@chatpanel/bridge 0.10.12 → 0.10.14

package/LICENSE

@@ -1,110 +1,168 @@
-# Functional Source License, Version 1.1, MIT Future License
+# PolyForm Shield License 1.0.0
 
-## Abbreviation
+<https://polyformproject.org/licenses/shield/1.0.0>
 
-FSL-1.1-MIT
+Required Notice: Copyright © 2026 ChatPanel (https://chatpanel.net)
 
-## Notice
+Licensor Line of Business: ChatPanel — an AI browser side-panel, its local
+bridge, and related developer tools and services (https://chatpanel.net)
 
-Copyright 2026 ChatPanel
+## Acceptance
 
-## Terms and Conditions
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
 
-### Licensor ("We")
+## Copyright License
 
-The party offering the Software under these Terms and Conditions.
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose.  However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
 
-### The Software
+## Distribution License
 
-The "Software" is each version of the software that we make available under
-these Terms and Conditions, as indicated by our inclusion of these Terms and
-Conditions with the Software.
+The licensor grants you an additional copyright license to
+distribute copies of the software.  Your license to distribute
+covers distributing the software with changes and new works
+permitted by [Changes and New Works License](#changes-and-new-works-license).
 
-### License Grant
+## Notices
 
-Subject to your compliance with this License Grant and the Patents,
-Redistribution and Trademark clauses below, we hereby grant you the right to
-use, copy, modify, create derivative works, publicly perform, publicly display
-and redistribute the Software for any Permitted Purpose identified below.
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software.  For example:
 
-### Permitted Purpose
+> Required Notice: Copyright © 2026 ChatPanel (https://chatpanel.net)
 
-A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
-means making the Software available to others in a commercial product or
-service that:
+## Changes and New Works License
 
-1. substitutes for the Software;
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
 
-2. substitutes for any other product or service we offer using the Software
-   that exists as of the date we make the Software available; or
+## Patent License
 
-3. offers the same or substantially similar functionality as the Software.
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
 
-Permitted Purposes specifically include using the Software:
+## Noncompete
 
-1. for your internal use and access;
+Any purpose is a permitted purpose, except for providing any
+product that competes with the software or any product the
+licensor or any of its affiliates provides using the software.
 
-2. for non-commercial education;
+## Competition
 
-3. for non-commercial research; and
+Goods and services compete even when they provide functionality
+through different kinds of interfaces or for different technical
+platforms.  Applications can compete with services, libraries
+with plugins, frameworks with development tools, and so on,
+even if they're written in different programming languages
+or for different computer architectures.  Goods and services
+compete even when provided free of charge.  If you market a
+product as a practical substitute for the software or another
+product, it definitely competes.
 
-4. in connection with professional services that you provide to a licensee
-   using the Software in accordance with these Terms and Conditions.
+## New Products
 
-### Patents
+If you are using the software to provide a product that does
+not compete, but the licensor or any of its affiliates brings
+your product into competition by providing a new version of
+the software or another product using the software, you may
+continue using versions of the software available under these
+terms beforehand to provide your competing product, but not
+any later versions.
 
-To the extent your use for a Permitted Purpose would necessarily infringe our
-patents, the license grant above includes a license under our patents. If you
-make a claim against any party that the Software infringes or contributes to
-the infringement of any patent, then your patent license to the Software ends
-immediately.
+## Discontinued Products
 
-### Redistribution
+You may begin using the software to compete with a product
+or service that the licensor or any of its affiliates has
+stopped providing, unless the licensor includes a plain-text
+line beginning with `Licensor Line of Business:` with the
+software that mentions that line of business.  For example:
 
-The Terms and Conditions apply to all copies, modifications and derivatives of
-the Software.
+> Licensor Line of Business: ChatPanel — an AI browser side-panel, its local
+> bridge, and related developer tools and services (https://chatpanel.net)
 
-If you redistribute any copies, modifications or derivatives of the Software,
-you must include a copy of or a link to these Terms and Conditions and not
-remove any copyright notices provided in or with the Software.
+## Sales of Business
 
-### Disclaimer
+If the licensor or any of its affiliates sells a line of
+business developing the software or using the software
+to provide a product, the buyer can also enforce
+Noncompete for that product.
 
-THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
-PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+## Fair Use
 
-IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
-SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
-EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+You may have "fair use" rights for the software under the
+law.  These terms do not limit them.
 
-### Trademarks
+## No Other Rights
 
-Except for displaying the License Details and identifying us as the origin of
-the Software, you have no right under these Terms and Conditions to use our
-trademarks, trade names, service marks or product names.
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else.  These terms do not imply
+any other licenses.
 
-## Grant of Future License
+## Patent Defense
 
-We hereby irrevocably grant you an additional license to use the Software under
-the MIT license that is effective on the second anniversary of the date we make
-the Software available. On or after that date, you may use the Software under
-the MIT license, in which case the following will apply:
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately.  If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
+## Violations
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice.  Otherwise, all your licenses
+end immediately.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+A **product** can be a good or service, or a combination
+of them.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+its affiliates.
+
+**Affiliates** means the other organizations that an
+organization has control over, is under the control of, or is
+under common control with.
+
+**Control** means ownership of substantially all the assets of
+an entity, or the power to direct its management and policies
+by vote, contract, or otherwise.  Control can be direct or
+indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.

package/README.md

@@ -124,3 +124,19 @@ macOS (launchd) example — save to `~/Library/LaunchAgents/app.chatpanel.bridge
 ```
 
 Then `launchctl load ~/Library/LaunchAgents/app.chatpanel.bridge.plist`.
+
+## License
+
+**Source-available**, under the [**PolyForm Shield License 1.0.0**](LICENSE).
+Read, audit, run, and modify it for your own use — you just may not use it to
+provide a product or service that **competes** with ChatPanel. The
+[extension](https://github.com/chatpanel/chatpanel-extension) is under the same
+license. This is *not* an OSI "open source" license; the source is published for
+transparency and trust (this bridge runs on your machine with file access, so it
+should be auditable), not for re-packaging or resale.
+
+## Trademarks & brand
+
+The name **“ChatPanel”**, the logo, and brand assets are **trademarks of ChatPanel,
+not licensed** under the terms above — the Shield license covers the code only.
+Don't redistribute a fork (e.g. to npm) under the ChatPanel name or marks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.12",
+  "version": "0.10.14",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/server.js

@@ -32,11 +32,12 @@ import { installService, uninstallService, serviceStatus, restartService } from
 import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
+import { assertPublicHttpUrl } from './ssrf.js';
 
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.12';
+const VERSION = '0.10.14';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -233,31 +234,12 @@ const PRIVILEGED_POST = new Set([
 ]);
 const PRIVILEGED_GET = new Set(['/debug']);
 
-// SSRF guard for /mcp-remote: the bridge must not become an open relay into the
-// local network. Block non-http(s) schemes and private/loopback/link-local/
-// metadata hosts — on the initial URL AND after any redirect.
-function isBlockedHttpHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
-  if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true;
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (m) {
-    const a = Number(m[1]), b = Number(m[2]);
-    if (a === 0 || a === 127 || a === 10) return true;       // this-host / loopback / RFC1918
-    if (a === 169 && b === 254) return true;                 // link-local + cloud metadata
-    if (a === 172 && b >= 16 && b <= 31) return true;        // RFC1918
-    if (a === 192 && b === 168) return true;                 // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true;       // CGNAT
-  }
-  return false;
-}
-function assertPublicHttpUrl(u) {
-  let parsed;
-  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
-  if (isBlockedHttpHost(parsed.hostname)) throw new Error(`refusing to proxy a private/loopback/metadata address (${parsed.hostname})`);
-  return parsed;
-}
+// SSRF guard for /mcp-remote lives in ./ssrf.js (assertPublicHttpUrl). Loopback
+// is allowed (the user's own localhost MCP server — the common "via bridge"
+// case; the extension can reach it directly anyway), cloud metadata is always
+// blocked, and other private/LAN ranges are blocked unless the operator sets
+// CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1. Checked on the initial URL AND after
+// any redirect.
 
 // Returns an error code if the request must be blocked, else null.
 function guard(req, pathname) {

package/src/ssrf.js

@@ -0,0 +1,102 @@
+// SSRF guard for the /mcp-remote proxy.
+//
+// The bridge proxies ONE JSON-RPC message to a remote MCP server *from this
+// machine* (no browser Origin header), so the extension can reach servers that
+// reject browser origins. That route is already privileged — it requires the
+// extension origin or the per-install bridge token, so a random web page cannot
+// drive it. This guard is the second layer: even when driven by the extension,
+// the bridge must not become a relay that a prompt-injected agent could point at
+// cloud metadata or use to sweep the LAN.
+//
+// Policy:
+//   • Loopback (127.0.0.0/8, ::1, localhost, *.localhost) → ALLOWED.
+//     It's the user's own host — the same place the bridge runs, and a place the
+//     extension can already fetch DIRECTLY. Proxying it grants no new reach; it
+//     only drops the browser Origin header (the whole point of "via bridge").
+//     Localhost MCP servers are the common case.
+//   • Cloud instance metadata (169.254.169.254) → ALWAYS BLOCKED.
+//     This is the sharpest SSRF target (credential theft) and is blocked even
+//     when private hosts are opted in.
+//   • Everything else private/internal (RFC1918, CGNAT, link-local, IPv6 ULA,
+//     0.0.0.0, ::, *.local) → BLOCKED, unless the operator opts in with
+//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (for reaching an MCP server on
+//     another machine on a trusted LAN).
+//   • Non-http(s) schemes → BLOCKED.
+//
+// The same checks run on the initial URL AND after any redirect.
+
+const ALLOW_PRIVATE_HOSTS = /^(1|true|yes|on)$/i.test(
+  process.env.CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS || '',
+);
+
+function ipv4(h) {
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+// Loopback = this host's own services. Reachable by the extension directly, so
+// allowing the bridge to reach it adds no capability.
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — credential-theft vector. Always blocked.
+function isMetadataHost(hostname) {
+  const o = ipv4(hostname);
+  return !!(o && o[0] === 169 && o[1] === 254);
+}
+
+export function isBlockedHttpHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h) return true;
+  if (isLoopbackHost(h)) return false; // user's own host — allowed
+  if (isMetadataHost(h)) return true; // never proxy cloud metadata, even when private is opted in
+  if (ALLOW_PRIVATE_HOSTS) return false; // operator opted in to LAN/private targets
+
+  // Default deny for the rest of the private/internal space.
+  if (h.endsWith('.local')) return true; // mDNS / LAN
+  if (
+    h === '::' ||
+    h.startsWith('fc') ||
+    h.startsWith('fd') || // IPv6 ULA
+    h.startsWith('fe8') ||
+    h.startsWith('fe9') ||
+    h.startsWith('fea') ||
+    h.startsWith('feb') // IPv6 link-local
+  ) {
+    return true;
+  }
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true; // this-host / RFC1918
+    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
+    if (a === 192 && b === 168) return true; // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
+  }
+  return false;
+}
+
+export function assertPublicHttpUrl(u) {
+  let parsed;
+  try {
+    parsed = new URL(u);
+  } catch {
+    throw new Error(`invalid URL: ${u}`);
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHttpHost(parsed.hostname)) {
+    throw new Error(`refusing to proxy a private/metadata address (${parsed.hostname})`);
+  }
+  return parsed;
+}