granttap-mcp 0.8.22 → 0.8.23

package/apps/bridge/src/bin/cli/connect.ts

@@ -28,7 +28,8 @@ async function connect(relayUrl: string): Promise<void> {
       "Background helper   Run granttap setup to verify",
       "",
       "Existing pairing reused. No QR or key rotation was needed.",
-      "Use granttap reset before pairing this computer again.",
+      "To link another iPhone or iPad, open the GrantTap connection card in your coding app and choose Add another device.",
+      "To repair the same phone, choose Reconnect in that card. Do not reset the computer pairing for either action.",
       "",
     ].join("\n"));
     return;

package/apps/bridge/src/bin/cli/phone.ts

@@ -0,0 +1,54 @@
+import QRCode from "qrcode";
+import { loadConfig } from "../../config";
+import { reloadPairingHelper } from "../../install";
+import { createOneTimePairing, DEFAULT_RELAY, PAIRING_CODE_TTL_MINUTES } from "../../pairing";
+import { isMachineConfigured, readOnlyMachineConfigPath } from "../../../../mcp/src/status/pairing-status";
+import { installHttpMcpService } from "../../../../mcp/src/http-service";
+
+const mode = process.argv[2];
+
+async function main(): Promise<void> {
+  if (mode !== "add" && mode !== "reconnect") {
+    process.stderr.write("Usage: granttap phone add|reconnect\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (!process.stdout.isTTY) {
+    process.stderr.write("Open an interactive terminal and run this command yourself; the private pairing QR is never written to agent logs.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const paired = isMachineConfigured();
+  if (!paired && mode === "reconnect") {
+    process.stderr.write("This computer has no saved pairing. Run granttap phone add instead.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const relay = paired ? loadConfig(readOnlyMachineConfigPath()).relayUrl : DEFAULT_RELAY;
+  const result = await createOneTimePairing(relay, {
+    addController: paired && mode === "add",
+    installHooks: false,
+  });
+  const helper = reloadPairingHelper({ firstPairing: !paired });
+  const mcp = installHttpMcpService({ forceReload: true });
+  const qr = await QRCode.toString(result.qrPayload, {
+    type: "terminal", small: true, errorCorrectionLevel: "L",
+  });
+  process.stdout.write([
+    "",
+    mode === "add" ? "Add a controller iPhone or iPad" : "Reconnect the same controller phone",
+    "Open GrantTap on the phone → Settings → Connections → Add a device (Scan QR).",
+    "",
+    qr,
+    "",
+    `The QR expires in ${PAIRING_CODE_TTL_MINUTES} minutes. Never paste it into chat.`,
+    ...(helper?.status === "manual" || mcp.status === "manual"
+      ? ["Background connection needs attention. Run granttap setup after scanning."] : []),
+    "",
+  ].join("\n"));
+}
+
+void main().catch((error: unknown) => {
+  process.stderr.write(`GrantTap could not issue a phone QR: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+});

package/apps/mcp/src/connection-center/bridge.js

@@ -43,6 +43,13 @@ async function initializeBridge() {
     });
     if (initialized?.protocolVersion !== "2026-01-26") throw new Error("Unsupported UI protocol");
     post({ method: "ui/notifications/initialized" });
+    // The compatibility API is an explicit tool-call capability. In Codex it
+    // avoids an iframe proxy that can initialize but time out on tools/call.
+    legacyBridge = typeof window.openai?.callTool === "function";
+    if (!legacyBridge && !initialized.hostCapabilities?.serverTools) {
+      message("This host cannot call GrantTap tools from the card. Ask the agent to open connection status or add a device.");
+      return;
+    }
     bridgeReady = true;
   } catch {
     if (!window.openai?.callTool) {

package/apps/mcp/src/connection-center/widget.html

@@ -38,7 +38,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
     Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.22</code> and <code>granttap setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.23</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/mcp-tools/connect/widget.ts

@@ -1,6 +1,6 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v2.html";
+export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v3.html";
 
 import { readFileSync } from "node:fs";
 

package/bin/granttap-mcp.mjs

@@ -16,6 +16,8 @@ const usage = [
   "  granttap setup                    Detect agents and install or repair GrantTap",
   "  granttap status [--json]          Show pairing, helper, and provider readiness",
   "  granttap connect [--relay <url>]  Pair this computer with iPhone/Apple Watch",
+  "  granttap phone add              Show a QR for another controller phone",
+  "  granttap phone reconnect        Show a QR to restore the same phone",
   "  granttap reset [--yes]            Reset this computer's phone pairing",
   "  granttap mesh connect <invite>    Redeem a one-time Grok Bot Mesh invite",
   "  granttap restrictions check [dir] Check files against Mesh / .granttap restrictions",
@@ -36,6 +38,8 @@ if (command === "mcp") {
   entry = join(root, "apps", "bridge", "src", "bin", "cli", "setup.ts");
 } else if (command === "connect") {
   entry = join(root, "apps", "bridge", "src", "bin", "cli", "connect.ts");
+} else if (command === "phone" && ["add", "reconnect"].includes(argument)) {
+  entry = join(root, "apps", "bridge", "src", "bin", "cli", "phone.ts");
 } else if (command === "status") {
   entry = join(root, "apps", "mcp", "src", "bin", "status.ts");
 } else if (command === "reset") {
@@ -100,8 +104,8 @@ if (!preflight || !loader) {
   process.exit(1);
 }
 
-const forwardedArgs = ["connect", "status", "reset", "mesh", "setup", "restrictions"].includes(command)
-  ? (command === "mesh" || command === "restrictions" ? commandArgs.slice(1) : commandArgs)
+const forwardedArgs = ["connect", "status", "reset", "mesh", "setup", "restrictions", "phone"].includes(command)
+  ? (command === "mesh" || command === "restrictions" || command === "phone" ? commandArgs.slice(1) : commandArgs)
   : [];
 const child = spawn(
   process.execPath,

package/cursor-plugin/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "granttap",
   "displayName": "GrantTap",
-  "version": "0.1.15",
-  "description": "The agent connects this computer in chat. Authorize in plugin settings opens the device window. Scan the QR in GrantTap — that scan authorizes. Device list and Add another stay there and in the GrantTap app.",
+  "version": "0.1.16",
+  "description": "GrantTap pairs this computer with iPhone. The connection card shows a one-time QR when Cursor supports interactive MCP Apps; an interactive terminal command is available if it does not. The website approves the coding app.",
   "author": {
     "name": "GrantTap",
     "email": "support@granttap.com",

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.22
+npm install -g granttap-mcp@0.8.23
 granttap setup
 granttap status
 ```
@@ -22,9 +22,12 @@ The commands have separate jobs:
 2. `granttap setup` also installs the background task-sync helper.
 3. `granttap status` performs a read-only readiness check.
 
-After `granttap setup`, pair on `granttap.com/connect` — Approve this coding
-app, Reconnect, or Add another. A saved pairing still opens that page. Scan
-in the GrantTap app only when a new device joins. Cloud **Error · fetch
+After `granttap setup`, open the GrantTap connection card in Cursor for **Add a
+device**, **Add another device**, or **Reconnect**. Scan its QR in the phone
+app. If Cursor does not render or operate the card, run `granttap phone add`
+in your own interactive terminal; it never prints the QR to an agent log.
+`granttap.com/connect` approves the coding app and shows phone observations.
+Cloud **Error · fetch
 failed** is a leftover HTTP MCP at `http://127.0.0.1:17342/mcp` — either a
 user Customize → MCPs row or an old plugin `mcp.json`. The current plugin is
 stdio (`node -e`) so Cloud never fetches loopback.

package/cursor-plugin/commands/connect.md

@@ -7,6 +7,7 @@ Call GrantTap tools yourself. Do not ask the person to pair in this chat.
 1. Call `connection_status`.
 2. If this computer is not paired, call `connect`.
 3. Do not print a pairing URI, token, or QR in chat.
-4. Device list, Approve, Add another device, and Reconnect belong on
-   granttap.com/connect, in GrantTap plugin settings, and in the GrantTap
-   app — not in chat.
+4. The GrantTap connection card shows the device list and one-time QR when
+   Cursor supports interactive MCP Apps. `granttap.com/connect` approves the
+   coding app but does not display a pairing QR. If the card cannot call tools,
+   tell the person to run `granttap phone add` in their own terminal.

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.22\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.23\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/skills/connect/SKILL.md

@@ -12,19 +12,20 @@ The person does not pair in chat. You connect this computer by calling tools.
 1. Call `connection_status`.
 2. If this computer is not paired, call `connect`.
 3. Never print a pairing URI, manual token, or QR in chat.
-4. Never tell the person to scan something in this conversation, open a website,
-   or type a setup command.
+4. Never put a private pairing QR in this conversation. If the host cannot
+   call tools from the connection card, explain the local interactive-terminal
+   fallback: `granttap phone add` or `granttap phone reconnect`.
 
 A saved pairing is reused. Do not call `reconnect` unless they confirmed
 Add another device or Reconnect in plugin settings.
 
 ## Settings (the person)
 
-Device list, Approve, Add another device, and Reconnect live on
-granttap.com/connect, in the GrantTap plugin settings of this host, and in
-the GrantTap app. Authenticate opens that page even when this computer is
-already paired. The same pairing room is shared across those hosts on this
-computer.
+The GrantTap connection card in this host shows the device list and one-time
+QR under Add a device, Add another device, or Reconnect when the host supports
+interactive MCP Apps. GrantTap on iPhone scans it in Settings → Connections.
+granttap.com/connect handles coding-app approval and phone observations, but
+does not display a pairing QR. All coding apps on this computer share one room.
 
 For an interactive question, send the same complete prompt to Cursor and
 GrantTap under one exact correlation. The first answer with that correlation

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.22";
+const PACKAGE = "granttap-mcp@0.8.23";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.22",
+  "version": "0.8.23",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {