granttap-mcp 0.8.41 → 0.8.47

package/README.md

@@ -17,6 +17,12 @@ adapters, and wire contracts. It powers Project Mesh, Governance, and observed
 usage while agents and provider credentials stay on your computer. Controller
 traffic is end-to-end encrypted.
 
+Known chats are read from their published native identities, without another
+walk through every provider log. The local helper retains a private metadata
+index so a restart can send current heads of the saved Now chats before a fresh
+discovery scan. The Apple clients keep downloaded conversations, pictures, and
+Mesh data locally for offline use; clearing that cache preserves the account login.
+
 The MCP runtime, plugins, and CLI are open source under the MIT License.
 The Apple apps, Engine, relay, and website are separately licensed commercial
 products or source. Their licenses do not change this repository's MIT grant.
@@ -328,6 +334,20 @@ invites, change the relay, expand Project scope, or reach `setup`; revoking the
 endpoint from the iPhone stops new Mesh operations immediately while local Task
 history stays on the device.
 
+## Decisions and Claude questions
+
+Tap an approval card to inspect the exact tool parameters and configure Auto
+allow for that chat. Apply waits for a receipt from the owning computer; an
+unconfirmed command is never shown as applied. The grant remains tied to the
+chat, Project, and current policy revision. Global DENY, paused automation, and
+new governance revisions still take precedence.
+
+Claude Code `AskUserQuestion` is delivered as a question form, including all
+options and descriptions, multiple selections, and an Other answer. Complete
+answers return through the same encrypted durable channel with Claude's original
+question array. Questions always need a human answer; Auto allow cannot answer
+them. A lost connection keeps Claude's local question flow available.
+
 ## Install
 
 The local runtime and plugins are available under the [MIT License](LICENSE).

package/apps/bridge/src/account-recovery/README.md

@@ -3,10 +3,12 @@
 `link.ts` persists the local Mac's opt-in account machine credential in its
 private GrantTap config directory. The Mac app can enroll through its existing
 authorized loopback connection; the provider MCP consent flow can enroll after
-a verified passkey assertion. `phone-link.ts` lets a QR-paired phone grant a
-machine-scoped credential through the existing encrypted device room after
-passkey sign-in. The Mac verifies it against the account service before saving
-and never receives the phone's account session token. The credential lets
+a verified passkey assertion. `phone-link.ts` accepts a legacy QR room's
+machine-scoped credential only when it matches the Mac's existing account
+machine, or when the Mac has no account machine yet. It cannot revoke or
+replace a machine enrolled through passkey. The Mac verifies the credential
+against the account service before saving and never receives the phone's
+account session token. The credential lets
 `poller.ts` answer
 short-lived, account-authorized phone requests. `offer.ts` creates a new phone
 controller key in the current room and seals its pairing half to the phone's

package/apps/bridge/src/account-recovery/offer.ts

@@ -30,7 +30,8 @@ export function createRecoveryOffer(request: RecoveryRequest, machineId: string)
     const extra = machineCfg.extraPeerPublicKeys ?? [];
     if (extra.length >= 16) throw new Error("This computer has reached its controller device limit.");
     const keys = generateKeyPair();
-    phoneCfg = { ...phoneCfg, senderId: randomId(8), myPublicKey: keys.publicKey,
+    phoneCfg = { ...phoneCfg, peerPublicKey: machineCfg.myPublicKey,
+      senderId: randomId(8), myPublicKey: keys.publicKey,
       mySecretKey: keys.secretKey };
     machineCfg = { ...machineCfg, extraPeerPublicKeys: [...extra, keys.publicKey] };
   }

package/apps/bridge/src/account-recovery/phone-link.ts

@@ -1,13 +1,14 @@
 import type { AccountMachineLink } from "../../../../packages/protocol/schema";
 import { loadAccountLink, saveAccountLink } from "./link";
 
-/** A trusted QR room can grant only a machine credential, never an account session. */
+/** A trusted QR room can enroll an unlinked Mac, never replace its machine identity. */
 export async function acceptPhoneAccountLink(
   link: AccountMachineLink, origin: string, request: typeof fetch = fetch,
 ): Promise<boolean> {
   if (new URL(origin).protocol !== "https:") return false;
   const current = loadAccountLink();
-  if (current && current.accountId !== link.accountId) return false;
+  if (current && (current.accountId !== link.accountId
+    || current.machineId !== link.machineId)) return false;
   const response = await request(`${origin}/api/account/machine/identity`, {
     headers: { authorization: `Bearer ${link.machineToken}`, accept: "application/json" },
     signal: AbortSignal.timeout(8_000), redirect: "error",
@@ -15,14 +16,6 @@ export async function acceptPhoneAccountLink(
   if (!response.ok) return false;
   const identity = await response.json() as { accountId?: string; machineId?: string };
   if (identity.accountId !== link.accountId || identity.machineId !== link.machineId) return false;
-  if (current && current.machineId !== link.machineId) {
-    const revoked = await request(`${origin}/api/account/machine/self`, {
-      method: "DELETE",
-      headers: { authorization: `Bearer ${current.machineToken}`, accept: "application/json" },
-      signal: AbortSignal.timeout(8_000), redirect: "error",
-    });
-    if (!revoked.ok && revoked.status !== 401) return false;
-  }
   return saveAccountLink({ accountId: link.accountId,
     machineId: link.machineId, machineToken: link.machineToken });
 }

package/apps/bridge/src/approvals/api.ts

@@ -1,3 +1,4 @@
+import { questionAnswers } from "../../../../packages/protocol/messages/approval-questions";
 import { randomUUID } from "node:crypto";
 import type { RelayClient } from "../../../../packages/core/relay-client";
 import {
@@ -86,6 +87,8 @@ export function acceptApprovalDecision(
   if (requestSessionId !== decisionSessionId) {
     return { matched: false, newlyResolved: false };
   }
+  if (record.request.kind === "question" && decision.decision === "allow"
+    && !questionAnswers(record.request.questions, decision.note)) return { matched: false, newlyResolved: false };
   const existingOutcome = recordOutcome(record);
   if (existingOutcome) return acceptance(record, existingOutcome, false);
   if (record.state !== "pending") return { matched: false, newlyResolved: false };

package/apps/bridge/src/approvals/index.ts

@@ -21,6 +21,7 @@ import {
 import { primeSessionKeys, sendSessionPayload } from "../host/session-keys";
 import { controllerPeerGate } from "../pairing/controllers";
 import { applyNetworkRoute } from "../device-network/settings";
+import { managedAdmissionOptions } from "../managed-admission";
 
 /**
  * Nobody answered — relay unreachable, or the phone never responded before the
@@ -46,7 +47,9 @@ export async function requestApproval(
   opts: RequestApprovalOpts = {},
 ): Promise<ApprovalDecision> {
   const timeoutMs = opts.timeoutMs ?? 60_000;
-  const client = opts.client ?? new RelayClient(applyNetworkRoute(cfg), { peerAllowed: controllerPeerGate(cfg) });
+  const routed = applyNetworkRoute(cfg);
+  const client = opts.client ?? new RelayClient(routed, {
+    ...managedAdmissionOptions(routed), peerAllowed: controllerPeerGate(cfg) });
   const ownsClient = !opts.client;
   let cancelDecisionWait = () => {};
   const registration = registerPendingApproval(req);

package/apps/bridge/src/approvals/records.ts

@@ -39,7 +39,7 @@ export function requestDigest(requestId: string): string {
 }
 
 export function requestFingerprint(request: ApprovalRequest): string {
-  const stable = JSON.stringify([
+  const fields: unknown[] = [
     request.type,
     request.requestId,
     request.agent,
@@ -50,7 +50,10 @@ export function requestFingerprint(request: ApprovalRequest): string {
     request.cwd ?? null,
     normalizedSessionId(request.sessionId) ?? null,
     request.risk,
-  ]);
+  ];
+  if (request.inputFingerprint || request.details) fields.push(request.inputFingerprint ?? request.details);
+  if (request.questions) fields.push(request.questions);
+  const stable = JSON.stringify(fields);
   return createHash("sha256").update(stable).digest("hex");
 }
 

package/apps/bridge/src/bin/hooks/claude-hook.ts

@@ -15,6 +15,8 @@
 import { recordProjectDecision } from "../../policy/decision-log";
 import { claudeToRequest, decisionToClaudeOutput, type HookInput } from "../../host/adapters";
 import { isUnanswered, requestApproval } from "../../approvals";
+import { questionRequest, claudeQuestionOutput } from "../../claude-questions";
+import { permitsProjectAskAutomation } from "../../task-automation";
 import {
   autoAcceptLevelFor,
   blockedSessionCapability,
@@ -100,15 +102,17 @@ async function handlePreToolUse(input: HookInput): Promise<void> {
 
   // Claude already granted this chat unconditional tool access. GrantTap's
   // Project ASK/DENY is a parent boundary, so bypass mode cannot weaken it.
-  if (legacyFlow && input.permission_mode === "bypassPermissions") return;
+  if (legacyFlow && input.permission_mode === "bypassPermissions" && input.tool_name !== "AskUserQuestion") return;
 
   // Gating paused, or this session is exempt → abstain (empty output = Claude
   // uses its normal permission flow, exactly as if GrantTap weren't installed).
   if (legacyFlow && isGatingSkipped(input.session_id)) return;
-  await continuePermissionFlow(input, legacyFlow);
+  await continuePermissionFlow(input, legacyFlow,
+    permitsProjectAskAutomation(projectDecision, input.session_id), projectDecision);
 }
 
-async function continuePermissionFlow(input: HookInput, legacyFlow: boolean): Promise<void> {
+async function continuePermissionFlow(input: HookInput, legacyFlow: boolean, taskAutomation = false,
+  scope: { projectId?: string; policy_revision?: number } = {}): Promise<void> {
   let cfg;
   try {
     cfg = loadConfig(machineConfigPath());
@@ -127,8 +131,12 @@ async function continuePermissionFlow(input: HookInput, legacyFlow: boolean): Pr
   // keep Claude's own prompts rather than be silently auto-allowed by a product
   // the user never finished setting up. Once paired, this is what keeps routine
   // work independent of whether the phone is awake, reachable, or even running.
-  const req = claudeToRequest(input);
-  if (legacyFlow && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+  if (input.tool_name === "AskUserQuestion") {
+    await answerNativeQuestion(input, cfg, scope);
+    return;
+  }
+  const req = { ...claudeToRequest(input), projectId: scope.projectId, policyRevision: scope.policy_revision };
+  if ((legacyFlow || taskAutomation) && shouldAutoAcceptTool(input.session_id, req.tool, req.command, scope.projectId)) {
     writeAutoApproval(input, req);
     return;
   }
@@ -152,6 +160,21 @@ async function continuePermissionFlow(input: HookInput, legacyFlow: boolean): Pr
   process.stdout.write(JSON.stringify(decisionToClaudeOutput(decision)));
 }
 
+async function answerNativeQuestion(input: HookInput, config: Parameters<typeof requestApproval>[0],
+  scope: { projectId?: string; policy_revision?: number }): Promise<void> {
+  const request = questionRequest(input);
+  if (!request) return; // Unsupported native shape keeps Claude's question UI.
+  request.projectId = scope.projectId;
+  request.policyRevision = scope.policy_revision;
+  const decision = await requestApproval(config, request, {
+    timeoutMs: Math.min(180_000, Number(process.env.GRANTTAP_APPROVAL_TIMEOUT_MS ?? 120_000)),
+  });
+  if (isUnanswered(decision)) return;
+  const output = claudeQuestionOutput(input, decision, request);
+  if (output) process.stdout.write(JSON.stringify(output));
+  else if (decision.decision === "deny") writePermission("deny", "The user declined to answer this question");
+}
+
 function writeAutoApproval(input: HookInput, req: ReturnType<typeof claudeToRequest>): void {
   const level = autoAcceptLevelFor(input.session_id);
   const cls = classifyAction(req.tool, req.command);

package/apps/bridge/src/bin/hooks/codex-hook.ts

@@ -26,6 +26,8 @@ import {
 import { recordAttributedCall } from "../../mesh/identity/call-scope";
 import { classifyAction } from "../../policy";
 import { consumeCodexProjectAsk } from "../../policy/codex-project-ask";
+import { evaluateEffectiveAction, legacyGrantTapFlowAllowed } from "../../policy/effective-action";
+import { permitsProjectAskAutomation } from "../../task-automation";
 import { protectedGrantTapAccess } from "../../host/self-protection";
 
 async function readStdin(): Promise<string> {
@@ -85,8 +87,14 @@ async function main(): Promise<void> {
     toolInput: input.tool_input,
   });
 
+  const policy = await evaluateEffectiveAction({ provider: "codex", sessionId: input.session_id,
+    cwd: input.cwd, toolName: input.tool_name, toolInput: input.tool_input });
+  if (policy.effect === "deny") { process.stdout.write(denyOutput(policy.reason)); return; }
+  const governedAsk = !!projectAsk || !legacyGrantTapFlowAllowed(policy);
+  const chatAutomation = permitsProjectAskAutomation(policy, input.session_id);
+
   // Gating paused or this session exempt → stay silent (Codex uses its own flow).
-  if (!projectAsk && isGatingSkipped(input.session_id)) return;
+  if (!governedAsk && isGatingSkipped(input.session_id)) return;
 
   let cfg;
   try {
@@ -97,8 +105,8 @@ async function main(): Promise<void> {
   }
 
   // Local policy, evaluated after pairing is confirmed — see claude-hook.
-  const req = codexToRequest(input);
-  if (!projectAsk && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+  const req = { ...codexToRequest(input), projectId: policy.projectId, policyRevision: policy.policy_revision };
+  if ((!governedAsk || chatAutomation) && shouldAutoAcceptTool(input.session_id, req.tool, req.command, policy.projectId)) {
     const level = autoAcceptLevelFor(input.session_id);
     const cls = classifyAction(req.tool, req.command);
     process.stdout.write(
@@ -126,7 +134,7 @@ async function main(): Promise<void> {
   // Routine relay failure stays in Codex's native flow. A Project ASK cannot
   // fall through to provider approval because that would weaken the parent rule.
   if (isUnanswered(decision)) {
-    if (projectAsk) {
+    if (governedAsk) {
       process.stdout.write(denyOutput("Project approval was required but no decision was received"));
     }
     return;

package/apps/bridge/src/bin/hooks/cursor-after-shell.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env -S npx tsx
 /** Cursor afterShellExecution: retire the exact chat's orphaned phone card. */
 import { RelayClient } from "../../../../../packages/core/relay-client";
+import { managedAdmissionOptions } from "../../managed-admission";
 import {
   markApprovalTerminal,
   pendingApprovalRegistrations,
@@ -78,7 +79,8 @@ async function main(): Promise<void> {
   if (cancelled.length > 0) {
     try {
       const config = loadConfig(machineConfigPath());
-      const client = new RelayClient(applyNetworkRoute(config), { peerAllowed: controllerPeerGate(config) });
+      const routed = applyNetworkRoute(config);
+      const client = new RelayClient(routed, { ...managedAdmissionOptions(routed), peerAllowed: controllerPeerGate(config) });
       await client.connect();
       try {
         for (const { request, accepted } of cancelled) {

package/apps/bridge/src/bin/runtime/monitor.ts

@@ -9,6 +9,7 @@ import { startSessionMonitor } from "../../monitor";
 import { controllerPeerGate } from "../../pairing/controllers";
 import { applyNetworkRoute } from "../../device-network/settings";
 import { startEndpointPublisher } from "../../device-network/directory";
+import { managedAdmissionOptions } from "../../managed-admission";
 
 let client: RelayClient;
 let monitor: ReturnType<typeof startSessionMonitor>;
@@ -19,6 +20,7 @@ let stopEndpointPublisher = () => {};
 try {
   const cfg = applyNetworkRoute(loadConfig(machineConfigPath()));
   client = new RelayClient(cfg, {
+    ...managedAdmissionOptions(cfg),
     autoReconnect: true,
     replayPath: join(configDir(), `replay-${cfg.room}.json`),
     peerAllowed: controllerPeerGate(cfg),

package/apps/bridge/src/claude-questions/README.md

@@ -0,0 +1,13 @@
+# Claude questions
+
+Public entry point: `index.ts`. Handles Claude Code `AskUserQuestion` through the
+existing encrypted, durable approval channel. All original questions, options,
+descriptions, multiple selections and custom answers stay attached to the exact
+native chat and call. A permission Allow without complete answers is rejected.
+Auto allow never invents an answer. Transport timeout leaves Claude's local
+question UI available. Successful answers return the original `questions` and
+an `answers` mapping using Claude's documented PreToolUse `updatedInput` contract.
+
+Tests: `tests/`. Engineering contract: the Apple repository `AGENTS.md`.
+
+License: MIT License; see the repository LICENSE.

package/apps/bridge/src/claude-questions/index.ts

@@ -0,0 +1,26 @@
+import { createHash } from "node:crypto";
+import type { ApprovalDecision, ApprovalRequest } from "../../../../packages/protocol/schema";
+import { ApprovalQuestions, questionAnswers } from "../../../../packages/protocol/messages/approval-questions";
+import { claudeToRequest, type HookInput } from "../host/adapters";
+
+export function questionRequest(input: HookInput): ApprovalRequest | undefined {
+  if (input.tool_name !== "AskUserQuestion") return undefined;
+  const questions = ApprovalQuestions.safeParse(input.tool_input?.questions);
+  if (!questions.success) return undefined;
+  const base = claudeToRequest(input);
+  if (input.tool_use_id) base.requestId = "claude-question-" + createHash("sha256")
+    .update(JSON.stringify([input.session_id, input.tool_use_id, input.tool_input])).digest("hex").slice(0, 24);
+  return { ...base, kind: "question", questions: questions.data,
+    title: questions.data[0]!.question, risk: "low", command: undefined };
+}
+
+/** Preserve the original tool input; supply only the human's explicit answers. */
+export function claudeQuestionOutput(input: HookInput, decision: ApprovalDecision,
+  request = questionRequest(input)) {
+  if (!request || decision.decision !== "allow" || decision.requestId !== request.requestId
+    || decision.sessionId !== request.sessionId) return undefined;
+  const answers = questionAnswers(request.questions, decision.note);
+  if (!answers) return undefined;
+  return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow",
+    updatedInput: { ...input.tool_input, questions: input.tool_input!.questions, answers } } };
+}

package/apps/bridge/src/config/commands.ts

@@ -6,6 +6,8 @@ import { configDir } from "./runtime/paths";
 import { loadRuntimeConfig, saveRuntimeConfig, type RuntimeConfig } from "./runtime";
 import { writePrivateFile } from "./access/write-private";
 import { acceptInstanceEpoch } from "../host/instance-epoch";
+import { applyControllerGrant, type GrantRejection } from "../task-automation/controller-grant";
+import { revokeTaskAutomation } from "../task-automation";
 
 const CLOCK_SKEW_MS = 2 * 60_000;
 const MAX_COMMANDS = 256;
@@ -13,7 +15,7 @@ const MAX_COMMANDS = 256;
 export type ConfigCommandResult =
   | { kind: "applied"; revision: number }
   | { kind: "replay"; revision: number }
-  | { kind: "rejected"; reason: "expired" | "conflict" | "digest_mismatch" | "legacy_blocked" | "stale_instance" };
+  | { kind: "rejected"; reason: "expired" | "conflict" | "digest_mismatch" | "legacy_blocked" | "stale_instance" | GrantRejection };
 
 type CommandRecord = {
   operationId: string;
@@ -146,6 +148,17 @@ export function applyConfigSet(
   if (!acceptInstanceEpoch(message.instanceEpoch, state.requireFreshCommands)) {
     return { kind: "rejected", reason: "stale_instance" };
   }
+  const session = message.autoAcceptSession;
+  if (session?.authorizeProjectAsk) {
+    if (!message.operationId || !message.expiresAt || !message.instanceEpoch) {
+      return { kind: "rejected", reason: "legacy_blocked" };
+    }
+    const reason = applyControllerGrant(session, now);
+    if (reason) return { kind: "rejected", reason };
+  } else if (session) {
+    revokeTaskAutomation(session.sessionId);
+  }
+  if (message.excludeSession) revokeTaskAutomation(message.excludeSession);
   applyRuntimePatch(message);
   state.revision += 1;
   if (message.operationId) {

package/apps/bridge/src/config/index.ts

@@ -1,6 +1,7 @@
 /** Public entry point for local bridge configuration and pairing. */
 export * from "./access/capability-policy";
 export * from "./access/pairing";
+export { writePrivateFile } from "./access/write-private";
 export * from "./runtime/paths";
 export * from "./runtime";
 export {

package/apps/bridge/src/config/runtime/index.ts

@@ -19,6 +19,8 @@ import {
   type CortexProjectConfig,
 } from "../../cortex/config";
 import { configDir, runtimeConfigPath } from "./paths";
+import { taskAutomationLevel, taskAutomationProject } from "../../task-automation";
+import { governedRevision } from "../../policy/governed-projects";
 
 export type RuntimeConfig = {
   enabled: boolean;
@@ -213,7 +215,7 @@ export function saveRuntimeConfig(cfg: Partial<RuntimeConfig>): void {
   writePrivateFile(runtimeConfigPath(), JSON.stringify(merged, null, 2) + "\n");
 }
 
-function projectIdForSession(sessionId: string | null | undefined): string | null | undefined {
+export function projectIdForSession(sessionId: string | null | undefined): string | null | undefined {
   if (!sessionId) return undefined;
   try {
     const loaded = readStoreState(join(configDir(), "project-mesh.json"));
@@ -235,10 +237,16 @@ function projectIdForSession(sessionId: string | null | undefined): string | nul
   }
 }
 
-export function autoAcceptLevelFor(sessionId: string | null | undefined): AutoAcceptLevel {
+export function autoAcceptLevelFor(sessionId: string | null | undefined,
+  observedProjectId?: string): AutoAcceptLevel {
   const cfg = loadRuntimeConfig();
-  const projectId = projectIdForSession(sessionId);
-  if (projectId === null) return "ask";
+  const mappedProject = projectIdForSession(sessionId);
+  if (mappedProject === null || (observedProjectId && mappedProject && observedProjectId !== mappedProject)) return "ask";
+  const projectId = observedProjectId ?? mappedProject ?? taskAutomationProject(sessionId);
+  if (!cfg.autoAcceptPaused && projectId) {
+    const grant = taskAutomationLevel(sessionId ?? undefined, projectId, governedRevision(projectId) ?? 0);
+    if (grant) return grant;
+  }
   return resolveAutoAcceptLevel({
     paused: cfg.autoAcceptPaused,
     // A Mesh execution without an explicit Project level must fail closed.
@@ -255,8 +263,9 @@ export function shouldAutoAcceptTool(
   sessionId: string | null | undefined,
   tool: string,
   command: string | null | undefined,
+  observedProjectId?: string,
 ): boolean {
-  const level = autoAcceptLevelFor(sessionId);
+  const level = autoAcceptLevelFor(sessionId, observedProjectId);
   return shouldAutoAllow(level, classifyAction(tool, command ?? undefined));
 }
 

package/apps/bridge/src/configuration-delivery/README.md

@@ -0,0 +1,10 @@
+# Configuration delivery
+
+Public entry point: `index.ts`. Applies the existing authenticated controller
+configuration command and returns its operation receipt with the effective
+computer-enforced chat level. Socket delivery alone is never an applied rule.
+
+The configuration and task-automation modules own durable admission and tests.
+Engineering contract: the Apple repository `AGENTS.md`.
+
+License: MIT License; see the repository LICENSE.

package/apps/bridge/src/configuration-delivery/index.ts

@@ -0,0 +1,17 @@
+import type { ConfigSet } from "../../../../packages/protocol/schema";
+import type { RelayClient } from "../../../../packages/core/relay-client";
+import { autoAcceptLevelFor } from "../config";
+import { handleConfigSet } from "../monitor/handlers/session-commands";
+
+/** A receipt reports effective computer policy, independently of a slow catalog scan. */
+export async function handleConfigurationCommand(client: RelayClient, message: ConfigSet): Promise<void> {
+  const result = handleConfigSet(message);
+  if (!message.operationId) return;
+  await client.send({ type: "config.command.result", operationId: message.operationId,
+    ok: result.kind !== "rejected",
+    ...(result.kind === "rejected" ? { reason: result.reason } : { revision: result.revision }),
+    sessionId: message.autoAcceptSession?.sessionId,
+    level: message.autoAcceptSession?.sessionId
+      ? autoAcceptLevelFor(message.autoAcceptSession.sessionId) : undefined,
+    createdAt: Date.now() }, "phone", { ttlMs: 60_000 });
+}

package/apps/bridge/src/engine/runtime/engine-memory.ts

@@ -89,6 +89,13 @@ export function recordsFromEvent(event: MeshEvent): KnowledgeRecordInput[] {
     return [{ ...base, record_id: event.eventId, category: "decision",
       content: event.payload.answer, source: "agent_report", visibility: "task" }];
   }
+  if (event.payload.failed && (event.eventType === "TASK_PROGRESS"
+    || event.eventType === "TASK_COMPLETED")) {
+    const content = event.payload.reason || event.payload.summary;
+    return content ? [{ ...base, record_id: event.eventId, category: "attempt",
+      content, source: "agent_report",
+      visibility: event.eventType === "TASK_COMPLETED" ? "project" : "task" }] : [];
+  }
   if (event.eventType === "TASK_COMPLETED" && event.payload.summary) {
     return [{ ...base, record_id: event.eventId, category: "result",
       content: event.payload.summary, source: "agent_report", visibility: "project" }];

package/apps/bridge/src/host/adapters.ts

@@ -15,7 +15,9 @@
  *                (Codex PreToolUse can only deny and only wraps `shell`.)
  */
 import type { ApprovalDecision, ApprovalRequest, Risk } from "../../../../packages/protocol/schema";
+import { createHash } from "node:crypto";
 import { randomId } from "../../../../packages/core/crypto";
+import { approvalPresentation } from "./approval-presentation";
 
 /** Heuristic risk tag so the watch can color/rank the request at a glance. */
 export function guessRisk(tool: string, command: string | undefined): Risk {
@@ -64,13 +66,16 @@ function extractCommand(tool: string, ti: Record<string, unknown>): string {
 function toRequest(agent: string, input: HookInput, idHint?: string): ApprovalRequest {
   const tool = input.tool_name ?? "tool";
   const command = extractCommand(tool, input.tool_input ?? {});
+  const presentation = approvalPresentation(tool, input.tool_input ?? {});
   return {
     type: "approval.request",
     requestId: idHint ?? randomId(6),
     agent,
     kind: "permission",
     tool,
-    title: shortTitle(tool, command),
+    title: command === tool ? presentation.title ?? shortTitle(tool, command) : shortTitle(tool, command),
+    details: presentation.details,
+    inputFingerprint: createHash("sha256").update(JSON.stringify(input.tool_input ?? {})).digest("hex"),
     command,
     cwd: input.cwd,
     sessionId: input.session_id,

package/apps/bridge/src/host/approval-presentation/README.md

@@ -0,0 +1,10 @@
+# Approval presentation
+
+Public entry: `index.ts`. Hook adapters send a bounded, credential-redacted
+parameter preview with an approval. Browser batches name their operations so
+the person can inspect the request before deciding. Presentation does not
+alter provider input, classify an unknown operation as safe, or authorize it.
+
+Behavior tests live in `tests/`.
+
+License: MIT License; see the repository LICENSE.

package/apps/bridge/src/host/approval-presentation/index.ts

@@ -0,0 +1,51 @@
+const SECRET = /authorization|cookie|password|secret|(?:^|_)token(?:$|_)|api[_-]?key|private[_-]?key/i;
+
+function safeText(value: string): string {
+  let text = value.slice(0, 4_096).replace(/\bBearer\s+[^\s"']+/gi, "Bearer [redacted]");
+  if (/^https?:\/\//i.test(text)) {
+    try {
+      const url = new URL(text);
+      url.username = "";
+      url.password = "";
+      url.hash = "";
+      for (const key of [...url.searchParams.keys()]) {
+        if (SECRET.test(key)) url.searchParams.set(key, "[redacted]");
+      }
+      text = url.toString();
+    } catch { /* Keep a bounded non-URL parameter visible. */ }
+  }
+  return text;
+}
+
+function redact(value: unknown, depth = 0): unknown {
+  if (depth > 6) return "[nested input omitted]";
+  if (typeof value === "string") return safeText(value);
+  if (Array.isArray(value)) return value.slice(0, 100).map(item => redact(item, depth + 1));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).slice(0, 64).map(([key, item]) =>
+      [key, SECRET.test(key) ? "[redacted]" : redact(item, depth + 1)]));
+  }
+  return value;
+}
+
+/** Human inspection data only: it never changes provider input or risk policy. */
+export function approvalPresentation(tool: string, input: Record<string, unknown>): {
+  details?: string; title?: string;
+} {
+  if (Object.keys(input).length === 0) return {};
+  const clean = redact(input) as Record<string, unknown>;
+  const encoded = JSON.stringify(clean, null, 2);
+  const details = encoded.length <= 16_384 ? encoded
+    : encoded.slice(0, 16_340) + "\n[remaining parameters omitted]";
+  const operations = clean.actions ?? clean.operations ?? clean.steps;
+  const actions = Array.isArray(operations) ? operations.slice(0, 4).flatMap(item => {
+    if (!item || typeof item !== "object") return [];
+    const action = item.action ?? item.method ?? item.type ?? item.operation;
+    return typeof action === "string" ? [action.slice(0, 48)] : [];
+  }) : [];
+  const description = clean.description ?? clean.purpose;
+  const caption = actions.length ? actions.join(" → ")
+    : typeof description === "string" ? description : undefined;
+  const name = tool.split("__").at(-1) ?? tool;
+  return { details, title: caption ? `${name}: ${caption}`.slice(0, 120) : undefined };
+}

package/apps/bridge/src/install/inspect.ts

@@ -114,6 +114,7 @@ export const CLAUDE_MATCHERS = [
   "Write",
   "MultiEdit",
   "NotebookEdit",
+  "AskUserQuestion",
   "Skill",
   "mcp__.*",
   "skill__.*",

package/apps/bridge/src/managed-admission/README.md

@@ -0,0 +1,14 @@
+# Managed relay admission
+
+`managedAdmissionOptions` obtains a fresh short-lived relay lease using the
+saved account machine credential at each socket upgrade. The account service
+chooses the stable computer identity and enforces Personal seats; QR rooms and
+native agent sessions do not take additional seats. Own-relay connections never
+call billing. Tickets are transport headers and are not prompt content.
+
+Legacy free beta servers may not issue leases. Commercial relay mode requires
+a valid signed lease independently, including when a modified client omits it.
+Expiry/refund stops hosted delivery; local provider approval remains available,
+and history, pairing keys and pending decisions are retained.
+
+Copyright (c) 2026 Sergii Ziborov. Licensed under the MIT License in the repository root.

package/apps/bridge/src/managed-admission/index.ts

@@ -0,0 +1,30 @@
+import type { PeerConfig, RelayClientOptions } from "../../../../packages/core/relay-client";
+import { loadAccountLink } from "../account-recovery/link";
+
+/** Account computer identity is stable across QR rooms and provider sessions. */
+export function managedAdmissionOptions(config: PeerConfig,
+  request: typeof fetch = fetch): Pick<RelayClientOptions, "upgradeHeaders"> {
+  const url = new URL(config.relayUrl);
+  if (config.role !== "machine" || url.protocol !== "wss:" || url.hostname !== "relay.granttap.com") return {};
+  return { upgradeHeaders: async (): Promise<Record<string, string>> => {
+    const account = loadAccountLink();
+    if (!account) return {};
+    const response = await request("https://granttap.com/api/account/machine/admission", {
+      method: "POST", headers: { authorization: `Bearer ${account.machineToken}`,
+        "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ publicKey: config.myPublicKey, room: config.room }),
+      signal: AbortSignal.timeout(8_000), redirect: "error",
+    });
+    // Legacy free-beta deployments predate admission. A commercial relay still
+    // independently refuses every machine socket without a valid ticket.
+    if (response.status === 404 || response.status === 503) return {};
+    if (!response.ok) throw new Error("Managed relay access or the computer limit must be renewed in GrantTap.");
+    const body = await response.json() as { ticket?: unknown; expiresAt?: unknown };
+    if (typeof body.ticket !== "string" || body.ticket.length > 2_048
+      || typeof body.expiresAt !== "number" || !Number.isSafeInteger(body.expiresAt)
+      || body.expiresAt <= Date.now() || body.expiresAt > Date.now() + 360_000) {
+      throw new Error("Managed admission returned an invalid lease.");
+    }
+    return { "X-GrantTap-Admission": body.ticket };
+  } };
+}