granttap-mcp 0.8.102 → 0.8.105

package/README.md

@@ -862,3 +862,10 @@ Installed GrantTap background services check for stable MCP updates automaticall
 Verified updates are staged separately and applied after active requests and pending
 decisions finish. Startup failures restore the previous version. Pairing and task
 policies are retained; source checkouts and running provider processes stay in place.
+
+In the plugin's GrantTap connection card, use **Automatic updates: On / Off**.
+The choice is saved for this computer and takes effect without restarting the
+service. Off prevents further update checks and activation; an already running
+download may finish staging, and the current runtime keeps running. Turn it on to
+resume automatic checks. `GRANTTAP_DISABLE_AUTO_UPDATE=1` on the service overrides
+the card and keeps the switch disabled.

package/apps/bridge/src/codex-desktop/README.md

@@ -29,3 +29,8 @@ consumed them. Tests exercise native delivery, framing, socket trust, durable
 deduplication, and refusal without launching the CLI.
 
 License: GrantTap Commercial Source License in the repository-root `LICENSE`.
+
+Document staging for a native-only question keeps the file note inside its
+original answer envelope. The host's native question and all paired controllers
+therefore observe the same question item as answered; document paths remain
+available to the admitted turn. Ordinary chat text is unchanged.

package/apps/bridge/src/codex-desktop/index.ts

@@ -1,3 +1,4 @@
+import { nativeQuestionAttachmentEnvelope } from './question-attachment-envelope';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import type { SessionInfo } from '../../../../packages/protocol/schema';
@@ -72,7 +73,7 @@ function turnRequest(input: { session: SessionInfo; text: string; images: string
       networkAccess: false, excludeTmpdirEnvVar: false, excludeSlashTmp: false }
     : access === 'full' ? { type: 'dangerFullAccess' } : undefined;
   return { threadId: session.sessionId, clientUserMessageId: options.messageId ?? randomUUID(),
-    input: [{ type: 'text', text, text_elements: [] }, ...images.map(path => ({ type: 'localImage', path }))],
+    input: [{ type: 'text', text: options.nativeOnly ? nativeQuestionAttachmentEnvelope(text) : text, text_elements: [] }, ...images.map(path => ({ type: 'localImage', path }))],
     ...(options.model ? { model: options.model } : {}), ...(effort ? { effort } : {}),
     ...(sandboxPolicy ? { sandboxPolicy } : {}) };
 }

package/apps/bridge/src/codex-desktop/question-attachment-envelope.ts

@@ -0,0 +1,23 @@
+/** Preserve the native question envelope after document staging appends its local file note. */
+export function nativeQuestionAttachmentEnvelope(text: string): string {
+  const opening = '<send_user_message_question_reply>';
+  const closing = '</send_user_message_question_reply>';
+  const boundary = text.lastIndexOf(closing);
+  if (!text.startsWith(opening) || boundary < opening.length) return text;
+  const note = text.slice(boundary + closing.length);
+  const header = '\n\nAttached files available locally:\n';
+  if (!note.startsWith(header)) return text;
+  const files = note.slice(header.length).split('\n');
+  if (!files.length || files.some(line => !/^- .+: .+$/.test(line))) return text;
+  try {
+    const rows = JSON.parse(text.slice(opening.length, boundary));
+    if (!Array.isArray(rows) || rows.length !== 1 || typeof rows[0]?.questionItemId !== 'string'
+      || typeof rows[0]?.answer !== 'string') return text;
+    const identity = JSON.parse(rows[0].questionItemId);
+    if (!Array.isArray(identity) || identity.length !== 3 || identity[0] !== 'request_user_input_async'
+      || typeof identity[1] !== 'string' || !/^[a-zA-Z0-9_-]{1,180}$/.test(identity[1])
+      || !Number.isInteger(identity[2]) || identity[2] < 0 || identity[2] > 3) return text;
+    rows[0].answer += note;
+    return opening + '\n' + JSON.stringify(rows) + '\n' + closing;
+  } catch { return text; }
+}

package/apps/bridge/src/codex-questions/README.md

@@ -25,3 +25,10 @@ Tests under `tests/` cover publication, reconnect replay, native acknowledgement
 scope rejection, expiry and delivery through an isolated native IPC fixture.
 
 License: GrantTap Commercial Source License in the repository-root `LICENSE`.
+
+Attachment-capable controllers opt in using the advertised
+`questionReplyFormat: attachments-v1`. The original question item owns the
+answer, image and file payload together; ordinary encrypted attachment transport,
+Task policy, native-owner admission and stable question idempotency still apply.
+Legacy text-only replies keep their existing contract. Files remain available
+for the admitted native turn; another phone cannot start a second answer.

package/apps/bridge/src/codex-questions/index.ts

@@ -40,6 +40,7 @@ export async function publishCodexQuestions(client: RelayClient, sessions: Sessi
       } else if (!record.announced || options.replay) {
         const text = [record.question, ...record.options.map(value => '• ' + value)].join('\n');
         await client.send({ type: 'agent.event', kind: 'question', requestId: record.requestId,
+          questionReplyFormat: 'attachments-v1',
           sessionId: session.sessionId, agent: 'codex', projectId: session.projectId,
           taskId: session.taskId, computerId: session.computerId, text, createdAt: record.createdAt },
         'phone', { ttlMs: Math.max(1, record.createdAt + RETENTION_MS - Date.now()),
@@ -73,8 +74,9 @@ export async function handleCodexQuestionReply(client: RelayClient, message: Use
     await resolveQuestion(client, record, peerPublicKey, !record.answered);
     return true;
   }
-  if (!message.text.trim() || message.text.length > 4_000 || message.attachments?.length
-    || message.attachmentRefs?.length) return false;
+  const hasAttachments = !!(message.attachments?.length || message.attachmentRefs?.length);
+  if (!message.text.trim() || message.text.length > 4_000
+    || (hasAttachments && message.questionReplyFormat !== 'attachments-v1')) return false;
   return deliver(client, { ...message, requestId: undefined,
     messageId: message.messageId ?? 'codex-answer-' + record.requestId,
     text: nativeAnswerEnvelope(record, message.text) }, publish, peerPublicKey,

package/apps/bridge/src/monitor/handlers/user-message.ts

@@ -121,6 +121,7 @@ export async function handleUserMessage(
   onProcessing?: () => Promise<void>,
   peerPublicKey?: string,
   native?: { messageId: string; nativeOnly: true },
+  onRefusal?: (error: string) => Promise<void>,
 ): Promise<"accepted" | "rejected"> {
   const say = (text: string, sessionId?: string, wake = false, kind: "status" | "response" = "response") => {
     const payload = agentEventForUserMessage(message, text, sessionId, kind);
@@ -129,6 +130,11 @@ export async function handleUserMessage(
       ? sendSessionPayload(client, payload, sessionId, "phone", options)
       : client.send(payload, "phone", options)).catch(() => {});
   };
+  const refuse = async (error: string, wake = false): Promise<"rejected"> => {
+    await onRefusal?.(error);
+    await say(error, message.sessionId, wake);
+    return "rejected";
+  };
   if (!message.sessionId) {
     const origin = message.taskOriginId && peerPublicKey ? {
       registry: localTaskOrigins(),
@@ -150,23 +156,16 @@ export async function handleUserMessage(
   // so it runs only for a chat newer than that catalog.
   const target = publishedSession(client, message.sessionId)
     ?? scanSessions().sessions.find((session) => session.sessionId === message.sessionId);
-  if (!target) {
-    await say("This task is no longer available on the computer.", message.sessionId);
-    return "rejected";
-  }
+  if (!target) return refuse("This task is no longer available on the computer.");
 
   const settings = loadRuntimeConfig().providerSettings;
   if (target.agent in settings
     && settings[target.agent as keyof typeof settings] === false) {
-    await say("This agent is disabled in GrantTap Settings.", message.sessionId, true);
-    return "rejected";
+    return refuse("This agent is disabled in GrantTap Settings.", true);
   }
 
   const routingError = deliveryRoutingError(target, message);
-  if (routingError) {
-    await say(routingError, target.sessionId);
-    return "rejected";
-  }
+  if (routingError) return refuse(routingError);
 
   // No "sent, waiting" line from a middleman: the delivery receipt already
   // marks the person's bubble, and the next words in the chat are the answer.

package/apps/bridge/src/monitor/message-delivery/README.md

@@ -22,6 +22,11 @@ message again. Only the original authenticated controller, room, and session
 may read it. Older unscoped records are not exposed through this query.
 Receipts to a known controller use its device encryption directly, so a missed
 task-key grant cannot hide a provider rejection or processing acknowledgement.
+For existing chats, refusals before provider dispatch (missing task, disabled provider, or rejected
+task capability) also persist a scoped rejected receipt before the relay box is
+consumed. The original controller can recover that specific refusal after a
+restart or lost response. Missing attachment recovery retains its existing
+transport behavior; an admission refusal is never reported as agent activity.
 
 A correlated `agentActivityAt` receipt is emitted only after provider stream output
 confirms activity. It is retained under the original controller, room and session

package/apps/bridge/src/monitor/message-delivery/index.ts

@@ -1,7 +1,8 @@
 import type { Payload } from "../../../../../packages/protocol/schema";
 import type { RelayClient } from "../../../../../packages/core/relay-client";
 import { abandonDelivery, beginDelivery, completeDelivery,
-  acknowledgeProcessingDelivery, processingDeliveryAcknowledged, completedDeliveryFailure, deliveryReceiptStatus } from "../../delivery";
+  acknowledgeProcessingDelivery, processingDeliveryAcknowledged, completedDeliveryFailure, deliveryReceiptStatus,
+  rejectCompletedDelivery } from "../../delivery";
 import { sendDeliveryReceipt } from "../handlers/receipts";
 import { handleUserMessage } from "../handlers/user-message";
 
@@ -34,9 +35,15 @@ export async function handleInboundUserMessage(
       if (!payload.messageId) return;
       acknowledgeProcessingDelivery(payload.messageId);
       await sendDeliveryReceipt(client, payload.messageId, "accepted", undefined, payload.sessionId, peerPublicKey);
-    }, peerPublicKey, native);
+    }, peerPublicKey, native, async error => {
+      if (!payload.messageId) return;
+      rejectCompletedDelivery(payload.messageId, error);
+      await sendDeliveryReceipt(client, payload.messageId, 'rejected', error, payload.sessionId, peerPublicKey);
+    });
     if (payload.messageId && deliveryStarted) {
-      if (outcome === "rejected") abandonDelivery(payload.messageId);
+      if (outcome === "rejected") {
+        if (!completedDeliveryFailure(payload.messageId)) abandonDelivery(payload.messageId);
+      }
       else {
         completeDelivery(payload.messageId);
         await sendDeliveryReceipt(client, payload.messageId, "accepted", undefined, payload.sessionId, peerPublicKey);

package/apps/bridge/src/runtime-updates/README.md

@@ -14,7 +14,13 @@ failed version is quarantined until a newer release appears.
 
 Pairing, account credentials, task history, capability policy, and provider
 installations are not modified by runtime updates. Offline checks retry later.
-Source checkouts and test processes do not update themselves. Administrators may
+Source checkouts and test processes do not update themselves. The plugin's
+connection card offers a persistent **Automatic updates: On / Off** switch for
+this computer. The running monitor reads it before registry checks and activation;
+the launcher checks it again before handing off an owned service. Off keeps the
+current selected runtime and rollback protection. An in-progress download may
+finish staging but cannot activate while off. Re-enabling is observed on the next
+minute tick without restarting services. Administrators may
 set `GRANTTAP_DISABLE_AUTO_UPDATE=1` on their service to retain their installed
 version. Private staging consumes space; old versions are retained for rollback.
 

package/apps/bridge/src/runtime-updates/index.ts

@@ -4,6 +4,8 @@ import { fileURLToPath } from 'node:url';
 import { configDir } from '../config/runtime/paths';
 import { latestRelease, trustedRelease, installRelease, verifyRelease, type Release } from './registry';
 import { newerVersion, readState, runtimeVersion, saveState, validRuntime, versionRoot } from './selection.mjs';
+import { automaticUpdatesAllowed } from './preferences/storage.mjs';
+export { runtimeUpdateSettings, setRuntimeAutoUpdate } from './preferences';
 
 type Options={root:string;stateDirectory:string;now?:()=>number;latest?:()=>Promise<unknown>;
   idle:()=>boolean;install?:(release:Release,directory:string)=>Promise<void>;
@@ -11,11 +13,13 @@ type Options={root:string;stateDirectory:string;now?:()=>number;latest?:()=>Prom
 
 /** Stage verified releases independently; activation waits until no request or decision is pending. */
 export async function checkForRuntimeUpdate(options:Options):Promise<string|undefined> {
+  if(!automaticUpdatesAllowed(options.stateDirectory))return;
   mkdirSync(options.stateDirectory,{recursive:true,mode:0o700});
   const lock=join(options.stateDirectory,'install.lock');let fd:number;
   try {fd=openSync(lock,'wx',0o600);} catch {return undefined;}
   try {
     const release=await (options.latest??latestRelease)();
+    if(!automaticUpdatesAllowed(options.stateDirectory))return;
     const state=readState(options.stateDirectory);
     if(!trustedRelease(release) || !newerVersion(release.version,runtimeVersion(options.root))
       || state.rejectedVersion===release.version || (state.version && !newerVersion(release.version,state.version)))return;
@@ -23,9 +27,10 @@ export async function checkForRuntimeUpdate(options:Options):Promise<string|unde
     if(!validRuntime(candidate,options.stateDirectory,release.version)) {
       await (options.install??installRelease)(release,options.stateDirectory);
     }
+    if(!automaticUpdatesAllowed(options.stateDirectory))return;
     await (options.verify??verifyRelease)(candidate);
     if(!validRuntime(candidate,options.stateDirectory,release.version))throw Error('Runtime verification failed');
-    if(!options.idle())return;
+    if(!options.idle() || !automaticUpdatesAllowed(options.stateDirectory))return;
     saveState(options.stateDirectory,{root:candidate,version:release.version,
       previous:state.root?{root:state.root,version:state.version}:undefined});
     options.activate?.(candidate);return candidate;
@@ -42,6 +47,7 @@ export function runtimeUpdateLoop(options:LoopOptions):()=>void {
   const tick=async()=>{
     if(stopped)return;
     try {
+      if(!automaticUpdatesAllowed(options.directory)){lastCheck=0;return;}
       const lock=join(options.directory,'install.lock');
       try {if(now()-statSync(lock).mtimeMs>10*60_000)unlinkSync(lock);} catch { /* no stale lock */ }
       if(now()-lastCheck>=4*60*60_000) {

package/apps/bridge/src/runtime-updates/preferences/README.md

@@ -0,0 +1,18 @@
+# Runtime update preference
+
+The public runtime-updates entry exports `runtimeUpdateSettings` and
+`setRuntimeAutoUpdate`. The connection card stores the computer-wide choice in
+`runtime-updates/preferences.json`, separately from version selection and pairing.
+Missing settings retain the existing enabled default; unreadable settings pause
+updates. A service-level `GRANTTAP_DISABLE_AUTO_UPDATE=1` takes precedence.
+
+The monitor checks the saved preference before registry access and before
+activation. Its loop observes changes without restarting. The launcher checks it
+again before asking the owned service to drain or stopping that service. Turning
+updates off retains the selected working version and startup rollback protection.
+
+Integration tests in `../tests/preferences.test.ts` cover live off/on and an
+in-flight update. Connection-center tests cover persistence through actual MCP
+calls, pairing preservation, service overrides, and the DOM switch.
+
+License: [GrantTap Commercial Source License](../../../../../LICENSE).

package/apps/bridge/src/runtime-updates/preferences/index.ts

@@ -0,0 +1,12 @@
+import { join } from 'node:path';
+import { configDir } from '../../config';
+import { automaticUpdateSettings, saveAutomaticUpdateSetting } from './storage.mjs';
+
+export function runtimeUpdateSettings() {
+  return automaticUpdateSettings(join(configDir(), 'runtime-updates'));
+}
+
+/** A running monitor reads this preference before its next check and before activation. */
+export function setRuntimeAutoUpdate(enabled: boolean): void {
+  saveAutomaticUpdateSetting(join(configDir(), 'runtime-updates'), enabled);
+}

package/apps/bridge/src/runtime-updates/preferences/storage.d.mts

@@ -0,0 +1,4 @@
+export type AutomaticUpdateSettings = { enabled: boolean; lockedByEnvironment: boolean };
+export function automaticUpdateSettings(directory: string): AutomaticUpdateSettings;
+export function automaticUpdatesAllowed(directory: string): boolean;
+export function saveAutomaticUpdateSetting(directory: string, enabled: boolean): void;

package/apps/bridge/src/runtime-updates/preferences/storage.mjs

@@ -0,0 +1,35 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Missing preferences preserve the installed default; unreadable settings pause updates. */
+export function automaticUpdateSettings(directory) {
+  const lockedByEnvironment = process.env.GRANTTAP_DISABLE_AUTO_UPDATE === '1';
+  let enabled;
+  try {
+    const value = JSON.parse(readFileSync(join(directory, 'preferences.json'), 'utf8'));
+    enabled = value?.automaticUpdatesEnabled === true;
+  } catch (error) { enabled = error?.code === 'ENOENT'; }
+  return { enabled: enabled && !lockedByEnvironment, lockedByEnvironment };
+}
+
+export function automaticUpdatesAllowed(directory) {
+  return automaticUpdateSettings(directory).enabled;
+}
+
+/** Separate from selected versions, pairing, credentials, and capability policy. */
+export function saveAutomaticUpdateSetting(directory, enabled) {
+  if (typeof enabled !== 'boolean') throw new TypeError('Automatic updates require a boolean setting');
+  if (enabled && process.env.GRANTTAP_DISABLE_AUTO_UPDATE === '1') {
+    throw new Error('Automatic updates are disabled by service configuration');
+  }
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const path = join(directory, 'preferences.json');
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+  try {
+    writeFileSync(temporary, JSON.stringify({ automaticUpdatesEnabled: enabled }) + '\n', { mode: 0o600 });
+    renameSync(temporary, path);
+  } finally {
+    try { unlinkSync(temporary); } catch (error) { if (error?.code !== 'ENOENT') throw error; }
+  }
+}

package/apps/bridge/src/runtime-updates/supervision.mjs

@@ -1,4 +1,5 @@
 import { selectedRuntime, rollbackRuntime } from './selection.mjs';
+import { automaticUpdatesAllowed } from './preferences/storage.mjs';
 
 /** Monitor only the child started by this launcher; external providers are never stopped. */
 export function superviseRuntime(child, options) {
@@ -9,14 +10,14 @@ export function superviseRuntime(child, options) {
   const stop=()=>{if(stopped)return;stopped=true;clearInterval(timer);child.off('message',onMessage);};
   const onMessage=message=>{
     if(message?.type==='granttap.runtime-healthy')healthy=true;
-    if(message?.type==='granttap.runtime-update-ready' && changed()) {stop();child.kill('SIGTERM');}
+    if(message?.type==='granttap.runtime-update-ready' && automaticUpdatesAllowed(directory) && changed()) {stop();child.kill('SIGTERM');}
   };
   const tick=()=>{
     if(stopped)return;
     if(!healthy && (options.now??Date.now)()-started>120_000) {
       rollbackRuntime(bundled,directory,root);stop();child.kill('SIGTERM');return;
     }
-    if(changed() && child.connected)child.send({type:'granttap.runtime-update-check'},()=>{});
+    if(automaticUpdatesAllowed(directory) && changed() && child.connected)child.send({type:'granttap.runtime-update-check'},()=>{});
   };
   const timer=(options.schedule??setInterval)(tick,10_000);timer.unref?.();child.on('message',onMessage);
   return {stop,onExit:(code,signal)=>{

package/apps/bridge/src/sessions/README.md

@@ -35,6 +35,11 @@ answers below the current request. Native completion marks the final visible
 answer. Existing entry IDs replace cached timestamps without duplicating history.
 Session continuation uses the installed Grok CLI and its existing authentication.
 
+Prepared transfer chats retain their stable Task identity and are ranked again
+after native-session aliasing, before the bounded live and history windows.
+A transferred chat therefore keeps its native activity position instead of
+being appended behind older chats and disappearing from the phone's catalog.
+
 ## License
 
 Licensed under the GrantTap Commercial Source License. See LICENSE and NOTICE.

package/apps/bridge/src/sessions/catalog.ts

@@ -56,9 +56,9 @@ async function cooperativeProviderScans(maxFiles = MAX_FILES): Promise<ProviderS
   return scans;
 }
 
-function sortedUniqueSessions(scans: ProviderScan[]): SessionInfo[] {
+function sortedUniqueSessions(sessions: SessionInfo[]): SessionInfo[] {
   const merged = new Map<string, SessionInfo>();
-  for (const session of scans.flatMap((scan) => scan.sessions)) {
+  for (const session of sessions) {
     const key = sessionKey(session);
     const previous = merged.get(key);
     if (!previous || session.lastActivityAt >= previous.lastActivityAt) {
@@ -97,8 +97,12 @@ function pickWithReserve(
 }
 
 function catalogFromScans(scans: ProviderScan[]) {
+  const native = sortedUniqueSessions(scans.flatMap((scan) => scan.sessions));
+  // Prepared transfers replace native ids; rank their native activity before
+  // the bounded live/history windows, rather than appending them after older chats.
+  const sessions = sortedUniqueSessions(localTaskTransfers().catalog(native));
   return {
-    all: localTaskTransfers().catalog(sortedUniqueSessions(scans)).map(session => ({ ...session,
+    all: sessions.map(session => ({ ...session,
       transfer: localTransferContinuations().notice(session.sessionId) })),
     tokensRecent: scans.reduce((sum, scan) => sum + scan.tokensRecent, 0),
     sourceLimited: scans.some((scan) => scan.sourceLimited === true),

package/apps/mcp/src/connection-center/README.md

@@ -32,6 +32,13 @@ the one-time URL from structured tool output when a host omits MCP metadata.
 The separate coding-app OAuth page can also use passkey to authorize that MCP
 client. The Codex-owned plugin management page is not this card.
 
+The Automatic updates switch calls `set_runtime_auto_update` with an explicit
+boolean and displays the confirmed persisted result from the server. The setting
+is computer-wide for the GrantTap runtime; marketplace plugin updates stay under
+the coding app's control. A service environment override locks it off. Failed
+saves do not optimistically change the switch. Pairing and capability policy are
+stored separately and preserved.
+
 Tests in `tests/` exercise isolated keys, a loopback encrypted phone connection,
 expiry, non-mutating status, and actual DOM button/host-message behavior.
 

package/apps/mcp/src/connection-center/bridge.js

@@ -70,11 +70,11 @@ async function call(name, args = {}) {
     const result = legacyBridge
       ? await legacyCall(name, args)
       : await request("tools/call", { name, arguments: args });
-    if (result?.isError) message("Could not complete the request. Refresh status and check the relay before retrying.");
+    if (result?.isError) message("Could not complete the request. Refresh status before retrying.");
     else { render(result); message("Status updated."); }
     return result;
   } catch {
-    message("No successful response. Refresh status before retrying; pairing may already have changed.");
+    message("No successful response. Refresh status before retrying.");
   } finally {
     setBusy(false);
   }

package/apps/mcp/src/connection-center/state.ts

@@ -7,6 +7,7 @@ import { packageVersion } from "../status/package-version";
 import { connectionRuntimeStatus } from "../mcp-tools/connect/relay";
 import { beginEnrollment, cancelEnrollment, enrollmentIsOpen } from "./enrollment";
 import { loadAccountLink } from "../../../bridge/src/account-recovery/link";
+import { runtimeUpdateSettings } from "../../../bridge/src/runtime-updates";
 
 export const connectionOutput = {
   status: z.enum(["disconnected", "paired", "pairing", "expired", "connected"]),
@@ -25,6 +26,7 @@ export const connectionOutput = {
   providers: z.array(z.object({ id: z.string(), status: z.string(), detail: z.string() })),
   roomPrefix: z.string(),
   accountLinkSaved: z.boolean(),
+  runtimeUpdates: z.object({ enabled: z.boolean(), lockedByEnvironment: z.boolean() }),
   passkeyUrl: z.string().url().optional(),
 };
 
@@ -80,6 +82,7 @@ export class ConnectionState {
         providers: inspectProviderStatusSnapshot().providers.map(({ id, status, detail }) => ({ id, status, detail })),
         roomPrefix: config?.room ? config.room.slice(0, 8) : "",
         accountLinkSaved: loadAccountLink() !== null,
+        runtimeUpdates: runtimeUpdateSettings(),
       },
       _meta: { granttap: code ? { pairingUri: code.pairingUri, qrDataUrl: code.qrDataUrl } : {} },
     };

package/apps/mcp/src/connection-center/update-controls.ts

@@ -0,0 +1,23 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { z } from 'zod';
+import { setRuntimeAutoUpdate } from '../../../bridge/src/runtime-updates';
+import { connectionOutput } from './state';
+
+export function registerRuntimeUpdateControl(
+  server: McpServer, result: () => CallToolResult, meta: Record<string, unknown>,
+): void {
+  server.registerTool('set_runtime_auto_update', {
+    title: 'GrantTap automatic updates',
+    description: 'Enable or disable automatic GrantTap runtime updates on this computer when the user requests it. Saves the preference without restarting services or changing pairing, tasks, or provider policy.',
+    inputSchema: { enabled: z.boolean().describe('Whether this computer should automatically check for and apply stable GrantTap runtime updates') },
+    outputSchema: connectionOutput,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    _meta: meta,
+  }, async ({ enabled }) => {
+    try { setRuntimeAutoUpdate(enabled); return result(); }
+    catch {
+      return { isError: true, content: [{ type: 'text', text: 'Could not save automatic update settings. Service configuration may disable updates. Refresh status to see the current setting.' }] };
+    }
+  });
+}

package/apps/mcp/src/connection-center/view.js

@@ -7,6 +7,16 @@ function message(text) { $("message").textContent = text; }
 function setBusy(value) {
   busy = value;
   document.querySelectorAll("button").forEach(button => { button.disabled = value; });
+  renderUpdateSetting();
+}
+function renderUpdateSetting() {
+  const setting = current.runtimeUpdates;
+  $("automatic-updates").textContent = "Automatic updates: " + (setting ? setting.enabled ? "On" : "Off" : "Unknown");
+  $("automatic-updates").setAttribute("aria-checked", String(setting?.enabled === true));
+  $("automatic-updates").disabled = busy || !setting || setting.lockedByEnvironment;
+  $("updates-detail").textContent = setting?.lockedByEnvironment
+    ? "Disabled by service configuration."
+    : "Checks for stable GrantTap runtime updates every 4 hours. Off keeps this computer’s current version.";
 }
 function clearCode() {
   pairingUri = "";
@@ -19,6 +29,7 @@ function render(value) {
   const state = result?.structuredContent ?? result?.structured_content;
   if (!state?.status || result.isError) return;
   current = state;
+  renderUpdateSetting();
   clearCode();
   const meta = result._meta?.granttap ?? {};
   const candidate = state.passkeyUrl || meta.passkeyUrl;
@@ -102,6 +113,7 @@ $("connect").addEventListener("click", () => {
   call("connect");
 });
 $("refresh").addEventListener("click", () => call("connection_status"));
+$("automatic-updates").addEventListener("click", () => call("set_runtime_auto_update", { enabled: !current.runtimeUpdates.enabled }));
 $("passkey").addEventListener("click", () => call("connect_with_passkey"));
 $("reconnect").addEventListener("click", () => {
   pendingMode = "reconnect";

package/apps/mcp/src/connection-center/widget.html

@@ -31,6 +31,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <img id="qr" class="hidden" alt="GrantTap pairing QR" />
   </section>
   <p id="expiry" class="small" aria-live="polite"></p>
+  <section aria-label="Runtime updates"><div class="actions"><button id="automatic-updates" role="switch" aria-checked="false" aria-describedby="updates-detail" disabled>Automatic updates: Unknown</button></div><p id="updates-detail" class="small">Checking update settings…</p></section>
   <details><summary>Connection details &amp; help</summary>
     <dl><dt>Computer</dt><dd id="computer">—</dd><dt>MCP version</dt><dd id="version">—</dd>
     <dt>Relay observed by this MCP</dt><dd id="relay">Not checked</dd>

package/apps/mcp/src/mcp-tools/README.md

@@ -1,7 +1,8 @@
 # MCP tools
 
 The Personal MCP surface is an exact allowlist: `connection_status`, `connect`,
-`reconnect`, `notify`, `ask_yes_no`, and `ask`. Context compilation belongs
+`connect_with_passkey`, `reconnect`, `set_runtime_auto_update`, `notify`,
+`ask_yes_no`, `ask`, and `offload_task`. Context compilation belongs
 inside Project Mesh, not as extra tools. `relay.ts` owns one shared encrypted relay connection
 and the durable question lifecycle. Machine setup, custom relay selection, and
 pairing reset remains an explicit CLI operation. The narrower `reconnect` MCP
@@ -32,3 +33,7 @@ The connection center lives in `../connection-center`. Status requests are
 read-only. Saved pairing, a connected relay socket, and recent encrypted phone
 activity are separate observations. Only explicit connect/reconnect requests
 create codes; transfer material is carried in UI metadata and a user-facing QR.
+
+`set_runtime_auto_update` saves the user’s computer-wide runtime update choice
+from the connection card. It preserves pairing and capability policy, and cannot
+override a service-level disable. Status exposes the confirmed setting.

package/apps/mcp/src/mcp-tools/connect/index.ts

@@ -8,6 +8,7 @@ import { ConnectionState, connectionOutput } from "../../connection-center/state
 import { CONNECTION_WIDGET_URI } from "./widget";
 import { resetRelay, relay } from "./relay";
 import { startPasskeyAccountLink } from "../../connection-center/passkey";
+import { registerRuntimeUpdateControl } from "../../connection-center/update-controls";
 
 const widgetMeta = {
   ui: { resourceUri: CONNECTION_WIDGET_URI, visibility: ["model", "app"] },
@@ -26,6 +27,7 @@ const changes = {
 
 export function registerConnectTool(server: McpServer): void {
   const state = new ConnectionState();
+  registerRuntimeUpdateControl(server, () => connectionResult(state), widgetMeta);
   let pendingCall: Promise<CallToolResult> | null = null;
   const perform = (options: { issue?: boolean; replace?: boolean; addController?: boolean } = {}) => {
     if (pendingCall) return pendingCall;
@@ -126,7 +128,7 @@ async function connect(
 
 function connectionResult(state: ConnectionState): CallToolResult {
   const snapshot = state.snapshot();
-  const { status, computer, relay, version, relayStatus } = snapshot.structuredContent;
+  const { status, computer, relay, version, relayStatus, runtimeUpdates } = snapshot.structuredContent;
   const instructions = status === "pairing"
     ? "Use the GrantTap card: tap Add a device if needed, then scan the QR on the card."
     : status === "disconnected" ? "Use the GrantTap card and tap Add a device. The QR stays on the card."
@@ -135,7 +137,7 @@ function connectionResult(state: ConnectionState): CallToolResult {
   return {
     ...snapshot,
     content: [{ type: "text", text:
-      `GrantTap: ${status}. Computer: ${computer}. MCP ${version}. Relay: ${relay || "not configured"} (${relayStatus}).\n${instructions}`,
+      `GrantTap: ${status}. Computer: ${computer}. MCP ${version}. Relay: ${relay || "not configured"} (${relayStatus}). Automatic runtime updates: ${runtimeUpdates.enabled ? "on" : "off"}.\n${instructions}`,
     }],
   };
 }

package/apps/mcp/src/mcp-tools/connect/widget.ts

@@ -1,6 +1,6 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v4.html";
+export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v5.html";
 
 import { readFileSync } from "node:fs";
 

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.102
+npm install -g granttap-mcp@0.8.105
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.102\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.105\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.102";
+const PACKAGE = "granttap-mcp@0.8.105";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.102",
+  "version": "0.8.105",
   "description": "Commercial computer runtime connecting local coding agents to GrantTap on Mac, iPhone, iPad and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/interaction/index.ts

@@ -49,6 +49,8 @@ export const UserMessage = z.object({
   agent: CodingAgent.optional(),
   cwd: z.string().max(4_096).optional(),
   requestId: z.string().optional(),
+  /** Explicit compatible opt-in for native question file/image replies. */
+  questionReplyFormat: z.literal("attachments-v1").optional(),
   sessionId: z.string().optional(),
   attachments: z.array(UserAttachment).max(MAX_USER_ATTACHMENTS).optional(),
   /** Attachments that came ahead of this message, by id. */
@@ -122,6 +124,8 @@ export const AgentEvent = z.object({
   type: z.literal("agent.event"),
   text: z.string(),
   requestId: z.string().optional(),
+  /** Explicit compatible opt-in for native question file/image replies. */
+  questionReplyFormat: z.literal("attachments-v1").optional(),
   kind: z.enum(["question", "status", "response"]).optional(),
   sessionId: z.string().optional(),
   agent: CodingAgent.optional(),