granttap-mcp 0.8.104 → 0.8.105

package/apps/bridge/src/codex-desktop/README.md

@@ -29,3 +29,8 @@ consumed them. Tests exercise native delivery, framing, socket trust, durable
 deduplication, and refusal without launching the CLI.
 
 License: GrantTap Commercial Source License in the repository-root `LICENSE`.
+
+Document staging for a native-only question keeps the file note inside its
+original answer envelope. The host's native question and all paired controllers
+therefore observe the same question item as answered; document paths remain
+available to the admitted turn. Ordinary chat text is unchanged.

package/apps/bridge/src/codex-desktop/index.ts

@@ -1,3 +1,4 @@
+import { nativeQuestionAttachmentEnvelope } from './question-attachment-envelope';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import type { SessionInfo } from '../../../../packages/protocol/schema';
@@ -72,7 +73,7 @@ function turnRequest(input: { session: SessionInfo; text: string; images: string
       networkAccess: false, excludeTmpdirEnvVar: false, excludeSlashTmp: false }
     : access === 'full' ? { type: 'dangerFullAccess' } : undefined;
   return { threadId: session.sessionId, clientUserMessageId: options.messageId ?? randomUUID(),
-    input: [{ type: 'text', text, text_elements: [] }, ...images.map(path => ({ type: 'localImage', path }))],
+    input: [{ type: 'text', text: options.nativeOnly ? nativeQuestionAttachmentEnvelope(text) : text, text_elements: [] }, ...images.map(path => ({ type: 'localImage', path }))],
     ...(options.model ? { model: options.model } : {}), ...(effort ? { effort } : {}),
     ...(sandboxPolicy ? { sandboxPolicy } : {}) };
 }

package/apps/bridge/src/codex-desktop/question-attachment-envelope.ts

@@ -0,0 +1,23 @@
+/** Preserve the native question envelope after document staging appends its local file note. */
+export function nativeQuestionAttachmentEnvelope(text: string): string {
+  const opening = '<send_user_message_question_reply>';
+  const closing = '</send_user_message_question_reply>';
+  const boundary = text.lastIndexOf(closing);
+  if (!text.startsWith(opening) || boundary < opening.length) return text;
+  const note = text.slice(boundary + closing.length);
+  const header = '\n\nAttached files available locally:\n';
+  if (!note.startsWith(header)) return text;
+  const files = note.slice(header.length).split('\n');
+  if (!files.length || files.some(line => !/^- .+: .+$/.test(line))) return text;
+  try {
+    const rows = JSON.parse(text.slice(opening.length, boundary));
+    if (!Array.isArray(rows) || rows.length !== 1 || typeof rows[0]?.questionItemId !== 'string'
+      || typeof rows[0]?.answer !== 'string') return text;
+    const identity = JSON.parse(rows[0].questionItemId);
+    if (!Array.isArray(identity) || identity.length !== 3 || identity[0] !== 'request_user_input_async'
+      || typeof identity[1] !== 'string' || !/^[a-zA-Z0-9_-]{1,180}$/.test(identity[1])
+      || !Number.isInteger(identity[2]) || identity[2] < 0 || identity[2] > 3) return text;
+    rows[0].answer += note;
+    return opening + '\n' + JSON.stringify(rows) + '\n' + closing;
+  } catch { return text; }
+}

package/apps/bridge/src/codex-questions/README.md

@@ -25,3 +25,10 @@ Tests under `tests/` cover publication, reconnect replay, native acknowledgement
 scope rejection, expiry and delivery through an isolated native IPC fixture.
 
 License: GrantTap Commercial Source License in the repository-root `LICENSE`.
+
+Attachment-capable controllers opt in using the advertised
+`questionReplyFormat: attachments-v1`. The original question item owns the
+answer, image and file payload together; ordinary encrypted attachment transport,
+Task policy, native-owner admission and stable question idempotency still apply.
+Legacy text-only replies keep their existing contract. Files remain available
+for the admitted native turn; another phone cannot start a second answer.

package/apps/bridge/src/codex-questions/index.ts

@@ -40,6 +40,7 @@ export async function publishCodexQuestions(client: RelayClient, sessions: Sessi
       } else if (!record.announced || options.replay) {
         const text = [record.question, ...record.options.map(value => '• ' + value)].join('\n');
         await client.send({ type: 'agent.event', kind: 'question', requestId: record.requestId,
+          questionReplyFormat: 'attachments-v1',
           sessionId: session.sessionId, agent: 'codex', projectId: session.projectId,
           taskId: session.taskId, computerId: session.computerId, text, createdAt: record.createdAt },
         'phone', { ttlMs: Math.max(1, record.createdAt + RETENTION_MS - Date.now()),
@@ -73,8 +74,9 @@ export async function handleCodexQuestionReply(client: RelayClient, message: Use
     await resolveQuestion(client, record, peerPublicKey, !record.answered);
     return true;
   }
-  if (!message.text.trim() || message.text.length > 4_000 || message.attachments?.length
-    || message.attachmentRefs?.length) return false;
+  const hasAttachments = !!(message.attachments?.length || message.attachmentRefs?.length);
+  if (!message.text.trim() || message.text.length > 4_000
+    || (hasAttachments && message.questionReplyFormat !== 'attachments-v1')) return false;
   return deliver(client, { ...message, requestId: undefined,
     messageId: message.messageId ?? 'codex-answer-' + record.requestId,
     text: nativeAnswerEnvelope(record, message.text) }, publish, peerPublicKey,

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.104
+npm install -g granttap-mcp@0.8.105
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.104\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.105\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.104";
+const PACKAGE = "granttap-mcp@0.8.105";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.104",
+  "version": "0.8.105",
   "description": "Commercial computer runtime connecting local coding agents to GrantTap on Mac, iPhone, iPad and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/interaction/index.ts

@@ -49,6 +49,8 @@ export const UserMessage = z.object({
   agent: CodingAgent.optional(),
   cwd: z.string().max(4_096).optional(),
   requestId: z.string().optional(),
+  /** Explicit compatible opt-in for native question file/image replies. */
+  questionReplyFormat: z.literal("attachments-v1").optional(),
   sessionId: z.string().optional(),
   attachments: z.array(UserAttachment).max(MAX_USER_ATTACHMENTS).optional(),
   /** Attachments that came ahead of this message, by id. */
@@ -122,6 +124,8 @@ export const AgentEvent = z.object({
   type: z.literal("agent.event"),
   text: z.string(),
   requestId: z.string().optional(),
+  /** Explicit compatible opt-in for native question file/image replies. */
+  questionReplyFormat: z.literal("attachments-v1").optional(),
   kind: z.enum(["question", "status", "response"]).optional(),
   sessionId: z.string().optional(),
   agent: CodingAgent.optional(),