## Summary
Fixes#4148
The MCP server hardcodes `aws_sso_auth=True` when creating a
`ChatAWSBedrock` instance, forcing AWS SSO authentication for all
Bedrock users — even when standard `AWS_ACCESS_KEY_ID` /
`AWS_SECRET_ACCESS_KEY` credentials are configured.
## Changes
- `browser_use/mcp/server.py`:
- Read `aws_sso_auth` from `llm_config` with a default of `False`,
allowing boto3's standard credential chain to work correctly
- Replaced a Chinese-language comment with an English one
## Usage
Users who need SSO auth can set it explicitly in their config:
```json
{"aws_sso_auth": true}
```
Users with IAM key-based auth (the most common deployment pattern) now
work without extra configuration.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Stop forcing AWS SSO auth for Bedrock in the MCP server. We now read
aws_sso_auth from config (default false) so IAM keys and the standard
boto3 credential chain work.
- **Bug Fixes**
- Read aws_sso_auth from llm_config and pass through to ChatAWSBedrock.
- Replaced a non-English comment with an English one.
<sup>Written for commit 2a955de5c9.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Use the configured default LLM model for MCP tool execution instead of
hardcoding gpt-4o. Fixes#3099 and preserves explicit model overrides
when provided.
- **Bug Fixes**
- Tool schema now states the model defaults to the configured value.
- Removed 'gpt-4o' defaults from argument handling and function
signatures; model is optional.
- Runtime falls back to llm_config['model'] when no model is passed.
<sup>Written for commit 50b22b2472.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
On Windows, `Path('/tmp')` resolves to `C:\TMP` at the drive root, which
either crashes on import (`FileNotFoundError` / `FileExistsError`) or
silently pollutes the root drive. This replaces all hardcoded `/tmp`
paths with `tempfile.gettempdir()`, which returns the
platform-appropriate temp directory.
Also removes a redundant `import tempfile`.
## Attribution
Cherry-picked from @giulio-leone's commits in #4242:
- `cf2c179`: main fix across both files
- `33ba044`: redundant import cleanup
## Related issues
Fixes#4165, fixes#4073
## Related PRs
Several PRs addressed this; none covered all locations or were fully
CI-clean:
- #4074 (Chase-Xuu): `profile.py` only, misses `code_use/service.py`
- #4168 (worksbyfriday): `profile.py` only, misses `code_use/service.py`
- #4194 (thakoreh): `profile.py` only, CI failures
- #4240, #4242 (giulio-leone): fix both locations, CI green, mergeable.
This PR cherry-picks from #4242.
- #4206 (thakoreh): bundles this with unrelated proxy fix#4050
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Replace hardcoded /tmp with tempfile.gettempdir() for profile downloads
and the code agent directory, using the correct temp folder on all
platforms. Prevents Windows errors and root drive pollution; also
switches to a single module-level tempfile import.
- **Bug Fixes**
- Use tempfile.gettempdir() for downloads_path and agent_directory.
- Prevents FileNotFoundError/FileExistsError on Windows and avoids
C:\TMP.
- **Refactors**
- Use module-level tempfile import; remove local shadowed imports in
profile extraction and downloads setup.
<sup>Written for commit e9222d49e1.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
tempfile is already imported at module level (line 3). The local
imports inside set_default_downloads_path() and _extract_extension()
were shadowing the module-level import with no effect.
Refs: browser-use/browser-use#4242
On Windows, Python resolves '/tmp' to the current drive root (e.g. C:\TMP),
creating unwanted folders. Use tempfile.gettempdir() which returns the
platform-appropriate temp directory on all operating systems.
Applied to:
- browser_use/browser/profile.py: BrowserProfile downloads_path default
- browser_use/code_use/service.py: CodeUseService agent_directory base
Fixes#4165
- Replace 'production' nav item with 'use-claude' linking to docs.cloud.browser-use.com/introduction
- Add redirect from /use-claude to external Claude docs
- Add redirect from /production to /customize/sandbox/quickstart for backward compatibility
- Delete production.mdx, create use-claude.mdx with meta refresh fallback
Co-authored-by: Magnus Müller <MagMueller@users.noreply.github.com>
tempfile is already imported at module level (line 3). The local
imports inside set_default_downloads_path() and _extract_extension()
were shadowing the module-level import with no effect.
Refs: browser-use/browser-use#4242
## Summary
Fixes#4050 - CDP startup fails on Windows with proxy env causing
JSONDecodeError on /json/version.
## Problem
When `HTTP_PROXY` or `HTTPS_PROXY` environment variables are set,
`httpx.AsyncClient()` by default routes **all** HTTP requests through
the proxy, including localhost requests to the Chrome DevTools Protocol
endpoint (`http://127.0.0.1:<port>/json/version`).
On Windows, this causes the CDP endpoint query to return a 502 response
with an empty body, which then fails JSON parsing with:
```
JSONDecodeError: Expecting value: line 1 column 1 (char 0)
```
## Solution
Add `trust_env=False` to the `httpx.AsyncClient()` call when querying
the CDP `/json/version` endpoint. This prevents httpx from using proxy
environment variables for this specific localhost request.
## Changes
- Modified `browser_use/browser/session.py`: Added `trust_env=False`
parameter to httpx.AsyncClient() in the connect() method
## Testing
- Verified the change allows CDP connection to succeed when proxy env
vars are set
- The fix is minimal and targeted, only affecting the CDP endpoint query
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Disable proxy usage only for local CDP /json/version requests
(localhost, 127.0.0.1, ::1) to fix Windows startup 502s and
JSONDecodeError. Local requests use httpx.AsyncClient with
trust_env=False; remote CDP URLs continue to honor
HTTP_PROXY/HTTPS_PROXY.
<sup>Written for commit 9932f06500.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
Resolves#3782, and makes a slight change to #3802.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes the Browser State format docs in system_prompt.md to match the
actual DOMTreeSerializer output. Replaces the old
[index]<type>text</type> description with a tree-style format
([index]<tag attr=value /> with text on child lines), updates the
example, and documents the |SCROLL| and |SHADOW(open/closed)| prefixes
(fixes#3782).
<sup>Written for commit e3ca7ea550.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
The system_prompt.md incorrectly documented the browser state format as:
[index]<type>text</type>
Example: [33]<div>User form</div>
But the actual serializer output format is:
[index]<tagname attribute=value />
With text content as child nodes on separate lines
This update:
- Corrects the format description to match actual DOMTreeSerializer output
- Updates examples to show realistic tree structure
- Documents |SCROLL| prefix for scrollable containers
- Documents |SHADOW(open/closed)| prefix for shadow DOM elements
Fixes#3782
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Added a Product Hunt launch banner to the README to promote the launch
and direct users to our Product Hunt page. This places a featured badge
alongside existing badges and links out in a new tab.
<sup>Written for commit f3aeca9bef.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
The MCP server hardcoded aws_sso_auth=True, breaking all non-SSO
Bedrock users (IAM key-based auth). Now reads aws_sso_auth from
llm_config with a default of False, letting boto3's standard
credential chain work correctly.
Also replaced a Chinese-language comment with an English one.
Fixes#4148
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Upgraded google-genai to 1.65.0 to resolve "'str' object has no
attribute 'pop'" errors during Gemini calls. Addresses Linear 4224 and
stabilizes response handling.
- **Dependencies**
- google-genai: 1.60.0 → 1.65.0
<sup>Written for commit bab3e36c71.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
Resolves#3523, and makes Playwright storage_state behave like
Playwright itself: session cookies with expires: 0/-1 are treated as
session cookies (not expired), and storage is only applied on matching
origins. Also waits for restore before navigation so it sticks.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes storage_state restore to match Playwright: session cookies are
kept, and local/session storage is applied only on matching origins.
Also waits for restore to finish before navigation so cookies/storage
take effect. Addresses #3523.
- **Bug Fixes**
- Await BrowserConnectedEvent handlers so restore completes before
start() returns.
- Normalize session cookies by removing expires=0/-1 so CDP doesn’t
treat them as expired.
- Scope localStorage/sessionStorage init scripts to
window.location.origin, guard missing origin, and batch per-origin
writes in a try/catch-wrapped script.
<sup>Written for commit 744c2be4ae.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
Addresses root cause of #4156:
When proxy auth is enabled, the code registers a new
Target.attachedToTarget handler and overwrites the existing one that
tracks new tabs, so the "tab opened" event never gets processed, and the
new tab never appears. The fix is to avoid replacing that handler and
enable proxy auth on each newly attached session instead.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes proxy auth breaking tab tracking. Auth is now enabled per session
so new tabs appear reliably.
- **Bug Fixes**
- Removed the global Target.attachedToTarget handler in session.py that
overwrote tab tracking.
- Enabled Fetch.handleAuthRequests per newly attached session in
SessionManager when proxy credentials exist.
- **Refactors**
- Removed unused imports.
<sup>Written for commit c8bfc86440.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Pinned all runtime, optional, and dev dependencies in pyproject.toml to
exact versions for deterministic installs and reproducible builds. Bumps
package version to 0.12.0.
- **Dependencies**
- Replaced version ranges with exact pins across core packages (e.g.,
pydantic 2.12.5, requests 2.32.5, openai 2.16.0, anthropic 0.76.0,
google-api-python-client 2.188.0).
- Pinned optional extras (cli, code, aws, oci, video, examples, eval) to
exact versions.
- Pinned dev tooling (ruff, pytest, fastapi, uvicorn, pre-commit, etc.)
to exact versions.
- Kept platform-specific markers (pyobjc on macOS, screeninfo on
non-macOS).
<sup>Written for commit a2f6be18fc.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Automatically normalizes CSV content in the agent filesystem to produce
RFC 4180-compliant files on write and append. Fixes common LLM CSV
errors and handles double-escaped \n and \" outputs.
- **New Features**
- CsvFile now parses and re-serializes CSV via Python’s csv module to
fix quoting, escaping, empty fields, and blank lines.
- Detects and unescapes double-escaped \n and \" when no real newlines
exist; preserves literals when real newlines are present.
- Normalization applied on write and append with safe newline merging;
added example script and extensive tests.
- **Refactors**
- Fixed code styling; pinned browser-use-sdk to 2.0.15.
<sup>Written for commit 4a70f0e64a.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Bump package version to 0.11.13 in pyproject.toml to release the next
patch.
<sup>Written for commit 1ed90b8bff.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Adds a new save_as_pdf agent action to export the current page to a PDF
via Chrome DevTools Protocol. Saves full-page content and returns the
file path; supports custom filename, paper size, orientation, scale, and
background.
- New Features
- Added SaveAsPdfAction with fields: file_name, print_background
(default true), landscape, scale (0.1–2.0), paper_format (Letter, Legal,
A4, A3, Tabloid).
- Integrated CDP Page.printToPDF with preferCSSPageSize and a 30s
timeout.
- Auto filename from page title, sanitized with .pdf added; duplicates
resolved by appending “(n)”.
- ActionResult includes a success message, the PDF path in attachments,
and the full path in long_term_memory.
- Added example script (examples/features/save_as_pdf.py) and CI tests
covering default/custom filenames, duplicates, A4 and landscape,
background rendering, and PDF validity.
<sup>Written for commit bc5659e7b4.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Add automatic WebSocket reconnection for remote CDP connections so
agents recover from transient drops without stopping. Adds reconnect
events, fixes timeouts, and updates error handling and watchdogs to wait
for recovery instead of failing.
- **New Features**
- Auto-reconnect CDP WebSocket with up to 3 attempts (1s, 2s, 4s
backoff); detects WS drops from the CDP message handler and triggers
reconnect.
- Reconnect rebuilds the CDP client/session manager, re-enables
autoAttach, restores page focus (fallback or new blank page), and proxy
auth.
- Emits BrowserReconnectingEvent and BrowserReconnectedEvent (includes
attempt and downtime); emits BrowserErrorEvent on repeated failure.
- **Bug Fixes**
- Distinguish recoverable connection-like errors from true
browser-closed or intentional stops; suppress auto-reconnect on
kill/stop/reset.
- Standardize reconnection wait to RECONNECT_WAIT_TIMEOUT (54s) so
watchdogs and the step error handler wait the full window and resume on
success.
- Avoid false positives during reconnects by not treating transient CDP
None states as terminal; watchdogs now wait during reconnect instead of
skipping.
<sup>Written for commit 08bf06f734.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated description by cubic. -->
## Summary by cubic
Adds automatic CAPTCHA handling that pauses agent steps while the
browser solves challenges, then resumes and reports the result to the
model. Prompts now say CAPTCHAs are auto-solved.
- New Features
- CaptchaWatchdog listens for typed
BrowserUse.captchaSolverStarted/Finished events, waits until done (with
timeout), and exposes session.wait_if_captcha_solving returning a typed
CaptchaWaitResult.
- Agent step pre-checks for active CAPTCHA, waits, resets timing, and
appends an ActionResult with vendor, duration, and outcome.
- Emits typed CaptchaSolverStarted/Finished events; handlers auto-attach
on connect and clear on disconnect, with duplicate-attach protection.
New BrowserProfile.captcha_solver flag (default true).
- Dependencies
- Bumped cdp-use to 1.4.5 for CAPTCHA solver events.
<sup>Written for commit f60a62bc76.
Summary will update on new commits.</sup>
<!-- End of auto-generated description by cubic. -->
laithrw
