# OpenChrome v1.10.0

Release date: 2026-04-22

## Summary

v1.10.0 promotes the recent reliability, SaaS, and observability work from the
validated `develop` line into the next publishable package release.

This release materially improves:

- session initialization deadline handling
- HTTP timeout and disconnect behavior
- tenant-aware request isolation foundations
- multi-tenant API key and JWT/OAuth authentication
- request correlation and audit logging
- orphan Chrome cleanup and shutdown resilience

It is a feature-forward, backward-compatible release and is therefore shipped as
a **minor** version bump.

---

## Highlights

### 1. Session initialization is now budgeted end-to-end

OpenChrome now applies a real retry budget across session startup rather than
letting nested retries and per-step timeouts drift upward unpredictably.

Key outcomes:

- `waitForDebugPort()` uses a monotonic deadline guard
- CDP connect retries consume from a shared `Budget`
- budget exhaustion surfaces as an explicit session-init failure mode
- reconnect paths preserve the session-init budget instead of silently falling
  back to unbudgeted retries

Impact:

- fewer “hung startup” cases
- more predictable failure times
- clearer diagnostics for launch vs. connect-stage failures

---

### 2. HTTP request handling is safer under slow or abandoned clients

The HTTP transport now distinguishes between:

- slow/incomplete request bodies
- idle keepalive sockets
- valid long-running tool calls
- client disconnects during tool execution

Key outcomes:

- explicit request/body/socket timeout configuration
- body receive deadline enforcement for slowloris-style requests
- disconnect-triggered abort propagation into tool execution
- socket idle timeout is disabled once the full request body is received so
  legitimate long-running tool calls are not reset mid-flight

Impact:

- less wasted work after clients disappear
- fewer zombie tool calls
- better production behavior under retries and flaky clients

---

### 3. Multi-tenant auth foundations are now in place

This release introduces the core building blocks for SaaS-grade per-tenant auth:

- file-backed `ApiKeyStore`
- multi-tenant API key CRUD primitives
- admin key management CLI
- JWT / JWKS verification support
- scope-based authorization policy
- HTTP auth mode resolution for:
  - legacy shared token
  - API key
  - JWT
  - API key or JWT

Operationally important details:

- API keys are append-only and file-backed
- verification is hardened for multi-process correctness
- crash-tail JSONL append recovery is guarded
- docs and integration tests now reflect the shipped auth control plane

---

### 4. Tenant isolation groundwork is materially stronger

The release line now includes the tenant context stack that was previously
staged across multiple branches:

- `TenantManager`
- runtime idle sweep wiring
- tenant-scoped BrowserContext resolution
- tenant-aware HTTP transport validation and binding
- stricter tenant-session security tests

Important nuance:

- the tenant-isolation **infrastructure** is present
- the product still preserves backward compatibility by default
- strict tenant isolation is **not** enabled by default for all deployments

This means the groundwork is shipped, but deployments that want strict SaaS
isolation must still opt in where appropriate.

---

### 5. Request correlation and audit logging are substantially improved

Observability and security logging now capture more of the execution context:

- request ID generation and propagation
- extended audit entries with redacted arguments
- tenant-aware metric labeling helpers
- rule-based audit redaction for sensitive tool arguments
- stronger redaction defaults for `form_input`
- malformed redaction policy entries fail safe instead of breaking requests

This gives operators much better traceability for:

- which request triggered what
- which tenant a call belonged to
- which arguments were used without leaking secrets

---

### 6. Chrome orphan cleanup is better, but not “done forever”

This release includes improvements for cleaning up orphaned Chrome instances:

- Chrome PID tracking
- startup orphan cleanup
- synchronous exit-path cleanup
- broader server/session cleanup behavior

However, this is best described as **improved lifecycle resilience**, not the
final word on all headless/headed lifecycle edge cases. Detached Chrome launch
paths still exist, so follow-up hardening may still be warranted for some
real-world environments.

---

## Detailed changes

### Reliability

- Added monotonic debug-port deadline enforcement
- Added session-init retry budgeting and explicit budget exhaustion behavior
- Preserved budget through probe-triggered reconnects
- Fixed long-running HTTP tool calls being terminated by socket idle timeout
- Surfaced async listener failures via metrics/logging
- Surfaced partial cookie-scan completion and related metrics

### Security

- Added multi-tenant API key storage and verification
- Added JWT / OAuth-compatible verification path via JWKS
- Added scope policy enforcement for authenticated tool access
- Hardened tenant session binding tests
- Improved audit redaction and protected `form_input` values

### SaaS / tenancy

- Added tenant-aware BrowserContext foundations
- Added runtime idle sweep wiring for tenant contexts
- Added tenant extraction and tenant-bound MCP session behavior in HTTP
- Added integration and transport tests around tenant behavior

### Observability

- Added request ID infrastructure
- Added extended audit log schema
- Added tenant-aware metric label helper
- Added additional metrics for listener errors and cookie-scan outcomes

### Docs

- Updated auth/operator docs to match shipped runtime behavior
- Added richer observability and correlation guidance
- Included FAQ comparison docs that were merged into the release line

---

## Verification performed before release prep

The integrated release line was verified with:

- `npm run lint` (warnings only, no errors)
- `npm run build`
- targeted regression suites covering:
  - auth and scope enforcement
  - tenant session binding
  - multi-tenant auth integration
  - tenant manager + registry behavior
  - HTTP tenant transport behavior
  - HTTP long-running socket behavior
  - CDP active probe reconnect behavior
  - session-init budget handling
  - redaction and audit logger behavior

The release branch was then promoted through:

- `develop` → `f65e580`
- `main` → `84350f5`

---

## Known limits / follow-up candidates

The following areas are improved but not fully “closed out” by this release:

- strict tenant isolation is not the global default yet
- transport-bound tenant propagation follow-up remains worth reviewing
- request-aware logger wrapper exists but is not yet consistently adopted across
  all production log sites
- some abort/disconnect observability requested in issue drafts is still only
  partially implemented
- Chrome/headed fallback lifecycle still includes detached-process paths

---

## Upgrade notes

- No breaking migration is expected for existing single-user installs
- HTTP deployments should review:
  - `OPENCHROME_AUTH_MODE`
  - `OPENCHROME_TENANT_METRICS`
  - `OPENCHROME_AUDIT_EXTENDED`
  - `OPENCHROME_STRICT_TENANT_ISOLATION`
  - HTTP timeout environment variables
- If you rely on legacy shared-token behavior, confirm your deployment still
  sets `OPENCHROME_AUTH_TOKEN`

---

## Suggested publish flow

After merge and final tag preparation:

1. verify `main` is at the intended commit
2. run `npm run build`
3. optionally run a final targeted smoke test
4. publish with your normal npm workflow
5. create the GitHub release using these notes

