@chatpanel/bridge 0.10.15 → 0.10.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.15",
+  "version": "0.10.17",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/engines/antigravity.js

@@ -11,7 +11,7 @@
 // path so the model opens it.
 
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdirSync, writeFileSync, unlinkSync, existsSync, readFileSync, rmSync } from 'node:fs';
+import { mkdirSync, writeFileSync, unlinkSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin } from '../env.js';
@@ -78,57 +78,6 @@ function writeImages(images, dir) {
   return files;
 }
 
-// Antigravity has no per-run MCP flag (`agy --help` shows none). The CLI only
-// discovers MCP servers from config files: <cwd>/.agents/mcp_config.json
-// (workspace) or ~/.gemini/config/mcp_config.json (global). To give a headless
-// `agy -p` run our page/MCP tools, write the workspace file pointing at the
-// bridge's per-session HTTP MCP server. Remote servers MUST use `serverUrl`
-// (Antigravity rejects the legacy `url`/`httpUrl` fields). This is the agy
-// equivalent of what claude.js/codex.js do via --mcp-config / -c mcp_servers.
-//
-// Non-destructive: an existing .agents/mcp_config.json is parsed, our one server
-// merged in, and the original restored on cleanup. If the file exists but isn't
-// JSON we recognize, we leave it untouched (and tools simply won't attach) rather
-// than risk corrupting the user's config. Returns a cleanup fn (always callable).
-function setupMcpConfig(mcp, cwd) {
-  if (!mcp?.url) return () => {};
-  const dir = path.join(cwd, '.agents');
-  const file = path.join(dir, 'mcp_config.json');
-  const serverName = mcp.serverName || 'chatpanel_browser';
-  const hadDir = existsSync(dir);
-  let prev = null; // original file contents (null = file did not exist)
-
-  let config = { mcpServers: {} };
-  if (existsSync(file)) {
-    try {
-      prev = readFileSync(file, 'utf8');
-      const parsed = JSON.parse(prev);
-      if (!parsed || typeof parsed !== 'object') return () => {};
-      config = parsed;
-      if (!config.mcpServers || typeof config.mcpServers !== 'object') config.mcpServers = {};
-    } catch {
-      return () => {}; // unreadable / not JSON — don't clobber it
-    }
-  }
-  config.mcpServers[serverName] = { serverUrl: mcp.url };
-
-  try {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(file, JSON.stringify(config, null, 2));
-  } catch {
-    return () => {};
-  }
-  return () => {
-    try {
-      if (prev !== null) writeFileSync(file, prev); // restore original contents
-      else if (hadDir) rmSync(file, { force: true }); // remove just the file we added
-      else rmSync(dir, { recursive: true, force: true }); // remove the dir we created
-    } catch {
-      /* best effort */
-    }
-  };
-}
-
 export async function chat({ messages, system, options, images }, emit) {
   try {
     mkdirSync(SCRATCH, { recursive: true });
@@ -141,29 +90,18 @@ export async function chat({ messages, system, options, images }, emit) {
   // reads @-referenced files (incl. images) inline as multimodal input, so no
   // read-tool approval is needed in headless `-p` mode. (Confirmed working.)
   const imageFiles = writeImages(images, cwd);
-  // Wire our page/MCP tools into agy via a workspace mcp_config.json (it has no
-  // per-run MCP flag). Tools then route: agy → bridge /mcp/<session> → extension.
-  const cleanupMcp = setupMcpConfig(options.mcp, cwd);
-  const cleanup = () => {
-    imageFiles.forEach((f) => { try { unlinkSync(f); } catch { /* gone */ } });
-    cleanupMcp();
-  };
+  const cleanup = () => imageFiles.forEach((f) => { try { unlinkSync(f); } catch { /* gone */ } });
   let prompt = buildCliPrompt(messages, system);
   if (imageFiles.length) {
     prompt += `\n\nThe user attached image(s): ${imageFiles.map((f) => '@' + path.basename(f)).join(' ')}`;
   }
 
   // `-p` runs one prompt non-interactively. --model picks the model.
+  // --dangerously-skip-permissions auto-approves tool use (headless has no human
+  // approver) only when the user opted into bypassPermissions.
   const args = ['-p', prompt];
   if (options.model) args.push('--model', options.model);
-  // Headless `agy -p` cannot prompt for tool approval — without this flag any MCP
-  // tool call just times out (it never reaches the server). So skip agy's own
-  // approval whenever the user opted into bypass OR we've attached page/MCP tools.
-  // The real gate stays on the ChatPanel side: each relayed call goes back to the
-  // extension, which applies its per-action confirmation for risky page actions.
-  if (options.permissionMode === 'bypassPermissions' || options.mcp?.url) {
-    args.push('--dangerously-skip-permissions');
-  }
+  if (options.permissionMode === 'bypassPermissions') args.push('--dangerously-skip-permissions');
   if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
 
   await new Promise((resolve, reject) => {

package/src/engines/prompt.js

@@ -1,3 +1,5 @@
+import { stripHidden } from '../sanitize.js';
+
 function roleLabel(role) {
   return role === 'assistant' ? 'Assistant' : 'User';
 }
@@ -24,5 +26,10 @@ export function buildCliPrompt(messages = [], system = '') {
     );
   }
 
-  return parts.join('\n\n---\n\n');
+  // De-steganography on the final prompt before it reaches the local agent. The
+  // extension already scrubs when its redaction is on, but the bridge is also a
+  // public localhost endpoint other clients can call — so strip invisible/format
+  // Unicode here too (hidden instructions via Tag chars, zero-width-split values,
+  // injected fingerprint markers). See src/sanitize.js.
+  return stripHidden(parts.join('\n\n---\n\n'));
 }

package/src/sanitize.js

@@ -0,0 +1,137 @@
+// VENDORED COPY of chatpanel-pii/sanitize.js - keep in sync with the canonical
+// engine (the bridge stays dependency-free, so this is a copy, not an import).
+// Regenerate by copying ../chatpanel-pii/sanitize.js over this file.
+
+// Unicode de-steganography for text that flows through the privacy boundary.
+//
+// Invisible and format-control characters are a single vector with three abuses,
+// all relevant to a redaction product:
+//
+//   1. Redaction bypass - splitting a value with zero-width chars (j<ZWSP>o<ZWSP>hn@x.com)
+//      hides it from the regex/NER detector, then the model reassembles the real
+//      value. The deterministic engine works on text, so the smuggled PII leaks.
+//   2. Hidden prompt injection - Unicode Tag characters (U+E0000-E007F) render as
+//      nothing but encode a full ASCII instruction the model reads ("ASCII smuggling").
+//   3. Fingerprinting / watermarking - steganographic markers injected into a prompt
+//      (e.g. a client classifying a custom gateway and encoding a bit into invisible
+//      punctuation). A privacy proxy should scrub these - and never emit its own.
+//
+// We strip the channels that have no legitimate place in plain prompt text, while
+// PRESERVING the few legitimate uses (emoji ZWJ/variation sequences, normal accents).
+//
+// The patterns are BUILT FROM NUMERIC CODE POINTS below - there are deliberately no
+// literal invisible characters anywhere in this source (auditable, and fitting for a
+// de-steg module). Pure + dependency-free ESM. Call it BEFORE detection so obfuscated
+// PII becomes matchable, and on model output before restoration so a token can't be
+// split/spoofed with invisibles.
+
+// Code-point ranges (inclusive) per category, by their abuse.
+const RANGES = {
+  // Unicode Tag block - the ASCII-smuggling channel.
+  tags: [[0xE0000, 0xE007F]],
+  // Bidi controls - reorder/override visible text to hide reversed instructions.
+  bidi: [[0x061C, 0x061C], [0x200E, 0x200F], [0x202A, 0x202E], [0x2066, 0x2069]],
+  // Zero-width & assorted invisible format chars: soft hyphen, Hangul/Mongolian
+  // fillers, ZWSP, word/invisible joiners, deprecated format controls, BOM/ZWNBSP,
+  // interlinear annotation, object replacement.
+  zeroWidth: [
+    [0x00AD, 0x00AD], [0x115F, 0x1160], [0x180E, 0x180E], [0x200B, 0x200B],
+    [0x2060, 0x2064], [0x206A, 0x206F], [0x3164, 0x3164], [0xFEFF, 0xFEFF],
+    [0xFFA0, 0xFFA0], [0xFFF9, 0xFFFB], [0xFFFC, 0xFFFC],
+  ],
+  // Supplementary variation selectors - the byte-smuggling range. Never legit in text.
+  supVS: [[0xE0100, 0xE01EF]],
+  // Line/paragraph separators - converted to '\n' (kill parser tricks, keep the break).
+  lineSep: [[0x2028, 0x2029]],
+  // ZWJ/ZWNJ + BMP variation selectors - legit ONLY next to an emoji base, so these
+  // are stripped contextually (see ANOMALOUS_JOIN_VS), not unconditionally.
+  joinVS: [[0x200C, 0x200D], [0xFE00, 0xFE0F]],
+};
+
+const u = (cp) => `\\u{${cp.toString(16).toUpperCase()}}`;
+const cls = (ranges) => ranges.map(([a, b]) => (a === b ? u(a) : `${u(a)}-${u(b)}`)).join('');
+
+const TAGS = new RegExp(`[${cls(RANGES.tags)}]`, 'gu');
+const BIDI = new RegExp(`[${cls(RANGES.bidi)}]`, 'gu');
+const ZERO_WIDTH = new RegExp(`[${cls(RANGES.zeroWidth)}]`, 'gu');
+const SUP_VS = new RegExp(`[${cls(RANGES.supVS)}]`, 'gu');
+const LINE_SEP = new RegExp(`[${cls(RANGES.lineSep)}]`, 'gu');
+// Strip ZWJ/ZWNJ/VS only when NOT preceded by an emoji base (so emoji sequences and
+// regional-indicator flags survive); supplementary VS are always stripped.
+const ANOMALOUS_JOIN_VS = new RegExp(
+  `(?<![\\p{Extended_Pictographic}${u(0x1F1E6)}-${u(0x1F1FF)}])[${cls(RANGES.joinVS)}]|[${cls(RANGES.supVS)}]`,
+  'gu',
+);
+// Runs of combining marks (Zalgo / bit-stuffing). A real stacked diacritic is 1-3
+// marks; anything past the cap is signalling, not language.
+const COMBINING_RUN = /\p{M}+/gu;
+
+// Cheap boolean for hot paths / UI ("does this contain anything hidden?"). Excludes
+// the context-dependent joinVS so legitimate emoji aren't flagged - sanitizeUnicode()
+// stays the source of truth for those.
+const ANY_HIDDEN = new RegExp(
+  `[${cls(RANGES.bidi)}${cls(RANGES.zeroWidth)}]|[${cls(RANGES.tags)}]|[${cls(RANGES.supVS)}]`,
+  'u',
+);
+
+export function hasHiddenChars(text) {
+  return typeof text === 'string' && ANY_HIDDEN.test(text);
+}
+
+// sanitizeUnicode(text, opts) -> { clean, removed, findings }
+//   clean    - text with the smuggling channels stripped/normalized
+//   removed  - total count of stripped/collapsed characters (0 = nothing hidden)
+//   findings - per-category counts (only non-zero keys), for transparent reporting
+//
+// opts.normalize: 'NFC' (default, appearance-preserving) | 'NFKC' (also folds
+//   fullwidth/homoglyph compatibility forms - stronger for detection, but rewrites
+//   some visible glyphs) | 'none'.
+// opts.collapseCombiningOver: max combining marks kept per run (default 4).
+export function sanitizeUnicode(text, { normalize = 'NFC', collapseCombiningOver = 4 } = {}) {
+  if (typeof text !== 'string' || text === '') return { clean: text ?? '', removed: 0, findings: {} };
+  let s = text;
+  const findings = {};
+
+  // Strip one category, counting by code point (spread iterates code points, so a
+  // supplementary char like a Tag counts as 1, not 2 UTF-16 units).
+  const strip = (re, key) => {
+    let n = 0;
+    s = s.replace(re, (m) => { n += [...m].length; return ''; });
+    if (n) findings[key] = n;
+  };
+
+  let lineSep = 0;
+  s = s.replace(LINE_SEP, () => { lineSep++; return '\n'; });
+  if (lineSep) findings.lineSep = lineSep;
+
+  strip(TAGS, 'tags');
+  strip(BIDI, 'bidi');
+  strip(ZERO_WIDTH, 'zeroWidth');
+  strip(ANOMALOUS_JOIN_VS, 'joinersVS');
+
+  // Compose canonically so split/decomposed forms can't dodge the detector.
+  if (normalize && normalize !== 'none') {
+    try { s = s.normalize(normalize); } catch { /* invalid form name -> skip */ }
+  }
+
+  let combining = 0;
+  s = s.replace(COMBINING_RUN, (run) => {
+    const marks = [...run];
+    if (marks.length <= collapseCombiningOver) return run;
+    combining += marks.length - collapseCombiningOver;
+    return marks.slice(0, collapseCombiningOver).join('');
+  });
+  if (combining) findings.combining = combining;
+
+  const removed = (findings.tags || 0) + (findings.bidi || 0) + (findings.zeroWidth || 0)
+    + (findings.joinersVS || 0) + (findings.combining || 0);
+  return { clean: s, removed, findings };
+}
+
+// Convenience for the common "just give me clean text" caller.
+export function stripHidden(text, opts) {
+  return sanitizeUnicode(text, opts).clean;
+}
+
+// Exposed for tests / external auditing.
+export const SANITIZE_RANGES = RANGES;

package/src/server.js

@@ -37,7 +37,7 @@ import { assertPublicHttpUrl } from './ssrf.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.15';
+const VERSION = '0.10.17';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;