@1presence/bridge 0.65.0 → 0.66.0

package/dist/auth.js

@@ -197,11 +197,22 @@ async function refreshIdToken(refreshToken) {
         throw new Error('Token refresh returned no id_token');
     return data.id_token;
 }
-/** Returns auth with a fresh ID token. Refreshes in-memory if <10 minutes remain. */
+/** Headroom below which ensureFreshToken mints a new ID token at turn start.
+ *  Firebase ID tokens live 60 min; the token is baked into the MCP SSE config
+ *  header at spawn (writeMcpConfig) and reused by that connection for the whole
+ *  turn — it can't be re-tokened mid-turn without reconnecting the MCP server.
+ *  So a turn must START with enough headroom to outlive itself. At 10 min a turn
+ *  that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its
+ *  save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see
+ *  the 2026-07-07 stuck-run bug). 30 min comfortably covers the 10-min bridge
+ *  stage wall-clock and any normal chat turn; near-full-hour refresh would churn
+ *  a token every turn for little gain. */
+const TOKEN_REFRESH_HEADROOM_SEC = 30 * 60;
+/** Returns auth with a fresh ID token. Refreshes in-memory if less than
+ *  TOKEN_REFRESH_HEADROOM_SEC of validity remains. */
 export async function ensureFreshToken(auth) {
     const { exp } = parseJwt(auth.token);
-    const tenMinutes = 10 * 60;
-    if (exp && exp > Math.floor(Date.now() / 1000) + tenMinutes)
+    if (exp && exp > Math.floor(Date.now() / 1000) + TOKEN_REFRESH_HEADROOM_SEC)
         return auth;
     if (!auth.refreshToken)
         return auth; // no refresh token, use as-is

package/dist/index.js

@@ -433,6 +433,22 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
         catch (err) {
             console.warn(`[bridge] spool write failed: ${err.message}`);
         }
+        // Refresh the token right before the POST — this fires at turn END, when the
+        // most time has elapsed. A long turn (started with a token that was fresh
+        // then) must not 401 on save-turn with a since-expired token — the failure
+        // that left a run stuck at 'running' on 2026-07-07. Best-effort: on refresh
+        // failure fall back to the current token; the spool file is retried on the
+        // next successful POST or on the next bridge startup.
+        try {
+            const fresh = await ensureFreshToken(activeAuth);
+            if (fresh.token !== activeAuth.token) {
+                activeAuth = fresh;
+                currentAuth = fresh;
+            }
+        }
+        catch (err) {
+            console.warn(`[bridge] pre-save-turn token refresh failed (using current token): ${err.message}`);
+        }
         const result = await postSaveTurn(GATEWAY_HTTP, activeAuth.token, record);
         if (result.ok) {
             deleteSpool(record.conversationId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "license": "Apache-2.0",
   "type": "module",