@1presence/bridge 0.65.0 → 0.67.0

package/README.md

@@ -22,6 +22,27 @@ On first run, a browser window will open to sign in to your 1Presence account. Y
 
 Once connected, your 1Presence app on any device automatically routes to your local Claude Code session. When you stop the bridge, 1Presence falls back to platform mode.
 
+## Admin: running the bridge as another user
+
+If your 1Presence account is an **admin**, the sign-in screen shows a user picker
+instead of connecting immediately. Choose which 1Presence user this bridge runs
+as — it defaults to **you** — and click Connect. Picking another user lets you
+drive their account (their vault, connectors, and history) through your local
+Claude Code, which is handy for onboarding testers who don't run the bridge
+themselves. You never need their password; the picker mints a scoped token for
+the selected user server-side.
+
+The target user must have **Local Claude Code access** granted in the admin panel
+(the same permission that gates your own bridge and also lets bridge turns run
+free on your Claude subscription). The picker flags anyone who isn't eligible yet.
+
+### Multiple sessions at once
+
+Because every session is keyed by the connected user, you can run several bridges
+side by side — each in its own terminal, each impersonating a **different** user —
+and they won't interfere. Running two bridges for the *same* user at once is not
+supported (the second displaces the first).
+
 ## How it works
 
 The bridge connects outbound to the 1Presence gateway as a persistent WebSocket. When you send a message from the app, the gateway relays it to the bridge, which spawns a `claude` subprocess with your personal system prompt and all 1Presence tools (vault, Gmail, Drive, Calendar, MemPalace, and more) wired in via MCP. Responses stream back in real time.

package/dist/auth.js

@@ -197,11 +197,22 @@ async function refreshIdToken(refreshToken) {
         throw new Error('Token refresh returned no id_token');
     return data.id_token;
 }
-/** Returns auth with a fresh ID token. Refreshes in-memory if <10 minutes remain. */
+/** Headroom below which ensureFreshToken mints a new ID token at turn start.
+ *  Firebase ID tokens live 60 min; the token is baked into the MCP SSE config
+ *  header at spawn (writeMcpConfig) and reused by that connection for the whole
+ *  turn — it can't be re-tokened mid-turn without reconnecting the MCP server.
+ *  So a turn must START with enough headroom to outlive itself. At 10 min a turn
+ *  that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its
+ *  save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see
+ *  the 2026-07-07 stuck-run bug). 30 min comfortably covers the 10-min bridge
+ *  stage wall-clock and any normal chat turn; near-full-hour refresh would churn
+ *  a token every turn for little gain. */
+const TOKEN_REFRESH_HEADROOM_SEC = 30 * 60;
+/** Returns auth with a fresh ID token. Refreshes in-memory if less than
+ *  TOKEN_REFRESH_HEADROOM_SEC of validity remains. */
 export async function ensureFreshToken(auth) {
     const { exp } = parseJwt(auth.token);
-    const tenMinutes = 10 * 60;
-    if (exp && exp > Math.floor(Date.now() / 1000) + tenMinutes)
+    if (exp && exp > Math.floor(Date.now() / 1000) + TOKEN_REFRESH_HEADROOM_SEC)
         return auth;
     if (!auth.refreshToken)
         return auth; // no refresh token, use as-is

package/dist/index.js

@@ -433,6 +433,22 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
         catch (err) {
             console.warn(`[bridge] spool write failed: ${err.message}`);
         }
+        // Refresh the token right before the POST — this fires at turn END, when the
+        // most time has elapsed. A long turn (started with a token that was fresh
+        // then) must not 401 on save-turn with a since-expired token — the failure
+        // that left a run stuck at 'running' on 2026-07-07. Best-effort: on refresh
+        // failure fall back to the current token; the spool file is retried on the
+        // next successful POST or on the next bridge startup.
+        try {
+            const fresh = await ensureFreshToken(activeAuth);
+            if (fresh.token !== activeAuth.token) {
+                activeAuth = fresh;
+                currentAuth = fresh;
+            }
+        }
+        catch (err) {
+            console.warn(`[bridge] pre-save-turn token refresh failed (using current token): ${err.message}`);
+        }
         const result = await postSaveTurn(GATEWAY_HTTP, activeAuth.token, record);
         if (result.ok) {
             deleteSpool(record.conversationId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "license": "Apache-2.0",
   "type": "module",