granttap-mcp 0.8.9 → 0.8.10

package/apps/bridge/src/bin/setup.ts

@@ -64,9 +64,12 @@ async function main(): Promise<void> {
   const helper = installMonitorHelper();
   let cursorService: InstallResult | null = null;
   let cursorConfig: InstallResult | null = null;
-  if (before.cursor.installed) {
+  const codexInstalled = before.agents.some((item) => item.agent === "codex" && item.installed);
+  if (before.cursor.installed || codexInstalled) {
     cursorService = installHttpMcpService();
-    if (cursorService.status !== "manual") cursorConfig = installCursorHttpConfig();
+    if (before.cursor.installed && cursorService.status !== "manual") {
+      cursorConfig = installCursorHttpConfig();
+    }
   }
   const pairingResult = await pairIfNeeded();
   const paired = isMachineConfigured();
@@ -83,7 +86,8 @@ async function main(): Promise<void> {
     "",
     `Claude Code         ${installed.has("claude") ? state(claudeHook) : "Not installed"}`,
     `Codex               ${installed.has("codex")
-      ? codexHook.status === "manual" ? "Needs attention" : "Needs hook trust"
+      ? codexHook.status === "manual" || cursorService?.status === "manual"
+        ? "Needs attention" : !paired ? "Needs connection" : "Authorize in Codex; review hooks"
       : "Not installed"}`,
     `Cursor              ${before.cursor.installed ? `Beta · ${cursorReady ? "Authorize in Cursor" : "Needs repair"}` : "Not installed"}`,
     `Grok Build          ${installed.has("grok") ? "Ready" : "Not installed"}`,
@@ -92,7 +96,7 @@ async function main(): Promise<void> {
     `Project Governance  ${engine ? "Ready" : "No engine found"}`,
     "",
     paired && installed.has("codex")
-      ? `Next: ${CODEX_TRUST_INSTRUCTION}`
+      ? `Next: authorize GrantTap in Codex, then ${CODEX_TRUST_INSTRUCTION}`
       : paired && before.cursor.installed
         ? "Next: open Cursor Settings → MCP → GrantTap → Authorize."
         : !paired

package/apps/mcp/src/http-server.ts

@@ -72,10 +72,10 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
       }
       const pendingId = String(req.body?.pending_id ?? "");
       if (!provider.getPending(pendingId)) {
-        res.status(400).json({ error: "Authorization request expired. Start Authorize again from Cursor Settings." });
+        res.status(400).json({ error: "Authorization request expired. Start authorization again from your MCP client." });
         return;
       }
-      if (isMachineConfigured()) {
+      if (isMachineConfigured() && req.body?.confirmed !== "true") {
         res.json({ ok: true, alreadyPaired: true });
         return;
       }

package/apps/mcp/src/oauth/consent-page.ts

@@ -39,10 +39,10 @@ function escapeHtml(value: string): string {
     .replaceAll('"', """).replaceAll("'", "'");
 }
 
-function statusCards(paired: boolean): string {
+function statusCards(paired: boolean, clientName: string): string {
   const rows = [
     { id: "phone", label: "iPhone / Apple Watch", status: "action_required", detail: paired ? "Local E2EE keys exist; live phone reachability is not verified on this page." : "Scan the QR or paste the manual token." },
-    { id: "cursor", label: "Cursor", status: "action_required", detail: "Review this local client and approve access below." },
+    { id: "client", label: `${clientName} MCP access`, status: "action_required", detail: "Review this local client and approve access below." },
     ...integrationRows(),
   ];
   return rows.map((row) => {
@@ -51,11 +51,88 @@ function statusCards(paired: boolean): string {
   }).join("");
 }
 
+function reconnectControls(): string {
+  return `<div class="client"><p>Already paired with an iPhone? You can approve this client without a new QR.</p>
+<button type="button" id="reconnect">Pair a different iPhone / show a new QR</button>
+<div id="reconnect-confirm" hidden><p>A new QR replaces the current computer pairing. The previously paired iPhone will stop receiving this computer until it scans the new QR.</p>
+<div class="row"><button type="button" id="cancel-reconnect" class="deny">Cancel</button><button type="button" id="confirm-reconnect" class="approve">Replace pairing and show QR</button></div></div></div>`;
+}
+
+function consentScript(pendingId: string, paired: boolean): string {
+  return `<script>
+const paired = ${paired ? "true" : "false"};
+const status = document.getElementById("status");
+const approve = document.getElementById("approve");
+const qrBox = document.getElementById("qr");
+const manualBox = document.getElementById("manual");
+const manualCode = document.getElementById("manual-code");
+document.getElementById("copy-token").addEventListener("click", async () => {
+  try {
+    await navigator.clipboard.writeText(manualCode.textContent || "");
+    status.textContent = "Manual token copied. It expires after 15 minutes.";
+  } catch {
+    status.textContent = "Select the manual token and copy it.";
+  }
+});
+async function ensurePairing(confirmed = false) {
+  if (paired && !confirmed) return;
+  const body = new URLSearchParams({ pending_id: ${JSON.stringify(pendingId)} });
+  if (confirmed) body.set("confirmed", "true");
+  try {
+    const response = await fetch("/oauth/pairing", { method: "POST", body });
+    const data = await response.json();
+    if (!response.ok) {
+      status.textContent = data.error || "Pairing failed.";
+      return;
+    }
+    if (data.alreadyPaired) {
+      status.textContent = "Local pairing found. Approve this client or check phone reachability with a live request.";
+      approve.disabled = false;
+      return;
+    }
+    const image = document.createElement("img");
+    image.alt = "GrantTap pairing QR";
+    image.src = data.qrDataUrl;
+    qrBox.replaceChildren(image);
+    qrBox.style.display = "block";
+    manualCode.textContent = data.manualToken;
+    manualBox.style.display = "block";
+    for (const provider of data.providers || []) {
+      const chip = document.getElementById("status-" + provider.id);
+      if (!chip) continue;
+      chip.textContent = provider.status === "connected" ? "Connected" : "Action required";
+      chip.className = "chip " + provider.status;
+    }
+    status.textContent = "Scan with GrantTap on iPhone, then Approve.";
+    approve.disabled = false;
+  } catch {
+    status.textContent = "Could not reach the local GrantTap service. Try again.";
+  }
+}
+const reconnect = document.getElementById("reconnect");
+if (reconnect) {
+  const confirmation = document.getElementById("reconnect-confirm");
+  reconnect.addEventListener("click", () => { confirmation.hidden = false; });
+  document.getElementById("cancel-reconnect").addEventListener("click", () => {
+    confirmation.hidden = true;
+  });
+  document.getElementById("confirm-reconnect").addEventListener("click", async () => {
+    confirmation.hidden = true;
+    reconnect.disabled = true;
+    status.textContent = "Creating a new one-time pairing QR…";
+    await ensurePairing(true);
+    reconnect.disabled = false;
+  });
+}
+void ensurePairing();
+</script>`;
+}
+
 export function consentHtml(opts: ConsentOptions): string {
   const { pendingId, paired, clientName, redirectUri, scopes, resource } = opts;
   return `<!DOCTYPE html>
 <html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Authorize GrantTap</title>
 <style>:root{color-scheme:light dark;font-family:ui-sans-serif,system-ui,sans-serif}body{margin:0;min-height:100vh;display:grid;place-items:center;background:#0f1419;color:#e8eef4}main{width:min(520px,92vw);padding:28px;border-radius:16px;background:#1a222c;box-shadow:0 16px 48px #0008}h1{font-size:1.25rem;margin:0 0 8px}p{margin:0 0 16px;line-height:1.45;color:#b7c4d2;font-size:.95rem}#qr{display:none;margin:0 auto 16px;width:240px;height:240px;background:#fff;border-radius:12px;padding:10px;box-sizing:border-box}#qr img{width:100%;height:100%;object-fit:contain}.client{padding:12px;border:1px solid #334151;border-radius:10px;background:#121920;margin-bottom:16px}.client strong,.client code{display:block;overflow-wrap:anywhere}.client code{margin-top:4px;color:#9fb0c0;font-size:.75rem}.providers{display:grid;gap:8px;margin:0 0 18px}.provider{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;padding:10px 12px;border:1px solid #334151;border-radius:10px}.provider strong,.provider small{display:block}.provider small{margin-top:3px;color:#8fa3b8}.chip{flex:none;padding:4px 7px;border:1px solid;border-radius:999px;font-size:.65rem;font-weight:750;text-transform:uppercase}.connected{color:#68d39c;border-color:#68d39c66}.action_required{color:#f0bb7b;border-color:#f0bb7b66}.not_configured{color:#8fa3b8;border-color:#8fa3b866}#manual{display:none;margin:0 0 16px;padding:12px;border:1px solid #334151;border-radius:10px}#manual code{display:block;margin:7px 0;padding:8px;overflow-wrap:anywhere;background:#0c1117;border-radius:7px;user-select:all}.row{display:flex;gap:10px}button{flex:1;border:0;border-radius:10px;padding:12px 14px;font-weight:600;cursor:pointer}.approve{background:#3d8bfd;color:#fff}.deny{background:#2a3440;color:#d7e0ea}.status{font-size:.85rem;color:#8fa3b8;min-height:1.2em}</style></head>
-<body><main><h1>Authorize ${escapeHtml(clientName)} → GrantTap</h1><p>Grant this local MCP client access to GrantTap tools on this Mac. E2EE keys stay local in <code>~/.granttap</code>.</p><div class="client"><strong>Requesting client: ${escapeHtml(clientName)}</strong><code>Permission: ${escapeHtml(scopes.join(" "))}</code><code>Resource: ${escapeHtml(resource)}</code><code>Redirect: ${escapeHtml(redirectUri)}</code></div><div class="providers">${statusCards(paired)}</div><div id="qr"></div><div id="manual"><strong>Camera unavailable?</strong><span> Paste this one-time token in the GrantTap app:</span><code id="manual-code"></code><button type="button" id="copy-token">Copy token</button></div><p class="status" id="status">${paired ? "Local pairing keys found; phone reachability is not verified here." : "Creating a pairing QR…"}</p><p>Approve grants this MCP client local tool access. It does not prove that the phone has scanned the pairing code.</p><form id="form" method="POST" action="/consent" class="row"><input type="hidden" name="pending_id" value="${pendingId}" /><button class="deny" type="submit" name="decision" value="deny">Deny</button><button class="approve" type="submit" name="decision" value="approve" id="approve" ${paired ? "" : "disabled"}>Approve</button></form></main>
-<script>const paired=${paired ? "true" : "false"};const status=document.getElementById("status");const approve=document.getElementById("approve");const qrBox=document.getElementById("qr");const manualBox=document.getElementById("manual");const manualCode=document.getElementById("manual-code");const copyToken=document.getElementById("copy-token");copyToken.addEventListener("click",async()=>{try{await navigator.clipboard.writeText(manualCode.textContent||"");status.textContent="Manual token copied. It expires after 15 minutes."}catch{status.textContent="Select the manual token and copy it."}});async function ensurePairing(){if(paired)return;const body=new URLSearchParams({pending_id:${JSON.stringify(pendingId)}});const res=await fetch("/oauth/pairing",{method:"POST",body});const data=await res.json();if(!res.ok){status.textContent=data.error||"Pairing failed";return}if(data.alreadyPaired){status.textContent="Local pairing keys found. Review the client and Approve; verify the phone with a live request.";approve.disabled=false;return}qrBox.style.display="block";qrBox.innerHTML='<img alt="GrantTap pairing QR" src="'+data.qrDataUrl+'" />';manualCode.textContent=data.manualToken;manualBox.style.display="block";for(const provider of data.providers||[]){const chip=document.getElementById("status-"+provider.id);if(!chip)continue;chip.textContent=provider.status==="connected"?"Connected":"Action required";chip.className="chip "+provider.status}status.textContent="Scan with GrantTap on iPhone, then Approve.";approve.disabled=false}ensurePairing().catch((err)=>{status.textContent=String(err)});</script></body></html>`;
+<body><main><h1>Authorize ${escapeHtml(clientName)} → GrantTap</h1><p>Grant this local MCP client access to GrantTap tools on this Mac. E2EE keys stay local in <code>~/.granttap</code>.</p><div class="client"><strong>Requesting client: ${escapeHtml(clientName)}</strong><code>Permission: ${escapeHtml(scopes.join(" "))}</code><code>Resource: ${escapeHtml(resource)}</code><code>Redirect: ${escapeHtml(redirectUri)}</code></div><div class="providers">${statusCards(paired, clientName)}</div>${paired ? reconnectControls() : ""}<div id="qr"></div><div id="manual"><strong>Camera unavailable?</strong><span> Paste this one-time token in the GrantTap app:</span><code id="manual-code"></code><button type="button" id="copy-token">Copy token</button></div><p class="status" id="status">${paired ? "Local pairing keys found; phone reachability is not verified here." : "Creating a pairing QR…"}</p><p>Approve grants this MCP client local tool access. It does not prove that the phone has scanned the pairing code.</p><form id="form" method="POST" action="/consent" class="row"><input type="hidden" name="pending_id" value="${pendingId}" /><button class="deny" type="submit" name="decision" value="deny">Deny</button><button class="approve" type="submit" name="decision" value="approve" id="approve" ${paired ? "" : "disabled"}>Approve</button></form></main>
+${consentScript(pendingId, paired)}</body></html>`;
 }

package/apps/mcp/src/oauth-provider.ts

@@ -1,7 +1,7 @@
 /**
- * Loopback OAuth 2.1 provider for Cursor Settings → Authorize.
+ * Loopback OAuth 2.1 provider for Codex and Cursor MCP authorization.
  *
- * Authorize means: confirm this Mac's GrantTap pairing for Cursor (issue a
+ * Authorize means: confirm this Mac's GrantTap pairing for a client (issue a
  * bearer token). E2EE keys stay in ~/.granttap — OAuth does not replace pair.
  */
 import { randomUUID } from "node:crypto";
@@ -104,10 +104,10 @@ export class GrantTapOAuthProvider implements OAuthServerProvider {
     }));
   }
 
-  /** Complete consent: issue code and redirect to Cursor. */
+  /** Complete consent: issue code and redirect to the requesting MCP client. */
   completeConsent(pendingId: string, approve: boolean): { redirectUrl: string } {
     const pending = this.getPending(pendingId);
-    if (!pending) throw new Error("Authorization request expired. Start Authorize again from Cursor Settings.");
+    if (!pending) throw new Error("Authorization request expired. Start authorization again from your MCP client.");
 
     const target = new URL(pending.params.redirectUri);
     if (!approve) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {