granttap-mcp 0.8.82 → 0.8.84

package/README.md

@@ -239,7 +239,17 @@ manual rebuilds join pending work and return their own delivery receipts.
 Usable reports persist privately on the computer across MCP restarts, while
 the phone keeps its last received map visible during a rebuild. Source Git
 revision and analysis content fingerprint are separate freshness facts.
-Partial and unavailable reports retain their scope and status.
+Partial and unavailable reports retain their scope and status. Health separates
+report freshness from completeness and offers local filtering, sorting and
+diagnostics options. The code city has an independent legend, symbol-kind and
+size colours, label and relation controls, and optional measured code checks.
+
+Engine source checks carry measured function extent, a token-based cyclomatic
+estimate, loop nesting and resolved call fan-in. The clients compare those
+measurements with the selected thresholds. Green means within those checks; red
+means review a threshold; unmeasured code remains unknown. Correctness, test
+coverage and runtime performance are not inferred. Analysis uses this computer's
+verified Git checkout roots, observed revision and local Git exclusions.
 
 <p align="center">
   <img src="docs/images/iphone-chat-work-summary.png" width="200" alt="Files and Agents above the composer with deterministic sample work">
@@ -781,6 +791,14 @@ in the Apple apps. Use the support contact there for product issues. Report
 security vulnerabilities through [SECURITY.md](SECURITY.md); do not put pairing
 QR codes, credentials or private chat transcripts into public issues.
 
+## Node.js requirement
+
+Install the latest patched Node.js LTS release. GrantTap requires Node.js
+22.13.0 or newer; Node.js 18 and 20 are not supported. The CLI checks this
+before loading dependencies or changing local configuration. The npm `engines`
+field also reports this requirement, but npm may only warn unless engine checks
+are enforced by the installer.
+
 ## Development
 
 ```bash

package/apps/bridge/src/config/README.md

@@ -1,10 +1,14 @@
 # Bridge Configuration
 
 This module owns local runtime policy, exact-session capability controls, paths,
-and device pairing serialization. `../config.ts` is its public entry point.
+and device pairing serialization. `index.ts` is its public entry point.
 
 Behavior is covered by `tests/config.test.ts`, `tests/capabilities.test.ts`, and
 `tests/core.test.ts`.
 
 License: this module is distributed under the GrantTap Commercial Source License
 in the repository-root `LICENSE` file.
+
+Runtime startup and persistent OAuth share `runtime/node-requirement.mjs`, which
+reads the package Node minimum before loading TypeScript dependencies. Runtime
+compatibility regressions live in `runtime/tests/node-requirement.test.ts`.

package/apps/bridge/src/config/index.ts

@@ -4,6 +4,7 @@ export * from "./access/pairing";
 export { writePrivateFile } from "./access/write-private";
 export * from "./runtime/paths";
 export * from "./runtime";
+export { isSupportedNode, minimumNodeVersion } from "./runtime/node-requirement.mjs";
 export {
   classifyAction,
   isSafeReadonlyShell,

package/apps/bridge/src/config/runtime/node-requirement.d.mts

@@ -0,0 +1,2 @@
+export const minimumNodeVersion: string;
+export function isSupportedNode(version: string): boolean;

package/apps/bridge/src/config/runtime/node-requirement.mjs

@@ -0,0 +1,15 @@
+import { readFileSync } from "node:fs";
+
+const manifest = JSON.parse(readFileSync(new URL("../../../../../package.json", import.meta.url), "utf8"));
+export const minimumNodeVersion = manifest.engines.node.replace(/^>=/, "");
+
+/** Shared by the native launcher and persistent-service installer before loading tsx. */
+export function isSupportedNode(version) {
+  if (!/^v?\d+\.\d+\.\d+$/.test(version)) return false;
+  const actual = version.replace(/^v/, "").split(".").map(Number);
+  const minimum = minimumNodeVersion.split(".").map(Number);
+  for (let index = 0; index < 3; index += 1) {
+    if (actual[index] !== minimum[index]) return actual[index] > minimum[index];
+  }
+  return true;
+}

package/apps/bridge/src/engine/distribution/artifacts.ts

@@ -8,12 +8,12 @@ export type EngineArtifact = {
 
 /** Release hashes are part of the reviewed MCP, never supplied by a remote manifest. */
 export const ENGINE_ARTIFACTS: readonly EngineArtifact[] = [
-  { version: "0.1.1", platform: "darwin", arch: "arm64",
-    sha256: "3381b757cf79470267976c3e74f8262c9a9a754bcff3b45f74d6f2b00d74e1e4", bytes: 12067440 },
-  { version: "0.1.1", platform: "darwin", arch: "x64",
-    sha256: "c08752079cd58b9249c345e81cef02130da553ac7066494323a41e2204d581a8", bytes: 13915384 },
-  { version: "0.1.1", platform: "linux", arch: "x64",
-    sha256: "e2d322857be5a628795ffa088bd873dbffb42697a77e79b9d98b80a290d574b2", bytes: 14726408 },
+  { version: "0.1.2", platform: "darwin", arch: "arm64",
+    sha256: "fa23668f2f2cbb716a0ba66c5a6e027a25ed4e7e2dedf0c870edb32199045b97", bytes: 12101408 },
+  { version: "0.1.2", platform: "darwin", arch: "x64",
+    sha256: "b3235a15936a77ec323d5ecbc54a0bc19994fe6e5a36044da964b68524b4c1dd", bytes: 13944984 },
+  { version: "0.1.2", platform: "linux", arch: "x64",
+    sha256: "1a6b227289b69459a64cd13078044960cf83bb858e6be1b70b1b38c950b00cc0", bytes: 14753312 },
 ];
 
 export function selectEngineArtifact(platform: string = process.platform, arch: string = process.arch): EngineArtifact | undefined {

package/apps/bridge/src/engine/protocol/transport/code-checks/README.md

@@ -0,0 +1,11 @@
+# Measured source checks
+
+Public entry: `index.ts`. The Engine response parser admits optional, measured
+function size, token-based complexity, nesting and resolved call fan-in. Absent
+measurements stay absent. Malformed, negative and out-of-range values fail the
+response instead of becoming healthy zeroes.
+
+Integration tests: `runtime/repository-graph/tests/code-checks.test.ts`, relative
+to the Engine module. The additive fields remain compatible with older Engines.
+
+License: GrantTap Commercial Source License; see the repository LICENSE.

package/apps/bridge/src/engine/protocol/transport/code-checks/index.ts

@@ -0,0 +1,14 @@
+import { EngineProtocolError } from "../protocol-base";
+
+/** Missing checks stay unknown; present checks must be bounded measurements. */
+export function parseCodeChecks(value: unknown): void {
+  if (value == null) return;
+  const checks = value as Record<string, unknown>;
+  if (typeof checks !== "object" || Array.isArray(checks) || checks.measured !== true
+    || !["source_lines", "cyclomatic", "max_loop_depth", "callers"].every(key =>
+      Number.isSafeInteger(checks[key]) && Number(checks[key]) >=
+        (["source_lines", "cyclomatic"].includes(key) ? 1 : 0)
+        && Number(checks[key]) <= 0xffff_ffff)) {
+    throw new EngineProtocolError("invalid measured code checks");
+  }
+}

package/apps/bridge/src/engine/protocol/transport/protocol-types.ts

@@ -49,7 +49,9 @@ export type EngineRepositoryGraph = {
   code_map?: {
     files: Array<{ path: string; language: string | null; line_count: number | null;
       symbols: Array<{ id: string; label: string; kind: string;
-        start_line: number; line_count: number }> }>;
+        start_line: number; line_count: number;
+        metrics?: { measured: boolean; source_lines: number; cyclomatic: number;
+          max_loop_depth: number; callers: number } }> }>;
     externals?: Array<{ id: string; label: string; kind: string }>;
     roads: Array<{ source: string; target: string; relation: string }>;
     total_files: number;

package/apps/bridge/src/engine/protocol/transport/result-parser.ts

@@ -4,6 +4,7 @@ import { parsePolicyResult } from "../engine-policy-protocol";
 import { parseImpactResult } from "../impact/engine-impact-protocol";
 import { parseEngineIdentityResult } from "./identity-result-parser";
 import { parseProjectCatalog } from "./project-catalog-parser";
+import { parseCodeChecks } from "./code-checks";
 import {
   ENGINE_PROTOCOL_VERSION,
   EngineProtocolError,
@@ -186,6 +187,7 @@ function parseCodeMap(value: unknown): void {
       requireBoundedString(symbol.id, "code symbol id", 512);
       requireBoundedString(symbol.label, "code symbol label", 160);
       requireBoundedString(symbol.kind, "code symbol kind", 64);
+      parseCodeChecks(symbol.metrics);
       if (!Number.isSafeInteger(symbol.start_line) || Number(symbol.start_line) < 1
         || !Number.isSafeInteger(symbol.line_count) || Number(symbol.line_count) < 1) invalidResult();
     }

package/apps/bridge/src/engine/runtime/engine-projects.ts

@@ -17,6 +17,7 @@ import type {
 import { RepositoryGraphJobs } from "./repository-graph-jobs";
 import { fitRepositoryGraph } from "./repository-graph/fit";
 import { RepositoryGraphCache } from "./repository-graph/cache";
+import { repositorySourceMap } from "./repository-graph/source-map";
 
 export type LocalProjectBinding = {
   summary: ProjectBindingSummary;
@@ -229,20 +230,7 @@ async function analyzeRepositoryGraph(
       analysisId: graph.analysis_id ?? undefined,
       analysisStatus: graph.analysis_status,
       architectureHypotheses: graph.architecture_hypotheses,
-      codeMap: graph.code_map ? {
-        files: graph.code_map.files.map((file) => ({
-          path: file.path, language: file.language, lineCount: file.line_count,
-          symbols: file.symbols.map((symbol) => ({
-            id: symbol.id, label: symbol.label, kind: symbol.kind,
-            startLine: symbol.start_line, lineCount: symbol.line_count,
-          })),
-        })),
-        externals: graph.code_map.externals ?? [],
-        roads: graph.code_map.roads,
-        totalFiles: graph.code_map.total_files,
-        totalExternals: graph.code_map.total_externals ?? 0,
-        truncated: graph.code_map.truncated,
-      } : undefined,
+      codeMap: repositorySourceMap(graph),
       nodes: graph.nodes,
       relations: graph.relations.map((edge) => ({
         source: edge.source, target: edge.target, relation: edge.relation,

package/apps/bridge/src/engine/runtime/repository-graph/fit.ts

@@ -1,4 +1,5 @@
 import type { ProjectRepositoryGraph } from "../../../../../../packages/protocol/schema";
+import { representativeSourcePaths, canReduceSymbols, sampleSymbols } from "./source-sampling";
 
 type CodeMap = NonNullable<ProjectRepositoryGraph["codeMap"]>;
 type Relation = ProjectRepositoryGraph["relations"][number];
@@ -21,7 +22,7 @@ export function fitRepositoryGraph(
     if (map && map.roads.length > 16
       && Buffer.byteLength(JSON.stringify(map.roads), "utf8") > maxBytes / 3) {
       bounded = { ...bounded, codeMap: trimRoads(map) };
-    } else if (map?.files.some((file) => file.symbols.length > 0)) {
+    } else if (map && canReduceSymbols(map)) {
       bounded = { ...bounded, codeMap: trimSymbols(map) };
     } else if (bounded.relations.length > 8) {
       bounded = { ...bounded, relations: strongestRelations(bounded.relations,
@@ -75,27 +76,31 @@ function roadDegree(map: CodeMap): Map<string, number> {
   return degree;
 }
 
-function rankedFiles(map: CodeMap): CodeMap["files"] {
+function rankedFiles(map: CodeMap, preserveSource = false): CodeMap["files"] {
   const degree = roadDegree(map);
+  const representatives = preserveSource ? representativeSourcePaths(map) : new Set<string>();
   return [...map.files].sort((left, right) =>
-    (degree.get(right.path) ?? 0) - (degree.get(left.path) ?? 0)
+    Number(representatives.has(right.path)) - Number(representatives.has(left.path))
+      || (preserveSource ? Number(right.symbols.length > 0) - Number(left.symbols.length > 0) : 0)
+      || (degree.get(right.path) ?? 0) - (degree.get(left.path) ?? 0)
       || (right.lineCount ?? 0) - (left.lineCount ?? 0)
       || left.path.localeCompare(right.path));
 }
 
 function trimSymbols(map: CodeMap): CodeMap {
   const ranked = rankedFiles(map).filter((file) => file.symbols.length > 0);
-  const keep = new Set(ranked.slice(0, Math.floor(ranked.length / 2)).map((file) => file.path));
+  if (ranked.length <= 16) return { ...map, truncated: true,
+    files: map.files.map(file => ({ ...file, symbols: sampleSymbols(file.symbols) })) };
+  const candidates = [...representativeSourcePaths(map), ...ranked.map(file => file.path)];
+  const keep = new Set([...new Set(candidates)].slice(0, Math.max(16, Math.floor(ranked.length / 2))));
   return { ...map, truncated: true, files: map.files.map((file) => {
     if (!keep.has(file.path)) return { ...file, symbols: [] };
-    if (ranked.length === 1) return { ...file, symbols: file.symbols.slice(0,
-      Math.floor(file.symbols.length / 2)) };
     return file;
   }) };
 }
 
 function trimFiles(map: CodeMap): CodeMap {
-  const files = rankedFiles(map).slice(0, Math.ceil(map.files.length / 2))
+  const files = rankedFiles(map, true).slice(0, Math.ceil(map.files.length / 2))
     .sort((left, right) => left.path.localeCompare(right.path));
   const paths = new Set(files.map((file) => file.path));
   for (const external of map.externals ?? []) paths.add(external.id);

package/apps/bridge/src/engine/runtime/repository-graph/source-map.ts

@@ -0,0 +1,21 @@
+import type { EngineRepositoryGraph } from "../../protocol/engine-protocol";
+import type { ProjectCodeMap } from "../../../../../../packages/protocol/messages/mesh/graph/code-map";
+
+/** Preserve optional source checks without turning absent measurements into zero. */
+export function repositorySourceMap(graph: EngineRepositoryGraph): ProjectCodeMap | undefined {
+  const map = graph.code_map;
+  if (!map) return undefined;
+  return {
+    files: map.files.map(file => ({ path: file.path, language: file.language, lineCount: file.line_count,
+      symbols: file.symbols.map(symbol => ({
+        id: symbol.id, label: symbol.label, kind: symbol.kind, startLine: symbol.start_line, lineCount: symbol.line_count,
+        ...(symbol.metrics?.measured === true ? { metrics: {
+          measured: true as const, sourceLines: symbol.metrics.source_lines, cyclomatic: symbol.metrics.cyclomatic,
+          maxLoopDepth: symbol.metrics.max_loop_depth, callers: symbol.metrics.callers,
+        } } : {}),
+      })),
+    })),
+    externals: map.externals ?? [], roads: map.roads, totalFiles: map.total_files,
+    totalExternals: map.total_externals ?? 0, truncated: map.truncated,
+  };
+}

package/apps/bridge/src/engine/runtime/repository-graph/source-sampling.ts

@@ -0,0 +1,39 @@
+import type { ProjectRepositoryGraph } from "../../../../../../packages/protocol/schema";
+
+type CodeMap = NonNullable<ProjectRepositoryGraph["codeMap"]>;
+type Symbol = CodeMap["files"][number]["symbols"][number];
+
+/** Reserve actual measured checks and a small sample of distinct source kinds. */
+export function representativeSourcePaths(map: CodeMap): Set<string> {
+  const paths = new Set<string>();
+  const measured = map.files.find(file => file.symbols.some(symbol => symbol.metrics?.measured));
+  if (measured) paths.add(measured.path);
+  const kinds = new Set<string>();
+  for (const file of map.files) for (const symbol of file.symbols) {
+    if (kinds.has(symbol.kind) || paths.size >= 8) continue;
+    kinds.add(symbol.kind); paths.add(file.path);
+  }
+  return paths;
+}
+
+export function canReduceSymbols(map: CodeMap): boolean {
+  return map.files.filter(file => file.symbols.length > 0).length > 16
+    || map.files.some(file => file.symbols.length > 1);
+}
+
+export function sampleSymbols(symbols: Symbol[]): Symbol[] {
+  if (symbols.length <= 1) return symbols;
+  const keep = new Set<Symbol>(), kinds = new Set<string>();
+  const limit = Math.max(1, Math.floor(symbols.length / 2));
+  const measured = symbols.find(symbol => symbol.metrics?.measured);
+  if (measured) { keep.add(measured); kinds.add(measured.kind); }
+  for (const symbol of symbols) {
+    if (keep.size >= limit) break;
+    if (!kinds.has(symbol.kind)) { keep.add(symbol); kinds.add(symbol.kind); }
+  }
+  for (const symbol of symbols) {
+    if (keep.size >= limit) break;
+    keep.add(symbol);
+  }
+  return symbols.filter(symbol => keep.has(symbol));
+}

package/apps/bridge/src/install/monitor-helper.ts

@@ -209,13 +209,13 @@ export function installMonitorHelper(): InstallResult {
     const node = resolveMonitorNodeBin();
     return node && !isCursorHelperNode(node)
       ? installLinuxService("monitor", node, join(repoRoot, "bin", "granttap-mcp.mjs"), { forceReload: true })
-      : { status: "manual", detail: "A stable Node.js 20+ installation is required for Linux background sync." };
+      : { status: "manual", detail: "A stable Node.js 22.13.0+ installation is required for Linux background sync." };
   }
   if (process.platform === "win32") {
     const node = resolveMonitorNodeBin();
     return node && !isCursorHelperNode(node)
       ? installWindowsTask("monitor", node, join(repoRoot, "bin", "granttap-mcp.mjs"), true)
-      : { status: "manual", detail: "A stable Node.js 20+ installation is required for Windows background sync." };
+      : { status: "manual", detail: "A stable Node.js 22.13.0+ installation is required for Windows background sync." };
   }
   if (process.platform !== "darwin") {
     return { status: "manual", detail: "background task sync currently requires macOS" };

package/apps/bridge/src/mesh/runtime/graph/README.md

@@ -11,8 +11,10 @@ remote claim. Changed remote identities and local paths to different checkouts
 remain rejected. Neither Task identity nor Project membership is rewritten.
 
 After admission, `graphAnalysisBindings` selects one graph per endpoint and real
-checkout path, preferring an admitted canonical binding over a duplicate local
-alias. Failed bindings remain visible with their original error. Both the Mac
+checkout path, preferring the currently verified canonical binding over retired aliases.
+Observed Git revisions replace old catalog observations in admission and report
+provenance. A subfolder with a remembered parent commit is not a checkout. Each
+computer analyzes only its own endpoint bindings. Failed bindings remain visible with their original error. Both the Mac
 projection and phone refresh use this rule. The graph contains actual Engine
 analysis; unavailable analysis is never synthesized as a successful graph.
 

package/apps/bridge/src/mesh/runtime/graph/analysis.ts

@@ -6,6 +6,8 @@ import { publishedCatalog } from "../../../session-catalog";
 import { meshSnapshot, meshSnapshots } from "..";
 import { refreshLocalGraphBindings } from "./binding-sync";
 import { graphAnalysisBindings } from "./checkout-identity";
+import { computerId } from "../../identity/computer";
+import { repositoryDetails } from "../../repository-details";
 
 /** A person's explicit Graph refresh bypasses background job backoff. */
 type GraphAnalysisDependencies = {
@@ -16,6 +18,8 @@ type GraphAnalysisDependencies = {
   backbone: typeof projectBackbone;
   graphs: typeof projectRepositoryGraphs;
   send: (client: RelayClient, snapshot: MeshSnapshot) => Promise<void>;
+  endpoint?: () => string;
+  details?: (snapshot: MeshSnapshot) => ReturnType<typeof repositoryDetails>;
 };
 
 const graphAnalysisDependencies: GraphAnalysisDependencies = {
@@ -24,6 +28,8 @@ const graphAnalysisDependencies: GraphAnalysisDependencies = {
   sync: refreshLocalGraphBindings,
   backbone: projectBackbone,
   graphs: projectRepositoryGraphs,
+  endpoint: computerId,
+  details: snapshot => repositoryDetails(snapshot, computerId()),
   send: (client, snapshot) => sendMeshPayload(client, snapshot, "phone", {
     ttlMs: 60_000, reliable: true,
   }),
@@ -47,10 +53,13 @@ export async function analyzeProjectGraphNow(
   if (!current) return false;
   const failures = dependencies.sync ? await dependencies.sync(current) : [];
   const rejected = new Set(failures.map(report => report.repositoryId));
-  const [backbone, repositoryGraphs] = await Promise.all([
+  const bindings = graphAnalysisBindings((current.bindings ?? [])
+    .filter(binding => !rejected.has(binding.repositoryId)), dependencies.endpoint?.());
+  if (dependencies.endpoint && !bindings.length && !failures.length && current.bindings?.length) return false;
+  const [backbone, repositoryGraphs, details] = await Promise.all([
     dependencies.backbone(projectId),
-    dependencies.graphs(projectId, graphAnalysisBindings((current.bindings ?? [])
-      .filter(binding => !rejected.has(binding.repositoryId))), { background: false }),
+    dependencies.graphs(projectId, bindings, { background: false }),
+    dependencies.details?.(current),
   ]);
   const observed = [...repositoryGraphs, ...failures];
   const reports = observed.length > 0 ? observed : [{
@@ -63,6 +72,7 @@ export async function analyzeProjectGraphNow(
   for (const id of receipts) {
     await dependencies.send(client, {
       ...current, backbone, repositoryGraphs: reports, generatedAt: Date.now(),
+      ...(details ? { repositoryDetails: details } : {}),
       ...(id ? { graphAnalysisRequestId: id } : {}),
     });
   }

package/apps/bridge/src/mesh/runtime/graph/binding-sync.ts

@@ -44,7 +44,7 @@ export async function refreshLocalGraphBindings(
     }
     try {
       const admitted = await dependencies.sync(snapshot.project, {
-        summary: binding,
+        summary: { ...binding, revision: facts.revision ?? binding.revision },
         localRoot: facts.root,
         // A local binding is scoped by its verified path. Do not relabel it as
         // a remote repository or move it into that repository's Project scope.

package/apps/bridge/src/mesh/runtime/graph/checkout-identity.ts

@@ -1,6 +1,7 @@
 import { realpathSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import type { ProjectBindingSummary } from "../../../../../../packages/protocol/schema";
+import { inspectRepository, type RepositoryFacts } from "../../catalog";
 
 /** Local identities name an exact directory, even after that directory gains an origin. */
 export function matchesLocalCheckout(repositoryId: string, root: string): boolean {
@@ -12,17 +13,39 @@ export function matchesLocalCheckout(repositoryId: string, root: string): boolea
 }
 
 /** Once admitted, one checkout contributes one graph to this Mesh. */
-export function graphAnalysisBindings(bindings: ProjectBindingSummary[]): ProjectBindingSummary[] {
+export function graphAnalysisBindings(bindings: ProjectBindingSummary[], endpointId?: string): ProjectBindingSummary[] {
   const selected = new Map<string, ProjectBindingSummary>();
+  const observations = new Map<string, RepositoryFacts | undefined>();
+  const nonRepositories = new Set<string>();
+  const ranks = new Map<string, number>();
   for (const binding of bindings) {
+    if (endpointId && binding.endpointId !== endpointId) continue;
     let path: string | undefined;
     if (binding.available && binding.localPathHint) {
       try { path = realpathSync(binding.localPathHint); } catch { /* Keep an unavailable checkout distinct. */ }
     }
+    if (path && !observations.has(path)) {
+      let facts: RepositoryFacts | undefined;
+      try {
+        const observed = inspectRepository(path);
+        if (observed.worktree && realpathSync(observed.root) === path) facts = observed;
+        else nonRepositories.add(path);
+      } catch { /* Unavailable roots retain their own identity. */ }
+      observations.set(path, facts);
+    }
+    // A remembered commit from the parent does not make a subfolder a checkout.
+    if (path && nonRepositories.has(path)) continue;
+    const facts = path ? observations.get(path) : undefined;
+    const canonical = facts?.canonicalRepositoryId === binding.repositoryId;
+    const scoped = facts && matchesLocalCheckout(binding.repositoryId, facts.root);
+    const rank = canonical ? 3 : scoped ? 2 : binding.repositoryId.startsWith("local:") ? 0 : 1;
+    const candidate = (canonical || scoped) && facts?.revision
+      ? { ...binding, revision: facts.revision } : binding;
     const key = JSON.stringify([binding.endpointId, path ?? binding.repositoryId]);
     const previous = selected.get(key);
-    if (!previous || (previous.repositoryId.startsWith("local:") && !binding.repositoryId.startsWith("local:"))) {
-      selected.set(key, binding);
+    if (!previous || rank > (ranks.get(key) ?? 0)) {
+      selected.set(key, candidate);
+      ranks.set(key, rank);
     }
   }
   return [...selected.values()];

package/apps/bridge/src/mesh/runtime/snapshot/enriched.ts

@@ -18,7 +18,7 @@ export async function enrichMeshSnapshot(
   const identityFailures = await refreshLocalGraphBindings(snapshot);
   const excludedRepositories = new Set(identityFailures.map((report) => report.repositoryId));
   const bindings = graphAnalysisBindings((snapshot.bindings ?? [])
-    .filter((binding) => !excludedRepositories.has(binding.repositoryId)));
+    .filter((binding) => !excludedRepositories.has(binding.repositoryId)), computerId());
   await waitForProjectBindingSync(snapshot.projectId);
   queueProjectKnowledgeSync({
     projectId: snapshot.projectId,

package/apps/mcp/src/http-service/installer.ts

@@ -4,7 +4,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileS
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { isCursorHelperNode, resolveMonitorNodeBin, type InstallResult } from "../../../bridge/src/install";
-import { configDir, normalizeRelayUrl, loadRuntimeConfig, verifiableEngine } from "../../../bridge/src/config";
+import { configDir, normalizeRelayUrl, loadRuntimeConfig, verifiableEngine, isSupportedNode, minimumNodeVersion } from "../../../bridge/src/config";
 import { installWindowsTask } from "../../../bridge/src/install/windows-service";
 import { installLinuxService } from "../../../bridge/src/install/linux-service";
 import { configuredCursorHttpMcpUrl } from "../cursor-config";
@@ -65,9 +65,8 @@ function validateInstallation(nodeBin: string, executable: string): InstallResul
     return { status: "manual", detail: "Authorization requires a stable granttap-mcp install; npm's temporary _npx cache is not durable." };
   }
   const version = spawnSync(nodeBin, ["--version"], { encoding: "utf8" });
-  const major = Number(/^v(\d+)/.exec(version.stdout.trim())?.[1]);
-  return version.status !== 0 || !Number.isInteger(major) || major < 20
-    ? { status: "manual", detail: `Persistent OAuth requires Node 20+ (${nodeBin}).` }
+  return version.status !== 0 || !isSupportedNode(version.stdout.trim())
+    ? { status: "manual", detail: `Persistent OAuth requires Node ${minimumNodeVersion}+ (${nodeBin}).` }
     : undefined;
 }
 

package/bin/granttap-mcp.mjs

@@ -5,6 +5,13 @@ import { createRequire } from "node:module";
 import { delimiter, dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { isSupportedNode, minimumNodeVersion } from "../apps/bridge/src/config/runtime/node-requirement.mjs";
+
+if (!isSupportedNode(process.versions.node)) {
+  process.stderr.write(`[granttap-mcp] requires Node.js ${minimumNodeVersion} or newer; found ${process.versions.node}. Install the latest supported Node.js LTS release.\n`);
+  process.exit(1);
+}
+
 const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 const [command = "mcp", ...commandArgs] = process.argv.slice(2);
 const argument = commandArgs[0];

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.82
+npm install -g granttap-mcp@0.8.84
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.82\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.84\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.82";
+const PACKAGE = "granttap-mcp@0.8.84";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;
@@ -31,7 +31,7 @@ function launch() {
   const npx = first(roots.map((root) =>
     join(root, "node_modules", "npm", "bin", "npx-cli.js")));
   if (npx) return { command: process.execPath, args: [npx, "-y", PACKAGE] };
-  throw new Error("Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.");
+  throw new Error("Node.js/npm 22.13.0+ is required on this Windows device. Install npm and retry GrantTap.");
 }
 
 let target;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.82",
+  "version": "0.8.84",
   "description": "Commercial computer runtime connecting local coding agents to GrantTap on Mac, iPhone, iPad and Apple Watch.",
   "type": "module",
   "bin": {
@@ -55,7 +55,7 @@
     "typescript": "^5.7.2"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.13.0"
   },
   "repository": {
     "type": "git",

package/packages/protocol/messages/mesh/graph/code-map.ts

@@ -14,6 +14,12 @@ export const ProjectCodeMap = z.object({
       kind: z.string().trim().min(1).max(64),
       startLine: z.number().int().positive(),
       lineCount: z.number().int().positive(),
+      metrics: z.object({
+        measured: z.literal(true), sourceLines: z.number().int().positive().max(0xffff_ffff),
+        cyclomatic: z.number().int().positive().max(0xffff_ffff),
+        maxLoopDepth: z.number().int().nonnegative().max(0xffff_ffff),
+        callers: z.number().int().nonnegative().max(0xffff_ffff),
+      }).strict().optional(),
     }).strict()).max(72),
   }).strict()).max(650),
   externals: z.array(z.object({