@1presence/bridge 0.1.11 → 0.1.13

package/dist/auth.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureFreshToken = ensureFreshToken;
 exports.getValidAuth = getValidAuth;
 exports.refreshAuth = refreshAuth;
 exports.clearAuth = clearAuth;
@@ -45,7 +46,7 @@ function loadCachedAuth() {
         const data = JSON.parse(raw);
         if (!data.token || !isTokenValid(data.token))
             return null;
-        return { token: data.token, uid: data.uid, email: data.email };
+        return { token: data.token, uid: data.uid, email: data.email, refreshToken: data.refreshToken };
     }
     catch {
         return null;
@@ -88,7 +89,7 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
             req.on('data', (chunk) => { body += chunk.toString(); });
             req.on('end', () => {
                 try {
-                    const { token } = JSON.parse(body);
+                    const { token, refreshToken } = JSON.parse(body);
                     if (!token) {
                         res.writeHead(400);
                         res.end();
@@ -103,7 +104,7 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
                         reject(new Error('Invalid token — missing uid'));
                         return;
                     }
-                    resolve({ token, uid, email });
+                    resolve({ token, uid, email, refreshToken: refreshToken ?? undefined });
                 }
                 catch (err) {
                     res.writeHead(400);
@@ -125,6 +126,35 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
         }, 5 * 60 * 1000);
     });
 }
+// ─── Token refresh ────────────────────────────────────────────────────────────
+// Firebase web API key — public, safe to embed
+const FIREBASE_API_KEY = 'AIzaSyAz16A3eRIMhdLGF9ptsVsWZx9LjKeZwi8';
+async function refreshIdToken(refreshToken) {
+    const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshToken }),
+    });
+    if (!res.ok)
+        throw new Error(`Token refresh failed: ${res.status}`);
+    const data = await res.json();
+    if (!data.id_token)
+        throw new Error('Token refresh returned no id_token');
+    return data.id_token;
+}
+/** Returns auth with a fresh ID token. Refreshes if <10 minutes remain. */
+async function ensureFreshToken(auth) {
+    const { exp } = parseJwt(auth.token);
+    const tenMinutes = 10 * 60;
+    if (exp && exp > Math.floor(Date.now() / 1000) + tenMinutes)
+        return auth;
+    if (!auth.refreshToken)
+        return auth; // no refresh token, use as-is
+    const newToken = await refreshIdToken(auth.refreshToken);
+    const updated = { ...auth, token: newToken };
+    saveCachedAuth(updated);
+    return updated;
+}
 // ─── Public API ───────────────────────────────────────────────────────────────
 async function getValidAuth(gatewayUrl, pwaUrl) {
     const cached = loadCachedAuth();

package/dist/claude.js

@@ -21,12 +21,16 @@ function spawnClaude(params) {
         '--allowedTools', 'mcp__1presence__*',
         '--system-prompt', systemPromptPath,
         '--mcp-config', mcpConfigPath,
+        '--strict-mcp-config',
     ];
     if (claudeSessionId) {
         args.push('--resume', claudeSessionId);
     }
+    // Strip API key so Claude Code uses the user's claude.ai Pro subscription
+    // (OAuth credentials), not an API key that would bill to a separate account.
+    const { ANTHROPIC_API_KEY: _stripped, ...safeEnv } = process.env;
     const proc = (0, child_process_1.spawn)('claude', args, {
-        env: { ...process.env },
+        env: safeEnv,
         stdio: ['ignore', 'pipe', 'pipe'],
     });
     active.set(conversationId, proc);
@@ -57,6 +61,10 @@ function spawnClaude(params) {
                 if (sid && presenceSessionId) {
                     (0, sessions_1.saveClaudeSession)(presenceSessionId, sid);
                 }
+                const keySource = event['apiKeySource'];
+                const model = event['model'];
+                const authLabel = keySource === 'oauth' || !keySource ? 'claude.ai plan' : `api key`;
+                process.stderr.write(`[bridge] model: ${model ?? 'unknown'}  auth: ${authLabel}\n`);
                 sessionIdExtracted = true;
             }
             // Count complete assistant turns + accumulate token usage

package/dist/index.js

@@ -57,6 +57,56 @@ async function writeSetupFiles(auth) {
     };
     (0, fs_1.writeFileSync)(tmpFile(`mcp-${uid}.json`), JSON.stringify(mcpConfig, null, 2), 'utf-8');
 }
+// ─── Handle a single incoming message (token refresh + spawn) ─────────────────
+async function handleMessage(conversationId, text, sessionId, ws, auth) {
+    // Refresh JWT if <10 min remaining before spawning Claude
+    let activeAuth = auth;
+    try {
+        const freshAuth = await (0, auth_1.ensureFreshToken)(auth);
+        if (freshAuth.token !== auth.token) {
+            currentAuth = freshAuth;
+            activeAuth = freshAuth;
+            await writeSetupFiles(freshAuth);
+        }
+    }
+    catch (err) {
+        console.warn(`[bridge] token refresh failed: ${err.message}`);
+    }
+    let responding = false;
+    (0, claude_1.spawnClaude)({
+        conversationId,
+        presenceSessionId: sessionId,
+        text,
+        uid: activeAuth.uid,
+        onEvent: (event) => {
+            if (!responding && event['type'] === 'assistant') {
+                responding = true;
+                console.log(`[${new Date().toLocaleTimeString()}] ◐ responding…`);
+            }
+            if (ws.readyState === ws_1.default.OPEN) {
+                ws.send(JSON.stringify({ type: 'stream', conversationId, event }));
+            }
+        },
+        onDone: (messageCount, costUsd, usage) => {
+            const parts = [];
+            if (usage)
+                parts.push(`in:${usage.input_tokens} out:${usage.output_tokens}`);
+            const costStr = costUsd === 0 ? '$0.0000 (plan usage)' : `$${costUsd.toFixed(4)}`;
+            parts.push(costStr);
+            const suffix = parts.length ? `  ${parts.join('  ')}` : '';
+            console.log(`[${new Date().toLocaleTimeString()}] ✓ done${suffix}`);
+            if (ws.readyState === ws_1.default.OPEN) {
+                ws.send(JSON.stringify({ type: 'done', conversationId, messageCount, costUsd }));
+            }
+        },
+        onError: (message) => {
+            console.error(`[${new Date().toLocaleTimeString()}] ✗ ${message}`);
+            if (ws.readyState === ws_1.default.OPEN) {
+                ws.send(JSON.stringify({ type: 'error', conversationId, message }));
+            }
+        },
+    });
+}
 // ─── WebSocket connection ─────────────────────────────────────────────────────
 function connect(auth, retryDelay = 1000) {
     const ws = new ws_1.default(GATEWAY_WS, {
@@ -79,42 +129,11 @@ function connect(auth, retryDelay = 1000) {
         const ts = new Date().toLocaleTimeString();
         const preview = text.length > 80 ? text.slice(0, 80) + '…' : text;
         console.log(`[${ts}] ▶ ${preview}`);
-        let responding = false;
-        (0, claude_1.spawnClaude)({
-            conversationId,
-            presenceSessionId: sessionId ?? null,
-            text,
-            uid: auth.uid,
-            onEvent: (event) => {
-                if (!responding && event['type'] === 'assistant') {
-                    responding = true;
-                    console.log(`[${new Date().toLocaleTimeString()}] ◐ responding…`);
-                }
-                if (ws.readyState === ws_1.default.OPEN) {
-                    ws.send(JSON.stringify({ type: 'stream', conversationId, event }));
-                }
-            },
-            onDone: (messageCount, costUsd, usage) => {
-                const parts = [];
-                if (usage)
-                    parts.push(`in:${usage.input_tokens} out:${usage.output_tokens}`);
-                const costStr = costUsd === 0 ? '$0.0000 (plan usage)' : `$${costUsd.toFixed(4)}`;
-                parts.push(costStr);
-                const suffix = parts.length ? `  ${parts.join('  ')}` : '';
-                console.log(`[${new Date().toLocaleTimeString()}] ✓ done${suffix}`);
-                if (ws.readyState === ws_1.default.OPEN) {
-                    ws.send(JSON.stringify({ type: 'done', conversationId, messageCount, costUsd }));
-                }
-            },
-            onError: (message) => {
-                console.error(`[${new Date().toLocaleTimeString()}] ✗ ${message}`);
-                if (ws.readyState === ws_1.default.OPEN) {
-                    ws.send(JSON.stringify({ type: 'error', conversationId, message }));
-                }
-            },
+        handleMessage(conversationId, text, sessionId ?? null, ws, auth).catch((err) => {
+            console.error(`[bridge] handleMessage error: ${err.message}`);
         });
     });
-    ws.on('close', (code, reason) => {
+    ws.on('close', (code) => {
         if (code === 4001) {
             console.error('Authentication failed — clearing cached credentials. Please restart the bridge.');
             (0, auth_1.clearAuth)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "bin": {
     "1presence-bridge": "dist/index.js"