@1presence/bridge 0.22.0 → 0.24.0

package/dist/claude.js

@@ -97,8 +97,12 @@ function spawnClaude(params) {
     // - `--no-session-persistence` keeps no jsonl on disk. The bridge has zero
     //   local filesystem dependency for continuity; Firestore is the only
     //   source of truth.
-    // - `--session-id <presenceSessionId>` pins the CLI session UUID to the
-    //   presence sessionId so logs across bridge/gateway are easy to correlate.
+    // - `--session-id <uuid>` must be a fresh UUID per spawn: the CLI treats
+    //   this flag as a "claim a new session ID" operation and rejects the
+    //   second spawn with "Session ID X is already in use" if we reuse one
+    //   across turns of a chat — even with --no-session-persistence. The
+    //   bridge passes the per-spawn `conversationId` here; the presence
+    //   sessionId is correlated separately via bridge logs and spool records.
     const args = [
         '--print',
         '--input-format', 'stream-json',
@@ -228,7 +232,18 @@ function spawnClaude(params) {
                             // --setting-sources "") are supposed to make this unreachable. If we see a
                             // non-1Presence tool here anyway, something has bypassed those guards — kill
                             // immediately so any side effect already in flight is the only damage done.
-                            if (!toolName.startsWith('mcp__1presence__')) {
+                            //
+                            // Valid forms:
+                            //   mcp__1presence__<name>  — namespaced MCP form
+                            //   <snake_case_name>       — bare form; Claude Code may omit the prefix in
+                            //                            stream-json output. Safe because --strict-mcp-config
+                            //                            limits MCP to the 1presence server only.
+                            // Invalid (real violations):
+                            //   PascalCase (Bash, Read, Write, …) — Claude Code built-ins
+                            //   mcp__<other>__*         — tools from a different MCP server
+                            const isMcp1presence = toolName.startsWith('mcp__1presence__');
+                            const isBareName = /^[a-z][a-z0-9_]*$/.test(toolName);
+                            if (!isMcp1presence && !isBareName) {
                                 killedForViolation = true;
                                 const violation = `bridge tool violation: ${toolName} is not allowed in Local Mode`;
                                 process.stderr.write(`[bridge] FATAL ${violation} — killing\n`);

package/dist/index.js

@@ -171,10 +171,14 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
     const accumulator = (0, accumulator_1.makeBridgeAccumulator)();
     const startedAt = Date.now();
     const turnSessionId = sessionId ?? conversationId; // gateway always supplies one; defensive fallback
-    // --session-id requires a UUID; turnSessionId is always one in practice
-    // (gateway generates via crypto.randomUUID). Defensive: if a non-UUID slips
-    // through, fall back to conversationId which is also crypto.randomUUID.
-    const claudePinnedSessionId = isUuid(turnSessionId) ? turnSessionId : conversationId;
+    // The CLI's `--session-id` is treated as a "claim this new session ID"
+    // operation — passing the same UUID across turns of one chat (which is
+    // what the presence sessionId is) makes turn 2 fail with "Session ID X
+    // is already in use", even with --no-session-persistence. Use the
+    // per-spawn conversationId instead — continuity comes from history
+    // replay via --input-format stream-json, not from CLI session tracking.
+    // turnSessionId is still kept for spool records / log correlation.
+    const claudePinnedSessionId = isUuid(conversationId) ? conversationId : crypto.randomUUID();
     function buildSpoolRecord(usage, model) {
         const s = accumulator.state();
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "bin": {
     "1presence-bridge": "dist/index.js"