@1presence/bridge 0.10.0 → 0.12.0

package/dist/auth.js

@@ -4,27 +4,17 @@ exports.AuthCancelledError = void 0;
 exports.isTokenValid = isTokenValid;
 exports.ensureFreshToken = ensureFreshToken;
 exports.getValidAuth = getValidAuth;
-exports.refreshAuth = refreshAuth;
-exports.clearAuth = clearAuth;
 const http_1 = require("http");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
-// ─── Paths ────────────────────────────────────────────────────────────────────
-const CONFIG_DIR = (0, path_1.join)((0, os_1.homedir)(), '.1presence');
-const AUTH_FILE = (0, path_1.join)(CONFIG_DIR, 'auth.json');
-function ensureConfigDir() {
-    // 0o700: refresh token + session map live here; deny traversal to other local accounts.
-    (0, fs_1.mkdirSync)(CONFIG_DIR, { recursive: true, mode: 0o700 });
-}
-// writeFileSync's `mode` only applies when the file is newly created. chmodSync
-// covers the overwrite case so a legacy 0644 auth.json gets tightened on next save.
-function writeRestricted(path, data) {
-    (0, fs_1.writeFileSync)(path, data, { mode: 0o600 });
-    (0, fs_1.chmodSync)(path, 0o600);
-}
+// Auth lives only in process memory. Earlier versions persisted tokens to
+// ~/.1presence/auth.json; remove any leftover file on startup so a stale,
+// permission-bearing token can't survive a bridge restart.
+const LEGACY_AUTH_FILE = (0, path_1.join)((0, os_1.homedir)(), '.1presence', 'auth.json');
+(0, fs_1.rmSync)(LEGACY_AUTH_FILE, { force: true });
 // ─── JWT helpers ──────────────────────────────────────────────────────────────
 function parseJwt(token) {
     try {
@@ -49,24 +39,6 @@ function uidFromToken(token) {
 function emailFromToken(token) {
     return parseJwt(token).email;
 }
-// ─── Cache read/write ─────────────────────────────────────────────────────────
-function loadCachedAuth() {
-    try {
-        const raw = (0, fs_1.readFileSync)(AUTH_FILE, 'utf-8');
-        const data = JSON.parse(raw);
-        if (!data.token || !isTokenValid(data.token))
-            return null;
-        return { token: data.token, uid: data.uid, email: data.email, refreshToken: data.refreshToken };
-    }
-    catch {
-        return null;
-    }
-}
-function saveCachedAuth(auth) {
-    ensureConfigDir();
-    const data = { ...auth, savedAt: Date.now() };
-    writeRestricted(AUTH_FILE, JSON.stringify(data, null, 2));
-}
 // ─── Browser auth flow ────────────────────────────────────────────────────────
 function openBrowser(url) {
     const platform = process.platform;
@@ -208,7 +180,7 @@ async function refreshIdToken(refreshToken) {
         throw new Error('Token refresh returned no id_token');
     return data.id_token;
 }
-/** Returns auth with a fresh ID token. Refreshes if <10 minutes remain. */
+/** Returns auth with a fresh ID token. Refreshes in-memory if <10 minutes remain. */
 async function ensureFreshToken(auth) {
     const { exp } = parseJwt(auth.token);
     const tenMinutes = 10 * 60;
@@ -217,26 +189,13 @@ async function ensureFreshToken(auth) {
     if (!auth.refreshToken)
         return auth; // no refresh token, use as-is
     const newToken = await refreshIdToken(auth.refreshToken);
-    const updated = { ...auth, token: newToken };
-    saveCachedAuth(updated);
-    return updated;
+    return { ...auth, token: newToken };
 }
 // ─── Public API ───────────────────────────────────────────────────────────────
+// No cache — every bridge launch goes through the browser flow. This means
+// permission revocations take effect on the next restart, and the PWA's
+// CliAuthPage no-permission screen is what users see if access is denied.
 async function getValidAuth(gatewayUrl, pwaUrl) {
-    const cached = loadCachedAuth();
-    if (cached)
-        return cached;
     console.log('Sign-in required.');
-    const auth = await runBrowserAuthFlow(gatewayUrl, pwaUrl);
-    saveCachedAuth(auth);
-    return auth;
-}
-function refreshAuth(auth) {
-    saveCachedAuth(auth);
-}
-function clearAuth() {
-    try {
-        writeRestricted(AUTH_FILE, '{}');
-    }
-    catch { /* ignore */ }
+    return runBrowserAuthFlow(gatewayUrl, pwaUrl);
 }

package/dist/index.js

@@ -252,8 +252,7 @@ function connect(auth, retryDelay = 1000) {
     ws.on('close', (code) => {
         stopPing();
         if (code === 4001) {
-            console.error('Authentication failed — clearing cached credentials. Please restart the bridge.');
-            (0, auth_1.clearAuth)();
+            console.error('Authentication failed. Please restart the bridge to sign in again.');
             process.exit(1);
         }
         if (code === 4003) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "bin": {
     "1presence-bridge": "dist/index.js"