@chatpanel/bridge 0.10.21 → 0.10.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.21",
+  "version": "0.10.22",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/engines/antigravity.js

@@ -16,6 +16,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { killOnAbort } from '../proc.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 const IDLE_MS = Number(process.env.CHATPANEL_AGY_TIMEOUT_MS) || 180_000;
 const SCRATCH = path.join(os.tmpdir(), 'chatpanel-agy-scratch');
@@ -78,7 +80,7 @@ function writeImages(images, dir) {
   return files;
 }
 
-export async function chat({ messages, system, options, images }, emit) {
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
   try {
     mkdirSync(SCRATCH, { recursive: true });
   } catch {
@@ -102,7 +104,8 @@ export async function chat({ messages, system, options, images }, emit) {
   const args = ['-p', prompt];
   if (options.model) args.push('--model', options.model);
   if (options.permissionMode === 'bypassPermissions') args.push('--dangerously-skip-permissions');
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  // Drop caller extras that would auto-approve tools (shared sanitizer).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.antigravity, emit);
 
   await new Promise((resolve, reject) => {
     let child;
@@ -113,6 +116,8 @@ export async function chat({ messages, system, options, images }, emit) {
       return reject(new Error(`Failed to start agy: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → terminate the agy child
+
     let out = '';
     let err = '';
     let streamed = false;
@@ -137,12 +142,15 @@ export async function chat({ messages, system, options, images }, emit) {
     child.stderr.on('data', (d) => { armIdle(); err += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
       reject(new Error(`Failed to start agy: ${e.message}`));
     });
     child.on('close', (code) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
+      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly
       if (code === 0) {
         if (!streamed) emit({ type: 'delta', text: out.trim() || '(no output)' });
         emit({ type: 'done', text: '' });

package/src/engines/args.js

@@ -0,0 +1,42 @@
+// Caller-supplied "extra CLI arguments" sanitizer (shared by every engine).
+//
+// The extension/model can pass free-form extraArgs to the agent CLI. A prompt-
+// injected model must NOT be able to smuggle a flag that re-opens the sandbox /
+// permission boundary the engine deliberately sets (e.g. Codex's
+// --dangerously-bypass-approvals-and-sandbox, Claude's --permission-mode). Since
+// these flags take values, partial filtering is unsafe — if ANY forbidden token is
+// present we drop the WHOLE extraArgs. Previously only claude.js did this; codex,
+// antigravity and custom pushed extraArgs unfiltered (this closes that gap).
+
+export function splitArgs(raw) {
+  return String(raw || '').split(/\s+/).filter(Boolean);
+}
+
+// Per-engine escalation flags. Long flags use \b so `--flag=value` is caught too;
+// short flags are exact-matched so we don't over-block a benign token.
+export const FORBIDDEN = {
+  claude: /^--?(permission-mode|allowed-?tools|disallowed-?tools|dangerously|add-dir|mcp-config|setting-sources|permission-prompt-tool)/i,
+  // Codex: sandbox / approval escalation + `-c key=val` (can set approval_policy or
+  // sandbox_mode in TOML) + `-C/--cd` (retarget the working dir).
+  codex: /^(-s|-a|-c|-C)$|^--(dangerously[\w-]*|sandbox|ask-for-approval|full-auto|yolo|config|cd)\b/i,
+  antigravity: /^--(dangerously[\w-]*|skip-permissions|trust-all-?tools|yolo|full-auto)\b/i,
+  // Custom runs an arbitrary CLI, so only clearly-dangerous LONG flags are blocked
+  // (no short-flag guesses that might collide with a benign tool option).
+  custom: /^--(dangerously[\w-]*|skip-permissions|trust-all-?tools|no-sandbox|bypass|yolo|full-auto|permission-mode|allowed-?tools|disallowed-?tools|mcp-config)\b/i,
+};
+
+// Returns { args, blocked }. `blocked:true` => the whole extraArgs was dropped.
+export function sanitizeExtraArgs(raw, forbidden) {
+  const tokens = splitArgs(raw);
+  if (tokens.some((t) => forbidden.test(t))) return { args: [], blocked: true };
+  return { args: tokens, blocked: false };
+}
+
+// Convenience for the engines: sanitize, push the safe tokens onto `args`, and emit
+// a status when something was dropped.
+export function pushExtraArgs(args, raw, forbidden, emit) {
+  if (!raw) return;
+  const { args: extra, blocked } = sanitizeExtraArgs(raw, forbidden);
+  if (blocked) { try { emit?.({ type: 'status', text: '(ignored unsafe extraArgs)' }); } catch { /* ignore */ } return; }
+  args.push(...extra);
+}

package/src/engines/claude.js

@@ -19,6 +19,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { resolveClaude, buildSpawnSpec, isCompiledBinary, selfMcpStdio } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { killOnAbort } from '../proc.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 // Write base64 data-URL images to temp files. Claude Code reads them with its
 // Read tool (which feeds images to the model as vision), so we just reference the
@@ -95,7 +97,7 @@ export function claudeMcpConfig(mcp) {
 // Spawn claude (however it resolves) and stream its stream-json output via
 // `emit`. Resolves with { streamedAny, resultText } once it closes 0. Returns
 // null (no spawn) when claude can't be resolved, so the caller can fall back.
-function runClaude({ prompt, args, cwd, emit }) {
+function runClaude({ prompt, args, cwd, emit, signal }) {
   const spec = resolveClaude();
   if (!spec) return null;
   const [bin, argv, opts] = buildSpawnSpec(spec, args, cwd);
@@ -108,6 +110,8 @@ function runClaude({ prompt, args, cwd, emit }) {
       return reject(new Error(`Failed to start claude: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → terminate the claude child
+
     let stdout = '';
     let stderr = '';
     let streamedAny = false;
@@ -145,10 +149,13 @@ function runClaude({ prompt, args, cwd, emit }) {
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       reject(new Error(`Failed to start claude (${bin}): ${e.message}`));
     });
     child.on('close', (code) => {
       clearTimeout(idleTimer);
+      detach();
+      if (signal?.aborted) { resolve({ streamedAny, resultText }); return; } // Stop pressed — end quietly
       if (code === 0) resolve({ streamedAny, resultText });
       else reject(new Error(`Claude Code exited ${code}: ${stderr.trim().split('\n').pop() || 'failed'}`));
     });
@@ -204,7 +211,7 @@ export function handleMessage(msg, emit, alreadyStreamed) {
   return out;
 }
 
-export async function chat({ messages, system, options, images }, emit) {
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
   const permissionMode = options.permissionMode || 'default';
   // Explicit project dir, else null → CLI runs in home (or WSL home).
   const cwd = options.workingDir ? path.resolve(options.workingDir) : null;
@@ -259,22 +266,13 @@ export async function chat({ messages, system, options, images }, emit) {
     }: ${imageFiles.join(', ')}`;
   }
 
-  if (options.extraArgs) {
-    const extra = String(options.extraArgs).split(/\s+/).filter(Boolean);
-    // Never let caller-supplied extras re-open the read-only boundary the mode
-    // flags above establish. If ANY security-sensitive flag is present, drop the
-    // whole extraArgs (these tokens take values, so partial filtering is unsafe).
-    const FORBIDDEN = /^--?(permission-mode|allowed-?tools|disallowed-?tools|dangerously|add-dir|mcp-config|setting-sources|permission-prompt-tool)/i;
-    if (extra.some((t) => FORBIDDEN.test(t))) {
-      emit({ type: 'status', text: '(ignored unsafe extraArgs)' });
-    } else {
-      args.push(...extra);
-    }
-  }
-  const run = runClaude({ prompt, args, cwd, emit });
+  // Never let caller-supplied extras re-open the read-only boundary the mode flags
+  // above establish (shared sanitizer — see args.js).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.claude, emit);
+  const run = runClaude({ prompt, args, cwd, emit, signal });
   if (run === null) {
     cleanup(); // SDK fallback doesn't take images yet
-    return sdkChat({ messages, system, options }, emit);
+    return sdkChat({ messages, system, options }, emit, { signal });
   }
   try {
     const { streamedAny, resultText } = await run;
@@ -335,11 +333,18 @@ function loadSdk() {
   return sdkPromise;
 }
 
-async function sdkChat({ messages, system, options }, emit) {
+async function sdkChat({ messages, system, options }, emit, { signal } = {}) {
   const sdk = await loadSdk();
   if (!sdk) throw new Error(lastReason);
   const { query } = sdk;
 
+  // The SDK cancels the run when this controller aborts — forward the request signal.
+  const abortController = new AbortController();
+  if (signal) {
+    if (signal.aborted) abortController.abort();
+    else signal.addEventListener('abort', () => abortController.abort(), { once: true });
+  }
+
   const permissionMode = options.permissionMode || 'default';
   const cwd = options.workingDir ? path.resolve(options.workingDir) : os.homedir();
   const writesAllowed = permissionMode === 'acceptEdits' || permissionMode === 'bypassPermissions';
@@ -358,6 +363,7 @@ async function sdkChat({ messages, system, options }, emit) {
       permissionMode,
       includePartialMessages: true,
       canUseTool,
+      abortController,
       settingSources: options.useLocalConfig === false ? [] : ['user', 'project'],
       systemPrompt: system
         ? { type: 'preset', preset: 'claude_code', append: system }
@@ -366,10 +372,15 @@ async function sdkChat({ messages, system, options }, emit) {
       ...(process.env.CHATPANEL_MAX_TURNS ? { maxTurns: Number(process.env.CHATPANEL_MAX_TURNS) } : {}),
     },
   });
-  for await (const message of iterator) {
-    const r = handleMessage(message, emit, streamedAny);
-    if (r.streamed) streamedAny = true;
-    if (r.result != null) resultText = r.result;
+  try {
+    for await (const message of iterator) {
+      const r = handleMessage(message, emit, streamedAny);
+      if (r.streamed) streamedAny = true;
+      if (r.result != null) resultText = r.result;
+    }
+  } catch (e) {
+    if (signal?.aborted || abortController.signal.aborted) return; // Stop pressed — end quietly
+    throw e;
   }
   emit({ type: 'done', text: streamedAny ? '' : resultText });
 }

package/src/engines/cli-agents.js

@@ -1,8 +1,6 @@
 // Built-in CLI agents — pi, opencode, kiro — that reuse the shared custom-engine
-// runner (runSpec) with a FIXED spec each. Unlike the Pro "custom" engine, these
-// are NOT entitlement-gated: they ship as built-ins, and the extension bounds
-// free users to a single usable agent (FREE_LIMITS.bridgeAgents). Bring-your-own
-// arbitrary CLIs stay Pro via custom.js.
+// runner (runSpec) with a fixed spec each. These are fixed built-in engines and are
+// not entitlement-gated; custom BYO CLIs are handled by custom.js.
 //
 // Specs come from each CLI's actual flags:
 //   pi       — pi -p "<prompt>"        · --model · @{path} images · --list-models
@@ -34,8 +32,8 @@ function makeCliAgent(command, spec, notFoundHint) {
     listModels(options = {}) {
       return listSpecModels(command, spec.listModelsArgs, options.workingDir);
     },
-    chat(input, emit) {
-      return runSpec(resolvedSpec, input, emit);
+    chat(input, emit, opts) {
+      return runSpec(resolvedSpec, input, emit, opts);
     },
   };
 }

package/src/engines/codex.js

@@ -15,12 +15,14 @@
 // the agent to point it at a real project.
 
 import { spawn, spawnSync } from 'node:child_process';
+import { killOnAbort } from '../proc.js';
 import { readFile, unlink, writeFile } from 'node:fs/promises';
 import { existsSync, mkdirSync, symlinkSync, readFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin, selfMcpStdio } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 // Idle timeout: re-armed on every stdout/stderr chunk, so a long run that keeps
 // streaming never trips it — only true silence does. Override with
@@ -136,7 +138,7 @@ async function writeImages(images, tag) {
   return files;
 }
 
-export async function chat({ messages, system, options, images }, emit) {
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
   ensureScratch();
   const tag = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
   const outFile = path.join(os.tmpdir(), `chatpanel-codex-${tag}.txt`);
@@ -162,7 +164,8 @@ export async function chat({ messages, system, options, images }, emit) {
   // `-c key=value` parses value as TOML; JSON.stringify yields valid TOML here.
   args.push(...codexMcpConfigArgs(options.mcp));
   if (options.model) args.push('-m', options.model);
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  // Drop caller extras that would re-open the sandbox/approval boundary (shared sanitizer).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.codex, emit);
   for (const f of imageFiles) args.push('-i', f); // attach images to the initial prompt
   args.push('-');
 
@@ -183,6 +186,8 @@ export async function chat({ messages, system, options, images }, emit) {
       return reject(new Error(`Failed to start codex: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → SIGTERM/SIGKILL the codex child
+
     let stdout = '';
     let stderr = '';
     let idleTimer;
@@ -213,11 +218,13 @@ export async function chat({ messages, system, options, images }, emit) {
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       cleanupImages();
       reject(e);
     });
     child.on('close', async (code) => {
       clearTimeout(idleTimer);
+      detach();
       let text = '';
       try {
         text = (await readFile(outFile, 'utf8')).trim();
@@ -226,6 +233,7 @@ export async function chat({ messages, system, options, images }, emit) {
       }
       unlink(outFile).catch(() => {});
       cleanupImages();
+      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly, no error
       if (code === 0) {
         emit({ type: 'delta', text: text || '(no output)' });
         emit({ type: 'done', text: '' });

package/src/engines/custom.js

@@ -5,9 +5,7 @@
 // Windows cli.js+.cmd / WSL — same launcher as Claude), pipes the prompt in, and
 // streams output back.
 //
-// HARD Pro gate: a custom agent only runs if the request carries a valid,
-// server-signed entitlement token (verified OFFLINE here — no network). A forked
-// client or a raw POST can't forge it, so this is real gating, not UI.
+// Custom agents require a valid entitlement token, verified offline here (no network).
 //
 // Output formats:
 //   'text' (default) — stream stdout straight through as text deltas. Works for
@@ -21,8 +19,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { resolveCommand, buildSpawnSpec, selfMcpStdio } from '../env.js';
 import { isProEntitled } from '../entitlement.js';
+import { killOnAbort } from '../proc.js';
 import { handleMessage } from './claude.js';
 import { buildCliPrompt } from './prompt.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
 
 // Write base64 data-URL images to temp files so a custom CLI can take them via
 // its configured `imageArg` template (e.g. "-i {path}", "@{path}"). Returns paths.
@@ -95,7 +95,7 @@ function parseModelList(stdout) {
 
 // Unified model listing: run the agent's CONFIGURED list-models invocation
 // (e.g. pi `--list-models`, opencode `models`) and parse the output. Returns []
-// when not configured. Pro-gated like chat (it runs the user's CLI).
+// when not configured. Requires Pro (runs the user's CLI).
 export async function listModels(options = {}) {
   if (!(await isProEntitled(options.entitlement))) {
     throw new Error('Custom agents require ChatPanel Pro.');
@@ -104,8 +104,8 @@ export async function listModels(options = {}) {
   return listSpecModels(spec.command, spec.listModelsArgs, options.workingDir);
 }
 
-// Shared model listing (no Pro gate): run a CLI's list-models invocation and
-// parse it. Used by the Pro custom engine (gated above) AND built-in CLI agents.
+// Shared model listing: run a CLI's list-models invocation and parse it. Used by
+// the custom engine and the built-in CLI agents.
 export async function listSpecModels(command, listModelsArgs, workingDir) {
   const listArgs = String(listModelsArgs || '').trim();
   if (!command || !listArgs) return [];
@@ -360,18 +360,16 @@ export async function ensureStableMcpConfig(spec, cwd, label, emit, deps = {}) {
   throw new Error(`${label} browser-tool setup completed, but the MCP server is still not visible. Run: ${setupCommand}`);
 }
 
-export async function chat({ messages, system, options, images }, emit) {
-  // Pro gate — verified, not just UI. No valid signed entitlement → no run.
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
+  // Require a valid signed entitlement before running.
   if (!(await isProEntitled(options.entitlement))) {
     throw new Error('Custom agents require ChatPanel Pro. Upgrade in Settings to bring your own CLI agent.');
   }
-  return runSpec(options.custom || {}, { messages, system, options, images }, emit);
+  return runSpec(options.custom || {}, { messages, system, options, images }, emit, { signal });
 }
 
-// Run a CLI agent from a spec — SHARED by the Pro custom engine (gated in chat()
-// above) and the built-in CLI engines (pi/opencode/kiro). This never gates; the
-// built-in agents are bounded instead by the extension's free 1-agent limit.
-export async function runSpec(spec, { messages, system, options = {}, images }, emit) {
+// Run a CLI agent from a spec — shared by the custom engine and the built-in CLI engines.
+export async function runSpec(spec, { messages, system, options = {}, images }, emit, { signal } = {}) {
   if (!spec.command) throw new Error('This agent has no command configured.');
 
   const resolved = resolveCommand(spec.command);
@@ -394,9 +392,13 @@ export async function runSpec(spec, { messages, system, options = {}, images },
       ? String(spec.args).split(/\s+/).filter(Boolean)
       : [];
   // User-supplied extra CLI flags (Settings → agent → "Extra arguments"), placed
-  // right after the base args/subcommand — e.g. opencode `run --format json
-  // --dangerously-skip-permissions`. Applies to every built-in & custom CLI agent.
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  // right after the base args/subcommand. Sanitized (shared helper): escalation flags
+  // (--dangerously*, --skip-permissions, --trust-all-tools, --no-sandbox …) are dropped
+  // from the EXTRA args so an injected value can't unlock tools. The built-in agents'
+  // intentional autonomy flags live in their BASE spec (cli-agents.js), not here, so
+  // they're unaffected; a custom CLI that genuinely needs such a flag should carry it
+  // in its configured command/args, not the extra-args field.
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN.custom, emit);
   // Inject the selected model via the agent's CONFIGURED model-arg template
   // (e.g. "--model {model}" or, for opencode, "-m {model}" with provider/model).
   // Without a template we can't know how this CLI takes a model, so options.model
@@ -486,6 +488,8 @@ export async function runSpec(spec, { messages, system, options = {}, images },
       return reject(new Error(`Failed to start ${label}: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → terminate the CLI child
+
     let stderr = '';
     let streamedAny = false;
     let resultText = '';
@@ -552,12 +556,15 @@ export async function runSpec(spec, { messages, system, options = {}, images },
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
       reject(new Error(`Failed to start ${label}: ${e.message}`));
     });
     child.on('close', (code) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
+      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly
       if (code === 0) {
         emit({ type: 'done', text: streamedAny ? '' : resultText });
         resolve();

package/src/entitlement.js

@@ -1,11 +1,7 @@
-// Offline Pro/Team entitlement verification — the HARD gate for paid features
-// (e.g. custom "bring your own CLI" agents).
-//
-// The license server (Cloudflare Worker) signs a compact entitlement token with
-// an ECDSA P-256 private key that lives ONLY there. The bridge ships the matching
-// PUBLIC key and verifies the signature locally — no network, no secret. A forked
-// client or a raw `curl` to the bridge can't forge entitlement without the
-// private key, so this is a real cryptographic gate, not a UI check.
+// Offline entitlement verification. The license server signs a compact entitlement
+// token with an ECDSA P-256 private key; the bridge ships the matching public key
+// and verifies the token's signature locally (no network). Gates Pro features such
+// as "bring your own" custom CLI agents.
 //
 // Token format (identical to the extension's, extension/js/license.js):
 //   token   = base64url(JSON payload) + "." + base64url(raw ECDSA signature)
@@ -44,9 +40,8 @@ function publicKey() {
 }
 
 // Verify a server entitlement token. Returns its payload, or null. Checks the
-// ECDSA signature (unforgeable without the private key), the token type, and
-// expiry. install_id binding is the extension's concern — for the bridge gate the
-// signature is what matters.
+// ECDSA signature, the token type, and expiry. install_id binding is handled by
+// the extension; the bridge checks the signature.
 export async function verifyEntitlement(token) {
   if (!token || typeof token !== 'string' || token.indexOf('.') < 0) return null;
   const [head, sig] = token.split('.');
@@ -70,7 +65,8 @@ export async function verifyEntitlement(token) {
     return null;
   }
   if (payload.typ !== 'ent') return null;
-  if (payload.exp && Date.now() > payload.exp) return null;
+  // exp is required; the worker always mints a finite exp, so requiring one is non-breaking.
+  if (typeof payload.exp !== 'number' || !Number.isFinite(payload.exp) || Date.now() > payload.exp) return null;
   return payload;
 }
 

package/src/net.js

@@ -0,0 +1,107 @@
+// VENDORED COPY of chatpanel-pii/net.js — keep in sync with the canonical engine
+// (the bridge stays dependency-free, so this is a copy, not an import). Regenerate
+// by copying ../chatpanel-pii/net.js over this file (then re-add this header).
+//
+// Shared host classifier + outbound-URL guard — the SSRF primitive.
+//
+// One implementation of "what is a loopback / cloud-metadata / private host",
+// delivered the way the rest of @chatpanel/pii is: npm dependency for the
+// gateway/bridge, vendorable into the browser extension (pure — only URL + string
+// ops, no node APIs, so it runs in a Worker/service-worker too). Replaces the
+// hand-maintained copies in the bridge (src/ssrf.js) and the extension
+// (js/context.js isBlockedHost) so a security guard can't silently drift between
+// the direct client path and the proxied path. See docs/secure-data-plane.md.
+//
+// The policy knobs cover the two legitimate trust contexts:
+//   • A MODEL / API / MCP endpoint (gateway upstream, bridge MCP proxy) may live on
+//     loopback (Ollama, LM Studio) or the LAN (a homelab GPU box) — so those are
+//     allowed by default — but must NEVER reach cloud instance metadata.
+//   • A WEB PAGE fetch (link title, page context) has no business touching loopback
+//     or any private host at all — call with { allowLoopback:false, allowPrivate:false }.
+// Cloud metadata (169.254.169.254 & friends) and non-http(s) schemes are blocked in
+// BOTH contexts, unconditionally. Re-run the assert on every redirect hop.
+
+function ipv4(h) {
+  const m = String(h).match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+const norm = (hostname) => String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+
+// Loopback = this host's own services (127.0.0.0/8, ::1, localhost, *.localhost).
+export function isLoopbackHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — the sharpest SSRF target (credential theft). Covers the
+// link-local IMDS address used by AWS/GCP/Azure/DO (169.254.169.254), Alibaba's
+// 100.100.100.200, and the GCP/name-based metadata hosts. ALWAYS blocked.
+export function isMetadataHost(hostname) {
+  const h = norm(hostname);
+  if (h === 'metadata.google.internal' || h === 'metadata') return true;
+  const o = ipv4(h);
+  if (!o) return false;
+  if (o[0] === 169 && o[1] === 254) return true;                 // 169.254.169.254 (+ link-local)
+  if (o[0] === 100 && o[1] === 100 && o[2] === 100 && o[3] === 200) return true; // Alibaba IMDS
+  return false;
+}
+
+// Private / internal address space, EXCLUDING loopback + metadata (checked
+// separately): RFC1918, CGNAT, IPv6 ULA/link-local, mDNS .local, this-host 0.x/::.
+export function isPrivateHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (h.endsWith('.local')) return true;
+  if (
+    h === '::' || h.startsWith('fc') || h.startsWith('fd')       // IPv6 ULA
+    || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb') // link-local
+  ) return true;
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true;                        // this-host / RFC1918
+    if (a === 169 && b === 254) return true;                     // link-local
+    if (a === 172 && b >= 16 && b <= 31) return true;            // RFC1918
+    if (a === 192 && b === 168) return true;                     // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;           // CGNAT
+  }
+  return false;
+}
+
+// Policy-driven classifier. Returns true if `hostname` must be blocked under `policy`.
+// Defaults model the ENDPOINT context (loopback + LAN allowed, metadata never).
+export function isBlockedHost(hostname, { allowLoopback = true, allowPrivate = true } = {}) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (isMetadataHost(h)) return true;                            // never, in any context
+  if (isLoopbackHost(h)) return !allowLoopback;
+  if (isPrivateHost(h)) return !allowPrivate;
+  return false;                                                  // public host
+}
+
+// Assert a URL is fetchable under `policy`; returns the parsed URL or throws.
+// Call on the initial URL AND after every redirect hop.
+export function assertFetchableUrl(u, policy = {}) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHost(parsed.hostname, policy)) {
+    throw new Error(`refusing to reach a blocked address (${parsed.hostname})`);
+  }
+  return parsed;
+}
+
+// Endpoint context: model/API/MCP upstream — loopback + LAN OK, metadata never.
+export const assertEndpointUrl = (u, opts = {}) => assertFetchableUrl(u, { allowLoopback: true, allowPrivate: true, ...opts });
+// Web-page context: no loopback, no private, no metadata — genuinely public only.
+export const assertPublicWebUrl = (u) => assertFetchableUrl(u, { allowLoopback: false, allowPrivate: false });

package/src/proc.js

@@ -0,0 +1,21 @@
+// Terminate a spawned CLI child when an AbortSignal fires. The extension's Stop
+// button aborts the /chat request; server.js turns that disconnect into an abort on
+// this signal. Without this, the agent CLI (codex / claude / agy / custom) keeps
+// running to completion in the background after Stop — burning tokens and holding the
+// session — and only the 3-minute idle timer would eventually reap it.
+//
+// SIGTERM first so the CLI can flush + exit cleanly (its own child procs get the
+// signal via the process group where the platform delivers it), then SIGKILL after a
+// short grace if it's still alive. Returns a detach() to drop the listener once the
+// child exits normally.
+export function killOnAbort(child, signal, { graceMs = 1500 } = {}) {
+  if (!signal || !child) return () => {};
+  const onAbort = () => {
+    try { child.kill('SIGTERM'); } catch { /* already exited */ }
+    const t = setTimeout(() => { try { child.kill('SIGKILL'); } catch { /* gone */ } }, graceMs);
+    if (t.unref) t.unref(); // don't keep the event loop alive just for the grace timer
+  };
+  if (signal.aborted) { onAbort(); return () => {}; }
+  signal.addEventListener('abort', onAbort, { once: true });
+  return () => { try { signal.removeEventListener('abort', onAbort); } catch { /* noop */ } };
+}

package/src/server.js

@@ -30,6 +30,7 @@ import { pi, opencode, kiro } from './engines/cli-agents.js';
 import * as custom from './engines/custom.js';
 import { installService, uninstallService, serviceStatus, restartService } from './service.js';
 import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
+import { stripHidden } from './sanitize.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
 import { assertPublicHttpUrl, assertPublicWebUrl } from './ssrf.js';
@@ -37,7 +38,7 @@ import { assertPublicHttpUrl, assertPublicWebUrl } from './ssrf.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.21';
+const VERSION = '0.10.22';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -108,10 +109,13 @@ function relayToolCall(session, name, input) {
 
 // The extension returns a string OR { text, image(dataURL) }; map to MCP content.
 function toMcpContent(result) {
+  // L5: de-steganographize tool-result TEXT before it flows back to the CLI/model —
+  // the bridge is a public localhost endpoint, so (like the prompt path) it must strip
+  // ASCII-smuggled / bidi Unicode from relayed results, not assume the caller did.
   if (result == null) return { content: [{ type: 'text', text: 'ok' }] };
-  if (typeof result === 'string') return { content: [{ type: 'text', text: result }] };
+  if (typeof result === 'string') return { content: [{ type: 'text', text: stripHidden(result) }] };
   const content = [];
-  if (result.text) content.push({ type: 'text', text: String(result.text) });
+  if (result.text) content.push({ type: 'text', text: stripHidden(String(result.text)) });
   if (typeof result.image === 'string') {
     const m = /^data:([^;]+);base64,(.+)$/s.exec(result.image);
     if (m) content.push({ type: 'image', data: m[2], mimeType: m[1] });
@@ -330,9 +334,13 @@ async function handleChat(req, res) {
     if (!res.writableEnded) res.write(`data: ${JSON.stringify(obj)}\n\n`);
   };
 
-  // If the client disconnects, stop caring about late writes.
+  // If the client disconnects (Stop, or the panel closes), stop caring about late
+  // writes AND abort the run so the engine kills its CLI child instead of letting it
+  // finish in the background. Older engines ignore the signal (harmless); the spawn
+  // engines honor it via killOnAbort.
   let closed = false;
-  req.on('close', () => (closed = true));
+  const ac = new AbortController();
+  req.on('close', () => { closed = true; ac.abort(); });
 
   const safeEmit = (obj) => { if (!closed) emit(obj); };
 
@@ -358,6 +366,7 @@ async function handleChat(req, res) {
         images: Array.isArray(body.images) ? body.images : [],
       },
       safeEmit,
+      { signal: ac.signal },
     );
   } catch (e) {
     log('error', `${body.agent} chat failed: ${e?.message || e}`);
@@ -718,11 +727,16 @@ const server = createServer(async (req, res) => {
   try {
     if (req.method === 'GET' && url.pathname === '/health') return handleHealth(res);
     if (req.method === 'GET' && url.pathname === '/debug') {
+      // L6: by default expose only version + agent AVAILABILITY (a boolean) — enough
+      // to diagnose "is codex installed?". The full home dir, $PATH, and resolved
+      // binary paths (which embed the username / home) leak environment detail, so
+      // they're opt-in behind CHATPANEL_BRIDGE_DEBUG=1. The extension doesn't read
+      // this route, so trimming it by default breaks nothing.
+      const verbose = /^(1|true|yes|on)$/i.test(process.env.CHATPANEL_BRIDGE_DEBUG || '');
       return json(res, 200, {
         version: VERSION,
-        home: os.homedir(),
-        agents: Object.fromEntries(AGENT_CLIS.map((name) => [name, findAgentBin(name) || null])),
-        path: process.env.PATH,
+        agents: Object.fromEntries(AGENT_CLIS.map((name) => [name, verbose ? (findAgentBin(name) || null) : !!findAgentBin(name)])),
+        ...(verbose ? { home: os.homedir(), path: process.env.PATH } : {}),
       });
     }
     if (req.method === 'POST' && url.pathname === '/chat') return handleChat(req, res);
@@ -826,6 +840,12 @@ function startServer() {
   });
   server.listen(PORT, HOST, async () => {
     log('info', `listening on http://${HOST}:${PORT}`);
+    // M7: a non-loopback bind disables the anti-DNS-rebinding Host check (hostAllowed
+    // returns true for any Host), so the only inbound guard left is the per-install
+    // token / extension Origin. Make that trade-off LOUD — it's rarely what you want.
+    if (!LOOPBACK_HOSTNAMES.has(HOST)) {
+      log('error', `⚠ SECURITY: bound to NON-LOOPBACK host ${HOST}. The anti-rebinding Host check is OFF, so any device that reaches this port (and any web page via a spoofed Host header) can drive local agents — gated only by the bridge token. Only do this on a trusted, firewalled network; prefer 127.0.0.1.`);
+    }
     for (const [, { engine, label, hidden }] of Object.entries(ENGINES)) {
       if (hidden) continue;
       const a = await engine.available().catch(() => ({ ok: false }));

package/src/ssrf.js

@@ -1,88 +1,35 @@
-// SSRF guard for the /mcp-remote proxy.
+// SSRF guard for the bridge's outbound proxies (/mcp-remote, /fetch-title).
 //
-// The bridge proxies ONE JSON-RPC message to a remote MCP server *from this
-// machine* (no browser Origin header), so the extension can reach servers that
-// reject browser origins. That route is already privileged — it requires the
-// extension origin or the per-install bridge token, so a random web page cannot
-// drive it. This guard is the second layer: even when driven by the extension,
-// the bridge must not become a relay that a prompt-injected agent could point at
-// cloud metadata or use to sweep the LAN.
+// The host CLASSIFICATION (what is loopback / cloud-metadata / RFC1918 / CGNAT /
+// ULA / link-local / .local) now lives in ONE shared place — src/net.js, a vendored
+// copy of @chatpanel/pii/net.js, the same classifier the gateway and extension use.
+// This file keeps only the bridge's two POLICIES + their exact error messages, so a
+// security guard can't drift between the direct client path and the proxied path.
+// See docs/secure-data-plane.md.
 //
-// Policy:
-//   • Loopback (127.0.0.0/8, ::1, localhost, *.localhost) → ALLOWED.
-//     It's the user's own host — the same place the bridge runs, and a place the
-//     extension can already fetch DIRECTLY. Proxying it grants no new reach; it
-//     only drops the browser Origin header (the whole point of "via bridge").
-//     Localhost MCP servers are the common case.
-//   • Cloud instance metadata (169.254.169.254) → ALWAYS BLOCKED.
-//     This is the sharpest SSRF target (credential theft) and is blocked even
-//     when private hosts are opted in.
-//   • Everything else private/internal (RFC1918, CGNAT, link-local, IPv6 ULA,
-//     0.0.0.0, ::, *.local) → BLOCKED, unless the operator opts in with
-//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (for reaching an MCP server on
-//     another machine on a trusted LAN).
-//   • Non-http(s) schemes → BLOCKED.
+// Two policies:
+//   • /mcp-remote (assertPublicHttpUrl): loopback ALLOWED (the user's own MCP
+//     servers — the whole point of "via bridge"), cloud metadata ALWAYS blocked,
+//     every other private/LAN range blocked UNLESS the operator opts in with
+//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (reaching an MCP server on a trusted LAN).
+//   • /fetch-title (assertPublicWebUrl): STRICTER — a page fetch has no business
+//     touching loopback OR any private host, so loopback + metadata + every private
+//     range are blocked unconditionally (the opt-in is deliberately NOT honored).
 //
-// The same checks run on the initial URL AND after any redirect.
+// Non-http(s) schemes are blocked in both. Run the assert on the initial URL AND
+// after every redirect hop.
+
+import { isLoopbackHost, isBlockedHost } from './net.js';
+
+export { isLoopbackHost };
 
 const ALLOW_PRIVATE_HOSTS = /^(1|true|yes|on)$/i.test(
   process.env.CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS || '',
 );
 
-function ipv4(h) {
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (!m) return null;
-  const o = m.slice(1).map(Number);
-  if (o.some((n) => n > 255)) return null;
-  return o;
-}
-
-// Loopback = this host's own services. Reachable by the extension directly, so
-// allowing the bridge to reach it adds no capability.
-export function isLoopbackHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h) return false;
-  if (h === 'localhost' || h.endsWith('.localhost')) return true;
-  if (h === '::1') return true;
-  const o = ipv4(h);
-  return !!(o && o[0] === 127);
-}
-
-// Cloud instance metadata — credential-theft vector. Always blocked.
-function isMetadataHost(hostname) {
-  const o = ipv4(hostname);
-  return !!(o && o[0] === 169 && o[1] === 254);
-}
-
+// MCP-proxy policy: loopback ok, metadata never, other private only when opted in.
 export function isBlockedHttpHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h) return true;
-  if (isLoopbackHost(h)) return false; // user's own host — allowed
-  if (isMetadataHost(h)) return true; // never proxy cloud metadata, even when private is opted in
-  if (ALLOW_PRIVATE_HOSTS) return false; // operator opted in to LAN/private targets
-
-  // Default deny for the rest of the private/internal space.
-  if (h.endsWith('.local')) return true; // mDNS / LAN
-  if (
-    h === '::' ||
-    h.startsWith('fc') ||
-    h.startsWith('fd') || // IPv6 ULA
-    h.startsWith('fe8') ||
-    h.startsWith('fe9') ||
-    h.startsWith('fea') ||
-    h.startsWith('feb') // IPv6 link-local
-  ) {
-    return true;
-  }
-  const o = ipv4(h);
-  if (o) {
-    const [a, b] = o;
-    if (a === 0 || a === 10) return true; // this-host / RFC1918
-    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
-    if (a === 192 && b === 168) return true; // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  }
-  return false;
+  return isBlockedHost(hostname, { allowLoopback: true, allowPrivate: ALLOW_PRIVATE_HOSTS });
 }
 
 export function assertPublicHttpUrl(u) {
@@ -101,41 +48,9 @@ export function assertPublicHttpUrl(u) {
   return parsed;
 }
 
-// STRICTER guard for fetching arbitrary WEB pages (the /fetch-title route). Unlike the MCP proxy,
-// a page fetch has NO legitimate reason to reach the user's own loopback services or any LAN /
-// private host — those would be pure SSRF (port-scan the LAN, hit a localhost admin panel, read
-// cloud metadata). So loopback + metadata + every private/internal range are blocked
-// UNCONDITIONALLY here; the CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS opt-in (meant for reaching a LAN
-// MCP server, a different trust context) is deliberately NOT honored. Only genuinely public
-// http(s) hosts pass. Re-run this on every redirect hop, not just the initial URL.
+// Web-fetch policy (stricter): block loopback + metadata + all private, always.
 export function isDisallowedWebHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h) return true;
-  if (isLoopbackHost(h)) return true; // localhost/127.x — a page fetch must never touch it
-  if (isMetadataHost(h)) return true; // 169.254.169.254 — credential theft
-  if (h.endsWith('.local')) return true; // mDNS / LAN
-  if (
-    h === '::' ||
-    h.startsWith('fc') ||
-    h.startsWith('fd') || // IPv6 ULA
-    h.startsWith('fe8') ||
-    h.startsWith('fe9') ||
-    h.startsWith('fea') ||
-    h.startsWith('feb') // IPv6 link-local
-  ) {
-    return true;
-  }
-  const o = ipv4(h);
-  if (o) {
-    const [a, b] = o;
-    if (a === 0 || a === 10) return true; // this-host / RFC1918
-    if (a === 127) return true; // loopback (also caught above; explicit for clarity)
-    if (a === 169 && b === 254) return true; // link-local (incl. metadata)
-    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
-    if (a === 192 && b === 168) return true; // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  }
-  return false;
+  return isBlockedHost(hostname, { allowLoopback: false, allowPrivate: false });
 }
 
 export function assertPublicWebUrl(u) {