granttap-mcp 0.8.20 → 0.8.21

package/apps/bridge/src/bin/runtime/monitor.ts

@@ -3,6 +3,8 @@ import { join } from "node:path";
 import { RelayClient } from "../../../../../packages/core/relay-client";
 import { configDir, loadConfig, machineConfigPath } from "../../config";
 import { EngineSupervisor } from "../../engine/runtime/engine-supervisor";
+import { meshSnapshots } from "../../mesh/runtime";
+import { recoverLocalGraphBindings } from "../../mesh/runtime/graph/binding-sync";
 import { startSessionMonitor } from "../../monitor";
 import { controllerPeerGate } from "../../pairing/controllers";
 
@@ -38,6 +40,13 @@ process.on("SIGINT", stop);
 process.on("SIGTERM", stop);
 
 void engine.ensureAvailable().then((health) => {
+  if (health.state === "healthy") {
+    // A new Engine binary starts with its own registry. Re-admit existing,
+    // locally verified Git bindings so linked repositories have a graph again.
+    void recoverLocalGraphBindings(meshSnapshots())
+      .then(() => monitor.publish())
+      .catch(() => undefined);
+  }
   if (health.state !== "disabled" && health.state !== "healthy") {
     const reason = health.reason ? `: ${health.reason}` : "";
     process.stderr.write(

package/apps/bridge/src/engine/protocol/transport/protocol-types.ts

@@ -45,6 +45,16 @@ export type EngineRepositoryGraph = {
     status: "SUPPORTED" | "CANDIDATE" | "CONTRADICTED" | "INSUFFICIENT_EVIDENCE";
     evidence: string[]; contradictions: string[]; unknowns: string[];
   }>;
+  code_map?: {
+    files: Array<{ path: string; language: string | null; line_count: number | null;
+      symbols: Array<{ id: string; label: string; kind: string;
+        start_line: number; line_count: number }> }>;
+    externals?: Array<{ id: string; label: string; kind: string }>;
+    roads: Array<{ source: string; target: string; relation: string }>;
+    total_files: number;
+    total_externals?: number;
+    truncated: boolean;
+  } | null;
   nodes: Array<{ id: string; kind: string; label: string }>;
   relations: Array<{ source: string; target: string; relation: string; evidence_count?: number }>;
   total_nodes: number;

package/apps/bridge/src/engine/protocol/transport/result-parser.ts

@@ -148,6 +148,7 @@ function parseRepositoryGraph(value: unknown): void {
       }
     }
   }
+  if (graph.code_map != null) parseCodeMap(graph.code_map);
   if (!Array.isArray(graph.nodes) || graph.nodes.length > 256
     || !Array.isArray(graph.relations) || graph.relations.length > 512
     || !Number.isSafeInteger(graph.total_nodes) || Number(graph.total_nodes) < 0
@@ -170,6 +171,55 @@ function parseRepositoryGraph(value: unknown): void {
   }
 }
 
+function parseCodeMap(value: unknown): void {
+  const map = requireObject(value, "repository code map");
+  if (!Array.isArray(map.files) || map.files.length > 650
+    || (map.externals != null && (!Array.isArray(map.externals) || map.externals.length > 24))
+    || !Array.isArray(map.roads) || map.roads.length > 1_200
+    || !Number.isSafeInteger(map.total_files) || Number(map.total_files) < map.files.length
+    || (map.total_externals != null && !Number.isSafeInteger(map.total_externals))
+    || Number(map.total_externals ?? 0) < (Array.isArray(map.externals) ? map.externals.length : 0)
+    || typeof map.truncated !== "boolean") invalidResult();
+  const paths = new Set<string>();
+  for (const value of map.files) {
+    const file = requireObject(value, "repository code file");
+    requireBoundedString(file.path, "code path", 512);
+    const path = file.path as string;
+    if (path.startsWith("/") || path.split("/").includes("..") || paths.has(path)) invalidResult();
+    paths.add(path);
+    requireOptionalString(file.language, "code language", 64);
+    if (file.line_count != null
+      && (!Number.isSafeInteger(file.line_count) || Number(file.line_count) < 1)) invalidResult();
+    if (!Array.isArray(file.symbols) || file.symbols.length > 72) invalidResult();
+    for (const value of file.symbols) {
+      const symbol = requireObject(value, "code symbol");
+      requireBoundedString(symbol.id, "code symbol id", 512);
+      requireBoundedString(symbol.label, "code symbol label", 160);
+      requireBoundedString(symbol.kind, "code symbol kind", 64);
+      if (!Number.isSafeInteger(symbol.start_line) || Number(symbol.start_line) < 1
+        || !Number.isSafeInteger(symbol.line_count) || Number(symbol.line_count) < 1) invalidResult();
+    }
+  }
+  for (const value of (map.externals ?? []) as unknown[]) {
+    const external = requireObject(value, "repository external resource");
+    requireBoundedString(external.id, "external id", 512);
+    requireBoundedString(external.label, "external label", 160);
+    requireBoundedString(external.kind, "external kind", 64);
+    const id = external.id as string;
+    if (!id.startsWith("ext:") || id.length < 5 || paths.has(id)) invalidResult();
+    paths.add(id);
+  }
+  for (const value of map.roads) {
+    const road = requireObject(value, "code road");
+    requireBoundedString(road.source, "road source", 512);
+    requireBoundedString(road.target, "road target", 512);
+    const source = road.source as string;
+    const target = road.target as string;
+    requireBoundedString(road.relation, "road relation", 64);
+    if (!paths.has(source) || !paths.has(target)) invalidResult();
+  }
+}
+
 function parseBackbone(value: unknown): void {
   const backbone = requireObject(value, "project backbone");
   requireBoundedString(backbone.project_id, "project_id", 128);

package/apps/bridge/src/engine/runtime/engine-projects.ts

@@ -15,6 +15,7 @@ import type {
   EngineContextEvidence,
 } from "../protocol/engine-protocol";
 import { RepositoryGraphJobs } from "./repository-graph-jobs";
+import { fitRepositoryGraph } from "./repository-graph/fit";
 
 export type LocalProjectBinding = {
   summary: ProjectBindingSummary;
@@ -26,8 +27,8 @@ export type LocalProjectBinding = {
 
 let sharedClient: EngineClient | undefined;
 const pendingBindingSyncs = new Map<string, Promise<boolean>>();
-const MAX_REPOSITORY_GRAPH_WIRE_BYTES = 128 * 1_024;
-const MAX_SINGLE_GRAPH_WIRE_BYTES = 48 * 1_024;
+const MAX_REPOSITORY_GRAPH_WIRE_BYTES = 256 * 1_024;
+const MAX_SINGLE_GRAPH_WIRE_BYTES = 192 * 1_024;
 const repositoryGraphJobs = new RepositoryGraphJobs<ProjectRepositoryGraph>();
 
 export async function syncProjectBinding(
@@ -211,6 +212,20 @@ async function analyzeRepositoryGraph(
       analysisId: graph.analysis_id ?? undefined,
       analysisStatus: graph.analysis_status,
       architectureHypotheses: graph.architecture_hypotheses,
+      codeMap: graph.code_map ? {
+        files: graph.code_map.files.map((file) => ({
+          path: file.path, language: file.language, lineCount: file.line_count,
+          symbols: file.symbols.map((symbol) => ({
+            id: symbol.id, label: symbol.label, kind: symbol.kind,
+            startLine: symbol.start_line, lineCount: symbol.line_count,
+          })),
+        })),
+        externals: graph.code_map.externals ?? [],
+        roads: graph.code_map.roads,
+        totalFiles: graph.code_map.total_files,
+        totalExternals: graph.code_map.total_externals ?? 0,
+        truncated: graph.code_map.truncated,
+      } : undefined,
       nodes: graph.nodes,
       relations: graph.relations.map((edge) => ({
         source: edge.source, target: edge.target, relation: edge.relation,
@@ -249,27 +264,6 @@ function boundRepositoryGraphs(graphs: ProjectRepositoryGraph[]): ProjectReposit
   return result;
 }
 
-function fitRepositoryGraph(
-  graph: ProjectRepositoryGraph,
-  maxBytes: number,
-): ProjectRepositoryGraph | undefined {
-  let nodes = graph.nodes;
-  let relations = graph.relations;
-  let bounded = graph;
-  while (Buffer.byteLength(JSON.stringify(bounded), "utf8") > maxBytes
-    && (nodes.length > 8 || relations.length > 8)) {
-    if (relations.length >= nodes.length && relations.length > 8) {
-      relations = relations.slice(0, Math.max(8, Math.floor(relations.length / 2)));
-    } else if (nodes.length > 8) {
-      nodes = nodes.slice(0, Math.max(8, Math.floor(nodes.length / 2)));
-      const ids = new Set(nodes.map((node) => node.id));
-      relations = relations.filter((edge) => ids.has(edge.source) && ids.has(edge.target));
-    }
-    bounded = { ...graph, nodes, relations, truncated: true };
-  }
-  return Buffer.byteLength(JSON.stringify(bounded), "utf8") <= maxBytes ? bounded : undefined;
-}
-
 function defaultClient(): EngineClient {
   sharedClient ??= new EngineClient({ socketPath: join(configDir(), "engine.sock") });
   return sharedClient;

package/apps/bridge/src/engine/runtime/repository-graph/fit.ts

@@ -0,0 +1,86 @@
+import type { ProjectRepositoryGraph } from "../../../../../../packages/protocol/schema";
+
+type CodeMap = NonNullable<ProjectRepositoryGraph["codeMap"]>;
+type Relation = ProjectRepositoryGraph["relations"][number];
+
+/** Keep a navigable code city and the strongest architecture evidence in the snapshot envelope. */
+export function fitRepositoryGraph(
+  graph: ProjectRepositoryGraph,
+  maxBytes: number,
+): ProjectRepositoryGraph | undefined {
+  let bounded = graph;
+  const bytes = () => Buffer.byteLength(JSON.stringify(bounded), "utf8");
+  if (bytes() <= maxBytes) return bounded;
+  if (bounded.relations.length > 128) {
+    bounded = { ...bounded, relations: strongestRelations(bounded.relations, 128), truncated: true };
+  }
+  while (bytes() > maxBytes) {
+    const map = bounded.codeMap;
+    if (map?.files.some((file) => file.symbols.length > 0)) {
+      bounded = { ...bounded, codeMap: trimSymbols(map) };
+    } else if (bounded.relations.length > 8) {
+      bounded = { ...bounded, relations: strongestRelations(bounded.relations,
+        Math.ceil(bounded.relations.length / 2)), truncated: true };
+    } else if (bounded.nodes.length > 8) {
+      const nodes = bounded.nodes.slice(0, Math.ceil(bounded.nodes.length / 2));
+      const ids = new Set(nodes.map((node) => node.id));
+      bounded = { ...bounded, nodes, relations: bounded.relations.filter((edge) =>
+        ids.has(edge.source) && ids.has(edge.target)), truncated: true };
+    } else if (map && map.roads.length > 16) {
+      bounded = { ...bounded, codeMap: { ...map, truncated: true,
+        roads: map.roads.slice(0, Math.ceil(map.roads.length / 2)) } };
+    } else if (map && map.files.length > 8) {
+      bounded = { ...bounded, codeMap: trimFiles(map) };
+    } else if (map) {
+      bounded = { ...bounded, codeMap: undefined };
+    } else {
+      return undefined;
+    }
+  }
+  return bounded;
+}
+
+function strongestRelations(relations: Relation[], limit: number): Relation[] {
+  return relations.map((edge, index) => ({ edge, index }))
+    .sort((left, right) => (right.edge.evidenceCount ?? 0) - (left.edge.evidenceCount ?? 0)
+      || left.index - right.index)
+    .slice(0, limit).sort((left, right) => left.index - right.index)
+    .map(({ edge }) => edge);
+}
+
+function roadDegree(map: CodeMap): Map<string, number> {
+  const degree = new Map<string, number>();
+  for (const road of map.roads) {
+    degree.set(road.source, (degree.get(road.source) ?? 0) + 1);
+    degree.set(road.target, (degree.get(road.target) ?? 0) + 1);
+  }
+  return degree;
+}
+
+function rankedFiles(map: CodeMap): CodeMap["files"] {
+  const degree = roadDegree(map);
+  return [...map.files].sort((left, right) =>
+    (degree.get(right.path) ?? 0) - (degree.get(left.path) ?? 0)
+      || (right.lineCount ?? 0) - (left.lineCount ?? 0)
+      || left.path.localeCompare(right.path));
+}
+
+function trimSymbols(map: CodeMap): CodeMap {
+  const ranked = rankedFiles(map).filter((file) => file.symbols.length > 0);
+  const keep = new Set(ranked.slice(0, Math.floor(ranked.length / 2)).map((file) => file.path));
+  return { ...map, truncated: true, files: map.files.map((file) => {
+    if (!keep.has(file.path)) return { ...file, symbols: [] };
+    if (ranked.length === 1) return { ...file, symbols: file.symbols.slice(0,
+      Math.floor(file.symbols.length / 2)) };
+    return file;
+  }) };
+}
+
+function trimFiles(map: CodeMap): CodeMap {
+  const files = rankedFiles(map).slice(0, Math.ceil(map.files.length / 2))
+    .sort((left, right) => left.path.localeCompare(right.path));
+  const paths = new Set(files.map((file) => file.path));
+  for (const external of map.externals ?? []) paths.add(external.id);
+  return { ...map, files, truncated: true,
+    roads: map.roads.filter((road) => paths.has(road.source) && paths.has(road.target)) };
+}

package/apps/bridge/src/mesh/runtime/catalog/session-catalog.ts

@@ -0,0 +1,23 @@
+import type { SessionInfo } from "../../../../../../packages/protocol/schema";
+import { scanSessionHistory, scanSessions } from "../../../sessions";
+import { deduplicateNativeSessions } from "../capabilities/session-discovery";
+
+type Readers = {
+  history: () => SessionInfo[];
+  live: () => SessionInfo[];
+};
+
+/** Mesh keeps old Task identities, while current provider state stays fresh. */
+export function createMeshSessionCatalog(readers: Readers = {
+  history: scanSessionHistory,
+  live: () => scanSessions().sessions,
+}) {
+  let history: SessionInfo[] | undefined;
+  return {
+    sessions(): SessionInfo[] {
+      history ??= readers.history();
+      return deduplicateNativeSessions(history, readers.live());
+    },
+    invalidateHistory(): void { history = undefined; },
+  };
+}

package/apps/bridge/src/mesh/runtime/graph/binding-sync.ts

@@ -17,15 +17,27 @@ export async function refreshLocalGraphBindings(
   const candidates = (snapshot.bindings ?? []).filter((binding) =>
     binding.endpointId === localEndpoint && binding.available && binding.localPathHint);
   await Promise.all(candidates.map(async (binding) => {
-    const path = binding.localPathHint!;
-    const facts = dependencies.inspect(path);
-    if (!facts.worktree || resolve(facts.root) !== resolve(path)
-      || facts.canonicalRepositoryId !== binding.repositoryId) return;
-    await dependencies.sync(snapshot.project, {
-      summary: binding,
-      localRoot: facts.root,
-      canonicalRemote: facts.baseRemote,
-      lastSeenAt: Date.now(),
-    });
+    try {
+      const path = binding.localPathHint!;
+      const facts = dependencies.inspect(path);
+      if (!facts.worktree || resolve(facts.root) !== resolve(path)
+        || facts.canonicalRepositoryId !== binding.repositoryId) return;
+      await dependencies.sync(snapshot.project, {
+        summary: binding,
+        localRoot: facts.root,
+        canonicalRemote: facts.baseRemote,
+        lastSeenAt: Date.now(),
+      });
+    } catch { /* A stale checkout cannot prevent other verified bindings from recovery. */ }
   }));
 }
+
+/** Rehydrate previously admitted Git checkouts after Engine restart. */
+export async function recoverLocalGraphBindings(
+  snapshots: MeshSnapshot[],
+  dependencies?: Parameters<typeof refreshLocalGraphBindings>[1],
+): Promise<void> {
+  for (const snapshot of snapshots) {
+    await refreshLocalGraphBindings(snapshot, dependencies);
+  }
+}

package/apps/bridge/src/mesh/runtime/index.ts

@@ -24,7 +24,6 @@ import {
   deliverToSession,
 } from "../../reply";
 import { isProviderEnabled } from "../../config/runtime";
-import { scanSessionHistory, scanSessions } from "../../sessions";
 import { sendMeshPayload } from "../../host/session-keys";
 import { linkSessionsToProjects, workingTreeState } from "../catalog";
 import { catalogFromSessions } from "../catalog/models";
@@ -42,21 +41,23 @@ import { localMeshStore } from "../local-remote/local";
 import { createHandoffWorktree, repositoryHasCommit } from "./worktree";
 import { fetchRevision, pushBranch } from "../local-remote/remote";
 import { projectSessionCapabilityInventory, projectExecutionCapabilitySessions } from "./capabilities";
-import { deduplicateNativeSessions } from "./capabilities/session-discovery";
 import { refreshLocalGraphBindings } from "./graph/binding-sync";
+import { createMeshSessionCatalog } from "./catalog/session-catalog";
 
 export type { MeshRuntimeDependencies };
 
 /** Who handed the payload in: the relay (the phone, another computer) or an agent's tool call. */
 export type MeshPayloadOrigin = "relay" | "agent";
 
-function discoveredSessions(): SessionInfo[] {
-  return deduplicateNativeSessions(scanSessionHistory(), scanSessions().sessions);
+const sessionCatalog = createMeshSessionCatalog();
+
+export function invalidateMeshSessionHistory(): void {
+  sessionCatalog.invalidateHistory();
 }
 
 const defaultDependencies: MeshRuntimeDependencies = {
   store: localMeshStore,
-  sessions: discoveredSessions,
+  sessions: sessionCatalog.sessions,
   capabilityInventory: projectSessionCapabilityInventory,
   computer: () => computerId(),
   now: Date.now,

package/apps/bridge/src/monitor/handlers/inbound.ts

@@ -10,6 +10,7 @@ import {
   handleMeshPayload,
   prepareMeshHandoff,
   requestProjectCapability,
+  invalidateMeshSessionHistory,
 } from "../../mesh/runtime";
 import { releaseClaimByPerson, releaseResult } from "../../mesh/admin";
 import { handleInvocationQuery } from "../../engine/invocation/query";
@@ -72,11 +73,7 @@ export async function handleMonitorMessage(
       void publishSessionEvents(client, payload.sessionId, undefined, payload.threadId).catch(() => false);
       return true;
     } else if (payload.type === "sessions.refresh") {
-      // Pull-to-refresh must include a newly scanned history snapshot; otherwise
-      // a phone that cleared local state can receive an apparently empty tick.
-      void publish(true).catch(() => {});
-      if (payload.graphProjectId && loadRuntimeConfig().meshEnabled) requestProjectGraphRefresh(client, payload.graphProjectId);
-      return true;
+      return handleInboundRefresh(client, payload, publish);
     } else if (payload.type === "sessions.history.query") {
       await publishHistoryPage(client, payload);
       return true;
@@ -135,6 +132,20 @@ export async function handleMonitorMessage(
     return false;
 }
 
+function handleInboundRefresh(
+  client: RelayClient, payload: Extract<Payload, { type: "sessions.refresh" }>,
+  publish: (forceHistory?: boolean) => Promise<void>,
+): boolean {
+  // An explicit refresh may pay for the full history scan; routine Mesh
+  // snapshots use the cached history and fresh live sessions.
+  invalidateMeshSessionHistory();
+  void publish(true).catch(() => {});
+  if (payload.graphProjectId && loadRuntimeConfig().meshEnabled) {
+    requestProjectGraphRefresh(client, payload.graphProjectId);
+  }
+  return true;
+}
+
 function handleInboundToolUpdate(
   client: RelayClient, payload: Extract<Payload, { type: "tool.update" }>,
   publish: (forceHistory?: boolean) => Promise<void>,

package/apps/bridge/src/reply/README.md

@@ -6,5 +6,11 @@ This module prepares phone attachments, routes selected MCP/skill intent, and ru
 handoff resumes the same Task on another agent or computer. Providers without an
 implemented remote-start path fail closed instead of reporting parity.
 
+On POSIX, a managed provider command owns a process group. Phone pause and
+timeouts signal that group, so local descendants that remain in it are also
+requested to stop. The stop count records accepted signals, not confirmed exit
+of every descendant. Windows uses the direct-child stop path; remote jobs and
+resources that outlive the agent process need their own cancellation receipts.
+
 License: this module is distributed under the MIT License
 in the repository-root `LICENSE` file.

package/apps/bridge/src/reply/process/index.ts

@@ -36,14 +36,30 @@ function track(key: string, child: ChildProcess): () => void {
   };
 }
 
+function signalOwnedProcess(child: ChildProcess, signal: NodeJS.Signals): boolean {
+  if (process.platform !== "win32" && child.pid && child.pid > 0) {
+    try {
+      // POSIX detached children lead a new process group. Signal descendants
+      // as well as the provider CLI, without touching the monitor's group.
+      process.kill(-child.pid, signal);
+      return true;
+    } catch {
+      // The group may already have exited; fall back to the direct child.
+    }
+  }
+  return child.kill(signal);
+}
+
 /** Request a stop for owned child processes; count signals accepted, not exits. */
 export function abortProcesses(key: string): number {
   const set = running.get(key);
   if (!set) return 0;
   let stopped = 0;
   for (const child of set) {
-    (child as ChildProcess & { granttapStopped?: boolean }).granttapStopped = true;
-    if (child.kill("SIGTERM")) stopped += 1;
+    if (signalOwnedProcess(child, "SIGTERM")) {
+      (child as ChildProcess & { granttapStopped?: boolean }).granttapStopped = true;
+      stopped += 1;
+    }
   }
   return stopped;
 }
@@ -70,6 +86,7 @@ export function runProcess(
         // hand a background run the journal kept for the live session.
         env: { ...process.env, GRANTTAP_DELIVERY: "1", ...projectEnvForCwd(cwd) },
         stdio: [stdin == null ? "ignore" : "pipe", "pipe", "pipe"],
+        detached: process.platform !== "win32",
       });
     } catch (error) {
       resolve({ ok: false, error: `${command} did not start: ${(error as Error).message}` });
@@ -89,7 +106,7 @@ export function runProcess(
     };
     const timer = setTimeout(() => {
       if (done) return;
-      child.kill("SIGKILL");
+      signalOwnedProcess(child, "SIGKILL");
       finish({ ok: false, error: `${command} did not respond within ${Math.round(timeoutMs / 1000)}s.` });
     }, timeoutMs);
     child.stdout?.on("data", (chunk) => { stdout += chunk; });

package/apps/mcp/src/connection-center/widget.html

@@ -38,7 +38,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
     Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.19</code> and <code>granttap setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.21</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/cursor-plugin/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "granttap",
   "displayName": "GrantTap",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "The agent connects this computer in chat. Authorize in plugin settings opens the device window. Scan the QR in GrantTap — that scan authorizes. Device list and Add another stay there and in the GrantTap app.",
   "author": {
     "name": "GrantTap",

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.19
+npm install -g granttap-mcp@0.8.21
 granttap setup
 granttap status
 ```
@@ -49,10 +49,10 @@ import the public repository once and reload Cursor. The plugin adds `/connect`,
 skill, and the exact-correlation rule; `granttap setup` configures the local
 MCP endpoint separately.
 
-Publish by pushing this repository. Keep `name` as `granttap` and the GitHub URL
-as `sergii-ziborov/granttap-mcp`. That updates the existing listing. Do not
-submit Cursor Marketplace or cursor.directory again — a second submit is a
-second card. The only Cursor marketplace file is the repo-root
+Pushing this repository updates the plugin source. Cursor reviews marketplace
+updates separately, so confirm the displayed version after review. Keep `name`
+as `granttap` and the GitHub URL as `sergii-ziborov/granttap-mcp`; do not create
+a second listing. The only Cursor marketplace file is the repo-root
 `.cursor-plugin/marketplace.json`, and it lists this plugin once.
 
 If Customize or Marketplace shows both a lowercase **granttap** cube and an

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.19\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.21\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.19";
+const PACKAGE = "granttap-mcp@0.8.21";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/docs/cursor-authorize.md

@@ -14,8 +14,8 @@ GrantTap in Cursor Customize → MCPs.
 Cursor Cloud Agents cannot reach `http://127.0.0.1`. An HTTP MCP entry
 there — leftover user Customize → MCPs, or an old plugin `mcp.json` — is why
 Cloud shows **Error · fetch failed**. The Marketplace plugin uses stdio
-(`node -e` so cwd `$HOME` still starts GrantTap; on Windows that bootstrap
-runs `cmd.exe /c npx`).
+(`node -e` so cwd `$HOME` still starts GrantTap; on Windows the bootstrap
+launches npm's JavaScript entry point through Node).
 Authorize in the browser on `granttap.com/connect`; that page talks only to
 the website, not to loopback. Pairing stays on the connection card, last
 resort a QR there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.20",
+  "version": "0.8.21",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/mesh/graph/code-map.ts

@@ -0,0 +1,44 @@
+import { z } from "zod";
+
+const CodePath = z.string().trim().min(1).max(512).refine((value) =>
+  !value.startsWith("/") && !value.split("/").includes(".."), "repository-relative path required");
+
+export const ProjectCodeMap = z.object({
+  files: z.array(z.object({
+    path: CodePath,
+    language: z.string().trim().min(1).max(64).nullable(),
+    lineCount: z.number().int().positive().nullable(),
+    symbols: z.array(z.object({
+      id: z.string().trim().min(1).max(512),
+      label: z.string().max(160),
+      kind: z.string().trim().min(1).max(64),
+      startLine: z.number().int().positive(),
+      lineCount: z.number().int().positive(),
+    }).strict()).max(72),
+  }).strict()).max(650),
+  externals: z.array(z.object({
+    id: z.string().startsWith("ext:").min(5).max(512),
+    label: z.string().max(160),
+    kind: z.string().trim().min(1).max(64),
+  }).strict()).max(24).optional(),
+  roads: z.array(z.object({
+    source: CodePath,
+    target: CodePath,
+    relation: z.string().trim().min(1).max(64),
+  }).strict()).max(1_200),
+  totalFiles: z.number().int().nonnegative(),
+  totalExternals: z.number().int().nonnegative().optional(),
+  truncated: z.boolean(),
+}).strict().superRefine((value, ctx) => {
+  const paths = new Set(value.files.map((file) => file.path));
+  const externals = new Set((value.externals ?? []).map((node) => node.id));
+  const references = new Set([...paths, ...externals]);
+  if (paths.size !== value.files.length || value.totalFiles < value.files.length
+    || externals.size !== (value.externals?.length ?? 0)
+    || (value.totalExternals ?? 0) < (value.externals?.length ?? 0)
+    || value.roads.some((road) => !references.has(road.source) || !references.has(road.target))) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "invalid code tower references" });
+  }
+});
+
+export type ProjectCodeMap = z.infer<typeof ProjectCodeMap>;

package/packages/protocol/messages/mesh/snapshot.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { ProjectCodeMap } from "./graph/code-map";
 import { Identifier, Label, MeshProvider } from "./endpoint";
 import {
   ProjectEnvironment,
@@ -161,6 +162,7 @@ export const ProjectRepositoryGraph = z.object({
     contradictions: z.array(z.string().max(240)).max(16),
     unknowns: z.array(z.string().max(160)).max(4),
   }).strict()).max(8).optional(),
+  codeMap: ProjectCodeMap.optional(),
   nodes: z.array(z.object({
     id: z.string().trim().min(1).max(512),
     kind: z.string().trim().min(1).max(64),