@chatpanel/bridge 0.10.11 → 0.10.12

package/LICENSE

@@ -1,13 +1,102 @@
-MIT License
+# Functional Source License, Version 1.1, MIT Future License
 
-Copyright (c) 2026 ChatPanel
+## Abbreviation
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 ChatPanel
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
 
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.11",
+  "version": "0.10.12",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
@@ -17,7 +17,7 @@
     "type": "git",
     "url": "git+https://github.com/chatpanel/chatpanel-bridge.git"
   },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "bin": {
     "chatpanel-bridge": "src/server.js"
   },

package/src/server.js

@@ -36,7 +36,7 @@ import { callLocalMcp } from './mcp-local.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.11';
+const VERSION = '0.10.12';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -224,6 +224,7 @@ function tokenOk(req) {
 const PRIVILEGED_POST = new Set([
   '/chat',
   '/mcp-local',
+  '/mcp-remote',
   '/complete',
   '/list-models',
   '/agent-check',
@@ -232,6 +233,32 @@ const PRIVILEGED_POST = new Set([
 ]);
 const PRIVILEGED_GET = new Set(['/debug']);
 
+// SSRF guard for /mcp-remote: the bridge must not become an open relay into the
+// local network. Block non-http(s) schemes and private/loopback/link-local/
+// metadata hosts — on the initial URL AND after any redirect.
+function isBlockedHttpHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
+  if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true;
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const a = Number(m[1]), b = Number(m[2]);
+    if (a === 0 || a === 127 || a === 10) return true;       // this-host / loopback / RFC1918
+    if (a === 169 && b === 254) return true;                 // link-local + cloud metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;        // RFC1918
+    if (a === 192 && b === 168) return true;                 // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;       // CGNAT
+  }
+  return false;
+}
+function assertPublicHttpUrl(u) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  if (isBlockedHttpHost(parsed.hostname)) throw new Error(`refusing to proxy a private/loopback/metadata address (${parsed.hostname})`);
+  return parsed;
+}
+
 // Returns an error code if the request must be blocked, else null.
 function guard(req, pathname) {
   if (!hostAllowed(req)) return 'forbidden host';
@@ -441,6 +468,59 @@ async function handleMcpLocal(req, res) {
   }
 }
 
+// POST /mcp-remote — proxy ONE JSON-RPC message to a remote Streamable-HTTP MCP
+// server FROM the bridge (server-side, no browser Origin header), so the extension
+// can reach servers that reject browser origins (their own DNS-rebinding/CORS
+// protection). Body: { url, headers?, message }. Returns the upstream
+// { status, sessionId, contentType, body } for the extension to parse. Privileged
+// route + SSRF guard, so it can't be driven by a page or relay into the LAN.
+async function handleMcpRemote(req, res) {
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    return json(res, 400, { error: 'Bad JSON: ' + e.message });
+  }
+  const { url, headers: hdrs, message } = body || {};
+  if (!url || !message) return json(res, 400, { error: 'need url and message' });
+  let target;
+  try {
+    target = assertPublicHttpUrl(url);
+  } catch (e) {
+    return json(res, 400, { error: String(e?.message || e) });
+  }
+  // Forward only safe, MCP-relevant client headers (auth, session, protocol, x-*);
+  // never the Host/hop-by-hop headers. Content-Type/Accept are set by us.
+  const fwd = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' };
+  if (hdrs && typeof hdrs === 'object') {
+    for (const [k, v] of Object.entries(hdrs)) {
+      const lk = k.toLowerCase();
+      if (['authorization', 'mcp-session-id', 'mcp-protocol-version', 'x-api-key'].includes(lk) || lk.startsWith('x-')) {
+        fwd[k] = String(v);
+      }
+    }
+  }
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), 30_000);
+  try {
+    const up = await fetch(target.href, { method: 'POST', headers: fwd, body: JSON.stringify(message), redirect: 'follow', signal: ac.signal });
+    // A redirect may have landed on an internal host — re-check the final URL.
+    try { if (up.url) assertPublicHttpUrl(up.url); } catch (e) { return json(res, 400, { error: String(e?.message || e) }); }
+    const text = await up.text().catch(() => '');
+    return json(res, 200, {
+      status: up.status,
+      sessionId: up.headers.get('Mcp-Session-Id') || null,
+      contentType: up.headers.get('Content-Type') || '',
+      body: text,
+    });
+  } catch (e) {
+    const why = e?.name === 'AbortError' ? 'timed out' : String(e?.message || e);
+    return json(res, 502, { error: `couldn't reach MCP server ${target.host}: ${why}` });
+  } finally {
+    clearTimeout(t);
+  }
+}
+
 // POST /tool-result — the extension returns a relayed tool's result.
 async function handleToolResult(req, res) {
   let body;
@@ -582,6 +662,7 @@ const server = createServer(async (req, res) => {
     }
     if (req.method === 'POST' && url.pathname === '/tool-result') return handleToolResult(req, res);
     if (req.method === 'POST' && url.pathname === '/mcp-local') return handleMcpLocal(req, res);
+    if (req.method === 'POST' && url.pathname === '/mcp-remote') return handleMcpRemote(req, res);
     if (req.method === 'POST' && url.pathname === '/complete') return handleComplete(req, res);
     if (req.method === 'POST' && url.pathname === '/list-models') return handleListModels(req, res);
     if (req.method === 'POST' && url.pathname === '/agent-check') return handleAgentCheck(req, res);