granttap-mcp 0.8.47 → 0.8.48

package/apps/bridge/src/engine/README.md

@@ -14,7 +14,8 @@ Mesh snapshot enrichment queues Weavatrix repository analysis through
 `repository-graph-jobs.ts`. One analysis runs at a time, repeated snapshot
 ticks reuse a fresh bounded report, and failed analyses back off. An absent
 report leaves the graph unavailable and Cortex degraded; it does not block
-policy IPC or turn a repository label into an architecture result.
+policy IPC: repository analysis owns a separate bounded-lifetime socket, while
+policy and Backbone requests keep their control connection. It does not turn a repository label into an architecture result.
 Claude, Codex, and Cursor hooks can evaluate the engine's local Project
 Governance policy only when both `GRANTTAP_ENGINE_ENABLED` and
 `GRANTTAP_PROJECT_POLICY_ENABLED` are enabled. Project `DENY` and `ASK` precede

package/apps/bridge/src/engine/runtime/engine-projects.ts

@@ -182,7 +182,7 @@ export async function projectRepositoryGraphs(
     priority?: number } = {},
 ): Promise<ProjectRepositoryGraph[]> {
   if (!engineFeatureEnabled(options.env ?? process.env)) return [];
-  const client = options.client ?? defaultClient();
+  const client = options.client;
   const repositories = [...new Map(bindings.map((item) => [item.repositoryId, item])).values()].slice(0, 64);
   const graphs = options.background
     ? repositories.map((binding) => repositoryGraphJobs.read(
@@ -191,7 +191,7 @@ export async function projectRepositoryGraphs(
       options.priority ?? 0,
     ))
     : await Promise.all(repositories.map((binding) =>
-      analyzeRepositoryGraph(client, projectId, binding.repositoryId, 30_000).then((graph) => {
+      analyzeRepositoryGraph(client, projectId, binding.repositoryId, 120_000).then((graph) => {
         repositoryGraphJobs.remember(JSON.stringify([projectId, binding.repositoryId, binding.revision]), graph);
         return graph;
       })));
@@ -199,10 +199,13 @@ export async function projectRepositoryGraphs(
 }
 
 async function analyzeRepositoryGraph(
-  client: EngineClientLike, projectId: string, repositoryId: string, timeoutMs: number,
+  client: EngineClientLike | undefined, projectId: string, repositoryId: string, timeoutMs: number,
 ): Promise<ProjectRepositoryGraph | undefined> {
+  // The daemon serves a socket serially. Analysis must not occupy the channel
+  // used for policy, bindings and Backbone reads while a repository is scanned.
+  const channel = client ?? new EngineClient({ socketPath: join(configDir(), "engine.sock") });
   try {
-    const result = await client.request({
+    const result = await channel.request({
       operation: "graph.analyze_repository", input: {
         project_id: projectId, repository_id: repositoryId,
       },
@@ -251,6 +254,8 @@ async function analyzeRepositoryGraph(
       analysisStatus: "UNAVAILABLE", analysisErrorCode: code,
       nodes: [], relations: [], totalNodes: 0, totalRelations: 0, truncated: false,
     };
+  } finally {
+    if (!client) channel.close();
   }
 }
 

package/apps/bridge/src/mesh/runtime/graph/analysis.ts

@@ -0,0 +1,69 @@
+import type { RelayClient } from "../../../../../../packages/core/relay-client";
+import type { MeshSnapshot } from "../../../../../../packages/protocol/schema";
+import { projectBackbone, projectRepositoryGraphs, waitForProjectBindingSync } from "../../../engine/runtime/engine-projects";
+import { sendMeshPayload } from "../../../host/session-keys";
+import { publishedCatalog } from "../../../session-catalog";
+import { meshSnapshot, meshSnapshots } from "..";
+import { refreshLocalGraphBindings } from "./binding-sync";
+
+/** A person's explicit Graph refresh bypasses background job backoff. */
+type GraphAnalysisDependencies = {
+  snapshot?: (projectId: string) => MeshSnapshot | undefined;
+  snapshots?: typeof meshSnapshots;
+  wait: typeof waitForProjectBindingSync;
+  sync?: typeof refreshLocalGraphBindings;
+  backbone: typeof projectBackbone;
+  graphs: typeof projectRepositoryGraphs;
+  send: (client: RelayClient, snapshot: MeshSnapshot) => Promise<void>;
+};
+
+const graphAnalysisDependencies: GraphAnalysisDependencies = {
+  snapshot: meshSnapshot,
+  wait: waitForProjectBindingSync,
+  sync: refreshLocalGraphBindings,
+  backbone: projectBackbone,
+  graphs: projectRepositoryGraphs,
+  send: (client, snapshot) => sendMeshPayload(client, snapshot, "phone", {
+    ttlMs: 60_000, reliable: true,
+  }),
+};
+
+export async function analyzeProjectGraphNow(
+  client: RelayClient, projectId: string,
+  dependencies: GraphAnalysisDependencies = graphAnalysisDependencies,
+  requestIds?: ReadonlySet<string>,
+): Promise<boolean> {
+  const known = publishedCatalog(client);
+  const read = dependencies.snapshot ?? ((id: string) => dependencies.snapshots?.().find(item => item.projectId === id));
+  const snapshot = dependencies === graphAnalysisDependencies
+    ? meshSnapshot(projectId, known ? [...known.sessions, ...(known.history ?? [])] : undefined)
+    : read(projectId);
+  if (!snapshot) return false;
+  await dependencies.wait(projectId);
+  const current = dependencies === graphAnalysisDependencies
+    ? meshSnapshot(projectId, known ? [...known.sessions, ...(known.history ?? [])] : undefined)
+    : read(projectId);
+  if (!current) return false;
+  const failures = dependencies.sync ? await dependencies.sync(current) : [];
+  const rejected = new Set(failures.map(report => report.repositoryId));
+  const [backbone, repositoryGraphs] = await Promise.all([
+    dependencies.backbone(projectId),
+    dependencies.graphs(projectId, (current.bindings ?? []).filter(binding => !rejected.has(binding.repositoryId)), { background: false }),
+  ]);
+  const observed = [...repositoryGraphs, ...failures];
+  const reports = observed.length > 0 ? observed : [{
+    projectId, repositoryId: current.project.canonicalRepositoryId,
+    revision: "unverified", weavatrixVersion: "unknown",
+    analysisStatus: "UNAVAILABLE" as const, analysisErrorCode: "REPOSITORY_NOT_BOUND",
+    nodes: [], relations: [], totalNodes: 0, totalRelations: 0, truncated: false,
+  }];
+  const receipts = requestIds?.size ? requestIds : new Set<string | undefined>([undefined]);
+  for (const id of receipts) {
+    await dependencies.send(client, {
+      ...current, backbone, repositoryGraphs: reports, generatedAt: Date.now(),
+      ...(id ? { graphAnalysisRequestId: id } : {}),
+    });
+  }
+  return true;
+}
+

package/apps/bridge/src/mesh/runtime/index.ts

@@ -10,9 +10,6 @@ import type {
   SessionInfo,
   TaskCapsule,
 } from "../../../../../packages/protocol/schema";
-import {
-  projectBackbone, projectRepositoryGraphs, waitForProjectBindingSync,
-} from "../../engine/runtime/engine-projects";
 import { configDir } from "../../config";
 import {
   createClaudeSession,
@@ -25,10 +22,7 @@ import { isProviderEnabled } from "../../config/runtime";
 import { sendMeshPayload } from "../../host/session-keys";
 import { linkSessionsToProjects, workingTreeState } from "../catalog";
 import { catalogFromEndpoint } from "../catalog/models";
-import { projectMcpServers } from "../catalog/project/capabilities";
-import { configuredProjectMcpServers, mergeConfiguredMcpServers } from "../catalog/project/configured-mcp";
 import { saveProjectCapabilityRequest } from "../catalog/project/requests";
-import { projectCapabilityObservations } from "../catalog/project/observations";
 import { computerId } from "../identity/computer";
 import { createCheckpoint } from "../admin/checkpoint";
 import { buildTaskCapsule } from "../admin/capsule";
@@ -36,11 +30,11 @@ import { handoffReadiness } from "../tasks/readiness";
 import { createHandoffFlow } from "./handoff";
 import type { MeshRuntimeDependencies } from "./dependencies";
 import { localMeshStore } from "../local-remote/local";
+import { composeMeshSnapshot } from "./snapshot/compose";
 import { enrichMeshSnapshot } from "./snapshot/enriched";
 import { createHandoffWorktree, repositoryHasCommit } from "./worktree";
 import { fetchRevision, pushBranch } from "../local-remote/remote";
-import { projectSessionCapabilityInventory, projectExecutionCapabilitySessions } from "./capabilities";
-import { refreshLocalGraphBindings } from "./graph/binding-sync";
+import { projectSessionCapabilityInventory } from "./capabilities";
 import { createMeshSessionCatalog } from "./catalog/session-catalog";
 
 export type { MeshRuntimeDependencies };
@@ -158,53 +152,29 @@ export function createMeshRuntime(deps: MeshRuntimeDependencies) {
   const catalog = (sessions: SessionInfo[]) =>
     linkSessionsToProjects(deps.store(), sessions, deps.computer());
 
-  const composeSnapshot = (
-    projectId: string,
-    store = deps.store(),
-    sessions = deps.sessions(),
-    models = catalogFromEndpoint(deps.computer(), sessions),
-  ): MeshSnapshot | undefined => {
-    const snapshot = store.snapshot(projectId, deps.computer());
-    if (!snapshot) return undefined;
-    const linked = projectExecutionCapabilitySessions(
-      snapshot, sessions, deps.computer(), deps.capabilityInventory,
-    );
-    const reported = projectMcpServers(
-      linked.filter((session) => session.computerId === deps.computer()), projectId,
-    );
-    const workspaces = (snapshot.bindings ?? [])
-      .filter((binding) => binding.endpointId === deps.computer()
-        && binding.available && binding.localPathHint)
-      .map((binding) => binding.localPathHint!);
-    const mcpServers = mergeConfiguredMcpServers(
-      configuredProjectMcpServers(deps.computer(), workspaces), reported,
-    );
-    const capabilityObservations = projectCapabilityObservations({
-      projectId, endpointId: deps.computer(), bound: workspaces.length > 0,
-      requests: snapshot.capabilityRequests ?? [], skills: snapshot.skills ?? [],
-      mcpServers, now: deps.now(),
-    });
-    return {
-      ...snapshot,
-      publisherEndpointId: deps.computer(),
-      mcpServers: mcpServers.length > 0 ? mcpServers : undefined,
-      capabilityObservations: capabilityObservations.length > 0
-        ? capabilityObservations : undefined,
-      modelCatalog: models.models.length > 0 || models.reason ? [models] : undefined,
-    };
-  };
 
   return {
     catalog,
-    snapshot(projectId: string): MeshSnapshot | undefined {
-      return composeSnapshot(projectId);
+    snapshot(projectId: string, sessions?: SessionInfo[]): MeshSnapshot | undefined {
+      return composeMeshSnapshot(deps, projectId, deps.store(), sessions ?? deps.sessions());
     },
     snapshots(): MeshSnapshot[] {
       const store = deps.store();
       const sessions = deps.sessions();
       const models = catalogFromEndpoint(deps.computer(), sessions);
       return store.projectIds().flatMap((projectId) =>
-        composeSnapshot(projectId, store, sessions, models) ?? []);
+        composeMeshSnapshot(deps, projectId, store, sessions, models) ?? []);
+    },
+    async snapshotsAsync(sessions = deps.sessions()): Promise<MeshSnapshot[]> {
+      const store = deps.store();
+      const models = catalogFromEndpoint(deps.computer(), sessions);
+      const snapshots: MeshSnapshot[] = [];
+      for (const id of store.projectIds()) {
+        await new Promise<void>(resolve => setImmediate(resolve));
+        const snapshot = composeMeshSnapshot(deps, id, store, sessions, models);
+        if (snapshot) snapshots.push(snapshot);
+      }
+      return snapshots;
     },
     requestCapability(input: ProjectCapabilityRequestSet): boolean {
       const project = deps.store().snapshot(input.projectId)?.project;
@@ -251,16 +221,21 @@ export function meshSnapshots(): MeshSnapshot[] {
   return defaultRuntime.snapshots();
 }
 
-export function meshSnapshot(projectId: string): MeshSnapshot | undefined {
-  return defaultRuntime.snapshot(projectId);
+/** Yield between Project projections so live decisions and heartbeats continue. */
+export function meshSnapshotsAsync(sessions?: SessionInfo[]): Promise<MeshSnapshot[]> {
+  return defaultRuntime.snapshotsAsync(sessions);
+}
+
+export function meshSnapshot(projectId: string, sessions?: SessionInfo[]): MeshSnapshot | undefined {
+  return defaultRuntime.snapshot(projectId, sessions);
 }
 
 export function requestProjectCapability(input: ProjectCapabilityRequestSet): boolean {
   return defaultRuntime.requestCapability(input);
 }
 
-export async function meshSnapshotsWithEngine(): Promise<MeshSnapshot[]> {
-  return Promise.all(meshSnapshots().map((snapshot) => enrichMeshSnapshot(snapshot)));
+export async function meshSnapshotsWithEngine(snapshots = meshSnapshots()): Promise<MeshSnapshot[]> {
+  return Promise.all(snapshots.map((snapshot) => enrichMeshSnapshot(snapshot)));
 }
 
 export async function meshSnapshotWithEngine(projectId: string): Promise<MeshSnapshot | undefined> {
@@ -268,52 +243,7 @@ export async function meshSnapshotWithEngine(projectId: string): Promise<MeshSna
   return snapshot ? enrichMeshSnapshot(snapshot) : undefined;
 }
 
-/** A person's explicit Graph refresh bypasses background job backoff. */
-type GraphAnalysisDependencies = {
-  snapshots: typeof meshSnapshots;
-  wait: typeof waitForProjectBindingSync;
-  sync?: typeof refreshLocalGraphBindings;
-  backbone: typeof projectBackbone;
-  graphs: typeof projectRepositoryGraphs;
-  send: (client: RelayClient, snapshot: MeshSnapshot) => Promise<void>;
-};
-
-const graphAnalysisDependencies: GraphAnalysisDependencies = {
-  snapshots: meshSnapshots,
-  wait: waitForProjectBindingSync,
-  sync: refreshLocalGraphBindings,
-  backbone: projectBackbone,
-  graphs: projectRepositoryGraphs,
-  send: (client, snapshot) => sendMeshPayload(client, snapshot, "phone", {
-    ttlMs: 60_000, reliable: true,
-  }),
-};
-
-export async function analyzeProjectGraphNow(
-  client: RelayClient, projectId: string,
-  dependencies: GraphAnalysisDependencies = graphAnalysisDependencies,
-): Promise<boolean> {
-  const snapshot = dependencies.snapshots().find((item) => item.projectId === projectId);
-  if (!snapshot) return false;
-  await dependencies.wait(projectId);
-  const current = dependencies.snapshots().find((item) => item.projectId === projectId);
-  if (!current) return false;
-  if (dependencies.sync) await dependencies.sync(current);
-  const [backbone, repositoryGraphs] = await Promise.all([
-    dependencies.backbone(projectId),
-    dependencies.graphs(projectId, current.bindings ?? [], { background: false }),
-  ]);
-  const reports = repositoryGraphs.length > 0 ? repositoryGraphs : [{
-    projectId, repositoryId: current.project.canonicalRepositoryId,
-    revision: "unverified", weavatrixVersion: "unknown",
-    analysisStatus: "UNAVAILABLE" as const, analysisErrorCode: "REPOSITORY_NOT_BOUND",
-    nodes: [], relations: [], totalNodes: 0, totalRelations: 0, truncated: false,
-  }];
-  await dependencies.send(client, {
-    ...current, backbone, repositoryGraphs: reports, generatedAt: Date.now(),
-  });
-  return true;
-}
+export { analyzeProjectGraphNow } from "./graph/analysis";
 
 export function handleMeshPayload(
   client: RelayClient,

package/apps/bridge/src/mesh/runtime/snapshot/compose.ts

@@ -0,0 +1,45 @@
+import type { MeshSnapshot } from "../../../../../../packages/protocol/schema";
+import type { MeshRuntimeDependencies } from "../dependencies";
+import { catalogFromEndpoint } from "../../catalog/models";
+import { projectMcpServers } from "../../catalog/project/capabilities";
+import { configuredProjectMcpServers, mergeConfiguredMcpServers } from "../../catalog/project/configured-mcp";
+import { projectCapabilityObservations } from "../../catalog/project/observations";
+import { projectExecutionCapabilitySessions } from "../capabilities";
+
+export function composeMeshSnapshot(
+    deps: MeshRuntimeDependencies,
+    projectId: string,
+    store = deps.store(),
+    sessions = deps.sessions(),
+    models = catalogFromEndpoint(deps.computer(), sessions),
+  ): MeshSnapshot | undefined {
+    const snapshot = store.snapshot(projectId, deps.computer());
+    if (!snapshot) return undefined;
+    const linked = projectExecutionCapabilitySessions(
+      snapshot, sessions, deps.computer(), deps.capabilityInventory,
+    );
+    const reported = projectMcpServers(
+      linked.filter((session) => session.computerId === deps.computer()), projectId,
+    );
+    const workspaces = (snapshot.bindings ?? [])
+      .filter((binding) => binding.endpointId === deps.computer()
+        && binding.available && binding.localPathHint)
+      .map((binding) => binding.localPathHint!);
+    const mcpServers = mergeConfiguredMcpServers(
+      configuredProjectMcpServers(deps.computer(), workspaces), reported,
+    );
+    const capabilityObservations = projectCapabilityObservations({
+      projectId, endpointId: deps.computer(), bound: workspaces.length > 0,
+      requests: snapshot.capabilityRequests ?? [], skills: snapshot.skills ?? [],
+      mcpServers, now: deps.now(),
+    });
+    return {
+      ...snapshot,
+      publisherEndpointId: deps.computer(),
+      mcpServers: mcpServers.length > 0 ? mcpServers : undefined,
+      capabilityObservations: capabilityObservations.length > 0
+        ? capabilityObservations : undefined,
+      modelCatalog: models.models.length > 0 || models.reason ? [models] : undefined,
+    };
+  }
+

package/apps/bridge/src/mesh/runtime/snapshot/enriched.ts

@@ -40,7 +40,8 @@ export async function enrichMeshSnapshot(
     ...(snapshot.supersededKnowledgeRecordIds ?? []),
     ...supersededProjectKnowledgeIds(snapshot.projectId, allMemory),
   ])].sort().slice(-128);
-  const enriched = { ...snapshot, backbone, repositoryGraphs: [...repositoryGraphs, ...identityFailures],
+  const enriched = { ...snapshot, backbone, ...(repositoryGraphs.length || identityFailures.length
+      ? { repositoryGraphs: [...repositoryGraphs, ...identityFailures] } : {}),
     repositoryDetails: details,
     knowledge: activeProjectKnowledge(snapshot.projectId, allMemory)
       .sort((a, b) => b.recordedAt - a.recordedAt).slice(0, 16),

package/apps/bridge/src/monitor/README.md

@@ -0,0 +1,13 @@
+# Session monitor
+
+`index.ts` owns discovery, subscriptions and phone delivery for this computer.
+Chat catalogs publish independently of background Mesh enrichment. The Mesh
+publisher reuses known native identities and yields between Projects.
+
+Architecture responses acknowledge their explicit request. Coalesced builds
+retain every controller's receipt; periodic cached reports remain ordinary Mesh
+snapshots. Repository analysis uses its own Engine socket to keep policy and
+Backbone requests responsive.
+
+Integration tests remain in `tests/monitor`; background publication tests live
+beside `mesh-publication`. This module uses the repository MIT License.

package/apps/bridge/src/monitor/graph-refresh.ts

@@ -1,16 +1,19 @@
 import type { RelayClient } from "../../../../packages/core/relay-client";
 import { analyzeProjectGraphNow } from "../mesh/runtime";
 
-const inFlight = new Set<string>();
+const inFlight = new Map<string, Set<string>>();
 
 /** One user request starts one analysis per Project, even during reconnect. */
 export function requestProjectGraphRefresh(
   client: RelayClient, projectId: string,
   analyze: typeof analyzeProjectGraphNow = analyzeProjectGraphNow,
+  requestId?: string,
 ): boolean {
-  if (inFlight.has(projectId)) return false;
-  inFlight.add(projectId);
-  void analyze(client, projectId).catch(() => false).finally(() => {
+  const pending = inFlight.get(projectId);
+  if (pending) { if (requestId) pending.add(requestId); return false; }
+  const receipts = new Set(requestId ? [requestId] : []);
+  inFlight.set(projectId, receipts);
+  void analyze(client, projectId, undefined, receipts).catch(() => false).finally(() => {
     inFlight.delete(projectId);
   });
   return true;

package/apps/bridge/src/monitor/handlers/inbound.ts

@@ -172,10 +172,10 @@ async function handleInboundRefresh(
   // An explicit refresh may pay for the full history scan; routine Mesh
   // snapshots use the cached history and fresh live sessions.
   invalidateMeshSessionHistory();
-  await publish(true).catch(() => {});
   if (payload.graphProjectId && loadRuntimeConfig().meshEnabled) {
-    requestProjectGraphRefresh(client, payload.graphProjectId);
+    requestProjectGraphRefresh(client, payload.graphProjectId, undefined, payload.graphAnalysisRequestId);
   }
+  void publish(true).catch(() => {});
   return true;
 }
 

package/apps/bridge/src/monitor/mesh-publication/README.md

@@ -0,0 +1,9 @@
+# Mesh publication
+
+`index.ts` owns one background Mesh publication per monitor transport. Project
+projection yields to live decisions and uses the observed native catalog. Plain
+snapshots, policy reports, and Engine enrichment remain separate from fresh chat
+catalog delivery. Monitor close stops publication from the old transport.
+
+Tests in `tests/` exercise current catalog progress while Mesh delivery is held.
+This module uses the repository MIT License.

package/apps/bridge/src/monitor/mesh-publication/index.ts

@@ -0,0 +1,45 @@
+import type { RelayClient } from "../../../../../packages/core/relay-client";
+import type { SessionsStatus } from "../../../../../packages/protocol/schema";
+import { localMeshStore } from "../../mesh/local-remote/local";
+import { meshSnapshotsAsync, meshSnapshotsWithEngine } from "../../mesh/runtime";
+import { deriveObservedClaims } from "../../mesh/observed/claims";
+import { ingestRuntimeInvocations } from "../../engine/invocation/ingest";
+import { publishProjectPolicyStatuses } from "../../project-policy/runtime";
+import { publishedCatalog } from "../../session-catalog";
+import { sendMeshPayload } from "../../host/session-keys";
+import { INTERVAL_MS } from "../handlers/catalog";
+
+const pending = new WeakMap<RelayClient, { active: boolean }>();
+
+/** One background projection per transport; it never holds the current chat catalog. */
+export function publishMonitorMeshes(client: RelayClient, status: SessionsStatus): void {
+  if (pending.has(client)) return;
+  const token = { active: true };
+  pending.set(client, token);
+  const work = (async () => {
+    await new Promise<void>(resolve => setImmediate(resolve));
+    if (!token.active || !client.isConnected) return;
+    deriveObservedClaims(localMeshStore(), status.sessions);
+    void ingestRuntimeInvocations(status.sessions).catch(() => {});
+    const known = publishedCatalog(client);
+    const snapshots = await meshSnapshotsAsync([...status.sessions, ...(known?.history ?? [])]);
+    for (const snapshot of snapshots) {
+      if (!token.active || !client.isConnected) return;
+      await sendMeshPayload(client, snapshot, "phone", { ttlMs: INTERVAL_MS * 24, reliable: false }).catch(() => {});
+    }
+    if (!token.active || !client.isConnected) return;
+    await publishProjectPolicyStatuses(client, snapshots.map(mesh => mesh.projectId)).catch(() => {});
+    const enriched = await meshSnapshotsWithEngine(snapshots);
+    for (const snapshot of enriched) {
+      if (!token.active || !client.isConnected) return;
+      await sendMeshPayload(client, snapshot, "phone", { ttlMs: INTERVAL_MS * 24, reliable: false }).catch(() => {});
+    }
+  })();
+  void work.catch(() => {}).finally(() => { if (pending.get(client) === token) pending.delete(client); });
+}
+
+export function stopMonitorMeshes(client: RelayClient): void {
+  const token = pending.get(client);
+  if (token) token.active = false;
+  pending.delete(client);
+}

package/apps/bridge/src/monitor/support/runtime.ts

@@ -12,10 +12,7 @@ import { localMeshStore } from "../../mesh/local-remote/local";
 import { refreshMcpLoad } from "../../machine-load/mcp/refresh";
 import { approvalsStatus } from "../../approvals/state";
 import { primeSessionKeys } from "../../host/session-keys";
-import { sendMeshPayload } from "../../host/session-keys";
-import { meshCatalog, meshSnapshots, meshSnapshotsWithEngine } from "../../mesh/runtime";
-import { deriveObservedClaims } from "../../mesh/observed/claims";
-import { ingestRuntimeInvocations } from "../../engine/invocation/ingest";
+import { meshCatalog } from "../../mesh/runtime";
 import { HEARTBEAT_INTERVAL_MS, publishHeartbeat } from "./heartbeat";
 import { confirmPendingController } from "../../pairing/controllers";
 import { recordControllerName } from "../../pairing/presence";
@@ -24,14 +21,13 @@ import { singleFlightPublisher } from "./single-flight";
 import { publishedCatalog, rememberPublishedCatalog, resumePublishedChats } from "../../session-catalog";
 import { createMachineLoadPublisher } from "../../machine-load";
 import { startMachineLoadLoop } from "../../machine-load/host/loop";
-import { publishProjectPolicyStatuses } from "../../project-policy/runtime";
 import { scanCapabilityUsage, scanSessionHistory, scanSessions, scopeCapabilityUsageToRoom, TOKEN_WINDOW_HOURS } from "../../sessions";
 import { boundedCatalogHistory, INTERVAL_MS, publishSessionEvents } from "../handlers/catalog";
 import { sweepAttachments } from "../handlers/receipts";
 import { handleMonitorMessage } from "../handlers/inbound";
 
 const HISTORY_INTERVAL_MS = 10_000;
-let meshEnrichmentInFlight: Promise<void> | undefined;
+import { publishMonitorMeshes, stopMonitorMeshes } from "../mesh-publication";
 
 export type SessionMonitor = {
   publish: () => Promise<void>;
@@ -140,22 +136,7 @@ async function publishMonitorTick(input: {
     await publishSessionEvents(client, sessionId, status).catch(() => false);
   }
   await client.send(approvalsStatus(), "phone", { ttlMs: INTERVAL_MS * 3, reliable: false });
-  if (loadRuntimeConfig().meshEnabled) {
-    deriveObservedClaims(localMeshStore(), status.sessions);
-    void ingestRuntimeInvocations(status.sessions).catch(() => {});
-    const meshes = meshSnapshots();
-    for (const mesh of meshes) {
-      await sendMeshPayload(client, mesh, "phone", {
-        ttlMs: INTERVAL_MS * 24,
-        reliable: false,
-      }).catch(() => {});
-    }
-    await publishProjectPolicyStatuses(
-      client,
-      meshes.map((mesh) => mesh.projectId),
-    ).catch(() => {});
-    publishEnrichedMeshes(client);
-  }
+  if (loadRuntimeConfig().meshEnabled) publishMonitorMeshes(client, status);
   if (Date.now() - lastCapabilityPublishedAt >= 30_000) {
     const usage = scanCapabilityUsage([
       ...status.sessions,
@@ -167,18 +148,6 @@ async function publishMonitorTick(input: {
   return { lastHistoryPublishedAt, lastCapabilityPublishedAt };
 }
 
-function publishEnrichedMeshes(client: RelayClient): void {
-  if (meshEnrichmentInFlight) return;
-  meshEnrichmentInFlight = (async () => {
-    const meshes = await meshSnapshotsWithEngine();
-    for (const mesh of meshes) {
-      await sendMeshPayload(client, mesh, "phone", {
-        ttlMs: INTERVAL_MS * 24, reliable: false,
-      }).catch(() => {});
-    }
-  })().finally(() => { meshEnrichmentInFlight = undefined; });
-}
-
 /**
  * Attach task discovery and phone-to-agent delivery to the same relay client
  * used by MCP tools. This keeps STDIO stdout clean and removes the old need for
@@ -254,6 +223,7 @@ export function startSessionMonitor(client: RelayClient): SessionMonitor {
     publish: () => publish(false),
     close: () => {
       stopCatalog();
+      stopMonitorMeshes(client);
       stopHeartbeat();
       loadLoop.stop();
       off();

package/apps/bridge/src/session-catalog/README.md

@@ -2,7 +2,8 @@
 
 `index.ts` keeps the native identities of the latest published catalog. Requests
 for a chat already shown on the phone use that identity instead of walking every
-provider directory again. A new discovery window cannot make a known chat
+provider directory again, including image chunk requests. The in-memory catalog
+retains current names; the private restart cache contains only native identity. A new discovery window cannot make a known chat
 unreadable merely because hundreds of newer logs appeared.
 
 The private `session-catalog-cache.json` contains metadata and validated native

package/apps/bridge/src/session-catalog/index.ts

@@ -20,10 +20,12 @@ function metadata(session: SessionInfo): SessionInfo {
 
 /** Keep native identity, not capability descriptors or message contents. */
 export function rememberPublishedCatalog(client: RelayClient, status: SessionsStatus): void {
+  const previous = catalogs.get(client);
+  const history = status.history ?? previous?.history;
   const compact: SessionsStatus = { type: "sessions.status", machine: status.machine,
-    sessions: status.sessions.map(metadata), history: status.history?.map(metadata),
+    sessions: status.sessions.map(metadata), history: history?.map(metadata),
     generatedAt: status.generatedAt };
-  catalogs.set(client, compact);
+  catalogs.set(client, { ...status, history });
   const paths = Object.fromEntries([...compact.sessions, ...(compact.history ?? [])]
     .flatMap(session => { const path = nativeTranscriptSource(session);
       return path ? [[session.sessionId, path]] : []; }));

package/apps/bridge/src/session-images/README.md

@@ -12,3 +12,8 @@ account state. Apple clients retain validated original bytes locally and use
 their scoped copy when offline. Tests live in `tests/`.
 
 Licensed under the MIT License. See the repository root `LICENSE`.
+
+Native image identities remain readable after the chat head advances. Codex
+attachments are located by timestamp and content block together, so a caption
+with the same timestamp cannot hide the picture. Original bytes are delivered in
+bounded encrypted chunks and the Apple client retains them for offline use.

package/apps/bridge/src/session-images/index.ts

@@ -3,6 +3,7 @@ import { SessionImageChunk } from '../../../../packages/protocol/schema';
 import type { RelayClient } from '../../../../packages/core/relay-client';
 import { sendSessionPayload } from '../host/session-keys';
 import { readTranscriptHistory } from '../transcript-history';
+import { publishedSession } from '../session-catalog';
 import { cachedSessionActivity } from '../monitor/support/session-activity';
 import { scanSessions, scanSessionHistory } from '../sessions';
 import { sessionImageChunk, transcriptImages } from '../../../mcp/src/desktop/image';
@@ -22,7 +23,8 @@ export function readSessionImage(query: SessionImageQuery, session: SessionInfo,
 }
 
 export async function publishSessionImage(client: RelayClient, query: SessionImageQuery): Promise<boolean> {
-  const session = scanSessions().sessions.find(s => s.sessionId === query.sessionId)
+  const session = publishedSession(client, query.sessionId)
+    ?? scanSessions().sessions.find(s => s.sessionId === query.sessionId)
     ?? scanSessionHistory().find(s => s.sessionId === query.sessionId);
   const activity = session ? readTranscriptHistory(session, query.historyCursor)
     ?? cachedSessionActivity(session) : undefined;

package/apps/bridge/src/transcript-history/images/native.ts

@@ -21,14 +21,16 @@ export function nativeTranscriptImage(session: SessionInfo, imageId: string, off
   }
   if (!path || !['claude', 'codex'].includes(session.agent)) return undefined;
   try {
-    const lines = previousNativeLines(path, session.sessionId, cursor)?.lines.map(l => l.text);
-    if (!lines) return undefined;
-    if (session.agent === 'codex') {
-      const full = codexImageChunk(session.sessionId, imageId, 0, lines);
-      if (!full) return undefined;
-      // The native reader retains the original bytes for subsequent bounded chunks.
-      return codexImageChunk(session.sessionId, imageId, offset);
-    }
+    let pageCursor = cursor;
+    for (let page = 0; page < 32; page++) {
+      const window = previousNativeLines(path, session.sessionId, pageCursor);
+      if (!window) return undefined;
+      const lines = window.lines.map(line => line.text);
+      if (session.agent === 'codex') {
+        const full = codexImageChunk(session.sessionId, imageId, 0, lines)
+          ?? codexImageChunk(session.sessionId, imageId, 0);
+        return full ? codexImageChunk(session.sessionId, imageId, offset) : undefined;
+      }
     for (const line of lines) {
       let row;
       try { row = JSON.parse(line); } catch { continue; }
@@ -46,6 +48,9 @@ export function nativeTranscriptImage(session: SessionInfo, imageId: string, off
         return slice(cached, offset);
       }
     }
+      if (window.start === 0) break;
+      pageCursor = window.cursorAt(window.lines[0]?.offset ?? window.start);
+    }
   } catch { return undefined; }
   return undefined;
 }

package/apps/bridge/src/transcript-history/images.ts

@@ -5,9 +5,10 @@ import { previousNativeLines } from "./native-lines";
 /** Locate an older image row without copying image bytes into chat pages. */
 export function nativeImageLines(sessionId: string, entryId: string): string[] | undefined {
   if (!entryId.startsWith(`${sessionId}:`)) return undefined;
-  const stamp = Number(entryId.slice(sessionId.length + 1).split(":")[0]);
+  const [stampText, blockText] = entryId.slice(sessionId.length + 1).split(":");
+  const stamp = Number(stampText), blockIndex = Number(blockText);
   const path = codexLogPathBySession.get(sessionId);
-  if (!path || !Number.isFinite(stamp)) return undefined;
+  if (!path || !Number.isFinite(stamp) || !Number.isSafeInteger(blockIndex) || blockIndex < 0) return undefined;
   let cursor: string | undefined;
   try {
     for (let page = 0; page < 32; page++) {
@@ -19,7 +20,8 @@ export function nativeImageLines(sessionId: string, entryId: string): string[] |
         const createdAt = ts(row?.timestamp);
         if (createdAt) earliest = Math.min(earliest, createdAt);
         if (createdAt === stamp && row?.type === "response_item" && p?.type === "message"
-          && p.role === "user" && Array.isArray(p.content)) return [line.text];
+          && p.role === "user" && Array.isArray(p.content)
+          && p.content[blockIndex]?.type === "input_image") return [line.text];
       }
       if (window.start === 0 || earliest < stamp) return undefined;
       cursor = window.cursorAt(window.lines[0]?.offset ?? window.start);

package/apps/mcp/src/desktop/image/index.ts

@@ -15,7 +15,10 @@ export function sessionImageChunk(session: SessionInfo, activity: SessionActivit
   if (activity.sessionId !== session.sessionId) return undefined;
   const native = activity.entries.some(entry => entry.id === imageId && entry.kind === 'user'
     && entry.attachments?.includes('Image'));
-  if (native) return nativeTranscriptImage(session, imageId, offset, cursor);
+  if (native || imageId.startsWith(`${session.sessionId}:`)) {
+    const picture = nativeTranscriptImage(session, imageId, offset, cursor);
+    if (picture) return picture;
+  }
   const artifact = activity.entries.flatMap(artifactImages).find(image => image.id === imageId);
   if (!artifact) return undefined;
   const loaded = readStoreState(storePath ?? join(configDir(), 'project-mesh.json'));

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.47
+npm install -g granttap-mcp@0.8.48
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.47\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.48\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.47";
+const PACKAGE = "granttap-mcp@0.8.48";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.47",
+  "version": "0.8.48",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/interaction/index.ts

@@ -144,5 +144,6 @@ export const SessionsRefresh = z.object({
   type: z.literal("sessions.refresh"),
   createdAt: z.number(),
   graphProjectId: z.string().min(1).max(128).optional(),
+  graphAnalysisRequestId: z.string().min(1).max(128).optional(),
 });
 export type SessionsRefresh = z.infer<typeof SessionsRefresh>;

package/packages/protocol/messages/mesh/snapshot.ts

@@ -250,6 +250,7 @@ export const MeshSnapshot = z.object({
   dependencies: z.array(TaskDependency).max(128),
   events: z.array(MeshEvent).max(128),
   generatedAt: z.number().nonnegative(),
+  graphAnalysisRequestId: z.string().min(1).max(128).optional(),
 }).strict().superRefine((value, ctx) => {
   const detailKeys = new Set(value.repositoryDetails?.map((item) => `${item.endpointId}\0${item.repositoryId}`));
   if (detailKeys.size !== (value.repositoryDetails?.length ?? 0)