agent-browser 0.41.1 fixes commands that could claim success while leaving requested cookie security attributes unapplied. The November 1 stable release makes the affected options work and rejects unknown inputs for a single cookie. A separate permission change limits the installed agent skill to its installed command rather than an unpinned package invoked through npx.
agent-browser, Vercel Labs’ tool for browser agents, corrected cookie-setting behavior in stable version 0.41.1 on November 1. The project’s change description identifies a mismatch between the command’s success message and the cookie actually stored. Options using hyphenated names could be ignored silently. As a result, a requested HttpOnly or SameSite attribute could be missing even though the operation appeared to have worked.[1]
The fix makes the affected options take effect and keeps previously accepted aliases available. When the command writes one cookie, it also rejects unknown input options. The cookie change reached the development branch on October 30. It was absent from the preceding stable version’s notes and appears in the 0.41.1 stable release, distinguishing the earlier code change from the packaged update.[1]
The same stable update narrows the installed agent skill’s execution permission. It removes permission to run an unpinned package with npx while leaving the installed agent-browser command allowed. That permission adjustment entered development on October 29. The release thus includes both cookie-option handling and a restriction on which command the installed skill may execute.[1]
