granttap-mcp 0.8.37 → 0.8.39

package/README.md

@@ -170,7 +170,8 @@ decided by the runtime after receipt verification.
 
 The first executable handoff path is Claude Code ↔ Codex across linked
 computers. GrantTap builds a bounded Task Capsule from explicit task/git facts,
-requires local phone authorization, creates a separate target branch/worktree,
+requires authorization from the phone or the owning Mac's local desktop channel,
+creates a separate target branch/worktree,
 starts the target execution, and returns a receipt bound to the exact capsule.
 Cursor uses the same provider-neutral schema and trusted caller attribution.
 Grok Build remains observable where available, but does not
@@ -192,6 +193,10 @@ the commit fetches that branch once before refusing. A handoff can also stay on
 one computer: the same Task continues with another agent there, in a worktree
 of its own from the same commit, taken up at once by the computer that
 prepared it.
+The person can select an advertised destination model and add a bounded comment.
+Both travel inside the encrypted capsule; the destination includes the comment
+in the new execution's opening message and starts the selected model. A model
+change on the same computer and provider is a new execution of the same Task.
 
 ### Pause and resume
 

package/apps/bridge/src/mesh/admin/capsule.ts

@@ -70,6 +70,8 @@ export function buildTaskCapsule(
     targetProvider: request.targetProvider,
     targetActorId: request.targetActorId,
     targetComputer: request.targetComputer,
+    targetModel: request.targetModel,
+    userComment: request.userComment,
     repository: project.canonicalRepositoryId,
     baseSha: head,
     branch: session.branch ?? git(cwd, ["branch", "--show-current"]),

package/apps/bridge/src/mesh/runtime/dependencies.ts

@@ -22,7 +22,7 @@ export type MeshRuntimeDependencies = {
   now: () => number;
   eventId: () => string;
   providerEnabled: (provider: Exclude<MeshProvider, "grok_bot">) => boolean;
-  start: (provider: MeshProvider, prompt: string, cwd: string) => Promise<StartResult>;
+  start: (provider: MeshProvider, prompt: string, cwd: string, model?: string) => Promise<StartResult>;
   deliver: typeof deliverToSession;
   send: (
     client: RelayClient,

package/apps/bridge/src/mesh/runtime/handoff.ts

@@ -19,6 +19,7 @@ function capsulePrompt(capsule: TaskCapsule): string {
     `Base SHA: ${capsule.baseSha}`,
   ];
   if (capsule.latestCommit) lines.push(`Latest commit: ${capsule.latestCommit}`);
+  if (capsule.userComment) lines.push(`User comment: ${capsule.userComment}`);
   if (capsule.checkpoint) {
     const { status, files, excluded } = capsule.checkpoint;
     const line = status === "complete"
@@ -138,7 +139,9 @@ async function acceptHandoff(
     revision,
   );
   if (!worktree) return rejectHandoff(deps, client, event, "A separate handoff worktree could not be created.");
-  const result = await deps.start(capsule.targetProvider, capsulePrompt(capsule), worktree.path);
+  const result = await deps.start(
+    capsule.targetProvider, capsulePrompt(capsule), worktree.path, capsule.targetModel,
+  );
   if (!result.ok || !result.sessionId) {
     const reason = result.ok ? "The target agent did not create a session." : result.error;
     return rejectHandoff(deps, client, event, reason);

package/apps/bridge/src/mesh/runtime/index.ts

@@ -62,11 +62,11 @@ const defaultDependencies: MeshRuntimeDependencies = {
   now: Date.now,
   eventId: randomUUID,
   providerEnabled: isProviderEnabled,
-  start: async (provider, prompt, cwd) => {
-    if (provider === "claude") return createClaudeSession(prompt, cwd);
-    if (provider === "codex") return createCodexSession(prompt, cwd);
-    if (provider === "cursor") return createCursorSession(prompt, cwd);
-    return createGrokSession(prompt, cwd);
+  start: async (provider, prompt, cwd, model) => {
+    if (provider === "claude") return createClaudeSession(prompt, cwd, 240_000, [], model);
+    if (provider === "codex") return createCodexSession(prompt, cwd, 240_000, [], model);
+    if (provider === "cursor") return createCursorSession(prompt, cwd, 240_000, [], model);
+    return createGrokSession(prompt, cwd, 240_000, [], model);
   },
   deliver: deliverToSession,
   hasCommit: repositoryHasCommit,

package/apps/mcp/src/connection-center/widget.html

@@ -37,7 +37,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <dt>Last encrypted message from iPhone</dt><dd id="phone">Not observed</dd></dl>
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>QR pairs a phone directly. A passkey links this Mac to your GrantTap account so your signed-in phone can discover its computers. Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.37</code> and <code>granttap setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.39</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/desktop/delivery/README.md

@@ -10,7 +10,13 @@ same limits as encrypted phone messages. Invalid batches are rejected rather
 than silently losing files. The existing provider attachment pipeline stages
 images and arbitrary documents; the native client removes its batch after reply.
 
-Tests: `tests/desktop/desktop-task-send.test.ts`, local `tests/attachments.test.ts`.
+`desktop.task_handoff` accepts a bounded handoff request from the authenticated
+Mac desktop channel. It verifies the exact owning local execution, then asks the
+canonical Mesh runtime to prepare the encrypted Task Capsule. A destination
+model and user comment are carried with the Task, including for another computer.
+
+Tests: `tests/desktop/desktop-task-send.test.ts`,
+`tests/desktop/delivery/task-handoff.test.ts`, local `tests/attachments.test.ts`.
 Parent: [Desktop local channel](../README.md).
 
 This MCP component is covered by the repository [MIT License](../../../../../LICENSE).

package/apps/mcp/src/desktop/delivery/task-handoff.ts

@@ -0,0 +1,57 @@
+import { join } from "node:path";
+import { RelayClient } from "../../../../../packages/core/relay-client";
+import { MeshHandoffPrepare, type MeshHandoffPrepare as HandoffRequest } from "../../../../../packages/protocol/schema";
+import { configDir, loadConfig, machineConfigPath } from "../../../../bridge/src/config";
+import { applyNetworkRoute } from "../../../../bridge/src/device-network/settings";
+import { observedComputerId } from "../../../../bridge/src/mesh/identity/computer";
+import { prepareMeshHandoff } from "../../../../bridge/src/mesh/runtime";
+import { readStoreState } from "../../../../bridge/src/mesh/store/state";
+import { controllerPeerGate } from "../../../../bridge/src/pairing/controllers";
+
+type Prepare = (request: HandoffRequest) => Promise<boolean>;
+
+async function prepareThroughRelay(request: HandoffRequest): Promise<boolean> {
+  const config = applyNetworkRoute(loadConfig(machineConfigPath()));
+  const client = new RelayClient(config, { peerAllowed: controllerPeerGate(config) });
+  try {
+    await client.connect();
+    return await prepareMeshHandoff(client, request);
+  } finally {
+    client.close();
+  }
+}
+
+/** Same-user Mac request, limited to the exact Task owner on this computer. */
+export async function desktopTaskHandoff(
+  input: unknown,
+  storePath = join(configDir(), "project-mesh.json"),
+  prepare: Prepare = prepareThroughRelay,
+  localComputer = observedComputerId(),
+): Promise<unknown> {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return undefined;
+  const row = input as Record<string, unknown>;
+  const request = MeshHandoffPrepare.safeParse({
+    type: "mesh.handoff.prepare",
+    sessionId: row.session_id, projectId: row.project_id, taskId: row.task_id,
+    targetProvider: row.target_provider, targetComputer: row.target_computer,
+    targetModel: row.target_model, userComment: row.user_comment,
+    checkpoint: row.checkpoint, push: row.push, createdAt: Date.now(),
+  });
+  if (!request.success) return undefined;
+  const loaded = readStoreState(storePath);
+  if (loaded.status !== "ok") return undefined;
+  const task = loaded.state.tasks.find((item) => item.taskId === request.data.taskId);
+  const execution = loaded.state.executions.find((item) =>
+    item.taskId === request.data.taskId && item.sessionId === request.data.sessionId
+      && item.endedAt == null && item.computerId === localComputer);
+  if (task?.projectId !== request.data.projectId || task.ownerSessionId !== request.data.sessionId
+    || !execution?.workspace) return undefined;
+  try {
+    const accepted = await prepare(request.data);
+    return { operation: "desktop.task_handoff", accepted,
+      error: accepted ? null : "The handoff was not ready. Check the Task and its repository." };
+  } catch {
+    return { operation: "desktop.task_handoff", accepted: false,
+      error: "The local relay or handoff service is unavailable." };
+  }
+}

package/apps/mcp/src/desktop/engine-bridge.ts

@@ -22,6 +22,7 @@ export const DESKTOP_OPERATIONS = new Set([
   "desktop.installed_skills", "desktop.policy_status", "desktop.policy_set", "desktop.project_auto_accept",
   "desktop.mesh_snapshots",
   "desktop.task_send",
+  "desktop.task_handoff",
   "desktop.task_create",
   "desktop.mesh_create",
   "desktop.invocation_history",
@@ -48,7 +49,7 @@ export function desktopOperationTimeout(operation: unknown, input: unknown): num
     || operation === "desktop.mesh_snapshots") return 75_000;
   if (operation === "desktop.task_activity"
     || operation === "desktop.task_image" || operation === "desktop.live_catalog") return 45_000;
-  if (operation === "desktop.task_send"
+  if (operation === "desktop.task_send" || operation === "desktop.task_handoff"
     || operation === "desktop.task_create") return 250_000;
   if (operation === "desktop.mesh_snapshot"
     && (input as { enrich?: unknown } | undefined)?.enrich === "true") return 45_000;

package/apps/mcp/src/desktop/native-access/README.md

@@ -10,6 +10,9 @@ may send an opaque Origin. The callback is fixed to
 and codes expire after five minutes. A private file stores only token hashes,
 up to eight active grants, expiring after 30 days. The app keeps its token in
 its device-only Keychain and never shares it with a provider.
+The fallback consent page is styled and localized by the loopback service;
+the stylesheet has no script or external dependency. A Mac app with a verified
+passkey account uses `/desktop/account/authorize` instead of opening that page.
 
 `/desktop/invoke` requires that grant before parsing a bounded request. It can
 invoke only the existing allowlisted desktop operations; inputs are still

package/apps/mcp/src/desktop/native-access/consent-page.ts

@@ -0,0 +1,43 @@
+const copy = {
+  en: {
+    heading: 'Allow GrantTap on this Mac',
+    detail: 'GrantTap for Mac needs access to the local GrantTap service to show your tasks, send messages, handle approvals, and configure the relay.',
+    scope: 'This approval applies only to this Mac app on this computer. It does not authorize another computer or a coding provider.',
+    action: 'Allow this Mac app',
+    expires: 'The authorization request expires after five minutes.',
+  },
+  ru: {
+    heading: 'Разрешить GrantTap на этом Mac',
+    detail: 'Приложению GrantTap для Mac нужен доступ к локальному сервису, чтобы показывать задачи, отправлять сообщения, обрабатывать одобрения и настраивать relay.',
+    scope: 'Разрешение действует только для приложения на этом Mac. Оно не открывает доступ другому компьютеру или агенту.',
+    action: 'Разрешить на этом Mac',
+    expires: 'Запрос разрешения истечёт через пять минут.',
+  },
+} as const;
+
+type Consent = { id: string; confirmation: string; state: string };
+
+export function desktopConsentPage(row: Consent, language: string | undefined): string {
+  const locale = language?.toLowerCase().startsWith('ru') ? 'ru' : 'en';
+  const words = copy[locale];
+  return `<!doctype html><html lang="${locale}"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark"><title>GrantTap for Mac</title>
+<link rel="stylesheet" href="/desktop/consent.css"></head><body>
+<main class="consent-card"><div class="brand"><span class="brand-mark" aria-hidden="true">✓</span><span>GrantTap</span></div>
+<h1>${words.heading}</h1><p>${words.detail}</p><p class="scope">${words.scope}</p>
+<form action="/desktop/approve" method="post"><input type="hidden" name="id" value="${row.id}">
+<input type="hidden" name="confirmation" value="${row.confirmation}">
+<input type="hidden" name="state" value="${row.state}"><button type="submit">${words.action}</button></form>
+<p class="footnote">${words.expires}</p></main></body></html>`;
+}
+
+export const desktopConsentStyles = `:root{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color-scheme:light dark}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:#f4f1ed;color:#211f1d}
+.consent-card{width:min(100%,480px);padding:32px;border:1px solid #dfd8d0;border-radius:24px;background:#fff;box-shadow:0 16px 48px #20170e18}
+.brand{display:flex;align-items:center;gap:10px;font-size:19px;font-weight:750}.brand-mark{display:grid;place-items:center;width:38px;height:38px;border-radius:10px;background:#f17b39;color:#17110e;font-size:26px}
+h1{margin:32px 0 14px;font-size:27px;line-height:1.2;letter-spacing:-.025em}p{margin:0 0 18px;line-height:1.5;color:#56504a}
+.scope{padding:15px 16px;border-radius:12px;background:#f4f1ed;color:#38332e}button{display:block;width:100%;margin-top:24px;padding:14px 18px;border:0;border-radius:12px;background:#ca4e24;color:white;font:inherit;font-weight:700;cursor:pointer}
+button:hover{background:#a93c1b}button:focus-visible{outline:3px solid #2171d1;outline-offset:3px}.footnote{margin:18px 0 0;text-align:center;font-size:13px;color:#817a73}
+@media(prefers-color-scheme:dark){body{background:#101114;color:#f5f2ef}.consent-card{background:#22252a;border-color:#3b3e45;box-shadow:0 16px 48px #0007}p{color:#bdb8b2}.scope{background:#30343a;color:#e0dad3}.footnote{color:#a39e98}}
+`;

package/apps/mcp/src/desktop/native-access/routes.ts

@@ -5,23 +5,23 @@ import { invokeDesktop } from './invoke';
 import { DESKTOP_OPERATIONS, desktopOperationTimeout } from '../engine-bridge';
 import { enrollMacAccount } from '../../../../bridge/src/account-recovery/enroll';
 import { websiteOrigin } from '../../oauth/consent/website-session';
+import { desktopConsentPage, desktopConsentStyles } from './consent-page';
 
 export function installDesktopNativeRoutes(app: Express, socketPath: string, origin: string,
   access = new DesktopNativeAccess(), enroll = enrollMacAccount): void {
   app.use('/desktop', (_req, res, next) => {
     res.set({ 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer',
-      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'none'; form-action 'self'; frame-ancestors 'none'" });
+      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'none'; style-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'" });
     next();
   });
+  app.get('/desktop/consent.css', (_req, res) => res.type('css').send(desktopConsentStyles));
   app.get('/desktop/authorize', (req, res) => {
     try {
       const row = access.begin(String(req.query.challenge ?? ''), String(req.query.state ?? ''));
       res.cookie('granttap_desktop_consent', row.confirmation, {
         httpOnly: true, sameSite: 'strict', path: '/desktop/approve', maxAge: 300_000,
       });
-      res.type('html').send(`<!doctype html><html lang="en"><meta charset="utf-8"><title>GrantTap for Mac</title>
-<h1>Allow GrantTap for Mac on this computer</h1><p>The app can inspect tasks, send your messages, handle approvals and configure your local relay. This does not authorize another computer or a coding provider.</p>
-<form action="/desktop/approve" method="post"><input type="hidden" name="id" value="${row.id}"><input type="hidden" name="confirmation" value="${row.confirmation}"><input type="hidden" name="state" value="${row.state}"><button type="submit">Allow this Mac app</button></form></html>`);
+      res.type('html').send(desktopConsentPage(row, req.headers['accept-language']));
     } catch { res.status(400).json({ error: 'Invalid native authorization' }); }
   });
   app.post('/desktop/approve', (req, res) => {

package/apps/mcp/src/desktop/operations/index.ts

@@ -10,6 +10,7 @@ import type { DesktopTaskActivityRunner } from "../task-activity-runner";
 import type { EngineClient } from "../../../../bridge/src/engine/runtime/engine-client";
 import type { EngineOperation } from "../../../../bridge/src/engine/protocol/engine-protocol";
 import { desktopTaskSend } from "../delivery/task-send";
+import { desktopTaskHandoff } from "../delivery/task-handoff";
 import { desktopTaskCreate } from "../delivery/task-create";
 import { desktopMeshCreate } from "../delivery/mesh-create";
 import { desktopInvocationHistory } from "../invocation";
@@ -54,6 +55,7 @@ export function desktopReadOperation(input: {
   if (operation === "desktop.task_activity") return activity.read(queryInput, storePath);
   if (operation === "desktop.task_image") return activity.image(queryInput, storePath);
   if (operation === "desktop.task_send") return desktopTaskSend(queryInput, storePath);
+  if (operation === "desktop.task_handoff") return desktopTaskHandoff(queryInput, storePath);
   if (operation === "desktop.task_create") return desktopTaskCreate(queryInput, storePath);
   if (operation === "desktop.mesh_create") return Promise.resolve(desktopMeshCreate(queryInput, storePath));
   if (operation === "desktop.invocation_history") {

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.37
+npm install -g granttap-mcp@0.8.39
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.37\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.39\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.37";
+const PACKAGE = "granttap-mcp@0.8.39";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.37",
+  "version": "0.8.39",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/mesh/events.ts

@@ -18,6 +18,8 @@ export const TaskCapsule = z.object({
   targetProvider: MeshExecutionProvider,
   targetActorId: Identifier.optional(),
   targetComputer: Identifier,
+  targetModel: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:/-]{0,159}$/).optional(),
+  userComment: Detail.optional(),
   repository: z.string().trim().min(1).max(1_024),
   baseSha: GitSha,
   branch: z.string().trim().min(1).max(512).optional(),
@@ -206,6 +208,8 @@ export const MeshHandoffPrepare = z.object({
   targetProvider: MeshExecutionProvider,
   targetActorId: Identifier.optional(),
   targetComputer: Identifier,
+  targetModel: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:/-]{0,159}$/).optional(),
+  userComment: Detail.optional(),
   createdAt: z.number().nonnegative(),
   /**
    * Commit uncommitted work to a checkpoint branch first, so the Task can