machine-bridge-mcp 0.16.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.16.1 - 2026-07-13
+
+### Fixed
+
+- Fix `machine-mcp` startup after 0.16.0 by keeping normalized policy capabilities immutable while allowing the sealed CLI-owned state record to update persistence metadata.
+- Add regression coverage proving `updatedAt` remains writable without permitting capability fields or undeclared fields to be mutated.
+
 ## 0.16.0 - 2026-07-13
 
 ### Runtime boundaries and lifecycle

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "0.16.0"
+  "version_name": "0.16.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/app-automation.mjs

@@ -215,8 +215,6 @@ async function listWindowsApplications(configuredRoots, home, context, throwIfCa
   const roots = configuredRoots || [
     join(process.env.APPDATA || home, "Microsoft", "Windows", "Start Menu", "Programs"),
     process.env.ProgramData ? join(process.env.ProgramData, "Microsoft", "Windows", "Start Menu", "Programs") : "",
-    process.env.ProgramFiles,
-    process.env["ProgramFiles(x86)"],
   ].filter(Boolean);
   return listExecutableRoots(roots, new Set([".exe", ".lnk"]), context, throwIfCancelled);
 }

package/src/local/cli-policy.mjs

@@ -15,14 +15,26 @@ export function resolvePolicy(args = {}, stored = {}) {
   const explicitKeys = ["profile", ...POLICY_OVERRIDE_KEYS];
   const hasExplicit = explicitKeys.some((key) => Object.prototype.hasOwnProperty.call(args, key));
   const base = { ...selectPolicyBase(args, stored, hasStored) };
-  if (!hasExplicit) return normalizePolicy(base);
+  if (!hasExplicit) return policyState(base);
   applyPolicyOverrides(base, args);
   if (args.profile === undefined || POLICY_OVERRIDE_KEYS.some((key) => Object.prototype.hasOwnProperty.call(args, key))) {
     base.profile = "custom";
     base.origin = "custom";
     base.revision = DEFAULT_POLICY_REVISION;
   }
-  return normalizePolicy(base);
+  return policyState(base);
+}
+
+function policyState(policy) {
+  // Capability fields retain the canonical immutable contract. The CLI owns a
+  // sealed persistence record with exactly one writable metadata field.
+  const normalized = normalizePolicy(policy);
+  const state = {};
+  for (const [key, value] of Object.entries(normalized)) {
+    Object.defineProperty(state, key, { value, enumerable: true, writable: false, configurable: false });
+  }
+  Object.defineProperty(state, "updatedAt", { value: undefined, enumerable: true, writable: true, configurable: false });
+  return Object.seal(state);
 }
 
 function selectPolicyBase(args, stored, hasStored) {

package/src/worker/index.ts

@@ -17,7 +17,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "0.16.0";
+const SERVER_VERSION = "0.16.1";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";