This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Affected surfaces
Summary
AI summaryUpdates What's fixed, Verification, and Compatibility across a mixed release.
Full changelog
Highlights
Adds Hermes to the trusted MCP visual-session client allowlist. Prior to this release, every action-tool call from a Hermes-labeled MCP client was rejected with Visual session contract / Client label "Hermes" is not on the trusted v0.9.36 badge allowlist. Closes #47.
Also bumps the project version 0.9.64 → 0.9.65 across the Chrome extension, root package, showcase Angular app, README badges, and Chrome Web Store listing copy.
What's fixed
mcp/src/tools/visual-session.ts— Added'Hermes'toMCP_VISUAL_CLIENT_LABELS.extension/utils/mcp-visual-session.js— Added'Hermes'to the extension-side mirror so the dispatcher's allowlist check matches the MCP side. The shared allowlist now contains 13 canonical client labels: Claude, Codex, ChatGPT, Perplexity, Windsurf, Cursor, Antigravity, OpenCode, OpenClaw, OpenClaw 🦀, Grok, Gemini, Hermes.
Version bump
Bumped 0.9.64 → 0.9.65 in:
package.json(version, zip script, badge URL)extension/manifest.json(name + version)README.md(title, badge, status banner)extension/README.mdstore-assets/chrome-web-store/listing-copy.mdmcp/README.md(cross-reference parenthetical)showcase/angular/package.json+package-lock.jsonshowcase/angular/src/app/core/seo/version.ts+public/llms-full.txt+public/sitemap.xml(regenerated byscripts/build-crawler-files.mjs)
The MCP package version ([email protected]) is independent and unchanged. Frozen contract anchors (v0.9.36, v0.9.60, v0.9.61, v0.9.62) referenced in source comments and tests are historical phase markers, also unchanged.
Compatibility
- No protocol or schema changes. Existing agents and MCP clients continue to work unmodified.
- To pick up the Hermes allowlist fix, reload the FSB Chrome extension. No MCP server redeploy is required (the MCP server's allowlist was already updated server-side as part of this release).
Verification
mcp-visual-session-contract: 116/116 passvisual-session-schema-lock: 314/314 passmcp-version-parity: 10/10 passskill-fsb-spec: 48/48 pass- CI on both release PRs (#48, #49): extension ✅, mcp ✅, showcase ✅
Download
The packaged Chrome extension (fsb-extension-v0.9.65.zip) is attached below. To install:
- Download and unzip.
- Open
chrome://extensions, enable Developer mode. - Click Load unpacked and select the unzipped directory.
Or get it from the Chrome Web Store once the store review completes.
Pull Requests
- #49 — fix(visual-session): add Hermes to MCP client allowlist
- #48 — chore(release): bump version 0.9.64 -> 0.9.65
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About LakshmanTurlapati/FSB
All releases →Related context
Beta — feedback welcome: [email protected]