[showcase] Mac MCP 2.1.4 – local macOS control with public endpoint modes, SSRF/symlink hardening, transaction undo, doctor + conformance lab

I'm the maintainer of Mac MCP, MIT-licensed open-source local macOS control server for AI agents (Safari/Chrome background tabs, files, shell, macOS UI, delegated Codex/OpenCode agents, memory, skills, menu-bar app). Repo: https://github.com/bulutarkan/mac-mcp

2.1.4 is the update since my first r/mcp post, mostly shaped by Reddit security feedback:

• Public endpoints are now a real mode, not just ngrok on/off: Local only / managed ngrok / managed Cloudflare Tunnel / Custom HTTPS. Cloudflare token is asked once via hidden stdin, stored owner-only 0600, launched with –token-file, supervised by launchd KeepAlive. No VPS or inbound port.
• Outbound HTTP + browser navigation hardened against SSRF/DNS rebinding: every redirect hop revalidated, non-global DNS rejected, private dev access only via explicit allowlists.
• Scoped file ops hardened against symlink/TOCTOU with dir_fd + O_NOFOLLOW traversal; scoped search no longer follows symlink dirs.
• File writes/edits/moves/deletes are now journaled with atomic batches and conflict-aware undo (file_transaction_undo).
• Delegated workflows got durable checkpoints + fail-closed resume (no replay of verified side effects), steering idempotency bound to daemon generation.
• Added mac-mcp doctor (redacted support bundle) and a deterministic Computer Use conformance lab.
• ChatGPT path got turn budgeting + web-throttle recovery; role-scoped lessons for coder/reviewer/orchestrator.

Question I'd value feedback on: for local execution, do you trust capability confinement (workspace-scoped, server-enforced) + irreversibility-gated approvals more than per-action popups? That's the model I shipped and I'm still tuning it.