@chatpanel/bridge 0.10.13 → 0.10.15

package/README.md

@@ -7,7 +7,9 @@ so this bridges the gap.
 - **Claude Code** — embedded via `@anthropic-ai/claude-agent-sdk`, using your
   existing Claude Code login (or `ANTHROPIC_API_KEY`).
 - **Codex** — driven via the `codex exec` CLI, using your `codex login`.
-- **Gemini CLI** — driven via the `gemini -p` CLI, using your `gemini` login.
+- **Antigravity CLI** — driven via the `agy -p` CLI, using your Antigravity login.
+  This is Google's successor to Gemini CLI; **Gemini CLI** itself remains available
+  for business/enterprise (paid API keys) and can be added as a custom agent.
 
 Bring whichever agent you already have installed — the extension auto-detects
 the ones the bridge reports as available.
@@ -27,7 +29,7 @@ in-place upgrade.
 ### Windows — via Node (recommended)
 
 Windows SmartScreen flags unsigned downloads, so on Windows run the bridge through
-Node — you already have it if you use Claude Code / Codex / Gemini (all npm CLIs),
+Node — you already have it if you use Claude Code / Codex (both npm CLIs),
 and there's no security prompt:
 
 ```powershell
@@ -64,7 +66,7 @@ The agents you want to use must already be set up:
 
 - **Claude Code**: installed and signed in (`claude`), or set `ANTHROPIC_API_KEY`.
 - **Codex**: `codex` on your `PATH` and `codex login` done.
-- **Gemini CLI**: `gemini` on your `PATH` and signed in.
+- **Antigravity CLI**: `agy` on your `PATH` and signed in (install the Antigravity app, then run `agy` once to sign in). Replaces Gemini CLI; business/enterprise users can still run `gemini` as a custom agent.
 
 The extension polls `/health` and shows each agent as available/unavailable.
 

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.13",
+  "version": "0.10.15",
   "type": "module",
-  "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
+  "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
     "chatpanel",
     "claude-code",
     "codex",
+    "antigravity-cli",
     "gemini-cli",
     "chrome-extension",
     "ai-agents",

package/src/engines/antigravity.js

@@ -11,7 +11,7 @@
 // path so the model opens it.
 
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdirSync, writeFileSync, unlinkSync } from 'node:fs';
+import { mkdirSync, writeFileSync, unlinkSync, existsSync, readFileSync, rmSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin } from '../env.js';
@@ -78,6 +78,57 @@ function writeImages(images, dir) {
   return files;
 }
 
+// Antigravity has no per-run MCP flag (`agy --help` shows none). The CLI only
+// discovers MCP servers from config files: <cwd>/.agents/mcp_config.json
+// (workspace) or ~/.gemini/config/mcp_config.json (global). To give a headless
+// `agy -p` run our page/MCP tools, write the workspace file pointing at the
+// bridge's per-session HTTP MCP server. Remote servers MUST use `serverUrl`
+// (Antigravity rejects the legacy `url`/`httpUrl` fields). This is the agy
+// equivalent of what claude.js/codex.js do via --mcp-config / -c mcp_servers.
+//
+// Non-destructive: an existing .agents/mcp_config.json is parsed, our one server
+// merged in, and the original restored on cleanup. If the file exists but isn't
+// JSON we recognize, we leave it untouched (and tools simply won't attach) rather
+// than risk corrupting the user's config. Returns a cleanup fn (always callable).
+function setupMcpConfig(mcp, cwd) {
+  if (!mcp?.url) return () => {};
+  const dir = path.join(cwd, '.agents');
+  const file = path.join(dir, 'mcp_config.json');
+  const serverName = mcp.serverName || 'chatpanel_browser';
+  const hadDir = existsSync(dir);
+  let prev = null; // original file contents (null = file did not exist)
+
+  let config = { mcpServers: {} };
+  if (existsSync(file)) {
+    try {
+      prev = readFileSync(file, 'utf8');
+      const parsed = JSON.parse(prev);
+      if (!parsed || typeof parsed !== 'object') return () => {};
+      config = parsed;
+      if (!config.mcpServers || typeof config.mcpServers !== 'object') config.mcpServers = {};
+    } catch {
+      return () => {}; // unreadable / not JSON — don't clobber it
+    }
+  }
+  config.mcpServers[serverName] = { serverUrl: mcp.url };
+
+  try {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(file, JSON.stringify(config, null, 2));
+  } catch {
+    return () => {};
+  }
+  return () => {
+    try {
+      if (prev !== null) writeFileSync(file, prev); // restore original contents
+      else if (hadDir) rmSync(file, { force: true }); // remove just the file we added
+      else rmSync(dir, { recursive: true, force: true }); // remove the dir we created
+    } catch {
+      /* best effort */
+    }
+  };
+}
+
 export async function chat({ messages, system, options, images }, emit) {
   try {
     mkdirSync(SCRATCH, { recursive: true });
@@ -90,18 +141,29 @@ export async function chat({ messages, system, options, images }, emit) {
   // reads @-referenced files (incl. images) inline as multimodal input, so no
   // read-tool approval is needed in headless `-p` mode. (Confirmed working.)
   const imageFiles = writeImages(images, cwd);
-  const cleanup = () => imageFiles.forEach((f) => { try { unlinkSync(f); } catch { /* gone */ } });
+  // Wire our page/MCP tools into agy via a workspace mcp_config.json (it has no
+  // per-run MCP flag). Tools then route: agy → bridge /mcp/<session> → extension.
+  const cleanupMcp = setupMcpConfig(options.mcp, cwd);
+  const cleanup = () => {
+    imageFiles.forEach((f) => { try { unlinkSync(f); } catch { /* gone */ } });
+    cleanupMcp();
+  };
   let prompt = buildCliPrompt(messages, system);
   if (imageFiles.length) {
     prompt += `\n\nThe user attached image(s): ${imageFiles.map((f) => '@' + path.basename(f)).join(' ')}`;
   }
 
   // `-p` runs one prompt non-interactively. --model picks the model.
-  // --dangerously-skip-permissions auto-approves tool use (headless has no human
-  // approver) only when the user opted into bypassPermissions.
   const args = ['-p', prompt];
   if (options.model) args.push('--model', options.model);
-  if (options.permissionMode === 'bypassPermissions') args.push('--dangerously-skip-permissions');
+  // Headless `agy -p` cannot prompt for tool approval — without this flag any MCP
+  // tool call just times out (it never reaches the server). So skip agy's own
+  // approval whenever the user opted into bypass OR we've attached page/MCP tools.
+  // The real gate stays on the ChatPanel side: each relayed call goes back to the
+  // extension, which applies its per-action confirmation for risky page actions.
+  if (options.permissionMode === 'bypassPermissions' || options.mcp?.url) {
+    args.push('--dangerously-skip-permissions');
+  }
   if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
 
   await new Promise((resolve, reject) => {

package/src/env.js

@@ -76,7 +76,7 @@ function shellWhich(name) {
 // ---------------------------------------------------------------------------
 // Claude Code launcher resolution.
 //
-// The Codex/Gemini engines can assume `spawn('codex', …)` runs a directly
+// The Codex/Antigravity engines can assume `spawn('codex', …)` runs a directly
 // executable file on the current OS's PATH. Claude needs more care:
 //   • On Windows, npm installs `claude.cmd` / `claude.ps1` / an extensionless
 //     bash shim — NONE of which Node's spawn() can execute directly (that's the

package/src/server.js

@@ -32,11 +32,12 @@ import { installService, uninstallService, serviceStatus, restartService } from
 import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
+import { assertPublicHttpUrl } from './ssrf.js';
 
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.13';
+const VERSION = '0.10.15';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -233,31 +234,12 @@ const PRIVILEGED_POST = new Set([
 ]);
 const PRIVILEGED_GET = new Set(['/debug']);
 
-// SSRF guard for /mcp-remote: the bridge must not become an open relay into the
-// local network. Block non-http(s) schemes and private/loopback/link-local/
-// metadata hosts — on the initial URL AND after any redirect.
-function isBlockedHttpHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
-  if (h === '::1' || h === '::' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true;
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (m) {
-    const a = Number(m[1]), b = Number(m[2]);
-    if (a === 0 || a === 127 || a === 10) return true;       // this-host / loopback / RFC1918
-    if (a === 169 && b === 254) return true;                 // link-local + cloud metadata
-    if (a === 172 && b >= 16 && b <= 31) return true;        // RFC1918
-    if (a === 192 && b === 168) return true;                 // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true;       // CGNAT
-  }
-  return false;
-}
-function assertPublicHttpUrl(u) {
-  let parsed;
-  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
-  if (isBlockedHttpHost(parsed.hostname)) throw new Error(`refusing to proxy a private/loopback/metadata address (${parsed.hostname})`);
-  return parsed;
-}
+// SSRF guard for /mcp-remote lives in ./ssrf.js (assertPublicHttpUrl). Loopback
+// is allowed (the user's own localhost MCP server — the common "via bridge"
+// case; the extension can reach it directly anyway), cloud metadata is always
+// blocked, and other private/LAN ranges are blocked unless the operator sets
+// CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1. Checked on the initial URL AND after
+// any redirect.
 
 // Returns an error code if the request must be blocked, else null.
 function guard(req, pathname) {
@@ -732,7 +714,7 @@ function runMcpStdioProxy(url) {
 }
 
 function startServer() {
-  enrichPath(); // so codex/gemini are found even under a minimal service PATH
+  enrichPath(); // so codex/agy (Antigravity) are found even under a minimal service PATH
   ensureToken(); // per-install bearer token for privileged routes (defense-in-depth)
   server.listen(PORT, HOST, async () => {
     log('info', `listening on http://${HOST}:${PORT}`);

package/src/ssrf.js

@@ -0,0 +1,102 @@
+// SSRF guard for the /mcp-remote proxy.
+//
+// The bridge proxies ONE JSON-RPC message to a remote MCP server *from this
+// machine* (no browser Origin header), so the extension can reach servers that
+// reject browser origins. That route is already privileged — it requires the
+// extension origin or the per-install bridge token, so a random web page cannot
+// drive it. This guard is the second layer: even when driven by the extension,
+// the bridge must not become a relay that a prompt-injected agent could point at
+// cloud metadata or use to sweep the LAN.
+//
+// Policy:
+//   • Loopback (127.0.0.0/8, ::1, localhost, *.localhost) → ALLOWED.
+//     It's the user's own host — the same place the bridge runs, and a place the
+//     extension can already fetch DIRECTLY. Proxying it grants no new reach; it
+//     only drops the browser Origin header (the whole point of "via bridge").
+//     Localhost MCP servers are the common case.
+//   • Cloud instance metadata (169.254.169.254) → ALWAYS BLOCKED.
+//     This is the sharpest SSRF target (credential theft) and is blocked even
+//     when private hosts are opted in.
+//   • Everything else private/internal (RFC1918, CGNAT, link-local, IPv6 ULA,
+//     0.0.0.0, ::, *.local) → BLOCKED, unless the operator opts in with
+//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (for reaching an MCP server on
+//     another machine on a trusted LAN).
+//   • Non-http(s) schemes → BLOCKED.
+//
+// The same checks run on the initial URL AND after any redirect.
+
+const ALLOW_PRIVATE_HOSTS = /^(1|true|yes|on)$/i.test(
+  process.env.CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS || '',
+);
+
+function ipv4(h) {
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+// Loopback = this host's own services. Reachable by the extension directly, so
+// allowing the bridge to reach it adds no capability.
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — credential-theft vector. Always blocked.
+function isMetadataHost(hostname) {
+  const o = ipv4(hostname);
+  return !!(o && o[0] === 169 && o[1] === 254);
+}
+
+export function isBlockedHttpHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (!h) return true;
+  if (isLoopbackHost(h)) return false; // user's own host — allowed
+  if (isMetadataHost(h)) return true; // never proxy cloud metadata, even when private is opted in
+  if (ALLOW_PRIVATE_HOSTS) return false; // operator opted in to LAN/private targets
+
+  // Default deny for the rest of the private/internal space.
+  if (h.endsWith('.local')) return true; // mDNS / LAN
+  if (
+    h === '::' ||
+    h.startsWith('fc') ||
+    h.startsWith('fd') || // IPv6 ULA
+    h.startsWith('fe8') ||
+    h.startsWith('fe9') ||
+    h.startsWith('fea') ||
+    h.startsWith('feb') // IPv6 link-local
+  ) {
+    return true;
+  }
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true; // this-host / RFC1918
+    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
+    if (a === 192 && b === 168) return true; // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
+  }
+  return false;
+}
+
+export function assertPublicHttpUrl(u) {
+  let parsed;
+  try {
+    parsed = new URL(u);
+  } catch {
+    throw new Error(`invalid URL: ${u}`);
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHttpHost(parsed.hostname)) {
+    throw new Error(`refusing to proxy a private/metadata address (${parsed.hostname})`);
+  }
+  return parsed;
+}