granttap-mcp 0.8.38 → 0.8.39

package/apps/mcp/src/connection-center/widget.html

@@ -37,7 +37,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <dt>Last encrypted message from iPhone</dt><dd id="phone">Not observed</dd></dl>
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>QR pairs a phone directly. A passkey links this Mac to your GrantTap account so your signed-in phone can discover its computers. Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.38</code> and <code>granttap setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.39</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/desktop/native-access/README.md

@@ -10,6 +10,9 @@ may send an opaque Origin. The callback is fixed to
 and codes expire after five minutes. A private file stores only token hashes,
 up to eight active grants, expiring after 30 days. The app keeps its token in
 its device-only Keychain and never shares it with a provider.
+The fallback consent page is styled and localized by the loopback service;
+the stylesheet has no script or external dependency. A Mac app with a verified
+passkey account uses `/desktop/account/authorize` instead of opening that page.
 
 `/desktop/invoke` requires that grant before parsing a bounded request. It can
 invoke only the existing allowlisted desktop operations; inputs are still

package/apps/mcp/src/desktop/native-access/consent-page.ts

@@ -0,0 +1,43 @@
+const copy = {
+  en: {
+    heading: 'Allow GrantTap on this Mac',
+    detail: 'GrantTap for Mac needs access to the local GrantTap service to show your tasks, send messages, handle approvals, and configure the relay.',
+    scope: 'This approval applies only to this Mac app on this computer. It does not authorize another computer or a coding provider.',
+    action: 'Allow this Mac app',
+    expires: 'The authorization request expires after five minutes.',
+  },
+  ru: {
+    heading: 'Разрешить GrantTap на этом Mac',
+    detail: 'Приложению GrantTap для Mac нужен доступ к локальному сервису, чтобы показывать задачи, отправлять сообщения, обрабатывать одобрения и настраивать relay.',
+    scope: 'Разрешение действует только для приложения на этом Mac. Оно не открывает доступ другому компьютеру или агенту.',
+    action: 'Разрешить на этом Mac',
+    expires: 'Запрос разрешения истечёт через пять минут.',
+  },
+} as const;
+
+type Consent = { id: string; confirmation: string; state: string };
+
+export function desktopConsentPage(row: Consent, language: string | undefined): string {
+  const locale = language?.toLowerCase().startsWith('ru') ? 'ru' : 'en';
+  const words = copy[locale];
+  return `<!doctype html><html lang="${locale}"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark"><title>GrantTap for Mac</title>
+<link rel="stylesheet" href="/desktop/consent.css"></head><body>
+<main class="consent-card"><div class="brand"><span class="brand-mark" aria-hidden="true">✓</span><span>GrantTap</span></div>
+<h1>${words.heading}</h1><p>${words.detail}</p><p class="scope">${words.scope}</p>
+<form action="/desktop/approve" method="post"><input type="hidden" name="id" value="${row.id}">
+<input type="hidden" name="confirmation" value="${row.confirmation}">
+<input type="hidden" name="state" value="${row.state}"><button type="submit">${words.action}</button></form>
+<p class="footnote">${words.expires}</p></main></body></html>`;
+}
+
+export const desktopConsentStyles = `:root{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color-scheme:light dark}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:#f4f1ed;color:#211f1d}
+.consent-card{width:min(100%,480px);padding:32px;border:1px solid #dfd8d0;border-radius:24px;background:#fff;box-shadow:0 16px 48px #20170e18}
+.brand{display:flex;align-items:center;gap:10px;font-size:19px;font-weight:750}.brand-mark{display:grid;place-items:center;width:38px;height:38px;border-radius:10px;background:#f17b39;color:#17110e;font-size:26px}
+h1{margin:32px 0 14px;font-size:27px;line-height:1.2;letter-spacing:-.025em}p{margin:0 0 18px;line-height:1.5;color:#56504a}
+.scope{padding:15px 16px;border-radius:12px;background:#f4f1ed;color:#38332e}button{display:block;width:100%;margin-top:24px;padding:14px 18px;border:0;border-radius:12px;background:#ca4e24;color:white;font:inherit;font-weight:700;cursor:pointer}
+button:hover{background:#a93c1b}button:focus-visible{outline:3px solid #2171d1;outline-offset:3px}.footnote{margin:18px 0 0;text-align:center;font-size:13px;color:#817a73}
+@media(prefers-color-scheme:dark){body{background:#101114;color:#f5f2ef}.consent-card{background:#22252a;border-color:#3b3e45;box-shadow:0 16px 48px #0007}p{color:#bdb8b2}.scope{background:#30343a;color:#e0dad3}.footnote{color:#a39e98}}
+`;

package/apps/mcp/src/desktop/native-access/routes.ts

@@ -5,23 +5,23 @@ import { invokeDesktop } from './invoke';
 import { DESKTOP_OPERATIONS, desktopOperationTimeout } from '../engine-bridge';
 import { enrollMacAccount } from '../../../../bridge/src/account-recovery/enroll';
 import { websiteOrigin } from '../../oauth/consent/website-session';
+import { desktopConsentPage, desktopConsentStyles } from './consent-page';
 
 export function installDesktopNativeRoutes(app: Express, socketPath: string, origin: string,
   access = new DesktopNativeAccess(), enroll = enrollMacAccount): void {
   app.use('/desktop', (_req, res, next) => {
     res.set({ 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer',
-      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'none'; form-action 'self'; frame-ancestors 'none'" });
+      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'none'; style-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'" });
     next();
   });
+  app.get('/desktop/consent.css', (_req, res) => res.type('css').send(desktopConsentStyles));
   app.get('/desktop/authorize', (req, res) => {
     try {
       const row = access.begin(String(req.query.challenge ?? ''), String(req.query.state ?? ''));
       res.cookie('granttap_desktop_consent', row.confirmation, {
         httpOnly: true, sameSite: 'strict', path: '/desktop/approve', maxAge: 300_000,
       });
-      res.type('html').send(`<!doctype html><html lang="en"><meta charset="utf-8"><title>GrantTap for Mac</title>
-<h1>Allow GrantTap for Mac on this computer</h1><p>The app can inspect tasks, send your messages, handle approvals and configure your local relay. This does not authorize another computer or a coding provider.</p>
-<form action="/desktop/approve" method="post"><input type="hidden" name="id" value="${row.id}"><input type="hidden" name="confirmation" value="${row.confirmation}"><input type="hidden" name="state" value="${row.state}"><button type="submit">Allow this Mac app</button></form></html>`);
+      res.type('html').send(desktopConsentPage(row, req.headers['accept-language']));
     } catch { res.status(400).json({ error: 'Invalid native authorization' }); }
   });
   app.post('/desktop/approve', (req, res) => {

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.38
+npm install -g granttap-mcp@0.8.39
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.38\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.39\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.38";
+const PACKAGE = "granttap-mcp@0.8.39";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.38",
+  "version": "0.8.39",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {