Skip to content

WebKitUI MCP 0.6.5 Developer Preview

Choose a tag to compare

View all tags
@lowrisk75 lowrisk75 released this 06 Sep 13:14
· 2 commits to main since this release
v0.6.5
a707f5e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

If you built from source and nothing worked, this is why.

Before showing a confirmation, the server checks the helper sitting beside it. That check demanded a Developer ID team identifier and the exact identifier the release signing script stamps. A swift build product has neither — it is ad-hoc signed, carries no team, and is identified by its own file name — so the pair the README told you to install was refused. Every navigation failed closed with "the confirmation helper did not present a prompt", and the only installations that worked were signed with the release certificate.

What the check may demand now follows what the server itself is:

Server What the helper must satisfy
Notarized same Developer ID team and the release identifier
Built from source (ad-hoc) sits beside it under its own executable name
Mismatched either way refused

The relaxation concedes nothing: whoever can write a helper beside an unsigned server can replace that server too, so there the check could only ever assert co-location. The direction that matters stays closed — an unsigned helper can never be smuggled in beside a notarized server, and a notarized server never runs a helper that is not its own.

If you re-sign one binary, re-sign the other with the same identity, or the confirmation will not appear.

Verified end to end on a pure README install: two ad-hoc binaries, no certificate, session opened, confirmation shown, approved, navigation completed.

Everything from the 0.6.x line

  • The confirmation panel draws (0.6.2 shipped one that aborted on launch).
  • Tab moves between the confirmation buttons, Cancel first.
  • "Release host lease" actually releases a lease held by another process.
  • THIRD_PARTY_NOTICES.md no longer claims the project is MIT licensed. It is not, and never was — LICENSE is authoritative.
  • The pre-notarization verifier starts the confirmation helper and fails the build if it exits instead of presenting.

Verification

  • 187 tests pass.
  • Developer ID signed (Team TDV6D5L785), hardened runtime, notarized and stapled.
shasum -a 256 -c SHA256SUMS
spctl -a -vv -t exec "WebKitUI MCP.app"

Licensed under the Business Source License 1.1; Change Date 2030-08-28, then Apache 2.0.

Assets 4
Loading