NianJiuZst · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,16 +6,25 @@ See the [Chinese changelog](CHANGELOG.zh-CN.md). Update both versions in the sam
 
 Starting from 0.2.0, CLI / Extension / DSH Plugin share the same version number.
 
-## [Unreleased]
+## [0.4.2] - 2026-11-05
 
 ### Added
 
+- Session controller labels show an agent name, project, session ID and color in
+  browser overlays. CLI and DSH session startup accept the display metadata.
+- Fill supports date, time, datetime-local, month and week inputs, validates
+  formats and min/max limits, and preserves background input state.
 - `bsk mcp` lets MCP clients control BrowserSkill over stdio using the existing
   daemon and browser extension. `bsk install-skill --mcp` can configure Codex,
   Claude Code, and Cursor.
 
 ### Changed
 
+- Borrowed tabs return relative to their original neighbors, with improved pinned
+  tab and group restoration. Eligible requests support automatic borrowing when
+  borrow confirmation is disabled.
+- The extension restores the `tabGroups` permission to read and restore borrowed
+  tabs' original groups.
 - Shared control waits for two seconds of quiet after the person's last completed
   action before returning control to the Agent, up from 650 ms.
 - CLI and daemon updates prefer the official website's domestic download source,
@@ -26,6 +35,13 @@ Starting from 0.2.0, CLI / Extension / DSH Plugin share the same version number.
 
 ### Fixed
 
+- Element waits requery selectors when matched nodes are replaced, avoiding false
+  hidden/detached success while a replacement remains visible.
+- Console capture is enabled only when requested, avoiding repeated reloads on
+  affected anti-debugging pages while preserving capture diagnostics.
+- Debug evidence redacts exact vendor credential headers.
+- DSH fill/select values beginning with `-` are passed as option values rather
+  than being parsed as CLI flags.
 - The shared-control toolbar yields pointer hits during automated clicks,
   including page actions beneath its lower-right corner. Its controls become
   interactive again when the click finishes or its passthrough lease expires.

diff --git a/CHANGELOG.zh-CN.md b/CHANGELOG.zh-CN.md
@@ -3,19 +3,27 @@
 BrowserSkill 的重要变更记录于此，格式参考 [Keep a Changelog](https://keepachangelog.com/)。
 从 0.2.0 起，CLI、扩展和 DSH 插件使用统一版本号。更新日志的中英文版本须在同一 PR 中同步更新。
 
-## [Unreleased]
+## [0.4.2] - 2026-11-05
 
 ### 新增
 
+- 浏览器浮层显示会话控制者的 Agent 名称、项目、会话 ID 和颜色；CLI 和 DSH 启动会话时支持传入这些显示信息。
+- 填写支持 date、time、datetime-local、month 和 week 输入框，校验格式与 min/max 范围，并保留后台输入状态。
 - `bsk mcp` 让 MCP 客户端通过标准输入和输出，借助现有守护进程与浏览器扩展控制 BrowserSkill。`bsk install-skill --mcp` 可为 Codex、Claude Code 和 Cursor 配置 MCP 服务。
 
 ### 变更
 
+- 借用标签根据原相邻标签恢复归还位置，改善固定标签和分组恢复；关闭借用确认后，符合条件的请求支持自动借用。
+- 扩展恢复使用 `tabGroups` 权限，以读取和还原借用标签的原分组。
 - 共享控制在用户最后一次已完成操作后连续安静 2 秒再交回 Agent，原阈值为 650 毫秒。
 - CLI 和 daemon 更新优先使用官网国内下载源；清单或安装包下载、验证失败时回退 GitHub。安装包回退固定为已选版本并保留 SHA256 校验，两个源都失败时逐项报告 URL 和失败原因。显式指定的自定义清单仍只使用配置的源。
 
 ### 修复
 
+- 元素等待在匹配节点被替换后重新查询选择器，避免替代节点仍可见却误报隐藏或移除成功。
+- 仅在请求时开启控制台采集，避免部分反调试页面反复刷新，并保留采集诊断。
+- 调试证据对精确匹配的厂商凭据请求头脱敏。
+- DSH 填写和选择以 `-` 开头的值时，将其作为选项值传递，避免被解析为 CLI 参数。
 - 共享控制工具栏在自动点击期间让出指针命中，包括被其右下角遮住的页面操作；点击结束或穿透租约到期后，工具栏控件恢复交互。
 - Enter 的 keydown 与文本事件一并派发，保留已完成的链接或表单导航回执，避免向新页面再发送独立字符事件；导航后的下一操作仍须获取新的控制上下文。
 - 页面操作超时后取消执行并等待有界清理，错误回包保留执行阶段、效果状态和操作标识；缺失回执时明确表示效果未知。CLI 和 MCP 的超时提示要求先检查应用结果再决定下一操作，避免盲目重试。

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -7,7 +7,7 @@ members = [
 default-members = ["crates/bsk-cli"]
 
 [workspace.package]
-version = "0.4.1"
+version = "0.4.2"
 edition = "2024"
 rust-version = "1.85"
 license = "MIT"
@@ -43,7 +43,7 @@ rand = "0.8"
 uuid = { version = "1", features = ["v4", "serde"] }
 
 # Workspace crates (version required for `cargo publish` of dependents)
-bsk-protocol = { version = "0.4.1", path = "crates/bsk-protocol" }
+bsk-protocol = { version = "0.4.2", path = "crates/bsk-protocol" }
 
 [profile.release]
 strip = "symbols"

diff --git a/apps/extension/package.json b/apps/extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@browser-skill/extension",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "private": true,
   "type": "module",
   "scripts": {

diff --git a/docs/releases/0.4.2-cli.md b/docs/releases/0.4.2-cli.md
@@ -0,0 +1,72 @@
+BrowserSkill CLI 0.4.2 adds MCP access and more reliable updates, cancellation, and action outcomes. Use it with extension 0.4.2 for the browser-side fixes below.
+
+### Added
+
+- **MCP server:** `bsk mcp` exposes BrowserSkill over stdio through the existing daemon and extension. `bsk install-skill --mcp` configures Codex, Claude Code, or Cursor. The initial adapter covers its tool schemas; file transfers, recording, and full-page screenshot export remain available through the CLI or DSH plugin.
+- **Controller identity:** session startup accepts an agent name, project, and color, shown in the extension's shared-control overlay and session metadata.
+- **Date and time inputs:** `fill` supports `date`, `time`, `datetime-local`, `month`, and `week`, with format and min/max validation.
+
+### Changed
+
+- CLI and daemon updates prefer the official website's domestic download source and fall back to GitHub on download or verification failures. Archive fallback stays on the selected version and retains SHA256 verification. Explicit manifest overrides continue to use only the configured source.
+- Borrowed tabs return relative to their original neighbors, with improved pinned-tab and group restoration. Eligible requests can automatically borrow a tab when borrow confirmation is disabled.
+- Shared control now waits for two seconds of quiet after the person's last completed action, up from 650 ms.
+
+### Fixed
+
+- Timed-out page actions cancel and await bounded cleanup. Errors preserve execution phase, effect state, and operation identity. Missing receipts remain explicitly uncertain; CLI and MCP guidance asks callers to inspect the application result before choosing another action.
+- Cancellation arriving before daemon RPC registration is retried within a shared two-second confirmation/response budget, reducing screenshots that keep a session busy after the caller stops.
+- Windows remote pairing, credential rotation, and revocation retry authorization snapshot replacement when concurrent readers cause `Access is denied`.
+- Shared-control sync recovers missing frame collectors, reports failed child frames safely, preserves human holds, and retries transient coverage failures within its deadline.
+- Recovery guidance identifies the sync reply's top-level `observation_id`. Borrow guidance explains closed tabs and unavailable confirmation UI.
+- DSH fill/select values beginning with `-` are passed as values instead of being parsed as CLI options.
+
+### Coordinated extension fixes
+
+- Restore legacy `mousewheel` handlers, including Bilibili player volume controls, even when no BrowserSkill task is active.
+- Avoid repeated page reloads caused by enabling console capture before it is requested.
+- Prevent truncated emoji text from invalidating an entire daemon reply and leaving commands waiting until timeout.
+- Let automated clicks reach page controls beneath the shared-control toolbar; preserve successful Enter-triggered navigation receipts.
+- Keep scrolling, ineffective keys, and focus alone from unnecessarily taking control; release completed/cancelled gestures and composition holds correctly.
+- Preserve main-document target actions across unrelated iframe refreshes, recheck selectors after node replacement, and associate repeated action labels with their own DOM containers.
+- Verify actual window and viewport sizes after resizing, and refresh shared-control observations.
+- Extend sensitive-field redaction across shared-control state, expectation failures, extraction, recording, and saved HTML debug evidence; recognize compound autocomplete tokens and keep recognized password fields masked after reveal. Redact vendor credential headers in debug evidence.
+
+### Upgrade
+
+1. Finish active browser tasks and run `bsk update --yes`. Restart foreground or supervisor-managed daemons in their owning terminal or process manager; after replacing the executable with an installer, run `bsk daemon restart`.
+2. Install [extension 0.4.2](https://github.com/Tencent/BrowserSkill/releases/tag/ext-v0.4.2) and update the DSH plugin to 0.4.2. Store review may delay availability.
+3. Reload the browser-skill instructions. DSH users should restart the profile and invoke `/browser-skill` again. Restart MCP clients after adding their configuration.
+4. Check `bsk --version`, `bsk status`, and `bsk doctor`.
+
+### What's Changed
+
+- fix(fill): support date, time, datetime-local, month, and week inputs by @Li-john1021 in [#443](https://github.com/Tencent/BrowserSkill/pull/443)
+- fix(cooperation): recover frame coverage during synchronization by @iuyo5678 in [#549](https://github.com/Tencent/BrowserSkill/pull/549)
+- fix(cooperation): name the top-level observation_id in strict-observation recovery by @LilMGenius in [#547](https://github.com/Tencent/BrowserSkill/pull/547)
+- docs(skill): explain closed and unconfirmable tab borrows by @anhtahaylove in [#526](https://github.com/Tencent/BrowserSkill/pull/526)
+- fix: verify window resize and refresh observations by @NianJiuZst in [#559](https://github.com/Tencent/BrowserSkill/pull/559)
+- fix(extension): invalidate cooperation only on root-frame navigation by @gadzan in [#561](https://github.com/Tencent/BrowserSkill/pull/561)
+- fix: keep Runtime off until console capture is requested by @yaou-li in [#558](https://github.com/Tencent/BrowserSkill/pull/558)
+- fix(dsh-plugin): attach fill/select values to --value by @columbia11 in [#570](https://github.com/Tencent/BrowserSkill/pull/570)
+- fix(extension): redact exact vendor credential headers in debug evidence by @columbia11 in [#571](https://github.com/Tencent/BrowserSkill/pull/571)
+- feat(tabs): anchor borrowed tab return position and support auto-borrow (#331) by @NianJiuZst in [#582](https://github.com/Tencent/BrowserSkill/pull/582)
+- fix(daemon): retry Windows authorization snapshot replacement by @columbia11 in [#583](https://github.com/Tencent/BrowserSkill/pull/583)
+- Add Chinese changelog and enforce bilingual updates by @NianJiuZst in [#585](https://github.com/Tencent/BrowserSkill/pull/585)
+- feat: display session controller identity in browser overlays by @wzxsdf in [#584](https://github.com/Tencent/BrowserSkill/pull/584)
+- fix(extension): keep code and card values out of agent-visible state by @columbia11 in [#579](https://github.com/Tencent/BrowserSkill/pull/579)
+- fix(cooperation): preserve main-page control across iframe refreshes by @NianJiuZst in [#599](https://github.com/Tencent/BrowserSkill/pull/599)
+- fix(cli): prefer domestic update downloads with GitHub fallback by @NianJiuZst in [#601](https://github.com/Tencent/BrowserSkill/pull/601)
+- fix(extension): yield shared control on meaningful user input by @NianJiuZst in [#600](https://github.com/Tencent/BrowserSkill/pull/600)
+- fix(extension): never send lone surrogates to the daemon by @columbia11 in [#569](https://github.com/Tencent/BrowserSkill/pull/569)
+- fix(extension): listen for wheel only while cooperation is collecting by @columbia11 in [#568](https://github.com/Tencent/BrowserSkill/pull/568)
+- fix(extension): match sensitive autocomplete values token by token by @TheeCoderAhmed in [#566](https://github.com/Tencent/BrowserSkill/pull/566)
+- feat: expose BrowserSkill through an MCP server by @NianJiuZst in [#590](https://github.com/Tencent/BrowserSkill/pull/590)
+- fix(cli): handle cancellation before RPC registration by @iuyo5678 in [#419](https://github.com/Tencent/BrowserSkill/pull/419)
+- fix(waits): recheck selectors when matched nodes are replaced by @u7-u7 in [#553](https://github.com/Tencent/BrowserSkill/pull/553)
+- fix: unblock shared-control input and preserve action outcomes by @NianJiuZst in [#608](https://github.com/Tencent/BrowserSkill/pull/608)
+
+- chore(release): prepare 0.4.2 by @NianJiuZst in [#609](https://github.com/Tencent/BrowserSkill/pull/609)
+
+**Full Changelog**: [cli-v0.4.1...cli-v0.4.2](https://github.com/Tencent/BrowserSkill/compare/cli-v0.4.1...cli-v0.4.2)
+