granttap-mcp 0.8.81 → 0.8.83

package/README.md

@@ -239,7 +239,17 @@ manual rebuilds join pending work and return their own delivery receipts.
 Usable reports persist privately on the computer across MCP restarts, while
 the phone keeps its last received map visible during a rebuild. Source Git
 revision and analysis content fingerprint are separate freshness facts.
-Partial and unavailable reports retain their scope and status.
+Partial and unavailable reports retain their scope and status. Health separates
+report freshness from completeness and offers local filtering, sorting and
+diagnostics options. The code city has an independent legend, symbol-kind and
+size colours, label and relation controls, and optional measured code checks.
+
+Engine source checks carry measured function extent, a token-based cyclomatic
+estimate, loop nesting and resolved call fan-in. The clients compare those
+measurements with the selected thresholds. Green means within those checks; red
+means review a threshold; unmeasured code remains unknown. Correctness, test
+coverage and runtime performance are not inferred. Analysis uses this computer's
+verified Git checkout roots, observed revision and local Git exclusions.
 
 <p align="center">
   <img src="docs/images/iphone-chat-work-summary.png" width="200" alt="Files and Agents above the composer with deterministic sample work">

package/THIRD_PARTY_LICENSES.txt

@@ -324,8 +324,8 @@ hasown 2.0.4 — MIT
 Source: https://www.npmjs.com/package/hasown/v/2.0.4
 Notices: bf9b0d665be2a689851eea667ca9f42066ea1d903b38349c51e6a44b2577680a
 
-hono 4.13.7 — MIT
-Source: https://www.npmjs.com/package/hono/v/4.13.7
+hono 4.13.13 — MIT
+Source: https://www.npmjs.com/package/hono/v/4.13.13
 Notices: a6ab98e5c77b9070c443eaff2ff81034a6f8cc05a7524d5098eb0f24defa0115
 
 http-errors 2.0.1 — MIT

package/apps/bridge/src/engine/distribution/artifacts.ts

@@ -8,12 +8,12 @@ export type EngineArtifact = {
 
 /** Release hashes are part of the reviewed MCP, never supplied by a remote manifest. */
 export const ENGINE_ARTIFACTS: readonly EngineArtifact[] = [
-  { version: "0.1.1", platform: "darwin", arch: "arm64",
-    sha256: "3381b757cf79470267976c3e74f8262c9a9a754bcff3b45f74d6f2b00d74e1e4", bytes: 12067440 },
-  { version: "0.1.1", platform: "darwin", arch: "x64",
-    sha256: "c08752079cd58b9249c345e81cef02130da553ac7066494323a41e2204d581a8", bytes: 13915384 },
-  { version: "0.1.1", platform: "linux", arch: "x64",
-    sha256: "e2d322857be5a628795ffa088bd873dbffb42697a77e79b9d98b80a290d574b2", bytes: 14726408 },
+  { version: "0.1.2", platform: "darwin", arch: "arm64",
+    sha256: "fa23668f2f2cbb716a0ba66c5a6e027a25ed4e7e2dedf0c870edb32199045b97", bytes: 12101408 },
+  { version: "0.1.2", platform: "darwin", arch: "x64",
+    sha256: "b3235a15936a77ec323d5ecbc54a0bc19994fe6e5a36044da964b68524b4c1dd", bytes: 13944984 },
+  { version: "0.1.2", platform: "linux", arch: "x64",
+    sha256: "1a6b227289b69459a64cd13078044960cf83bb858e6be1b70b1b38c950b00cc0", bytes: 14753312 },
 ];
 
 export function selectEngineArtifact(platform: string = process.platform, arch: string = process.arch): EngineArtifact | undefined {

package/apps/bridge/src/engine/protocol/transport/code-checks/README.md

@@ -0,0 +1,11 @@
+# Measured source checks
+
+Public entry: `index.ts`. The Engine response parser admits optional, measured
+function size, token-based complexity, nesting and resolved call fan-in. Absent
+measurements stay absent. Malformed, negative and out-of-range values fail the
+response instead of becoming healthy zeroes.
+
+Integration tests: `runtime/repository-graph/tests/code-checks.test.ts`, relative
+to the Engine module. The additive fields remain compatible with older Engines.
+
+License: GrantTap Commercial Source License; see the repository LICENSE.

package/apps/bridge/src/engine/protocol/transport/code-checks/index.ts

@@ -0,0 +1,14 @@
+import { EngineProtocolError } from "../protocol-base";
+
+/** Missing checks stay unknown; present checks must be bounded measurements. */
+export function parseCodeChecks(value: unknown): void {
+  if (value == null) return;
+  const checks = value as Record<string, unknown>;
+  if (typeof checks !== "object" || Array.isArray(checks) || checks.measured !== true
+    || !["source_lines", "cyclomatic", "max_loop_depth", "callers"].every(key =>
+      Number.isSafeInteger(checks[key]) && Number(checks[key]) >=
+        (["source_lines", "cyclomatic"].includes(key) ? 1 : 0)
+        && Number(checks[key]) <= 0xffff_ffff)) {
+    throw new EngineProtocolError("invalid measured code checks");
+  }
+}

package/apps/bridge/src/engine/protocol/transport/protocol-types.ts

@@ -49,7 +49,9 @@ export type EngineRepositoryGraph = {
   code_map?: {
     files: Array<{ path: string; language: string | null; line_count: number | null;
       symbols: Array<{ id: string; label: string; kind: string;
-        start_line: number; line_count: number }> }>;
+        start_line: number; line_count: number;
+        metrics?: { measured: boolean; source_lines: number; cyclomatic: number;
+          max_loop_depth: number; callers: number } }> }>;
     externals?: Array<{ id: string; label: string; kind: string }>;
     roads: Array<{ source: string; target: string; relation: string }>;
     total_files: number;

package/apps/bridge/src/engine/protocol/transport/result-parser.ts

@@ -4,6 +4,7 @@ import { parsePolicyResult } from "../engine-policy-protocol";
 import { parseImpactResult } from "../impact/engine-impact-protocol";
 import { parseEngineIdentityResult } from "./identity-result-parser";
 import { parseProjectCatalog } from "./project-catalog-parser";
+import { parseCodeChecks } from "./code-checks";
 import {
   ENGINE_PROTOCOL_VERSION,
   EngineProtocolError,
@@ -186,6 +187,7 @@ function parseCodeMap(value: unknown): void {
       requireBoundedString(symbol.id, "code symbol id", 512);
       requireBoundedString(symbol.label, "code symbol label", 160);
       requireBoundedString(symbol.kind, "code symbol kind", 64);
+      parseCodeChecks(symbol.metrics);
       if (!Number.isSafeInteger(symbol.start_line) || Number(symbol.start_line) < 1
         || !Number.isSafeInteger(symbol.line_count) || Number(symbol.line_count) < 1) invalidResult();
     }

package/apps/bridge/src/engine/runtime/engine-projects.ts

@@ -17,6 +17,7 @@ import type {
 import { RepositoryGraphJobs } from "./repository-graph-jobs";
 import { fitRepositoryGraph } from "./repository-graph/fit";
 import { RepositoryGraphCache } from "./repository-graph/cache";
+import { repositorySourceMap } from "./repository-graph/source-map";
 
 export type LocalProjectBinding = {
   summary: ProjectBindingSummary;
@@ -229,20 +230,7 @@ async function analyzeRepositoryGraph(
       analysisId: graph.analysis_id ?? undefined,
       analysisStatus: graph.analysis_status,
       architectureHypotheses: graph.architecture_hypotheses,
-      codeMap: graph.code_map ? {
-        files: graph.code_map.files.map((file) => ({
-          path: file.path, language: file.language, lineCount: file.line_count,
-          symbols: file.symbols.map((symbol) => ({
-            id: symbol.id, label: symbol.label, kind: symbol.kind,
-            startLine: symbol.start_line, lineCount: symbol.line_count,
-          })),
-        })),
-        externals: graph.code_map.externals ?? [],
-        roads: graph.code_map.roads,
-        totalFiles: graph.code_map.total_files,
-        totalExternals: graph.code_map.total_externals ?? 0,
-        truncated: graph.code_map.truncated,
-      } : undefined,
+      codeMap: repositorySourceMap(graph),
       nodes: graph.nodes,
       relations: graph.relations.map((edge) => ({
         source: edge.source, target: edge.target, relation: edge.relation,

package/apps/bridge/src/engine/runtime/repository-graph/README.md

@@ -0,0 +1,20 @@
+# Repository graph delivery
+
+[Runtime entry point](../engine-projects.ts) · [Wire fitting](fit.ts)
+
+The encrypted Mesh snapshot carries bounded, observed repository metadata.
+`fitRepositoryGraph` preserves file identities, measured LOC and source sections.
+When directed file links dominate the wire budget, it reduces those links before
+discarding source sections. The bounded sample keeps links reaching previously
+unrepresented files and external services, then fills in original report order.
+It never invents links, reverses their direction, or edits the engine report.
+
+Remaining reductions retain the existing wire limit and mark partial evidence.
+The persistent cache keeps a last successful bounded report through an MCP
+restart while the normal observation refresh obtains current engine evidence.
+
+Behavior tests live in `tests/`; runtime and cache integration scenarios remain
+under the repository's `tests/engine` harness.
+
+License: this module is distributed under the GrantTap Commercial Source License
+in the repository-root `LICENSE` file.

package/apps/bridge/src/engine/runtime/repository-graph/fit.ts

@@ -1,4 +1,5 @@
 import type { ProjectRepositoryGraph } from "../../../../../../packages/protocol/schema";
+import { representativeSourcePaths, canReduceSymbols, sampleSymbols } from "./source-sampling";
 
 type CodeMap = NonNullable<ProjectRepositoryGraph["codeMap"]>;
 type Relation = ProjectRepositoryGraph["relations"][number];
@@ -16,7 +17,12 @@ export function fitRepositoryGraph(
   }
   while (bytes() > maxBytes) {
     const map = bounded.codeMap;
-    if (map?.files.some((file) => file.symbols.length > 0)) {
+    // Dense import graphs must not consume the source-section budget. Keep
+    // observed directed links across the inventory before reducing symbols.
+    if (map && map.roads.length > 16
+      && Buffer.byteLength(JSON.stringify(map.roads), "utf8") > maxBytes / 3) {
+      bounded = { ...bounded, codeMap: trimRoads(map) };
+    } else if (map && canReduceSymbols(map)) {
       bounded = { ...bounded, codeMap: trimSymbols(map) };
     } else if (bounded.relations.length > 8) {
       bounded = { ...bounded, relations: strongestRelations(bounded.relations,
@@ -27,8 +33,7 @@ export function fitRepositoryGraph(
       bounded = { ...bounded, nodes, relations: bounded.relations.filter((edge) =>
         ids.has(edge.source) && ids.has(edge.target)), truncated: true };
     } else if (map && map.roads.length > 16) {
-      bounded = { ...bounded, codeMap: { ...map, truncated: true,
-        roads: map.roads.slice(0, Math.ceil(map.roads.length / 2)) } };
+      bounded = { ...bounded, codeMap: trimRoads(map) };
     } else if (map && map.files.length > 8) {
       bounded = { ...bounded, codeMap: trimFiles(map) };
     } else if (map) {
@@ -40,6 +45,20 @@ export function fitRepositoryGraph(
   return bounded;
 }
 
+function trimRoads(map: CodeMap): CodeMap {
+  const limit = Math.max(16, Math.ceil(map.roads.length / 2));
+  const kept = new Set<number>(), endpoints = new Set<string>();
+  for (const [index, road] of map.roads.entries()) {
+    if (kept.size === limit) break;
+    if (endpoints.has(road.source) && endpoints.has(road.target)) continue;
+    kept.add(index);
+    endpoints.add(road.source);
+    endpoints.add(road.target);
+  }
+  for (let index = 0; kept.size < limit; index++) kept.add(index);
+  return { ...map, truncated: true, roads: map.roads.filter((_, index) => kept.has(index)) };
+}
+
 function strongestRelations(relations: Relation[], limit: number): Relation[] {
   return relations.map((edge, index) => ({ edge, index }))
     .sort((left, right) => (right.edge.evidenceCount ?? 0) - (left.edge.evidenceCount ?? 0)
@@ -57,27 +76,31 @@ function roadDegree(map: CodeMap): Map<string, number> {
   return degree;
 }
 
-function rankedFiles(map: CodeMap): CodeMap["files"] {
+function rankedFiles(map: CodeMap, preserveSource = false): CodeMap["files"] {
   const degree = roadDegree(map);
+  const representatives = preserveSource ? representativeSourcePaths(map) : new Set<string>();
   return [...map.files].sort((left, right) =>
-    (degree.get(right.path) ?? 0) - (degree.get(left.path) ?? 0)
+    Number(representatives.has(right.path)) - Number(representatives.has(left.path))
+      || (preserveSource ? Number(right.symbols.length > 0) - Number(left.symbols.length > 0) : 0)
+      || (degree.get(right.path) ?? 0) - (degree.get(left.path) ?? 0)
       || (right.lineCount ?? 0) - (left.lineCount ?? 0)
       || left.path.localeCompare(right.path));
 }
 
 function trimSymbols(map: CodeMap): CodeMap {
   const ranked = rankedFiles(map).filter((file) => file.symbols.length > 0);
-  const keep = new Set(ranked.slice(0, Math.floor(ranked.length / 2)).map((file) => file.path));
+  if (ranked.length <= 16) return { ...map, truncated: true,
+    files: map.files.map(file => ({ ...file, symbols: sampleSymbols(file.symbols) })) };
+  const candidates = [...representativeSourcePaths(map), ...ranked.map(file => file.path)];
+  const keep = new Set([...new Set(candidates)].slice(0, Math.max(16, Math.floor(ranked.length / 2))));
   return { ...map, truncated: true, files: map.files.map((file) => {
     if (!keep.has(file.path)) return { ...file, symbols: [] };
-    if (ranked.length === 1) return { ...file, symbols: file.symbols.slice(0,
-      Math.floor(file.symbols.length / 2)) };
     return file;
   }) };
 }
 
 function trimFiles(map: CodeMap): CodeMap {
-  const files = rankedFiles(map).slice(0, Math.ceil(map.files.length / 2))
+  const files = rankedFiles(map, true).slice(0, Math.ceil(map.files.length / 2))
     .sort((left, right) => left.path.localeCompare(right.path));
   const paths = new Set(files.map((file) => file.path));
   for (const external of map.externals ?? []) paths.add(external.id);

package/apps/bridge/src/engine/runtime/repository-graph/source-map.ts

@@ -0,0 +1,21 @@
+import type { EngineRepositoryGraph } from "../../protocol/engine-protocol";
+import type { ProjectCodeMap } from "../../../../../../packages/protocol/messages/mesh/graph/code-map";
+
+/** Preserve optional source checks without turning absent measurements into zero. */
+export function repositorySourceMap(graph: EngineRepositoryGraph): ProjectCodeMap | undefined {
+  const map = graph.code_map;
+  if (!map) return undefined;
+  return {
+    files: map.files.map(file => ({ path: file.path, language: file.language, lineCount: file.line_count,
+      symbols: file.symbols.map(symbol => ({
+        id: symbol.id, label: symbol.label, kind: symbol.kind, startLine: symbol.start_line, lineCount: symbol.line_count,
+        ...(symbol.metrics?.measured === true ? { metrics: {
+          measured: true as const, sourceLines: symbol.metrics.source_lines, cyclomatic: symbol.metrics.cyclomatic,
+          maxLoopDepth: symbol.metrics.max_loop_depth, callers: symbol.metrics.callers,
+        } } : {}),
+      })),
+    })),
+    externals: map.externals ?? [], roads: map.roads, totalFiles: map.total_files,
+    totalExternals: map.total_externals ?? 0, truncated: map.truncated,
+  };
+}

package/apps/bridge/src/engine/runtime/repository-graph/source-sampling.ts

@@ -0,0 +1,39 @@
+import type { ProjectRepositoryGraph } from "../../../../../../packages/protocol/schema";
+
+type CodeMap = NonNullable<ProjectRepositoryGraph["codeMap"]>;
+type Symbol = CodeMap["files"][number]["symbols"][number];
+
+/** Reserve actual measured checks and a small sample of distinct source kinds. */
+export function representativeSourcePaths(map: CodeMap): Set<string> {
+  const paths = new Set<string>();
+  const measured = map.files.find(file => file.symbols.some(symbol => symbol.metrics?.measured));
+  if (measured) paths.add(measured.path);
+  const kinds = new Set<string>();
+  for (const file of map.files) for (const symbol of file.symbols) {
+    if (kinds.has(symbol.kind) || paths.size >= 8) continue;
+    kinds.add(symbol.kind); paths.add(file.path);
+  }
+  return paths;
+}
+
+export function canReduceSymbols(map: CodeMap): boolean {
+  return map.files.filter(file => file.symbols.length > 0).length > 16
+    || map.files.some(file => file.symbols.length > 1);
+}
+
+export function sampleSymbols(symbols: Symbol[]): Symbol[] {
+  if (symbols.length <= 1) return symbols;
+  const keep = new Set<Symbol>(), kinds = new Set<string>();
+  const limit = Math.max(1, Math.floor(symbols.length / 2));
+  const measured = symbols.find(symbol => symbol.metrics?.measured);
+  if (measured) { keep.add(measured); kinds.add(measured.kind); }
+  for (const symbol of symbols) {
+    if (keep.size >= limit) break;
+    if (!kinds.has(symbol.kind)) { keep.add(symbol); kinds.add(symbol.kind); }
+  }
+  for (const symbol of symbols) {
+    if (keep.size >= limit) break;
+    keep.add(symbol);
+  }
+  return symbols.filter(symbol => keep.has(symbol));
+}

package/apps/bridge/src/mesh/runtime/graph/README.md

@@ -11,8 +11,10 @@ remote claim. Changed remote identities and local paths to different checkouts
 remain rejected. Neither Task identity nor Project membership is rewritten.
 
 After admission, `graphAnalysisBindings` selects one graph per endpoint and real
-checkout path, preferring an admitted canonical binding over a duplicate local
-alias. Failed bindings remain visible with their original error. Both the Mac
+checkout path, preferring the currently verified canonical binding over retired aliases.
+Observed Git revisions replace old catalog observations in admission and report
+provenance. A subfolder with a remembered parent commit is not a checkout. Each
+computer analyzes only its own endpoint bindings. Failed bindings remain visible with their original error. Both the Mac
 projection and phone refresh use this rule. The graph contains actual Engine
 analysis; unavailable analysis is never synthesized as a successful graph.
 

package/apps/bridge/src/mesh/runtime/graph/analysis.ts

@@ -6,6 +6,8 @@ import { publishedCatalog } from "../../../session-catalog";
 import { meshSnapshot, meshSnapshots } from "..";
 import { refreshLocalGraphBindings } from "./binding-sync";
 import { graphAnalysisBindings } from "./checkout-identity";
+import { computerId } from "../../identity/computer";
+import { repositoryDetails } from "../../repository-details";
 
 /** A person's explicit Graph refresh bypasses background job backoff. */
 type GraphAnalysisDependencies = {
@@ -16,6 +18,8 @@ type GraphAnalysisDependencies = {
   backbone: typeof projectBackbone;
   graphs: typeof projectRepositoryGraphs;
   send: (client: RelayClient, snapshot: MeshSnapshot) => Promise<void>;
+  endpoint?: () => string;
+  details?: (snapshot: MeshSnapshot) => ReturnType<typeof repositoryDetails>;
 };
 
 const graphAnalysisDependencies: GraphAnalysisDependencies = {
@@ -24,6 +28,8 @@ const graphAnalysisDependencies: GraphAnalysisDependencies = {
   sync: refreshLocalGraphBindings,
   backbone: projectBackbone,
   graphs: projectRepositoryGraphs,
+  endpoint: computerId,
+  details: snapshot => repositoryDetails(snapshot, computerId()),
   send: (client, snapshot) => sendMeshPayload(client, snapshot, "phone", {
     ttlMs: 60_000, reliable: true,
   }),
@@ -47,10 +53,13 @@ export async function analyzeProjectGraphNow(
   if (!current) return false;
   const failures = dependencies.sync ? await dependencies.sync(current) : [];
   const rejected = new Set(failures.map(report => report.repositoryId));
-  const [backbone, repositoryGraphs] = await Promise.all([
+  const bindings = graphAnalysisBindings((current.bindings ?? [])
+    .filter(binding => !rejected.has(binding.repositoryId)), dependencies.endpoint?.());
+  if (dependencies.endpoint && !bindings.length && !failures.length && current.bindings?.length) return false;
+  const [backbone, repositoryGraphs, details] = await Promise.all([
     dependencies.backbone(projectId),
-    dependencies.graphs(projectId, graphAnalysisBindings((current.bindings ?? [])
-      .filter(binding => !rejected.has(binding.repositoryId))), { background: false }),
+    dependencies.graphs(projectId, bindings, { background: false }),
+    dependencies.details?.(current),
   ]);
   const observed = [...repositoryGraphs, ...failures];
   const reports = observed.length > 0 ? observed : [{
@@ -63,6 +72,7 @@ export async function analyzeProjectGraphNow(
   for (const id of receipts) {
     await dependencies.send(client, {
       ...current, backbone, repositoryGraphs: reports, generatedAt: Date.now(),
+      ...(details ? { repositoryDetails: details } : {}),
       ...(id ? { graphAnalysisRequestId: id } : {}),
     });
   }

package/apps/bridge/src/mesh/runtime/graph/binding-sync.ts

@@ -44,7 +44,7 @@ export async function refreshLocalGraphBindings(
     }
     try {
       const admitted = await dependencies.sync(snapshot.project, {
-        summary: binding,
+        summary: { ...binding, revision: facts.revision ?? binding.revision },
         localRoot: facts.root,
         // A local binding is scoped by its verified path. Do not relabel it as
         // a remote repository or move it into that repository's Project scope.

package/apps/bridge/src/mesh/runtime/graph/checkout-identity.ts

@@ -1,6 +1,7 @@
 import { realpathSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import type { ProjectBindingSummary } from "../../../../../../packages/protocol/schema";
+import { inspectRepository, type RepositoryFacts } from "../../catalog";
 
 /** Local identities name an exact directory, even after that directory gains an origin. */
 export function matchesLocalCheckout(repositoryId: string, root: string): boolean {
@@ -12,17 +13,39 @@ export function matchesLocalCheckout(repositoryId: string, root: string): boolea
 }
 
 /** Once admitted, one checkout contributes one graph to this Mesh. */
-export function graphAnalysisBindings(bindings: ProjectBindingSummary[]): ProjectBindingSummary[] {
+export function graphAnalysisBindings(bindings: ProjectBindingSummary[], endpointId?: string): ProjectBindingSummary[] {
   const selected = new Map<string, ProjectBindingSummary>();
+  const observations = new Map<string, RepositoryFacts | undefined>();
+  const nonRepositories = new Set<string>();
+  const ranks = new Map<string, number>();
   for (const binding of bindings) {
+    if (endpointId && binding.endpointId !== endpointId) continue;
     let path: string | undefined;
     if (binding.available && binding.localPathHint) {
       try { path = realpathSync(binding.localPathHint); } catch { /* Keep an unavailable checkout distinct. */ }
     }
+    if (path && !observations.has(path)) {
+      let facts: RepositoryFacts | undefined;
+      try {
+        const observed = inspectRepository(path);
+        if (observed.worktree && realpathSync(observed.root) === path) facts = observed;
+        else nonRepositories.add(path);
+      } catch { /* Unavailable roots retain their own identity. */ }
+      observations.set(path, facts);
+    }
+    // A remembered commit from the parent does not make a subfolder a checkout.
+    if (path && nonRepositories.has(path)) continue;
+    const facts = path ? observations.get(path) : undefined;
+    const canonical = facts?.canonicalRepositoryId === binding.repositoryId;
+    const scoped = facts && matchesLocalCheckout(binding.repositoryId, facts.root);
+    const rank = canonical ? 3 : scoped ? 2 : binding.repositoryId.startsWith("local:") ? 0 : 1;
+    const candidate = (canonical || scoped) && facts?.revision
+      ? { ...binding, revision: facts.revision } : binding;
     const key = JSON.stringify([binding.endpointId, path ?? binding.repositoryId]);
     const previous = selected.get(key);
-    if (!previous || (previous.repositoryId.startsWith("local:") && !binding.repositoryId.startsWith("local:"))) {
-      selected.set(key, binding);
+    if (!previous || rank > (ranks.get(key) ?? 0)) {
+      selected.set(key, candidate);
+      ranks.set(key, rank);
     }
   }
   return [...selected.values()];

package/apps/bridge/src/mesh/runtime/snapshot/enriched.ts

@@ -18,7 +18,7 @@ export async function enrichMeshSnapshot(
   const identityFailures = await refreshLocalGraphBindings(snapshot);
   const excludedRepositories = new Set(identityFailures.map((report) => report.repositoryId));
   const bindings = graphAnalysisBindings((snapshot.bindings ?? [])
-    .filter((binding) => !excludedRepositories.has(binding.repositoryId)));
+    .filter((binding) => !excludedRepositories.has(binding.repositoryId)), computerId());
   await waitForProjectBindingSync(snapshot.projectId);
   queueProjectKnowledgeSync({
     projectId: snapshot.projectId,

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.81
+npm install -g granttap-mcp@0.8.83
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.81\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.83\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.81";
+const PACKAGE = "granttap-mcp@0.8.83";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.81",
+  "version": "0.8.83",
   "description": "Commercial computer runtime connecting local coding agents to GrantTap on Mac, iPhone, iPad and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/protocol/messages/mesh/graph/code-map.ts

@@ -14,6 +14,12 @@ export const ProjectCodeMap = z.object({
       kind: z.string().trim().min(1).max(64),
       startLine: z.number().int().positive(),
       lineCount: z.number().int().positive(),
+      metrics: z.object({
+        measured: z.literal(true), sourceLines: z.number().int().positive().max(0xffff_ffff),
+        cyclomatic: z.number().int().positive().max(0xffff_ffff),
+        maxLoopDepth: z.number().int().nonnegative().max(0xffff_ffff),
+        callers: z.number().int().nonnegative().max(0xffff_ffff),
+      }).strict().optional(),
     }).strict()).max(72),
   }).strict()).max(650),
   externals: z.array(z.object({