granttap-mcp 0.8.14 → 0.8.16

package/README.md

@@ -223,7 +223,8 @@ grok plugin marketplace add sergii-ziborov/granttap-mcp
 grok plugin install granttap --trust
 ```
 
-Install **GrantTap** from the Cursor plugin marketplace, then open
+Import `sergii-ziborov/granttap-mcp` as a private Git plugin in Cursor. A public
+listing requires an open-source plugin license and Cursor review. Reload Cursor, then open
 **Cursor Customize → MCPs → GrantTap → Authenticate**. Complete authorization
 and any one-time QR pairing on `https://granttap.com/connect`.
 

package/apps/bridge/src/bin/setup.ts

@@ -13,7 +13,7 @@ import { createOneTimePairing, DEFAULT_RELAY, PAIRING_CODE_TTL_MINUTES } from ".
 import { declareEngine } from "../engine/engine-declaration";
 import { isMachineConfigured } from "../../../mcp/src/pairing-status";
 import { installCursorHttpConfig } from "../../../mcp/src/cursor-config";
-import { installHttpMcpService } from "../../../mcp/src/http-service";
+import { installHttpMcpService, waitForHttpMcpHealth } from "../../../mcp/src/http-service";
 
 function state(result: InstallResult): string {
   return result.status === "manual" ? "Needs attention" : "Ready";
@@ -67,6 +67,10 @@ async function main(): Promise<void> {
   const mcpClientInstalled = before.agents.some((item) => item.installed);
   if (before.cursor.installed || mcpClientInstalled) {
     httpService = installHttpMcpService();
+    if (process.platform === "win32" && httpService.status !== "manual"
+      && !await waitForHttpMcpHealth(undefined, 15_000)) {
+      httpService = { status: "manual", detail: "Windows background service did not become healthy." };
+    }
     if (before.cursor.installed && httpService.status !== "manual") {
       cursorConfig = installCursorHttpConfig();
     }

package/apps/bridge/src/install.ts

@@ -28,6 +28,7 @@ import { spawnSync } from "node:child_process";
 import type { CodingAgent } from "../../../packages/protocol/schema";
 import { refusesLiveLaunchd } from "./launchd-safety";
 import { configDir, loadRuntimeConfig, verifiableEngine } from "./config";
+import { inspectWindowsTask, installWindowsTask } from "./windows-service";
 
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
 
@@ -287,6 +288,7 @@ export type MonitorIntegrationStatus = {
 
 /** Read-only status check. It never installs, reloads, or repairs the helper. */
 export function inspectMonitorHelper(): MonitorIntegrationStatus {
+  if (process.platform === "win32") return inspectWindowsTask("monitor");
   if (process.platform !== "darwin") return { configured: false, running: false };
   const agentsDir = process.env.GRANTTAP_LAUNCH_AGENTS_DIR
     ?? join(homedir(), "Library", "LaunchAgents");
@@ -340,7 +342,8 @@ function xml(value: string): string {
 }
 
 export function isCursorHelperNode(nodePath: string): boolean {
-  return nodePath.includes("Cursor.app") || nodePath.includes("/helpers/node");
+  return /Cursor\.app|[\\/]Cursor[\\/].*[\\/]helpers[\\/]node/i.test(nodePath)
+    || nodePath.includes("/helpers/node");
 }
 
 /** True when a plist uses the caller's explicit development monitor pin. */
@@ -407,6 +410,12 @@ function engineEnvironment(): string[] {
 }
 
 export function installMonitorHelper(): InstallResult {
+  if (process.platform === "win32") {
+    const node = resolveMonitorNodeBin();
+    return node && !isCursorHelperNode(node)
+      ? installWindowsTask("monitor", node, join(repoRoot, "bin", "granttap-mcp.mjs"))
+      : { status: "manual", detail: "A stable Node.js 20+ installation is required for Windows background sync." };
+  }
   if (process.platform !== "darwin") {
     return { status: "manual", detail: "background task sync currently requires macOS" };
   }

package/apps/bridge/src/windows-service.ts

@@ -0,0 +1,135 @@
+/** Per-user Windows Task Scheduler jobs for the loopback MCP and phone monitor. */
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { configDir } from "./config";
+import type { InstallResult } from "./install";
+
+export type WindowsJob = "http" | "monitor";
+const names: Record<WindowsJob, string> = {
+  http: "GrantTap MCP HTTP",
+  monitor: "GrantTap Phone Monitor",
+};
+
+export function windowsTaskName(job: WindowsJob): string { return names[job]; }
+
+function xml(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+
+export function windowsTaskDefinition(job: WindowsJob, node: string, launcher: string, owner = "TestUser", version = "0.0.0"): string {
+  const date = new Date(Date.now() - 60_000);
+  const local = new Date(date.getTime() - date.getTimezoneOffset() * 60_000);
+  const start = local.toISOString().slice(0, 19);
+  const args = `"${launcher}" internal ${job === "http" ? "serve" : "monitor"}`;
+  return [
+    '<?xml version="1.0" encoding="UTF-16"?>',
+    '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
+    `<RegistrationInfo><Description>GrantTap ${xml(version)} ${job}</Description></RegistrationInfo>`,
+    "<Triggers><TimeTrigger>", `<StartBoundary>${start}</StartBoundary>`,
+    "<Enabled>true</Enabled><Repetition><Interval>PT1M</Interval></Repetition>",
+    "</TimeTrigger></Triggers>",
+    `<Principals><Principal id="Author"><UserId>${xml(owner)}</UserId>`,
+    "<LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>",
+    "<Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>",
+    "<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>",
+    "<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>",
+    "<StartWhenAvailable>true</StartWhenAvailable><ExecutionTimeLimit>PT0S</ExecutionTimeLimit>",
+    "<RestartOnFailure><Interval>PT1M</Interval><Count>3</Count></RestartOnFailure>",
+    "</Settings>",
+    `<Actions Context="Author"><Exec><Command>${xml(node)}</Command>`,
+    `<Arguments>${xml(args)}</Arguments><WorkingDirectory>${xml(dirname(launcher))}</WorkingDirectory>`,
+    "</Exec></Actions></Task>", "",
+  ].join("\n");
+}
+
+function taskXml(job: WindowsJob): string | null {
+  const result = spawnSync("schtasks.exe", ["/Query", "/TN", names[job], "/XML"], { windowsHide: true });
+  if (result.status !== 0) return null;
+  const output = result.stdout;
+  return output[0] === 0xff && output[1] === 0xfe || output.includes(0)
+    ? output.toString("utf16le").replace(/^\uFEFF/, "")
+    : output.toString("utf8");
+}
+
+function owned(job: WindowsJob, data: string): boolean {
+  return /<Command>[^<]*node\.exe<\/Command>/i.test(data)
+    && /granttap-mcp\.mjs(?:&quot;|\")? internal (?:serve|monitor)/i.test(data)
+    && data.includes(`internal ${job === "http" ? "serve" : "monitor"}`);
+}
+
+function identity(): string | null {
+  const result = spawnSync("whoami.exe", [], { encoding: "utf8", windowsHide: true });
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+
+function taskFile(job: WindowsJob): string { return join(configDir(), `windows-${job}-task.xml`); }
+
+export function inspectWindowsTask(job: WindowsJob): { configured: boolean; running: boolean } {
+  const data = taskXml(job);
+  if (!data || !owned(job, data)) return { configured: false, running: false };
+  const state = spawnSync("powershell.exe", [
+    "-NoProfile", "-NonInteractive", "-Command",
+    `(Get-ScheduledTask -TaskName '${names[job]}').State.ToString()`,
+  ], { encoding: "utf8", windowsHide: true });
+  return { configured: true, running: state.status === 0 && state.stdout.trim() === "Running" };
+}
+
+export function installWindowsTask(job: WindowsJob, node: string, launcher: string, forceReload = false): InstallResult {
+  if (!existsSync(node) || !existsSync(launcher)) {
+    return { status: "manual", detail: "Stable Node.js and granttap-mcp installation are required on Windows." };
+  }
+  const previous = taskXml(job);
+  if (previous && !owned(job, previous)) {
+    return { status: "manual", detail: `The existing ${names[job]} task is not owned by GrantTap.` };
+  }
+  const owner = identity();
+  if (!owner) return { status: "manual", detail: "Could not identify the current Windows user." };
+  let version: string;
+  try {
+    version = (JSON.parse(readFileSync(join(dirname(launcher), "..", "package.json"), "utf8")) as { version: string }).version;
+    if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error("invalid version");
+  } catch {
+    return { status: "manual", detail: "Installed GrantTap package version could not be read." };
+  }
+  const path = taskFile(job);
+  const definition = windowsTaskDefinition(job, node, launcher, owner, version);
+  const previousCommand = previous?.match(/<Command>([^<]*)<\/Command>/)?.[1];
+  const previousArgs = previous?.match(/<Arguments>([^<]*)<\/Arguments>/)?.[1];
+  const normalizedArgs = previousArgs?.replaceAll("&quot;", '"').replaceAll("&amp;", "&");
+  const already = previousCommand === xml(node)
+    && normalizedArgs === `"${launcher}" internal ${job === "http" ? "serve" : "monitor"}`
+    && previous?.includes("<Interval>PT1M</Interval>") === true
+    && previous.includes(`<Description>GrantTap ${version} ${job}</Description>`);
+  if (already && !forceReload && inspectWindowsTask(job).running) return { status: "already", detail: names[job] };
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  // Task Scheduler reads an XML file; keep it private to this user's config directory.
+  writeFileSync(path, `\uFEFF${definition}`, { encoding: "utf16le", mode: 0o600 });
+  const created = spawnSync("schtasks.exe", ["/Create", "/TN", names[job], "/XML", path, "/F"], {
+    encoding: "utf8", windowsHide: true,
+  });
+  unlinkSync(path);
+  if (created.status !== 0) return { status: "manual", detail: `${names[job]} could not be registered for this Windows user.` };
+  if (previous && (forceReload || !already)) {
+    spawnSync("schtasks.exe", ["/End", "/TN", names[job]], { windowsHide: true });
+  }
+  const started = spawnSync("schtasks.exe", ["/Run", "/TN", names[job]], { encoding: "utf8", windowsHide: true });
+  return started.status === 0
+    ? { status: already ? "already" : "installed", detail: names[job] }
+    : { status: "manual", detail: `${names[job]} was registered but did not start.` };
+}
+
+export function snapshotWindowsTask(job: WindowsJob): string | null { return taskXml(job); }
+
+export function restoreWindowsTask(job: WindowsJob, previous: string | null): boolean {
+  const current = taskXml(job);
+  if (!current || !owned(job, current) || (previous && !owned(job, previous))) return false;
+  spawnSync("schtasks.exe", ["/End", "/TN", names[job]], { windowsHide: true });
+  if (!previous) return spawnSync("schtasks.exe", ["/Delete", "/TN", names[job], "/F"], { windowsHide: true }).status === 0;
+  const path = taskFile(job);
+  writeFileSync(path, `\uFEFF${previous}`, { encoding: "utf16le", mode: 0o600 });
+  const restored = spawnSync("schtasks.exe", ["/Create", "/TN", names[job], "/XML", path, "/F"], { windowsHide: true });
+  unlinkSync(path);
+  return restored.status === 0 && spawnSync("schtasks.exe", ["/Run", "/TN", names[job]], { windowsHide: true }).status === 0;
+}

package/apps/mcp/src/bin/authorize.ts

@@ -13,7 +13,6 @@ import {
   waitForHttpMcpHealth,
 } from "../http-service";
 import type { InstallResult } from "../../../bridge/src/install";
-import { existsSync } from "node:fs";
 
 async function authorize(): Promise<void> {
   const preflight = validateCursorHttpConfig();
@@ -33,7 +32,7 @@ async function authorize(): Promise<void> {
     if (alreadyHealthy) {
       if (before.configured && before.running) {
         service = { status: "already", detail: httpMcpLaunchAgentPath() };
-      } else if (existsSync(httpMcpLaunchAgentPath())) {
+      } else if (serviceBefore.exists) {
         repairAttempted = true;
         service = installHttpMcpService({ forceReload: true });
       } else {
@@ -70,9 +69,9 @@ async function authorize(): Promise<void> {
       [
         `[granttap-mcp] Cursor · Configured — ${cursor.detail}`,
         `[granttap-mcp] Persistent local OAuth is healthy at ${mcpUrl}`,
-        `[granttap-mcp] LaunchAgent: ${service.status} (${service.detail})`,
+        `[granttap-mcp] Background service: ${service.status} (${service.detail})`,
         "[granttap-mcp] Open Cursor Customize → MCPs → GrantTap → Authenticate. The browser continues at granttap.com/connect.",
-        "[granttap-mcp] If this Mac is not paired, granttap.com/connect shows a QR and manual token.",
+        "[granttap-mcp] If this computer is not paired, granttap.com/connect shows a QR and manual token.",
         "",
       ].join("\n"),
     );

package/apps/mcp/src/http-service/common.ts

@@ -7,6 +7,7 @@ export const packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "
 export const HTTP_SERVICE_LABEL = "com.granttap.mcp-http";
 
 export function httpMcpLaunchAgentPath(): string {
+  if (process.platform === "win32") return "GrantTap MCP HTTP";
   const agentsDir = process.env.GRANTTAP_LAUNCH_AGENTS_DIR
     ?? join(homedir(), "Library", "LaunchAgents");
   return join(agentsDir, `${HTTP_SERVICE_LABEL}.plist`);

package/apps/mcp/src/http-service/installer.ts

@@ -5,13 +5,14 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { isCursorHelperNode, resolveMonitorNodeBin, type InstallResult } from "../../../bridge/src/install";
 import { configDir, normalizeRelayUrl } from "../../../bridge/src/config";
+import { installWindowsTask } from "../../../bridge/src/windows-service";
 import { configuredCursorHttpMcpUrl } from "../cursor-config";
 import { HTTP_SERVICE_LABEL, httpMcpLaunchAgentPath, packageRoot, xml } from "./common";
 import { inspectHttpMcpService, restoreHttpMcpServiceAfterFailure, snapshotHttpMcpService } from "./snapshot";
 
 /** Install/repair and load a per-user, loopback-only OAuth MCP daemon. */
 export function installHttpMcpService(options: { forceReload?: boolean } = {}): InstallResult {
-  if (process.platform !== "darwin") return macosOnly();
+  if (process.platform !== "darwin" && process.platform !== "win32") return macosOnly();
   const mcpUrl = configuredMcpUrl();
   if (mcpUrl instanceof Error) return { status: "manual", detail: mcpUrl.message };
   const nodeBin = safeNodeBin();
@@ -19,6 +20,12 @@ export function installHttpMcpService(options: { forceReload?: boolean } = {}):
   const executable = join(packageRoot, "bin", "granttap-mcp.mjs");
   const installation = validateInstallation(nodeBin, executable);
   if (installation) return installation;
+  if (process.platform === "win32") {
+    if (mcpUrl.href !== "http://127.0.0.1:17342/mcp") {
+      return { status: "manual", detail: "Windows background service currently uses the default loopback endpoint." };
+    }
+    return installWindowsTask("http", nodeBin, executable, options.forceReload);
+  }
   const path = httpMcpLaunchAgentPath();
   const logsDir = join(configDir(), "logs");
   const plist = createPlist(nodeBin, executable, mcpUrl, logsDir);

package/apps/mcp/src/http-service/snapshot.ts

@@ -11,6 +11,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname } from "node:path";
+import { inspectWindowsTask, restoreWindowsTask, snapshotWindowsTask, windowsTaskName } from "../../../bridge/src/windows-service";
 import {
   httpMcpLaunchAgentPath,
   isConfiguredHttpService,
@@ -32,6 +33,15 @@ export type HttpMcpServiceSnapshot = {
 
 /** Exact plist bytes/mode and loaded state for transactional repair rollback. */
 export function snapshotHttpMcpService(): HttpMcpServiceSnapshot {
+  if (process.platform === "win32") {
+    const task = snapshotWindowsTask("http");
+    const state = inspectWindowsTask("http");
+    return {
+      path: windowsTaskName("http"), exists: task !== null,
+      plist: task === null ? null : Buffer.from(task), mode: 0o600,
+      owned: state.configured, configured: state.configured, running: state.running,
+    };
+  }
   const path = httpMcpLaunchAgentPath();
   if (!existsSync(path)) return missingSnapshot(path);
   let plist: Buffer;
@@ -65,6 +75,7 @@ function unreadableSnapshot(path: string): HttpMcpServiceSnapshot {
 
 /** Read-only plist/process inspection. Health is probed separately. */
 export function inspectHttpMcpService(): HttpMcpServiceStatus {
+  if (process.platform === "win32") return inspectWindowsTask("http");
   if (process.platform !== "darwin") return { configured: false, running: false };
   const snapshot = snapshotHttpMcpService();
   return { configured: snapshot.configured, running: snapshot.configured && snapshot.running };
@@ -72,6 +83,10 @@ export function inspectHttpMcpService(): HttpMcpServiceStatus {
 
 /** Restore a failed repair, deleting the service only when this attempt created it. */
 export function restoreHttpMcpServiceAfterFailure(before: HttpMcpServiceSnapshot): boolean {
+  if (process.platform === "win32") {
+    if (before.exists && !before.owned) return false;
+    return restoreWindowsTask("http", before.plist?.toString("utf8") ?? null);
+  }
   if (before.exists && !before.owned) return false;
   const current = currentOwnedPlist(before.path);
   if (current === undefined) return false;

package/bin/granttap-mcp.mjs

@@ -2,7 +2,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
+import { delimiter, dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -107,7 +107,7 @@ const child = spawn(
     cwd: root,
     env: {
       ...process.env,
-      NODE_PATH: [join(root, "node_modules"), process.env.NODE_PATH].filter(Boolean).join(":"),
+      NODE_PATH: [join(root, "node_modules"), process.env.NODE_PATH].filter(Boolean).join(delimiter),
     },
   },
 );

package/cursor-plugin/.cursor-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "GrantTap for Cursor — authorize on granttap.com/connect and approve local tasks from your phone",
-    "version": "0.1.5"
+    "version": "0.1.6"
   },
   "plugins": [
     {

package/cursor-plugin/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "granttap",
   "displayName": "GrantTap",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Connect Cursor to GrantTap through granttap.com/connect, pair your phone with a one-time QR, and keep approvals in the originating chat.",
   "author": {
     "name": "GrantTap",

package/cursor-plugin/README.md

@@ -6,8 +6,7 @@ each phone response tied to the exact originating chat and prompt.
 
 ## Connect Cursor
 
-Install the supported CLI and the GrantTap plugin from Cursor's marketplace,
-then run:
+Install the supported CLI on this computer, then run:
 
 ```bash
 npm install -g granttap-mcp
@@ -25,19 +24,31 @@ The commands have separate jobs:
 
 After `granttap setup`, open **Cursor Customize → MCPs → GrantTap** and choose
 **Authenticate**. The browser opens granttap.com/connect to authorize Cursor.
-If the Mac is not paired, the website shows a one-time QR and manual-code
+If this computer is not paired, the website shows a one-time QR and manual-code
 fallback; a saved pairing is reused unless you explicitly confirm reconnect.
 
+On Windows, `granttap setup` registers the loopback MCP and phone monitor as
+least-privileged jobs under your signed-in account. Install Node.js 20+ and the
+current `granttap-mcp` package on that same Windows computer; the plugin alone
+cannot start the local server. The jobs restart after a crash and keep running
+when Cursor closes. Run `granttap status` to confirm readiness before choosing
+**Authenticate** in Cursor.
+
 The OAuth service listens only at `http://127.0.0.1:17342/mcp`. Cursor cannot
 show **Authenticate** for a stdio (`command`/`args`) MCP entry, so do not replace the
 plugin's HTTP configuration with stdio.
 
-## Install from the Cursor marketplace
-
-Install **GrantTap** from Cursor's plugin marketplace, then reload Cursor.
-The plugin adds the `/connect` command, a connect skill, and the
-exact-correlation rule; `granttap setup` still configures the MCP endpoint
-itself.
+## Install the Cursor plugin
+
+A public Cursor Marketplace listing requires an open-source plugin license and
+manual review. The current commercially licensed plugin is available as a
+private Git import: `sergii-ziborov/granttap-mcp`. Reload Cursor after import.
+The private listing is tied to the version imported on that computer; re-import
+it to pick up the current orange icon and plugin changes. If a public listing
+is later approved, install **GrantTap** from Cursor's marketplace to receive
+its reviewed updates. The plugin adds the `/connect` command, a connect
+skill, and the exact-correlation rule; `granttap setup` configures the local
+MCP endpoint separately.
 
 ## Exact dual-channel behavior
 

package/cursor-plugin/assets/logo.svg

@@ -1,7 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
-  <rect width="64" height="64" rx="14" fill="#0B1F17"/>
-  <circle cx="32" cy="32" r="18" stroke="#3DDC97" stroke-width="3"/>
-  <path d="M24 28c0-4.4 3.6-8 8-8h2" stroke="#3DDC97" stroke-width="3" stroke-linecap="round"/>
-  <path d="M40 36c0 4.4-3.6 8-8 8h-2" stroke="#3DDC97" stroke-width="3" stroke-linecap="round"/>
-  <circle cx="32" cy="32" r="3" fill="#3DDC97"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="GrantTap">
+  <rect width="64" height="64" rx="10" fill="#f47f42"/>
+  <path d="M11 31.5 24.5 45 42 19" fill="none" stroke="#1d130e" stroke-width="7" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M45.5 29v10M52 25v18M58.5 29v10" fill="none" stroke="#1d130e" stroke-width="5" stroke-linecap="round"/>
 </svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.14",
+  "version": "0.8.16",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {