granttap-mcp 0.8.33 → 0.8.35

package/README.md

@@ -4,16 +4,18 @@
 [![CI](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-GrantTap is a distributed Project control system for local coding agents.
+> **See what your coding agents are doing. Step in when they need you.**
 
-> See what your coding agents are doing. Step in when they need you.
+GrantTap connects local Claude Code and Codex work to a live control center on
+Mac, iPhone, iPad, and Apple Watch. See the Task and its latest activity, answer
+an approval or question with context, and continue the same goal as sessions or
+computers change. Cursor and Grok Build join the view where their local
+integrations support it.
 
-This repository is the canonical machine runtime: CLI, MCP server, provider
-hooks, local adapters, and TypeScript wire schemas. It connects the Mac,
-iPhone, iPad, and Apple Watch product surfaces to local agents, Project Mesh,
-Governance, auto-accept, and Engine-backed evidence. Agents and provider
-credentials stay on your computer. Native controller traffic is end-to-end
-encrypted.
+This repository supplies the local runtime: CLI, MCP server, provider hooks,
+adapters, and wire contracts. It powers Project Mesh, Governance, and observed
+usage while agents and provider credentials stay on your computer. Controller
+traffic is end-to-end encrypted.
 
 The MCP runtime, plugins, and CLI are open source under the MIT License.
 The Apple apps, Engine, relay, and website are separately licensed commercial
@@ -36,11 +38,13 @@ products or source. Their licenses do not change this repository's MIT grant.
   <img src="docs/images/apple-watch-approval.png" width="180" alt="GrantTap approval on Apple Watch">
 </p>
 
+<p align="center"><em>GrantTap iPhone and Apple Watch screens with deterministic sample work; no private user tasks are shown.</em></p>
+
 ## Supported providers
 
-- Primary: Claude Code and Codex.
-- Beta: Cursor.
-- Experimental where available: Grok Build.
+- Claude Code and Codex: primary local control and continuation paths.
+- Cursor: Task visibility and supported local controls, with narrower coverage.
+- Grok Build: observable work where the installed runtime exposes it.
 
 GrantTap reports the depth each provider actually exposes. Visibility does not
 imply deterministic remote blocking or full mobile continuation.
@@ -147,7 +151,7 @@ computers. GrantTap builds a bounded Task Capsule from explicit task/git facts,
 requires local phone authorization, creates a separate target branch/worktree,
 starts the target execution, and returns a receipt bound to the exact capsule.
 Cursor uses the same provider-neutral schema and trusted caller attribution.
-Grok Build remains Experimental and observable where available, but does not
+Grok Build remains observable where available, but does not
 yet expose a trusted caller hook, so agent-authored scoped Mesh events are not
 offered for it. Unsupported remote-start paths fail closed instead of claiming
 parity.
@@ -381,19 +385,20 @@ trust.
 
 ## MCP contract
 
-`tools/list` returns exactly five public tools:
+`tools/list` returns exactly six public tools:
 
 | Tool | Contract |
 | --- | --- |
+| `connection_status` | Open the connection card and inspect saved pairing, QR expiry, relay observations, and provider readiness without changing pairing |
 | `connect` | Reuse the existing production pairing or return a one-time QR |
-| `reconnect` | Replace the pairing after explicit confirmation and return a fresh one-time QR |
+| `reconnect` | After explicit confirmation, show a one-time QR to reconnect or add an independent controller device while retaining the current room |
 | `notify` | Send a non-blocking status update of at most 2,000 characters |
 | `ask_yes_no` | Ask a yes/no question and wait for the explicit answer |
 | `ask` | Ask an open question and wait for typed or spoken text |
 
 MCP `connect` accepts no custom routing, replacement, or key-rotation input.
-`reconnect` is declared destructive and requires `confirmed: true`; relay
-acceptance happens before the working local pairing is replaced.
+`reconnect` is declared destructive and requires `confirmed: true`; the
+existing pairing remains usable during a new enrollment attempt.
 Setup is CLI-only because it changes provider configuration and must not be
 available to a model through prompt injection.
 

package/apps/mcp/src/connection-center/README.md

@@ -23,11 +23,12 @@ checks parent messages, refreshes pending pairing while visible, and keeps
 copyable transfer material out of model-visible text and persistent UI storage.
 Non-UI clients can still use the tools and display the returned QR image.
 
-The connection card itself does not log in to an account. The Codex-owned
-plugin management page is not this UI. The optional Mac passkey choice lives
-in the browser authorization page for the loopback HTTP MCP server. It grants
-the coding app an MCP token, without creating a phone pairing or changing the
-local provider runtime.
+Connect with passkey on the card creates a short-lived, authenticated website
+request. A fresh passkey assertion on granttap.com links this Mac to the user's
+account; the site returns a machine token only to the local MCP watcher, which
+saves it privately. The QR pairing room and provider runtime remain unchanged.
+The separate coding-app OAuth page can also use passkey to authorize that MCP
+client. The Codex-owned plugin management page is not this card.
 
 Tests in `tests/` exercise isolated keys, a loopback encrypted phone connection,
 expiry, non-mutating status, and actual DOM button/host-message behavior.

package/apps/mcp/src/connection-center/bridge.js

@@ -72,6 +72,7 @@ async function call(name, args = {}) {
       : await request("tools/call", { name, arguments: args });
     if (result?.isError) message("Could not complete the request. Refresh status and check the relay before retrying.");
     else { render(result); message("Status updated."); }
+    return result;
   } catch {
     message("No successful response. Refresh status before retrying; pairing may already have changed.");
   } finally {

package/apps/mcp/src/connection-center/passkey.ts

@@ -0,0 +1,27 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { buildConnectSnapshot } from "../oauth/session/connect-snapshot";
+import { publishConnectRequestRetry, watchConnectDecision, websiteOrigin } from "../oauth/consent/website-session";
+
+const REQUEST_LIFETIME_MS = 15 * 60_000;
+let pending: { url: string; expiresAt: number } | null = null;
+
+/** Start a browser passkey ceremony for this Mac. No account credential enters MCP output. */
+export async function startPasskeyAccountLink(): Promise<string> {
+  if (pending && pending.expiresAt > Date.now()) return pending.url;
+  const origin = websiteOrigin();
+  if (!origin) throw new Error("GrantTap account service is unavailable.");
+  const id = randomUUID();
+  const secret = randomBytes(32).toString("base64url");
+  const snapshot = () => ({ ...buildConnectSnapshot("GrantTap MCP"), purpose: "account-link" as const });
+  if (!await publishConnectRequestRetry(origin, id, snapshot(), 3, secret)) {
+    throw new Error("GrantTap account service did not accept the connection request.");
+  }
+  watchConnectDecision(origin, id, snapshot, (approved, method) => {
+    if (!approved || method !== "passkey") throw new Error("Use the account passkey to link this Mac.");
+    pending = null;
+    return { redirectUrl: `${origin}/account` };
+  }, { requestSecret: secret });
+  const url = `${origin}/connect#request=${id}`;
+  pending = { url, expiresAt: Date.now() + REQUEST_LIFETIME_MS };
+  return url;
+}

package/apps/mcp/src/connection-center/state.ts

@@ -6,6 +6,7 @@ import { inspectProviderStatusSnapshot } from "../status/provider-status";
 import { packageVersion } from "../status/package-version";
 import { connectionRuntimeStatus } from "../mcp-tools/connect/relay";
 import { beginEnrollment, cancelEnrollment, enrollmentIsOpen } from "./enrollment";
+import { loadAccountLink } from "../../../bridge/src/account-recovery/link";
 
 export const connectionOutput = {
   status: z.enum(["disconnected", "paired", "pairing", "expired", "connected"]),
@@ -23,6 +24,7 @@ export const connectionOutput = {
   expiresInMinutes: z.number().int().positive().nullable(),
   providers: z.array(z.object({ id: z.string(), status: z.string(), detail: z.string() })),
   roomPrefix: z.string(),
+  accountLinkSaved: z.boolean(),
 };
 
 export type PendingCode = {
@@ -76,6 +78,7 @@ export class ConnectionState {
         expiresInMinutes: code ? Math.max(1, Math.ceil((code.expiresAt - now) / 60_000)) : null,
         providers: inspectProviderStatusSnapshot().providers.map(({ id, status, detail }) => ({ id, status, detail })),
         roomPrefix: config?.room ? config.room.slice(0, 8) : "",
+        accountLinkSaved: loadAccountLink() !== null,
       },
       _meta: { granttap: code ? { pairingUri: code.pairingUri, qrDataUrl: code.qrDataUrl } : {} },
     };

package/apps/mcp/src/connection-center/view.js

@@ -21,6 +21,16 @@ function render(value) {
   current = state;
   clearCode();
   const meta = result._meta?.granttap ?? {};
+  const passkeyUrl = typeof meta.passkeyUrl === "string" && /^https:\/\/granttap\.com\/connect#request=[0-9a-f-]{36}$/i.test(meta.passkeyUrl)
+    ? meta.passkeyUrl : "";
+  $("passkey-link").classList.toggle("hidden", !passkeyUrl || state.accountLinkSaved === true);
+  if (passkeyUrl) $("passkey-link").setAttribute("href", passkeyUrl);
+  else $("passkey-link").removeAttribute("href");
+  $("account-status").textContent = state.accountLinkSaved === true
+    ? "Saved account link on this Mac. Current server access is checked when it is used."
+    : "No account linked on this Mac. A passkey can link it without changing the QR pairing.";
+  $("passkey").textContent = state.accountLinkSaved === true
+    ? "Reauthorize with passkey" : "Connect with passkey";
   const labels = {
     disconnected: ["Not paired", "Add a device", "Tap Add a device. Scan the QR in GrantTap on iPhone, iPad, or Android."],
     pairing: ["Waiting for a device", "Scan this QR", "Keep this card open. The QR is only here — not in chat."],
@@ -91,6 +101,7 @@ $("connect").addEventListener("click", () => {
   call("connect");
 });
 $("refresh").addEventListener("click", () => call("connection_status"));
+$("passkey").addEventListener("click", () => call("connect_with_passkey"));
 $("reconnect").addEventListener("click", () => {
   pendingMode = "reconnect";
   $("confirm-copy").textContent = "Reconnect shows a new QR for the existing controller device in this room.";

package/apps/mcp/src/connection-center/widget.html

@@ -27,7 +27,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
 </svg>
 </div><div><div class="title">GrantTap</div><div class="status"><span class="dot"></span><span id="status">Checking connection…</span></div></div></header>
   <section class="body">
-    <div class="copy"><h2 id="heading">Add a device</h2><p id="detail">Scan the QR in GrantTap on iPhone, iPad, or Android. It appears here as soon as pairing starts.</p><ul class="phones" id="phones"></ul><p class="empty" id="phones-empty">No saved pairing on this Mac yet.</p><div class="actions"><button class="primary" id="connect">Add a device</button><button id="reconnect">Reconnect</button><button id="new-qr" class="hidden">Create a new QR</button><button id="refresh">Refresh status</button><button id="copy" class="hidden">Copy pairing link</button></div><div class="message small" id="message" role="status"></div></div>
+    <div class="copy"><h2 id="heading">Add a device</h2><p id="detail">Scan the QR in GrantTap on iPhone, iPad, or Android. It appears here as soon as pairing starts.</p><ul class="phones" id="phones"></ul><p class="empty" id="phones-empty">No saved pairing on this Mac yet.</p><div class="actions"><button class="primary" id="connect">Add a device</button><button id="reconnect">Reconnect</button><button id="new-qr" class="hidden">Create a new QR</button><button id="refresh">Refresh status</button><button id="copy" class="hidden">Copy pairing link</button></div><p id="account-status" class="small">Checking account link…</p><div class="actions"><button id="passkey">Connect with passkey</button><a id="passkey-link" class="hidden" target="_blank" rel="noopener noreferrer">Continue on granttap.com</a></div><div class="message small" id="message" role="status"></div></div>
     <img id="qr" class="hidden" alt="GrantTap pairing QR" />
   </section>
   <p id="expiry" class="small" aria-live="polite"></p>
@@ -36,9 +36,8 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <dt>Relay observed by this MCP</dt><dd id="relay">Not checked</dd>
     <dt>Last encrypted message from iPhone</dt><dd id="phone">Not observed</dd></dl>
     <h3>Provider readiness</h3><ul id="providers"></ul>
-    <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
-    Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.23</code> and <code>granttap setup</code> locally.
+    <p>QR pairs a phone directly. A passkey links this Mac to your GrantTap account so your signed-in phone can discover its computers. Provider sign-in is separate.</p>
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.35</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/mcp-tools/connect/index.ts

@@ -7,6 +7,7 @@ import { isMachineConfigured } from "../../status/pairing-status";
 import { ConnectionState, connectionOutput } from "../../connection-center/state";
 import { CONNECTION_WIDGET_URI } from "./widget";
 import { resetRelay, relay } from "./relay";
+import { startPasskeyAccountLink } from "../../connection-center/passkey";
 
 const widgetMeta = {
   ui: { resourceUri: CONNECTION_WIDGET_URI, visibility: ["model", "app"] },
@@ -39,6 +40,24 @@ export function registerConnectTool(server: McpServer): void {
     annotations: { ...changes, readOnlyHint: true, idempotentHint: true },
     _meta: widgetMeta,
   }, async () => connectionResult(state));
+  server.registerTool("connect_with_passkey", {
+    title: "Link this Mac to a GrantTap account",
+    description: "Open a short-lived GrantTap account passkey request for this Mac. The passkey is entered only on granttap.com; existing QR pairings remain unchanged.",
+    inputSchema: {},
+    outputSchema: connectionOutput,
+    annotations: changes,
+    _meta: widgetMeta,
+  }, async () => {
+    try {
+      const passkeyUrl = await startPasskeyAccountLink();
+      const result = connectionResult(state);
+      const meta = result._meta?.granttap;
+      const granttap = meta && typeof meta === "object" ? meta : {};
+      return { ...result, _meta: { granttap: { ...granttap, passkeyUrl } } };
+    } catch {
+      return { isError: true, content: [{ type: "text", text: "GrantTap could not start passkey linking. Check the account service and try again." }] };
+    }
+  });
   server.registerTool(
     "connect",
     {

package/apps/mcp/src/mcp-tools/connect/widget.ts

@@ -1,6 +1,6 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v3.html";
+export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v4.html";
 
 import { readFileSync } from "node:fs";
 
@@ -13,7 +13,7 @@ export function registerConnectionWidget(server: McpServer): void {
     CONNECTION_WIDGET_URI,
     {
       title: "GrantTap connection center",
-      description: "GrantTap card: devices in this pairing room, Add a device, and the QR on this card only.",
+      description: "GrantTap card: QR device pairing, Mac account passkey linking, and connection status.",
       mimeType: "text/html;profile=mcp-app",
     },
     async (uri) => ({
@@ -23,7 +23,7 @@ export function registerConnectionWidget(server: McpServer): void {
         text: html,
         _meta: {
           ui: { prefersBorder: true, permissions: { clipboardWrite: {} }, csp: { connectDomains: [], resourceDomains: [] } },
-          "openai/widgetDescription": "List devices in this pairing room and add one with a QR that stays on this card.",
+          "openai/widgetDescription": "Pair a device by QR or link this Mac to your account with passkey.",
           "openai/widgetPrefersBorder": true,
         },
       }],

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.33
+npm install -g granttap-mcp@0.8.35
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.33\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.35\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.33";
+const PACKAGE = "granttap-mcp@0.8.35";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.33",
+  "version": "0.8.35",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {