@1presence/bridge 0.1.19 → 0.3.0

package/dist/auth.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCancelledError = void 0;
 exports.isTokenValid = isTokenValid;
 exports.ensureFreshToken = ensureFreshToken;
 exports.getValidAuth = getValidAuth;
@@ -69,8 +70,13 @@ function openBrowser(url) {
             console.error('Could not open browser automatically. Please open this URL manually:\n' + url);
     });
 }
+class AuthCancelledError extends Error {
+    constructor() { super('Sign-in cancelled — the browser tab was closed.'); }
+}
+exports.AuthCancelledError = AuthCancelledError;
 function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
     return new Promise((resolve, reject) => {
+        let resolved = false;
         const server = (0, http_1.createServer)((req, res) => {
             // CORS headers so the PWA (https) can POST to http://localhost
             res.setHeader('Access-Control-Allow-Origin', '*');
@@ -86,6 +92,21 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
                 res.end();
                 return;
             }
+            // Status beacon from the PWA — currently used so we exit early when
+            // the user closes the auth tab before signing in (sendBeacon path).
+            const path = (req.url ?? '/').split('?')[0];
+            if (path === '/status') {
+                const params = new URL(req.url ?? '/', 'http://localhost').searchParams;
+                const event = params.get('event');
+                res.writeHead(204);
+                res.end();
+                if (event === 'closed' && !resolved) {
+                    resolved = true;
+                    server.close();
+                    reject(new AuthCancelledError());
+                }
+                return;
+            }
             let body = '';
             req.on('data', (chunk) => { body += chunk.toString(); });
             req.on('end', () => {
@@ -98,6 +119,7 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
                     }
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ ok: true }));
+                    resolved = true;
                     server.close();
                     const uid = uidFromToken(token);
                     const email = emailFromToken(token);
@@ -122,6 +144,9 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
             openBrowser(authUrl);
         });
         setTimeout(() => {
+            if (resolved)
+                return;
+            resolved = true;
             server.close();
             reject(new Error('Sign-in timed out after 5 minutes. Please try again.'));
         }, 5 * 60 * 1000);

package/dist/claude.js

@@ -122,10 +122,23 @@ function spawnClaude(params) {
     if (syncedFolders?.length)
         ctxParts.push(`synced_folders: ${syncedFolders.join(', ')}`);
     const promptText = ctxParts.length > 0 ? `[${ctxParts.join(' | ')}]\n\n${text}` : text;
+    // Lockdown rationale:
+    // - `--tools ""` disables ALL built-in tools (Bash/Read/Write/Edit/Glob/Grep/
+    //   WebFetch/etc.). MCP tools are not "built-in" so the 1Presence MCP surface
+    //   remains available.
+    // - `--setting-sources ""` prevents claude CLI from loading the user's
+    //   ~/.claude/settings.json (and project/.local equivalents). Without this,
+    //   permissive `permissions.allow` rules in the user's personal Claude Code
+    //   config would silently re-enable Bash/Edit/Write etc. inside the bridge.
+    // - `--strict-mcp-config` keeps the MCP surface to exactly what we wire in
+    //   via --mcp-config. Together these guarantee the bridge can only call
+    //   `mcp__1presence__*` — no filesystem, no shell, no arbitrary network.
     const args = [
         '-p', promptText,
         '--output-format', 'stream-json',
         '--verbose',
+        '--tools', '',
+        '--setting-sources', '',
         '--allowedTools', 'mcp__1presence__*',
         '--system-prompt', systemPromptPath,
         '--mcp-config', mcpConfigPath,
@@ -153,6 +166,7 @@ function spawnClaude(params) {
     let usage = null;
     let extractedModel = null;
     let buffer = '';
+    let killedForViolation = false;
     proc.stdout.on('data', (chunk) => {
         buffer += chunk.toString('utf-8');
         const lines = buffer.split('\n');
@@ -218,6 +232,19 @@ function spawnClaude(params) {
                             const toolName = block['name'];
                             const prefix = toolName.startsWith('mcp__') ? '[mcp]' : '[tool]';
                             process.stderr.write(`[bridge] ${prefix} ${toolName}\n`);
+                            // Defense-in-depth: CLI flags (--tools "", --allowedTools, --strict-mcp-config,
+                            // --setting-sources "") are supposed to make this unreachable. If we see a
+                            // non-1Presence tool here anyway, something has bypassed those guards — kill
+                            // immediately so any side effect already in flight is the only damage done.
+                            if (!toolName.startsWith('mcp__1presence__')) {
+                                killedForViolation = true;
+                                const violation = `bridge tool violation: ${toolName} is not allowed in Local Mode`;
+                                process.stderr.write(`[bridge] FATAL ${violation} — killing\n`);
+                                active.delete(conversationId);
+                                proc.kill('SIGKILL');
+                                onError(violation, usage, extractedModel);
+                                return;
+                            }
                         }
                         else if (block['type'] === 'text') {
                             const text = block['text'];
@@ -248,6 +275,9 @@ function spawnClaude(params) {
     });
     proc.on('close', (code) => {
         active.delete(conversationId);
+        // Violation path already called onError + killed — don't double-fire.
+        if (killedForViolation)
+            return;
         // Flush any remaining buffer
         if (buffer.trim()) {
             try {

package/dist/index.js

@@ -290,6 +290,11 @@ async function main() {
     process.on('SIGTERM', shutdown);
 }
 main().catch((err) => {
+    if (err instanceof auth_1.AuthCancelledError) {
+        console.error(`\n${err.message}`);
+        console.error('Run `npx @1presence/bridge` again when you are ready to sign in.');
+        process.exit(0);
+    }
     console.error('Fatal:', err.message);
     process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.1.19",
+  "version": "0.3.0",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "bin": {
     "1presence-bridge": "dist/index.js"