@1presence/bridge 0.73.0 → 0.75.0

package/README.md

@@ -45,7 +45,7 @@ supported (the second displaces the first).
 
 ## How it works
 
-The bridge connects outbound to the 1Presence gateway as a persistent WebSocket. When you send a message from the app, the gateway relays it to the bridge, which spawns a `claude` subprocess with your personal system prompt and all 1Presence tools (vault, Gmail, Drive, Calendar, MemPalace, and more) wired in via MCP. Responses stream back in real time.
+The bridge connects outbound to the 1Presence gateway as a persistent WebSocket. When you send a message from the app, the gateway relays it to the bridge, which spawns a `claude` subprocess with your personal system prompt and all 1Presence tools (vault, Gmail, Drive, Calendar, memory, and more) wired in via MCP. Responses stream back in real time.
 
 Conversations are stateful — the bridge maps each 1Presence conversation to a Claude Code session ID so context is preserved across messages.
 

package/dist/accumulator.js

@@ -5,17 +5,7 @@ export function makeBridgeAccumulator() {
         toolResults: {},
         turns: [],
     };
-    // A new API turn bucket only opens when a user event (tool_results) has
-    // arrived since the last assistant event — mirrors the gateway translator
-    // logic. The CLI splits a single model emission's text and tool_use blocks
-    // into separate `{type:'assistant'}` events; without this guard each split
-    // creates a stored assistant message and produces consecutive same-role
-    // rows that the read-side merger has to repair. Init true so the very first
-    // assistant event opens turn 0.
     let sawUserSinceLastAssistant = true;
-    // Returns the current open API-turn bucket, creating one lazily if a text
-    // event arrives before any `{type:'assistant'}` event (shouldn't normally
-    // happen with Claude Code's stream-json, but keep it robust).
     function currentTurn() {
         if (state.turns.length === 0)
             state.turns.push({ text: '', toolUseIds: [] });
@@ -24,9 +14,7 @@ export function makeBridgeAccumulator() {
     function appendText(text) {
         const turn = currentTurn();
         turn.text += text;
-        // Mirror to the flat string with `\n\n` between turns for convenience.
         if (state.assistantText && state.turns.length > 1 && turn.text === text) {
-            // First text emission of a new turn — separate from prior turn.
             state.assistantText += '\n\n';
         }
         state.assistantText += text;
@@ -41,10 +29,6 @@ export function makeBridgeAccumulator() {
                 return;
             }
             if (type === 'assistant') {
-                // Only open a fresh bucket when a user event has arrived since the
-                // last assistant event. Otherwise treat this as a continuation of
-                // the current API turn (CLI splits text and tool_use into separate
-                // assistant events within one model emission).
                 if (sawUserSinceLastAssistant) {
                     state.turns.push({ text: '', toolUseIds: [] });
                     sawUserSinceLastAssistant = false;
@@ -78,7 +62,6 @@ export function makeBridgeAccumulator() {
                 return;
             }
             if (type === 'user') {
-                // Flip the flag so the next assistant event opens a new API turn.
                 sawUserSinceLastAssistant = true;
                 const msg = event['message'];
                 const content = msg?.['content'];

package/dist/auth.js

@@ -4,12 +4,8 @@ import { homedir } from 'os';
 import { join } from 'path';
 import { exec } from 'child_process';
 import { randomBytes, timingSafeEqual } from 'crypto';
-// Auth lives only in process memory. Earlier versions persisted tokens to
-// ~/.1presence/auth.json; remove any leftover file on startup so a stale,
-// permission-bearing token can't survive a bridge restart.
 const LEGACY_AUTH_FILE = join(homedir(), '.1presence', 'auth.json');
 rmSync(LEGACY_AUTH_FILE, { force: true });
-// ─── JWT helpers ──────────────────────────────────────────────────────────────
 function parseJwt(token) {
     try {
         const payload = token.split('.')[1];
@@ -24,7 +20,6 @@ export function isTokenValid(token) {
     const { exp } = parseJwt(token);
     if (!exp)
         return false;
-    // Require at least 5 minutes of validity remaining
     return exp > Math.floor(Date.now() / 1000) + 300;
 }
 function uidFromToken(token) {
@@ -33,7 +28,6 @@ function uidFromToken(token) {
 function emailFromToken(token) {
     return parseJwt(token).email;
 }
-// ─── Browser auth flow ────────────────────────────────────────────────────────
 function openBrowser(url) {
     const platform = process.platform;
     const cmd = platform === 'darwin' ? `open "${url}"`
@@ -47,18 +41,6 @@ function openBrowser(url) {
 export class AuthCancelledError extends Error {
     constructor() { super('Sign-in cancelled — the browser tab was closed.'); }
 }
-/**
- * Applies the localhost auth server's CORS headers, scoped to the legitimate
- * PWA origin. Exported so the Private Network Access behaviour stays under test.
- *
- * The `Access-Control-Allow-Private-Network` reflection is load-bearing: when
- * the HTTPS PWA (a public/secure context) fetches this 127.0.0.1 server (a
- * private address), Chrome sends a CORS preflight carrying
- * `Access-Control-Request-Private-Network: true`. Without the matching allow
- * header, Chrome (PNA enforcement, ~v130+) blocks the request outright — even a
- * plain GET, even for localhost, which is exempt from mixed-content blocking —
- * and the PWA shows "Could not reach the bridge" though the server is up.
- */
 export function applyAuthCorsHeaders(req, res, pwaOrigin) {
     const reqOrigin = req.headers['origin'] ?? '';
     if (pwaOrigin && reqOrigin === pwaOrigin) {
@@ -74,10 +56,6 @@ export function applyAuthCorsHeaders(req, res, pwaOrigin) {
 function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
     return new Promise((resolve, reject) => {
         let resolved = false;
-        // Per-launch nonce. Embedded in the auth URL the bridge prints/opens and
-        // required on every request to this localhost server. Without it, a
-        // malicious page in the user's browser could scan ephemeral ports during
-        // the auth window and POST a forged token to hijack the bridge.
         const nonce = randomBytes(32).toString('base64url');
         const nonceBuf = Buffer.from(nonce, 'utf-8');
         function checkNonce(provided) {
@@ -88,7 +66,6 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
                 return false;
             return timingSafeEqual(provBuf, nonceBuf);
         }
-        // CORS allowlist scoped to the legitimate PWA origin only.
         const pwaOrigin = (() => {
             try {
                 return new URL(pwaUrl).origin;
@@ -106,13 +83,11 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
             }
             const reqUrl = new URL(req.url ?? '/', 'http://localhost');
             const path = reqUrl.pathname;
-            // Every request must carry the launch-specific nonce.
             if (!checkNonce(reqUrl.searchParams.get('nonce'))) {
                 res.writeHead(403);
                 res.end();
                 return;
             }
-            // Lets the PWA verify the bridge is still listening before POSTing the token.
             if (req.method === 'GET' && (path === '/' || path === '')) {
                 res.writeHead(200, { 'Content-Type': 'text/plain' });
                 res.end('1Presence bridge waiting for sign-in');
@@ -123,8 +98,6 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
                 res.end();
                 return;
             }
-            // Status beacon from the PWA — used so we exit early when the user closes
-            // the auth tab before signing in (sendBeacon path).
             if (path === '/status') {
                 const event = reqUrl.searchParams.get('event');
                 res.writeHead(204);
@@ -181,8 +154,6 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
         }, 5 * 60 * 1000);
     });
 }
-// ─── Token refresh ────────────────────────────────────────────────────────────
-// Firebase web API key — public, safe to embed
 const FIREBASE_API_KEY = 'AIzaSyAz16A3eRIMhdLGF9ptsVsWZx9LjKeZwi8';
 async function refreshIdToken(refreshToken) {
     const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_API_KEY}`, {
@@ -197,47 +168,22 @@ async function refreshIdToken(refreshToken) {
         throw new Error('Token refresh returned no id_token');
     return data.id_token;
 }
-/** Headroom below which ensureFreshToken mints a new ID token at turn start.
- *  Firebase ID tokens live 60 min; the token is baked into the MCP SSE config
- *  header at spawn (writeMcpConfig) and reused by that connection for the whole
- *  turn — it can't be re-tokened mid-turn without reconnecting the MCP server.
- *  So a turn must START with enough headroom to outlive itself. At 10 min a turn
- *  that began with ~12 min of life and ran 17 min lost its MCP OAuth AND its
- *  save-turn token mid-flight ("MCP OAuth not configured" + save-turn 401 — see
- *  the 2026-07-07 stuck-run bug). 30 min comfortably covers the 10-min bridge
- *  stage wall-clock and any normal chat turn; near-full-hour refresh would churn
- *  a token every turn for little gain. */
 const TOKEN_REFRESH_HEADROOM_SEC = 30 * 60;
-/** Returns auth with a fresh ID token. Refreshes in-memory if less than
- *  TOKEN_REFRESH_HEADROOM_SEC of validity remains. */
 export async function ensureFreshToken(auth) {
     const { exp } = parseJwt(auth.token);
     if (exp && exp > Math.floor(Date.now() / 1000) + TOKEN_REFRESH_HEADROOM_SEC)
         return auth;
     if (!auth.refreshToken)
-        return auth; // no refresh token, use as-is
+        return auth;
     const newToken = await refreshIdToken(auth.refreshToken);
     return { ...auth, token: newToken };
 }
-/**
- * Mints a fresh ID token unconditionally, ignoring local expiry. Used on the
- * reconnect path after the gateway has *rejected* our token (WS close 4001):
- * the gateway's verdict beats our own clock, so we always refresh rather than
- * trusting a token that still looks valid locally (e.g. clock skew). Returns
- * the refreshed auth, or null when there is no refresh token to mint from —
- * the caller must then fall back to an interactive re-sign-in. Throws only if
- * the refresh endpoint itself rejects (refresh token revoked/expired).
- */
 export async function forceRefreshToken(auth) {
     if (!auth.refreshToken)
         return null;
     const newToken = await refreshIdToken(auth.refreshToken);
     return { ...auth, token: newToken };
 }
-// ─── Public API ───────────────────────────────────────────────────────────────
-// No cache — every bridge launch goes through the browser flow. This means
-// permission revocations take effect on the next restart, and the PWA's
-// CliAuthPage no-permission screen is what users see if access is denied.
 export async function getValidAuth(gatewayUrl, pwaUrl) {
     console.log('Sign-in required.');
     return runBrowserAuthFlow(gatewayUrl, pwaUrl);