Browser-harness 0.1.10 stops leaking CDP credentials to logs

Browser-harness, the 17,145-star agent-browser project, released browser-harness's v0.1.10 release notes on August 26 at 00:49 UTC. Every item in it is about containment. None of it adds a new feature.

The headline fix, PR #639, redacts Chrome DevTools Protocol credentials from daemon logs. A CDP endpoint is full remote control of a browser session: navigation, cookies, form fills, the works. A credential sitting in plain text in a log file was a standing invitation to anyone who could read that log.

PR #640 changes what happens when an orchestrator-owned daemon shuts down. It now fails closed, so a crashed or killed orchestrator can't leave a browser session open for something else to pick up. PR #653 adds a machine-readable health check for daemons. Teams add checks like this after a daemon dies silently and leaves them guessing.

Two smaller changes round it out. PR #641 splits the screenshot response timeout from the IPC connect timeout, so a slow screenshot doesn't get misread as a dead connection. PR #642 lets teams suppress the Cloud live viewer.

Anyone running browser agents unattended, with no one watching the session live, should pull this release. The credential leak and the fail-closed shutdown are exactly the failure modes that show up when an agent runs overnight. Nobody checks its logs until something's already wrong.

The release notes don't say how long the CDP logging issue existed, or whether older log files need to be rotated out as a precaution. They also don't mention backporting the fix to older release branches, so anyone on a version before 0.1.10 stays exposed until they upgrade.