granttap-mcp 0.8.52 → 0.8.54

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.52
+npm install -g granttap-mcp@0.8.54
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.52\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.54\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.52";
+const PACKAGE = "granttap-mcp@0.8.54";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.52",
+  "version": "0.8.54",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/core/outbound-scheduler/README.md

@@ -11,3 +11,11 @@ Tests live in `tests/`; they include an actual WebSocket server with the relay's
 rate limit. A socket write is transport evidence, never an approval receipt.
 
 MIT License; see the repository LICENSE.
+# Active controllers
+
+Authenticated incoming phone traffic marks that controller active for 90 seconds.
+Large replaceable encrypted task/project data targets recent controllers while
+catalogs, liveness, approval status and reliable messages retain every authorized
+recipient. Current catalogs and liveness pass queued bulk frames. A transport with no recent controller falls back to
+the complete authorized set for legacy clients and reconnection. Routing never
+deletes a pairing or replaces the controller authorization gate.

package/packages/core/outbound-scheduler/active-controllers.ts

@@ -0,0 +1,15 @@
+/** Activity routes replaceable traffic; authorization remains a separate check. */
+export class ActiveControllerRecipients {
+  private readonly seen = new Map<string, number>();
+
+  observe(peer: string, now = Date.now()): void {
+    this.seen.set(peer, now);
+  }
+
+  allows(peer: string, replaceable: boolean, now = Date.now()): boolean {
+    if (!replaceable) return true;
+    const active = [...this.seen].filter(([, at]) => now >= at && now - at <= 90_000);
+    // A newly connected transport has not heard its controllers yet.
+    return active.length === 0 || active.some(([key]) => key === peer);
+  }
+}

package/packages/core/outbound-scheduler/index.ts

@@ -3,6 +3,7 @@ import type { PeerConfig, SendOptions } from "../relay-client-types";
 import type { Payload, Role } from "../../protocol/schema";
 import { peerPublicKeys } from "../crypto";
 import { sealEnvelope } from "../relay-envelope";
+export { ActiveControllerRecipients } from "./active-controllers";
 
 type Job = { frame: string; bytes: number; resolve: () => void; reject: (error: Error) => void };
 const CLOSED = () => new Error("relay connection closed before delivery");
@@ -68,7 +69,8 @@ export class OutboundFrameQueue {
 }
 
 const control = (type: Payload["type"]) => type === "hello" || type.startsWith("approval.")
-  || type.startsWith("config.") || type.startsWith("pairing.") || type === "session.key.grant";
+  || type.startsWith("config.") || type.startsWith("pairing.") || type === "session.key.grant"
+  || type === "sessions.status" || type === "machine.heartbeat" || type === "approvals.status";
 
 export async function sendEncryptedPayload(queue: OutboundFrameQueue, config: PeerConfig,
   allowed: (key: string) => boolean,

package/packages/core/relay-client.ts

@@ -10,7 +10,7 @@
  * the Cloudflare Durable Object deployment.
  */
 import WebSocket from "ws";
-import { OutboundFrameQueue, sendEncryptedPayload } from "./outbound-scheduler";
+import { OutboundFrameQueue, sendEncryptedPayload, ActiveControllerRecipients } from "./outbound-scheduler";
 import { createHash } from "node:crypto";
 import { Envelope, Payload, type Role } from "../protocol/schema";
 import { openFromPeersWithIdentity, openWithTransferKey, peerPublicKeys, seal, sealWithTransferKey } from "./crypto";
@@ -34,6 +34,7 @@ export class RelayClient {
   private livenessTimer?: NodeJS.Timeout;
   private awaitingPong = false;
   private readonly sessionKeys = new Map<string, string>();
+  private readonly activeControllers = new ActiveControllerRecipients();
   /**
    * Delivery ids are relay-controlled metadata, so replay protection is bound
    * to the authenticated ciphertext itself. Keep a bounded process-local set:
@@ -199,6 +200,9 @@ export class RelayClient {
       this.sessionKeys.set(payload.sessionId, payload.key);
     }
     if (this.processingCiphertexts.has(fingerprint)) return;
+    if (this.cfg.role === "machine" && (payload.type !== "hello" || payload.role === "phone")) {
+      this.activeControllers.observe(peerPublicKey);
+    }
     this.processingCiphertexts.add(fingerprint);
     try {
       const results = await Promise.all([...this.listeners].map(async (listener) => {
@@ -234,7 +238,11 @@ export class RelayClient {
     const ws = this.ws;
     if (!ws || ws.readyState !== WebSocket.OPEN) throw new Error("relay not connected");
     if (!this.frames) throw new Error("relay not connected");
-    await sendEncryptedPayload(this.frames, this.cfg, key => this.peerIsAllowed(key), { payload, to, options });
+    const replaceable = this.cfg.role === "machine" && to === "phone"
+      && options.reliable === false && payload.type === "session.sealed";
+    await sendEncryptedPayload(this.frames, this.cfg,
+      key => this.peerIsAllowed(key) && this.activeControllers.allows(key, replaceable),
+      { payload, to, options });
   }
 
   /** Add a newly issued controller without waiting for the monitor to restart. */