DarwinRelay 0.6.9

Distribution

DarwinRelay is currently source-first / self-built. This release intentionally does not include a prebuilt .app or .dmg asset. New users should clone the canonical repository and follow the README Quick Start / self-build path; the zero binary-asset count is part of the current product model, not a missing release artifact.

Existing installs on v0.6.9 can use the confirmed Update DarwinRelay… menu action for future release-to-release updates, or run ./scripts/update.sh from an independent local shell. The updater remains manual; DarwinRelay does not silently auto-update.

---

DarwinRelay 0.6.9 adds a verified manual update flow to the menu-bar app and hardens the underlying release transaction after real-Mac lifecycle testing.

Highlights:

• adds Update DarwinRelay… to the menu bar with explicit confirmation;
• launches the canonical scripts/update.sh latest --yes in an independent Terminal window, so update logic is not duplicated in Swift and survives the app restart;
• allows only one update transaction at a time via lockf; closing the Terminal during a transaction triggers rollback rather than leaving a partial update;
• validates already-ready Accessibility, Screen Recording, and Input/Post Events through the authenticated live MCP runtime before and after app replacement, and rolls back if they do not recover;
• makes LaunchAgent shutdown/restart ownership fail-closed, including asynchronous bootout handling and rejection of competing DarwinRelay launchd owners;
• scopes tunnel ownership to DarwinRelay's recorded cloudflared PID, leaving unrelated tunnels on the Mac untouched;
• adds a maintainer-only exact-candidate updater harness so release candidates can be exercised on a real Mac before a public tag exists.

Validation for the exact release tree:

• final candidate tree: 3d2d154b1c9a127379085b79b890f8416ef7c552;
• merge/release commit: 93d61eb97a56d9c223ef33da0581acb4695874c7;
• full local core, desktop, and lifecycle suite green;
• integrity manifest: 117/117 tracked regular files;
• real-Mac injected rollback gate passed;
• real-Mac full v0.6.6 → candidate 0.6.9 → validation → v0.6.6 round-trip passed;
• signed 0.6.9 app build passed codesign --verify --deep --strict with stable designated requirements;
• PR CI, post-merge CI, JavaScript CodeQL, and Swift CodeQL all green;
• zero open GitHub code-scanning alerts at release time.

Existing installs older than 0.6.9 do not yet have the menu-bar update action. After the one-time upgrade to 0.6.9, future manual release updates can be started directly from the DarwinRelay menu bar.

DarwinRelay 0.6.8

DarwinRelay 0.6.8 fixes the manual update transaction failure found during real v0.6.6 → v0.6.7 validation.

Highlights:

• deploy process discovery snapshots ps before matching, preventing self-matches on matcher argv;
• the updater invokes app deployment in explicit stopped-runtime mode instead of enforcing zero-downtime PID stability after fail-closed shutdown;
• rollback restores/rebuilds the old app based on actual bundle versions rather than a post-success flag;
• LaunchAgent ownership and doctor readiness remain mandatory update success conditions.

Validation:

• #22 and #24 merged;
• PR and post-merge CI/JavaScript CodeQL are green;
• full local npm test for 0.6.8 completed with exit code 0;
• integrity verified 113/113 tracked files;
• zero open GitHub code-scanning alerts at release time.

DarwinRelay 0.6.7

DarwinRelay 0.6.7 completes the manual updater lifecycle ownership fix discovered during real release-to-release validation.

Highlights:

• after target app installation, the updater re-establishes a contained baseline with the integrity-verified target kill switch;
• standalone DarwinRelay menu instances are reclaimed before the final LaunchAgent bootstrap;
• update success now requires the HTTP LaunchAgent itself to report state = running with a live DarwinRelay PID;
• rollback uses the same bounded menu-process reclamation;
• the final update result reports the LaunchAgent-owned PID.

Validation:

• updater ownership PR #20 and release PR #21 merged cleanly;
• PR and post-merge CI/JavaScript CodeQL are green;
• full local npm test for the exact 0.6.7 candidate completed with exit code 0;
• integrity verified 113/113 tracked files;
• zero open GitHub code-scanning alerts at release time.

DarwinRelay 0.6.6

DarwinRelay 0.6.6 fixes the manual update path after production validation exposed an ownership bug in the kill switch.

Highlights:

• scripts/disable.sh now treats only the cloudflared PID recorded by DarwinRelay as DarwinRelay-owned tunnel authority; unrelated Cloudflare tunnels on the same Mac no longer make a clean stop/update impossible and are never signalled;
• zero-downtime deploy verification uses the same recorded ownership boundary instead of whichever cloudflared command appears first;
• the manual updater now extracts the target release's scripts/disable.sh before changing HEAD, verifies it against the target release's SHA256SUMS, and uses that verified kill switch for fail-closed quiescence. A newer release can therefore repair containment logic that is broken in an older installed release;
• lifecycle coverage now exercises unrelated, owned, and stale tunnel pidfile cases with all control-plane paths isolated from production state.

Validation:

• the original v0.6.4 → v0.6.5 production update failure rolled back checkout/app correctly;
• PR #18 and release PR #19 are green;
• post-merge CI and JavaScript CodeQL are green;
• full local npm test for the v0.6.6 candidate exited 0;
• integrity verified for 113/113 tracked regular files;
• build-only DarwinRelay.app smoke produced bundle version 0.6.6 and passed deep strict codesign verification;
• gitleaks reported no leaks;
• zero open GitHub code-scanning alerts at release time.

DarwinRelay 0.6.5

DarwinRelay 0.6.5 adds the supported manual release-to-release updater for source-first installations.

Highlights:

• scripts/update.sh updates the Git checkout and installed menu app as one transaction instead of updating only the .app;
• updates only from a clean exact stable release tag on the canonical dcierra/darwinrelay origin;
• refuses dirty/development checkouts, split app/runtime versions, moved tags, signing-identity changes, destructive Git cleanup, and downgrades;
• stops DarwinRelay fail-closed before replacing source files, installs through the existing atomic rollback-aware app path, regenerates autostart, restarts, waits for /healthz, and requires the authenticated doctor to return CORE VERDICT: READY;
• attempts to restore both the previous checkout and retained rollback app if activation fails;
• README and agent docs now define this as the canonical manual update path from v0.6.5 onward;
• doctor.sh now detects a connected but stale unpacked Chrome extension version after an update and reports it as OPTIONAL / ACTION REQUIRED.

Existing installations on v0.6.4 or older need one final manual source-first upgrade/reinstall to v0.6.5; after that, future releases can use ./scripts/update.sh.

Validation:

• PR and post-merge CI/JavaScript CodeQL are clean;
• full local npm test completed successfully;
• integrity verified for 112/112 tracked regular files;
• build-only DarwinRelay.app smoke produced bundle version 0.6.5 and passed deep strict codesign verification;
• gitleaks reported no leaks;
• zero open GitHub code-scanning alerts at release time.

DarwinRelay 0.6.4

DarwinRelay 0.6.4 is a lifecycle hotfix on top of 0.6.3.

It includes all 0.6.3 improvements—request provenance, ChatGPT-first onboarding/doctor UX, permission routing, and transient virtual-cursor moves—plus two install/update fixes found during a real source-first production upgrade:

• the HTTP LaunchAgent no longer sets its working directory to the source checkout, so launchd does not need Files & Folders/TCC access to a checkout under protected locations such as ~/Documents before the signed DarwinRelay app starts;
• scripts/deploy-menubar-update.sh no longer uses early-exit awk pipelines under pipefail, avoiding false SIGPIPE/exit-141 failures on busy process tables.

Validation:

• full npm test passed on the 0.6.4 release candidate;
• npm run check passed;
• integrity verified for 110/110 tracked regular files;
• gitleaks reported no leaks;
• PR and post-merge CI/JavaScript CodeQL are clean;
• the Swift/native changes inherited from 0.6.3 have a clean Swift CodeQL run;
• zero open GitHub code-scanning alerts at release time.

DarwinRelay 0.6.3

DarwinRelay 0.6.3 strengthens execution provenance and makes the ChatGPT-first onboarding path substantially clearer and easier to diagnose.

Highlights:

• added server-generated request/session correlation and safe audit provenance across HTTP → bridge → tool execution, including background shell jobs and PTYs, without deriving identities from OAuth/bearer secrets;
• repositioned the product/onboarding surface around turning ChatGPT and other MCP clients into local macOS agents, with the canonical ChatGPT Apps/developer-mode flow;
• reworked scripts/doctor.sh into a transport-aware readiness gate that separates the blocking Core / MCP coding path from optional native desktop, Full Disk Access, background Chrome, and Codex continuity;
• added a real authenticated local MCP initialize → bridge_status doctor smoke check plus app/runtime consistency and token-file permission validation;
• improved menu-bar permission remediation so Accessibility/Input, Screen Recording, and Full Disk Access open the relevant macOS settings paths instead of treating every missing capability as a global runtime failure;
• fixed the DarwinRelay virtual AI cursor lingering on the desktop after an agent move: normal ui_cursor action=move calls now auto-hide after 2.5 seconds by default, while explicit show remains persistent;
• expanded deterministic regression coverage for HTTP provenance, readiness diagnostics, permission routing, install/source-package consistency, and virtual-cursor lifecycle.

Release validation:

• full npm test passed on the 0.6.3 release candidate;
• npm run check and integrity verification passed (109/109 tracked regular files);
• gitleaks found no leaks;
• post-merge CI and JavaScript CodeQL are clean;
• Swift CodeQL is clean for the native/menu changes;
• zero open GitHub code-scanning alerts at release time;
• package, menu app bundle, and Chrome extension versions all resolve to 0.6.3.

DarwinRelay remains a source-first/self-hosted macOS runtime. This release does not require a paid Apple Developer membership or notarization.

DarwinRelay 0.6.2

DarwinRelay 0.6.2 improves the macOS menu-bar experience and release/runtime hygiene.

• redesigned status-oriented menu with product/version, health, transport, desktop-permission and safety summaries
• grouped connection credentials and diagnostics into submenus
• path-filtered Swift CodeQL so expensive native scans run only for Swift/SwiftPM changes, plus weekly/manual scans
• fixed menubar/build.sh --build-only so it has no installation side effect
• strengthened lifecycle/version regression coverage

All public CI checks and JavaScript CodeQL passed on the release commit; the underlying Swift menu change passed Swift CodeQL with zero open alerts.

DarwinRelay 0.6.1

DarwinRelay 0.6.1

Security-hardening patch release following the first public CodeQL cycle.

Security and transport hardening

• HTTP/OAuth request-body failures no longer serialize arbitrary internal exception text to remote callers; detailed diagnostics stay local.
• Bridge child-process failures return fixed public 500/503/504 messages instead of exposing exit details, local paths or runtime state.
• Optional OAuth client_secret comparison now uses a bounded fixed-size constant-time representation without persisting or hashing the secret.
• Cloudflare Quick Tunnel discovery now parses and validates URL components and host labels structurally instead of matching a URL substring with a regex.
• OAuth consent tests now assert the exact validated redirect destination rather than substring presence.

OSS security automation

• Added CodeQL v4 analysis for JavaScript/Node and Swift.
• Added SwiftPM metadata so all native Swift targets can be extracted deterministically by CodeQL.
• JavaScript CodeQL runs on pull requests; the heavier Swift scan runs on main, weekly schedules and manual dispatch.
• Added weekly Dependabot monitoring for GitHub Actions and npm metadata.
• main now requires the aggregate CodeQL security check in addition to the four existing CI checks.

Validation

The security-fix source passed:

• all four public CI jobs;
• the full local regression suite, including native AppKit E2E and lifecycle tests;
• JavaScript CodeQL with zero branch-level alerts;
• Swift CodeQL with zero branch-level alerts on the exact security-fix head.

DarwinRelay remains intentionally powerful and is not a sandbox. Read SECURITY.md before exposing the HTTP transport remotely.

DarwinRelay 0.6.0

DarwinRelay 0.6.0

First public release of DarwinRelay, an independently maintained native macOS execution runtime for MCP agents.

DarwinRelay combines unrestricted local shell/filesystem authority, real PTYs and background jobs, persisted Codex history, a managed background Chrome workspace, and Accessibility-based native computer use behind one MCP surface.

Highlights

Independent public product identity

• New DarwinRelay name, package, app bundle, LaunchAgent, Native Messaging and helper identifiers under io.github.dcierra.darwinrelay.
• No runtime namespace uses the upstream maintainer or an OpenAI product namespace.
• Original MIT attribution and inherited Git history are preserved; see UPSTREAM.md.
• Maintainer commits were privacy-sanitized from a personal email to the GitHub noreply identity without discarding changes, authorship, dates, messages or topology.

Native macOS computer use

• Accessibility-first observation and mutation with fingerprinted stale-safe AX refs.
• Targeted AX query and coordinate-to-semantic hit testing.
• ScreenCaptureKit screenshots, Vision OCR and visual waits.
• Windows, dialogs, standard open/save panels and drag/drop.
• Background PID-targeted input with verification and bounded foreground compatibility fallback.
• Deterministic ui_sequence execution and independent virtual AI cursor.
• Stable menu/helper/cursor signing identifiers for TCC continuity when a persistent Apple signing identity is available.

Isolated background Chrome by default

• The browser installer now creates or reuses a dedicated signed-out Chrome profile named DarwinRelay by default.
• First-time creation refuses to race Chrome's Local State: quit Chrome once, run the installer, then optionally use --open to reopen the correct profile.
• Existing signed-in profiles require explicit --profile or --use-current-profile opt-in.
• Uninstall never deletes the dedicated profile or its browsing data.
• Stable public extension identity: pfhahlehpahegefejooendokpkklgmgd.
• Managed DR tab pool keeps routine web automation in background reusable tabs.

Human + agent documentation

• Human-facing README.md focuses on product value, installation, security and common workflows.
• Root AGENTS.md gives coding agents the repository map, invariants, commands, CI expectations, signing/browser rules and release constraints.
• docs/AGENT_OPERATIONS.md documents the complete runtime tool families and recommended operating order.
• docs/ARCHITECTURE.md documents component/data flow and trust boundaries.
• docs/DEVELOPMENT_MODEL.md defines the public canonical source model and maps the legacy private lineage to the sanitized public history.

Public OSS engineering

Public CI exposes four explicit checks rather than one opaque test job:

• Static checks — syntax/native builds, integrity manifest and full-history gitleaks scan.
• Core & protocol tests — MCP, HTTP/OAuth, PTY, federation, browser and adversarial coverage.
• Desktop control tests — deterministic desktop protocol tests plus native fixture build/runtime boundary behavior.
• Install & lifecycle tests — browser-profile installer, autostart, atomic deployment, singleton ownership and installer mock.

The release source tree passed all four GitHub-hosted macOS checks. SHA256SUMS verifies all 95 tracked regular source files.

Security posture

DarwinRelay is intentionally not a sandbox. A connected client can act with the effective authority of the macOS account running it, subject to normal macOS controls such as TCC, ACLs and sudo authentication. Read SECURITY.md before exposing the HTTP transport remotely.

The public repository has GitHub secret scanning, push protection, private vulnerability reporting and protected main status checks enabled.

Existing 0.5.x users / private lineage

The legacy private 0.5.x installation is not a drop-in in-place upgrade to DarwinRelay 0.6.0. Rebranding changed bundle ids, environment prefixes, state paths, Chrome extension/native-host identity and LaunchAgent labels. Treat production migration as a separate cutover with rollback and new permission/browser verification. See docs/DEVELOPMENT_MODEL.md.

Installation artifact note

No prebuilt .app is attached. The current menu bundle intentionally embeds the local package path and should be built on the target Mac so its runtime path and signing/TCC identity are correct.