oab-instance-mcp 0.8.0

What's Changed

• fix(profile): classify every tool; boundary tests fail on unclassified ones by @chaodu-agent in #48
• docs(profiles): tool classification + observe/prompt-injection note by @chaodu-agent in #49
• docs: 'no egress' → no tailnet egress; internet egress is open by default by @chaodu-agent in #50
• ci: require a #openab-pty Discord discussion link on community PRs by @chaodu-agent in #51
• feat: switchboard mode (dial openab-sb /vm/attach) by @chaodu-agent in #53
• chore: bump to 0.8.0 (switchboard mode) by @chaodu-agent in #54

Full Changelog: v0.7.0...v0.8.0

oab-instance-mcp 0.7.0

What's Changed

• fix(profile): desktop (was sandbox) is shell-equivalent; add observe; document profiles by @chaodu-agent in #46
• chore: bump to 0.7.0 by @chaodu-agent in #47

Full Changelog: v0.6.7...v0.7.0

oab-instance-mcp 0.6.7

Highlights

Lent grants now survive a daemon restart, on both platforms. A deploy, crash or
launchctl kickstart / systemctl --user restart used to drop every grant and the human had to
lend the machine again. Live grants are now persisted and re-dialled at start under their original
id; a runtime that forgot the grant ends it normally (handshake_rejected_401).

Artifacts

Platform	Asset
macOS (universal, signed + notarized)	oab-instance-mcp-0.6.7-universal.pkg, .app.zip
Linux arm64	oab-instance-mcp-0.6.7-linux-arm64.tar.gz
Linux amd64	oab-instance-mcp-0.6.7-linux-amd64.tar.gz

What's changed since 0.6.6

• macOS grant persistence (#43): record in ~/Library/Application Support/oab-instance-mcp/grants.json
  (mode 600), attach secret in the login Keychain (service dev.openab.instance-mcp.grant).
  --no-grant-persistence keeps grants in memory.
• Linux grant persistence (#42): ~/.local/state/oab-instance-mcp/grants.json (mode 600;
  MCP_GRANTS_FILE to move it, off to disable).
• Shared conformance vectors in CI (#41): the same conformance/*.json now run against the Swift
  daemon (oracle) and the Linux port on every PR. They caught drift in the Linux AuthPolicy, now
  fixed: the Bearer scheme is case-insensitive, deny reasons match Swift, and a request relayed with
  X-Forwarded-For is never treated as local under MCP_INSECURE_LOCAL (a small tightening).
• Linux mouse/key no longer report success when the seat has no input device (#39).
• Docs: README reorganised with Quick start + Platforms (#38); ADR records the wlroots-only and
  headless-seat decisions (#40).

Full Changelog: v0.6.6...v0.6.7

oab-instance-mcp 0.6.6

Highlights

Linux hands node now runs on a headless server with no desktop (verified on an Intel N95
mini PC, Ubuntu 24.04 Server), not just a Raspberry Pi with a screen. Same three-artifact release
as 0.6.5; macOS behaviour unchanged.

Artifacts

Platform	Asset
macOS (universal, signed + notarized)	oab-instance-mcp-0.6.6-universal.pkg, .app.zip
Linux arm64 (Raspberry Pi, aarch64)	oab-instance-mcp-0.6.6-linux-arm64.tar.gz
Linux amd64 (x86-64)	oab-instance-mcp-0.6.6-linux-amd64.tar.gz

Each has a .sha256. Linux install:
docs/linux-setup.md.

What's changed since 0.6.5

• Headless-server support (#34): install-linux.sh --headless-seat runs sway with the
  headless wlroots backend as a user unit (one 1920×1080 virtual output) for boxes with no
  desktop. Installer now detects the seat's Wayland socket, falls back to Playwright's Chromium
  where the distro has none (Ubuntu), writes the AppArmor userns profile Ubuntu 24.04 needs so
  Chromium's sandbox stays on, forces Wayland + en-US locale, installs fonts, and sets
  KillMode=process. Verified end to end: lent to an openab-pty session, 37 tools, browser
  navigate/snapshot.
• Module split behind a Desktop trait (#33): the Linux PoC is now auth / http / mcp /
  attach / tools/* / platform/{desktop,linux/wlroots}, so a second backend (portal, macOS)
  is a drop-in.
• Reverse-attach grants match the Connect MacGrant contract (#28): 202 + standard
  fields, GET/DELETE /attach/{id}, one grant per runtime+session with replacement.
• Release pipeline (#35, #36): the Linux tarball jobs now share the release environment
  approval with the macOS job (they no longer time out), and retry dispatch is documented to run
  on the tag ref.

Full Changelog: v0.6.5...v0.6.6

oab-instance-mcp 0.6.5

Highlights

First release with Linux hands-node artifacts. oab-instance-mcp now ships a Rust build for
Linux alongside the macOS installer, so a cheap Linux box (Raspberry Pi, Intel mini PC) can be a
lendable "hands" node for openab-pty and OpenAB Connect.

Artifacts

Platform	Asset
macOS (universal, signed + notarized)	oab-instance-mcp-0.6.5-universal.pkg, .app.zip
Linux arm64 (Raspberry Pi, aarch64)	oab-instance-mcp-0.6.5-linux-arm64.tar.gz
Linux amd64 (x86-64)	oab-instance-mcp-0.6.5-linux-amd64.tar.gz

Each has a .sha256; macOS assets are also in SHA256SUMS. Linux install:
docs/linux-setup.md.

What's new (Linux, PoC)

• Rust hands node (poc/reverse-attach-linux/): reverse attach (POST /attach, mint or
  pre-minted secret, WS dial with the §9.2 disposition table), MCP over /mcp behind the Swift
  daemon's AuthPolicy (bearer AND Tailscale login), and tools sys_info, screenshot (grim →
  MCP image), bash, mouse (wlrctl), key (wtype). Re-serves an upstream @playwright/mcp
  as browser_*, filtered by profile. (#29)
• Setup guide + installer: docs/linux-setup.md, scripts/install-linux.sh, and CI that
  builds/smoke-tests on native amd64/arm64 and ships the tarballs. (#30)
• ADR: Linux input via wlrctl (wlroots), not ydotool. (#26)

Verified on a Raspberry Pi (labwc) end to end: lent to an openab-pty session, driven from
OpenAB Connect's Screens pane, browser navigate/snapshot.

macOS behaviour is unchanged from 0.6.4.

Full Changelog: v0.6.4...v0.6.5

oab-instance-mcp 0.6.4

What's Changed

• docs(adr): Linux-first Rust port — one core, per-OS backends by @chaodu-agent in #18
• fix(attach): forward requested lease TTL to runtime (0.6.4) by @chaodu-agent in #25

Full Changelog: v0.6.3...v0.6.4

oab-instance-mcp 0.6.3

What's Changed

• feat: first-run permission setup wizard (0.6.3) by @chaodu-agent in #21

Full Changelog: v0.6.2...v0.6.3

oab-instance-mcp 0.6.2

What's Changed

• fix(pkg): repair v0.6.0 ownership residue; release 0.6.2 by @chaodu-agent in #20

Full Changelog: v0.6.1...v0.6.2

oab-instance-mcp 0.6.1 (use 0.6.2 after a v0.6.0 attempt)

Warning

If this Mac previously attempted the broken v0.6.0 installer, use v0.6.2 or later: v0.6.0 could leave a root-owned app that v0.6.1 cannot replace. Fresh v0.6.1 installs are signed/notarized and work, but v0.6.2 includes automatic recovery.

What's Changed

• fix(pkg): disable app payload relocation by @chaodu-agent in #19

Full Changelog: v0.6.0...v0.6.1

oab-instance-mcp 0.6.0 (broken installer — use 0.6.1)

Warning

Do not install this package. The v0.6.0 pkg allowed PackageKit bundle relocation; on a Mac with an existing installation, postinstall could not find its payload and failed. Use v0.6.1 or later. Signing and notarization were valid; only installation was broken.

What's Changed

• docs: add ADR for sandbox adapter (#1) by @chaodu-obk[bot] in #2
• ci: add CI workflow — lint, swift build/test, toolchain smoke tests (#1) by @chaodu-obk[bot] in #4
• feat: add oab-toolchain sandbox image (#1) by @chaodu-obk[bot] in #3
• docs: reverse attach — macmini dials the sandbox, sandbox has no egress (Phase 4) by @chaodu-agent in #5
• docs: 4a spike results + node-not-a-tailnet-member assumption by @chaodu-agent in #6
• feat: reverse attach — dial into an openab-pty session, lend tools by profile (4b) by @chaodu-agent in #7
• fix: ATS allows plaintext tailnet URLs from the bundle; mint transport errors → 502 by @chaodu-agent in #8
• docs: 4b verified over the real tailnet; link the ATS fix by @chaodu-agent in #9
• feat: re-serve Playwright MCP as browser_* tools under the tool profile (#10) by @chaodu-agent in #11
• fix(deploy): refuse to install an ad-hoc bundle — it silently drops TCC grants by @chaodu-agent in #13

New Contributors

• @chaodu-obk[bot] made their first contribution in #2
• @chaodu-agent made their first contribution in #5

Full Changelog: https://github.com/openabdev/instance-mcp/commits/v0.6.0