browser-harness patches a CDP credential leak in daemon logs

browser-harness 0.1.10 redacts CDP credentials from daemon logs, closing a leak that put full control of a browser session into any file, aggregator, or console that captured those logs. A CDP endpoint isn't a read-only debug hook. Whoever holds those credentials can drive the browser directly, click, type, read cookies, pull whatever's on screen.

The rest of the release is cleanup, not new capability. Orchestrator-owned daemons now fail closed on shutdown, so a killed parent process can't leave an unmanaged daemon running. There's a machine-readable health check for daemon status. The screenshot response timeout is split from the IPC connect timeout, so a slow screenshot no longer trips the same clock as a dead connection. You can also turn off the Cloud live viewer.

Five changes, and each one narrows something rather than adding to it, unusual for a point release this size. It reads like a team that found one real problem and swept the code for anything sitting next to it.

The release notes don't say how far back the plaintext logging goes, so treat any browser-harness daemon deployed before August 26 as having written raw CDP credentials to disk for its entire run. If those logs went to a shared aggregator, rotate whatever session tokens were live and pin 0.1.10 before running it again.