granttap-mcp 0.8.35 → 0.8.37

package/README.md

@@ -25,6 +25,28 @@ products or source. Their licenses do not change this repository's MIT grant.
 [Security model](SECURITY.md) ·
 [Relay source](https://github.com/sergii-ziborov/granttap-relay)
 
+## Account Mesh and devices
+
+The passkey Account Mesh is the person's relay space. It exists with zero
+computers and can contain many computers and Project Meshes. Create or join it
+from **Devices** in the iPhone, iPad, or Mac app, then use the same passkey in
+the MCP connection card to attach this computer. A previously linked computer
+reuses its machine identity; reconnecting does not create a duplicate. The
+local helper reports the Mac's user-assigned Computer Name and updates its
+account display name when that name changes. Device names are display labels,
+not routing keys: each Task keeps the computer route selected by its Mesh.
+
+Install the local helper separately from the Mac App Store app:
+
+```bash
+npm install -g granttap-mcp
+granttap setup
+```
+
+The Mac app can join the Account Mesh before the helper is present and links it
+when the installed helper becomes available. A one-time QR still provides direct
+device pairing without a passkey account.
+
 ## Mac, iPhone, iPad, and Apple Watch
 
 <p align="center">

package/apps/bridge/src/account-recovery/enroll.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import { loadAccountLink, saveAccountLink } from "./link";
 
 const TOKEN = /^[A-Za-z0-9_-]{43}$/;
@@ -6,7 +6,8 @@ const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-
 
 /** Native Mac app authorizes this MCP with its account session over protected loopback. */
 export async function enrollMacAccount(accountToken: string, origin: string,
-  request: typeof fetch = fetch): Promise<{ accountId: string; machineId: string }> {
+  request: typeof fetch = fetch,
+  computerName: () => string = computerDisplayName): Promise<{ accountId: string; machineId: string }> {
   if (!TOKEN.test(accountToken) || new URL(origin).protocol !== "https:") {
     throw new Error("Invalid account authorization.");
   }
@@ -22,19 +23,29 @@ export async function enrollMacAccount(accountToken: string, origin: string,
     if (existing.accountId !== me.accountId) {
       throw new Error("This Mac is linked to a different account. Revoke it first.");
     }
-    const linked = await request(`${origin}/api/account/machines`, {
-      headers, signal: AbortSignal.timeout(8_000), redirect: "error",
+    const linked = await request(`${origin}/api/account/machine/identity`, {
+      headers: { authorization: `Bearer ${existing.machineToken}` },
+      signal: AbortSignal.timeout(8_000), redirect: "error",
     });
-    if (!linked.ok) throw new Error("Account computer list is unavailable.");
-    const list = await linked.json() as { machines?: Array<{ id?: string }> };
-    if (!Array.isArray(list.machines)) throw new Error("Invalid account computer list.");
-    if (list.machines.some(machine => machine.id === existing.machineId)) {
+    if (linked.status !== 401 && !linked.ok) throw new Error("Account machine is unavailable.");
+    if (linked.ok) {
+      const identity = await linked.json() as { accountId?: string; machineId?: string };
+      if (identity.accountId !== me.accountId || identity.machineId !== existing.machineId) {
+        throw new Error("Account machine identity changed unexpectedly.");
+      }
+      const renamed = await request(`${origin}/api/account/machine/self`, {
+        method: "PATCH", headers: { authorization: `Bearer ${existing.machineToken}`,
+          "content-type": "application/json" },
+        body: JSON.stringify({ name: computerName() }),
+        signal: AbortSignal.timeout(8_000), redirect: "error",
+      });
+      if (!renamed.ok) throw new Error("Account computer name could not be updated.");
       return { accountId: existing.accountId, machineId: existing.machineId };
     }
   }
   const registration = await request(`${origin}/api/account/machines`, {
     method: "POST", headers: { ...headers, "content-type": "application/json" },
-    body: JSON.stringify({ name: hostname().slice(0, 80) }),
+    body: JSON.stringify({ name: computerName() }),
     signal: AbortSignal.timeout(8_000), redirect: "error",
   });
   if (registration.status !== 201 && registration.status !== 200) {

package/apps/bridge/src/config/access/pairing.ts

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { generateKeyPair, randomId } from "../../../../../packages/core/crypto";
 import type { PeerConfig } from "../../../../../packages/core/relay-client";
 import { configDir } from "../runtime/paths";
@@ -129,7 +129,7 @@ export function createPairing(relayUrl: string): {
     relayUrl,
     room,
     role: "machine",
-    deviceName: hostname(),
+    deviceName: computerDisplayName(),
     senderId: randomId(4),
     myPublicKey: machine.publicKey,
     mySecretKey: machine.secretKey,

package/apps/bridge/src/machine-load/index.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import type {
   MachineLoad,
   SessionsStatus,
@@ -78,7 +78,7 @@ export function buildMachineLoad(input: {
   ]);
   return {
     type: "machine.load",
-    machine: input.machine ?? hostname(),
+    machine: input.machine ?? computerDisplayName(),
     monitorCpuPercent: input.self.cpuPercent,
     monitorMemoryBytes: input.self.memoryBytes,
     agents: [...agents]

package/apps/bridge/src/monitor/support/heartbeat.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import type { RelayClient } from "../../../../../packages/core/relay-client";
 
 /**
@@ -20,7 +20,7 @@ export const HEARTBEAT_INTERVAL_MS = Number(
  */
 export async function publishHeartbeat(client: RelayClient): Promise<void> {
   await client.send(
-    { type: "machine.heartbeat", machine: hostname(), createdAt: Date.now() },
+    { type: "machine.heartbeat", machine: computerDisplayName(), createdAt: Date.now() },
     "phone",
     { ttlMs: HEARTBEAT_INTERVAL_MS * 3, reliable: false },
   );
@@ -38,7 +38,7 @@ export const HELD_HEARTBEAT_TTL_MS = 60_000;
 
 export async function publishHeldHeartbeat(client: RelayClient): Promise<void> {
   await client.send(
-    { type: "machine.heartbeat", machine: hostname(), createdAt: Date.now() },
+    { type: "machine.heartbeat", machine: computerDisplayName(), createdAt: Date.now() },
     "phone",
     { ttlMs: HELD_HEARTBEAT_TTL_MS, reliable: true },
   );

package/apps/bridge/src/monitor/support/runtime.ts

@@ -1,5 +1,5 @@
 import { refreshCodexHooks } from "../../codex-hook-trust";
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { RelayClient } from "../../../../../packages/core/relay-client";
 import type { Payload, SessionInfo, SessionsStatus } from "../../../../../packages/protocol/schema";
 import { loadRuntimeConfig } from "../../config";
@@ -18,6 +18,7 @@ import { deriveObservedClaims } from "../../mesh/observed/claims";
 import { ingestRuntimeInvocations } from "../../engine/invocation/ingest";
 import { HEARTBEAT_INTERVAL_MS, publishHeartbeat } from "./heartbeat";
 import { confirmPendingController } from "../../pairing/controllers";
+import { recordControllerName } from "../../pairing/presence";
 import { startPublishLoop } from "./publish-loop";
 import { singleFlightPublisher } from "./single-flight";
 import { createMachineLoadPublisher } from "../../machine-load";
@@ -81,7 +82,7 @@ function monitorSnapshot(input: {
   const runtime = loadRuntimeConfig();
   return {
     type: "sessions.status",
-    machine: hostname(),
+    machine: computerDisplayName(),
     sessions: decorateSessions(sessions, subscriptions),
     history: includeHistory
       ? decorateSessions(boundedCatalogHistory(history(forceHistory), subscriptions), subscriptions)
@@ -218,6 +219,7 @@ export function startSessionMonitor(client: RelayClient): SessionMonitor {
   const off = client.onMessage(async (payload: Payload, peerPublicKey) => {
     if (payload.type === "hello" && payload.role === "phone") {
       confirmPendingController(client.room, peerPublicKey);
+      recordControllerName(peerPublicKey, payload.deviceName);
     }
     return handleMonitorMessage(client, payload, { leadership, subscriptions, publish, peerPublicKey });
   });

package/apps/bridge/src/pairing/presence.ts

@@ -1,10 +1,12 @@
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { configDir } from "../config/runtime/paths";
+import { writePrivateFile } from "../config/access/write-private";
 
 type PresenceState = {
   phoneLastSeenAt?: number;
   controllers?: Record<string, number>;
+  names?: Record<string, string>;
 };
 
 function presencePath(): string {
@@ -31,6 +33,25 @@ export function readControllerLastSeenAt(peerPublicKey: string): number | null {
   return typeof at === "number" && Number.isFinite(at) ? at : null;
 }
 
+export function readControllerName(peerPublicKey: string): string | null {
+  const name = readPresence().names?.[peerPublicKey];
+  return typeof name === "string" && name.length > 0 && name.length <= 80
+    && !/^(phone|machine|iphone|ipad)$/i.test(name) ? name : null;
+}
+
+/** A controller chooses its own visible label; never infer it from a pairing role. */
+export function recordControllerName(peerPublicKey: string, value: string): boolean {
+  const name = value.trim();
+  if (!/^[A-Za-z0-9+/]{43}=$/.test(peerPublicKey)
+    || !name || name.length > 80 || /[\x00-\x1f\x7f]/.test(name)
+    || /^(phone|machine|iphone|ipad)$/i.test(name)) return false;
+  const previous = readPresence();
+  const names = { ...previous.names, [peerPublicKey]: name };
+  const bounded = Object.fromEntries(Object.entries(names).slice(-32));
+  writePrivateFile(presencePath(), JSON.stringify({ ...previous, names: bounded }));
+  return true;
+}
+
 export function hasControllerPresence(): boolean {
   return Object.keys(readPresence().controllers ?? {}).length > 0;
 }

package/apps/bridge/src/reply/process/index.ts

@@ -93,7 +93,6 @@ export function runProcess(
       return;
     }
     const untrack = key ? track(key, child) : () => {};
-    if (stdin != null) child.stdin?.end(stdin);
     let stdout = "";
     let stderr = "";
     let done = false;
@@ -134,5 +133,13 @@ export function runProcess(
         }` });
       }
     });
+    if (stdin != null) {
+      child.stdin?.on("error", (error: NodeJS.ErrnoException) => {
+        // A CLI can finish with a valid result before it reads the whole prompt.
+        // Its closed pipe must not become an uncaught exception in the bridge.
+        if (error.code !== "EPIPE") finish({ ok: false, error: `${command}: ${error.message}` });
+      });
+      child.stdin?.end(stdin);
+    }
   });
 }

package/apps/mcp/src/connection-center/state.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import { loadConfig } from "../../../bridge/src/config";
 import { isMachineConfigured, listPairedPhones, readOnlyMachineConfigPath } from "../status/pairing-status";
 import { inspectProviderStatusSnapshot } from "../status/provider-status";
@@ -68,7 +68,7 @@ export class ConnectionState {
     return {
       structuredContent: {
         status,
-        computer: hostname(),
+        computer: computerDisplayName(),
         version: packageVersion(),
         relay: config ? new URL(config.relayUrl).host : "",
         relayStatus: runtime.relayStatus,

package/apps/mcp/src/connection-center/widget.html

@@ -37,7 +37,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <dt>Last encrypted message from iPhone</dt><dd id="phone">Not observed</dd></dl>
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>QR pairs a phone directly. A passkey links this Mac to your GrantTap account so your signed-in phone can discover its computers. Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.35</code> and <code>granttap setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.37</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/desktop/load/index.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import {
   sampleAgentProcesses, type AgentProcessLoad,
 } from "../../../../bridge/src/machine-load/host/process-sampler";
@@ -12,7 +12,7 @@ export async function desktopMachineLoad(
   return {
     operation: "desktop.machine_load" as const,
     source: "process_sample" as const,
-    computer: hostname(),
+    computer: computerDisplayName(),
     observed_at: now(),
     agents: Object.entries(processes)
       .filter(([agent]) => agent.length > 0)

package/apps/mcp/src/desktop/native-access/README.md

@@ -2,8 +2,10 @@
 
 `routes.ts` exposes the existing private desktop bridge on loopback for the
 sandboxed Mac App Store client. This is a desktop-only authorization grant,
-separate from provider MCP OAuth. A local human consent page, same-origin POST,
-one-time code and S256 PKCE are required. The callback is fixed to
+separate from provider MCP OAuth. Without a passkey account, a local human
+consent page, a matching one-time consent cookie, one-time code and S256 PKCE
+are required. An explicit foreign Origin is rejected; native browser sessions
+may send an opaque Origin. The callback is fixed to
 `granttap://desktop-auth`; there is no user-selected redirect. Pending consent
 and codes expire after five minutes. A private file stores only token hashes,
 up to eight active grants, expiring after 30 days. The app keeps its token in
@@ -16,6 +18,11 @@ provider broader MCP scope. The installer/runtime remains outside the sandbox.
 `/desktop/account/link` uses the same native grant, verifies the app's fresh
 passkey account session with granttap.com, and stores a revocable machine
 credential locally. It returns only the account and machine identifiers.
+`/desktop/account/authorize` exchanges the Mac app's passkey account session
+for the same scoped local grant. The relay verifies the account and existing
+machine identity, or enrolls this Mac if it has not been linked. The account
+session remains in the app Keychain; cross-origin browser requests cannot read
+it or submit JSON to the loopback service.
 Tests exercise real HTTP and Unix sockets, consent forgery rejection, PKCE,
 one-use codes, expiration, restart and authenticated forwarding.
 

package/apps/mcp/src/desktop/native-access/access.ts

@@ -44,6 +44,15 @@ export class DesktopNativeAccess {
     this.codes.delete(code);
     if (!row || row.expires <= this.now() || !/^[A-Za-z0-9_-]{43,128}$/.test(verifier)
       || digest(verifier) !== row.challenge) throw new Error('Invalid native code');
+    return this.issueGrant();
+  }
+
+  /** Called only after the local route verifies a passkey account with the relay. */
+  issueVerifiedAccountGrant(): string {
+    return this.issueGrant();
+  }
+
+  private issueGrant(): string {
     const token = random();
     const grants = this.grants().filter(grant => grant.expires > this.now()).slice(-7);
     grants.push({ digest: digest(token), expires: this.now() + 30 * 24 * 3_600_000 });

package/apps/mcp/src/desktop/native-access/routes.ts

@@ -7,7 +7,7 @@ import { enrollMacAccount } from '../../../../bridge/src/account-recovery/enroll
 import { websiteOrigin } from '../../oauth/consent/website-session';
 
 export function installDesktopNativeRoutes(app: Express, socketPath: string, origin: string,
-  access = new DesktopNativeAccess()): void {
+  access = new DesktopNativeAccess(), enroll = enrollMacAccount): void {
   app.use('/desktop', (_req, res, next) => {
     res.set({ 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer',
       'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'none'; form-action 'self'; frame-ancestors 'none'" });
@@ -26,7 +26,9 @@ export function installDesktopNativeRoutes(app: Express, socketPath: string, ori
   });
   app.post('/desktop/approve', (req, res) => {
     const confirmation = String(req.body?.confirmation ?? '');
-    if (req.headers.origin !== origin || !confirmation ||
+    const requestOrigin = req.headers.origin;
+    if ((requestOrigin !== undefined && requestOrigin !== 'null' && requestOrigin !== origin)
+      || !confirmation ||
       !(req.headers.cookie ?? '').split(';').some(cookie => cookie.trim() === `granttap_desktop_consent=${confirmation}`)) {
       res.status(403).json({ error: 'Native approval requires this local consent page' }); return;
     }
@@ -53,6 +55,14 @@ export function installDesktopNativeRoutes(app: Express, socketPath: string, ori
       res.status(403).json({ error: 'Account link could not be verified' });
     }
   });
+  app.post('/desktop/account/authorize', express.json({ limit: '2kb' }), async (req, res) => {
+    try {
+      await enroll(String(req.body?.accountToken ?? ''), websiteOrigin() ?? 'https://granttap.com');
+      res.json({ access_token: access.issueVerifiedAccountGrant() });
+    } catch {
+      res.status(403).json({ error: 'Passkey account could not authorize this Mac' });
+    }
+  });
   app.post('/desktop/invoke', (req, res, next) => {
     const auth = String(req.headers.authorization ?? '');
     if (!auth.startsWith('Bearer ') || !access.verify(auth.slice(7))) {

package/apps/mcp/src/desktop/pairing/index.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { loadConfig } from "../../../../bridge/src/config";
 import { reloadPairingHelper } from "../../../../bridge/src/install";
 import { createOneTimePairing, DEFAULT_RELAY, PAIRING_CODE_TTL_MINUTES } from "../../../../bridge/src/pairing";
@@ -37,7 +37,7 @@ export class DesktopControllerEnrollment {
 
   snapshot(now = Date.now()): DesktopControllerCode {
     const result: DesktopControllerCode = {
-      operation: "desktop.controller_enrollment", status: "idle", computer: hostname(),
+      operation: "desktop.controller_enrollment", status: "idle", computer: computerDisplayName(),
     };
     if (!this.pending) return result;
     if (!isMachineConfigured()) { this.pending = null; return result; }
@@ -77,7 +77,8 @@ export class DesktopControllerEnrollment {
       this.onPairingChanged();
       return this.snapshot();
     } catch {
-      return { operation: "desktop.controller_enrollment", status: "unavailable", computer: hostname() };
+      return { operation: "desktop.controller_enrollment", status: "unavailable",
+        computer: computerDisplayName() };
     }
   }
 }

package/apps/mcp/src/oauth/session/connect-snapshot.ts

@@ -2,7 +2,7 @@ import { codexHooksReady } from "../../../../bridge/src/codex-hook-trust";
 /**
  * Public consent snapshot for granttap.com. No pairing keys, tokens, or codes.
  */
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { inspectAgentIntegrations } from "../../../../bridge/src/install";
 import { loadConfig } from "../../../../bridge/src/config";
 import { computerId } from "../../../../bridge/src/mesh/identity/computer";
@@ -49,7 +49,7 @@ export function buildConnectSnapshot(clientName?: string): ConnectSnapshot {
   const runtime = connectionRuntimeStatus(room || undefined);
   return {
     clientName: publicClientName(clientName),
-    computerName: hostname(),
+    computerName: computerDisplayName(),
     paired,
     passkeyCapable: true,
     machineId: loadAccountLink()?.machineId,
@@ -70,7 +70,7 @@ export function buildConnectSnapshot(clientName?: string): ConnectSnapshot {
 
 /** Computers and open tasks only. No transcripts, keys, or room ids. */
 export function publicMeshSummary(): ConnectMesh {
-  const thisComputer = hostname().trim().slice(0, 80) || "This Mac";
+  const thisComputer = computerDisplayName();
   try {
     const store = localMeshStore();
     const names = new Set<string>([thisComputer, computerId().slice(0, 80)]);

package/apps/mcp/src/status/desktop-status.ts

@@ -1,8 +1,9 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import { loadConfig } from "../../../bridge/src/config";
 import { connectionRuntimeStatus } from "../mcp-tools/connect/relay";
 import { packageVersion } from "./package-version";
 import { computerId } from "../../../bridge/src/mesh/identity/computer";
+import { loadAccountLink } from "../../../bridge/src/account-recovery/link";
 import {
   isMachineConfigured, listPairedPhones, phoneReachability, readOnlyMachineConfigPath,
 } from "./pairing-status";
@@ -18,8 +19,9 @@ export function desktopStatusSnapshot(desktopEngineSocket?: string) {
     schema: "granttap.desktop-status.v1" as const,
     ok: true,
     service: "granttap-mcp" as const,
-    computer: hostname(),
+    computer: computerDisplayName(),
     endpointId: computerId(),
+    accountLinkSaved: loadAccountLink() !== null,
     version: packageVersion(),
     paired: configured,
     phoneReachability: phoneReachability(phones),

package/apps/mcp/src/status/pairing-status.ts

@@ -3,7 +3,8 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { loadConfig } from "../../../bridge/src/config";
-import { hasControllerPresence, readControllerLastSeenAt, readPhoneLastSeenAt } from "../../../bridge/src/pairing/presence";
+import { hasControllerPresence, readControllerLastSeenAt, readControllerName,
+  readPhoneLastSeenAt } from "../../../bridge/src/pairing/presence";
 import { controllerPeerGate } from "../../../bridge/src/pairing/controllers";
 
 export type PairedPhone = {
@@ -59,14 +60,15 @@ export function listPairedPhones(phoneLastSeenAt: number | null = null, now = Da
     value != null && (best == null || value > best) ? value : best
   ), null);
   const seen = lastSeenAt != null && now - lastSeenAt < 60_000;
-  const primary: PairedPhone = { name, status: seen ? "seen" : "paired", lastSeenAt };
+  const primary: PairedPhone = { name: readControllerName(machine.peerPublicKey) ?? name,
+    status: seen ? "seen" : "paired", lastSeenAt };
   const allowed = controllerPeerGate(machine);
   const additional = (machine.extraPeerPublicKeys ?? [])
     .filter((key) => key && key !== machine.peerPublicKey && allowed(key))
     .map((key, index): PairedPhone => {
       const at = readControllerLastSeenAt(key);
       const suffix = createHash("sha256").update(key).digest("hex").slice(0, 6);
-      return { name: `Controller ${index + 2} · ${suffix}`,
+      return { name: readControllerName(key) ?? `Controller ${index + 2} · ${suffix}`,
         status: at != null && now - at < 60_000 ? "seen" : "paired", lastSeenAt: at };
     });
   return [primary, ...additional];

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.35
+npm install -g granttap-mcp@0.8.37
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.35\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.37\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.35";
+const PACKAGE = "granttap-mcp@0.8.37";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.35",
+  "version": "0.8.37",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
     "prepublishOnly": "npm run inventory && npm run structure -- --strict && npm run package:allowlist && npm run test:coverage && npm run typecheck"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "express": "^5.2.1",
     "qrcode": "^1.5.4",
     "tsx": "^4.23.4",

package/packages/core/computer-name.ts

@@ -0,0 +1,31 @@
+import { execFileSync } from "node:child_process";
+import { hostname } from "node:os";
+
+type NameSources = {
+  platform?: NodeJS.Platform;
+  host?: string;
+  override?: string;
+  macName?: () => string;
+};
+
+function usableName(value: string | undefined): string | null {
+  const name = value?.trim();
+  return name && name.length <= 80 && !/[\x00-\x1f\x7f]/.test(name) ? name : null;
+}
+
+/** User-visible computer name; network hostname remains only a fallback. */
+export function computerDisplayName(sources: NameSources = {}): string {
+  const override = usableName(sources.override ?? process.env.GRANTTAP_COMPUTER_NAME);
+  if (override) return override;
+  if ((sources.platform ?? process.platform) === "darwin") {
+    try {
+      const macName = sources.macName ?? (() => execFileSync(
+        "/usr/sbin/scutil", ["--get", "ComputerName"],
+        { encoding: "utf8", timeout: 2_000, maxBuffer: 4_096 },
+      ));
+      const name = usableName(macName());
+      if (name) return name;
+    } catch { /* Computer Name may be unset; preserve the network fallback. */ }
+  }
+  return usableName(sources.host ?? hostname()) ?? "Computer";
+}