@1presence/bridge 0.73.0 → 0.75.0

package/dist/index.js

@@ -14,14 +14,8 @@ import { checkAndUpdate } from './update.js';
 import { makeBridgeAccumulator, postSaveTurn } from './accumulator.js';
 import { writeSpool, deleteSpool, listSpool } from './outbox.js';
 import { startTurnTimer, stopTurnTimer, formatElapsed } from './timer.js';
-// ESM has no __dirname; derive it. JSON version is read via createRequire to
-// avoid version-sensitive import assertions on a published CLI bin.
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const { version } = createRequire(import.meta.url)('../package.json');
-// Published tarballs don't ship src/, so this fires only when running the
-// dist build from a live workspace checkout. Catches the trap where editing
-// src/ without re-running tsc leaves you executing stale dist code — banner
-// version matches package.json but behavior doesn't match the source.
 if (__dirname.endsWith('dist')) {
     const srcDir = join(__dirname, '..', 'src');
     if (existsSync(srcDir)) {
@@ -32,50 +26,18 @@ if (__dirname.endsWith('dist')) {
         }
     }
 }
-// ─── CLI args ─────────────────────────────────────────────────────────────────
 const VERBOSE = process.argv.includes('--verbose') || process.argv.includes('-v');
-// --debug renders a clean per-turn transcript (user prompt, assistant text,
-// tool inputs, tool outputs) — the bridge equivalent of the chat's admin
-// debug view. Unlike --verbose it does NOT dump the system prompt.
 const DEBUG = process.argv.includes('--debug') || process.argv.includes('-d');
-// ─── Config ───────────────────────────────────────────────────────────────────
 const GATEWAY_URL = process.env.BRIDGE_GATEWAY_URL ?? 'https://api.1presence.com';
 const GATEWAY_WS = GATEWAY_URL.replace(/^https?:/, 'wss:').replace(/\/$/, '') + '/bridge';
 const GATEWAY_HTTP = GATEWAY_URL.replace(/^wss?:/, 'https:').replace(/\/$/, '');
-// PWA hosts the /cli-auth sign-in page; strip 'api.' subdomain to derive it from gateway URL
 const PWA_URL = process.env.BRIDGE_PWA_URL ?? GATEWAY_HTTP.replace('://api.', '://');
-// ─── In-memory state ──────────────────────────────────────────────────────────
 let currentAuth = null;
 let currentWs = null;
-// When the socket first dropped, for reporting how long the bridge was offline
-// once it reconnects. Set on the first disconnect of an outage (repeated failed
-// reconnect attempts don't reset it), cleared on a successful open.
 let disconnectedAt = null;
-// Running cost across all turns this process has handled, for the cost segment
-// of the per-turn status line. On a pure subscription the CLI often reports a
-// per-turn cost of 0, in which case this stays at 0 and reads as "plan usage".
 let sessionCostUsd = 0;
-// Consecutive gateway auth rejections (WS close 4001) since the last good
-// connection. Reset on every successful `open`. A 4001 is almost always a
-// Firebase ID token that expired while the bridge sat idle and a deploy/restart
-// dropped the socket — recoverable by minting a fresh token. But if freshly
-// minted tokens *keep* being rejected, the account itself is the problem
-// (disabled/permission revoked): stop the refresh-and-retry loop and ask the
-// user to sign in again rather than spinning forever.
 let authRejections = 0;
 const MAX_AUTH_REJECTIONS = 3;
-// ─── Status line ──────────────────────────────────────────────────────────────
-//
-// A compact line printed after each completed turn echoing the segments local
-// Claude Code shows in its own status bar: model, context fill, and cost. The
-// 5h/7d subscription rate-limit windows it also shows are deliberately absent —
-// those ride in the API's rate-limit response HEADERS, which the bridge (a
-// consumer of the CLI's stream-json stdout only) never sees. Display only.
-// Raw model id (claude-opus-5, claude-opus-4-7, claude-sonnet-4-6-20250101) to
-// friendly "Opus 5" / "Opus 4.7". Regex-based so new dated snapshots format
-// without a table edit; an unrecognised shape falls back to the raw id rather
-// than guessing. The minor version is capped at 2 digits so a dated snapshot on
-// a single-number id (claude-opus-5-20260724) reads "Opus 5", not "Opus 5.2026…".
 function friendlyModelName(model) {
     if (!model)
         return 'unknown';
@@ -85,21 +47,7 @@ function friendlyModelName(model) {
     const family = `${m[1].charAt(0).toUpperCase()}${m[1].slice(1)}`;
     return m[3] ? `${family} ${m[2]}.${m[3]}` : `${family} ${m[2]}`;
 }
-// Context window (tokens) per model, for the context-fill estimate. Keyed by a
-// family regex against the raw model id; first match wins, and an unrecognised
-// id falls back to the Claude 4.x baseline rather than guessing high.
-//
-// Every model the bridge can currently run is 200k: Opus/Sonnet/Haiku 4.x are
-// 200k on the standard path, and the 1M-context window is an API beta that the
-// bridge's subscription print mode never opts into — so it does not apply here.
-// When a model ships with a different standard window, add a row above the
-// baseline; that one line keeps the estimate honest without touching anything
-// else. (The percentage is of the raw window — local Claude's own gauge also
-// reserves output headroom, so its reading runs a few points higher near full.)
 const CONTEXT_WINDOWS = [
-    // 5-generation Opus/Sonnet + Mythos-class ship with a 1M window as the
-    // DEFAULT (not an opt-in beta), so the bridge's print mode gets it too.
-    // Haiku is deliberately excluded (4.5 is 200k and falls to the baseline).
     { match: /claude-(opus|sonnet|fable|mythos)-5/i, tokens: 1_000_000 },
     { match: /claude-(opus|sonnet|haiku)-4/i, tokens: 200_000 },
 ];
@@ -113,12 +61,6 @@ function contextWindowFor(model) {
     }
     return DEFAULT_CONTEXT_WINDOW;
 }
-// ─── Rate-limit window rendering ──────────────────────────────────────────────
-// Mirrors the local Claude Code statusline's ⏱️ line: a 10-cell bar + used % +
-// reset time per subscription window. Data comes from the SDK's rate_limit_event
-// (captured across turns in claude.ts), so no auth/header probe is needed.
-// 7-day usage may arrive as the generic `seven_day` window or a model-specific
-// variant; surface whichever the SDK has reported, preferring the generic one.
 function sevenDayWindow() {
     return getRateLimitWindow('seven_day')
         ?? getRateLimitWindow('seven_day_opus')
@@ -129,11 +71,9 @@ function makeBar(pct) {
     const filled = Math.max(0, Math.min(width, Math.floor((pct * width) / 100)));
     return '█'.repeat(filled) + '░'.repeat(width - filled);
 }
-// Green < 70%, yellow 70–89%, red ≥ 90% — same thresholds as the statusline.
 function rlColor(pct) {
     return pct >= 90 ? '31' : pct >= 70 ? '33' : '32';
 }
-// "12:20a.m." within a day, "Mon 11:00p.m." when the reset is > 24h out.
 function formatReset(resetsAt) {
     if (!resetsAt)
         return '';
@@ -149,7 +89,6 @@ function formatReset(resetsAt) {
     }
     return time;
 }
-// One coloured "5h ██░░░░░░░░ 20% resets 12:20a.m." segment; null if unknown.
 function formatWindow(label, w) {
     if (!w)
         return null;
@@ -158,19 +97,8 @@ function formatWindow(label, w) {
     const seg = `${label} ${makeBar(pct)} ${pct}%${reset ? ` resets ${reset}` : ''}`;
     return paint(rlColor(pct), seg);
 }
-// ─── System prompt fetch ──────────────────────────────────────────────────────
-// Pulls the fully-built system prompt from agent-api (via gateway proxy).
-// This MUST match the hosted runtime exactly — STATIC_SYSTEM_PROMPT + dynamic
-// context (timezone, connector scopes, vault state, personal AGENT.md, skills,
-// onboarding). There is intentionally NO fallback: if this fails the bridge
-// must surface the error, not silently degrade to a different prompt source
-// (which historically caused the "Skills section authoritative" rule to
-// vanish and the agent to vault-hunt for skills).
 async function fetchSystemPrompt(token, agentSlug) {
     const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
-    // Pass the selected agent slug so agent-api resolves THIS agent (identity,
-    // granted connectors, scoped memory) rather than always falling back to the
-    // default 1Presence. Without it, every Local Mode turn was the generalist.
     const agentParam = agentSlug ? `&agent=${encodeURIComponent(agentSlug)}` : '';
     const url = `${GATEWAY_HTTP}/system-prompt-for-bridge?timezone=${encodeURIComponent(tz)}${agentParam}`;
     const headers = { Authorization: `Bearer ${token}` };
@@ -194,7 +122,7 @@ async function fetchSystemPrompt(token, agentSlug) {
                 const parsed = JSON.parse(body);
                 retryable = parsed.error === 'agent_waking' || parsed.error === 'agent_unreachable';
             }
-            catch { /* use default */ }
+            catch { }
             if (retryable && attempt < maxAttempts) {
                 const delayMs = Math.min(2_000 * attempt, 10_000);
                 console.log(`[bridge] agent pod waking (${res.status}), retrying system prompt in ${delayMs / 1000}s…`);
@@ -222,15 +150,9 @@ async function fetchSystemPrompt(token, agentSlug) {
     }
     return data.text;
 }
-// ─── Setup files ──────────────────────────────────────────────────────────────
 function tmpFile(name) {
     return join(tmpdir(), name);
 }
-// Fetch the system prompt and write it to /tmp/agent-${uid}.md. The hosted
-// runtime rebuilds buildSystemBlocks() per turn (dynamic context: vault state,
-// connector status, palace, onboarding phase, skills) — call this per turn in
-// the bridge too, otherwise newly shipped skills and mid-session vault writes
-// never reach a long-running bridge. Throws on failure; caller must handle.
 async function writeSystemPrompt(auth, agentSlug) {
     const { uid, token } = auth;
     const systemPrompt = await fetchSystemPrompt(token, agentSlug);
@@ -249,11 +171,6 @@ function writeMcpConfig(auth) {
                 type: 'sse',
                 url: `${GATEWAY_HTTP}/mcp`,
                 headers: { Authorization: `Bearer ${token}` },
-                // Force every 1Presence tool into the prompt from turn 1. Without this the
-                // SDK defers MCP tools behind tool-search, so the model sees tool *names*
-                // (from the system prompt) but has nothing callable and confabulates the
-                // call + result as text. Also blocks the turn until the MCP server connects
-                // (5s cap) — a loud failure beats a silent tool-less run. See vault/Bugs.md.
                 alwaysLoad: true,
             },
         },
@@ -264,24 +181,14 @@ async function writeSetupFiles(auth, agentSlug) {
     await writeSystemPrompt(auth, agentSlug);
     writeMcpConfig(auth);
 }
-// The MCP config embeds a Bearer JWT and the system prompt may contain vault
-// state. writeFileSync's mode only takes effect on file creation — chmodSync
-// covers the overwrite case so a legacy 0644 file gets tightened on next run.
 function writeRestricted(path, data) {
     writeFileSync(path, data, { mode: 0o600 });
     chmodSync(path, 0o600);
 }
-// ─── Helpers ──────────────────────────────────────────────────────────────────
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isUuid(value) {
     return UUID_RE.test(value);
 }
-// ─── Bridge vision reconstruction (no MCP, no chat turn) ──────────────────────
-//
-// A lightweight path for doc reproduction: the gateway sends a signed GCS URL +
-// system prompt. We download the document and call query() with NO MCP tools —
-// just a direct vision call using the user's claude.ai subscription. The whole
-// reply is collected into one string and sent back as doc_recon_response.
 async function handleDocReconRequest(req) {
     const send = (payload) => {
         if (currentWs?.readyState === WebSocket.OPEN)
@@ -306,8 +213,6 @@ async function handleDocReconRequest(req) {
     const sourceBlock = isImage
         ? { type: 'image', source: { type: 'base64', media_type: mediaType, data: base64 } }
         : { type: 'document', source: { type: 'base64', media_type: 'application/pdf', data: base64 } };
-    // Strip API key so this uses the user's claude.ai subscription (same as every
-    // bridge turn). Spread the rest of the env through — options.env REPLACES.
     const { ANTHROPIC_API_KEY: _stripped, ...safeEnv } = process.env;
     if (!safeEnv['MAX_MCP_OUTPUT_TOKENS'])
         safeEnv['MAX_MCP_OUTPUT_TOKENS'] = '200000';
@@ -326,9 +231,6 @@ async function handleDocReconRequest(req) {
         permissionMode: 'default',
         env: safeEnv,
     };
-    // Cast through `unknown[]` like buildPromptMessages in claude.ts — the SDK's
-    // discriminated content-block union won't accept the inferred-`string` `type`
-    // discriminants on these literals, but the shape is correct at runtime.
     const promptMessages = [{
             type: 'user',
             message: { role: 'user', content: [sourceBlock, { type: 'text', text: req.userText }] },
@@ -359,9 +261,7 @@ async function handleDocReconRequest(req) {
         }
     }
 }
-// ─── Handle a single incoming message (token refresh + spawn) ─────────────────
 async function handleMessage(conversationId, text, sessionId, history, auth, vaultFileOpen, clientCapabilities, syncedFolders, agentSlug, model) {
-    // Refresh JWT if <10 min remaining before spawning Claude
     let activeAuth = auth;
     try {
         const freshAuth = await ensureFreshToken(auth);
@@ -372,8 +272,6 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
         }
     }
     catch (err) {
-        // If the cached token still has time, proceed — refresh was preemptive.
-        // If it's already invalid, MCP calls will 401 mid-turn — fail fast instead.
         if (!isTokenValid(auth.token)) {
             const message = 'Authentication expired and refresh failed — please restart the bridge to sign in again.';
             stopTurnTimer();
@@ -385,13 +283,6 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
         }
         console.warn(`[bridge] token refresh failed (proceeding with current token): ${err.message}`);
     }
-    // Refresh the system prompt on every turn — the hosted runtime rebuilds its
-    // dynamic context per turn (vault state, connector status, palace, onboarding
-    // phase, newly enabled skills). If this fails we abort the turn rather than
-    // silently reuse a stale snapshot — parity with agent-api is the whole point
-    // of bridge mode, and stale prompts have caused user-visible regressions
-    // (e.g. agent vault-hunting for skills because the Skills authoritative
-    // rule was missing from the previous snapshot).
     try {
         await writeSystemPrompt(activeAuth, agentSlug);
     }
@@ -407,14 +298,7 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
     let responding = false;
     const accumulator = makeBridgeAccumulator();
     const startedAt = Date.now();
-    const turnSessionId = sessionId ?? conversationId; // gateway always supplies one; defensive fallback
-    // The CLI's `--session-id` is treated as a "claim this new session ID"
-    // operation — passing the same UUID across turns of one chat (which is
-    // what the presence sessionId is) makes turn 2 fail with "Session ID X
-    // is already in use", even with --no-session-persistence. Use the
-    // per-spawn conversationId instead — continuity comes from history
-    // replay via --input-format stream-json, not from CLI session tracking.
-    // turnSessionId is still kept for spool records / log correlation.
+    const turnSessionId = sessionId ?? conversationId;
     const claudePinnedSessionId = isUuid(conversationId) ? conversationId : crypto.randomUUID();
     function buildSpoolRecord(usage, model) {
         const s = accumulator.state();
@@ -435,21 +319,12 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
         };
     }
     async function finalizeAndPost(record) {
-        // Spool BEFORE the network call so a crash between here and the POST
-        // ack is recoverable by drain-on-startup. The gateway dedupes on
-        // conversationId, so a replay is idempotent.
         try {
             writeSpool(record);
         }
         catch (err) {
             console.warn(`[bridge] spool write failed: ${err.message}`);
         }
-        // Refresh the token right before the POST — this fires at turn END, when the
-        // most time has elapsed. A long turn (started with a token that was fresh
-        // then) must not 401 on save-turn with a since-expired token — the failure
-        // that left a run stuck at 'running' on 2026-07-07. Best-effort: on refresh
-        // failure fall back to the current token; the spool file is retried on the
-        // next successful POST or on the next bridge startup.
         try {
             const fresh = await ensureFreshToken(activeAuth);
             if (fresh.token !== activeAuth.token) {
@@ -465,8 +340,6 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
             deleteSpool(record.conversationId);
         }
         else {
-            // Leave the spool file in place — next startup or next successful
-            // POST opportunity will retry. Quietly log so users aren't alarmed.
             console.warn(`[bridge] save-turn POST failed (${result.status}): ${result.error ?? 'unknown'} — kept on disk for retry`);
         }
     }
@@ -491,10 +364,6 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
             }
         },
         onNotice: (message) => {
-            // Ephemeral, non-persisted thread notice (admin-only Local Mode). Relayed
-            // by the gateway to the PWA SSE stream as a `notice` AgentEvent; it does
-            // NOT go through the turn accumulator, so it never lands in history.
-            // Log it too: anything the user sees in chat must have a bridge-log trail.
             console.log(`[${new Date().toLocaleTimeString()}] ⚠ notice: ${message}`);
             if (currentWs?.readyState === WebSocket.OPEN) {
                 currentWs.send(JSON.stringify({ type: 'notice', conversationId, message }));
@@ -509,19 +378,13 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
             parts.push(costStr);
             const suffix = `  ${parts.join('  ')}`;
             console.log(`[${new Date().toLocaleTimeString()}] ✓ done${suffix}`);
-            // Status-bar line, mirroring the local Claude Code statusline:
-            //   🤖 model v<version> | 🧠 context% | 💰 cost
-            //   ⏱️ 5h <bar> n% resets … | 7d <bar> n% resets …
-            // Dimmed and indented so it groups under the done line without competing
-            // with it. The cost segment falls back to "plan usage" whenever the running
-            // total is 0 (the subscription case). The ⏱️ window line is only printed
-            // once the SDK has reported at least one window this process.
             sessionCostUsd += costUsd;
             const ctxPct = Math.max(0, Math.min(100, Math.round((contextTokens / contextWindowFor(model)) * 100)));
             const costSeg = sessionCostUsd > 0 ? `$${sessionCostUsd.toFixed(2)} session` : 'plan usage';
             const ver = getCliVersion();
             const verSeg = ver ? ` v${ver}` : '';
-            console.log(paint('90', `             🤖 ${friendlyModelName(model)}${verSeg} | 🧠 ${ctxPct}% | 💰 ${costSeg}`));
+            const whoSeg = currentAuth?.email ? ` | 👤 ${currentAuth.email}` : '';
+            console.log(paint('90', `             🤖 ${friendlyModelName(model)}${verSeg} | 🧠 ${ctxPct}% | 💰 ${costSeg}${whoSeg}`));
             const windows = [
                 formatWindow('5h', getRateLimitWindow('five_hour')),
                 formatWindow('7d', sevenDayWindow()),
@@ -540,7 +403,6 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
                     usage: mapped,
                 }));
             }
-            // HTTP fallback runs unconditionally — gateway dedupes against WS path.
             void finalizeAndPost(buildSpoolRecord(mapped, model));
         },
         onError: (message, usage, model) => {
@@ -560,7 +422,6 @@ async function handleMessage(conversationId, text, sessionId, history, auth, vau
         },
     });
 }
-// ─── Usage shape adapter ──────────────────────────────────────────────────────
 function toBridgeUsage(usage) {
     if (!usage)
         return null;
@@ -571,12 +432,6 @@ function toBridgeUsage(usage) {
         cacheCreationTokens: usage.cache_creation_input_tokens,
     };
 }
-// ─── Outbox drain ─────────────────────────────────────────────────────────────
-//
-// On bridge startup and on every successful reconnect, replay any spool
-// records that didn't get a successful POST ack last time. The gateway
-// dedupes on conversationId — if it already saved via the WS path, the
-// reply is finalized=false and we still delete the spool.
 async function drainOutbox(auth) {
     const records = listSpool();
     if (records.length === 0)
@@ -592,14 +447,15 @@ async function drainOutbox(auth) {
         }
     }
 }
-// ─── WebSocket connection ─────────────────────────────────────────────────────
-// Application-level heartbeat — avoids relying on WebSocket control frames (ping/pong),
-// which some proxies (GKE LB) may not forward reliably.
 const PING_INTERVAL_MS = 30_000;
 const PONG_TIMEOUT_MS = 10_000;
 function connect(auth, retryDelay = 1000) {
     const ws = new WebSocket(GATEWAY_WS, {
-        headers: { Authorization: `Bearer ${auth.token}` },
+        headers: {
+            Authorization: `Bearer ${auth.token}`,
+            'X-Bridge-Capabilities': 'displace-4004',
+            'X-Bridge-Version': version,
+        },
     });
     let pingTimer = null;
     let pongTimer = null;
@@ -626,11 +482,7 @@ function connect(auth, retryDelay = 1000) {
     }
     ws.on('open', () => {
         currentWs = ws;
-        // Reset backoff so that a disconnect after a long-stable session
-        // reconnects quickly instead of waiting at the 30s cap.
         retryDelay = 1000;
-        // A clean connection means whatever token we hold is accepted — clear the
-        // 4001 refresh-retry budget so a future expiry gets the full allowance.
         authRejections = 0;
         const who = auth.email ? ` as ${auth.email}` : '';
         if (disconnectedAt !== null) {
@@ -642,9 +494,6 @@ function connect(auth, retryDelay = 1000) {
             console.log(`✓ Bridge connected${who}. Local Mode active on all your devices.\n`);
         }
         startPing();
-        // Drain any save records left behind by an earlier crashed/dropped session.
-        // Fire-and-forget — the network is up, the gateway is reachable, and we
-        // don't want to block message handling on this.
         if (currentAuth) {
             drainOutbox(currentAuth).catch(err => console.warn(`[bridge] drain failed: ${err.message}`));
         }
@@ -659,7 +508,6 @@ function connect(auth, retryDelay = 1000) {
             console.error(`[bridge] failed to parse ws message as JSON: ${err.message} (raw: ${preview})`);
             return;
         }
-        // Application-level pong — clear the timeout
         if (msg.type === 'pong') {
             if (pongTimer) {
                 clearTimeout(pongTimer);
@@ -667,9 +515,6 @@ function connect(auth, retryDelay = 1000) {
             }
             return;
         }
-        // Stop button: the gateway relays a cancel when the user abandons the turn
-        // (PWA→gateway connection dropped). Kill the local Claude Code process for
-        // this conversation so it stops generating instead of running to the end.
         if (msg.type === 'cancel' && msg.conversationId) {
             const cancelled = cancelConversation(msg.conversationId);
             if (cancelled)
@@ -702,49 +547,32 @@ function connect(auth, retryDelay = 1000) {
     });
     ws.on('close', (code) => {
         stopPing();
-        // Permission genuinely not granted — no token refresh can fix this, so it
-        // stays terminal.
         if (code === 4003) {
             console.error('Local Claude Code is not enabled for your account. To request access, email hello@1presence.com.');
             process.exit(1);
         }
-        // Everything else — including 4001 (gateway rejected the JWT) — is handled
-        // by scheduleReconnect, which refreshes the token before reconnecting so an
-        // expired-token disconnect recovers on its own instead of forcing a manual
-        // bridge restart.
+        if (code === 4004) {
+            if (ws !== currentWs) {
+                console.log('[bridge] ignoring a "replaced" close for a socket we already reconnected past.');
+                return;
+            }
+            console.log('\nAnother 1Presence bridge connected for this account — this one has exited.');
+            console.log('Local Mode runs one bridge per account: the newest connection serves your turns.');
+            killAll();
+            process.exit(0);
+        }
         scheduleReconnect(code, retryDelay);
     });
     ws.on('error', (err) => {
-        // close event fires after error — reconnect handled there
         console.error(`[bridge] ws error: ${err.message}`);
         if (VERBOSE && err.stack)
             console.error(err.stack);
     });
     return ws;
 }
-// ─── Reconnect with token refresh ──────────────────────────────────────────────
-//
-// Schedules a reconnect after any non-terminal disconnect. The job this does
-// that the old inline handler didn't: it mints a fresh ID token BEFORE
-// reconnecting. Firebase ID tokens last ~1h, and the only place the bridge
-// previously refreshed was per-turn (handleMessage). So an idle bridge whose
-// socket dropped during a deploy/restart would reconnect carrying an expired
-// token → 401 on the system-prompt fetch and 4001 on the new socket → the old
-// handler then hard-exited with "please restart the bridge". Now it self-heals.
-//
-//  • 4001 (gateway rejected the JWT): force a refresh — the gateway's verdict
-//    beats our local clock. Bounded by MAX_AUTH_REJECTIONS so a genuinely dead
-//    account (revoked permission, no refresh token) still exits instead of
-//    looping. Exits only when refresh is impossible or repeatedly rejected.
-//  • Any other code (1006 abnormal close, 1001 going-away on pod restart, …):
-//    refresh only if near expiry (ensureFreshToken). A transient refresh
-//    failure here is non-fatal — reconnect with the current token; if it's
-//    truly expired the gateway returns 4001 and the branch above handles it.
 function scheduleReconnect(closeCode, retryDelay) {
     const authFailure = closeCode === 4001;
     const delay = Math.min(retryDelay, 30_000);
-    // Stamp the start of the outage — only on the first drop, so the offline
-    // duration reported on reconnect spans failed retry cycles too.
     if (disconnectedAt === null)
         disconnectedAt = Date.now();
     const who = currentAuth?.email ? ` for ${currentAuth.email}` : '';
@@ -771,8 +599,6 @@ function scheduleReconnect(closeCode, retryDelay) {
                 console.log(`[bridge] token refreshed (attempt ${authRejections}/${MAX_AUTH_REJECTIONS}) — reconnecting with a new token.`);
             }
             catch (err) {
-                // Refresh endpoint rejected us — the refresh token is revoked/expired.
-                // No silent recovery is possible; the user must sign in again.
                 console.error(`[bridge] token refresh failed: ${err.message}`);
                 console.error('Please restart the bridge to sign in again.');
                 process.exit(1);
@@ -786,9 +612,6 @@ function scheduleReconnect(closeCode, retryDelay) {
                 console.warn(`[bridge] token refresh on reconnect failed (proceeding with current token): ${err.message}`);
             }
         }
-        // Token is as fresh as we can make it — write setup files and reconnect.
-        // If /system-prompt-for-bridge is still 503/down (gateway waking) we
-        // reconnect anyway; handleMessage refreshes the prompt on the next turn.
         try {
             await writeSetupFiles(currentAuth);
         }
@@ -799,19 +622,10 @@ function scheduleReconnect(closeCode, retryDelay) {
         connect(currentAuth, nextDelay);
     }, delay);
 }
-// ─── Main ─────────────────────────────────────────────────────────────────────
-// Check the LOCAL Claude Code sign-in (the user's own claude.ai subscription
-// OAuth, distinct from the 1Presence gateway login above) before connecting.
-// Local Mode drives Claude Code through the Agent SDK, so if Claude Code isn't
-// signed in every turn fails with the `local_auth` code (and pages ops). Catch
-// it up front: probe, and if signed out, offer to sign in here — polling also
-// picks up a sign-in the user does in another terminal, and the SDK re-reads
-// credentials each turn, so no restart is needed once signed in. Any uncertainty
-// (old CLI without `auth status`, probe error) is treated as "don't block".
 async function ensureClaudeCodeLogin() {
     const status = await probeClaudeAuth();
     if (status === null)
-        return; // unknown — don't gate startup on a probe we can't trust
+        return;
     if (status.loggedIn) {
         const who = status.email ? ` as ${status.email}` : '';
         const plan = status.subscriptionType ? ` (${status.subscriptionType})` : '';
@@ -829,9 +643,6 @@ async function ensureClaudeCodeLogin() {
         console.log('  Skipping sign-in. Messages will fail until you run `claude auth login` — sign in any time and resend.\n');
         return;
     }
-    // Best-effort: open the sign-in right here. If the CLI is too old for
-    // `auth login`, this returns false and the poll still catches a sign-in the
-    // user does in another terminal.
     const launched = await launchClaudeLogin();
     if (!launched) {
         console.log('  Couldn’t open sign-in automatically. In another terminal run:  claude auth login');
@@ -860,19 +671,10 @@ async function main() {
     }
     if (await checkAndUpdate())
         return;
-    // Auth
     const auth = await getValidAuth(GATEWAY_HTTP, PWA_URL);
     currentAuth = auth;
-    // One-time interactive model choice (only prompts on first run; saved to
-    // ~/.1presence/config.json). In a non-TTY environment this is a no-op and
-    // Claude Code's own default is used.
     await ensureModelChoice();
-    // Local Claude Code sign-in check (see fn comment). Runs before setup/connect
-    // so a signed-out user is guided in up front rather than hitting a failed turn.
     await ensureClaudeCodeLogin();
-    // Write system prompt + MCP config. If this fails the bridge is dead in the
-    // water — surface the underlying error rather than letting it bubble up as
-    // a generic "Fatal:" with no context.
     process.stdout.write('Setting up…');
     try {
         await writeSetupFiles(auth);
@@ -884,9 +686,7 @@ async function main() {
         process.exit(1);
     }
     process.stdout.write(' done.\n');
-    // Connect
     connect(auth);
-    // Graceful shutdown
     const shutdown = () => {
         console.log('\nShutting down…');
         killAll();
@@ -894,9 +694,6 @@ async function main() {
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
-    // Surface anything that would otherwise vanish into the void. Without these,
-    // a thrown error inside an async callback (ws handler, child process event,
-    // setTimeout) silently kills the bridge with no diagnostic.
     process.on('uncaughtException', (err) => {
         console.error(`[bridge] uncaughtException: ${err.message}`);
         if (err.stack)

package/dist/outbox.js

@@ -1,20 +1,6 @@
 import { mkdirSync, writeFileSync, readdirSync, readFileSync, unlinkSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
-// ─── On-disk turn spool ───────────────────────────────────────────────────────
-//
-// Each in-flight bridge turn writes a record to ~/.1presence/outbox/. The file
-// exists from the moment the turn starts until the gateway acks the save-turn
-// POST. If the bridge is killed (Ctrl+C, terminal closed, crash) between
-// Claude finishing and the ack landing, the next startup drains the directory
-// — covering the failure mode the WS+HTTP path alone can't.
-//
-// Records are keyed by conversationId, which the gateway also dedupes on, so
-// a drained replay is idempotent: if it already saved via WS, the POST is a
-// 200 no-op and the spool file is deleted.
-//
-// Payload mode 0600 — the file contains the user's assistant transcript and
-// tool inputs. Tightened on every write to handle legacy world-readable files.
 const OUTBOX_DIR = join(homedir(), '.1presence', 'outbox');
 function ensureDir() {
     mkdirSync(OUTBOX_DIR, { recursive: true });
@@ -30,7 +16,7 @@ export function deleteSpool(conversationId) {
     try {
         unlinkSync(pathFor(conversationId));
     }
-    catch { /* already gone — fine */ }
+    catch { }
 }
 export function listSpool() {
     ensureDir();
@@ -43,7 +29,6 @@ export function listSpool() {
             out.push(JSON.parse(raw));
         }
         catch {
-            // Malformed file — leave it alone so a human can inspect.
         }
     }
     return out;

package/dist/sessionPath.js

@@ -1,27 +1,10 @@
 import { homedir } from 'os';
 import { join, resolve, sep } from 'path';
-// Confinement guard for read_session_file (the in-process `local` MCP server in
-// claude.ts). The Agent SDK occasionally spills a large MCP tool result to a
-// local file under ~/.claude/projects/<cwd-slug>/<session-id>/ and hands the
-// model a stub telling it to read the file. Local Mode disables every built-in
-// tool, so the model has no Read — read_session_file is the recovery path. It
-// MUST stay read-only and confined to the CURRENT session's own folder: file
-// contents read here flow up through the gateway into the model and session
-// history, so an unrestricted reader would leak the operator's machine
-// (~/.ssh, other projects) into the transcript.
-//
-// We deliberately do NOT reconstruct Claude Code's lossy cwd-slug. Instead we
-// require (a) the resolved path to live under ~/.claude/projects/ and (b) the
-// current session UUID to appear as a discrete path segment. The UUID is
-// unguessable, so this pins reads to this session alone while staying robust to
-// changes in how Claude Code encodes the cwd.
-//
-// Returns the resolved absolute path when safe, or null when it must be refused.
 export function resolveSessionFilePath(requestedPath, sessionId, home = homedir()) {
     if (!sessionId || !requestedPath)
         return null;
     const projectsRoot = join(home, '.claude', 'projects');
-    const resolved = resolve(requestedPath); // normalises away `..`
+    const resolved = resolve(requestedPath);
     const underProjects = resolved === projectsRoot || resolved.startsWith(projectsRoot + sep);
     if (!underProjects)
         return null;

package/dist/timer.js

@@ -1,7 +1,3 @@
-// Live elapsed-time indicator for the active turn. Writes `\r\x1b[K⏱  Xs`
-// once per second; wraps console.log/error/warn so that any other output
-// clears the timer line before printing, then redraws the timer on the new
-// bottom line. Idempotent — stop is safe to call multiple times.
 let intervalId = null;
 let startedAt = 0;
 let originalLog = null;

package/dist/update.js

@@ -1,7 +1,5 @@
 import { spawn } from 'child_process';
 import { createRequire } from 'module';
-// ESM JSON imports need version-sensitive import assertions; createRequire reads
-// the manifest synchronously on every Node 18+ without that fragility.
 const { version } = createRequire(import.meta.url)('../package.json');
 function isNewer(a, b) {
     const pa = a.split('.').map(Number);
@@ -34,7 +32,6 @@ export async function checkAndUpdate() {
         return true;
     }
     catch {
-        // Non-fatal — registry unreachable or fetch unavailable (old Node)
         return false;
     }
 }