says a leftover tab may remain in the AI window (#583). Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.194 (October 13, 2026): Extension 0.5.41 adds full access mode for panel conversations. Codex starts with approvalPolicy=never and the full-access sandbox; Claude Code starts with bypassPermissions and all tools. Remaining approval requests are answered as Allow once; questions still go to the user. New conversations default to full access and remember the choice; existing ones switch in place, and "Allow all in this conversation" releases waiting requests, with the agent restarted on matching flags for the next turn. Agent, access and model now sit in the composer's bottom row, following the Codex and Claude apps. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.193 (October 13, 2026): Extension 0.5.40 lets the panel delete a conversation. After confirmation it stops the agent and waits for exit, then removes the panel history, the CLI's own session history and the conversation's browser tabs. CLI history is matched by exact session id under CODEX_HOME / CLAUDE_CONFIG_DIR (Codex rollouts in sessions/ and archived_sessions/; Claude Code projects/*/<session>.jsonl and its folder). Failures are listed in the panel. Codex 0.162's own SQLite caches are left alone; Codex no longer lists or opens the thread once its rollout is gone. Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.192 (October 13, 2026): Panel agents now run the same CLI as the terminal. Chrome gives the native host a minimal PATH, so a version-manager shim could start an older build (Codex 0.145.0 instead of 0.162.1) that rejected the configured model; conversations and the Agents & models check now use the directories discovery searches. "Retry with default model" appears only for an explicitly chosen model; a failing model from the CLI configuration offers "Change default model" instead. Contributors: @leeguooooo.
• v1.5.191 (October 13, 2026): Extension 0.5.39 simplifies the local agent panel: a one-row header with the conversation picker and new, refresh and settings buttons; no connection line while connected; agent and model as compact chips above the composer; Stop only while a response runs; one-line tool rows that expand. Raw agent error JSON shows as its message with the original under Details, and a failed explicit model offers a one-click retry on the CLI default. Agents & models shows each agent's reported version, login state and model count (#576, #577). Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.190 (October 12, 2026): Extension 0.5.38 keeps AI sessions in one shared background window per profile, with separate tab groups and the user's window separate. New windows use the first task tab directly, without a blank placeholder. Lost records recover verified agent windows; fullscreen does not create a replacement. Mixed user/agent windows or uncertain ownership refuse new tabs. Failed legacy-placeholder cleanup retains identity and reports any tab already created. Even the first tab list --all starts no daemon and creates no window or tab; live sessions retain their own browser (#545). Web Store publication requires Google review. Contributors: @leeguooooo.
• v1.5.189 (October 12, 2026): Extension 0.5.37 adds a local agent panel for Codex/Claude Code on macOS/Linux, with local history, streamed replies, approvals, queue edits and direct sending after verified interruption. Discover 14 agent families, preview and verify configuration changes, and restore without overwriting later edits. Model suggestions use CLI metadata, not verified execution access. First-connect loading and browser timer bindings are fixed; older hosts require upgrade. Windows panel mode is read-only and existing browser CLI automation is unchanged. Chats use independent sessions; visible-page binding is not included. Web Store publication requires Google review. Also fixes saved groups after agent tab closure, repeated-control snapshot context and site info, and improves installation/recording guidance. Contributors: @leeguooooo, @mpeter.
• v1.5.188 (2026-10-12): On macOS, a tab or pop-up an agent click opens no longer leaves Chrome in front of the user's app. Chrome raises itself when a page opens a tab, which can't be prevented, so chrome-use notes the frontmost app before a click and, when Chrome comes forward with a new tab credited to that click, brings the previous app back (front window only, nothing launched, no permission prompt); measured, Chrome stayed in front for 41–72 ms. Nothing happens if Chrome was already in front, another app came forward, or no tab opened. The click reports focusRestored; AGENT_BROWSER_RESTORE_FOCUS=0 turns it off. Windows and Linux are unchanged (#536, fixes #468). Contributors: @leeguooooo.
• v1.5.187 (2026-10-11): Site commands that run through OpenCLI now print a stderr note that they are third-party code chrome-use does not maintain, and writes are steered to our own adapters; --json adds maintainedBy: "opencli", readOnly and notice, with exit codes and behaviour unchanged (#534). twitter/like, twitter/follow, bilibili/user-videos and bilibili/creator-stats are ported into chrome-use-sites and never run through OpenCLI; like and follow only act on the named tweet or profile, never undo an existing one, and need --until-done; the bilibili commands return one object (#535). Contributors: @leeguooooo.
• v1.5.186 (2026-10-11): Requires extension ab-connect 0.5.35 (published; Chrome updates it automatically). New diag pages: a read-only report of every real page (url, title, window, active, discarded, owner) plus stale relay records, extension version lag, profile and relay state, attaching to nothing by default; --measure adds per-page heap, DOM nodes, listeners and worker heaps, needing --force for tabs chrome-use doesn't hold (Chrome shows its debugging bar while measuring), released afterwards without activation; --watch SECONDS samples twice and classifies leaks. Versioned JSON (schema: 1), exit codes 0/2/3, and the MCP tool chrome_use_diag_pages (#533, fixes #521). Contributors: @leeguooooo.
• v1.5.185 (unreleased): Works with ab-connect 0.5.34; 0.5.35 (submitted to the Chrome Web Store; Chrome updates once published) adds the update and large-reply fixes. A failed adopt leaves the session with no current tab and refuses commands instead of running in an unrelated tab you had open, across daemon restarts (#527, fixes #507). Relay uploads stream in bounded chunks: 200 MB in about 13 s, a plain 31 MB upload in about a second instead of over two minutes, one upload per browser with a queue that names its holder (#528, #532, fixes #506). Extension updates apply once the relay is quiet for 60 s, keeping sessions' tabs and refs, and doctor reports update status (0.5.35, #526, fixes #524). Replies over 64 MiB fail at once with reply_too_large (0.5.35, fixes #530). douyin/delete, douyin/update and twitter/delete now come from our own chrome-use-sites, run in the page with stealth handling, and never fall back to OpenCLI (#529). Contributors: @leeguooooo.
• v1.5.184 (unreleased): Requires extension ab-connect 0.5.34 (published; Chrome updates it automatically). tab list --all lists the tabs in every window without attaching to or activating any, labelling each with its owner (this session, another named session and whether it is live, or you), own tabs first; --tab <handle> --force acts on a tab the session doesn't own in place, in the background, and tab close <handle> --force closes it and confirms it is gone; without --force such tabs are refused, naming the owner (#520). open no longer reports a timeout for a page that loaded: when the load event never arrives but the page is plainly usable it succeeds with commit: "unverified" and the real URL, otherwise it fails non-retryably (#511, fixes #502). close with nothing to close no longer flashes an about:blank tab (#518, fixes #517). No phantom closed tabs over the relay (#522, fixes #519). douyin/delete keeps 19-digit IDs exact and matches the work card by title (#525, fixes #508). Contributors: @leeguooooo.
• v1.5.183 (unreleased): Requires extension ab-connect 0.5.33 (published; Chrome updates it automatically). close verifies by exact tab id that tabs are really gone before reporting, and otherwise fails with close incomplete and keeps the session for a retry, never a false closed: true; tab close on the session's only created tab ends the session (#496). A profile with no window fails at once with profile_not_open instead of a stuck daemon after 45 s and leftover blank tabs (#499, fixes #486). hover moves the real pointer and succeeds only when a trusted event reaches the element, refuses covered or transformed-frame targets, and accepts --observe (#509, #510). Refs survive a failed post-action capture, verified before use (#497). extract supports the "@attr" shorthand (#512). The settle warning names the requests that kept the page busy (#515). Small-page --observe returns the whole page and visible text changes (#498). read --links lists absolute link URLs (#513). Contributors: @leeguooooo.
• v1.5.182 (unreleased): Requires extension ab-connect 0.5.32 (published; Chrome updates it automatically). After a relay restart a --browser session waits for its own profile's new endpoint and keeps its tab ids and refs, never reconnecting to another profile (#491); close after an idle relay restart reconnects first and really closes the tabs, and reports close incomplete and keeps the session for a retry instead of closed: true (#492). Commands over 45 s are kept alive with keepalives, a queued second command no longer times out or takes the daemon down, and a queued command whose caller left never runs late (#488, #494). Relay input gets 25 s instead of 8 s, so no half-clicks (#489). A tab recovers after a debugger timeout, concurrent tab opening no longer races, and a service-worker restart no longer opens a second agent window (#478, #493). doctor and status report relay health, duplicate extensions, extension/CLI version skew and machine load, without launching a browser or touching a tab (#490). Contributors: @Sean529, @leeguooooo.
• v1.5.181 (October 9, 2026): auth login --bwu no longer reports a login the site never got. On a background tab of your own Chrome, the Enter that submits the form could be accepted by Chrome and never reach the page: nothing was submitted, yet it said submitted: true and auto-login said ok: true. The Enter is now checked, and one that did not arrive is replaced by a click on the sign-in button; a login is reported only once the sign-in form is gone from the page (signedIn: true with the evidence), and a form still there after about 12 s, or a page that cannot be read, fails with the sign-in was not confirmed and what the page shows. A tab that detaches under the Enter is judged by the page afterwards instead of action_outcome_unknown; alreadySignedIn needs a loaded page without a sign-in form. The login wall tries once more when the outcome is unknown or the page gave no reason (#487, fixes #482). Contributors: @leeguooooo.
• v1.5.180 (October 9, 2026): A login wall asks whether to sign in instead of needing a config switch. The first wall on a site (a redirect to its sign-in page, or a site adapter that finds it signed out) asks: sign in from the vault this time, always for that site, or never. A terminal gets a prompt; an agent gets the question on stderr and in loginWall.ask with one command per answer (auth login --bwu, auth autologin always <host>, auth autologin never <host>) and must relay it rather than choose. Decisions are stored per site in ~/.chrome-use/autologin.json; auth autologin status shows them and auth autologin off <host> (or --all) forgets one. "auth": {"autoLogin": "bwu"} and AGENT_BROWSER_AUTO_LOGIN=bwu still count as "always" (#483, fixes #481). Auto-login tries once more when the outcome of the login submit is unknown after a tab detach (cause still open, #482). Contributors: @leeguooooo.
• v1.5.179 (October 9, 2026): A site adapter whose site is signed out is a login wall: an adapter returning loginRequired: true (optionally loginUrl; error: "login_required" / "not_logged_in" mean the same), or a failed run whose fetch got HTTP 401, was redirected to a sign-in page or left the tab on one, reports login wall: and loginWall pointing at auth login --bwu, instead of "log in in Chrome" or a misreported failed write. With "auth": {"autoLogin": "bwu"} it opens the sign-in page, signs in from the vault and runs the command once more (a write only when the adapter reported the login itself). auth login --bwu without --item uses the one vault item named exactly the site's host when the domain matches several (#480, fixes #479). A session keeps its created tabs across a relay restart (#469, fixes #461) and is bound to its Chrome profile, not the relay address (#476, fixes #472).After a relay restart, tab ids and refs stay on the same tabs and the first command no longer says the tabs are gone; refs of a tab that navigated or closed during the outage are dropped and commands wait for a tab to be chosen, and the tab record is written atomically and holds the session when unreadable (#475, fixes #473). A click whose page opens a tab says when Chrome came to the front (openedTabWarning); AGENT_BROWSER_BACKGROUND_LINKS=cross-site opens plain cross-site target=_blank links in the background (needs ab-connect 0.5.31) (#474, #477, refs #468). Contributors: @leeguooooo.
• v1.5.178 (October 8, 2026): Requires extension ab-connect 0.5.30 (published; Chrome updates it automatically). chrome-use no longer pops up browsers or grabs your tabs: agent tabs stay in a background agent window, never your window; unit tests and doctor no longer launch visible browsers; screenshots, tab duplicate, state save and password-manager recovery no longer touch your foreground or tabs (a page pop-up after an agent click can still raise Chrome, #468) (#460). Over the relay a pop-up opened by the session's own tab is adopted by exact tab id, reported, followable and closed with the session; unconfirmed tabs are left alone (#457). ChooseBrowser rules are binding, with explicit errors when the profile isn't connected or the session is bound elsewhere (#466). find refuses ambiguous actions and lists candidates (#459). Also npm postinstall, an unused options card, skill frontmatter and env docs (#462–#467). Contributors: @AmeerAliAnwar, @leeguooooo.
• v1.5.177 (October 8, 2026): --observe attaches its page-change watcher before the action, so an observed click no longer sits out a 500 ms window it had already missed; the settle rules are unchanged. On a three-page catalog task each click --observe went from ~740 ms to ~220 ms and the task from ~3.5 s to ~1.4 s (median of 6 alternating rounds vs 1.5.176; form and delayed-load tasks unchanged). --follow settles the opened tab on its own. Fixes: pick --observe observes; batch step flags apply to their step, an explicit false overrides, and a step --tab never overrides a command's own tab; screenshot <path> --selector in any order; a fill whose handle was lost is read back before any rewrite and an unreadable value writes nothing; openedTab is reported again without --follow (#455). Contributors: @leeguooooo.
• v1.5.176 (October 7, 2026): auth login --bwu on an already signed-in page returns alreadySignedIn in about 3 s with nothing typed, instead of failing after 25 s; sign-in pages keep the full wait (#453). After an upgrade where the old daemon had already idled out, the first @ref command explains that the upgrade cost the refs and the tab was kept (#454). Contributors: @leeguooooo.
• v1.5.175 (October 7, 2026): An upgrade keeps a running session's tab and carries its refs over (identity-checked); from 1.5.174 or older the tab is kept and the first @ref command asks for snapshot -i (#450, fixes #448). auth login / --bwu work with sign-in forms in same-site iframes such as Apple's on App Store Connect: trusted input, username-then-password, the sign-in button, and a reported 2FA step (#452, fixes #449). Every command that touches the page clears a password manager's inline menu first; when Chrome's whole window is hidden the error explains how to clear it (#452). Contributors: @leeguooooo.
• v1.5.174 (unreleased): Fixed CLI browser readiness checks clearing repeated unchanged observations. Successful reuse on the same connection, target and session preserves the streak; rebinding, failure or storage-state loading still clears it. Added real CLI regression checks and clarified ordinary, batch and script JSON result shapes. Contributors: @leeguooooo. (#447)
• v1.5.173 (October 7, 2026): --observe flags observed.noProgress when repeated complete observations show no change (advice only; nothing is replayed). A nested script returning ok:false fails its caller. timing separates summed Chrome time from wall-clock busy time, and snapshot enrichment reads run concurrently (#444). Static pages gain search metadata and bilingual usage guides (#442, #445). Contributors: @leeguooooo.
• v1.5.172 (October 7, 2026): Chrome profiles by name: browsers lists every profile with name, directory, account and connection; --browser takes a name or prefix; sessions say which profile they use; browsers --who <domain> shows which profiles look signed in; URL routes pick a profile; connect --browser <name> connects a profile on demand (#443). Login walls are detected and routed to auth login --bwu, optionally automatic (#438). Fixes: a background-tab click after fill on a password-manager profile took 5 s, now ~0.2 s (#439); report --submit files through the github.com form without gh (#440); report --new is now --new-issue (#441). Contributors: @leeguooooo.
• v1.5.171 (October 7, 2026): New chrome-use report drafts a redacted GitHub issue from the failure log, dedups by failure signature (a match gets a +1 comment), and with the user's consent files it via gh, the logged-in Chrome or a prefilled URL; repeated failures prompt one suggestion (#436). A password manager's inline menu no longer blocks the tab: chrome-use closes it and continues without changing your foreground tab (#435). A dropped daemon connection is cleared at once (#421); adopt uses the selected profile's relay (#422); refusals no longer offer --force (#433). Contributors: @AmeerAliAnwar, @leeguooooo.
• v1.5.170 (October 7, 2026): A wait --text timeout names the page's actual wording when it differs only in case or spacing ("Grand total" for "Grand Total"), with the exact command to use. The core skill's extract example now runs as written. (#432) Contributors: @leeguooooo.
• v1.5.169 (October 7, 2026): close --all refuses while other sessions are live, lists them, and needs --force (#429). A session closed from outside says who closed it and to check for an earlier submission instead of silently running in a blank tab; tab select --activate no longer hides another session's tab (#431). pick handles autocomplete fields: it types, waits for suggestions, clicks the best match and verifies (#430). The core skill again lists the commands to use instead of eval (#428). Contributors: @leeguooooo.
• v1.5.168 (October 6, 2026): A @ref whose element was replaced is never acted on as a guess: a same-role, same-name replacement runs and is reported (relocated); a renamed one ("Delete" → "Delete all") is refused with try @e7 [button] "Delete all"; a text field re-found by id/name/data-testid is still filled after a label change. Unknown ref says what the ref was and suggests current refs (borrowed from callstack/agent-device, #419). New scroll down --until <selector|@ref|text=…>; a near-empty canvas snapshot attaches a screenshot (#420). The core skill shrinks from 15.7 KB to 6 KB (#416). Fixes: --observe before any snapshot renumbered unchanged elements; it listed other extensions' requests; local pages suggested OpenCLI desktop-app commands (#418). Extension tests run on an injected clock and no longer flake on a busy machine (#417). Contributors: @leeguooooo.
• v1.5.167 (October 6, 2026): chrome-use status no longer reports a dead relay as up. After the native host exits abruptly its relay address file stays on disk, and status used to treat it as a live connection with current extension and profile details; it now waits for a reply from the extension (up to 10 seconds on a silent connection) and otherwise reports the relay down and those details unknown. (#411) Contributors: @Sean529.
• v1.5.166 (October 6, 2026): click refuses a target something else covers, naming the cover, instead of quietly clicking it through the DOM; click --allow-dom clicks it anyway, and check, downloads and sign-in keep the old fallback. --json replies carry timing (total, Chrome time, slowest calls), logged per command to ~/.chrome-use/timing.jsonl (no URLs or content; rotated at 20 MB; AGENT_BROWSER_TIMING_LOG=0 turns it off). Screenshots default to 1200 px on the longest edge instead of 2000, full-page shots are capped by width only, and --full-res keeps the captured size. Borrowed from iphone-use. (#414) Contributors: @leeguooooo.
• v1.5.165 (October 6, 2026): New eval --background <expr> starts a slow expression in the page and polls for its value, past the relay's 8-second limit (the same mechanism site adapters use). OpenCLI commands that wait inside the page (e.g. jd/search) no longer hit the 8s relay timeout, and browser-less OpenCLI commands (e.g. pubmed/search) are called the way OpenCLI calls them instead of failing with Cannot read properties of null. (#413) Contributors: @leeguooooo.
• v1.5.164 (October 6, 2026): solve-slider supports rotating Yidun puzzles and checks the current question. Uncertain matches and exhausted attempts fail explicitly; old widget success is ignored. Cross-origin network bodies use their owning frame, with responseBodyError when unavailable. The agent guide explains ordinary CAPTCHA attempts, bounded retries, and site-level acceptance. Development builds and tests can use a configured SSH host with source and artifact checksums and no local compilation fallback. (#412) Contributors: @leeguooooo.
• v1.5.163 (October 6, 2026): A failing adapter no longer hides a working OpenCLI command of the same name: when ours fails and OpenCLI has a read command with that name, it runs instead. For example the community hackernews/top, whose API call the page's security policy blocks, now returns data through OpenCLI. Arguments carry over by name with common aliases mapped (count → limit, q → query); stderr says so and --json adds source: "opencli" and fallbackFrom. Write commands never retry. (#409) Contributors: @leeguooooo.
• v1.5.162 (October 6, 2026): OpenCLI commands install on Windows (it looked for npm, which is npm.cmd there, and skipped silently). An OpenCLI command no longer runs forever: 300 seconds by default, or its own timeout argument plus 60 seconds; AGENT_BROWSER_OPENCLI_TIMEOUT=<seconds> changes it. (#408) Contributors: @leeguooooo.
• v1.5.161 (October 6, 2026): OpenCLI's commands run as site commands. With Node.js 20+ on PATH, site update installs a pinned OpenCLI (1.8.8, about 180 sites and 1,300 commands) into ~/.chrome-use/opencli with npm install --ignore-scripts; no token needed. A name/cmd neither of our packs has runs through OpenCLI's own runtime, with every browser step going through chrome-use, so it uses your current session and logins. Marked (opencli) in site list, listed after ours in the site hint, ours win on a shared name; AGENT_BROWSER_SITES_NO_OPENCLI=1 turns it off. New site analyze [url]: the page's same-site API calls, embedded state and anti-bot vendors, with a recommended data source (page fetch, then page state, then DOM). New site verify: --write-fixture records a good result's shape (types only); later runs fail with exit 1 when a field disappears, changes type, or a list comes back empty. (#407) Contributors: @leeguooooo.
• v1.5.160 (October 6, 2026): Switching to a tab that is still loading announces its site adapters. A background tab can still read about:blank when you switch to it, so 1.5.159 missed the siteAdapters hint; it now uses the url the command reported from Chrome's tab info and checks again on the next command if the site is still unknown. (#406) Contributors: @leeguooooo.
• v1.5.159 (October 6, 2026): Site adapters are announced whenever you reach their site, not only on open/snapshot: tab new, switching or closing tabs, back/forward/reload, a click or key press that navigates, read, and the first command on a tab the session did not open attach siteAdapters when the site changed, once per site. A site you drive a lot without an adapter (30 actions in a session, or a third day of use) gets siteAdapterSuggestion in one response, telling the agent to ask you before writing one; once per site per session, not again for two weeks, local hosts and IPs skipped, off with AGENT_BROWSER_SITES_NO_SUGGEST=1. The official adapter pack takes precedence over the community pack: a shared adapter resolves to the official one, and the hint lists official and your own adapters first. (#405) Contributors: @leeguooooo.
• v1.5.158 (October 4, 2026): Windows: a call no longer hangs after the session daemon starts. The daemon inherited the stdout/stderr pipes of whoever ran chrome-use, so a caller reading its output to the end (Rust Command::output(), Python subprocess.run) waited until the daemon exited, up to its 10-minute idle timeout. A new daemon starts after an idle exit, on adopt or after a version change, so the relay seemed to work and then hang after idle. The standard handles are no longer inheritable when the daemon is spawned. (#399, likely cause of #392) Contributors: @leeguooooo.
• v1.5.157 (October 4, 2026): auth login --bwu uses vault passkeys in a --launch browser (bitwarden-use 0.9.0+): a temporary WebAuthn authenticator answers a passkey or security-key second factor; --passkey signs in without reading passwords, TOTP or custom fields. Synced passkeys report counter 0; nonzero counters are refused until vault write-back is supported. Only sign-in controls are clicked, normal registration calls are blocked during the attempt, and cleanup restores the registration function. Retained native references can bypass the guard; unexpected registration or unconfirmed cleanup aborts the command. Site refusals include the visible message; passkeys are explicitly unsupported on the extension relay: --passkey fails immediately and ordinary login keeps password/TOTP. --no-submit reads neither TOTP nor passkeys to avoid code auto-submission; it cannot be combined with --passkey. Help, both READMEs and bilingual login docs are updated. (#398) Contributors: @leeguooooo.
• v1.5.156 (October 3, 2026): the cookie argument checks that 1.5.155's notes described now actually ship: cookies get --url returns that URL's cookies (it returned the current page's), cookies clear --name needs --domain or --url, --domain with --url or a repeated flag is an error, and cookies get rejects unknown arguments. 1.5.155's daemon already refused --name on a full clear, so the browser could not be wiped. (#396) Contributors: @leeguooooo.
• v1.5.155 (October 3, 2026): cookies clear no longer wipes the whole browser when asked for one site: it ignored every argument, so cookies clear --domain platform.openai.com on a real Chrome profile signed the user out of every site. --domain (or --url, by its host) now deletes that domain's and its subdomains' cookies, never a parent domain's; --name narrows it; the result says what was cleared. Clearing everything needs --all --yes, and without --yes nothing is deleted. Unknown arguments are errors. (#395) Also, auth login --bwu no longer submits an empty 2FA form: on a page that only asks for the code, the default steps pressed Enter before typing it, which counted as a failed attempt (GitHub: "Two-factor authentication failed"). Codes are now typed once, without fill's rewrite, and a code the site rejects is reported as such, with its message. (#394) Contributors: @leeguooooo.
• v1.5.154 (October 3, 2026): docs: since bitwarden-use 0.8.0, require_touch_id false turns Touch ID confirmation off for unattended runs, so the authentication reference and the auth login --bwu notice no longer say bwu run always asks: it asks once by default, not for items in a reveal folder, and not at all when the user turned it off. (#393) Contributors: @leeguooooo.
• v1.5.153 (October 3, 2026): new auth login --bwu logs in with your Bitwarden vault: it asks bitwarden-use (0.7.0+) for the site's logins (masked, most recently used first), uses the only one or the one named with --item, and passes the values through bwu run after one Touch ID confirmation, so the result lists the steps filled, never the values. It handles username-then-password pages and TOTP code pages, follows an item's _autotype field (rofi-rbw syntax), and --no-submit fills only. Output now fits how agents call chrome-use (over 215 real sessions, 74% of calls piped through tail/head and 24% discarded stderr): an error also goes to stdout when stderr goes to /dev/null and ends with the next step; the --launch notice prints only when a browser is launched; plain-mode eval prints a string result as text rather than JSON-quoted (empty and number/true/null-like strings keep their quotes; --json is unchanged). "Session unresponsive" names one successor session instead of telling agents to pick a new name. Guessed commands (js, requests, har, logs, links) point to the real one, <command> --help without a page shows only the relevant lines, and help and addinitscript are new commands. The core guide gains a "before you write eval" table. Tests no longer write to your friction log (run chrome-use friction --clear once). (#390 #391) Contributors: @leeguooooo.
• v1.5.152 (October 2, 2026): new fill <sel> --from-env <VAR>: bwu run --env PW='github.com#password' -- chrome-use fill @e3 --from-env PW fills a Bitwarden secret without it ever being an argument, output or part of the transcript; results, errors and the --observe snapshot show <filled N chars> even on a field that does not look like a password, and the CLI drops the variable so a daemon it starts never holds it. upload catches the file chooser a button opens when the page has no <input type=file> until the click, with no native dialog; a single-file chooser refuses several files, and a wrong ref to a link or submit button is never clicked. Fixes: Bitwarden's inline menu no longer locks a login tab (recovery takes focus out of the field and waits for the overlay; a blocked fill is confirmed by reading the field); a click that changes nothing on a background tab says so, and --activate warns when it hides another session's tab; Google's sign-in rejection is reported as blocked_by_signin_rejection. (#373 #385 #386 #387) Contributors: @leeguooooo.
• v1.5.151 (October 2, 2026): a native <select> left on its placeholder (a disabled “Select…”) reads as nothing selected; #375 only worked for custom selects. The extension now publishes itself: a new extensions/ab-connect.zip on main is uploaded to the Chrome Web Store and submitted for review by CI with a service account, and a failure opens an issue; ab-connect 0.5.29 is in review. Added the OpenAI plugin directory package and a PRIVACY.md that lists the requests chrome-use makes and what it keeps locally (no server, no telemetry). (#383 #384 #388) Contributors: @leeguooooo.
• v1.5.150 (October 2, 2026): security: the dashboard refuses DNS-rebinding requests (every request needs a loopback Host or one listed in AGENT_BROWSER_DASHBOARD_ALLOWED_HOSTS), and snapshot / get value show card numbers, CVCs, passwords and one-time codes as <filled N chars> unless you pass --reveal-values. New tabs inherit the session's setup (user agent, locale, timezone, geolocation, offline, headers, credentials, media, init scripts, interception); addinitscript returns an init-script-N handle. auth login --no-navigate fills the form on the current page and refuses on another origin; login fills the usable field and checks it before submitting. --observe lists fetched resources and recognizes human-check scripts. Extension 0.5.29 follows a tab Chrome discarded and reloads it in the background. Also fixed: password-manager inline menus over a field, fill on formatted inputs, placeholder selects and invalid fields, NBSP and zero-width characters in select, wait --load on a loaded page, unparseable CDP replies waiting 30s, and --launch freezing on a full stderr pipe. Several fixes are ported from upstream agent-browser. (#372–#378 #380 #381 #382) Contributors: @leeguooooo.
• v1.5.149 (September 30, 2026): a site adapter is no longer bound by the ~8s budget of one command. An adapter was a single eval, cut off at about 8 seconds over the extension relay, so an upload or a publish had to return status: "incomplete" and be rerun by the caller. It now runs in the background of the page and is polled; --timeout <300|90s|10m> sets the total time (default: the adapter's @meta.timeout, else 120s), and progress reported with args.progress(...) is printed to stderr and returned with the result. --until-done reruns the adapter while it returns incomplete / uploading, or when a page navigation ended the run, until it finishes or the timeout passes (default 600s). Adapters take local files: an arg declared "type": "file" takes a local path, and await args.video.setOn() in the adapter puts it on the page's file input, with no separate upload; the page names the selector, never the path. Values can come from a file or stdin: --key @path, --key @-, --key-file path; @name that is not a file stays literal, and a path-like value that does not exist is an error. The MCP chrome_use_site tool gains untilDone and timeout. Existing adapters run unchanged. (#364 #365 #366) Contributors: @leeguooooo.
• v1.5.148 (September 30, 2026): skills get core works where the cache directory cannot be written. A single-binary install unpacks its bundled guide to the cache directory on first use; in an agent sandbox that denies writes under the home directory that failed with "Skills directory not found". It now falls back to the temp directory, where an existing extraction is replaced on every run, not reused. A skills/ directory above the binary that belongs to another tool (~/.local/skills, ~/skills) is no longer taken for the package directory, which used to answer "Skill not found: core"; it must contain skills/chrome-use/SKILL.md. The error no longer tells a single-binary install to reinstall via npm. (#367) Contributors: @leeguooooo.
• v1.5.147 (September 30, 2026): --launch passes Cloudflare's managed challenge again. With the stealth patches on it spun forever, while with them off it passed in about 16 seconds. Three causes: the patches faked Android-only APIs desktop Chrome lacks (connection.downlinkMax in the page and in workers, ContactsManager, ContentIndex), giving a Mac UA with Android APIs; they were evaluated into Cloudflare's challenge iframe while its scripts ran; and navigator.languages was forced to en-US in the page while workers and Accept-Language kept the system languages. The fake APIs are gone, anti-bot challenge frames (Cloudflare, hCaptcha, reCAPTCHA, DataDome, Arkose) keep only the native overrides, and languages are no longer patched in JS; the challenge passes in about 8 seconds. AGENT_BROWSER_LOCALE is passed to Chrome as --accept-lang, so the page, its workers and the request header agree, for temporary and --profile launches alike. cf-status no longer reports an embedded Turnstile widget as a challenge page. The docs replace the defunct nowsecure.nl benchmark with scrapingcourse.com's managed challenge. (#361) Contributors: @leeguooooo.
• v1.5.146 (September 30, 2026): fill writes text fields the way a user does: it selects the old value and replaces it with a trusted Input.insertText (trusted beforeinput / input, and a trusted change on blur), so pages that only honour real input register it; the old synthetic events left LinkedIn's edit-intro dialog showing the new text but never saving it. When the trusted write cannot produce the value (maxlength, mask) it falls back to the native setter and warns with input-synthetic. fill warns and reports commitControl when the field's form or dialog had a disabled Save / Submit before and after the fill. click refuses a disabled control, warns on aria-disabled, and reports dispatch: pointer | keyboard | dom with the reason for an element.click() fallback. keyboard type reads the focused field back, fails when it did not change and warns when nothing editable had focus. type --clear uses select-all and a trusted Delete. The docs say a toggles=checkbox(...) button is a switch that can be destructive. (#358) Contributors: @leeguooooo.
• v1.5.145 (September 29, 2026): bare find only locates (tag, role, name, box, visibility) instead of clicking; callers relying on the implicit click must say click. find text picks the deepest element holding the whole text, clicks the nearest clickable ancestor, errors on an invisible match and warns when a click changes nothing within 800 ms. (#354) type reads the field back and errors when it is empty or unchanged, suggesting fill or keyboard type. (#355) Refs re-bind after a React remount by stable attributes, and a refusal lists usable CSS selectors. (#356) adopt <url> only adopts a tab whose current URL matches, and a reconnect after navigation no longer fails with no open tab matching; a tab blocked by a foreign extension iframe no longer bricks the session, and the error points to tab new in the same session. (#357) site infers a missing argument from the current URL, so site linkedin/profile works on a profile page. (#359) Snapshot marks buttons that wrap a checkbox or switch. (#358) Contributors: @leeguooooo.
• v1.5.144 (September 28, 2026): chrome-use upgrade --check / --json report the current and latest versions plus installed skill copies without changing anything; a failed check exits 2. upgrade skips the reinstall when current and refreshes the skill in the Claude Code plugin, a chrome-use git checkout and installer folders; AGENT_BROWSER_NO_SKILL=1 leaves skills alone. At most one background check a day (2 s timeout, cached in ~/.cache/chrome-use/update-check.json) prints one stderr line while a newer release exists, never touching stdout or --json; disable with CHROME_USE_NO_UPDATE_CHECK=1, USE_NO_UPDATE_CHECK=1 or CI. (#352) Contributors: @leeguooooo.
• v1.5.143 (September 28, 2026): Explain debugger access denial caused by foreign extension iframes: save work, disable the conflicting extension on the site and reload, or use a separate profile. Add an isolated Chrome reproduction covering parent-command denial and failed reattachment with auto-attach off and on, plus recovery after removing the test iframe. This release does not remove Chrome permission restrictions or turn failures into success. References: #341, #349. Contributors: @leeguooooo.
• v1.5.142 (September 27, 2026): tab new/select/adopt --activate (alias --front) activates before renderer initialization; background operation remains the default. Direct CDP adoption preserves existing tabs without navigation. Failed new-tab initialization retains the original target, and recovery retries pending stealth setup until it succeeds. Timeout guidance avoids replaying uncertain actions. Contributors: @Sean529, @leeguooooo. (#346)
• v1.5.141 (September 24, 2026): A --launch session whose browser went away (closed after 10 idle minutes, killed or crashed) no longer hangs its next command on "Chrome relay dropped — reconnecting…" or moves to your real Chrome. The session stays launched until close; the next command starts a fresh browser in about a second and says the old window is gone. Pass --auto-connect, --cdp, --browser or --provider to switch it to your Chrome. Contributors: @leeguooooo.
• v1.5.140 (September 24, 2026): skill install installs and verifies the discovery entry bundled with the CLI without Node, npx, Git or network access. Global and project installs, update and refresh cover shared skills, Claude Code, Cursor, and detected Pi, OpenCode, Windsurf, CodeBuddy and Trae configurations. Codex uses the shared directory to avoid duplicate discovery. PowerShell also extracts the skill from older releases, explicitly decodes UTF-8 on Windows PowerShell 5.1, and preserves the old file when replacement fails. Skill, extension and doctor failures no longer produce an unconditional completion message; self-check timeouts are errors too. Windows doctor checks disk space, uses PowerShell environment-variable guidance, and omits macOS-only ChooseBrowser paths and unnecessary encryption-key setup advice. Contributors: @leeguooooo.
• v1.5.139 (September 24, 2026): One-line install on Windows. In PowerShell, irm https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.ps1 | iex installs to %LOCALAPPDATA%\Programs\chrome-use with no admin rights, adds it to your user PATH, then runs the same extension setup, skill install and self-check as install.sh. The sha256 check is mandatory and a mismatch installs nothing, because an interrupted download otherwise extracts into an .exe that dies at launch with an access violation. Existing PATH entries are kept exactly as they were, %USERPROFILE%-style variables included; the usual PowerShell API for this would have expanded them into absolute paths for good. Pin with $env:AGENT_BROWSER_VERSION, relocate with $env:AGENT_BROWSER_BIN_DIR, or set $env:AGENT_BROWSER_NO_PATH = 1 to leave PATH alone. Tested on Windows 11 with Windows PowerShell 5.1; ARM64 gets the x64 build under emulation, untested. Fixed: chrome-use doctor no longer launches Chrome on Windows. It read the version with chrome.exe --version, which on Windows starts the browser against your real profile instead of printing a version, and never returns — doctor --quick --offline hung indefinitely, and the new installer's self-check with it. The version is now read from the directory beside chrome.exe; nothing is launched and the check takes milliseconds. macOS and Linux are unchanged.
• v1.5.138 (September 23, 2026): The extension relay forwards less noise (from community PR #342, thanks @AmeerAliAnwar): nine high-frequency CDP events nothing in the CLI reads — Network.dataReceived, DOM.attributeModified and the like — are no longer serialised across the native-messaging pipe, and a test scans the CLI sources and fails if anything starts reading one, since the daemon would otherwise get no error. A new tab is attached immediately instead of after an unconditional 100ms, and duplicateTab's inspection reads are bounded by its transaction deadline instead of able to hang it. Fixed the regressions #342 would have shipped, each checked before the change: a 1 MB cap on messages to the host — Chrome's 1 MB limit is on messages from the host, messages to it may be 64 MiB, and a Wikipedia viewport screenshot is ~1.2 MB base64'd, so ordinary screenshots over the relay would have become errors — removed; session recovery's retry windows, cut by more than half though both were sized from live reproductions (#23, a cross-process checkout navigation; #24, a sign-in hop that "takes seconds to settle", ~6.3s) — restored; duplicateTab had stopped falling back when there was no focused window or active tab, and stopped refusing to start stages after its deadline, so side-effecting steps could run after the transaction was over — both restored, with tests that fail against the PR's version; URL scheme rewriting that turned blob: and view-source: into https://blob:... — removed, since the CLI already adds a scheme. Removed an uncalled viewport scanner that wrote attributes into the user's page and named its results @e1, @e2 like the CLI's refs, and a test file whose tests re-implemented the code instead of importing it. ab-connect 0.5.28.
• v1.5.137 (September 23, 2026): jev run now completes the 16-question form it could not finish. Six runs out of six submit it with all twelve fields and all four checkboxes as asked — including leaving one unchecked because the goal said so — and report done, in 18.4–23.0s (median 19.8s), checked against the form itself rather than jev's own status. The cause was what the decision model could not see: its request carried only the last ten actions, and by the checkboxes the run had taken thirteen, so "full name", "company" and "role" left that list at the same moment they scrolled out of the viewport. The goal still asked for them and nothing the model was shown said they were done, so BLOCKED climbed from 0.07 to 0.53 over the last three decisions. The request now carries the whole run; an entry is a few dozen bytes and runs are capped. The text helper is retried once: a single malformed answer used to end the whole run (seen as truncated prose and as an upstream 502); the call only generates text and nothing is typed until it succeeds, so a retry repeats no side effect — one retry, not a loop. A field a run already filled with the same text is now marked rather than removed, so it stays in the element list under its own name and value — the evidence it is done — while offering nothing to type; v1.5.136 removed it, leaving only its Open <label> click. Correction: v1.5.136 was wrong about why the form stopped. It called the remaining stop "the model's judgement on complete input". The input was not complete. Controlled runs isolated it: a page with only the checkboxes and a goal about only them completed every time; the same page with the full 16-item goal went straight to BLOCKED (0.77); a pre-filled form with no history stalled too — each time on goal items the model had no evidence for.
• v1.5.136 (September 23, 2026): jev run no longer offers a field it already filled with the same text. Retyping a field that still holds the exact text the run typed into it is a no-op, and offering it is not free: the TYPE_TEXT target question has no "none of these" answer, so once the operation question picks TYPE_TEXT some field has to be chosen. On a 16-question form every text field left in view after scrolling was already filled, and that is what the run kept choosing — TYPE_TEXT at 0.48 against CLICK at 0.43, while a radio group and four checkboxes sat visibly unset beside it. With those candidates withheld, five runs in a row click both radio groups instead, spending the same 13 actions on work that counts. Only an exact match with the run's own typed text is dropped, so a field the page reset, or one holding something the run did not write, is still offered — as is the Open <label> click that re-triggers an autocomplete. The form still does not complete: with only checkboxes and Submit left, Jev answers BLOCKED (0.53) over CLICK (0.40) from a state that correctly shows every box unchecked and clickable — the model's judgement on complete input, which nothing here addresses. JEV_TRACE now also records the request body, since the candidate list alone does not show what the model was told about the page; it records the goal, page text and field values, so treat the file as sensitive.
• v1.5.135 (September 23, 2026): press Meta+a now selects all on macOS. It never did: Chrome resolves Cmd+A there through the OS text system, which a synthetic CDP key event does not reach, so the key was delivered, nothing was selected, and the next keyboard inserttext appended — a field reading hello became helloX instead of X. That broke the documented click <input> then press Meta+a pattern for every agent on macOS. The platform select-all chord (Cmd+A on macOS, Ctrl+A elsewhere, no other modifier) now goes through the editor command fill already used; Ctrl+A on macOS keeps its own meaning, and copy, paste, cut and undo were not reproduced and are unchanged. jev run no longer reads a checkbox's or radio's value attribute as its state: an unchecked terms box was shown to the model as "current value on" and an unselected radio as its own option name, so the model skipped both as already set; they now carry an empty value beside the real checked state. With the select-all fix, a re-filled field is replaced instead of appended to, and a previously skipped radio is now selected. The 16-question form that exposed both still does not complete: with only radios, checkboxes and Submit left, Jev weighs TYPE_TEXT (~0.52) over CLICK (~0.30) and re-types a finished field — recorded as open, not fixed. New: JEV_TRACE=<file> writes one JSON line per jev run decision with the candidates shown, the choice and Jev's answer probabilities; off unless set, and it records field labels and current values including anything typed, so treat it as sensitive. The run report also splits act_ms into act_read_ms, cmd_click_ms, cmd_press_ms and cmd_insert_ms.
• v1.5.134 (September 22, 2026): The installed skill now hands off to the guide the binary carries. skills/chrome-use/SKILL.md, the entry point an installed agent actually reads, was a separate 244-line manual that never loaded core, so v1.5.132's smaller core/SKILL.md did not reach it; it is now a 41-line entry that loads chrome-use skills get core, and upgrading the binary updates the guide an agent follows. On what that buys: in a small cross-harness comparison on synthetic local tasks, DeepSeek V4.1 Flash needed 7 outer tool calls with the new guide against 10 with the old one and about 35% lower host-reported cost on the paired basic task; Claude Code did not show that pattern, and native MCP did not consistently reduce model turns against the CLI. That is a few observations under uneven host load, not a general speedup or success-rate claim; the harness and full report are in bench/skill-eval/ and bench/reports/. Fixed: a wait that hit its deadline is no longer reported as a dead connection. Wait timed out after … used to become "the session's browser connection is unresponsive … Reconnect with connect, or close the session"; in one recorded run an agent waited for Saved while the page already read Delivery saved, spent its 25-second budget on the case mismatch, was told to throw the session away, and the next get text worked. The hint now says the condition was not observed and that the timeout alone does not establish a connection failure, without claiming the opposite either, since the poller retries failed probes until its deadline; it also states that --text is case-sensitive and that an already-visible receipt needs no second wait. Genuine CDP/relay timeouts keep their diagnosis, and wait matching is unchanged.
• v1.5.133 (September 22, 2026): Corrects an overstatement in v1.5.132, which said "the agent skill's entry point is 73.9% smaller". The measured reduction is real but applies to core/SKILL.md, the file chrome-use skills get core serves. The entry point an installed agent actually reads is skills/chrome-use/SKILL.md, a separate 244-line manual with no skills get core indirection, untouched by that change — so nothing about what an installed agent loads follows from the number, and the note now names the file rather than the entry point. Found by codex-01a0c18c auditing the real loading path rather than the file I had measured. Fixed a diagnostic field in jev run whose name was wrong, and misleading enough to read runs through. The last entry in the stale_fields report was labelled doc, implying a document identity; it is the form-control state (value, checked, selectedIndex, disabled, readOnly per input), while timeOrigin is what changes when a document is replaced. Read with the correct names, timeOrigin and url appear in no discarded decision at all — every one was the same document at the same URL, with the page's text, actionable set or form state still moving. The field is now called formState.
• v1.5.132 (September 21, 2026): core/SKILL.md is 73.9% smaller — it went from 9443 to 2460 tokens (o200k_base, measured, not inferred from line count), 204 lines. The default behaviour rules moved to the front and plain click / fill / select / pick are self-contained, so the common case loads no reference at all; detail moved into core/references/ (with new reading, connection and site-adapters), where frames, closed shadow roots, canvas, screenshot parameters, auth handoff and idle recovery all still live. This is a static routing budget: the token counts are real, the effect on task completion or latency was not measured and is not claimed. New: jev run reports where its time went — jev_ms, act_ms, observe_ms, fresh_ms, plus decision, stale and eval counts. One measured run on a public site split 64% model round trips, 29% real page load, 6% the CLI's own commands, against separately measured costs of ~15ms per daemon-to-renderer eval and ~34ms per click — one task, one site, one location, so the shape generalises and the figures do not. New: jev run --terminal-shadow (opt-in) asks in the same request whether the chosen action ends the goal and records that claim against what the closing decision then decided, along with which parts of the page moved when a decision was discarded. It is a measurement tool, not an optimisation: it does not change the completion control flow, and across six runs the model never once predicted a terminal action, so the shortcut it was built to evaluate would have saved nothing. A cheap local check is not a completion test either — a checkout bounced to /login changes the page exactly as a success would. Fixed three defects in the skill's quickstart: it taught npm i -g chrome-use (the distribution path this project deliberately does not support, shipping GitHub Release binaries and an install.sh one-liner instead), it offered close --all (which reaches every session, not the reader's), and an unclosed code fence swallowed the "Diagnosing install issues" section and everything after it.
• v1.5.131 (September 21, 2026): A large Input.insertText is no longer declared failed while it is still working (#315, #309). A timed-out insert cannot be cancelled — losing a Promise.race cancels nothing and CDP has no primitive to recall a dispatched command — so the page keeps working on it for minutes and the next command on that tab collides with a renderer we already gave up on. That damage was largely our own timeout: the extension budget is 8s + 2ms/byte, commented as "~4x the measured worst case", but the 120s cap began binding at 56KB and the effective rate collapsed above it — 0.8ms/byte at 150KB, under the ~1.0ms/byte worst case measured on chatgpt.com. A healthy renderer was failed at exactly the sizes the feature exists for, and #309 measured the same ceiling from outside ("around 100KB, not the ~265KB the budgets imply"). The extension cap moves to 300s and the daemon's to 360s, keeping "client outlasts daemon outlasts extension" at every size, with the invariant test now spanning both ceilings. The cap still guards against a pathological payload; it just no longer cuts into the per-byte allowance an ordinary large insert depends on. Fixed: the extension's own timeout text still advised "Insert less at once", the chunking #301 proved corrupts text at every boundary since a call returns on dispatch and not on commit — the CLI-side hint was fixed for this and this copy was missed. It now says the insert was not cancelled and the page may still be working. ab-connect 0.5.27.
• v1.5.130 (September 21, 2026): Fixed a Windows hang where a first command on a fresh --session name could wait forever with no output (#327). resolve_port fell back to a port derived from a hash of the session name into 49152–65534 — the Windows ephemeral range, the ports the OS hands to every other program's outbound sockets — so on a busy machine an unrelated process was routinely already listening there. The TCP connect then succeeded against a stranger: daemon_ready reported a healthy daemon so none was ever started, the command was written, and nothing answered. The "endpoint disappeared → clear stale state, start a fresh daemon" recovery keys on os error 2, which a Unix socket reports and a TCP connect never does, so it could not fire on Windows at all. Now the .port file a daemon writes is the only source for connecting (no file means "start one", not "connect to whoever is there"), the derived port moves to 21000–31999 so the preferred bind stops colliding by construction, and the Windows connect is bounded and reaches the existing recovery. Cross-checked against x86_64-pc-windows-gnu; not reproduced on Windows, so this is a demonstrated defect matching the report rather than a confirmed diagnosis of the reporter's machine. Also de-flaked a child-reaping test that slept a fixed 200 ms before asserting the child had exited.
• v1.5.129 (September 21, 2026): Fixed open --prefer-spa waiting only for the URL to change: the clicked link is not always a client-side route, and on a same-origin plain link location changes at commit, well before the document is parsed, so the command could return a page an ordinary open --wait-until load would still have been waiting for. readyState is now polled with the URL; an SPA route never sits at loading, so that path pays nothing. Fixed cu.find being undefined — the script guide has always listed it among the cu.* helpers, but the prelude never defined it, so calling it threw "cu.find is not a function". It now mirrors the CLI: a string is the natural-language search, and { selector } lists matching elements.
• v1.5.128 (September 21, 2026): Fixed a script context that could deadlock the session: a context runs one program at a time, so a cu.* call re-entering script --in <the same name> queued a job behind the very program waiting for it — the thread could not pick it up, nothing closed the bridge, and the daemon waited forever, which merely looked like an unresponsive session. The re-entrant call is now refused with an error that says why. Introduced with the 1.5.127 feature and caught before it was used in anger. Fixed AGENT_BROWSER_DEBUG=1 producing no daemon log on Windows (#327): the redirection sat inside a #[cfg(unix)] block, so on Windows the variable did nothing at all — no <session>.log, no daemon stderr anywhere — and #327 is a Windows-only hang whose reporter offered to run with a verbose variable that did not exist for them. Windows now writes the same file (eprintln! goes through CRT fd 2, so the fd is re-pointed, not just the Win32 stderr handle). Cross-checked against x86_64-pc-windows-gnu; not verified at runtime, as there is no Windows machine here. Fixed: session stop <name> --force no longer implies the name is clear (#309) — it reported "dropped its record", which reads as "this name works again", and it does not. --force drops the CLI's record; the tabs stay open, and on the relay a session's tabs live in a tab group named after the session, so a fresh daemon under the same name meets them again. If one of those tabs has a busy renderer, the name behaves exactly as before. The note now says so and names the two moves that work: close the tab, or use a different --session name.
• v1.5.127 (September 20, 2026): script gains named JS contexts that persist across calls (#289): --keep <name> runs in one and creates it on demand, --in <name> requires one that exists, --drop releases and --contexts lists them. What this saves is round trips, not bytes — a single call could always do several steps, but an agent usually has to see one step's result before choosing the next, which meant re-deriving every handle each time. A named context evaluates at top level so declarations survive, so top-level return and re-declaring a const both throw, each with a hint saying what to do instead. New open <url> --prefer-spa (#311): when the page is already on the target's origin and the app links to the target, click that link and let the router handle it rather than cold-booting the app with a full navigation. The issue measured 45 backend-api requests for a full open on chatgpt.com against 1 to 9 for the app's own controls, on a site that throttles on requests; on react.dev an in-page route costs 19 requests against 47. It falls back to an ordinary navigation for a cross-origin target, when no link matches, or when the router does not land, so it never leaves you elsewhere. Opt-in, since a client-side route can keep stale state a reload would have cleared. Fixed: cu.fill had never worked — it sent text where fill wants value, so every call failed with "Missing 'value' parameter".
• v1.5.126 (September 20, 2026): tab switch no longer pays for a second target discovery (#338 by @AmeerAliAnwar): it ran resync_targets unconditionally and then tab_switch discovered again through reattach_active_session; a known targetId or t<N> ref now resolves locally, and discovery runs only as the fallback for an unknown tab reference. Fixed: the refusal for an unadopted tab suggested tab adopt t1 or --adopt, and neither works — tab adopt matches a spec against targetIds and URL substrings only, so t1 fails with "no open tab matching", and there is no --adopt flag in the CLI; the hint now names the tab's targetId, so the command can be pasted as-is. Fixed: the extension version is read from the profile actually being driven (#319, remaining callers) — the per-profile file landed for status and doctor, but outdated_extension_note, the tab select / tab adopt liveness warnings, tab inspect's error and the bug-report environment block still read the generic file that whichever worker said hello last overwrites, so with two profiles connected each could describe the other one, including telling an up-to-date user to update. Fixed: duplicated tabs verify their settle under coarse timer ticks (#338 by @AmeerAliAnwar) — with 15.6ms quantization the transaction deadline could expire while completeBefore waited on a stalled promise, so observeWithin got timeoutMs = 0 and skipped verification even though foreground activation had finished; a small observation budget lets an already-reached state be confirmed.
• v1.5.125 (September 20, 2026): New chrome-use jev run --goal <text> [--url <url>]: TypeSafe's Jev picks each step's operation and target from an indexed element table, and a small model (default inception/mercury-2.5 on OpenRouter) writes text only when a field needs typing. The policy is adapted from browser-use/jev-ultrafast (MIT); the browser layer is this CLI's own daemon socket, with no process spawned per step. The Google Flights task (Zurich to London) finishes in 11 to 13s from Tokyo, mostly Jev round trips (about 460 ms each from Japan, about 150 ms from Los Angeles). Fixed: --cdp adopted the first existing tab without checking it, so a hung renderer made the first command wait out a 30s Page.enable and report the tab as gone; tabs are now probed with a 2s evaluation, the first that answers is driven, and if none does a fresh tab is opened and the hung ones are left alone. On a 1 GB Linux host with a hung Google Flights tab, open went from 3/6 (each failure 30s) to 6/6. Also: multi-tab concurrency isolation (#334 by @AmeerAliAnwar, via #335): per-tab state, a tab switch alias, chrome_use_tabs back in the extended MCP profile, and screenshots surface a background tab so it produces frames.
• v1.5.124 (September 19, 2026): Every command was about 150ms slower than it needed to be. Before dispatching anything the CLI slept 150ms and probed the daemon socket again, on every call, even with a healthy daemon. That was about 95% of a warm command: eval median went from 167ms to 11ms. On a Jev-driven Google Flights search (about 60 browser calls), five alternating verified runs moved the task median from 20.0s to 14.1s. The sleep guarded against a daemon that was shutting down; close now unlinks the socket before its shutdown delay, so a successful connect means the daemon is serving. Also fixed: eval of an async function that declares a variable returned {} (replMode does not await promises and the check missed async; async/Promise now match as whole words); main compile and three tests after the multi-tab change. New: concurrent multi-tab workflows, --new-tab and tab targeting (#330); trusted coordinate clicks on the relay.
• v1.5.123 (September 10, 2026): v1.5.122's fix for #319 did not work; this is the real one. status prints "driving A" above "profile: B" with two different ids. v1.5.122 moved the extension version into a per-profile file but still looked it up with the wrong id, so the same mistake entered somewhere else and the symptom survived — one status run after upgrading showed it unchanged. The actual defect is larger than the original diagnosis: "which profile is driving" had two unrelated implementations. The one deciding which browser is actually bound picks by window focus; the ones that report it — the profile: line, drivingProfileId, browsers' default column, doctor, and the version resolver — all used the other, "whichever worker connected last". With two profiles connected those disagree. They are now a single resolver, preferring the focus-based answer the endpoint selection actually uses and falling back to the generic sidecar only where the focus answer is deliberately absent (fewer than two profiles, an extension too old to report focus, a tie) — exactly the cases where the generic one is right. Honest limitation: this is not verified. The symptom only appears with two Chrome profiles connected and that environment was not available. What is established is that the two notions are unified in code and the suite passes — the same evidence v1.5.122 offered before turning out to be ineffective. #319 is left open rather than closed. If you have two profiles, run chrome-use status and check whether the driving and profile: lines name the same id.
• v1.5.122 (September 10, 2026): with two Chrome profiles connected, status reported the other profile's extension version (#319). It printed "driving 27ade1bc-…" next to "extension: live 0.5.21, expected 0.5.26", where the 0.5.21 belonged to a different profile — telling the reader to update an extension that was already current. The cause was a missing dimension rather than a race: the version sidecar is a single file written by whichever worker sent hello last, while "which profile is driving" is decided separately by focus timestamp. #60 had already given the endpoint per-profile treatment for exactly this reason ("regardless of who last clobbered the generic file"); the version never followed. It now has its own per-profile sidecar, written next to the endpoint on hello and removed with it on disconnect, and the places that print a version beside a profile read the driving profile's copy. An extension too old to report a profile id still writes only the generic file, so those keep working rather than degrading to "unknown". CLI-side only — no extension update needed. Note: failures where commands break right after open in this state have been reported, but their cause is not established and this release does not claim to fix them.
• v1.5.121 (September 10, 2026): keep now says why a tab was left behind, and can be undone (#290). keep exempts a tab from the shutdown sweep by dropping ownership, which erased the only record we had — afterwards the tab was indistinguishable from one we never touched, so tab list showed it as foreign and could not answer "why is this still open?". It now takes a reason: keep --as deliverable for a tab that IS the result (an edited document, a checkout the user must finish), keep --as handoff for one a later turn resumes from (waiting on a login, an approval, a code). Bare keep still means deliverable, so existing callers are unchanged, and tab list marks them [kept: deliverable] / [kept: handoff]. keep --release takes a tab back so it closes with the session again — and only works on a tab this session created and then kept, because the recorded keep is the proof it was ours to close; without it the command would claim the right to close a tab it never opened. Releasing does not rejoin the session's tab group: ungrouping is one-way today, and the message says so rather than implying otherwise. keep also gained the --help it never had. Separately, the per-KB cost quoted in the insert-timeout hint is now the measured one: it said ~0.45-0.53s/KB from an early small sample, while 60 KB measured 37s (0.62s/KB) and 90 KB measured 88s (0.98s/KB). The point is not that the constant was low — the per-KB cost rises with size, so a flat range invites extrapolating from it, which is how a "roughly 226 KB" ceiling got published and then corrected.
• v1.5.120 (September 10, 2026): the insert-timeout hint no longer recommends the one thing that corrupts text. It told the caller to "split the text and send it as separate keyboard inserttext calls" — the exact pattern #301 was filed for: a call returns when Chrome dispatched the insert, not when the editor committed it, so the next piece races the uncommitted tail and scrambles the text while preserving the total length, which is why a character-count check passes and the damage ships. commands.rs already said so in the repo; the error message said the opposite. If a split is mentioned at all, the hint now says to compare the field's content between pieces, never just its length. The hint also now says the insert was not cancelled: losing the timeout race cancels nothing — the command was dispatched before the race began, and CDP has no primitive to recall it. A renderer was measured still working roughly 14 minutes after the caller got the error, memory still climbing, so a command sent right after the failure lands on a tab that is still busy. It now says to let the tab go quiet and re-read the field first, because some or all of the text may have landed (#315). The per-character cost quoted is now the measured range, ~0.45-0.53s/KB.
• v1.5.119 (September 10, 2026): a large insert no longer dies at ~55s while looking like a dead session. Three layers budget the same CDP command — the extension (8s + 2ms/byte, capped at 120s), the daemon (30s + 4ms/byte, capped at 180s), and the client's socket read. v1.5.117/118 scaled the first two by payload but left the read budget flat at 45s, so the outermost layer cut first and the inner, more specific "the payload needed more time" error never reached the caller. That flat 45s plus the 8s DAEMON_SHUTDOWN_GRACE is exactly the ~55s wall reported from live use (measured 53.6s / 54.0s / 55.6s). The read budget now scales by the same rule, with a test pinning it against the budget the CDP client actually enforces so the two cannot drift. Commands without a payload keep the flat 45s, so a genuinely hung session still fails just as fast. The real ceiling is now the extension's 120s cap. Measured on chatgpt.com it falls between 90 KB and 120 KB (60 KB passed in 37s, 90 KB in 88s, 120 KB hit the cap). Note the per-KB cost rises with size — 0.62s/KB at 60 KB, 0.98s/KB at 90 KB — so extrapolating from one small sample overestimates the ceiling, which is exactly what an earlier draft of this entry did. Separately, the "session unresponsive" message no longer guesses at a cause: it used to assert the page was still finishing a long command, which fit one reproduction and not another (60 seconds versus over an hour), and the mechanism was never observed. It now states only what was observed — the name has been seen to free up on its own, so it is not permanently taken — and gives a move that works immediately: use a different --session name, or adopt the tab into a fresh session.
• v1.5.118 (September 10, 2026): ships the half v1.5.117 missed. That release artifact was cut 36 seconds before the fix merged, so it carried only the extension side — producing exactly the failure the fix had predicted: a 150 KB keyboard inserttext --file was cut off at 30.170s by the daemon's hard-coded budget while the extension would have allowed 308s. The daemon budget now scales with the payload too (30s + 4ms/byte, capped at 180s), with a cross-side test pinning the invariant that the daemon always outlasts the extension — otherwise the daemon cuts first and the relay's more specific error never reaches the caller. Separately, a payload-sized timeout no longer claims the connection is dead: CDP command timed out: Input.insertText used to add "the session's browser connection is unresponsive … reconnect with connect", sending the caller after a stale worker that is not there. The connection is fine; Input.insertText costs time per character (~0.45s/KB in a rich editor) and this payload exceeded the budget. It now says this is a size limit, says explicitly not to reconnect, and suggests inserting less at once; every other command keeps the connection diagnosis.
• v1.5.117 (September 10, 2026): from the chatgpt-use session's heavy live use of the real ChatGPT composer. keyboard inserttext gains --file / --stdin: back-to-back chunked inserts scrambled text at every chunk boundary while preserving total length (so a char-count check passed and the scrambled text shipped). The cause is that Input.insertText returns when Chrome dispatched the insert, not when the editor (e.g. ProseMirror) committed it, so the next chunk races the uncommitted tail; sending the whole payload in one insert removes the boundary entirely and the caller no longer needs to chunk (#301). site --help prints its own help instead of falling through to the 534-line top-level help — an agent runs <cmd> --help by reflex, sees no site, and reads that as "the command does not exist", falling back to the expensive snapshot+click path (#299). site list filters _-prefixed loader internals (such as the auto-injected _helper) and *.test.js, leaving only runnable adapters (#302). A purely numeric click argument is no longer sent to the DOM as a selector with the misleading "selector matched nothing"; it now says the argument looks like a coordinate and points at click x y / --coords x,y. The press help documents the popover trap: --selector focuses through the selector and dismisses an open menu, so a control inside one needs a coordinate click first, then a bare press.
• v1.5.116 (September 10, 2026): ab-connect 0.5.25 adds one generic door, ABExt.call: a CLI feature that only needs an allow-listed chrome.tabs / tabGroups / windows / downloads / webNavigation method no longer needs a new extension release; mutating calls are allowed only on tabs the agent created, adopted tabs stay read-only, windows.create/remove are refused, and debugger / identity / storage / runtime / management are never reachable this way. ABExt.state returns everything the extension holds, owns and is configured to in one call. New CLI commands extension call <ns.method> [json] and extension state; on an older extension they say "requires 0.5.25" instead of Chrome's wasn't found. Manifest permissions are unchanged, so the update installs without re-approval. The docs site gains a ChooseBrowser page (zh/en), and the permissions count in the README and docs is corrected to the actual 12.
• v1.5.115 (September 10, 2026): what came out of reading the 26 documents of the browser-use plugin bundled with Codex. The core loop is one round trip per step: click @e3 --observe + snapshot -i --diff; a new core/behaviour reference (read the why: line before retrying, never drop to coordinates, reload instead of re-opening the page you are on, one direct navigation for a lookup, the page's own signal ends verification, keep only deliverables, an empty tab list is not a disconnect); trust-boundaries gains three tiers of side effects (hand back / confirm at the step / task-level pre-approval). --observe returns the new tree when a click replaced the whole page instead of a diff that is the old page struck through; snapshot --diff with nothing changed prints (no change since the last snapshot) on stdout; console --level / --filter narrow before --limit, and an empty result says that capture is off. The skill stub's description now leads with "Browser automation in the user's real, logged-in Chrome", and the docs say that on Codex one line in AGENTS.md is what routes browser work here. Fix: embedded skill content is re-extracted when it changes, not only when the version does. README trimmed to about 290 lines.
• v1.5.114 (September 9, 2026): macOS binaries are now Developer ID signed and notarized: spctl goes from rejected to accepted, so a browser-downloaded (quarantined) copy runs without a Gatekeeper refusal (#283). Repeated control names carry the text that separates them, so three identical “进入” buttons read as context="飞行棋" and so on; added only when a name repeats, and dropped when it fails to distinguish (#284). --observe explains an empty delta (disabled / no box / covered / off-screen / present and fine) and states that an empty delta is not failure (#277). report states what it includes and excludes, notes that screenshots are a separate decision, and reads the extension and relay state itself (#278). tabs reports the tab the relay is actually attached to and speaks up when it disagrees with the session's pin (needs ab-connect 0.5.24, #279). Fixes: type with no target is a usage error rather than “selector matched nothing” (#282); fill no longer loses the value on a React combobox that resets on focus (#282); policy-installed extensions are no longer pointed at an Update button that does not exist (#284).
• v1.5.113 (September 9, 2026): ab-connect 0.5.23 asks Chrome to check the Web Store itself and applies an update while no tab is attached (no new permission, #272); a relay failure now says whether the installed extension is behind the published one — on the failure path only, and only when a newer build is actually installable (#271); --observe carries target (session / tabId / targetId / url, ids only) so a caller can tell whether the page under it changed (#270); frame <index> accepts the number frames prints, which previously came back as a raw querySelector error (#269). Fixes: do marks actions whose outcome the tree cannot decide (showMenu, toggle, stepping) as · with confirmed: null instead of ✓ (#266); a failed explicit rebinding keeps the session on the browser it had rather than leaving it on about:blank (#268); a blocked debugger access names the pinned tab and its url (#267); the socket-path limit explains where the 103 bytes went instead of blaming a session name the user never chose (#265).
• v1.5.112 (September 9, 2026): open --browser <profile> --remember asks ChooseBrowser to route that site to that profile from now on — a proposal only, saved after ChooseBrowser's own confirmation; invalid requests are refused before navigating with the reason; needs ChooseBrowser 0.2.1+ (#257). doctor reports which ChooseBrowser rules file is read and how many rules it holds, unreadable versions, a second copy that is not being read, and whether the installed app accepts rule requests (#253, #257). session stop --force drops a stale tab-ownership record without closing tabs (#263). Fixes: one upload fires one change, no more phantom 0% entries on React/Livewire uploaders (#261); read <url> refuses a client-rendered app shell instead of returning an empty page and points to open + text (#262); session stop after an upgrade no longer asks for a browser that is gone, and chrome-extension:// access errors mention that another session daemon may hold the tab (#263).
• v1.5.111 (September 9, 2026): Interactive snapshots retain bounded local context such as prices and omit repeated descriptions on product links. Status receipts appear in action observations while clickable status nodes keep their refs. Launched-browser drag routing uses the current connection (#246). Existing ChooseBrowser rules can select a connected profile when opening sites; explicit --browser wins and --no-choosebrowser opts out. Unavailable rule targets fall back to normal selection; verify account identity when needed (#247). Release validation precedes platform builds (#249). Contributors: @leeguooooo.
• v1.5.110 (September 9, 2026): picks the right Chrome profile automatically. It reads ChooseBrowser's per-site rules and selects the profile that site should use, instead of falling back to whichever profile connected last (#244).
• v1.5.109 (September 9, 2026): Relay recovery no longer repeats actions with unknown outcomes. Observation capture failures preserve action results and report complete, partial, or unavailable evidence instead of fabricating an empty page. Fixes child-frame recovery, replacement tab references, and lifecycle lock release. Protected extension content reports explicit access denial. Navigation detects confirmed debugger access denial early while retaining normal page-load waits. Request summaries are bounded with omission counts; CHROME_USE_RELAY_DIR isolates relay discovery. Bundled ab-connect 0.5.22 confirms host responses before showing Connected; Chrome Web Store distribution is separate (#242). Contributors: @leeguooooo.
• v1.5.108 (September 9, 2026): never reports an unverified result as success. An unconfirmed tab switch, a browser replacement, or a frame miss could all end in a ✓ — and an agent handed a false success keeps going, wrongly. All three now fail honestly. Also corrected: a cross-origin redirect is legitimate navigation and is no longer counted as a failed switch, and serving a skills reference is a success and now reports as one.
• v1.5.107 (September 8, 2026): a tab group label a person can read, and documentation that no longer costs 70 KB up front. chrome-use session name "🔎 track a parcel" replaces the routing-key session id on the tab group with something legible; renaming affects no routing, the session id remains the identity. And skills get core went from 70,691 bytes to 34,393 — the four heaviest sections moved out to references you pull one at a time, and SKILL.md's index is now organised by symptom rather than by topic, because an agent has a symptom, not a category.
• v1.5.106 (September 8, 2026): adaptive settling before an observation, so a read is less likely to catch a page mid-transition. Adds select-text and paste --format, and restores @ref re-anchoring for controls with no accessible name — re-anchoring matches on role + name, so when the name was empty every control of that role matched equally and it gave up, with wording that read as "the element is gone" (#215 #224 #226 #227 #228 #229 #231).
• v1.5.105 (September 8, 2026): actions / do — the things an element does besides click. expand/collapse, showMenu, increment/decrement, toggle, all derived from the element's computed accessibility properties. Three deliberate constraints: the set is read live, never carried over from the snapshot that minted the ref; an action outside the set is refused, with the list; and after acting it re-reads the set and says plainly when a control did not move, rather than reporting success (#225).
• v1.5.104 (September 8, 2026): snapshot --diff — re-read a page for a few bytes. On a 143 KB Hacker News thread: full tree 143,490 bytes; --diff with the page unchanged, 1 byte; after collapsing one comment, 31,370. With no valid baseline it returns the full tree and says which, because an empty diff and an unchanged page are indistinguishable. Also, tab select / tab adopt no longer report a switch that did not happen: the liveness probe was evaluate("1"), which any page satisfies — including the wrong one. It now reads location.href and compares scheme + host (#223).
• v1.5.103 (September 8, 2026): the @refs --observe prints are now real. They were minted into a throwaway map, so every [ref=eN] came back Unknown ref when you tried to use it — the flag cost a round trip and then made you spend another on snapshot anyway. Separately, the baseline snapshot used a virgin ref map while begin_snapshot preserves refs by backend-node identity; the two numberings disagreed, so diffing reported every node as removed-and-added (a sort that changed one row read as 1 added, 29 removed). navigate/reload/back/forward take --observe too, returning a snapshot rather than a delta across a page swap.
• v1.5.102 (September 7, 2026): a built-in accessibility audit, chrome-use a11y (axe-core), plus roughly half the browsing round trips and a controllable observation budget on large pages (#219 #220 #221). Fixes: nested cross-origin iframes can now be attached, drilled into and clicked; navigating to a privileged chrome:// page over the relay is refused instead of killing the tab; and when Chrome is not running it is launched for the right profile directly, rather than waiting 98 seconds on the relay and giving up. Note: this release's --observe prints refs you cannot use — install v1.5.103 instead.
• v1.5.101 (2026-09-04) — upload succeeds with a verification warning when a React dropzone consumes files and clears or replaces its input (#208). Native select uses platform setters plus input/change events so controlled forms commit the selection (#209). Idle daemon recycling preserves external Chrome tabs, URLs and in-page state; explicit close/session stop still clean up created tabs (#210). Bundled ab-connect 0.5.20 uses browser-level navigation first and diagnoses rapid same-URL reload loops. App Store Connect still needs a signed-in regression check, and Web Store publication is separate (#211). Added browser and extension regression tests. Contributor: @leeguooooo.
• v1.5.100 (2026-09-02) — A batch of interaction-reliability fixes (#202 to #206). DOM-dispatched clicks over the relay now move keyboard focus like a real click, so click followed by press no longer lands on the previous field (#204). type reads the field back and prints a ⚠ warning with readBack when the page rewrote or dropped the input; fill verification errors quote both values and say when the page filtered non-Latin text (#203). press probes for keydown/keyup/keypress listeners for keys whose only effect depends on page JavaScript (arrows on a text field, Escape, Enter on a bare input) and warns when none exist; bare XPath (//…) is detected automatically, a missed text() explains the first-text-node rule, and "Element not found" keeps the selector and the specific diagnosis (#202). An agent that changes directory reuses its live session, and "Unknown ref" names the session and whether it has any refs (#205). When the accessibility tree is empty, snapshot falls back to a DOM walk through shadow roots; snapshot --dom forces it (#206). The bundled ab-connect is now 0.5.19: a tab's debugger is released after 30 s of inactivity so the banner no longer stays up, and the next command re-attaches (#201, pending Web Store publish). Contributor: @leeguooooo.
• v1.5.99 (2026-08-31) — screenshot --annotate no longer clears the current session's ref map; unchanged nodes in the same document retain the @ref from the preceding snapshot. The original minimal regression now keeps @e82 as @e82 in the annotated legend, and the subsequent click succeeds; #197 remains open until the installed v1.5.99 release passes the same retest. If a page renderer blocks Page.navigate, the extension relay falls back to browser-level navigation without raising the global 8-second budget. Reconnect drops phantom tabs that no longer exist in Chrome, while tab inspect prefers a live replacement tabId (fixes #193 and #196). Launched Chrome on macOS disables MacAppCodeSignClone so interrupted automation sessions do not leave APFS clones that grow after later Chrome updates (fixes #195). The bundled ab-connect is now 0.5.18. Contributor: @leeguooooo.
• v1.5.98 (2026-08-27) — Relay command timeouts now include the number of in-flight commands, the age of the oldest command, and the current MV3 service-worker age, with the latest 20 timeout records retained in the extension. Those fields distinguish a blocked renderer from relay head-of-line blocking and worker-lifecycle failures; the global 8-second budget was deliberately left unchanged (#193). Contributor: @leeguooooo.
• v1.5.97 (2026-08-25) — External and extension-connected Chrome tabs now have explicit created, adopted, and foreign ownership. A session may drive tabs it created or explicitly adopted, but may close only tabs it created; adoption never grants deletion rights. Created target IDs persist per session and browser endpoint, so daemon restarts retain orphan cleanup without mistaking an adopted user tab for a created tab. Deletion authority is removed only after Target.closeTarget both completes and returns success: true. Selecting a pre-existing target now requires tab adopt <targetId> before tab select. Contributors: @forsakesoul, @leeguooooo.
• v1.5.96 (2026-08-25) — Reverts an ownership rule from v1.5.95. That release let a reconnecting daemon reclaim every relay-scoped tab as session-created, and therefore close it on session stop. The reasoning was wrong: scoping is decided by the relay's own target_group, and Target.attachToTarget — the call adopt makes — re-tags a target into the adopter's group, so a user tab this session adopted sits in that same list. Once a restart drops the in-memory ownership set, the two are indistinguishable, so adopting a user tab and then restarting could let session stop close the user's page. A reconnecting daemon now reclaims nothing until authorship is recorded durably. Users on v1.5.95 should upgrade. The root-cause half of #192 is unaffected and stays: the session stop grace period is 1s → 8s (the relay allows each command 8s, so the daemon was reliably SIGKILLed mid-cleanup), and the cleanup loop now fires concurrently under one 5s budget instead of awaiting each close in turn, where a single wedged tab consumed every other tab's chance. Contributors: @forsakesoul (found it), @leeguooooo.
• v1.5.95 (2026-08-24) — Restarting a named session no longer strands its tabs in the user's Chrome, so a long-running collector stops climbing toward 20GB (fixes #192). The cleanup existed; two clocks defeated it. session stop sent SIGTERM and force-killed after 1s, while every Target.closeTarget travels over the relay, whose per-command budget is 8s — so the daemon was reliably killed mid-cleanup (the grace period is now 8s, and since the poll returns the moment the process exits, a healthy stop still finishes in a fraction of a second). The cleanup loop also awaited each close in turn, letting one wedged tab consume every other tab's chance; the closes now fire together under one 5s budget. The third gap was that a restarted daemon no longer recognised the tabs its own previous incarnation had opened, because created_targets lives only in process memory. It now reclaims them through Chrome's tab group: the group title is the session name, and the only ways into that group are Target.createTarget carrying agentGroup and ABExt.duplicateTab (adopt deliberately neither groups nor marks ownership), so a grouped tab was necessarily created by a session of this name. Nothing is reclaimed without relay scoping, which keeps the user's own tabs from ever being mistaken for ours. extension status now splits its behind-the-Store hint by install route: a policy force-installed extension has no per-extension update control and has its permissions granted by Chrome, so those users are no longer sent after a button their greyed-out row does not have (fixes #190). Contributors: @leeguooooo.
• v1.5.94 (2026-08-24) — A uniform-color fallback check for screenshot: the #184 URL-drift guard only caught the case where the capturing session itself admits the drift — when the next eval reads back the right URL but the pixels come from somewhere else, the guard stays quiet and the agent still gets a ✓ plus a blank image. When a capture is a single solid color while the page reports real layout height and text length, the command now prints ⚠ with an actionable warning instead of a clean ✓; [selector]/--clip partial captures and --annotate (which skips downscaling and would otherwise decode a full-size page image just for this check) are exempt (fixes #184). The integration docs used to list only Claude Code / Cursor / Codex, reading like an allowlist when the real rule is just "can run shell → install the CLI + skill; can't run shell but can configure an MCP server → point it at the same command + args" — that rule is now spelled out on the MCP page, with CodeBuddy / Trae / Windsurf / Cline added to the list (fixes #172). The ab-connect extension shipped 0.5.17 to the Chrome Web Store, catching this release's bundled version up to the Store, so extension status no longer misreports a freshly published build (#189). Contributors: @leeguooooo.
• v1.5.93 (2026-08-20) — The macOS silent-install policy profile puts Chrome into a "managed by your organization" state, and the cost was never disclosed: Chrome disables and locks Secure DNS (DoH), and the extension is marked "installed by your administrator" with no manual update/remove controls. Added extension install --no-profile, which never writes the policy profile and installs from the Store instead; the approval prompt now states both costs and the opt-out command up front, and extension status/uninstall explain the same tradeoff whenever the policy is active (fixes #187). The extension version in this repo routinely runs ahead of what the Web Store has published (0.5.16 bundled against a Store still serving 0.5.12, at one point), which made status/doctor call every Store user OUTDATED and point them at an update that doesn't exist yet; they now ask the Store's updatecheck endpoint on demand and distinguish four cases — genuinely behind, already the newest published build, an intermediate unpacked build ahead of the Store, or Store unreachable (fixes #186). Contributors: @leeguooooo.
• v1.5.92 (2026-08-19) — On the extension relay, a page-injected extension frame could make screenshot's CDP session land on the extension's own about:blank renderer while tabs/eval/get-text kept reporting the real page — the result was a ✓ next to a blank image with nothing for the agent to doubt. The command now compares the tab URL the session is driving against the live location.href on the capturing session right before shooting; a mismatch is reported as drift with instructions to re-bind the tab, and no file is written (fixes #184). On Windows, Chrome's user data lives under LOCALAPPDATA rather than the Roaming AppData path config_dir() returns, so extension status reported "0 profiles found" even with a relay actively driving one; a behind-bundled extension version also stops printing a bare ✓ that makes the reader diff two version strings themselves and now says OUTDATED explicitly (fixes #183). Contributors: @leeguooooo.
• v1.5.91 (2026-08-13) — test used the literal flags.session == "default" to infer whether the user had explicitly picked a session — wrong both ways: --session default is indistinguishable from not passing the flag at all, while an agent-derived session name got treated as explicit. test suite.yaml --session default therefore silently launched a brand-new isolated browser, throwing away the logged-in state of the real Chrome the user had already connected. Fixed by tracking on Flags whether the session actually came from the user (--session / AGENT_BROWSER_SESSION / config file); test now decides between reusing that session and spinning up its own cu-test based on that flag, and only closes a browser it launched itself. --browser/--as/--as-strict are now forwarded to every step in a suite (fixes #181). Contributors: @leeguooooo.
• v1.5.90 (2026-08-12) — SessionLifecycleLock/RelayRecoveryLock were no-op stubs on Windows, so two concurrent invocations each spawned their own daemon and raced on the same socket/port files; switched to real cross-platform advisory locking via std::fs::File::lock (flock on Unix, LockFileEx on Windows), printing a status line before blocking so a lock wait isn't mistaken for a hang (fixes #177). The MCP screenshot tool used to return only a server-local path the client had no way to open — captures are now inlined as an image block (magic-byte MIME sniff, 2MB cap, overridable or disable-able via CHROME_USE_MCP_MAX_INLINE_IMAGE_BYTES) (fixes #178). DOM-dispatched clicks never produce a mirror Input.dispatchMouseEvent, so the on-page cursor didn't move and a click looked like nothing happened; the cursor is now driven explicitly at the resolved element's getBoundingClientRect (no extra resolve just for the visual), and hidden around a capture so it isn't baked into an image the agent later reads (fixes #179). Two agents sharing one terminal tab share WT_SESSION/TMUX_PANE and collapsed onto one daemon, fighting over tabs — session names now resolve in tiers (explicit agent id → <PRODUCT>_SESSION_ID-convention scan → per-terminal id), and doctor reports which environment variable the current session name was derived from (fixes #180). Contributors: @Ishannaik, @leeguooooo.
• v1.5.89 (2026-08-10) — download-url used to reject the blob: scheme outright — a blob URL belongs to the document that created it, and the extension's chrome.downloads API can't reach it, so a resource already rendered on the page (e.g. a canvas export before re-encoding) was simply unreachable. It now fetches the bytes from inside the page and writes them to disk directly — byte-for-byte, unlike toDataURL, which re-encodes and silently drops metadata such as C2PA provenance manifests; when the top frame can't fetch it, each child frame is retried and the result reports which frame the bytes came from; a 32MB cap applies since the bytes travel base64-encoded in a single CDP message and going over hangs the session rather than just failing the download (fixes #169). The daily version-check upgrade notice used to share stderr with real errors, so a tool wrapping chrome-use that "reports failure with attached stderr" got unrelated housekeeping mixed in — it now only prints where a human can see it (TTY, not --json, and CHROME_USE_NO_UPDATE_NOTICE unset); the background check and opt-in auto-upgrade themselves are unaffected (fixes #170). Contributors: @leeguooooo.
• v1.5.88 (2026-08-10) — fill ends by calling el.blur() to trigger a site's blur validation, which drops focus back to <body>; the very next press Enter then dispatches to the document, the form never submits, and the CLI still printed ✓ Done. fill now returns focus to the field it just filled (only when blur didn't hand focus somewhere else deliberately, checked by walking down to the true deepest activeElement across shadow roots); press gained --selector (alias --on) to focus a target first, its result now reports the target it landed on, and Enter dispatched to <body> gets a warning (arrow keys/Tab/Backspace landing there is normal and stays silent); press <chord> --hold used to drop its modifiers, actually holding a bare key while reporting the chord back unchanged — fixed (fixes #167). Contributors: @leeguooooo.
• v1.5.87 (2026-08-05) — Fixed @ref silently activating a different element. A timed-out, failed, or absent identity probe used to count as "confirmed", and the extension relay's multi-hop transport blew the 1s budget routinely — so click @e273 opened an unrelated message menu and printed Done. The probe budget is now transport-aware (2s direct CDP, 5s over the relay, tunable with AGENT_BROWSER_VERIFY_REF_TIMEOUT_MS), and a ref that cannot be confirmed is re-anchored on the snapshot's exact role + name (keeping the cached node when it still matches), then by fingerprint, and refused if neither lands — there is no "act on the cached node anyway" branch left. Fingerprint relocation gained an accessible-name floor: role, ancestors, and sibling position are worth 0.60 on their own, so two sibling <button>s cleared the 0.70 threshold on shape alone and relocated button "我的 agent" onto a message overflow button. Candidates whose label bears no resemblance are now excluded, while a recognisable rename (Submit → Submit now) still self-heals. Reusing a @ref across snapshots additionally requires the role + name to be unchanged, so a node React handed to another component gets a fresh ref (fixes #162). The skill stub dropped hidden: true: pi and other harnesses read it as "never load this skill", which made chrome-use invisible to the agents it exists for — the CLI now hides stubs by directory, and the stub description has a regression test for pi's 1024-character limit (fixes #165, #164). Contributors: @leeguooooo, @beilo.
• v1.5.86 (2026-07-31) — Fixed older ab-connect builds making a failed tab select liveness probe look like proof that the renderer was unresponsive. The warning now reports the live and bundled extension versions and states that probe failure alone is not a renderer diagnosis. On old extensions, tab inspect now replaces the raw -32601 CDP error with its 0.5.16 minimum, the current and bundled versions, and actionable update or reload steps at chrome://extensions (fixes #157). Contributors: @leeguooooo.
• v1.5.85 (2026-07-31) — record start now records the current session-owned tab in extension-connected real Chrome instead of calling the forbidden Target.createBrowserContext (fixes #151). snapshot -i adds non-default cursor, id, data-testid, compact class, and fallback-name anchors; the same DOM node now keeps its @ref across consecutive snapshots and modal churn, with hard resets only on navigation or tab changes (fixes #154 and #155). A bare find "natural-language description" returns ranked semantic/context candidates with selectors and scores and never acts automatically (fixes #156). ab-connect 0.5.16 reattaches white-screen or frozen tabs through the browser-level target registry without waiting for an unresponsive renderer to identify itself; new tab select, in-session no-navigation tab adopt, and page-JavaScript-free tab inspect operations distinguish renderer timeouts from a genuinely missing tab (fixes #157). Contributors: @leeguooooo.
• v1.5.84 (2026-07-29) — Fixed sessions becoming permanently unusable with No such file or directory (os error 2) when the daemon process remained alive after its Unix socket disappeared. Cross-process locks now serialize relay teardown and daemon startup for each session, while global native-host recovery runs in only one process. The next browser command allows a concurrent startup window, reclaims the unreachable worker, and starts a clean daemon for the same session. If the socket disappears during an in-flight command, the error names the exact endpoint, stops the orphan, removes stale sidecars, and asks the caller to rerun (fixes #152). Contributors: @leeguooooo.
• v1.5.83 (2026-07-28) — Fixed concurrent Codex tasks sharing the bare default daemon and overwriting one active tab: unset sessions now recognize CODEX_THREAD_ID and derive a distinct tab group per task. If a relay session's pinned tab disappears, chrome-use now preserves that target as a recovery tombstone and fails or reattaches to the same target instead of silently switching to a surviving about:blank scratch tab; mixed concurrent eval and snapshot flows therefore keep SPA in-memory login state intact (fixes #149). Contributors: @leeguooooo.
• v1.5.82 (2026-07-28) — Completed the v1.5.81 review follow-up: status now verifies that the native-host launcher resolves to an executable and exposes extension.hostHealthy in JSON; automatic stale-daemon recovery gives one consistent next action; ab-connect 0.5.15 identifies timeouts with a stable RelayTimeoutError; and the confirm E2E plus command help now match the behavior they document. Contributors: @leeguooooo.
• v1.5.81 (2026-07-28) — Added daemon-free chrome-use status for a single CLI, extension, relay, profile, and session health snapshot (fixes #145). Clicks that open native confirm()/prompt() now return a pending dialog immediately, so the same session can accept or dismiss it (fixes #144). ab-connect 0.5.14 bounds Chrome debugger calls at 8 seconds, while the CLI resets a stuck daemon when an older relay stays silent through the socket deadline, preventing indefinite HTTP-to-HTTPS process-swap hangs (fixes #146). The official chrome-use-sites source now provides Twitter search/thread engagement adapters with stable replies, bookmarks, and numeric views (fixes #124). Contributors: @leeguooooo.
• v1.5.80 (2026-07-26) — Fixed session stop [name] and session prune being intercepted by the ownership-command path. Both lifecycle commands now reach the daemon handler again, session --help clearly distinguishes ownership and lifecycle operations, and named stops validate the session name before touching daemon state (#142, fixes #140). Contributors: @leeguooooo.
• v1.5.79 (2026-07-26) — Added a Nix flake with a package, development shell, NixOS module, and home-manager module (#136). Native Duplicate tab transactions are now bounded, so late extension replies cannot outlive a timed-out request or corrupt later session state (#137). fill now resolves Monaco through global and AMD model APIs, performs an atomic setValue or trusted clipboard fallback, and verifies the authoritative model readback before reporting success; the Synology DSM empty-editor false success now fails safely (#139). Contributors: @M4jor-Tom, @forsakesoul, @leeguooooo.
• v1.5.78 (2026-07-24) — Native downloads: download-url, download-start, downloads, and matching MCP tools; dynamic-link downloads no longer navigate the active tab by mistake. The local service now exposes a loopback- and origin-protected /api/v1, with stable code / retryable error fields across CLI, MCP, daemon, and HTTP responses (#132). network requests --type websocket observes WebSocket connection metadata from pages and cross-origin iframes without recording frame payloads (#131). site update now syncs both the epiral/bb-sites community source and the leeguooooo/chrome-use-sites official source by default, with no manual registration required (#133).
• v1.5.77 (2026-07-21) — Site-adapter application errors now return a non-zero exit code; the installer works in non-interactive environments without /dev/tty; reserved global-flag collisions produce an actionable warning; heavy-page Page.navigate timeouts degrade to a warning after navigation is confirmed; configurable private adapter sources add site sources/add/remove (#122, #123, #125, #126, #127).
• v1.5.76 (2026-07-16) — New chrome-use tab duplicate [ref] [--label <name>]: uses Chrome's native Duplicate tab (preserving full navigation history) and is also exposed through the chrome_use_tabs MCP. It works only on extension-connected real Chrome — --launch, raw CDP, Lightpanda, cloud providers, and old extensions all get a clear unsupported error, with no URL-based recreation fallback (that would lose Duplicate semantics); the extension negotiates a nativeTabDuplicate capability via hello. The duplicate becomes chrome-use's internal active target while restoring your previously focused window and tab; output exposes only tab/target ids, never the URL, and orphaned duplicates are rolled back if attach, grouping, or setup fails.
• v1.5.75 (2026-07-10) — Fixed extension-relay auto-connect creating two about:blank tabs for a new session. The connection now reuses the session-owned scratch tab created during target discovery and creates a fallback only when the page count is zero, so read-only commands, status checks, and pre-navigation failures no longer leave paired blank tabs behind.
• v1.5.74 (2026-07-08) — Skill distribution v2: new chrome-use skill install as the one entry point — it delegates to skills.sh (npx skills add … -g) to install across 20+ runners and never writes runner dirs itself; curl … | sh now installs the skill after the binary and finishes with a doctor self-check plus a copy-paste first prompt for your agent; doctor gains a read-only "is the agent skill installed?" probe (warn, never fail); the stub routing table grows from 5 to 11 symptom→command rows (canvas/network/react/real-chrome/sessions/test, …). Also fixed: skills/chrome-use/SKILL.md's description was invalid YAML (a bare : ), which made npx skills add install core/test/… instead of chrome-use — fixed with a folded block scalar.
• v1.5.73 (2026-07-07) — Four issue fixes: extract --schema no longer silently returns [] on a plain repeating list (auto-detects the repeating container + a diagnostic on no match + accepts an array-shaped schema, #96); site adapters inject the family _helper before running (twitter/* etc. no longer ReferenceError, #99); console --limit N tails the last N entries (#110); real skill tiering (<!-- full --> marker — lean default, --full for everything) + dedup + session handoff synced into the sessions skill (#100).
• v1.5.72 (2026-07-07) — Native commands survive shadow-DOM-heavy apps: select/fill now handle react-select, module-scoped Monaco, and controlled inputs whose @ref anchored a wrapper (#105); sharper on Element-Plus modals — snapshot -i tags controls inside the top modal/drawer with modal, a closest-text hint on selector misses, and a new diagnose verb for blank SPAs (#90). curl … | sh sets up the extension and handles the debugging banner in one command (consent at install → auto-silence at runtime). The skill steers agents to read/click/fill over hand-rolled eval.
• v1.5.71 (2026-07-07) — Docs: new How It Works (with an SVG pipeline diagram), Lineage & Upstream, and Single-pass Scripting chapters, plus a full doc-site audit sweep. No functional change.
• v1.5.70 (2026-07-07) — chrome-use script single-pass scripting (#101): a JSON op-list (value bus + loops + asserts) and synchronous JS (cu.* helpers); a daemon-resident boa engine survives hard navigations, running many steps in one tool call. Also: connect detects enterprise-blocked extensions and guides the escape hatches; opt-in background auto-update (CHROME_USE_AUTO_UPGRADE=1); one-click Web Store install.
• v1.5.69 (2026-07-07) — snapshot -i merges presentation-role / AX-stripped cross-origin iframes (the reCAPTCHA case, #92); snapshot/eval resync before resolving the active tab so they don't drift to about:blank (#93); unlabeled interactive controls named from placeholder / nearest label (#90.2); screenshot resync captures the active tab (#91).
• v1.5.68 (2026-07-02) — Session ownership + human handoff: session handoff/resume/status/list (#89, ported from ego-lite); whoami per-site identity + a global --as account guard.
• v1.5.67 (2026-07-02) — Guided multi-profile extension install: enumerate all profiles, detect stale policy, deep-link Settings + wait for approval + auto-restart; setup wizard localized zh/en; connect <port> / --cdp rebind when the endpoint changes.
• v1.5.66 (2026-07-02) — select no longer silently selects nothing when no <option> matches; it now errors and lists every available option. Default action timeout dropped from 30s to 25s.
• v1.5.65 (2026-07-02) — network route --set-json: structured JSON-field edits on the real response; new chrome-use report packages a de-identified friction log into a paste-ready GitHub issue; MCP --tools all (24 tools).
• v1.5.64 (2026-07-01) — chrome-use mcp: a stdio MCP server (12-tool core profile) for MCP-only hosts like Claude Desktop that can't run a shell command.
• v1.5.63 (2026-07-01) — read [url]: fetch a URL — or, with no URL, the active tab — as agent-readable text; supports --llms / --outline / --filter / --raw.
• v1.5.62 (2026-07-01) — fixed type --clear / --delay parsing; find label now also matches aria-label/aria-labelledby.
• v1.5.61 (2026-07-01) — React renderer fix: pick the actual react-dom renderer instead of hardcoding id 1 (was reading an empty tree on Next.js 16.3 Turbopack RSC apps).
• v1.5.60 (2026-07-01) — network route: edit the real response at the response stage (status/headers/body substring replace).
• v1.5.59 (2026-07-01) — network route: mock responses and rewrite requests via the CDP Fetch domain — no proxy, no cert, no JS injection.
• v1.5.58 (2026-07-01) — chrome-use test: per-case account switching for multi-account YAML suites (account:).
• v1.5.55 (2026-06-29) — friction auto-reporting.
• v1.5.54 (2026-06-29) — form fill can select by visible option text; fixed self-heal on the --launch path.
• v1.5.53 (2026-06-29) — form fill --map: bulk-mapped form filling.
• v1.5.52 (2026-06-29) — --observe: capture the a11y-tree delta around an action; auto ref-heal docs.
• v1.5.51 (2026-06-29) — action guards --if-present / --optional.
• v1.5.50 (2026-06-29) — extract --schema: schema-driven structured scrape to JSON.
• v1.5.49 (2026-06-29) — expect: assertion verb with a matching exit code.
• v1.5.48 (2026-06-29) — ab-connect 0.5.7: wake-from-sleep reconnect via chrome.idle.
• v1.5.47 (2026-06-29) — ab-connect 0.5.6: adopt no longer persists; clears the stuck debugger banner.
• v1.5.46 (2026-06-29) — relay self-heal: a dropped relay recovers on its own, no hang or manual reconnect.
• v1.5.45 (2026-06-28) — fixed adopt-tab command resolution (a regression from #68).
• v1.5.44 (2026-06-28) — adopt switched to on-demand attach (ext 0.5.5): no more debugger banner on user tabs.
• v1.5.43 (2026-06-27) — #65 snapshot --filter + eval top-level-await hint.
• v1.5.42 (2026-06-27) — #60 browser/profile selection: browsers listing + --browser.
• v1.5.41 (2026-06-26) — #60 driving-profile observability + #53 canvas/closed-shadow skill docs.
• v1.5.40 (2026-06-26) — #58 eval --frame, reconnect alias, actionable stale-target errors.
• v1.5.39 (2026-06-26) — snapshot -i now surfaces inline form-validation errors.
• v1.5.38 (2026-06-26) — #52 tab routing scoped to the session group + CI format fix.
• v1.5.37 (2026-06-25) — solve-slider robustness (wait for slices) + pluggable detector hook.
• v1.5.34 (2026-06-25) — solve-slider (NetEase Yidun slider captcha) + drag offset mode.
• v1.5.32 (2026-06-24) — sunny extension UX: friendlier icon, polished popup, options page, agent cursor.
• v1.5.31 (2026-06-24) — fail loudly on relay tab-drift instead of clicking the wrong tab.
• v1.5.30 (2026-06-24) — relay-down guidance + canvas/closed-shadow skill playbook.
• v1.5.29 (2026-06-24) — silenced the chrome.debugger banner + fixed a leftover about:blank scratch tab.
• v1.5.28 (2026-06-22) — the chrome-use skill now prefers live web checks.
• v1.5.27 (2026-06-19) — gated the about:blank cleanup to the relay case only.
• v1.5.26 (2026-06-18) — session stop <name> + session prune + lifecycle docs.
• v1.5.25 (2026-06-18) — default idle-shutdown + keep: stop leaving scratch tabs/groups behind.
• v1.5.24 (2026-06-18) — build fix: include browser.rs's clear_viewport/via_relay + cargo fmt.
• v1.5.23 (2026-06-17) — adopt: drive a pre-existing tab without opening a new one.
• v1.5.22 (2026-06-17) — group-scoped Target.getTargets on the relay: restores follow-popup + cross-session adopt under isolation.
• v1.5.21 (2026-06-17) — rich-editor fill, box centers, screenshot downscale, disabled handling + docs (#41-#45).
• v1.5.20 (2026-06-17) — site: adapter auto-sync + auto-suggest.
• v1.5.19 (2026-06-17) — site: bb-sites adapters — turn any site into a structured-data CLI.
• v1.5.18 (2026-06-17) — issue-reporting guidance + a clear error for data: URLs over the relay.
• v1.5.17 (2026-06-17) — complete multi-agent isolation: clicks no longer adopt foreign tabs/pop-ups.
• v1.5.16 (2026-06-17) — strict multi-agent tab isolation on the relay.
• v1.5.15 (2026-06-17) — trusted activation for in-iframe buttons.
• v1.5.14 (2026-06-17) — fixed the eval-await regression (replMode) + default scroll; green CI (#36, #38).
• v1.5.13 (2026-06-17) — eval replMode (re-declarable let/const) + the snapshot-first skill rule (#37, #38).
• v1.5.12 (2026-06-17) — relay-safe hover/dblclick/drag, deeper iframe snapshot, key-events-based typing.
• v1.5.11 (2026-06-16) — cross-origin iframe scroll/click + open auto-reattach (#35, #36).
• v1.5.10 (2026-06-16) — warn when launching via debug-port while the relay is up.
• v1.5.9 (2026-06-16) — strip zero-width unicode from titles + screenshot --clip/element.
• v1.5.8 (2026-06-16) — file upload over the extension relay.
• v1.5.7 (2026-06-16) — cf-status: a Cloudflare clearance preflight check.
• v1.5.6 (2026-06-15) — pin the adopted tab against transient relay snapshots.
• v1.5.5 (2026-06-15) — a diagnostic log for the remote-debugging consent modal in connect mode.
• v1.5.4 (2026-06-15) — get text --pierce: pierce closed shadow DOM (#30).
• v1.5.3 (2026-06-15) — get text now defaults to cross-frame; #29 (sessions/did-you-mean/tab liveness); CI changelog fix.
• v1.5.1 (2026-06-15) — frame-aware text extraction (get text --all-frames/--main, frames) + #27, ab-connect 0.4.9 targetId recovery.
• v1.5.0 (2026-06-15) — text-selector click, get text defaults to body, tab --activate, click --follow/openedTab; fill now fires input/change/blur; close wording + chrome-use current.

v1.4.x

• v1.4.1 (2026-06-14) — hold-to-move (full keydown/keyup descriptor, #game); requires ab-connect 0.4.8 (#23 reattach hardening).
• v1.4.0 (2026-06-13) — open no longer hijacks focus; tab adopt-by-targetId; keydown/keyup docs; canvas hint; doctor checks version coherence across components.

v1.3.x

• v1.3.0 (2026-06-13) — daemon restart/status (#20.2) + live tab resync, adopt-by-targetId, open --reuse-tab.

v1.0.x – v1.2.x

• v1.2.3 (2026-06-13) — bringToFront command + tab list --full shows untruncated URLs.
• v1.2.2 (2026-06-12) — a non-blocking "update available" notice + release changelogs.
• v1.2.1 (2026-06-12) — relay tab-drift pin on open (#14/#18) + a stable per-tab relay session.
• v1.2.0 (2026-06-12) — chrome-use test: browser test suites.
• v1.1.0 (2026-06-12) — cross-profile cookie export/transfer.
• v1.0.0 (2026-06-12) — rebrand: agent-browser-stealth → chrome-use, de-fork, version reset to 1.0.0.

v0.27.0-fork.x (the fork era before the rebrand)

• v0.27.0-fork.51 (2026-06-12) — rustfmt fix for the issue #7 regression tests (CI format gate).
• v0.27.0-fork.50 (2026-06-11) — tab-title truncation + multi-agent/eval/type docs.
• v0.27.0-fork.49 (2026-06-11) — embedded stealth-status + multi-agent skill guidance.
• v0.27.0-fork.48 (2026-06-11) — iframe-proxy toggle + stealth status.
• v0.27.0-fork.47 (2026-06-11) — tab-drift pin, snapshot -c keeps interactive elements, stale-ref guidance.
• v0.27.0-fork.46 (2026-06-11) — capped the --annotate legend.
• v0.27.0-fork.45 (2026-06-11) — pick combobox as an atomic op.
• v0.27.0-fork.44 (2026-06-11) — eval origin stamp, type --focused, humanize argument validation warning.
• v0.27.0-fork.43 (2026-06-11) — a batch of issue/Hermes fixes (silent-click, live env, eval --file, tab-list, docs).
• v0.27.0-fork.42 (2026-06-11) — close session-owned tabs on exit — no more tab leak.
• v0.27.0-fork.41 (2026-06-11) — relay self-heals silently, no user action needed on a blip.
• v0.27.0-fork.40 (2026-06-11) — no more consent-dialog fallback when the extension is installed.
• v0.27.0-fork.39 (2026-06-11) — cookies set --curl preserves the full set of cookie attributes.
• v0.27.0-fork.38 (2026-06-11) — silent operation — no foreground tab stealing.
• v0.27.0-fork.37 (2026-06-11) — completed humanize (bbox jitter + wheel/drag easing).
• v0.27.0-fork.36 (2026-06-11) — human-like input stealth (humanize).
• v0.27.0-fork.35 (2026-06-11) — skill docs embed Store-install, feedback channel, and stale-binary guidance.
• v0.27.0-fork.34 (2026-06-11) — Web Store live: store-targeted force-install + skill store-install guidance.
• v0.27.0-fork.33 (2026-06-10) — polished two Hermes-found cosmetic issues (invalid-selector wording, empty-URL glob).
• v0.27.0-fork.32 (2026-06-10) — resolved Hermes-found CLI bugs (wait --url, find role, invalid selector, and more).
• v0.27.0-fork.31 (2026-06-10) — Web Store submission ready + two install paths.
• v0.27.0-fork.30 (2026-06-10) — stealth: navigator overrides moved onto the prototype, not the instance.
• v0.27.0-fork.29 (2026-06-10) — fixed the plugin overflowTest, popup-free auto-connect, ab-connect rebrand+icon, README.
• v0.27.0-fork.28 (2026-06-10) — skill docs: headed-by-default, tab groups.
• v0.27.0-fork.27 (2026-06-10) — forbid headless — always headed, for stealth.
• v0.27.0-fork.26 (2026-06-10) — stealth: navigator.platform fixed to MacIntel (anti-detection fix).
• v0.27.0-fork.25 (2026-06-10) — fixed the relay liveness check (answer Browser.getVersion locally) — stops the reconnect-storm drift.
• v0.27.0-fork.24 (2026-06-10) — passive tab discovery no longer hijacks the active tab (per-session control).
• v0.27.0-fork.23 (2026-06-10) — tolerate minimal targetInfo from the relay (extension connect's getTargets).
• v0.27.0-fork.22 (2026-06-09) — extension connect uses the relay URL, fixing a --session connect hang.
• v0.27.0-fork.21 (2026-06-09) — multi-client relay (concurrent agents).
• v0.27.0-fork.20 (2026-06-09) — per-session tab groups (ab-connect 0.4.0).
• v0.27.0-fork.19 (2026-06-09) — a new extension id (Web Store signing key) + store-aware install.
• v0.27.0-fork.18 (2026-06-09) — extension connect: zero-token native-messaging control of real Chrome + click reliability + eval-first/find-url/site-notes.
• v0.27.0-fork.17 (2026-06-05) — the eval-first skill + find-url (local bookmark search) + the site-notes convention.
• v0.27.0-fork.16 (2026-06-05) — click reliability (scroll-into-view + DOM fallback) + skill docs (console opt-in, CLICK_MODE, form/hidden-input eval).
• v0.27.0-fork.15 (2026-06-04) — stealth hardening (lazy Runtime.enable, native timezone/WebRTC, opt-in canvas noise) + adaptive @ref relocation.
• v0.27.0-fork.14 (2026-06-01) — upgrade fix + CI on Node 24.
• v0.27.0-fork.13 (2026-06-01) — --profile auto.
• v0.27.0-fork.12 (2026-06-01) — embedded skill docs.
• v0.27.0-fork.11 (2026-06-01) — stealth is now fully applied on the FullLaunch path (previously only on some launch paths).
• v0.27.0-fork.10 (2026-06-01) — a UX batch + stealth coverage/webdriver handling.
• v0.27.0-fork.9 (2026-06-01) — routine fix iteration.
• v0.27.0-fork.8 (2026-05-09) — built-in retry for transient overlay occlusion.
• v0.27.0-fork.7 (2026-05-09) — catch transient overlay occlusion before mis-clicking.
• v0.27.0-fork.6 (2026-05-09) — capped defensive CDP timeouts, fixed a misleading chrome://inspect tip.
• v0.27.0-fork.5 (2026-05-09) — fixed a misleading warning + a connect liveness probe + wait @ref.
• v0.27.0-fork.4 (2026-05-09) — fixed the SPA click race + @ref identity verification + wait --gone.
• v0.27.0-fork.3 (2026-05-09) — SPA click race fix + the wait --gone primitive.
• v0.27.0-fork.2 (2026-05-09) — a friendlier find error + restore the URL after a version-mismatch restart.
• v0.27.0-fork.1 (2026-05-09) — synced with upstream v0.27.0, added skills.sh support.

Earlier history

chrome-use periodically merges in upstream agent-browser releases (v0.27–v0.31, e.g. glob support in --wait from v0.30.0, a sandbox-package publish-metadata fix from v0.29.0). chrome-use's own development sits on top of these and diverges heavily, so the two version lines aren't in lockstep.

Earlier v0.x releases (v0.6.0 – v0.26.0, January–April 2026) inherit from the upstream agent-browser base; they're not worth listing individually here.

Related reading