@chatpanel/bridge 0.10.21 → 0.10.23

package/src/server.js

@@ -26,10 +26,11 @@ import { join } from 'node:path';
 import * as claude from './engines/claude.js';
 import * as codex from './engines/codex.js';
 import * as antigravity from './engines/antigravity.js';
-import { pi, opencode, kiro } from './engines/cli-agents.js';
+import { pi, opencode, kiro, copilot, deepseek } from './engines/cli-agents.js';
 import * as custom from './engines/custom.js';
 import { installService, uninstallService, serviceStatus, restartService } from './service.js';
 import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
+import { stripHidden } from './sanitize.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
 import { assertPublicHttpUrl, assertPublicWebUrl } from './ssrf.js';
@@ -37,7 +38,7 @@ import { assertPublicHttpUrl, assertPublicWebUrl } from './ssrf.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.21';
+const VERSION = '0.10.23';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -48,6 +49,8 @@ const ENGINES = {
   pi: { engine: pi, label: 'Pi' },
   opencode: { engine: opencode, label: 'OpenCode' },
   kiro: { engine: kiro, label: 'Kiro' },
+  copilot: { engine: copilot, label: 'GitHub Copilot' },
+  deepseek: { engine: deepseek, label: 'DeepSeek Harness' },
   // "Bring your own" — one engine drives any user-onboarded CLI (Pro). Hidden
   // from /health (it's not a single installable agent; the extension manages the
   // list and validates commands via /agent-check).
@@ -108,10 +111,13 @@ function relayToolCall(session, name, input) {
 
 // The extension returns a string OR { text, image(dataURL) }; map to MCP content.
 function toMcpContent(result) {
+  // L5: de-steganographize tool-result TEXT before it flows back to the CLI/model —
+  // the bridge is a public localhost endpoint, so (like the prompt path) it must strip
+  // ASCII-smuggled / bidi Unicode from relayed results, not assume the caller did.
   if (result == null) return { content: [{ type: 'text', text: 'ok' }] };
-  if (typeof result === 'string') return { content: [{ type: 'text', text: result }] };
+  if (typeof result === 'string') return { content: [{ type: 'text', text: stripHidden(result) }] };
   const content = [];
-  if (result.text) content.push({ type: 'text', text: String(result.text) });
+  if (result.text) content.push({ type: 'text', text: stripHidden(String(result.text)) });
   if (typeof result.image === 'string') {
     const m = /^data:([^;]+);base64,(.+)$/s.exec(result.image);
     if (m) content.push({ type: 'image', data: m[2], mimeType: m[1] });
@@ -330,9 +336,13 @@ async function handleChat(req, res) {
     if (!res.writableEnded) res.write(`data: ${JSON.stringify(obj)}\n\n`);
   };
 
-  // If the client disconnects, stop caring about late writes.
+  // If the client disconnects (Stop, or the panel closes), stop caring about late
+  // writes AND abort the run so the engine kills its CLI child instead of letting it
+  // finish in the background. Older engines ignore the signal (harmless); the spawn
+  // engines honor it via killOnAbort.
   let closed = false;
-  req.on('close', () => (closed = true));
+  const ac = new AbortController();
+  req.on('close', () => { closed = true; ac.abort(); });
 
   const safeEmit = (obj) => { if (!closed) emit(obj); };
 
@@ -358,6 +368,7 @@ async function handleChat(req, res) {
         images: Array.isArray(body.images) ? body.images : [],
       },
       safeEmit,
+      { signal: ac.signal },
     );
   } catch (e) {
     log('error', `${body.agent} chat failed: ${e?.message || e}`);
@@ -718,11 +729,16 @@ const server = createServer(async (req, res) => {
   try {
     if (req.method === 'GET' && url.pathname === '/health') return handleHealth(res);
     if (req.method === 'GET' && url.pathname === '/debug') {
+      // L6: by default expose only version + agent AVAILABILITY (a boolean) — enough
+      // to diagnose "is codex installed?". The full home dir, $PATH, and resolved
+      // binary paths (which embed the username / home) leak environment detail, so
+      // they're opt-in behind CHATPANEL_BRIDGE_DEBUG=1. The extension doesn't read
+      // this route, so trimming it by default breaks nothing.
+      const verbose = /^(1|true|yes|on)$/i.test(process.env.CHATPANEL_BRIDGE_DEBUG || '');
       return json(res, 200, {
         version: VERSION,
-        home: os.homedir(),
-        agents: Object.fromEntries(AGENT_CLIS.map((name) => [name, findAgentBin(name) || null])),
-        path: process.env.PATH,
+        agents: Object.fromEntries(AGENT_CLIS.map((name) => [name, verbose ? (findAgentBin(name) || null) : !!findAgentBin(name)])),
+        ...(verbose ? { home: os.homedir(), path: process.env.PATH } : {}),
       });
     }
     if (req.method === 'POST' && url.pathname === '/chat') return handleChat(req, res);
@@ -826,6 +842,12 @@ function startServer() {
   });
   server.listen(PORT, HOST, async () => {
     log('info', `listening on http://${HOST}:${PORT}`);
+    // M7: a non-loopback bind disables the anti-DNS-rebinding Host check (hostAllowed
+    // returns true for any Host), so the only inbound guard left is the per-install
+    // token / extension Origin. Make that trade-off LOUD — it's rarely what you want.
+    if (!LOOPBACK_HOSTNAMES.has(HOST)) {
+      log('error', `⚠ SECURITY: bound to NON-LOOPBACK host ${HOST}. The anti-rebinding Host check is OFF, so any device that reaches this port (and any web page via a spoofed Host header) can drive local agents — gated only by the bridge token. Only do this on a trusted, firewalled network; prefer 127.0.0.1.`);
+    }
     for (const [, { engine, label, hidden }] of Object.entries(ENGINES)) {
       if (hidden) continue;
       const a = await engine.available().catch(() => ({ ok: false }));

package/src/ssrf.js

@@ -1,88 +1,35 @@
-// SSRF guard for the /mcp-remote proxy.
+// SSRF guard for the bridge's outbound proxies (/mcp-remote, /fetch-title).
 //
-// The bridge proxies ONE JSON-RPC message to a remote MCP server *from this
-// machine* (no browser Origin header), so the extension can reach servers that
-// reject browser origins. That route is already privileged — it requires the
-// extension origin or the per-install bridge token, so a random web page cannot
-// drive it. This guard is the second layer: even when driven by the extension,
-// the bridge must not become a relay that a prompt-injected agent could point at
-// cloud metadata or use to sweep the LAN.
+// The host CLASSIFICATION (what is loopback / cloud-metadata / RFC1918 / CGNAT /
+// ULA / link-local / .local) now lives in ONE shared place — src/net.js, a vendored
+// copy of @chatpanel/pii/net.js, the same classifier the gateway and extension use.
+// This file keeps only the bridge's two POLICIES + their exact error messages, so a
+// security guard can't drift between the direct client path and the proxied path.
+// See docs/secure-data-plane.md.
 //
-// Policy:
-//   • Loopback (127.0.0.0/8, ::1, localhost, *.localhost) → ALLOWED.
-//     It's the user's own host — the same place the bridge runs, and a place the
-//     extension can already fetch DIRECTLY. Proxying it grants no new reach; it
-//     only drops the browser Origin header (the whole point of "via bridge").
-//     Localhost MCP servers are the common case.
-//   • Cloud instance metadata (169.254.169.254) → ALWAYS BLOCKED.
-//     This is the sharpest SSRF target (credential theft) and is blocked even
-//     when private hosts are opted in.
-//   • Everything else private/internal (RFC1918, CGNAT, link-local, IPv6 ULA,
-//     0.0.0.0, ::, *.local) → BLOCKED, unless the operator opts in with
-//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (for reaching an MCP server on
-//     another machine on a trusted LAN).
-//   • Non-http(s) schemes → BLOCKED.
+// Two policies:
+//   • /mcp-remote (assertPublicHttpUrl): loopback ALLOWED (the user's own MCP
+//     servers — the whole point of "via bridge"), cloud metadata ALWAYS blocked,
+//     every other private/LAN range blocked UNLESS the operator opts in with
+//     CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS=1 (reaching an MCP server on a trusted LAN).
+//   • /fetch-title (assertPublicWebUrl): STRICTER — a page fetch has no business
+//     touching loopback OR any private host, so loopback + metadata + every private
+//     range are blocked unconditionally (the opt-in is deliberately NOT honored).
 //
-// The same checks run on the initial URL AND after any redirect.
+// Non-http(s) schemes are blocked in both. Run the assert on the initial URL AND
+// after every redirect hop.
+
+import { isLoopbackHost, isBlockedHost } from './net.js';
+
+export { isLoopbackHost };
 
 const ALLOW_PRIVATE_HOSTS = /^(1|true|yes|on)$/i.test(
   process.env.CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS || '',
 );
 
-function ipv4(h) {
-  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (!m) return null;
-  const o = m.slice(1).map(Number);
-  if (o.some((n) => n > 255)) return null;
-  return o;
-}
-
-// Loopback = this host's own services. Reachable by the extension directly, so
-// allowing the bridge to reach it adds no capability.
-export function isLoopbackHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h) return false;
-  if (h === 'localhost' || h.endsWith('.localhost')) return true;
-  if (h === '::1') return true;
-  const o = ipv4(h);
-  return !!(o && o[0] === 127);
-}
-
-// Cloud instance metadata — credential-theft vector. Always blocked.
-function isMetadataHost(hostname) {
-  const o = ipv4(hostname);
-  return !!(o && o[0] === 169 && o[1] === 254);
-}
-
+// MCP-proxy policy: loopback ok, metadata never, other private only when opted in.
 export function isBlockedHttpHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h) return true;
-  if (isLoopbackHost(h)) return false; // user's own host — allowed
-  if (isMetadataHost(h)) return true; // never proxy cloud metadata, even when private is opted in
-  if (ALLOW_PRIVATE_HOSTS) return false; // operator opted in to LAN/private targets
-
-  // Default deny for the rest of the private/internal space.
-  if (h.endsWith('.local')) return true; // mDNS / LAN
-  if (
-    h === '::' ||
-    h.startsWith('fc') ||
-    h.startsWith('fd') || // IPv6 ULA
-    h.startsWith('fe8') ||
-    h.startsWith('fe9') ||
-    h.startsWith('fea') ||
-    h.startsWith('feb') // IPv6 link-local
-  ) {
-    return true;
-  }
-  const o = ipv4(h);
-  if (o) {
-    const [a, b] = o;
-    if (a === 0 || a === 10) return true; // this-host / RFC1918
-    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
-    if (a === 192 && b === 168) return true; // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  }
-  return false;
+  return isBlockedHost(hostname, { allowLoopback: true, allowPrivate: ALLOW_PRIVATE_HOSTS });
 }
 
 export function assertPublicHttpUrl(u) {
@@ -101,41 +48,9 @@ export function assertPublicHttpUrl(u) {
   return parsed;
 }
 
-// STRICTER guard for fetching arbitrary WEB pages (the /fetch-title route). Unlike the MCP proxy,
-// a page fetch has NO legitimate reason to reach the user's own loopback services or any LAN /
-// private host — those would be pure SSRF (port-scan the LAN, hit a localhost admin panel, read
-// cloud metadata). So loopback + metadata + every private/internal range are blocked
-// UNCONDITIONALLY here; the CHATPANEL_BRIDGE_ALLOW_PRIVATE_HOSTS opt-in (meant for reaching a LAN
-// MCP server, a different trust context) is deliberately NOT honored. Only genuinely public
-// http(s) hosts pass. Re-run this on every redirect hop, not just the initial URL.
+// Web-fetch policy (stricter): block loopback + metadata + all private, always.
 export function isDisallowedWebHost(hostname) {
-  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
-  if (!h) return true;
-  if (isLoopbackHost(h)) return true; // localhost/127.x — a page fetch must never touch it
-  if (isMetadataHost(h)) return true; // 169.254.169.254 — credential theft
-  if (h.endsWith('.local')) return true; // mDNS / LAN
-  if (
-    h === '::' ||
-    h.startsWith('fc') ||
-    h.startsWith('fd') || // IPv6 ULA
-    h.startsWith('fe8') ||
-    h.startsWith('fe9') ||
-    h.startsWith('fea') ||
-    h.startsWith('feb') // IPv6 link-local
-  ) {
-    return true;
-  }
-  const o = ipv4(h);
-  if (o) {
-    const [a, b] = o;
-    if (a === 0 || a === 10) return true; // this-host / RFC1918
-    if (a === 127) return true; // loopback (also caught above; explicit for clarity)
-    if (a === 169 && b === 254) return true; // link-local (incl. metadata)
-    if (a === 172 && b >= 16 && b <= 31) return true; // RFC1918
-    if (a === 192 && b === 168) return true; // RFC1918
-    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  }
-  return false;
+  return isBlockedHost(hostname, { allowLoopback: false, allowPrivate: false });
 }
 
 export function assertPublicWebUrl(u) {