@nopeek/agent-bridge 0.5.6 → 0.6.0

package/dist/bridge.js

@@ -1,10 +1,13 @@
 // Orchestrator. A bridge has two states:
 //   unpaired — local control API up, waiting for the NoPeek app to POST /pair
-//   paired   — runs every bot the runtime owns (GET /runtime/bots), keeps the
-//              fleet current via the control WebSocket (adopt_bot arrives live),
-//              and still serves the local API for status + live brain changes.
+//   paired   — one PairingRuntime PER PAIRED ACCOUNT, each with its own control
+//              WebSocket and bot fleet (GET /runtime/bots + live adopt_bot),
+//              all running simultaneously; the local API serves status + live
+//              brain changes across all of them.
 // Pairing, unpairing and brain config all happen at runtime (from the app) and
-// persist to <home>/settings.json — no restart, no terminal.
+// persist to <home>/settings.json — no restart, no terminal. Brains
+// (brainMap/serverBackends) are GLOBAL per machine: handles are globally
+// unique, so a handle→brain map needs no per-account scoping.
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
 import { saveSettings } from "./config.js";
@@ -14,7 +17,7 @@ import { resolveBrain } from "./brain.js";
 import { provisionSoul, provisionHermesProfile } from "./backends.js";
 import { reportCapabilities } from "./capabilities.js";
 import { isBrainBackend } from "./config.js";
-export const VERSION = "0.5.6";
+export const VERSION = "0.6.0";
 /** How often to re-probe + report brain availability to the server. */
 const CAPABILITIES_INTERVAL_MS = 5 * 60_000;
 export class PairError extends Error {
@@ -24,51 +27,278 @@ export class PairError extends Error {
         this.code = code;
     }
 }
-export class BridgeApp {
+/**
+ * Everything ONE pairing runs: its control WebSocket, its bot fleet, and its
+ * capabilities reports. This is exactly the pre-0.6 single-account core; the
+ * BridgeApp now manages a list of these, one per paired NoPeek account.
+ * Device-key stores are per bot USER id, so fleets never collide.
+ */
+class PairingRuntime {
+    pairing;
+    app;
     cfg;
-    startedAt = Date.now();
     bots = new Map(); // botUserId -> runner
     control = null;
-    capabilitiesTimer = null;
     stopped = false;
-    constructor(cfg) {
+    // A handle is provisioned at most once per process; the persisted BRAIN_MAP
+    // entry prevents re-provisioning across restarts.
+    provisioning = new Set();
+    tag;
+    constructor(app, cfg, pairing) {
+        this.app = app;
         this.cfg = cfg;
+        this.pairing = pairing;
+        this.tag = `[bridge:${pairing.label ?? pairing.appId}]`;
     }
-    get paired() {
-        return Boolean(this.cfg.pairingCode && this.cfg.appId);
-    }
-    /** Known once the control socket has authenticated at least once. */
+    /** Persisted (from pair time) or learned from the control socket's auth.ok. */
     get runtimeId() {
-        return this.control?.runtimeId ?? null;
+        return this.control?.runtimeId ?? this.pairing.runtimeId ?? null;
     }
     get controlConnected() {
         return this.control?.connected ?? false;
     }
     start() {
-        if (this.paired)
-            this.startCore();
-        else
+        if (this.stopped || this.control)
+            return;
+        this.control = new ControlSocket(this.pairing, {
+            onAuthed: (runtimeId) => {
+                // The server-issued runtime id is authoritative — persist it so the
+                // local API can keep authorizing this pairing across restarts.
+                if (runtimeId && this.pairing.runtimeId !== runtimeId) {
+                    this.pairing.runtimeId = runtimeId;
+                    saveSettings(this.cfg);
+                }
+                // Initial connect AND every reconnect: catch up on bots created while
+                // we were away (adopt_bot frames we may have missed).
+                void this.syncBots().catch((err) => {
+                    console.error(`${this.tag} bot sync failed: ${err.message}`);
+                });
+                // Report which brains this computer can run so the phone's picker is
+                // current (initial connect + every reconnect). Non-fatal on failure.
+                void reportCapabilities(this.cfg, this.pairing);
+            },
+            onAdoptBot: (f) => {
+                if (f.backend)
+                    this.app.applyServerBackend(f.handle, f.backend);
+                this.startBot({ userId: f.botUserId, handle: f.handle, ownerId: f.ownerUserId, backend: f.backend });
+            },
+            onGrantChanged: (f) => {
+                // Access changed for a bot — re-pull its allow list so enforcement is
+                // live (a revoked user stops being answered within seconds).
+                const runner = this.bots.get(f.botUserId);
+                if (runner)
+                    void runner.refreshAccess();
+            },
+            onBotConfig: (f) => {
+                // The owner changed this bot's brain from the phone. Record the server
+                // backend and re-resolve live — the runner resolves per message off the
+                // shared cfg, so the NEXT message already uses it; we also refresh the
+                // cached kind so status reflects it immediately. A running bot is keyed
+                // by userId; map it to a handle via its runner.
+                const runner = this.bots.get(f.botUserId);
+                if (!runner) {
+                    console.log(`${this.tag} bot_config_changed for ${f.botUserId} not running yet — applied on next sync/adopt`);
+                    return;
+                }
+                this.app.applyServerBackend(runner.info.handle, f.backend);
+                runner.refreshBrainKind();
+            },
+        });
+        // Bots first (so a control-socket hiccup doesn't delay serving), then the
+        // control socket, whose auth.ok triggers a redundant-but-safe re-sync.
+        void this.syncBots().catch((err) => {
+            console.error(`${this.tag} initial bot sync failed (will retry on control auth): ${err.message}`);
+        });
+        this.control.start();
+    }
+    stop() {
+        this.stopped = true;
+        this.control?.stop();
+        this.control = null;
+        for (const b of this.bots.values())
+            b.stop();
+        this.bots.clear();
+    }
+    status() {
+        return {
+            runtimeId: this.runtimeId,
+            appId: this.pairing.appId,
+            label: this.pairing.label ?? null,
+            connected: this.controlConnected,
+            bots: this.botStatuses(),
+        };
+    }
+    botStatuses() {
+        return [...this.bots.values()].map((b) => ({
+            handle: b.info.handle,
+            userId: b.info.userId,
+            connected: b.connected,
+            handled: b.handled,
+            brain: resolveBrain(this.cfg, b.info.handle).kind,
+        }));
+    }
+    // ---------------------------------------------------------------- core ----
+    startBot(info) {
+        if (this.bots.has(info.userId))
+            return; // already running
+        const runner = new BotRunner(info, this.cfg, this.pairing);
+        this.bots.set(info.userId, runner);
+        runner.start(); // background; failures are isolated inside the runner
+        void this.provisionBrain(info); // background; bot echoes until it lands
+    }
+    /**
+     * Auto-provision a brain for a newly adopted bot: run BRAIN_PROVISION_CMD
+     * (e.g. "create a Hermes profile with its own soul + memory for this handle")
+     * and store its stdout as the bot's brain command. Best-effort — on any
+     * failure the bot simply keeps the default brain.
+     */
+    async provisionBrain(info) {
+        const cmd = this.cfg.brainProvisionCmd;
+        const handle = info.handle.replace(/^@/, "");
+        // A server-mediated backend (picked on the phone) makes auto-provisioning
+        // moot — provisioning would only produce a default that must lose anyway.
+        if (!cmd || this.cfg.brainMap[handle] || this.cfg.serverBackends[handle] || this.provisioning.has(handle))
+            return;
+        this.provisioning.add(handle);
+        console.log(`[provision:@${handle}] running brain provisioner`);
+        const out = await new Promise((resolvePromise) => {
+            const child = spawn("bash", ["-c", cmd], {
+                stdio: ["ignore", "pipe", "pipe"],
+                env: { ...process.env, NOPEEK_BOT_HANDLE: handle, NOPEEK_BOT_USER_ID: info.userId },
+            });
+            let stdout = "";
+            let stderr = "";
+            const timer = setTimeout(() => {
+                child.kill("SIGKILL");
+                resolvePromise(null);
+            }, 120_000);
+            child.stdout.on("data", (d) => (stdout += d.toString()));
+            child.stderr.on("data", (d) => (stderr += d.toString()));
+            child.on("error", () => {
+                clearTimeout(timer);
+                resolvePromise(null);
+            });
+            child.on("close", (code) => {
+                clearTimeout(timer);
+                if (code !== 0) {
+                    console.error(`[provision:@${handle}] exit ${code}. stderr: ${stderr.slice(0, 1000)}`);
+                    resolvePromise(null);
+                    return;
+                }
+                resolvePromise(stdout.trim());
+            });
+        });
+        if (!out) {
+            console.error(`[provision:@${handle}] provisioner produced no brain command — bot keeps the default brain`);
+            return;
+        }
+        // Use the LAST non-empty stdout line: provisioners may log progress above it.
+        const brainCmd = out.split("\n").map((l) => l.trim()).filter(Boolean).pop();
+        this.app.setBrains({ map: { [handle]: { cmd: brainCmd, auto: true } } });
+        console.log(`[provision:@${handle}] brain provisioned`);
+    }
+    /** Fetch this pairing's authoritative bot list and start anything missing. */
+    async syncBots() {
+        const res = await fetch(`${this.pairing.apiUrl}/v1/apps/${this.pairing.appId}/runtime/bots`, {
+            headers: { authorization: `Bearer ${this.pairing.pairingCode}` },
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            throw new Error(`GET /runtime/bots HTTP ${res.status}: ${body.slice(0, 300)}`);
+        }
+        const { bots: list } = (await res.json());
+        console.log(`${this.tag} runtime owns ${list.length} bot(s): ${list.map((b) => `@${b.handle}`).join(", ") || "(none yet)"}`);
+        for (const info of list) {
+            // Record any server-mediated backend BEFORE starting the runner so its
+            // first brain resolution already sees it (local overrides still win).
+            const serverBackend = info.backend ?? info.brainBackend;
+            if (serverBackend)
+                this.app.applyServerBackend(info.handle, serverBackend);
+            this.startBot(info);
+        }
+    }
+}
+export class BridgeApp {
+    cfg;
+    startedAt = Date.now();
+    runtimes = [];
+    capabilitiesTimer = null;
+    stopped = false;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    get paired() {
+        return this.cfg.pairings.length > 0;
+    }
+    /** Every runtime id this bridge answers for (persisted or live-auth'd).
+     *  The local API accepts ANY of these as the x-nopeek-runtime capability. */
+    runtimeIds() {
+        const ids = [];
+        for (const r of this.runtimes) {
+            const id = r.runtimeId;
+            if (id && !ids.includes(id))
+                ids.push(id);
+        }
+        return ids;
+    }
+    start() {
+        if (!this.paired) {
             console.log(`[bridge] not paired yet — open the NoPeek app: Bots -> Connect this computer`);
+            return;
+        }
+        for (const pairing of this.cfg.pairings)
+            this.startRuntime(pairing);
     }
     stop() {
         this.stopped = true;
-        this.stopCore();
+        if (this.capabilitiesTimer) {
+            clearInterval(this.capabilitiesTimer);
+            this.capabilitiesTimer = null;
+        }
+        for (const r of this.runtimes)
+            r.stop();
+        this.runtimes = [];
+    }
+    startRuntime(pairing) {
+        if (this.stopped)
+            return;
+        if (this.runtimes.some((r) => r.pairing.pairingCode === pairing.pairingCode))
+            return;
+        const rt = new PairingRuntime(this, this.cfg, pairing);
+        this.runtimes.push(rt);
+        rt.start();
+        this.ensureCapabilitiesTimer();
+    }
+    /** Re-probe + report brain availability every ~5 min (once per pairing) so a
+     *  login/logout on this computer surfaces in each account's picker without a
+     *  reconnect. onAuthed covers initial + reconnect reports; this covers drift.
+     *  unref so a running interval never keeps the process alive on its own. */
+    ensureCapabilitiesTimer() {
+        if (this.capabilitiesTimer)
+            return;
+        this.capabilitiesTimer = setInterval(() => {
+            for (const r of this.runtimes)
+                void reportCapabilities(this.cfg, r.pairing);
+        }, CAPABILITIES_INTERVAL_MS);
+        this.capabilitiesTimer.unref?.();
     }
     // ------------------------------------------------------------- pairing ----
     /**
-     * Pair this bridge from the NoPeek app. Only accepted while UNPAIRED (an
-     * attacker on a webpage can't silently re-point an already-working bridge).
-     * The secret is validated against the API before anything is persisted.
+     * Pair ANOTHER NoPeek account onto this bridge (or the first one — same
+     * flow). Every request is validated against the API before anything is
+     * persisted: the npr_ secret is server-minted and unguessable, so possession
+     * of a VALID one is the proof. Only an exact duplicate (same secret, i.e.
+     * literally the same pairing) is rejected.
      */
     async pair(req) {
-        if (this.paired) {
-            throw new PairError("ALREADY_PAIRED", "This bridge is already paired. Unpair it first (from the NoPeek app) or revoke the runtime.");
-        }
         const pairingSecret = typeof req.pairingSecret === "string" ? req.pairingSecret.trim() : "";
         const appId = typeof req.appId === "string" ? req.appId.trim() : "";
         if (!pairingSecret || !appId) {
             throw new PairError("BAD_REQUEST", "pairingSecret and appId are required.");
         }
+        if (this.cfg.pairings.some((p) => p.pairingCode === pairingSecret)) {
+            throw new PairError("ALREADY_PAIRED", "This exact pairing is already active on this bridge.");
+        }
         const apiUrl = (typeof req.apiUrl === "string" && req.apiUrl.trim() ? req.apiUrl.trim() : this.cfg.apiUrl).replace(/\/+$/, "");
         // Validate before persisting: the bot list doubles as an auth probe.
         let res;
@@ -84,23 +314,54 @@ export class BridgeApp {
         if (!res.ok) {
             throw new PairError("PAIR_REJECTED", `the API rejected this pairing secret (HTTP ${res.status}).`);
         }
-        this.cfg.apiUrl = apiUrl;
-        this.cfg.appId = appId;
-        this.cfg.pairingCode = pairingSecret;
+        const label = typeof req.label === "string" && req.label.trim() ? req.label.trim().slice(0, 120) : undefined;
+        const runtimeId = typeof req.runtimeId === "string" && req.runtimeId.trim() ? req.runtimeId.trim() : undefined;
+        const pairing = {
+            appId,
+            pairingCode: pairingSecret,
+            apiUrl,
+            ...(label ? { label } : {}),
+            ...(runtimeId ? { runtimeId } : {}),
+        };
+        this.cfg.pairings.push(pairing);
         saveSettings(this.cfg);
-        console.log(`[bridge] paired with app ${appId} — starting bots`);
-        this.startCore();
+        console.log(`[bridge] paired with app ${appId}${label ? ` (${label})` : ""} — ${this.cfg.pairings.length} account(s) now — starting bots`);
+        this.startRuntime(pairing);
+        return pairing;
     }
-    /** Undo pairing: stop everything, forget the credential (device keys stay). */
-    unpair() {
-        console.log(`[bridge] unpairing — stopping bots and forgetting the pairing secret`);
-        this.stopCore();
-        this.cfg.pairingCode = null;
-        this.cfg.appId = null;
+    /**
+     * Undo pairing (device keys stay either way).
+     *   unpair()            — legacy no-arg: remove EVERY pairing (pre-0.6 shape).
+     *   unpair(runtimeId)   — remove just that account's pairing; others keep running.
+     * Returns false when a runtimeId was given but matches no pairing.
+     */
+    unpair(runtimeId) {
+        if (!runtimeId) {
+            console.log(`[bridge] unpairing ALL ${this.cfg.pairings.length} account(s) — stopping bots and forgetting the pairing secrets`);
+            for (const r of this.runtimes)
+                r.stop();
+            this.runtimes = [];
+            this.cfg.pairings.length = 0;
+            saveSettings(this.cfg);
+            return true;
+        }
+        const rt = this.runtimes.find((r) => r.runtimeId === runtimeId);
+        const idx = this.cfg.pairings.findIndex((p) => p.runtimeId === runtimeId || (rt ? p.pairingCode === rt.pairing.pairingCode : false));
+        if (idx < 0 && !rt)
+            return false;
+        console.log(`[bridge] unpairing runtime ${runtimeId} — its bots stop; other accounts keep running`);
+        if (rt) {
+            rt.stop();
+            this.runtimes = this.runtimes.filter((r) => r !== rt);
+        }
+        if (idx >= 0)
+            this.cfg.pairings.splice(idx, 1);
         saveSettings(this.cfg);
+        return true;
     }
     // -------------------------------------------------------------- brains ----
-    /** Apply a brain change live (next message uses it) and persist it. */
+    /** Apply a brain change live (next message uses it) and persist it.
+     *  Brains are GLOBAL per machine — handles are globally unique. */
     setBrains(patch) {
         if (patch.brainCmd !== undefined)
             this.cfg.brainCmd = patch.brainCmd || null;
@@ -151,6 +412,7 @@ export class BridgeApp {
      * either way but is inert while a local override exists. When it IS the
      * effective brain (no local override), provision the soul/profile up front so
      * the very first message doesn't wait on it. Persisted for reconnects.
+     * (Internal — called by each PairingRuntime; the map is machine-global.)
      */
     applyServerBackend(rawHandle, backend) {
         const handle = rawHandle.replace(/^@/, "");
@@ -196,20 +458,29 @@ export class BridgeApp {
     // -------------------------------------------------------------- status ----
     statusMinimal() {
         return {
-            ok: this.paired ? this.controlConnected : true,
+            ok: this.paired ? this.runtimes.length > 0 && this.runtimes.every((r) => r.controlConnected) : true,
             service: "nopeek-agent-bridge",
             version: VERSION,
             paired: this.paired,
+            // Count only — this endpoint is unauthenticated, and runtime ids are the
+            // local API's auth capability, so they must never appear here.
+            pairings: this.cfg.pairings.length,
             machine: hostname(),
             uptime: Math.round((Date.now() - this.startedAt) / 1000),
         };
     }
-    statusFull() {
+    /** Full status (authenticated). `callerRuntimeId` — when known — keeps the
+     *  legacy top-level `runtime`/`appId` fields pointing at the CALLER's own
+     *  pairing so pre-0.6 clients keep working unchanged. */
+    statusFull(callerRuntimeId) {
+        const own = (callerRuntimeId && this.runtimes.find((r) => r.runtimeId === callerRuntimeId)) || this.runtimes[0] || null;
         return {
             ...this.statusMinimal(),
-            runtime: this.runtimeId,
-            apiUrl: this.cfg.apiUrl,
-            appId: this.cfg.appId,
+            runtime: own?.runtimeId ?? null,
+            apiUrl: own?.pairing.apiUrl ?? this.cfg.apiUrl,
+            appId: own?.pairing.appId ?? null,
+            // All paired accounts, each with its own runtime id + bot fleet.
+            pairings: this.runtimes.map((r) => r.status()),
             brains: {
                 default: this.cfg.brainCmd
                     ? { cmd: this.cfg.brainCmd }
@@ -220,163 +491,8 @@ export class BridgeApp {
                 serverBackends: this.cfg.serverBackends,
                 provisionCmd: this.cfg.brainProvisionCmd,
             },
-            bots: [...this.bots.values()].map((b) => ({
-                handle: b.info.handle,
-                userId: b.info.userId,
-                connected: b.connected,
-                handled: b.handled,
-                brain: resolveBrain(this.cfg, b.info.handle).kind,
-            })),
+            // Legacy flat list = every pairing's bots (pre-0.6 clients read this).
+            bots: this.runtimes.flatMap((r) => r.botStatuses()),
         };
     }
-    // ---------------------------------------------------------------- core ----
-    startBot(info) {
-        if (this.bots.has(info.userId))
-            return; // already running
-        const runner = new BotRunner(info, this.cfg);
-        this.bots.set(info.userId, runner);
-        runner.start(); // background; failures are isolated inside the runner
-        void this.provisionBrain(info); // background; bot echoes until it lands
-    }
-    // A handle is provisioned at most once per process; the persisted BRAIN_MAP
-    // entry prevents re-provisioning across restarts.
-    provisioning = new Set();
-    /**
-     * Auto-provision a brain for a newly adopted bot: run BRAIN_PROVISION_CMD
-     * (e.g. "create a Hermes profile with its own soul + memory for this handle")
-     * and store its stdout as the bot's brain command. Best-effort — on any
-     * failure the bot simply keeps the default brain.
-     */
-    async provisionBrain(info) {
-        const cmd = this.cfg.brainProvisionCmd;
-        const handle = info.handle.replace(/^@/, "");
-        // A server-mediated backend (picked on the phone) makes auto-provisioning
-        // moot — provisioning would only produce a default that must lose anyway.
-        if (!cmd || this.cfg.brainMap[handle] || this.cfg.serverBackends[handle] || this.provisioning.has(handle))
-            return;
-        this.provisioning.add(handle);
-        console.log(`[provision:@${handle}] running brain provisioner`);
-        const out = await new Promise((resolvePromise) => {
-            const child = spawn("bash", ["-c", cmd], {
-                stdio: ["ignore", "pipe", "pipe"],
-                env: { ...process.env, NOPEEK_BOT_HANDLE: handle, NOPEEK_BOT_USER_ID: info.userId },
-            });
-            let stdout = "";
-            let stderr = "";
-            const timer = setTimeout(() => {
-                child.kill("SIGKILL");
-                resolvePromise(null);
-            }, 120_000);
-            child.stdout.on("data", (d) => (stdout += d.toString()));
-            child.stderr.on("data", (d) => (stderr += d.toString()));
-            child.on("error", () => {
-                clearTimeout(timer);
-                resolvePromise(null);
-            });
-            child.on("close", (code) => {
-                clearTimeout(timer);
-                if (code !== 0) {
-                    console.error(`[provision:@${handle}] exit ${code}. stderr: ${stderr.slice(0, 1000)}`);
-                    resolvePromise(null);
-                    return;
-                }
-                resolvePromise(stdout.trim());
-            });
-        });
-        if (!out) {
-            console.error(`[provision:@${handle}] provisioner produced no brain command — bot keeps the default brain`);
-            return;
-        }
-        // Use the LAST non-empty stdout line: provisioners may log progress above it.
-        const brainCmd = out.split("\n").map((l) => l.trim()).filter(Boolean).pop();
-        this.setBrains({ map: { [handle]: { cmd: brainCmd, auto: true } } });
-        console.log(`[provision:@${handle}] brain provisioned`);
-    }
-    /** Fetch the authoritative bot list and start anything we're missing. */
-    async syncBots() {
-        const res = await fetch(`${this.cfg.apiUrl}/v1/apps/${this.cfg.appId}/runtime/bots`, {
-            headers: { authorization: `Bearer ${this.cfg.pairingCode}` },
-        });
-        if (!res.ok) {
-            const body = await res.text().catch(() => "");
-            throw new Error(`GET /runtime/bots HTTP ${res.status}: ${body.slice(0, 300)}`);
-        }
-        const { bots: list } = (await res.json());
-        console.log(`[bridge] runtime owns ${list.length} bot(s): ${list.map((b) => `@${b.handle}`).join(", ") || "(none yet)"}`);
-        for (const info of list) {
-            // Record any server-mediated backend BEFORE starting the runner so its
-            // first brain resolution already sees it (local overrides still win).
-            const serverBackend = info.backend ?? info.brainBackend;
-            if (serverBackend)
-                this.applyServerBackend(info.handle, serverBackend);
-            this.startBot(info);
-        }
-    }
-    startCore() {
-        if (this.stopped || this.control)
-            return;
-        this.control = new ControlSocket(this.cfg, {
-            onAuthed: () => {
-                // Initial connect AND every reconnect: catch up on bots created while
-                // we were away (adopt_bot frames we may have missed).
-                void this.syncBots().catch((err) => {
-                    console.error(`[bridge] bot sync failed: ${err.message}`);
-                });
-                // Report which brains this computer can run so the phone's picker is
-                // current (initial connect + every reconnect). Non-fatal on failure.
-                void reportCapabilities(this.cfg);
-            },
-            onAdoptBot: (f) => {
-                if (f.backend)
-                    this.applyServerBackend(f.handle, f.backend);
-                this.startBot({ userId: f.botUserId, handle: f.handle, ownerId: f.ownerUserId, backend: f.backend });
-            },
-            onGrantChanged: (f) => {
-                // Access changed for a bot — re-pull its allow list so enforcement is
-                // live (a revoked user stops being answered within seconds).
-                const runner = this.bots.get(f.botUserId);
-                if (runner)
-                    void runner.refreshAccess();
-            },
-            onBotConfig: (f) => {
-                // The owner changed this bot's brain from the phone. Record the server
-                // backend and re-resolve live — the runner resolves per message off the
-                // shared cfg, so the NEXT message already uses it; we also refresh the
-                // cached kind so status reflects it immediately. A running bot is keyed
-                // by userId; map it to a handle via its runner.
-                const runner = this.bots.get(f.botUserId);
-                if (!runner) {
-                    console.log(`[bridge] bot_config_changed for ${f.botUserId} not running yet — applied on next sync/adopt`);
-                    return;
-                }
-                this.applyServerBackend(runner.info.handle, f.backend);
-                runner.refreshBrainKind();
-            },
-        });
-        // Bots first (so a control-socket hiccup doesn't delay serving), then the
-        // control socket, whose auth.ok triggers a redundant-but-safe re-sync.
-        void this.syncBots().catch((err) => {
-            console.error(`[bridge] initial bot sync failed (will retry on control auth): ${err.message}`);
-        });
-        this.control.start();
-        // Re-probe + report brain availability every ~5 min so a login/logout on
-        // this computer surfaces in the phone's picker without a reconnect. The
-        // onAuthed handler covers initial + reconnect reports; this covers drift.
-        // unref so a running interval never keeps the process alive on its own.
-        this.capabilitiesTimer = setInterval(() => {
-            void reportCapabilities(this.cfg);
-        }, CAPABILITIES_INTERVAL_MS);
-        this.capabilitiesTimer.unref?.();
-    }
-    stopCore() {
-        if (this.capabilitiesTimer) {
-            clearInterval(this.capabilitiesTimer);
-            this.capabilitiesTimer = null;
-        }
-        this.control?.stop();
-        this.control = null;
-        for (const b of this.bots.values())
-            b.stop();
-        this.bots.clear();
-    }
 }

package/dist/capabilities.d.ts

@@ -1,4 +1,4 @@
-import type { BridgeConfig } from "./config.js";
+import type { BridgeConfig, Pairing } from "./config.js";
 /** One backend's readiness. `reason` is a short human string when unavailable. */
 export interface BackendCapability {
     available: boolean;
@@ -16,8 +16,10 @@ export interface Capabilities {
 export declare function probeCapabilities(_cfg: BridgeConfig): Promise<Capabilities>;
 /**
  * Probe, then PUT the result to the server so the phone's picker reflects it.
- * Authed with the runtime pairing token — the SAME Bearer auth the bridge uses
- * for GET /runtime/bots (see bridge.ts syncBots). Non-fatal: a failed report is
- * logged and retried on the next tick (control reconnect or the 5-min interval).
+ * Authed with ONE pairing's runtime token — the SAME Bearer auth the bridge
+ * uses for GET /runtime/bots; a multi-account bridge reports once per pairing
+ * (the probe result is machine-wide, but each account's server must hear it).
+ * Non-fatal: a failed report is logged and retried on the next tick (control
+ * reconnect or the 5-min interval).
  */
-export declare function reportCapabilities(cfg: BridgeConfig): Promise<void>;
+export declare function reportCapabilities(cfg: BridgeConfig, pairing: Pairing): Promise<void>;

package/dist/capabilities.js

@@ -117,13 +117,13 @@ function summarize(c) {
 }
 /**
  * Probe, then PUT the result to the server so the phone's picker reflects it.
- * Authed with the runtime pairing token — the SAME Bearer auth the bridge uses
- * for GET /runtime/bots (see bridge.ts syncBots). Non-fatal: a failed report is
- * logged and retried on the next tick (control reconnect or the 5-min interval).
+ * Authed with ONE pairing's runtime token — the SAME Bearer auth the bridge
+ * uses for GET /runtime/bots; a multi-account bridge reports once per pairing
+ * (the probe result is machine-wide, but each account's server must hear it).
+ * Non-fatal: a failed report is logged and retried on the next tick (control
+ * reconnect or the 5-min interval).
  */
-export async function reportCapabilities(cfg) {
-    if (!cfg.pairingCode)
-        return; // unpaired — nothing to report to
+export async function reportCapabilities(cfg, pairing) {
     let caps;
     try {
         caps = await probeCapabilities(cfg);
@@ -132,12 +132,12 @@ export async function reportCapabilities(cfg) {
         console.error(`[caps] probe failed: ${err.message}`);
         return;
     }
-    console.log(`[caps] claude=${summarize(caps.claude)} hermes=${summarize(caps.hermes)}`);
+    console.log(`[caps] claude=${summarize(caps.claude)} hermes=${summarize(caps.hermes)} (reporting as ${pairing.label ?? pairing.appId})`);
     try {
-        const res = await fetch(`${cfg.apiUrl}/v1/runtime/capabilities`, {
+        const res = await fetch(`${pairing.apiUrl}/v1/runtime/capabilities`, {
             method: "PUT",
             headers: {
-                authorization: `Bearer ${cfg.pairingCode}`,
+                authorization: `Bearer ${pairing.pairingCode}`,
                 "content-type": "application/json",
             },
             body: JSON.stringify({ backends: { claude: caps.claude, hermes: caps.hermes } }),