granttap-mcp 0.8.12 → 0.8.14

package/apps/mcp/src/http-server.ts

@@ -14,11 +14,10 @@ import {
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import express from "express";
-import QRCode from "qrcode";
-import { createOneTimePairing, DEFAULT_RELAY } from "../../bridge/src/pairing";
 import { inspectAgentIntegrations } from "../../bridge/src/install";
 import { createGrantTapServer, relay, resetRelay } from "./create-server";
 import { isAllowedLoopbackOrigin } from "./oauth/loopback-origin";
+import { installPairingRoutes } from "./oauth/pairing-view";
 import { GrantTapOAuthProvider } from "./oauth-provider";
 import { isMachineConfigured } from "./pairing-status";
 
@@ -67,6 +66,7 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
   // authorization. The random pending id lives in the website URL fragment,
   // never in a request to the website server.
   app.use(["/oauth/session", "/oauth/pairing", "/oauth/decision"], (req, res, next) => {
+    if (req.originalUrl.split("?", 1)[0] === "/oauth/pairing/view") return next();
     const origin = req.get("origin");
     if (origin && origin !== "https://granttap.com"
         && !isAllowedLoopbackOrigin(origin, issuerUrl.origin)) {
@@ -105,58 +105,7 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
     });
   });
 
-  app.post("/oauth/pairing", async (req, res) => {
-    res.set("Cache-Control", "no-store");
-    try {
-      const origin = req.get("origin");
-      if (!isAllowedLoopbackOrigin(origin, issuerUrl.origin)) {
-        res.status(403).json({ error: "Cross-origin pairing requests are not allowed." });
-        return;
-      }
-      const pendingId = String(req.body?.pending_id ?? "");
-      if (!provider.getPending(pendingId)) {
-        res.status(400).json({ error: "Authorization request expired. Start authorization again from your MCP client." });
-        return;
-      }
-      if (isMachineConfigured() && req.body?.confirmed !== "true") {
-        res.json({ ok: true, alreadyPaired: true });
-        return;
-      }
-      const pairing = await createOneTimePairing(
-        process.env.GRANTTAP_RELAY_URL ?? process.env.NODVOX_RELAY_URL ?? DEFAULT_RELAY,
-        { installHooks: false },
-      );
-      resetRelay();
-      void relay();
-      const png = await QRCode.toBuffer(pairing.qrPayload, {
-        type: "png",
-        width: 480,
-        margin: 2,
-        errorCorrectionLevel: "L",
-      });
-      res.json({
-        ok: true,
-        alreadyPaired: false,
-        qrDataUrl: `data:image/png;base64,${png.toString("base64")}`,
-        manualToken: pairing.manualToken,
-        relay: pairing.httpBase,
-        providers: [
-          pairing.claude && {
-            id: "claude",
-            status: pairing.claude.status === "manual" ? "action_required" : "connected",
-          },
-          pairing.codex && {
-            id: "codex",
-            status: pairing.codex.status === "manual" ? "action_required" : "connected",
-          },
-        ].filter(Boolean),
-      });
-    } catch (error) {
-      res.status(500).json({
-        error: error instanceof Error ? error.message : String(error),
-      });
-    }
-  });
+  installPairingRoutes(app, provider, issuerUrl.origin);
 
   app.post("/oauth/decision", (req, res) => {
     res.set("Cache-Control", "no-store");

package/apps/mcp/src/http-service/installer.ts

@@ -58,7 +58,14 @@ function validateInstallation(nodeBin: string, executable: string): InstallResul
 }
 
 function createPlist(nodeBin: string, executable: string, mcpUrl: URL, logsDir: string): string | Error {
-  const environment = serviceEnvironment(nodeBin, mcpUrl);
+  let packageVersion: string;
+  try {
+    packageVersion = (JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")) as { version: string }).version;
+    if (!/^\d+\.\d+\.\d+$/.test(packageVersion)) throw new Error("Invalid package version");
+  } catch {
+    return new Error("Installed GrantTap package version could not be read.");
+  }
+  const environment = serviceEnvironment(nodeBin, mcpUrl, packageVersion);
   if (environment instanceof Error) return environment;
   const logPath = join(logsDir, "http-mcp.log");
   return [
@@ -79,12 +86,13 @@ function createPlist(nodeBin: string, executable: string, mcpUrl: URL, logsDir:
   ].join("\n");
 }
 
-function serviceEnvironment(nodeBin: string, mcpUrl: URL): Array<[string, string]> | Error {
+function serviceEnvironment(nodeBin: string, mcpUrl: URL, packageVersion: string): Array<[string, string]> | Error {
   const path = [dirname(nodeBin), join(homedir(), ".local", "bin"), "/usr/local/bin", "/opt/homebrew/bin", "/usr/bin", "/bin"].join(":");
   const values: Array<[string, string]> = [
     ["GRANTTAP_CONFIG_DIR", configDir()],
     ["GRANTTAP_MCP_HTTP_HOST", mcpUrl.hostname.replace(/^\[(.*)\]$/, "$1")],
     ["GRANTTAP_MCP_HTTP_PORT", mcpUrl.port],
+    ["GRANTTAP_PACKAGE_VERSION", packageVersion],
     ["PATH", path],
   ];
   const rawRelayUrl = process.env.GRANTTAP_RELAY_URL ?? process.env.NODVOX_RELAY_URL;

package/apps/mcp/src/oauth/pairing-view.ts

@@ -0,0 +1,102 @@
+/** Pairing secrets are rendered by the loopback origin, never returned to site JavaScript. */
+import { randomUUID } from "node:crypto";
+import type { Express } from "express";
+import QRCode from "qrcode";
+import { createOneTimePairing, DEFAULT_RELAY } from "../../../bridge/src/pairing";
+import { relay, resetRelay } from "../create-server";
+import { isMachineConfigured } from "../pairing-status";
+import type { GrantTapOAuthProvider } from "../oauth-provider";
+import { isAllowedLoopbackOrigin } from "./loopback-origin";
+
+const WEBSITE_ORIGIN = "https://granttap.com";
+const VIEW_TTL_MS = 15 * 60_000;
+type View = { qrDataUrl: string; manualToken: string; expiresAt: number };
+
+function escapeHtml(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+
+function renderView(view: View, nonce: string): string {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>GrantTap phone pairing</title><style>
+html{color-scheme:dark}body{margin:0;padding:18px;font:16px system-ui,sans-serif;color:#f6f6f6;background:#191919;text-align:center}
+img{display:block;box-sizing:border-box;width:min(100%,280px);height:auto;margin:12px auto;padding:12px;background:#fff;border-radius:12px}
+code{display:block;overflow-wrap:anywhere;padding:12px;background:#252525;border-radius:8px;user-select:all}
+button{padding:10px 18px;border:0;border-radius:8px;background:#f47a45;color:#161616;font-weight:700;cursor:pointer}
+</style></head><body><h2>Scan in GrantTap on your iPhone</h2>
+<img src="${view.qrDataUrl}" alt="One-time GrantTap pairing QR">
+<p>Or enter this one-time code in the app:</p><code id="token">${escapeHtml(view.manualToken)}</code>
+<p><button id="copy" type="button">Copy code</button></p>
+<script nonce="${nonce}">document.getElementById('copy').addEventListener('click',async()=>{
+const button=document.getElementById('copy');try{await navigator.clipboard.writeText(document.getElementById('token').textContent);button.textContent='Copied'}catch{button.textContent='Select the code and copy it'}
+});</script></body></html>`;
+}
+
+export function installPairingRoutes(app: Express, provider: GrantTapOAuthProvider, issuerOrigin: string): void {
+  const views = new Map<string, View>();
+  app.post("/oauth/pairing", async (req, res) => {
+    res.set("Cache-Control", "no-store");
+    try {
+      const origin = req.get("origin");
+      if (!isAllowedLoopbackOrigin(origin, issuerOrigin)) {
+        res.status(403).json({ error: "Cross-origin pairing requests are not allowed." });
+        return;
+      }
+      const pendingId = String(req.body?.pending_id ?? "");
+      if (!provider.getPending(pendingId)) {
+        res.status(400).json({ error: "Authorization request expired. Start authorization again from your MCP client." });
+        return;
+      }
+      if (isMachineConfigured() && req.body?.confirmed !== "true") {
+        res.json({ ok: true, alreadyPaired: true });
+        return;
+      }
+      const pairing = await createOneTimePairing(
+        process.env.GRANTTAP_RELAY_URL ?? process.env.NODVOX_RELAY_URL ?? DEFAULT_RELAY,
+        { installHooks: false },
+      );
+      resetRelay();
+      void relay();
+      const png = await QRCode.toBuffer(pairing.qrPayload, {
+        type: "png", width: 480, margin: 2, errorCorrectionLevel: "L",
+      });
+      const qrDataUrl = `data:image/png;base64,${png.toString("base64")}`;
+      if (origin === WEBSITE_ORIGIN) {
+        for (const [id, view] of views) if (view.expiresAt <= Date.now()) views.delete(id);
+        if (views.size >= 16) views.delete(views.keys().next().value!);
+        const viewId = randomUUID();
+        views.set(viewId, { qrDataUrl, manualToken: pairing.manualToken, expiresAt: Date.now() + VIEW_TTL_MS });
+        res.json({ ok: true, alreadyPaired: false, viewId });
+        return;
+      }
+      res.json({
+        ok: true, alreadyPaired: false, qrDataUrl, manualToken: pairing.manualToken,
+        relay: pairing.httpBase,
+        providers: [
+          pairing.claude && { id: "claude", status: pairing.claude.status === "manual" ? "action_required" : "connected" },
+          pairing.codex && { id: "codex", status: pairing.codex.status === "manual" ? "action_required" : "connected" },
+        ].filter(Boolean),
+      });
+    } catch (error) {
+      res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+
+  app.get("/oauth/pairing/view", (req, res) => {
+    const view = views.get(String(req.query.view_id ?? ""));
+    if (!view || view.expiresAt <= Date.now()) {
+      res.status(404).json({ error: "Pairing code expired. Start again from your coding app." });
+      return;
+    }
+    const nonce = randomUUID().replaceAll("-", "");
+    res.set({
+      "Cache-Control": "no-store",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": `default-src 'none'; img-src data:; style-src 'unsafe-inline'; script-src 'nonce-${nonce}'; frame-ancestors ${WEBSITE_ORIGIN}; base-uri 'none'; form-action 'none'`,
+    });
+    res.type("html").send(renderView(view, nonce));
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.12",
+  "version": "0.8.14",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {