granttap-mcp 0.8.9 → 0.8.11

package/apps/bridge/src/bin/setup.ts

@@ -62,18 +62,21 @@ async function main(): Promise<void> {
     engineFlag >= 0 ? process.argv[engineFlag + 1] : undefined,
   );
   const helper = installMonitorHelper();
-  let cursorService: InstallResult | null = null;
+  let httpService: InstallResult | null = null;
   let cursorConfig: InstallResult | null = null;
-  if (before.cursor.installed) {
-    cursorService = installHttpMcpService();
-    if (cursorService.status !== "manual") cursorConfig = installCursorHttpConfig();
+  const mcpClientInstalled = before.agents.some((item) => item.installed);
+  if (before.cursor.installed || mcpClientInstalled) {
+    httpService = installHttpMcpService();
+    if (before.cursor.installed && httpService.status !== "manual") {
+      cursorConfig = installCursorHttpConfig();
+    }
   }
   const pairingResult = await pairIfNeeded();
   const paired = isMachineConfigured();
   const installed = new Set(before.agents.filter((item) => item.installed).map((item) => item.agent));
   const cursorReady = cursorHook.status !== "manual"
     && (!before.cursor.installed
-      || (cursorService?.status !== "manual" && cursorConfig?.status !== "manual"));
+      || (httpService?.status !== "manual" && cursorConfig?.status !== "manual"));
 
   process.stdout.write([
     "GrantTap",
@@ -81,18 +84,23 @@ async function main(): Promise<void> {
     `Phone pairing       ${paired ? "Ready" : pairingResult === "failed" ? "Relay unavailable" : "Needs connection"}`,
     `Background helper   ${state(helper)}`,
     "",
-    `Claude Code         ${installed.has("claude") ? state(claudeHook) : "Not installed"}`,
+    `Claude Code         ${installed.has("claude")
+      ? claudeHook.status === "manual" || httpService?.status === "manual"
+        ? "Needs attention" : "Authorize in Claude Code" : "Not installed"}`,
     `Codex               ${installed.has("codex")
-      ? codexHook.status === "manual" ? "Needs attention" : "Needs hook trust"
+      ? codexHook.status === "manual" || httpService?.status === "manual"
+        ? "Needs attention" : !paired ? "Needs connection" : "Authorize in Codex; review hooks"
       : "Not installed"}`,
     `Cursor              ${before.cursor.installed ? `Beta · ${cursorReady ? "Authorize in Cursor" : "Needs repair"}` : "Not installed"}`,
-    `Grok Build          ${installed.has("grok") ? "Ready" : "Not installed"}`,
+    `Grok Build          ${installed.has("grok")
+      ? httpService?.status === "manual" ? "Needs attention" : "Authorize in Grok Build"
+      : "Not installed"}`,
     // Governance is edited on the phone but cannot report until an engine is
     // declared here, so say plainly which of the two is missing.
     `Project Governance  ${engine ? "Ready" : "No engine found"}`,
     "",
     paired && installed.has("codex")
-      ? `Next: ${CODEX_TRUST_INSTRUCTION}`
+      ? `Next: authorize GrantTap in Codex, then ${CODEX_TRUST_INSTRUCTION}`
       : paired && before.cursor.installed
         ? "Next: open Cursor Settings → MCP → GrantTap → Authorize."
         : !paired

package/apps/mcp/src/bin/authorize.ts

@@ -72,7 +72,7 @@ async function authorize(): Promise<void> {
         `[granttap-mcp] Persistent local OAuth is healthy at ${mcpUrl}`,
         `[granttap-mcp] LaunchAgent: ${service.status} (${service.detail})`,
         "[granttap-mcp] Open Cursor Settings → MCP → GrantTap → Authorize.",
-        "[granttap-mcp] If this Mac is not paired, the consent page shows a QR and manual token.",
+        "[granttap-mcp] If this Mac is not paired, granttap.com/connect shows a QR and manual token.",
         "",
       ].join("\n"),
     );

package/apps/mcp/src/connection-center/widget.html

@@ -37,7 +37,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
     Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npx -y granttap-mcp@0.8.9 setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.11</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·
@@ -47,4 +47,4 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
 </main>
 <script type="module">{{SCRIPT}}</script>
 </body>
-</html>
+</html>

package/apps/mcp/src/http-server.ts

@@ -1,7 +1,7 @@
 /**
- * GrantTap MCP over Streamable HTTP + loopback OAuth.
+ * GrantTap MCP over Streamable HTTP + loopback OAuth with website consent.
  *
- * This is what Cursor Settings needs for the Authorize button (stdio cannot show it).
+ * Codex, Claude Code, Cursor and Grok Build can discover this OAuth endpoint.
  * Bind is loopback-only. Pairing keys remain in ~/.granttap.
  */
 import { randomUUID } from "node:crypto";
@@ -16,6 +16,7 @@ import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import express from "express";
 import QRCode from "qrcode";
 import { createOneTimePairing, DEFAULT_RELAY } from "../../bridge/src/pairing";
+import { inspectAgentIntegrations } from "../../bridge/src/install";
 import { createGrantTapServer, relay, resetRelay } from "./create-server";
 import { isAllowedLoopbackOrigin } from "./oauth/loopback-origin";
 import { GrantTapOAuthProvider } from "./oauth-provider";
@@ -62,6 +63,48 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
     serviceDocumentationUrl: new URL("https://granttap.com"),
   }));
 
+  // The public website is the only browser origin allowed to read a pending
+  // authorization. The random pending id lives in the website URL fragment,
+  // never in a request to the website server.
+  app.use(["/oauth/session", "/oauth/pairing", "/oauth/decision"], (req, res, next) => {
+    const origin = req.get("origin");
+    if (origin && origin !== "https://granttap.com"
+        && !isAllowedLoopbackOrigin(origin, issuerUrl.origin)) {
+      res.status(403).json({ error: "Origin is not allowed." });
+      return;
+    }
+    if (origin === "https://granttap.com") {
+      res.set({
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type",
+        "Access-Control-Allow-Private-Network": "true",
+        "Vary": "Origin, Access-Control-Request-Private-Network",
+      });
+    }
+    if (req.method === "OPTIONS") {
+      res.status(204).end();
+      return;
+    }
+    next();
+  });
+
+  app.get("/oauth/session", (req, res) => {
+    res.set("Cache-Control", "no-store");
+    const pending = provider.getPending(String(req.query.pending_id ?? ""));
+    if (!pending) {
+      res.status(404).json({ error: "This connection request expired. Start again in your coding app." });
+      return;
+    }
+    res.json({
+      clientName: pending.client.client_name?.trim().slice(0, 80) || "Coding app",
+      paired: isMachineConfigured(),
+      providers: inspectAgentIntegrations()
+        .filter((item) => ["codex", "claude", "cursor"].includes(item.agent))
+        .map((item) => ({ id: item.agent, installed: item.installed, ready: item.hookConfigured })),
+    });
+  });
+
   app.post("/oauth/pairing", async (req, res) => {
     res.set("Cache-Control", "no-store");
     try {
@@ -72,10 +115,10 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
       }
       const pendingId = String(req.body?.pending_id ?? "");
       if (!provider.getPending(pendingId)) {
-        res.status(400).json({ error: "Authorization request expired. Start Authorize again from Cursor Settings." });
+        res.status(400).json({ error: "Authorization request expired. Start authorization again from your MCP client." });
         return;
       }
-      if (isMachineConfigured()) {
+      if (isMachineConfigured() && req.body?.confirmed !== "true") {
         res.json({ ok: true, alreadyPaired: true });
         return;
       }
@@ -115,6 +158,28 @@ export async function startHttpMcpServer(options: ServeOptions = {}): Promise<{
     }
   });
 
+  app.post("/oauth/decision", (req, res) => {
+    res.set("Cache-Control", "no-store");
+    if (req.get("origin") !== "https://granttap.com") {
+      res.status(403).json({ error: "Origin is not allowed." });
+      return;
+    }
+    try {
+      const pendingId = String(req.body?.pending_id ?? "");
+      const decision = String(req.body?.decision ?? "");
+      if (decision !== "approve" && decision !== "deny") {
+        res.status(400).json({ error: "Choose Approve or Deny." });
+        return;
+      }
+      const { redirectUrl } = provider.completeConsent(pendingId, decision === "approve");
+      res.json({ redirectUrl });
+    } catch (error) {
+      res.status(400).json({
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  });
+
   app.post("/consent", (req, res) => {
     res.set("Cache-Control", "no-store");
     try {

package/apps/mcp/src/http-service/installer.ts

@@ -27,7 +27,7 @@ export function installHttpMcpService(options: { forceReload?: boolean } = {}):
 }
 
 function macosOnly(): InstallResult {
-  return { status: "manual", detail: "persistent Cursor OAuth currently requires macOS" };
+  return { status: "manual", detail: "Persistent GrantTap MCP authorization currently requires macOS" };
 }
 
 function configuredMcpUrl(): URL | Error {
@@ -42,13 +42,13 @@ function safeNodeBin(): string | Error {
   const nodeBin = resolveMonitorNodeBin();
   return nodeBin && !isCursorHelperNode(nodeBin)
     ? nodeBin
-    : new Error("No safe absolute Node binary is available; refusing Cursor's short-lived helper node.");
+    : new Error("No safe absolute Node binary is available for the persistent GrantTap service.");
 }
 
 function validateInstallation(nodeBin: string, executable: string): InstallResult | undefined {
   if (!existsSync(executable)) return { status: "manual", detail: `Installed launcher is missing at ${executable}` };
   if (packageRoot.includes("/.npm/_npx/")) {
-    return { status: "manual", detail: "Authorize requires a stable granttap-mcp install; npm's temporary _npx cache is not durable." };
+    return { status: "manual", detail: "Authorization requires a stable granttap-mcp install; npm's temporary _npx cache is not durable." };
   }
   const version = spawnSync(nodeBin, ["--version"], { encoding: "utf8" });
   const major = Number(/^v(\d+)/.exec(version.stdout.trim())?.[1]);

package/apps/mcp/src/oauth/README.md

@@ -1,5 +1,5 @@
 # OAuth
 
-This module owns local Cursor OAuth client persistence, consent rendering, and token issuance. It never replaces the encrypted GrantTap pairing stored by the bridge.
+This module owns local MCP OAuth client persistence and token issuance. The OAuth authorization endpoint immediately redirects to `https://granttap.com/connect`; the website reads a short-lived request through the loopback helper, while pairing keys remain on the computer and phone. The local service never renders a user-facing consent page.
 
 License: this module is distributed under the GrantTap Commercial Source License in the repository-root `LICENSE` file.

package/apps/mcp/src/oauth/loopback-origin.ts

@@ -9,6 +9,7 @@ export function isAllowedLoopbackOrigin(
 ): boolean {
   if (!origin) return true;
   if (origin === issuerOrigin) return true;
+  if (origin === "https://granttap.com") return true;
   const lower = origin.toLowerCase();
   return lower.startsWith("vscode-webview:")
     || lower.startsWith("cursor:")

package/apps/mcp/src/oauth-provider.ts

@@ -1,7 +1,7 @@
 /**
- * Loopback OAuth 2.1 provider for Cursor Settings → Authorize.
+ * Loopback OAuth 2.1 provider for Codex and Cursor MCP authorization.
  *
- * Authorize means: confirm this Mac's GrantTap pairing for Cursor (issue a
+ * Authorize means: confirm this Mac's GrantTap pairing for a client (issue a
  * bearer token). E2EE keys stay in ~/.granttap — OAuth does not replace pair.
  */
 import { randomUUID } from "node:crypto";
@@ -22,7 +22,6 @@ import type {
   OAuthTokens,
 } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { isMachineConfigured } from "./pairing-status";
-import { consentHtml } from "./oauth/consent-page";
 import { GrantTapClientsStore, loadOAuthStore, saveOAuthStore } from "./oauth/store";
 
 type PendingAuth = {
@@ -48,7 +47,7 @@ export class GrantTapOAuthProvider implements OAuthServerProvider {
 
   constructor(private readonly expectedResource?: string) {}
 
-  /** Begin auth: stash params and return a pending id for the consent page. */
+  /** Begin auth: stash params; the website reads only the opaque request id. */
   createPending(client: OAuthClientInformationFull, params: AuthorizationParams): string {
     this.gcPending();
     const id = randomUUID();
@@ -86,28 +85,21 @@ export class GrantTapOAuthProvider implements OAuthServerProvider {
       resource: this.expectedResource ? new URL(this.expectedResource) : params.resource,
     };
     const pendingId = this.createPending(client, normalizedParams);
-    const paired = isMachineConfigured();
     res.set({
       "Cache-Control": "no-store",
-      "Content-Security-Policy": "frame-ancestors 'none'; base-uri 'none'; form-action 'self'",
       "Referrer-Policy": "no-referrer",
-      "X-Frame-Options": "DENY",
       "X-Content-Type-Options": "nosniff",
     });
-    res.status(200).type("html").send(consentHtml({
-      pendingId,
-      paired,
-      clientName: client.client_name?.trim() || "Unknown local MCP client",
-      redirectUri: normalizedParams.redirectUri,
-      scopes: normalizedParams.scopes ?? [],
-      resource: normalizedParams.resource?.href ?? "local GrantTap MCP",
-    }));
+    const website = new URL("https://granttap.com/connect");
+    const resource = new URL(this.expectedResource ?? normalizedParams.resource!.href);
+    website.hash = new URLSearchParams({ request: pendingId, port: resource.port }).toString();
+    res.redirect(302, website.href);
   }
 
-  /** Complete consent: issue code and redirect to Cursor. */
+  /** Complete consent: issue code and redirect to the requesting MCP client. */
   completeConsent(pendingId: string, approve: boolean): { redirectUrl: string } {
     const pending = this.getPending(pendingId);
-    if (!pending) throw new Error("Authorization request expired. Start Authorize again from Cursor Settings.");
+    if (!pending) throw new Error("Authorization request expired. Start authorization again from your MCP client.");
 
     const target = new URL(pending.params.redirectUri);
     if (!approve) {

package/cursor-plugin/README.md

@@ -21,16 +21,16 @@ The commands have separate jobs:
 1. `granttap setup` detects Cursor, installs and verifies the persistent loopback OAuth/MCP
    service, then writes only GrantTap's entry in `~/.cursor/mcp.json`.
 2. `granttap connect` displays a one-time QR and a short manual code for pairing
-   the iPhone or iPad app. If Cursor's consent page already completed pairing,
+   the iPhone or iPad app. If the website already completed pairing,
    this command is not needed again.
 3. `granttap setup` installs the Cursor, Claude Code, and Codex policy hooks and
    the background task-sync helper. OAuth remains a separate authorization.
 4. `granttap status` performs a read-only readiness check.
 
 After `granttap setup`, open **Cursor Settings → MCP → GrantTap** and choose
-**Authorize**. The local consent page confirms access to this Mac's GrantTap
-pairing. If the Mac is not paired, it offers the same one-time QR and manual-code
-fallback as the CLI.
+**Authorize**. The browser opens granttap.com/connect to authorize Cursor.
+If the Mac is not paired, the website shows a one-time QR and manual-code
+fallback; a saved pairing is reused unless you explicitly confirm reconnect.
 
 The OAuth service listens only at `http://127.0.0.1:17342/mcp`. Cursor cannot
 show **Authorize** for a stdio (`command`/`args`) MCP entry, so do not replace the

package/cursor-plugin/skills/connect/SKILL.md

@@ -46,8 +46,8 @@ granttap connect
 ```
 
 Show the resulting one-time QR in chat. Preserve the short manual code as a
-fallback when the camera or QR rendering is unavailable. The local OAuth
-consent page can offer the same pairing choices when Authorize starts first.
+fallback when the camera or QR rendering is unavailable. When Authorize starts
+first, `granttap.com/connect` offers the same pairing choices.
 
 ### 3. Install policy hooks
 

package/docs/cursor-authorize.md

@@ -9,7 +9,7 @@ granttap setup
 When Cursor is installed, setup preserves unrelated MCP entries, installs the
 GrantTap shell and MCP policy hooks, configures the loopback HTTP MCP endpoint,
 and installs its persistent per-user service. Then open **Cursor Settings → MCP
-→ GrantTap → Authorize** to complete Cursor's browser consent.
+→ GrantTap → Authorize** to complete authorization on granttap.com.
 
 The service binds only to loopback. Its OAuth token does not replace GrantTap's
 end-to-end encrypted computer pairing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/apps/mcp/src/oauth/consent-page.ts

@@ -1,61 +0,0 @@
-import { inspectAgentIntegrations } from "../../../bridge/src/install";
-
-type ConsentOptions = {
-  pendingId: string;
-  paired: boolean;
-  clientName: string;
-  redirectUri: string;
-  scopes: string[];
-  resource: string;
-};
-
-type IntegrationRow = {
-  id: "claude" | "codex";
-  label: string;
-  status: "connected" | "action_required" | "not_configured";
-  detail: string;
-};
-
-function integrationRows(): IntegrationRow[] {
-  return inspectAgentIntegrations()
-    .filter((integration): integration is typeof integration & { agent: "claude" | "codex" } =>
-      integration.agent === "claude" || integration.agent === "codex")
-    .map((integration) => ({
-    id: integration.agent,
-    label: integration.agent === "claude" ? "Claude Code" : "Codex",
-    status: integration.agent === "codex" && integration.hookConfigured
-      ? "action_required"
-      : integration.hookConfigured ? "connected" : integration.installed ? "action_required" : "not_configured",
-    detail: integration.agent === "codex" && integration.hookConfigured
-      ? "Both hooks installed. Open /hooks, review and trust both GrantTap hooks, then restart Codex."
-      : integration.hookConfigured ? "Approval hook installed."
-      : integration.installed ? "Run granttap setup to install the approval hook."
-      : "Agent was not found on this Mac.",
-    }));
-}
-
-function escapeHtml(value: string): string {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-
-function statusCards(paired: boolean): string {
-  const rows = [
-    { id: "phone", label: "iPhone / Apple Watch", status: "action_required", detail: paired ? "Local E2EE keys exist; live phone reachability is not verified on this page." : "Scan the QR or paste the manual token." },
-    { id: "cursor", label: "Cursor", status: "action_required", detail: "Review this local client and approve access below." },
-    ...integrationRows(),
-  ];
-  return rows.map((row) => {
-    const label = row.status === "connected" ? "Connected" : row.status === "action_required" ? "Action required" : "Not configured";
-    return `<div class="provider"><div><strong>${escapeHtml(row.label)}</strong><small>${escapeHtml(row.detail)}</small></div><span id="status-${row.id}" class="chip ${row.status}">${label}</span></div>`;
-  }).join("");
-}
-
-export function consentHtml(opts: ConsentOptions): string {
-  const { pendingId, paired, clientName, redirectUri, scopes, resource } = opts;
-  return `<!DOCTYPE html>
-<html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Authorize GrantTap</title>
-<style>:root{color-scheme:light dark;font-family:ui-sans-serif,system-ui,sans-serif}body{margin:0;min-height:100vh;display:grid;place-items:center;background:#0f1419;color:#e8eef4}main{width:min(520px,92vw);padding:28px;border-radius:16px;background:#1a222c;box-shadow:0 16px 48px #0008}h1{font-size:1.25rem;margin:0 0 8px}p{margin:0 0 16px;line-height:1.45;color:#b7c4d2;font-size:.95rem}#qr{display:none;margin:0 auto 16px;width:240px;height:240px;background:#fff;border-radius:12px;padding:10px;box-sizing:border-box}#qr img{width:100%;height:100%;object-fit:contain}.client{padding:12px;border:1px solid #334151;border-radius:10px;background:#121920;margin-bottom:16px}.client strong,.client code{display:block;overflow-wrap:anywhere}.client code{margin-top:4px;color:#9fb0c0;font-size:.75rem}.providers{display:grid;gap:8px;margin:0 0 18px}.provider{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;padding:10px 12px;border:1px solid #334151;border-radius:10px}.provider strong,.provider small{display:block}.provider small{margin-top:3px;color:#8fa3b8}.chip{flex:none;padding:4px 7px;border:1px solid;border-radius:999px;font-size:.65rem;font-weight:750;text-transform:uppercase}.connected{color:#68d39c;border-color:#68d39c66}.action_required{color:#f0bb7b;border-color:#f0bb7b66}.not_configured{color:#8fa3b8;border-color:#8fa3b866}#manual{display:none;margin:0 0 16px;padding:12px;border:1px solid #334151;border-radius:10px}#manual code{display:block;margin:7px 0;padding:8px;overflow-wrap:anywhere;background:#0c1117;border-radius:7px;user-select:all}.row{display:flex;gap:10px}button{flex:1;border:0;border-radius:10px;padding:12px 14px;font-weight:600;cursor:pointer}.approve{background:#3d8bfd;color:#fff}.deny{background:#2a3440;color:#d7e0ea}.status{font-size:.85rem;color:#8fa3b8;min-height:1.2em}</style></head>
-<body><main><h1>Authorize ${escapeHtml(clientName)} → GrantTap</h1><p>Grant this local MCP client access to GrantTap tools on this Mac. E2EE keys stay local in <code>~/.granttap</code>.</p><div class="client"><strong>Requesting client: ${escapeHtml(clientName)}</strong><code>Permission: ${escapeHtml(scopes.join(" "))}</code><code>Resource: ${escapeHtml(resource)}</code><code>Redirect: ${escapeHtml(redirectUri)}</code></div><div class="providers">${statusCards(paired)}</div><div id="qr"></div><div id="manual"><strong>Camera unavailable?</strong><span> Paste this one-time token in the GrantTap app:</span><code id="manual-code"></code><button type="button" id="copy-token">Copy token</button></div><p class="status" id="status">${paired ? "Local pairing keys found; phone reachability is not verified here." : "Creating a pairing QR…"}</p><p>Approve grants this MCP client local tool access. It does not prove that the phone has scanned the pairing code.</p><form id="form" method="POST" action="/consent" class="row"><input type="hidden" name="pending_id" value="${pendingId}" /><button class="deny" type="submit" name="decision" value="deny">Deny</button><button class="approve" type="submit" name="decision" value="approve" id="approve" ${paired ? "" : "disabled"}>Approve</button></form></main>
-<script>const paired=${paired ? "true" : "false"};const status=document.getElementById("status");const approve=document.getElementById("approve");const qrBox=document.getElementById("qr");const manualBox=document.getElementById("manual");const manualCode=document.getElementById("manual-code");const copyToken=document.getElementById("copy-token");copyToken.addEventListener("click",async()=>{try{await navigator.clipboard.writeText(manualCode.textContent||"");status.textContent="Manual token copied. It expires after 15 minutes."}catch{status.textContent="Select the manual token and copy it."}});async function ensurePairing(){if(paired)return;const body=new URLSearchParams({pending_id:${JSON.stringify(pendingId)}});const res=await fetch("/oauth/pairing",{method:"POST",body});const data=await res.json();if(!res.ok){status.textContent=data.error||"Pairing failed";return}if(data.alreadyPaired){status.textContent="Local pairing keys found. Review the client and Approve; verify the phone with a live request.";approve.disabled=false;return}qrBox.style.display="block";qrBox.innerHTML='<img alt="GrantTap pairing QR" src="'+data.qrDataUrl+'" />';manualCode.textContent=data.manualToken;manualBox.style.display="block";for(const provider of data.providers||[]){const chip=document.getElementById("status-"+provider.id);if(!chip)continue;chip.textContent=provider.status==="connected"?"Connected":"Action required";chip.className="chip "+provider.status}status.textContent="Scan with GrantTap on iPhone, then Approve.";approve.disabled=false}ensurePairing().catch((err)=>{status.textContent=String(err)});</script></body></html>`;
-}