@chatpanel/bridge 0.10.11 → 0.10.13

package/LICENSE

@@ -1,21 +1,168 @@
-MIT License
-
-Copyright (c) 2026 ChatPanel
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+# PolyForm Shield License 1.0.0
+
+<https://polyformproject.org/licenses/shield/1.0.0>
+
+Required Notice: Copyright © 2026 ChatPanel (https://chatpanel.net)
+
+Licensor Line of Business: ChatPanel — an AI browser side-panel, its local
+bridge, and related developer tools and services (https://chatpanel.net)
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose.  However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to
+distribute copies of the software.  Your license to distribute
+covers distributing the software with changes and new works
+permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software.  For example:
+
+> Required Notice: Copyright © 2026 ChatPanel (https://chatpanel.net)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
+
+## Noncompete
+
+Any purpose is a permitted purpose, except for providing any
+product that competes with the software or any product the
+licensor or any of its affiliates provides using the software.
+
+## Competition
+
+Goods and services compete even when they provide functionality
+through different kinds of interfaces or for different technical
+platforms.  Applications can compete with services, libraries
+with plugins, frameworks with development tools, and so on,
+even if they're written in different programming languages
+or for different computer architectures.  Goods and services
+compete even when provided free of charge.  If you market a
+product as a practical substitute for the software or another
+product, it definitely competes.
+
+## New Products
+
+If you are using the software to provide a product that does
+not compete, but the licensor or any of its affiliates brings
+your product into competition by providing a new version of
+the software or another product using the software, you may
+continue using versions of the software available under these
+terms beforehand to provide your competing product, but not
+any later versions.
+
+## Discontinued Products
+
+You may begin using the software to compete with a product
+or service that the licensor or any of its affiliates has
+stopped providing, unless the licensor includes a plain-text
+line beginning with `Licensor Line of Business:` with the
+software that mentions that line of business.  For example:
+
+> Licensor Line of Business: ChatPanel — an AI browser side-panel, its local
+> bridge, and related developer tools and services (https://chatpanel.net)
+
+## Sales of Business
+
+If the licensor or any of its affiliates sells a line of
+business developing the software or using the software
+to provide a product, the buyer can also enforce
+Noncompete for that product.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law.  These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else.  These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately.  If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice.  Otherwise, all your licenses
+end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+A **product** can be a good or service, or a combination
+of them.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+its affiliates.
+
+**Affiliates** means the other organizations that an
+organization has control over, is under the control of, or is
+under common control with.
+
+**Control** means ownership of substantially all the assets of
+an entity, or the power to direct its management and policies
+by vote, contract, or otherwise.  Control can be direct or
+indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.

package/README.md

@@ -124,3 +124,19 @@ macOS (launchd) example — save to `~/Library/LaunchAgents/app.chatpanel.bridge
 ```
 
 Then `launchctl load ~/Library/LaunchAgents/app.chatpanel.bridge.plist`.
+
+## License
+
+**Source-available**, under the [**PolyForm Shield License 1.0.0**](LICENSE).
+Read, audit, run, and modify it for your own use — you just may not use it to
+provide a product or service that **competes** with ChatPanel. The
+[extension](https://github.com/chatpanel/chatpanel-extension) is under the same
+license. This is *not* an OSI "open source" license; the source is published for
+transparency and trust (this bridge runs on your machine with file access, so it
+should be auditable), not for re-packaging or resale.
+
+## Trademarks & brand
+
+The name **“ChatPanel”**, the logo, and brand assets are **trademarks of ChatPanel,
+not licensed** under the terms above — the Shield license covers the code only.
+Don't redistribute a fork (e.g. to npm) under the ChatPanel name or marks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.11",
+  "version": "0.10.13",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
@@ -17,7 +17,7 @@
     "type": "git",
     "url": "git+https://github.com/chatpanel/chatpanel-bridge.git"
   },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "bin": {
     "chatpanel-bridge": "src/server.js"
   },

package/src/server.js

@@ -36,7 +36,7 @@ import { callLocalMcp } from './mcp-local.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.11';
+const VERSION = '0.10.13';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -224,6 +224,7 @@ function tokenOk(req) {
 const PRIVILEGED_POST = new Set([
   '/chat',
   '/mcp-local',
+  '/mcp-remote',
   '/complete',
   '/list-models',
   '/agent-check',
@@ -232,6 +233,32 @@ const PRIVILEGED_POST = new Set([
 ]);
 const PRIVILEGED_GET = new Set(['/debug']);
 
+// SSRF guard for /mcp-remote: the bridge must not become an open relay into the
+// local network. Block non-http(s) schemes and private/loopback/link-local/
+// metadata hosts — on the initial URL AND after any redirect.
+function isBlockedHttpHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
+  if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true;
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const a = Number(m[1]), b = Number(m[2]);
+    if (a === 0 || a === 127 || a === 10) return true;       // this-host / loopback / RFC1918
+    if (a === 169 && b === 254) return true;                 // link-local + cloud metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;        // RFC1918
+    if (a === 192 && b === 168) return true;                 // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;       // CGNAT
+  }
+  return false;
+}
+function assertPublicHttpUrl(u) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  if (isBlockedHttpHost(parsed.hostname)) throw new Error(`refusing to proxy a private/loopback/metadata address (${parsed.hostname})`);
+  return parsed;
+}
+
 // Returns an error code if the request must be blocked, else null.
 function guard(req, pathname) {
   if (!hostAllowed(req)) return 'forbidden host';
@@ -441,6 +468,59 @@ async function handleMcpLocal(req, res) {
   }
 }
 
+// POST /mcp-remote — proxy ONE JSON-RPC message to a remote Streamable-HTTP MCP
+// server FROM the bridge (server-side, no browser Origin header), so the extension
+// can reach servers that reject browser origins (their own DNS-rebinding/CORS
+// protection). Body: { url, headers?, message }. Returns the upstream
+// { status, sessionId, contentType, body } for the extension to parse. Privileged
+// route + SSRF guard, so it can't be driven by a page or relay into the LAN.
+async function handleMcpRemote(req, res) {
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    return json(res, 400, { error: 'Bad JSON: ' + e.message });
+  }
+  const { url, headers: hdrs, message } = body || {};
+  if (!url || !message) return json(res, 400, { error: 'need url and message' });
+  let target;
+  try {
+    target = assertPublicHttpUrl(url);
+  } catch (e) {
+    return json(res, 400, { error: String(e?.message || e) });
+  }
+  // Forward only safe, MCP-relevant client headers (auth, session, protocol, x-*);
+  // never the Host/hop-by-hop headers. Content-Type/Accept are set by us.
+  const fwd = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' };
+  if (hdrs && typeof hdrs === 'object') {
+    for (const [k, v] of Object.entries(hdrs)) {
+      const lk = k.toLowerCase();
+      if (['authorization', 'mcp-session-id', 'mcp-protocol-version', 'x-api-key'].includes(lk) || lk.startsWith('x-')) {
+        fwd[k] = String(v);
+      }
+    }
+  }
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), 30_000);
+  try {
+    const up = await fetch(target.href, { method: 'POST', headers: fwd, body: JSON.stringify(message), redirect: 'follow', signal: ac.signal });
+    // A redirect may have landed on an internal host — re-check the final URL.
+    try { if (up.url) assertPublicHttpUrl(up.url); } catch (e) { return json(res, 400, { error: String(e?.message || e) }); }
+    const text = await up.text().catch(() => '');
+    return json(res, 200, {
+      status: up.status,
+      sessionId: up.headers.get('Mcp-Session-Id') || null,
+      contentType: up.headers.get('Content-Type') || '',
+      body: text,
+    });
+  } catch (e) {
+    const why = e?.name === 'AbortError' ? 'timed out' : String(e?.message || e);
+    return json(res, 502, { error: `couldn't reach MCP server ${target.host}: ${why}` });
+  } finally {
+    clearTimeout(t);
+  }
+}
+
 // POST /tool-result — the extension returns a relayed tool's result.
 async function handleToolResult(req, res) {
   let body;
@@ -582,6 +662,7 @@ const server = createServer(async (req, res) => {
     }
     if (req.method === 'POST' && url.pathname === '/tool-result') return handleToolResult(req, res);
     if (req.method === 'POST' && url.pathname === '/mcp-local') return handleMcpLocal(req, res);
+    if (req.method === 'POST' && url.pathname === '/mcp-remote') return handleMcpRemote(req, res);
     if (req.method === 'POST' && url.pathname === '/complete') return handleComplete(req, res);
     if (req.method === 'POST' && url.pathname === '/list-models') return handleListModels(req, res);
     if (req.method === 'POST' && url.pathname === '/agent-check') return handleAgentCheck(req, res);