oab-instance-mcp 0.6.7

Highlights

Lent grants now survive a daemon restart, on both platforms. A deploy, crash or
launchctl kickstart / systemctl --user restart used to drop every grant and the human had to
lend the machine again. Live grants are now persisted and re-dialled at start under their original
id; a runtime that forgot the grant ends it normally (handshake_rejected_401).

Artifacts

Platform	Asset
macOS (universal, signed + notarized)	oab-instance-mcp-0.6.7-universal.pkg, .app.zip
Linux arm64	oab-instance-mcp-0.6.7-linux-arm64.tar.gz
Linux amd64	oab-instance-mcp-0.6.7-linux-amd64.tar.gz

What's changed since 0.6.6

• macOS grant persistence (#43): record in ~/Library/Application Support/oab-instance-mcp/grants.json
  (mode 600), attach secret in the login Keychain (service dev.openab.instance-mcp.grant).
  --no-grant-persistence keeps grants in memory.
• Linux grant persistence (#42): ~/.local/state/oab-instance-mcp/grants.json (mode 600;
  MCP_GRANTS_FILE to move it, off to disable).
• Shared conformance vectors in CI (#41): the same conformance/*.json now run against the Swift
  daemon (oracle) and the Linux port on every PR. They caught drift in the Linux AuthPolicy, now
  fixed: the Bearer scheme is case-insensitive, deny reasons match Swift, and a request relayed with
  X-Forwarded-For is never treated as local under MCP_INSECURE_LOCAL (a small tightening).
• Linux mouse/key no longer report success when the seat has no input device (#39).
• Docs: README reorganised with Quick start + Platforms (#38); ADR records the wlroots-only and
  headless-seat decisions (#40).

Full Changelog: v0.6.6...v0.6.7