@chatpanel/bridge 0.10.10 → 0.10.12

package/LICENSE

@@ -1,13 +1,102 @@
-MIT License
+# Functional Source License, Version 1.1, MIT Future License
 
-Copyright (c) 2026 ChatPanel
+## Abbreviation
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 ChatPanel
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
 
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.10",
+  "version": "0.10.12",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
@@ -17,7 +17,7 @@
     "type": "git",
     "url": "git+https://github.com/chatpanel/chatpanel-bridge.git"
   },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "bin": {
     "chatpanel-bridge": "src/server.js"
   },

package/src/engines/claude.js

@@ -244,7 +244,18 @@ export async function chat({ messages, system, options, images }, emit) {
     }: ${imageFiles.join(', ')}`;
   }
 
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  if (options.extraArgs) {
+    const extra = String(options.extraArgs).split(/\s+/).filter(Boolean);
+    // Never let caller-supplied extras re-open the read-only boundary the mode
+    // flags above establish. If ANY security-sensitive flag is present, drop the
+    // whole extraArgs (these tokens take values, so partial filtering is unsafe).
+    const FORBIDDEN = /^--?(permission-mode|allowed-?tools|disallowed-?tools|dangerously|add-dir|mcp-config|setting-sources|permission-prompt-tool)/i;
+    if (extra.some((t) => FORBIDDEN.test(t))) {
+      emit({ type: 'status', text: '(ignored unsafe extraArgs)' });
+    } else {
+      args.push(...extra);
+    }
+  }
   const run = runClaude({ prompt, args, cwd, emit });
   if (run === null) {
     cleanup(); // SDK fallback doesn't take images yet

package/src/server.js

@@ -12,11 +12,17 @@
 //                     {type:'done',  text?}    (text only if not streamed)
 //                     {type:'error', error}
 //
-// Binds to 127.0.0.1 only and accepts requests from the extension origin.
+// Binds to 127.0.0.1 only. A request guard (see `guard()`) enforces a loopback
+// Host (anti DNS-rebinding) and an allowlisted Origin; the command-spawning
+// endpoints (/chat, /mcp-local, /update, …) additionally require the extension
+// origin or the per-install bridge token, so a malicious web page can't drive
+// local execution. The CLI-facing /mcp endpoints stay open to no-Origin clients.
 
 import { createServer } from 'node:http';
 import os from 'node:os';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
 import * as claude from './engines/claude.js';
 import * as codex from './engines/codex.js';
 import * as antigravity from './engines/antigravity.js';
@@ -30,7 +36,7 @@ import { callLocalMcp } from './mcp-local.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.10';
+const VERSION = '0.10.12';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -115,18 +121,156 @@ function toMcpContent(result) {
 
 // --------------------------------------------------------------------------
 // CORS — allow the extension (chrome-extension://…) and localhost dev origins.
+// NOTE: CORS only controls whether a *page* may READ the response; it does NOT
+// stop a cross-origin request from running. The hard allow/deny gating that
+// actually protects the command-spawning endpoints lives in `guard()` below.
 // --------------------------------------------------------------------------
-function cors(req, res) {
-  const origin = req.headers.origin || '';
-  const allow =
+function originAllowed(origin) {
+  return (
     !origin ||
     origin.startsWith('chrome-extension://') ||
     origin.startsWith('moz-extension://') ||
     origin.startsWith('http://localhost') ||
-    origin.startsWith('http://127.0.0.1');
+    origin.startsWith('http://127.0.0.1') ||
+    origin.startsWith('http://[::1]')
+  );
+}
+
+// An origin that identifies the ChatPanel extension (or a local dev build).
+// Distinct from originAllowed(): this REQUIRES the header to be present, so a
+// no-Origin local process cannot pose as the extension on privileged routes.
+function isExtensionOrigin(origin) {
+  return (
+    origin.startsWith('chrome-extension://') ||
+    origin.startsWith('moz-extension://') ||
+    origin.startsWith('http://localhost') ||
+    origin.startsWith('http://127.0.0.1') ||
+    origin.startsWith('http://[::1]')
+  );
+}
+
+function cors(req, res) {
+  const origin = req.headers.origin || '';
+  const allow = originAllowed(origin);
   res.setHeader('Access-Control-Allow-Origin', allow ? origin || '*' : 'null');
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-ChatPanel-Token');
+  res.setHeader('Vary', 'Origin');
+}
+
+// --------------------------------------------------------------------------
+// Security gates — defend the localhost server against a malicious web page.
+//
+// Two browser attack classes are in scope even though we bind to 127.0.0.1:
+//   1. DNS rebinding — a page on http://evil.example rebinds that name to
+//      127.0.0.1 and fetches http://evil.example:PORT/…; the request arrives
+//      with Host: evil.example, which a naïve server happily serves.
+//   2. Cross-origin CSRF — a page POSTs a CORS "simple" request (text/plain)
+//      to http://127.0.0.1:PORT/…; no preflight fires and the side effect runs.
+//
+// hostAllowed() closes (1) by rejecting any non-loopback Host. The Origin
+// checks close (2). Privileged endpoints additionally require the extension
+// origin or the per-install token, so a no-Origin local process can't drive
+// command execution either.
+// --------------------------------------------------------------------------
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1']);
+
+function hostAllowed(req) {
+  // If the operator deliberately bound to a non-loopback/all interface
+  // (CHATPANEL_BRIDGE_HOST=0.0.0.0 / a LAN IP), don't second-guess their Host.
+  if (!LOOPBACK_HOSTNAMES.has(HOST)) return true;
+  const raw = String(req.headers.host || '');
+  if (!raw) return false; // HTTP/1.1 requires Host; absent → reject
+  const hostname = raw
+    .replace(/:\d+$/, '') // strip :port
+    .replace(/^\[|\]$/g, '') // strip IPv6 brackets
+    .toLowerCase();
+  return LOOPBACK_HOSTNAMES.has(hostname);
+}
+
+// Per-install bearer token — defense-in-depth so a non-browser local client can
+// authenticate to privileged routes without relying on an Origin header. Written
+// 0600 to ~/.chatpanel/bridge-token; the extension is allowed by origin and need
+// not send it, so adding this never breaks the existing wire contract.
+const TOKEN_PATH = join(os.homedir(), '.chatpanel', 'bridge-token');
+let AUTH_TOKEN = '';
+function ensureToken() {
+  try {
+    if (existsSync(TOKEN_PATH)) AUTH_TOKEN = readFileSync(TOKEN_PATH, 'utf8').trim();
+    if (!AUTH_TOKEN) {
+      AUTH_TOKEN = randomBytes(32).toString('hex');
+      mkdirSync(join(os.homedir(), '.chatpanel'), { recursive: true });
+      writeFileSync(TOKEN_PATH, AUTH_TOKEN, { mode: 0o600 });
+    }
+  } catch (e) {
+    // Token is optional hardening — never fail startup over it.
+    log('error', `could not initialise bridge token: ${e?.message || e}`);
+  }
+}
+function tokenOk(req) {
+  if (!AUTH_TOKEN) return false;
+  const h = String(req.headers['authorization'] || '');
+  const provided = (h.startsWith('Bearer ') ? h.slice(7) : String(req.headers['x-chatpanel-token'] || '')).trim();
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(AUTH_TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+// POST sinks that spawn local agents/commands or self-update, plus GET /debug
+// (leaks PATH/home). Only the extension (allowlisted origin) or a token-bearing
+// client may reach these. The CLI-facing /mcp and /mcp/<id> routes are NOT here:
+// local coding-agent CLIs connect to them with no Origin header by design.
+const PRIVILEGED_POST = new Set([
+  '/chat',
+  '/mcp-local',
+  '/mcp-remote',
+  '/complete',
+  '/list-models',
+  '/agent-check',
+  '/update',
+  '/tool-result',
+]);
+const PRIVILEGED_GET = new Set(['/debug']);
+
+// SSRF guard for /mcp-remote: the bridge must not become an open relay into the
+// local network. Block non-http(s) schemes and private/loopback/link-local/
+// metadata hosts — on the initial URL AND after any redirect.
+function isBlockedHttpHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
+  if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true;
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const a = Number(m[1]), b = Number(m[2]);
+    if (a === 0 || a === 127 || a === 10) return true;       // this-host / loopback / RFC1918
+    if (a === 169 && b === 254) return true;                 // link-local + cloud metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;        // RFC1918
+    if (a === 192 && b === 168) return true;                 // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;       // CGNAT
+  }
+  return false;
+}
+function assertPublicHttpUrl(u) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  if (isBlockedHttpHost(parsed.hostname)) throw new Error(`refusing to proxy a private/loopback/metadata address (${parsed.hostname})`);
+  return parsed;
+}
+
+// Returns an error code if the request must be blocked, else null.
+function guard(req, pathname) {
+  if (!hostAllowed(req)) return 'forbidden host';
+  const origin = req.headers.origin || '';
+  if (origin && !originAllowed(origin)) return 'forbidden origin';
+  const privileged =
+    (req.method === 'POST' && PRIVILEGED_POST.has(pathname)) ||
+    (req.method === 'GET' && PRIVILEGED_GET.has(pathname));
+  if (privileged && !(isExtensionOrigin(origin) || tokenOk(req))) {
+    return 'forbidden: this endpoint requires the ChatPanel extension or a valid bridge token';
+  }
+  return null;
 }
 
 function json(res, code, obj) {
@@ -324,6 +468,59 @@ async function handleMcpLocal(req, res) {
   }
 }
 
+// POST /mcp-remote — proxy ONE JSON-RPC message to a remote Streamable-HTTP MCP
+// server FROM the bridge (server-side, no browser Origin header), so the extension
+// can reach servers that reject browser origins (their own DNS-rebinding/CORS
+// protection). Body: { url, headers?, message }. Returns the upstream
+// { status, sessionId, contentType, body } for the extension to parse. Privileged
+// route + SSRF guard, so it can't be driven by a page or relay into the LAN.
+async function handleMcpRemote(req, res) {
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    return json(res, 400, { error: 'Bad JSON: ' + e.message });
+  }
+  const { url, headers: hdrs, message } = body || {};
+  if (!url || !message) return json(res, 400, { error: 'need url and message' });
+  let target;
+  try {
+    target = assertPublicHttpUrl(url);
+  } catch (e) {
+    return json(res, 400, { error: String(e?.message || e) });
+  }
+  // Forward only safe, MCP-relevant client headers (auth, session, protocol, x-*);
+  // never the Host/hop-by-hop headers. Content-Type/Accept are set by us.
+  const fwd = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' };
+  if (hdrs && typeof hdrs === 'object') {
+    for (const [k, v] of Object.entries(hdrs)) {
+      const lk = k.toLowerCase();
+      if (['authorization', 'mcp-session-id', 'mcp-protocol-version', 'x-api-key'].includes(lk) || lk.startsWith('x-')) {
+        fwd[k] = String(v);
+      }
+    }
+  }
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), 30_000);
+  try {
+    const up = await fetch(target.href, { method: 'POST', headers: fwd, body: JSON.stringify(message), redirect: 'follow', signal: ac.signal });
+    // A redirect may have landed on an internal host — re-check the final URL.
+    try { if (up.url) assertPublicHttpUrl(up.url); } catch (e) { return json(res, 400, { error: String(e?.message || e) }); }
+    const text = await up.text().catch(() => '');
+    return json(res, 200, {
+      status: up.status,
+      sessionId: up.headers.get('Mcp-Session-Id') || null,
+      contentType: up.headers.get('Content-Type') || '',
+      body: text,
+    });
+  } catch (e) {
+    const why = e?.name === 'AbortError' ? 'timed out' : String(e?.message || e);
+    return json(res, 502, { error: `couldn't reach MCP server ${target.host}: ${why}` });
+  } finally {
+    clearTimeout(t);
+  }
+}
+
 // POST /tool-result — the extension returns a relayed tool's result.
 async function handleToolResult(req, res) {
   let body;
@@ -431,7 +628,15 @@ const server = createServer(async (req, res) => {
     res.writeHead(204);
     return res.end();
   }
-  const url = new URL(req.url, `http://${req.headers.host}`);
+  let url;
+  try {
+    url = new URL(req.url, `http://${req.headers.host || '127.0.0.1'}`);
+  } catch {
+    return json(res, 400, { error: 'bad request' });
+  }
+  // Block DNS-rebinding / cross-origin CSRF before any route runs.
+  const blocked = guard(req, url.pathname);
+  if (blocked) return json(res, 403, { error: blocked });
   try {
     if (req.method === 'GET' && url.pathname === '/health') return handleHealth(res);
     if (req.method === 'GET' && url.pathname === '/debug') {
@@ -457,6 +662,7 @@ const server = createServer(async (req, res) => {
     }
     if (req.method === 'POST' && url.pathname === '/tool-result') return handleToolResult(req, res);
     if (req.method === 'POST' && url.pathname === '/mcp-local') return handleMcpLocal(req, res);
+    if (req.method === 'POST' && url.pathname === '/mcp-remote') return handleMcpRemote(req, res);
     if (req.method === 'POST' && url.pathname === '/complete') return handleComplete(req, res);
     if (req.method === 'POST' && url.pathname === '/list-models') return handleListModels(req, res);
     if (req.method === 'POST' && url.pathname === '/agent-check') return handleAgentCheck(req, res);
@@ -527,6 +733,7 @@ function runMcpStdioProxy(url) {
 
 function startServer() {
   enrichPath(); // so codex/gemini are found even under a minimal service PATH
+  ensureToken(); // per-install bearer token for privileged routes (defense-in-depth)
   server.listen(PORT, HOST, async () => {
     log('info', `listening on http://${HOST}:${PORT}`);
     for (const [, { engine, label, hidden }] of Object.entries(ENGINES)) {