granttap-mcp 0.7.6 → 0.8.1

package/LICENSE

@@ -1,21 +1,86 @@
-MIT License
-
-Copyright (c) 2026 Serhii Ziborov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+GrantTap Commercial Source License 1.0
+
+Copyright (c) 2026 Serhii Ziborov. All rights reserved.
+
+This license governs the source code and software distributed from the
+granttap-mcp repository and package (the "Software"), except for third-party
+components that identify their own license terms.
+
+1. Definitions
+
+"GrantTap" means Serhii Ziborov doing business as GrantTap.
+
+"Authorized Access" means an active paid GrantTap subscription, an official
+GrantTap trial, or a separate written commercial agreement with GrantTap.
+
+"Authorized User" means a person or legal entity covered by Authorized Access.
+
+2. Source inspection and contribution
+
+You may download, inspect, and make local modifications to the source solely to
+evaluate the Software, perform security review, or prepare a contribution to
+the official GrantTap repository. You may create a public fork solely for that
+contribution workflow if the fork retains this license and does not publish a
+release, binary, hosted service, or independently usable distribution.
+
+These rights do not permit production use, commercial use, or use to provide a
+service to another person.
+
+3. Authorized product use
+
+During Authorized Access, GrantTap grants the Authorized User a limited,
+non-exclusive, non-transferable, non-sublicensable license to install, execute,
+and internally modify the Software on devices the Authorized User owns or
+controls, solely to use the official GrantTap product and services.
+
+When Authorized Access ends, the Authorized User must stop using the Software
+except where a separate written agreement says otherwise.
+
+4. Restrictions
+
+Unless GrantTap gives prior written permission, you may not:
+
+- sell, sublicense, redistribute, or publish the Software or a derivative work;
+- offer the Software or a derivative work as a hosted or managed service;
+- use the Software to build or operate a competing product or service;
+- use the Software as a standalone general-purpose coding-agent runtime outside
+  the official GrantTap product;
+- bypass subscription, license, access-control, or entitlement checks;
+- remove or alter copyright, license, attribution, or proprietary notices; or
+- use GrantTap names or marks to imply endorsement of a modified distribution.
+
+5. Ownership
+
+The Software is licensed, not sold. GrantTap retains all right, title, and
+interest in the Software and its derivative works. No trademark, patent, or
+other rights are granted except the limited copyright rights stated here.
+
+6. Third-party components
+
+Third-party components remain governed by their respective licenses. Those
+licenses and notices are not replaced by this license. See
+THIRD_PARTY_NOTICES.md where distributed.
+
+7. Termination
+
+This license terminates automatically if you breach its terms. On termination,
+you must stop using and distributing the Software and delete copies that you
+are not legally required to retain. Sections 4 through 9 survive termination.
+
+8. Disclaimer of warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.
+
+9. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, GRANTTAP AND ITS CONTRIBUTORS WILL NOT
+BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
+PUNITIVE DAMAGES, OR FOR LOSS OF DATA, PROFITS, REVENUE, OR BUSINESS, ARISING
+FROM OR RELATED TO THE SOFTWARE OR THIS LICENSE.
+
+10. Commercial terms
+
+Authorized Access, pricing, and separate commercial licenses are available
+through https://granttap.com.

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm](https://img.shields.io/npm/v/granttap-mcp)](https://www.npmjs.com/package/granttap-mcp)
 [![CI](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml)
-[![MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![License](https://img.shields.io/badge/license-GrantTap%20Commercial-7c3aed.svg)](LICENSE)
 
 GrantTap is a Personal live control center for local coding agents.
 
@@ -13,6 +13,10 @@ hooks, local adapters, and TypeScript wire schemas. Agents and provider
 credentials stay on your computer. Native iPhone and Apple Watch traffic is
 end-to-end encrypted.
 
+The source is public for inspection and contribution, but GrantTap MCP is
+proprietary paid software rather than open source. Production use requires an
+active GrantTap subscription or a separate commercial agreement.
+
 [Website](https://granttap.com) · [npm](https://www.npmjs.com/package/granttap-mcp) ·
 [Security model](SECURITY.md) ·
 [Relay source](https://github.com/sergii-ziborov/granttap-relay)
@@ -97,6 +101,9 @@ history stays on the device.
 
 ## Install
 
+Installation and production use require Authorized Access under the
+[GrantTap Commercial Source License](LICENSE).
+
 ```bash
 npm install -g granttap-mcp
 granttap setup
@@ -107,10 +114,17 @@ hooks, installs the background helper, configures Cursor's persistent local
 OAuth service when Cursor is present, and starts phone pairing when run in an
 interactive terminal. It ends with one exact next action.
 
+Setup also declares the separately distributed GrantTap Engine, which Project
+Governance needs before it can report anything. The standard locations are
+searched, and `--engine <path>` points at one that lives elsewhere; the binary
+is checksummed here, because that checksum is the only thing verified before it
+is launched. Without an engine the rollout stays off and setup says so, rather
+than leaving "Governance not reported" on the phone as the only symptom.
+
 The normal CLI surface is intentionally small:
 
 ```text
-granttap setup
+granttap setup [--engine <path>]
 granttap status [--json]
 granttap connect [--relay <wss-url>]
 granttap reset [--yes]
@@ -162,11 +176,19 @@ The bounded encrypted protocol preserves:
 - visible activity, delivery state, context and token counters;
 - MCP, Skill, and CLI observations;
 - child-agent relationships;
-- per-capability outcome: `success`, `error`, `cancelled`, or `unknown`.
+- per-capability outcome: `success`, `error`, `cancelled`, or `unknown`;
+- what a call cost, where the machine can be observed while it ran.
 
 An optional bounded `errorClass` may describe an error category. Full tool
 error payloads are not copied into usage telemetry by default.
 
+Cost is reported as attributed rather than measured, because that is what it
+is. A call is read back from the transcript once it has finished, so it can
+never be measured directly: an MCP server outlives its calls and is sampled
+directly, while a built-in tool leaves nothing behind and is costed from the
+samples that fall inside its own start and end. A call with no sample near it
+reports nothing rather than a number borrowed from another moment.
+
 ## Local enforcement
 
 GrantTap can narrow later actions for an exact task only where a provider
@@ -217,4 +239,12 @@ gate on macOS, and `npm publish` enforces the same gate through
 Do not publish from a dirty checkout or before the package allowlist, tests,
 typecheck, and release checks pass.
 
+## License
+
+GrantTap MCP is distributed under the proprietary
+[GrantTap Commercial Source License 1.0](LICENSE). Public source access does not
+grant open-source, redistribution, hosted-service, or competing-product rights.
+Third-party dependencies retain their own terms; see
+[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+
 GrantTap is not affiliated with Anthropic, OpenAI, Apple, Anysphere, or xAI.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,23 @@
+# Third-party notices
+
+GrantTap MCP is proprietary software distributed under the GrantTap Commercial
+Source License. Third-party components retain their own licenses; the GrantTap
+license does not replace or restrict those terms.
+
+The npm package declares, rather than vendors, these direct runtime
+dependencies. Their packages carry the applicable license texts:
+
+| Component | License |
+| --- | --- |
+| `@modelcontextprotocol/sdk` | MIT |
+| `express` | MIT |
+| `qrcode` | MIT |
+| `tsx` | MIT |
+| `tweetnacl` | The Unlicense |
+| `ws` | MIT |
+| `zod` | MIT |
+
+The unpublished Rust workspace also depends on separately licensed components,
+including `mcport` (MIT), `blazingly-json` (MIT), `serde` (MIT OR Apache-2.0), and
+BlindPlane crates (MIT OR Apache-2.0). Binary distributions must retain the
+complete license texts required by the exact dependency versions they contain.

package/apps/bridge/src/bin/claude-hook.ts

@@ -25,6 +25,10 @@ import {
 } from "../config";
 import { recordAttributedCall } from "../mesh/call-scope";
 import { classifyAction } from "../policy";
+import {
+  evaluateEffectiveAction,
+  legacyGrantTapFlowAllowed,
+} from "../policy/effective-action";
 import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
@@ -35,31 +39,20 @@ async function readStdin(): Promise<string> {
 
 async function main(): Promise<void> {
   const raw = await readStdin();
-  let input: HookInput = {};
+  let input: HookInput;
   try {
     input = JSON.parse(raw) as HookInput;
   } catch {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: "GrantTap received invalid hook JSON",
-        },
-      }),
-    );
+    writePermission("deny", "GrantTap received invalid hook JSON");
     return;
   }
+  await handlePreToolUse(input);
+}
 
+async function handlePreToolUse(input: HookInput): Promise<void> {
   const protectedAccess = protectedGrantTapAccess(input.tool_name, input.tool_input);
   if (protectedAccess) {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: protectedAccess.reason,
-      },
-    }));
+    writePermission("deny", protectedAccess.reason);
     return;
   }
 
@@ -80,43 +73,42 @@ async function main(): Promise<void> {
     input.tool_name,
     input.tool_input,
   );
-  if (blocked) {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: blocked.reason,
-        },
-      }),
-    );
+  const projectDecision = await evaluateEffectiveAction({
+    provider: "claude",
+    sessionId: input.session_id,
+    cwd: input.cwd,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+    legacyDenyReason: blocked?.reason,
+  });
+  if (projectDecision.effect === "deny") {
+    writePermission("deny", projectDecision.reason);
     return;
   }
+  const legacyFlow = legacyGrantTapFlowAllowed(projectDecision);
 
   // Claude already granted this chat unconditional tool access. GrantTap's
-  // explicit MCP/skill/CLI blocks above still win, but phone approval must not
-  // re-prompt a call Claude is intentionally running in bypass mode.
-  if (input.permission_mode === "bypassPermissions") return;
+  // Project ASK/DENY is a parent boundary, so bypass mode cannot weaken it.
+  if (legacyFlow && input.permission_mode === "bypassPermissions") return;
 
   // Gating paused, or this session is exempt → abstain (empty output = Claude
   // uses its normal permission flow, exactly as if GrantTap weren't installed).
-  if (isGatingSkipped(input.session_id)) return;
+  if (legacyFlow && isGatingSkipped(input.session_id)) return;
+  await continuePermissionFlow(input, legacyFlow);
+}
 
+async function continuePermissionFlow(input: HookInput, legacyFlow: boolean): Promise<void> {
   let cfg;
   try {
     cfg = loadConfig(machineConfigPath());
   } catch {
+    if (!legacyFlow) {
+      writePermission("deny", "Project policy requires GrantTap approval, but this computer is not paired");
+      return;
+    }
     // No pairing yet: don't block the user's normal workflow — defer to Claude's
     // own prompt by emitting "ask".
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "ask",
-          permissionDecisionReason: "GrantTap not paired (run `npm run init`)",
-        },
-      }),
-    );
+    writePermission("ask", "GrantTap not paired (run `npm run init`)");
     return;
   }
 
@@ -125,21 +117,8 @@ async function main(): Promise<void> {
   // the user never finished setting up. Once paired, this is what keeps routine
   // work independent of whether the phone is awake, reachable, or even running.
   const req = claudeToRequest(input);
-  if (shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
-    const level = autoAcceptLevelFor(input.session_id);
-    const cls = classifyAction(req.tool, req.command);
-    process.stdout.write(
-      JSON.stringify(
-        decisionToClaudeOutput({
-          type: "approval.decision",
-          requestId: req.requestId,
-          decision: "allow",
-          decidedBy: "auto",
-          note: `GrantTap auto-accept (${level} / ${cls})`,
-          decidedAt: Date.now(),
-        }),
-      ),
-    );
+  if (legacyFlow && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+    writeAutoApproval(input, req);
     return;
   }
 
@@ -153,12 +132,38 @@ async function main(): Promise<void> {
   // Relay down or phone asleep ≠ phone said no: abstain so Claude's local flow
   // handles it (avoid flooding "решай локально" on every tool).
   if (isUnanswered(decision)) {
+    if (!legacyFlow) {
+      writePermission("deny", "Project approval was required but no decision was received");
+    }
     return;
   }
 
   process.stdout.write(JSON.stringify(decisionToClaudeOutput(decision)));
 }
 
+function writeAutoApproval(input: HookInput, req: ReturnType<typeof claudeToRequest>): void {
+  const level = autoAcceptLevelFor(input.session_id);
+  const cls = classifyAction(req.tool, req.command);
+  process.stdout.write(JSON.stringify(decisionToClaudeOutput({
+    type: "approval.decision",
+    requestId: req.requestId,
+    decision: "allow",
+    decidedBy: "auto",
+    note: `GrantTap auto-accept (${level} / ${cls})`,
+    decidedAt: Date.now(),
+  })));
+}
+
+function writePermission(decision: "deny" | "ask", reason: string): void {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: decision,
+      permissionDecisionReason: reason,
+    },
+  }));
+}
+
 main().catch((err) => {
   process.stdout.write(
     JSON.stringify({

package/apps/bridge/src/bin/codex-hook.ts

@@ -25,6 +25,7 @@ import {
 } from "../config";
 import { recordAttributedCall } from "../mesh/call-scope";
 import { classifyAction } from "../policy";
+import { consumeCodexProjectAsk } from "../policy/codex-project-ask";
 import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
@@ -77,9 +78,15 @@ async function main(): Promise<void> {
     process.stdout.write(denyOutput(blocked.reason));
     return;
   }
+  const projectAsk = consumeCodexProjectAsk({
+    sessionId: input.session_id,
+    toolUseId: input.tool_use_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+  });
 
   // Gating paused or this session exempt → stay silent (Codex uses its own flow).
-  if (isGatingSkipped(input.session_id)) return;
+  if (!projectAsk && isGatingSkipped(input.session_id)) return;
 
   let cfg;
   try {
@@ -91,7 +98,7 @@ async function main(): Promise<void> {
 
   // Local policy, evaluated after pairing is confirmed — see claude-hook.
   const req = codexToRequest(input);
-  if (shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+  if (!projectAsk && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
     const level = autoAcceptLevelFor(input.session_id);
     const cls = classifyAction(req.tool, req.command);
     process.stdout.write(
@@ -116,9 +123,14 @@ async function main(): Promise<void> {
   );
   const decision = await requestApproval(cfg, req, { timeoutMs });
 
-  // Relay down or phone never answered: stay silent — an empty hook result
-  // sends Codex back to its own approval flow, so desk work keeps going.
-  if (isUnanswered(decision)) return;
+  // Routine relay failure stays in Codex's native flow. A Project ASK cannot
+  // fall through to provider approval because that would weaken the parent rule.
+  if (isUnanswered(decision)) {
+    if (projectAsk) {
+      process.stdout.write(denyOutput("Project approval was required but no decision was received"));
+    }
+    return;
+  }
 
   process.stdout.write(JSON.stringify(decisionToCodexOutput(decision)));
 }

package/apps/bridge/src/bin/codex-policy-hook.ts

@@ -1,7 +1,9 @@
 #!/usr/bin/env -S npx tsx
-/** Deny-only Codex PreToolUse policy for exact per-chat capability switches. */
+/** Codex PreToolUse: deterministic deny or one-shot Project ASK handoff. */
 import type { HookInput } from "../adapters";
 import { blockedSessionCapability, isProviderEnabled } from "../config";
+import { recordCodexProjectAsk } from "../policy/codex-project-ask";
+import { evaluateEffectiveAction } from "../policy/effective-action";
 import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
@@ -19,13 +21,7 @@ async function main(): Promise<void> {
   }
   const protectedAccess = protectedGrantTapAccess(input.tool_name, input.tool_input);
   if (protectedAccess) {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: protectedAccess.reason,
-      },
-    }));
+    deny(protectedAccess.reason);
     return;
   }
   if (!isProviderEnabled("codex")) return;
@@ -34,12 +30,36 @@ async function main(): Promise<void> {
     input.tool_name,
     input.tool_input,
   );
-  if (!blocked) return;
+  const decision = await evaluateEffectiveAction({
+    provider: "codex",
+    sessionId: input.session_id,
+    cwd: input.cwd,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+    legacyDenyReason: blocked?.reason,
+  });
+  if (decision.effect === "deny") {
+    deny(decision.reason);
+    return;
+  }
+  if (decision.effect !== "ask") return;
+  const recorded = recordCodexProjectAsk({
+    sessionId: input.session_id,
+    toolUseId: input.tool_use_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+  }, decision.reason);
+  if (!recorded) {
+    deny("Project approval could not be bound to this exact Codex call");
+  }
+}
+
+function deny(reason: string): void {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
       permissionDecision: "deny",
-      permissionDecisionReason: blocked.reason,
+      permissionDecisionReason: reason,
     },
   }));
 }

package/apps/bridge/src/bin/cursor-hook.ts

@@ -15,6 +15,10 @@ import {
   machineConfigPath,
   shouldAutoAcceptCursorShell,
 } from "../config";
+import {
+  evaluateEffectiveAction,
+  legacyGrantTapFlowAllowed,
+} from "../policy/effective-action";
 import { cursorRootSessionId } from "../sessions/cursor";
 import { protectedGrantTapAccess } from "../self-protection";
 
@@ -48,6 +52,10 @@ async function main(): Promise<void> {
     nativeAsk("GrantTap could not read this shell call; use Cursor approval.");
     return;
   }
+  await handleShell(input);
+}
+
+async function handleShell(input: CursorHookInput): Promise<void> {
   const protectedAccess = protectedGrantTapAccess(
     input.tool_name, input.tool_input, input.command,
   );
@@ -66,19 +74,42 @@ async function main(): Promise<void> {
     input.tool_name ?? "Shell",
     input.tool_input ?? { command: input.command },
   );
-  if (blocked) {
-    deny(blocked.reason);
+  const projectDecision = await evaluateEffectiveAction({
+    provider: "cursor",
+    sessionId,
+    cwd: cursorCwd(input),
+    toolName: input.tool_name ?? "Shell",
+    toolInput: input.tool_input ?? { command: input.command },
+    legacyDenyReason: blocked?.reason,
+  });
+  if (projectDecision.effect === "deny") {
+    deny(projectDecision.reason);
+    return;
+  }
+  const legacyFlow = legacyGrantTapFlowAllowed(projectDecision);
+  if (!sessionId) {
+    if (!legacyFlow) deny("Project approval cannot be bound to an exact Cursor chat");
+    else nativeAsk("GrantTap is paused or this shell call is unscoped; use Cursor approval.");
     return;
   }
-  if (!sessionId || isGatingSkipped(sessionId)) {
+  if (legacyFlow && isGatingSkipped(sessionId)) {
     nativeAsk("GrantTap is paused or this shell call is unscoped; use Cursor approval.");
     return;
   }
+  await continueApproval(input, sessionId, legacyFlow);
+}
+
+async function continueApproval(
+  input: CursorHookInput,
+  sessionId: string,
+  legacyFlow: boolean,
+): Promise<void> {
   let config;
   try {
     config = loadConfig(machineConfigPath());
   } catch {
-    nativeAsk("GrantTap is not paired; use Cursor approval.");
+    if (!legacyFlow) deny("Project policy requires GrantTap approval, but this computer is not paired");
+    else nativeAsk("GrantTap is not paired; use Cursor approval.");
     return;
   }
   const request = cursorToRequest({
@@ -90,20 +121,35 @@ async function main(): Promise<void> {
   // Eligible levels approve locally — never wait on phone WS/APNs for an action
   // the configured level already allows.
   const level = autoAcceptLevelFor(sessionId);
-  if (shouldAutoAcceptCursorShell(level, request.tool, request.command)) {
+  if (legacyFlow && shouldAutoAcceptCursorShell(level, request.tool, request.command)) {
     process.stdout.write(JSON.stringify({ permission: "allow", continue: true }));
     return;
   }
 
   const timeoutMs = Number(process.env.GRANTTAP_APPROVAL_TIMEOUT_MS ?? 60_000);
-  const decision = await requestApproval(config, request, { timeoutMs });
+  let decision;
+  try {
+    decision = await requestApproval(config, request, { timeoutMs });
+  } catch {
+    if (!legacyFlow) deny("Project approval failed before a decision was recorded");
+    else nativeAsk("GrantTap shell hook failed; use Cursor approval.");
+    return;
+  }
   if (isUnanswered(decision)) {
-    nativeAsk("GrantTap got no answer; use Cursor approval.");
+    if (!legacyFlow) deny("Project approval was required but no decision was received");
+    else nativeAsk("GrantTap got no answer; use Cursor approval.");
     return;
   }
   process.stdout.write(JSON.stringify(decisionToCursorOutput(decision)));
 }
 
+function cursorCwd(input: CursorHookInput): string | undefined {
+  if (typeof input.cwd === "string" && input.cwd.trim()) return input.cwd;
+  return Array.isArray(input.workspace_roots) && typeof input.workspace_roots[0] === "string"
+    ? input.workspace_roots[0]
+    : undefined;
+}
+
 main().catch(() => {
   nativeAsk("GrantTap shell hook failed; use Cursor approval.");
   process.exit(0);