@chatpanel/bridge 0.10.21 → 0.10.23

package/src/engines/custom.js

@@ -5,9 +5,7 @@
 // Windows cli.js+.cmd / WSL — same launcher as Claude), pipes the prompt in, and
 // streams output back.
 //
-// HARD Pro gate: a custom agent only runs if the request carries a valid,
-// server-signed entitlement token (verified OFFLINE here — no network). A forked
-// client or a raw POST can't forge it, so this is real gating, not UI.
+// Custom agents require a valid entitlement token, verified offline here (no network).
 //
 // Output formats:
 //   'text' (default) — stream stdout straight through as text deltas. Works for
@@ -21,8 +19,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { resolveCommand, buildSpawnSpec, selfMcpStdio } from '../env.js';
 import { isProEntitled } from '../entitlement.js';
-import { handleMessage } from './claude.js';
+import { killOnAbort } from '../proc.js';
 import { buildCliPrompt } from './prompt.js';
+import { pushExtraArgs, FORBIDDEN } from './args.js';
+import { createStreamParser, STREAM_FORMATS, stripAnsi } from './stream-formats.js';
 
 // Write base64 data-URL images to temp files so a custom CLI can take them via
 // its configured `imageArg` template (e.g. "-i {path}", "@{path}"). Returns paths.
@@ -60,11 +60,8 @@ function imageTokensFor(imageArg, files) {
 // CHATPANEL_CUSTOM_TIMEOUT_MS (ms).
 const IDLE_MS = Number(process.env.CHATPANEL_CUSTOM_TIMEOUT_MS) || 180_000;
 
-// Many CLIs emit ANSI colour/escape codes even when piped (kiro-cli does), which
-// leak into the answer as `\x1b[38;5;141m…`. Strip them from text output. (We
-// also set NO_COLOR on the child env, but this is the robust backstop.)
-const ANSI_RE = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
-const stripAnsi = (s) => s.replace(ANSI_RE, '');
+// ANSI stripping moved to stream-formats.js (imported above), which is where
+// text output is actually rendered - one implementation for every format.
 const OPENCODE_STABLE_MCP_URL = 'http://127.0.0.1:4319/mcp';
 const CHATPANEL_STABLE_MCP_URL = 'http://127.0.0.1:4319/mcp';
 
@@ -95,7 +92,7 @@ function parseModelList(stdout) {
 
 // Unified model listing: run the agent's CONFIGURED list-models invocation
 // (e.g. pi `--list-models`, opencode `models`) and parse the output. Returns []
-// when not configured. Pro-gated like chat (it runs the user's CLI).
+// when not configured. Requires Pro (runs the user's CLI).
 export async function listModels(options = {}) {
   if (!(await isProEntitled(options.entitlement))) {
     throw new Error('Custom agents require ChatPanel Pro.');
@@ -104,27 +101,35 @@ export async function listModels(options = {}) {
   return listSpecModels(spec.command, spec.listModelsArgs, options.workingDir);
 }
 
-// Shared model listing (no Pro gate): run a CLI's list-models invocation and
-// parse it. Used by the Pro custom engine (gated above) AND built-in CLI agents.
+// Shared model listing: run a CLI's list-models invocation and parse it. Used by
+// the custom engine and the built-in CLI agents.
 export async function listSpecModels(command, listModelsArgs, workingDir) {
   const listArgs = String(listModelsArgs || '').trim();
   if (!command || !listArgs) return [];
+  const stdout = await runForStdout(command, listArgs.split(/\s+/).filter(Boolean), workingDir);
+  return parseModelList(stdout);
+}
+
+// Run a CLI to completion and return its stdout. Shared by every "ask the CLI
+// something" path (model listing and the per-agent listModels overrides) so the
+// spawn/resolve/timeout handling exists once.
+export async function runForStdout(command, argvIn, workingDir, timeoutMs = 20000) {
+  if (!command) return '';
   const resolved = resolveCommand(command);
   if (!resolved) throw new Error(`Couldn't find "${command}".`);
   const cwd = workingDir ? path.resolve(workingDir) : null;
-  const [bin, argv, opts] = buildSpawnSpec(resolved, listArgs.split(/\s+/).filter(Boolean), cwd);
+  const [bin, argv, opts] = buildSpawnSpec(resolved, argvIn, cwd);
   opts.env = { ...(opts.env || process.env), NO_COLOR: '1', CLICOLOR: '0' };
-  const stdout = await new Promise((resolve, reject) => {
+  return new Promise((resolve, reject) => {
     let child;
     try { child = spawn(bin, argv, opts); } catch (e) { return reject(new Error(`Failed to start ${command}: ${e.message}`)); }
     let out = '';
-    const timer = setTimeout(() => { child.kill('SIGKILL'); reject(new Error('Listing models timed out.')); }, 20000);
+    const timer = setTimeout(() => { child.kill('SIGKILL'); reject(new Error(`${command} timed out.`)); }, timeoutMs);
     child.stdout.on('data', (d) => (out += d.toString()));
     child.on('error', (e) => { clearTimeout(timer); reject(new Error(`Failed to start ${command}: ${e.message}`)); });
     child.on('close', () => { clearTimeout(timer); resolve(out); });
     try { child.stdin.end(); } catch { /* some CLIs don't read stdin */ }
   });
-  return parseModelList(stdout);
 }
 
 function mcpToolSpecs(mcp) {
@@ -360,18 +365,16 @@ export async function ensureStableMcpConfig(spec, cwd, label, emit, deps = {}) {
   throw new Error(`${label} browser-tool setup completed, but the MCP server is still not visible. Run: ${setupCommand}`);
 }
 
-export async function chat({ messages, system, options, images }, emit) {
-  // Pro gate — verified, not just UI. No valid signed entitlement → no run.
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
+  // Require a valid signed entitlement before running.
   if (!(await isProEntitled(options.entitlement))) {
     throw new Error('Custom agents require ChatPanel Pro. Upgrade in Settings to bring your own CLI agent.');
   }
-  return runSpec(options.custom || {}, { messages, system, options, images }, emit);
+  return runSpec(options.custom || {}, { messages, system, options, images }, emit, { signal });
 }
 
-// Run a CLI agent from a spec — SHARED by the Pro custom engine (gated in chat()
-// above) and the built-in CLI engines (pi/opencode/kiro). This never gates; the
-// built-in agents are bounded instead by the extension's free 1-agent limit.
-export async function runSpec(spec, { messages, system, options = {}, images }, emit) {
+// Run a CLI agent from a spec — shared by the custom engine and the built-in CLI engines.
+export async function runSpec(spec, { messages, system, options = {}, images }, emit, { signal } = {}) {
   if (!spec.command) throw new Error('This agent has no command configured.');
 
   const resolved = resolveCommand(spec.command);
@@ -382,7 +385,10 @@ export async function runSpec(spec, { messages, system, options = {}, images },
   const prompt = buildCliPrompt(messages, system);
   let cwd = options.workingDir ? path.resolve(options.workingDir) : null;
   const label = spec.label || spec.command;
-  const fmt = ['claude-stream-json', 'opencode-json'].includes(spec.format) ? spec.format : 'text';
+  // Output dialect — resolved against the stream-format registry, so a new agent
+  // brings a format by NAME instead of a new branch in this runner. Unknown /
+  // absent names fall back to plain text.
+  const fmt = Object.hasOwn(STREAM_FORMATS, spec.format) ? spec.format : 'text';
 
   // Args: either a real array or a space-split string. With promptVia:'arg' we
   // substitute {prompt} (or append it if there's no placeholder); otherwise the
@@ -394,9 +400,16 @@ export async function runSpec(spec, { messages, system, options = {}, images },
       ? String(spec.args).split(/\s+/).filter(Boolean)
       : [];
   // User-supplied extra CLI flags (Settings → agent → "Extra arguments"), placed
-  // right after the base args/subcommand — e.g. opencode `run --format json
-  // --dangerously-skip-permissions`. Applies to every built-in & custom CLI agent.
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  // right after the base args/subcommand. Sanitized (shared helper): escalation flags
+  // (--dangerously*, --skip-permissions, --trust-all-tools, --no-sandbox …) are dropped
+  // from the EXTRA args so an injected value can't unlock tools. The built-in agents'
+  // intentional autonomy flags live in their BASE spec (cli-agents.js), not here, so
+  // they're unaffected; a custom CLI that genuinely needs such a flag should carry it
+  // in its configured command/args, not the extra-args field.
+  // Built-in specs may name a stricter set than the generic `custom` one, since
+  // each CLI's escalation flags are spelled differently (Copilot's --allow-all-*
+  // family isn't matched by the generic pattern).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN[spec.forbidden] || FORBIDDEN.custom, emit);
   // Inject the selected model via the agent's CONFIGURED model-arg template
   // (e.g. "--model {model}" or, for opencode, "-m {model}" with provider/model).
   // Without a template we can't know how this CLI takes a model, so options.model
@@ -411,6 +424,16 @@ export async function runSpec(spec, { messages, system, options = {}, images },
     // project path, so it never loads opencode.json / its MCP servers.
     args = [...args, ...injected];
   }
+  // Permission mode -> flags, declared per agent as
+  //   permissionArgs: { default: [...], acceptEdits: [...], bypassPermissions: [...] }
+  // Agents whose autonomy flags are unconditional keep them in `args`; this is for
+  // CLIs (Copilot) with a real permission surface, so the extension's existing
+  // per-agent Permission mode actually means something. Unknown mode -> `default`.
+  if (spec.permissionArgs) {
+    const mode = String(options.permissionMode || 'default');
+    const perm = spec.permissionArgs[mode] || spec.permissionArgs.default || [];
+    args = [...args, ...perm.map(String)];
+  }
   // Images: write to temp files, expand the agent's imageArg template, then place
   // the tokens. An explicit {images} placeholder in args wins; otherwise they go
   // just before the prompt (arg mode) or get appended (stdin mode).
@@ -444,6 +467,28 @@ export async function runSpec(spec, { messages, system, options = {}, images },
   // /mcp endpoint is present before letting the agent answer with no tools.
   if (options.mcp?.url) await ensureStableMcpConfig(spec, cwd, label, emit);
 
+  // Model via a CONFIG-PATCH FILE, for agents with no --model flag (dsh takes the
+  // model as a Cordis config overlay: `--patch <file>` replacing one row by id).
+  // `build` is a function, so this can only come from a built-in spec — a custom
+  // BYO agent's spec arrives as JSON over HTTP and cannot carry one.
+  if (options.model && typeof spec.modelPatch?.build === 'function') {
+    // Keep the value to a conservative id charset: it lands in a config file the
+    // agent parses, so no quotes/newlines/path characters.
+    const safeModel = /^[A-Za-z0-9][\w.:-]{0,79}$/.test(String(options.model)) ? String(options.model) : '';
+    if (safeModel) {
+      const patchFile = path.join(os.tmpdir(), `chatpanel-modelpatch-${tag}.yml`);
+      await writeFile(patchFile, spec.modelPatch.build(safeModel));
+      mcpFiles.push(patchFile); // cleaned up with the other temp files
+      const tmpl = String(spec.modelPatch.arg || '--patch {file}');
+      const tokens = tmpl.includes('{file}')
+        ? tmpl.replaceAll('{file}', patchFile).split(/\s+/).filter(Boolean)
+        : [...tmpl.split(/\s+/).filter(Boolean), patchFile];
+      // PREPEND: these are launcher flags and must precede the task text (same
+      // reason mcpArg prepends).
+      args = [...tokens, ...args];
+    }
+  }
+
   const imageTokens = imageTokensFor(spec.imageArg, imageFiles);
   let placedImages = false;
   if (imageTokens.length) {
@@ -486,10 +531,12 @@ export async function runSpec(spec, { messages, system, options = {}, images },
       return reject(new Error(`Failed to start ${label}: ${e.message}`));
     }
 
+    const detach = killOnAbort(child, signal); // Stop → terminate the CLI child
+
     let stderr = '';
-    let streamedAny = false;
-    let resultText = '';
-    let jsonBuf = '';
+    // The output dialect is a plugin (stream-formats.js); it owns line buffering,
+    // "did anything stream", and the fallback answer text.
+    const parser = createStreamParser(fmt, emit);
 
     let idleTimer;
     const armIdle = () => {
@@ -504,62 +551,22 @@ export async function runSpec(spec, { messages, system, options = {}, images },
 
     child.stdout.on('data', (d) => {
       armIdle();
-      const s = d.toString();
-      if (fmt === 'claude-stream-json') {
-        jsonBuf += s;
-        let nl;
-        while ((nl = jsonBuf.indexOf('\n')) >= 0) {
-          const line = jsonBuf.slice(0, nl).trim();
-          jsonBuf = jsonBuf.slice(nl + 1);
-          if (!line.startsWith('{')) continue;
-          let msg;
-          try {
-            msg = JSON.parse(line);
-          } catch {
-            continue;
-          }
-          const r = handleMessage(msg, emit, streamedAny);
-          if (r.streamed) streamedAny = true;
-          if (r.result != null) resultText = r.result;
-        }
-      } else if (fmt === 'opencode-json') {
-        // opencode `run --format json` emits newline-delimited events: text parts,
-        // tool/tool_use, and errors. Extract the answer text + surface tools/errors.
-        jsonBuf += s;
-        let nl;
-        while ((nl = jsonBuf.indexOf('\n')) >= 0) {
-          const line = jsonBuf.slice(0, nl).trim();
-          jsonBuf = jsonBuf.slice(nl + 1);
-          if (!line.startsWith('{')) continue;
-          let ev;
-          try { ev = JSON.parse(line); } catch { continue; }
-          if (ev.type === 'text' && ev.part?.text) {
-            streamedAny = true;
-            emit({ type: 'delta', text: ev.part.text });
-          } else if (ev.type === 'tool' || ev.type === 'tool_use') {
-            const p = ev.part || {};
-            emit({ type: 'tool', name: p.tool || p.name || p.type || 'tool', summary: '' });
-          } else if (ev.type === 'error') {
-            const msg = ev.error?.data?.message || ev.error?.message || ev.error?.name || 'error';
-            emit({ type: 'status', text: String(msg).slice(0, 300) });
-          }
-        }
-      } else {
-        streamedAny = true;
-        emit({ type: 'delta', text: stripAnsi(s) });
-      }
+      parser.push(d.toString());
     });
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
       reject(new Error(`Failed to start ${label}: ${e.message}`));
     });
     child.on('close', (code) => {
       clearTimeout(idleTimer);
+      detach();
       cleanup();
+      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly
       if (code === 0) {
-        emit({ type: 'done', text: streamedAny ? '' : resultText });
+        emit({ type: 'done', text: parser.streamed ? '' : parser.finish() });
         resolve();
       } else {
         reject(new Error(`${label} exited ${code}: ${stderr.trim().split('\n').pop() || 'failed'}`));

package/src/engines/stream-formats.js

@@ -0,0 +1,207 @@
+// Stream-format plugins — the seam that makes "add a CLI agent" a DATA change.
+//
+// Every headless CLI prints its turn in some shape: plain text, or one of a
+// handful of NDJSON dialects. Previously each dialect was an inline `else if`
+// branch in runSpec(), so a new agent with a new dialect meant editing the
+// runner. That's the reinvention this registry removes: a format is a named
+// plugin here, and an agent spec just names it (`format: 'copilot-json'`).
+//
+// Contract — a format is a factory `(emit) => parser` where parser has:
+//   push(chunk: string)   feed raw stdout; emit deltas/tools/status as they parse
+//   finish(): string      the final answer when nothing was streamed (fallback)
+//   get streamed(): bool  true once any delta was emitted
+//
+// Emitted event types match the bridge's SSE vocabulary: delta | reasoning |
+// tool | status. (`done`/`usage`/`error` stay the runner's job.)
+
+import { handleMessage } from './claude.js';
+
+// Many CLIs colourize even when piped; strip ANSI from anything we treat as text.
+const ANSI_RE = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
+export const stripAnsi = (s) => String(s).replace(ANSI_RE, '');
+
+// Shared NDJSON pump: buffers partial lines and hands complete JSON objects to
+// `onEvent`. Every JSON dialect below is line-delimited, so they all reuse this.
+function ndjson(onEvent) {
+  let buf = '';
+  return (chunk) => {
+    buf += chunk;
+    let nl;
+    while ((nl = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, nl).trim();
+      buf = buf.slice(nl + 1);
+      if (!line.startsWith('{')) continue;
+      let ev;
+      try {
+        ev = JSON.parse(line);
+      } catch {
+        continue; // a partial/garbage line is not fatal — keep streaming
+      }
+      onEvent(ev);
+    }
+  };
+}
+
+// --- text ------------------------------------------------------------------
+// Anything that just prints a reply.
+function textFormat(emit) {
+  let streamed = false;
+  return {
+    push(chunk) {
+      streamed = true;
+      emit({ type: 'delta', text: stripAnsi(chunk) });
+    },
+    finish: () => '',
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// --- claude-stream-json ----------------------------------------------------
+// Claude Code's `--output-format stream-json`, parsed by the Claude engine.
+function claudeStreamJson(emit) {
+  let streamed = false;
+  let result = '';
+  const pump = ndjson((msg) => {
+    const r = handleMessage(msg, emit, streamed);
+    if (r.streamed) streamed = true;
+    if (r.result != null) result = r.result;
+  });
+  return {
+    push: pump,
+    finish: () => result,
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// --- opencode-json ---------------------------------------------------------
+// opencode `run --format json`: text parts, tool events, errors.
+function opencodeJson(emit) {
+  let streamed = false;
+  const pump = ndjson((ev) => {
+    if (ev.type === 'text' && ev.part?.text) {
+      streamed = true;
+      emit({ type: 'delta', text: ev.part.text });
+    } else if (ev.type === 'tool' || ev.type === 'tool_use') {
+      const p = ev.part || {};
+      emit({ type: 'tool', name: p.tool || p.name || p.type || 'tool', summary: '' });
+    } else if (ev.type === 'error') {
+      const msg = ev.error?.data?.message || ev.error?.message || ev.error?.name || 'error';
+      emit({ type: 'status', text: String(msg).slice(0, 300) });
+    }
+  });
+  return {
+    push: pump,
+    finish: () => '',
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// --- copilot-json ----------------------------------------------------------
+// GitHub Copilot CLI `--output-format json` (verified against 1.0.80).
+//
+// Event vocabulary (only the ones we surface):
+//   assistant.message_delta   data.deltaContent   -> streamed answer text
+//   assistant.message         data.content        -> whole answer (fallback)
+//   assistant.reasoning       data.content        -> thinking (usually opaque/empty)
+//   tool.execution_start      data.toolName       -> activity strip
+//   tool.execution_complete   data.success/result -> surface failures
+//   session.auto_mode_resolved data.chosenModel   -> which model `auto` picked
+//   result                    exitCode/usage      -> terminal event
+//
+// Copilot reports a denied tool as a COMPLETED call whose result explains the
+// permission gap, so a user on a low permission mode otherwise sees a confident
+// "I can't do that" with no hint that ChatPanel gated it. Detect that shape and
+// say which setting to raise.
+const PERMISSION_RE = /permission denied|could not request permission|not allowed|denied by|requires approval/i;
+
+function copilotJson(emit) {
+  let streamed = false;
+  let result = '';
+  let permissionHinted = false;
+
+  const hintPermissions = (text) => {
+    if (permissionHinted || !PERMISSION_RE.test(String(text || ''))) return;
+    permissionHinted = true;
+    emit({
+      type: 'status',
+      text: 'Copilot was denied a tool/URL — raise this agent’s Permission mode in Settings.',
+    });
+  };
+
+  const pump = ndjson((ev) => {
+    const type = ev?.type || '';
+    const d = ev?.data || {};
+    switch (type) {
+      case 'assistant.message_delta':
+        if (d.deltaContent) {
+          streamed = true;
+          emit({ type: 'delta', text: d.deltaContent });
+        }
+        break;
+      case 'assistant.message':
+        // Full turn text. Keep as the fallback answer for the non-streaming case
+        // (`--stream off`, or a turn that only produced a final message).
+        if (typeof d.content === 'string' && d.content) result = d.content;
+        break;
+      case 'assistant.reasoning':
+        if (d.content) emit({ type: 'reasoning', text: String(d.content) });
+        break;
+      case 'tool.execution_start':
+        emit({ type: 'tool', name: d.toolName || 'tool', summary: '' });
+        break;
+      case 'tool.execution_complete':
+        if (d.success === false) {
+          const msg = typeof d.result === 'string' ? d.result : d.result?.error || d.result?.message || '';
+          if (msg) emit({ type: 'status', text: String(msg).slice(0, 300) });
+          hintPermissions(msg);
+        } else {
+          hintPermissions(typeof d.result === 'string' ? d.result : '');
+        }
+        break;
+      case 'session.auto_mode_resolved':
+        if (d.chosenModel) emit({ type: 'status', text: `model: ${d.chosenModel}` });
+        break;
+      case 'session.mcp_server_status_changed':
+        // Only worth surfacing when our own browser-tool server fails to attach.
+        if (d.status === 'failed' && d.error) {
+          emit({ type: 'status', text: `MCP ${d.serverName}: ${String(d.error).slice(0, 160)}` });
+        }
+        break;
+      case 'result':
+        // Terminal event; `exitCode` is authoritative for failure (the process
+        // can still exit 0 while a tool failed). Surface a non-zero code.
+        if (ev.exitCode) emit({ type: 'status', text: `copilot exited ${ev.exitCode}` });
+        break;
+      default:
+        break;
+    }
+  });
+
+  return {
+    push: pump,
+    finish: () => result,
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// The registry. Adding a dialect = adding one entry here; agent specs reference
+// it by name, so no runner change is needed.
+export const STREAM_FORMATS = {
+  text: textFormat,
+  'claude-stream-json': claudeStreamJson,
+  'opencode-json': opencodeJson,
+  'copilot-json': copilotJson,
+};
+
+export function createStreamParser(format, emit) {
+  const make = STREAM_FORMATS[format] || STREAM_FORMATS.text;
+  return make(emit);
+}

package/src/entitlement.js

@@ -1,11 +1,7 @@
-// Offline Pro/Team entitlement verification — the HARD gate for paid features
-// (e.g. custom "bring your own CLI" agents).
-//
-// The license server (Cloudflare Worker) signs a compact entitlement token with
-// an ECDSA P-256 private key that lives ONLY there. The bridge ships the matching
-// PUBLIC key and verifies the signature locally — no network, no secret. A forked
-// client or a raw `curl` to the bridge can't forge entitlement without the
-// private key, so this is a real cryptographic gate, not a UI check.
+// Offline entitlement verification. The license server signs a compact entitlement
+// token with an ECDSA P-256 private key; the bridge ships the matching public key
+// and verifies the token's signature locally (no network). Gates Pro features such
+// as "bring your own" custom CLI agents.
 //
 // Token format (identical to the extension's, extension/js/license.js):
 //   token   = base64url(JSON payload) + "." + base64url(raw ECDSA signature)
@@ -44,9 +40,8 @@ function publicKey() {
 }
 
 // Verify a server entitlement token. Returns its payload, or null. Checks the
-// ECDSA signature (unforgeable without the private key), the token type, and
-// expiry. install_id binding is the extension's concern — for the bridge gate the
-// signature is what matters.
+// ECDSA signature, the token type, and expiry. install_id binding is handled by
+// the extension; the bridge checks the signature.
 export async function verifyEntitlement(token) {
   if (!token || typeof token !== 'string' || token.indexOf('.') < 0) return null;
   const [head, sig] = token.split('.');
@@ -70,7 +65,8 @@ export async function verifyEntitlement(token) {
     return null;
   }
   if (payload.typ !== 'ent') return null;
-  if (payload.exp && Date.now() > payload.exp) return null;
+  // exp is required; the worker always mints a finite exp, so requiring one is non-breaking.
+  if (typeof payload.exp !== 'number' || !Number.isFinite(payload.exp) || Date.now() > payload.exp) return null;
   return payload;
 }
 

package/src/env.js

@@ -14,7 +14,7 @@ let enriched = false;
 
 // The agent CLIs the bridge shells out to. Claude has its own richer resolution
 // (resolveClaude: native / cli.js / WSL / SDK) below.
-export const AGENT_CLIS = ['codex', 'claude', 'agy', 'pi', 'opencode', 'kiro-cli'];
+export const AGENT_CLIS = ['codex', 'claude', 'agy', 'pi', 'opencode', 'kiro-cli', 'copilot', 'dsh'];
 
 // Is `name` executable somewhere on the current PATH?
 function onPath(name) {

package/src/net.js

@@ -0,0 +1,107 @@
+// VENDORED COPY of chatpanel-pii/net.js — keep in sync with the canonical engine
+// (the bridge stays dependency-free, so this is a copy, not an import). Regenerate
+// by copying ../chatpanel-pii/net.js over this file (then re-add this header).
+//
+// Shared host classifier + outbound-URL guard — the SSRF primitive.
+//
+// One implementation of "what is a loopback / cloud-metadata / private host",
+// delivered the way the rest of @chatpanel/pii is: npm dependency for the
+// gateway/bridge, vendorable into the browser extension (pure — only URL + string
+// ops, no node APIs, so it runs in a Worker/service-worker too). Replaces the
+// hand-maintained copies in the bridge (src/ssrf.js) and the extension
+// (js/context.js isBlockedHost) so a security guard can't silently drift between
+// the direct client path and the proxied path. See docs/secure-data-plane.md.
+//
+// The policy knobs cover the two legitimate trust contexts:
+//   • A MODEL / API / MCP endpoint (gateway upstream, bridge MCP proxy) may live on
+//     loopback (Ollama, LM Studio) or the LAN (a homelab GPU box) — so those are
+//     allowed by default — but must NEVER reach cloud instance metadata.
+//   • A WEB PAGE fetch (link title, page context) has no business touching loopback
+//     or any private host at all — call with { allowLoopback:false, allowPrivate:false }.
+// Cloud metadata (169.254.169.254 & friends) and non-http(s) schemes are blocked in
+// BOTH contexts, unconditionally. Re-run the assert on every redirect hop.
+
+function ipv4(h) {
+  const m = String(h).match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+const norm = (hostname) => String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+
+// Loopback = this host's own services (127.0.0.0/8, ::1, localhost, *.localhost).
+export function isLoopbackHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — the sharpest SSRF target (credential theft). Covers the
+// link-local IMDS address used by AWS/GCP/Azure/DO (169.254.169.254), Alibaba's
+// 100.100.100.200, and the GCP/name-based metadata hosts. ALWAYS blocked.
+export function isMetadataHost(hostname) {
+  const h = norm(hostname);
+  if (h === 'metadata.google.internal' || h === 'metadata') return true;
+  const o = ipv4(h);
+  if (!o) return false;
+  if (o[0] === 169 && o[1] === 254) return true;                 // 169.254.169.254 (+ link-local)
+  if (o[0] === 100 && o[1] === 100 && o[2] === 100 && o[3] === 200) return true; // Alibaba IMDS
+  return false;
+}
+
+// Private / internal address space, EXCLUDING loopback + metadata (checked
+// separately): RFC1918, CGNAT, IPv6 ULA/link-local, mDNS .local, this-host 0.x/::.
+export function isPrivateHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (h.endsWith('.local')) return true;
+  if (
+    h === '::' || h.startsWith('fc') || h.startsWith('fd')       // IPv6 ULA
+    || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb') // link-local
+  ) return true;
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true;                        // this-host / RFC1918
+    if (a === 169 && b === 254) return true;                     // link-local
+    if (a === 172 && b >= 16 && b <= 31) return true;            // RFC1918
+    if (a === 192 && b === 168) return true;                     // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;           // CGNAT
+  }
+  return false;
+}
+
+// Policy-driven classifier. Returns true if `hostname` must be blocked under `policy`.
+// Defaults model the ENDPOINT context (loopback + LAN allowed, metadata never).
+export function isBlockedHost(hostname, { allowLoopback = true, allowPrivate = true } = {}) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (isMetadataHost(h)) return true;                            // never, in any context
+  if (isLoopbackHost(h)) return !allowLoopback;
+  if (isPrivateHost(h)) return !allowPrivate;
+  return false;                                                  // public host
+}
+
+// Assert a URL is fetchable under `policy`; returns the parsed URL or throws.
+// Call on the initial URL AND after every redirect hop.
+export function assertFetchableUrl(u, policy = {}) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHost(parsed.hostname, policy)) {
+    throw new Error(`refusing to reach a blocked address (${parsed.hostname})`);
+  }
+  return parsed;
+}
+
+// Endpoint context: model/API/MCP upstream — loopback + LAN OK, metadata never.
+export const assertEndpointUrl = (u, opts = {}) => assertFetchableUrl(u, { allowLoopback: true, allowPrivate: true, ...opts });
+// Web-page context: no loopback, no private, no metadata — genuinely public only.
+export const assertPublicWebUrl = (u) => assertFetchableUrl(u, { allowLoopback: false, allowPrivate: false });

package/src/proc.js

@@ -0,0 +1,21 @@
+// Terminate a spawned CLI child when an AbortSignal fires. The extension's Stop
+// button aborts the /chat request; server.js turns that disconnect into an abort on
+// this signal. Without this, the agent CLI (codex / claude / agy / custom) keeps
+// running to completion in the background after Stop — burning tokens and holding the
+// session — and only the 3-minute idle timer would eventually reap it.
+//
+// SIGTERM first so the CLI can flush + exit cleanly (its own child procs get the
+// signal via the process group where the platform delivers it), then SIGKILL after a
+// short grace if it's still alive. Returns a detach() to drop the listener once the
+// child exits normally.
+export function killOnAbort(child, signal, { graceMs = 1500 } = {}) {
+  if (!signal || !child) return () => {};
+  const onAbort = () => {
+    try { child.kill('SIGTERM'); } catch { /* already exited */ }
+    const t = setTimeout(() => { try { child.kill('SIGKILL'); } catch { /* gone */ } }, graceMs);
+    if (t.unref) t.unref(); // don't keep the event loop alive just for the grace timer
+  };
+  if (signal.aborted) { onAbort(); return () => {}; }
+  signal.addEventListener('abort', onAbort, { once: true });
+  return () => { try { signal.removeEventListener('abort', onAbort); } catch { /* noop */ } };
+}