@chatpanel/bridge 0.10.22 → 0.10.24

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.22",
+  "version": "0.10.24",
   "type": "module",
-  "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
+  "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
     "chatpanel",
     "claude-code",

package/src/engines/args.js

@@ -23,6 +23,11 @@ export const FORBIDDEN = {
   // Custom runs an arbitrary CLI, so only clearly-dangerous LONG flags are blocked
   // (no short-flag guesses that might collide with a benign tool option).
   custom: /^--(dangerously[\w-]*|skip-permissions|trust-all-?tools|no-sandbox|bypass|yolo|full-auto|permission-mode|allowed-?tools|disallowed-?tools|mcp-config)\b/i,
+  // Copilot's escalation surface is its own family of --allow-* flags (which the
+  // `custom` pattern above does NOT cover: "allow-all-tools" != "allowed-tools").
+  // Also block re-targeting the working dir (-C / --add-dir) and injecting MCP
+  // servers, since the engine sets those deliberately per turn.
+  copilot: /^(-C)$|^--(allow-all[\w-]*|allow-tool|allow-url|allow-path|yolo|add-dir|additional-mcp-config|disable-builtin-mcps|deny-tool|deny-url|autopilot|mode)\b/i,
 };
 
 // Returns { args, blocked }. `blocked:true` => the whole extraArgs was dropped.

package/src/engines/cli-agents.js

@@ -7,10 +7,13 @@
 //   opencode — opencode run "<prompt>" · -m provider/model · -f {path} images · models
 //   kiro     — kiro-cli chat --no-interactive "<prompt>" · --model · --list-models
 
-import { runSpec, listSpecModels } from './custom.js';
+import { runSpec, listSpecModels, runForStdout } from './custom.js';
 import { findAgentBin } from '../env.js';
 
-function makeCliAgent(command, spec, notFoundHint) {
+// `listModels` override hook: a CLI whose model listing isn't "one id per line"
+// (Copilot prints a quoted list inside `help config`) passes its own parser here
+// instead of forcing the generic one to grow special cases.
+function makeCliAgent(command, spec, notFoundHint, overrides = {}) {
   let installed = false;
   let lastProbe = 0;
   const resolvedSpec = { ...spec, command };
@@ -30,6 +33,7 @@ function makeCliAgent(command, spec, notFoundHint) {
       return installed ? { ok: true } : { ok: false, reason: notFoundHint };
     },
     listModels(options = {}) {
+      if (overrides.listModels) return overrides.listModels(command, options);
       return listSpecModels(command, spec.listModelsArgs, options.workingDir);
     },
     chat(input, emit, opts) {
@@ -94,3 +98,153 @@ export const kiro = makeCliAgent(
   },
   'kiro-cli not found on PATH. Install Kiro CLI, then sign in.',
 );
+
+// GitHub Copilot CLI. Verified against 1.0.80 (`copilot`, not the old
+// `gh copilot` extension).
+//
+// The two things that make or break headless Copilot:
+//   1. --allow-all-tools is REQUIRED in -p mode. Without it EVERY tool call dies
+//      with "Permission denied and could not request permission from user" — the
+//      CLI has no TTY to ask on — so the agent answers as if it had no tools.
+//   2. --output-format json turns the TUI into clean NDJSON we can stream;
+//      the default text output is not parseable as a live stream.
+// Both live in the base spec because neither is optional for this integration.
+//
+// Permission mode maps onto Copilot's real permission surface (see
+// permissionArgs): tools always run unattended, while filesystem reach beyond the
+// working dir and arbitrary URL access are what the mode actually escalates.
+const COPILOT_BASE_ARGS = [
+  '-p', '{prompt}',
+  '--output-format', 'json',
+  '--no-color',
+  '--log-level', 'none',
+  // Headless hygiene: never block asking the user a question, never self-update
+  // mid-turn, and don't ship the session to GitHub web/mobile from a ChatPanel
+  // turn (Copilot exports by default; ChatPanel keeps chat local by policy).
+  '--no-ask-user',
+  '--no-auto-update',
+  '--no-remote',
+  '--no-remote-export',
+];
+
+export const copilot = makeCliAgent(
+  'copilot',
+  {
+    args: COPILOT_BASE_ARGS,
+    promptVia: 'arg',
+    modelArg: '--model {model}',
+    // Non-interactive-only flag; one per image.
+    imageArg: '--attachment {path}',
+    format: 'copilot-json',
+    // Copilot takes per-run MCP servers, so browser tools work WITHOUT touching
+    // the user's ~/.copilot/mcp-config.json (unlike opencode/kiro, which only
+    // read global config). `@` prefix = "this is a file path, not inline JSON";
+    // the shape runSpec writes ({mcpServers:{name:{command,args}}}) is the one
+    // Copilot expects — verified.
+    mcpArg: '--additional-mcp-config @{file}',
+    permissionArgs: {
+      // Tools yes (or nothing works); no path escape, no arbitrary URLs.
+      default: ['--allow-all-tools'],
+      // Edits anywhere on disk, still no arbitrary URL fetching.
+      acceptEdits: ['--allow-all-tools', '--allow-all-paths'],
+      // == --allow-all-tools --allow-all-paths --allow-all-urls
+      bypassPermissions: ['--allow-all'],
+    },
+    forbidden: 'copilot',
+    label: 'GitHub Copilot',
+  },
+  'copilot not found on PATH. Install GitHub Copilot CLI, then run `copilot login`.',
+  { listModels: (command, options) => listCopilotModels(command, options.workingDir) },
+);
+
+// Copilot has no `--list-models`, and an invalid --model reports only that the
+// model is unavailable without naming the valid ones. `copilot help config`
+// documents the live list under its `model` key, so read it there — the ids stay
+// in step with the installed CLI instead of being hardcoded here.
+export async function listCopilotModels(command = 'copilot', workingDir) {
+  const stdout = await runForStdout(command, ['help', 'config'], workingDir);
+  const out = [];
+  const seen = new Set();
+  let inModelBlock = false;
+  for (const raw of String(stdout || '').split('\n')) {
+    // Section keys are printed as `  `key`: description`.
+    const key = /^\s*`([A-Za-z][\w.]*)`\s*:/.exec(raw);
+    if (key) {
+      inModelBlock = key[1] === 'model';
+      continue;
+    }
+    if (!inModelBlock) continue;
+    const m = /^\s*-\s*"([^"]+)"\s*$/.exec(raw);
+    if (!m) continue;
+    const id = m[1];
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+    if (out.length >= 200) break;
+  }
+  // `auto` is a real, documented value (Copilot routes the turn itself) but it is
+  // not in the enumerated list — offer it first.
+  return out.length ? ['auto', ...out] : [];
+}
+
+// DeepSeek Harness. The launcher is `dsh`; `--profile headless` is the shipped
+// one-shot template ("answer one task, print the final assistant message, exit").
+//
+// Deliberately sparse compared to the others, because the CLI surface is sparse:
+// the headless profile takes ONLY the task text. There is no --model, no JSON
+// output and no resume flag — dsh is a Cordis plugin tree, so the model adapter,
+// tools and MCP are chosen by the PROFILE, not by argv. Power users retarget it
+// with `--patch <file>` through the agent's "Extra arguments" field.
+//
+// Two consequences worth knowing before wiring UI to this:
+//   * `modelArg` is absent, so a model picked in Settings is ignored by design
+//     (runSpec skips model injection without a template) — configure it in the
+//     profile instead.
+//   * Output arrives as ONE chunk at the end, not token-by-token, so the turn
+//     shows progress but no live typing.
+export const deepseek = makeCliAgent(
+  'dsh',
+  {
+    args: ['--profile', 'headless', '{prompt}'],
+    promptVia: 'arg',
+    format: 'text',
+    // No --model flag exists. dsh takes the model as a CONFIG OVERLAY: --patch
+    // replaces one row of the composed plugin tree by id, and the model lives in
+    // the `agent-default-model` row. runSpec writes this file per turn.
+    modelPatch: {
+      arg: '--patch {file}',
+      // A patch replaces the row's WHOLE config, so provider must be restated.
+      build: (model) => `- id: ${DSH_MODEL_ROW}\n  config:\n    provider: ${DSH_PROVIDER}\n    model: ${JSON.stringify(model)}\n`,
+    },
+    label: 'DeepSeek Harness',
+  },
+  'dsh not found on PATH. Install DeepSeek Harness, then run `dsh --profile headless "hi"` once to check the profile.',
+  { listModels: (command, options) => listDshModels(command, options.workingDir) },
+);
+
+const DSH_MODEL_ROW = 'agent-default-model';
+const DSH_PROVIDER = 'deepseek-official';
+// dsh ships no model catalog command. The provider names its supported ids only
+// when you send a bad one ("The supported API model names are ..."), so these are
+// those ids, unioned with whatever the profile is actually set to. The field
+// still accepts any id — this is a convenience menu, not a whitelist.
+const DSH_KNOWN_MODELS = ['deepseek-v4-flash', 'deepseek-v4-pro'];
+
+// dsh publishes no model catalog — there is no `--list-models`, and the composed
+// config tree carries only the model the profile is CURRENTLY set to. So "Load
+// models" reports that one truthfully rather than inventing a menu; the field
+// still accepts any id the provider serves, applied via the patch above.
+export async function listDshModels(command = 'dsh', workingDir) {
+  const stdout = await runForStdout(command, ['--profile', 'headless', '--dump-config'], workingDir, 60000);
+  const lines = String(stdout || '').split('\n');
+  const rowStart = new RegExp(`^-\\s*id:\\s*${DSH_MODEL_ROW}\\s*$`);
+  for (let i = 0; i < lines.length; i++) {
+    if (!rowStart.test(lines[i])) continue;
+    // Scan this row's block for `model: <id>`, stopping at the next top-level row.
+    for (let j = i + 1; j < lines.length && !/^-\s*id:/.test(lines[j]); j++) {
+      const m = /^\s*model:\s*['"]?([\w.:-]+)['"]?\s*$/.exec(lines[j]);
+      if (m) return [...new Set([m[1], ...DSH_KNOWN_MODELS])];
+    }
+  }
+  return [...DSH_KNOWN_MODELS];
+}

package/src/engines/custom.js

@@ -20,9 +20,9 @@ import path from 'node:path';
 import { resolveCommand, buildSpawnSpec, selfMcpStdio } from '../env.js';
 import { isProEntitled } from '../entitlement.js';
 import { killOnAbort } from '../proc.js';
-import { handleMessage } from './claude.js';
 import { buildCliPrompt } from './prompt.js';
 import { pushExtraArgs, FORBIDDEN } from './args.js';
+import { createStreamParser, STREAM_FORMATS, stripAnsi } from './stream-formats.js';
 
 // Write base64 data-URL images to temp files so a custom CLI can take them via
 // its configured `imageArg` template (e.g. "-i {path}", "@{path}"). Returns paths.
@@ -60,11 +60,8 @@ function imageTokensFor(imageArg, files) {
 // CHATPANEL_CUSTOM_TIMEOUT_MS (ms).
 const IDLE_MS = Number(process.env.CHATPANEL_CUSTOM_TIMEOUT_MS) || 180_000;
 
-// Many CLIs emit ANSI colour/escape codes even when piped (kiro-cli does), which
-// leak into the answer as `\x1b[38;5;141m…`. Strip them from text output. (We
-// also set NO_COLOR on the child env, but this is the robust backstop.)
-const ANSI_RE = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
-const stripAnsi = (s) => s.replace(ANSI_RE, '');
+// ANSI stripping moved to stream-formats.js (imported above), which is where
+// text output is actually rendered - one implementation for every format.
 const OPENCODE_STABLE_MCP_URL = 'http://127.0.0.1:4319/mcp';
 const CHATPANEL_STABLE_MCP_URL = 'http://127.0.0.1:4319/mcp';
 
@@ -109,22 +106,30 @@ export async function listModels(options = {}) {
 export async function listSpecModels(command, listModelsArgs, workingDir) {
   const listArgs = String(listModelsArgs || '').trim();
   if (!command || !listArgs) return [];
+  const stdout = await runForStdout(command, listArgs.split(/\s+/).filter(Boolean), workingDir);
+  return parseModelList(stdout);
+}
+
+// Run a CLI to completion and return its stdout. Shared by every "ask the CLI
+// something" path (model listing and the per-agent listModels overrides) so the
+// spawn/resolve/timeout handling exists once.
+export async function runForStdout(command, argvIn, workingDir, timeoutMs = 20000) {
+  if (!command) return '';
   const resolved = resolveCommand(command);
   if (!resolved) throw new Error(`Couldn't find "${command}".`);
   const cwd = workingDir ? path.resolve(workingDir) : null;
-  const [bin, argv, opts] = buildSpawnSpec(resolved, listArgs.split(/\s+/).filter(Boolean), cwd);
+  const [bin, argv, opts] = buildSpawnSpec(resolved, argvIn, cwd);
   opts.env = { ...(opts.env || process.env), NO_COLOR: '1', CLICOLOR: '0' };
-  const stdout = await new Promise((resolve, reject) => {
+  return new Promise((resolve, reject) => {
     let child;
     try { child = spawn(bin, argv, opts); } catch (e) { return reject(new Error(`Failed to start ${command}: ${e.message}`)); }
     let out = '';
-    const timer = setTimeout(() => { child.kill('SIGKILL'); reject(new Error('Listing models timed out.')); }, 20000);
+    const timer = setTimeout(() => { child.kill('SIGKILL'); reject(new Error(`${command} timed out.`)); }, timeoutMs);
     child.stdout.on('data', (d) => (out += d.toString()));
     child.on('error', (e) => { clearTimeout(timer); reject(new Error(`Failed to start ${command}: ${e.message}`)); });
     child.on('close', () => { clearTimeout(timer); resolve(out); });
     try { child.stdin.end(); } catch { /* some CLIs don't read stdin */ }
   });
-  return parseModelList(stdout);
 }
 
 function mcpToolSpecs(mcp) {
@@ -380,7 +385,10 @@ export async function runSpec(spec, { messages, system, options = {}, images },
   const prompt = buildCliPrompt(messages, system);
   let cwd = options.workingDir ? path.resolve(options.workingDir) : null;
   const label = spec.label || spec.command;
-  const fmt = ['claude-stream-json', 'opencode-json'].includes(spec.format) ? spec.format : 'text';
+  // Output dialect — resolved against the stream-format registry, so a new agent
+  // brings a format by NAME instead of a new branch in this runner. Unknown /
+  // absent names fall back to plain text.
+  const fmt = Object.hasOwn(STREAM_FORMATS, spec.format) ? spec.format : 'text';
 
   // Args: either a real array or a space-split string. With promptVia:'arg' we
   // substitute {prompt} (or append it if there's no placeholder); otherwise the
@@ -398,7 +406,10 @@ export async function runSpec(spec, { messages, system, options = {}, images },
   // intentional autonomy flags live in their BASE spec (cli-agents.js), not here, so
   // they're unaffected; a custom CLI that genuinely needs such a flag should carry it
   // in its configured command/args, not the extra-args field.
-  pushExtraArgs(args, options.extraArgs, FORBIDDEN.custom, emit);
+  // Built-in specs may name a stricter set than the generic `custom` one, since
+  // each CLI's escalation flags are spelled differently (Copilot's --allow-all-*
+  // family isn't matched by the generic pattern).
+  pushExtraArgs(args, options.extraArgs, FORBIDDEN[spec.forbidden] || FORBIDDEN.custom, emit);
   // Inject the selected model via the agent's CONFIGURED model-arg template
   // (e.g. "--model {model}" or, for opencode, "-m {model}" with provider/model).
   // Without a template we can't know how this CLI takes a model, so options.model
@@ -413,6 +424,16 @@ export async function runSpec(spec, { messages, system, options = {}, images },
     // project path, so it never loads opencode.json / its MCP servers.
     args = [...args, ...injected];
   }
+  // Permission mode -> flags, declared per agent as
+  //   permissionArgs: { default: [...], acceptEdits: [...], bypassPermissions: [...] }
+  // Agents whose autonomy flags are unconditional keep them in `args`; this is for
+  // CLIs (Copilot) with a real permission surface, so the extension's existing
+  // per-agent Permission mode actually means something. Unknown mode -> `default`.
+  if (spec.permissionArgs) {
+    const mode = String(options.permissionMode || 'default');
+    const perm = spec.permissionArgs[mode] || spec.permissionArgs.default || [];
+    args = [...args, ...perm.map(String)];
+  }
   // Images: write to temp files, expand the agent's imageArg template, then place
   // the tokens. An explicit {images} placeholder in args wins; otherwise they go
   // just before the prompt (arg mode) or get appended (stdin mode).
@@ -446,6 +467,28 @@ export async function runSpec(spec, { messages, system, options = {}, images },
   // /mcp endpoint is present before letting the agent answer with no tools.
   if (options.mcp?.url) await ensureStableMcpConfig(spec, cwd, label, emit);
 
+  // Model via a CONFIG-PATCH FILE, for agents with no --model flag (dsh takes the
+  // model as a Cordis config overlay: `--patch <file>` replacing one row by id).
+  // `build` is a function, so this can only come from a built-in spec — a custom
+  // BYO agent's spec arrives as JSON over HTTP and cannot carry one.
+  if (options.model && typeof spec.modelPatch?.build === 'function') {
+    // Keep the value to a conservative id charset: it lands in a config file the
+    // agent parses, so no quotes/newlines/path characters.
+    const safeModel = /^[A-Za-z0-9][\w.:-]{0,79}$/.test(String(options.model)) ? String(options.model) : '';
+    if (safeModel) {
+      const patchFile = path.join(os.tmpdir(), `chatpanel-modelpatch-${tag}.yml`);
+      await writeFile(patchFile, spec.modelPatch.build(safeModel));
+      mcpFiles.push(patchFile); // cleaned up with the other temp files
+      const tmpl = String(spec.modelPatch.arg || '--patch {file}');
+      const tokens = tmpl.includes('{file}')
+        ? tmpl.replaceAll('{file}', patchFile).split(/\s+/).filter(Boolean)
+        : [...tmpl.split(/\s+/).filter(Boolean), patchFile];
+      // PREPEND: these are launcher flags and must precede the task text (same
+      // reason mcpArg prepends).
+      args = [...tokens, ...args];
+    }
+  }
+
   const imageTokens = imageTokensFor(spec.imageArg, imageFiles);
   let placedImages = false;
   if (imageTokens.length) {
@@ -491,9 +534,9 @@ export async function runSpec(spec, { messages, system, options = {}, images },
     const detach = killOnAbort(child, signal); // Stop → terminate the CLI child
 
     let stderr = '';
-    let streamedAny = false;
-    let resultText = '';
-    let jsonBuf = '';
+    // The output dialect is a plugin (stream-formats.js); it owns line buffering,
+    // "did anything stream", and the fallback answer text.
+    const parser = createStreamParser(fmt, emit);
 
     let idleTimer;
     const armIdle = () => {
@@ -508,50 +551,7 @@ export async function runSpec(spec, { messages, system, options = {}, images },
 
     child.stdout.on('data', (d) => {
       armIdle();
-      const s = d.toString();
-      if (fmt === 'claude-stream-json') {
-        jsonBuf += s;
-        let nl;
-        while ((nl = jsonBuf.indexOf('\n')) >= 0) {
-          const line = jsonBuf.slice(0, nl).trim();
-          jsonBuf = jsonBuf.slice(nl + 1);
-          if (!line.startsWith('{')) continue;
-          let msg;
-          try {
-            msg = JSON.parse(line);
-          } catch {
-            continue;
-          }
-          const r = handleMessage(msg, emit, streamedAny);
-          if (r.streamed) streamedAny = true;
-          if (r.result != null) resultText = r.result;
-        }
-      } else if (fmt === 'opencode-json') {
-        // opencode `run --format json` emits newline-delimited events: text parts,
-        // tool/tool_use, and errors. Extract the answer text + surface tools/errors.
-        jsonBuf += s;
-        let nl;
-        while ((nl = jsonBuf.indexOf('\n')) >= 0) {
-          const line = jsonBuf.slice(0, nl).trim();
-          jsonBuf = jsonBuf.slice(nl + 1);
-          if (!line.startsWith('{')) continue;
-          let ev;
-          try { ev = JSON.parse(line); } catch { continue; }
-          if (ev.type === 'text' && ev.part?.text) {
-            streamedAny = true;
-            emit({ type: 'delta', text: ev.part.text });
-          } else if (ev.type === 'tool' || ev.type === 'tool_use') {
-            const p = ev.part || {};
-            emit({ type: 'tool', name: p.tool || p.name || p.type || 'tool', summary: '' });
-          } else if (ev.type === 'error') {
-            const msg = ev.error?.data?.message || ev.error?.message || ev.error?.name || 'error';
-            emit({ type: 'status', text: String(msg).slice(0, 300) });
-          }
-        }
-      } else {
-        streamedAny = true;
-        emit({ type: 'delta', text: stripAnsi(s) });
-      }
+      parser.push(d.toString());
     });
     child.stderr.on('data', (d) => { armIdle(); stderr += d.toString(); });
     child.on('error', (e) => {
@@ -566,7 +566,7 @@ export async function runSpec(spec, { messages, system, options = {}, images },
       cleanup();
       if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly
       if (code === 0) {
-        emit({ type: 'done', text: streamedAny ? '' : resultText });
+        emit({ type: 'done', text: parser.streamed ? '' : parser.finish() });
         resolve();
       } else {
         reject(new Error(`${label} exited ${code}: ${stderr.trim().split('\n').pop() || 'failed'}`));

package/src/engines/stream-formats.js

@@ -0,0 +1,207 @@
+// Stream-format plugins — the seam that makes "add a CLI agent" a DATA change.
+//
+// Every headless CLI prints its turn in some shape: plain text, or one of a
+// handful of NDJSON dialects. Previously each dialect was an inline `else if`
+// branch in runSpec(), so a new agent with a new dialect meant editing the
+// runner. That's the reinvention this registry removes: a format is a named
+// plugin here, and an agent spec just names it (`format: 'copilot-json'`).
+//
+// Contract — a format is a factory `(emit) => parser` where parser has:
+//   push(chunk: string)   feed raw stdout; emit deltas/tools/status as they parse
+//   finish(): string      the final answer when nothing was streamed (fallback)
+//   get streamed(): bool  true once any delta was emitted
+//
+// Emitted event types match the bridge's SSE vocabulary: delta | reasoning |
+// tool | status. (`done`/`usage`/`error` stay the runner's job.)
+
+import { handleMessage } from './claude.js';
+
+// Many CLIs colourize even when piped; strip ANSI from anything we treat as text.
+const ANSI_RE = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
+export const stripAnsi = (s) => String(s).replace(ANSI_RE, '');
+
+// Shared NDJSON pump: buffers partial lines and hands complete JSON objects to
+// `onEvent`. Every JSON dialect below is line-delimited, so they all reuse this.
+function ndjson(onEvent) {
+  let buf = '';
+  return (chunk) => {
+    buf += chunk;
+    let nl;
+    while ((nl = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, nl).trim();
+      buf = buf.slice(nl + 1);
+      if (!line.startsWith('{')) continue;
+      let ev;
+      try {
+        ev = JSON.parse(line);
+      } catch {
+        continue; // a partial/garbage line is not fatal — keep streaming
+      }
+      onEvent(ev);
+    }
+  };
+}
+
+// --- text ------------------------------------------------------------------
+// Anything that just prints a reply.
+function textFormat(emit) {
+  let streamed = false;
+  return {
+    push(chunk) {
+      streamed = true;
+      emit({ type: 'delta', text: stripAnsi(chunk) });
+    },
+    finish: () => '',
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// --- claude-stream-json ----------------------------------------------------
+// Claude Code's `--output-format stream-json`, parsed by the Claude engine.
+function claudeStreamJson(emit) {
+  let streamed = false;
+  let result = '';
+  const pump = ndjson((msg) => {
+    const r = handleMessage(msg, emit, streamed);
+    if (r.streamed) streamed = true;
+    if (r.result != null) result = r.result;
+  });
+  return {
+    push: pump,
+    finish: () => result,
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// --- opencode-json ---------------------------------------------------------
+// opencode `run --format json`: text parts, tool events, errors.
+function opencodeJson(emit) {
+  let streamed = false;
+  const pump = ndjson((ev) => {
+    if (ev.type === 'text' && ev.part?.text) {
+      streamed = true;
+      emit({ type: 'delta', text: ev.part.text });
+    } else if (ev.type === 'tool' || ev.type === 'tool_use') {
+      const p = ev.part || {};
+      emit({ type: 'tool', name: p.tool || p.name || p.type || 'tool', summary: '' });
+    } else if (ev.type === 'error') {
+      const msg = ev.error?.data?.message || ev.error?.message || ev.error?.name || 'error';
+      emit({ type: 'status', text: String(msg).slice(0, 300) });
+    }
+  });
+  return {
+    push: pump,
+    finish: () => '',
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// --- copilot-json ----------------------------------------------------------
+// GitHub Copilot CLI `--output-format json` (verified against 1.0.80).
+//
+// Event vocabulary (only the ones we surface):
+//   assistant.message_delta   data.deltaContent   -> streamed answer text
+//   assistant.message         data.content        -> whole answer (fallback)
+//   assistant.reasoning       data.content        -> thinking (usually opaque/empty)
+//   tool.execution_start      data.toolName       -> activity strip
+//   tool.execution_complete   data.success/result -> surface failures
+//   session.auto_mode_resolved data.chosenModel   -> which model `auto` picked
+//   result                    exitCode/usage      -> terminal event
+//
+// Copilot reports a denied tool as a COMPLETED call whose result explains the
+// permission gap, so a user on a low permission mode otherwise sees a confident
+// "I can't do that" with no hint that ChatPanel gated it. Detect that shape and
+// say which setting to raise.
+const PERMISSION_RE = /permission denied|could not request permission|not allowed|denied by|requires approval/i;
+
+function copilotJson(emit) {
+  let streamed = false;
+  let result = '';
+  let permissionHinted = false;
+
+  const hintPermissions = (text) => {
+    if (permissionHinted || !PERMISSION_RE.test(String(text || ''))) return;
+    permissionHinted = true;
+    emit({
+      type: 'status',
+      text: 'Copilot was denied a tool/URL — raise this agent’s Permission mode in Settings.',
+    });
+  };
+
+  const pump = ndjson((ev) => {
+    const type = ev?.type || '';
+    const d = ev?.data || {};
+    switch (type) {
+      case 'assistant.message_delta':
+        if (d.deltaContent) {
+          streamed = true;
+          emit({ type: 'delta', text: d.deltaContent });
+        }
+        break;
+      case 'assistant.message':
+        // Full turn text. Keep as the fallback answer for the non-streaming case
+        // (`--stream off`, or a turn that only produced a final message).
+        if (typeof d.content === 'string' && d.content) result = d.content;
+        break;
+      case 'assistant.reasoning':
+        if (d.content) emit({ type: 'reasoning', text: String(d.content) });
+        break;
+      case 'tool.execution_start':
+        emit({ type: 'tool', name: d.toolName || 'tool', summary: '' });
+        break;
+      case 'tool.execution_complete':
+        if (d.success === false) {
+          const msg = typeof d.result === 'string' ? d.result : d.result?.error || d.result?.message || '';
+          if (msg) emit({ type: 'status', text: String(msg).slice(0, 300) });
+          hintPermissions(msg);
+        } else {
+          hintPermissions(typeof d.result === 'string' ? d.result : '');
+        }
+        break;
+      case 'session.auto_mode_resolved':
+        if (d.chosenModel) emit({ type: 'status', text: `model: ${d.chosenModel}` });
+        break;
+      case 'session.mcp_server_status_changed':
+        // Only worth surfacing when our own browser-tool server fails to attach.
+        if (d.status === 'failed' && d.error) {
+          emit({ type: 'status', text: `MCP ${d.serverName}: ${String(d.error).slice(0, 160)}` });
+        }
+        break;
+      case 'result':
+        // Terminal event; `exitCode` is authoritative for failure (the process
+        // can still exit 0 while a tool failed). Surface a non-zero code.
+        if (ev.exitCode) emit({ type: 'status', text: `copilot exited ${ev.exitCode}` });
+        break;
+      default:
+        break;
+    }
+  });
+
+  return {
+    push: pump,
+    finish: () => result,
+    get streamed() {
+      return streamed;
+    },
+  };
+}
+
+// The registry. Adding a dialect = adding one entry here; agent specs reference
+// it by name, so no runner change is needed.
+export const STREAM_FORMATS = {
+  text: textFormat,
+  'claude-stream-json': claudeStreamJson,
+  'opencode-json': opencodeJson,
+  'copilot-json': copilotJson,
+};
+
+export function createStreamParser(format, emit) {
+  const make = STREAM_FORMATS[format] || STREAM_FORMATS.text;
+  return make(emit);
+}

package/src/env.js

@@ -11,10 +11,11 @@ import { spawnSync } from 'node:child_process';
 import { readdirSync, readFileSync, existsSync } from 'node:fs';
 
 let enriched = false;
+let envEnriched = false;
 
 // The agent CLIs the bridge shells out to. Claude has its own richer resolution
 // (resolveClaude: native / cli.js / WSL / SDK) below.
-export const AGENT_CLIS = ['codex', 'claude', 'agy', 'pi', 'opencode', 'kiro-cli'];
+export const AGENT_CLIS = ['codex', 'claude', 'agy', 'pi', 'opencode', 'kiro-cli', 'copilot', 'dsh'];
 
 // Is `name` executable somewhere on the current PATH?
 function onPath(name) {
@@ -421,6 +422,64 @@ export function commandCandidateFiles(name, home = os.homedir(), platform = proc
   return unique([...fromDirs, ...agentCandidateBins(name, home, platform, env)]);
 }
 
+// Agent credentials a LaunchAgent/systemd unit does NOT inherit.
+//
+// enrichPath() repairs the minimal PATH a service gets; this is the same problem
+// one layer up. A CLI that authenticates from a FILE (claude, codex, copilot:
+// ~/.copilot) works fine under the service, but one that reads an API key from
+// the ENVIRONMENT (dsh -> DEEPSEEK_API_KEY) fails with a missing-credential
+// error that looks like a ChatPanel bug — the launchd job's environment is just
+// SSH_AUTH_SOCK and a bare PATH.
+//
+// So: ask the user's login shell for a NARROW allowlist of agent credential
+// variables and fill in only the ones we don't already have. These are the
+// user's own credentials, on their own machine, handed to CLIs the user
+// configured ChatPanel to launch — exactly what would happen had they run the
+// CLI from their terminal. Values are never logged, and /debug never dumps the
+// environment (it exposes only PATH/home, and only under CHATPANEL_BRIDGE_DEBUG).
+const AGENT_ENV_KEYS = [
+  'DEEPSEEK_API_KEY', 'DSH_HOME',
+  'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_BASE_URL',
+  'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_API_BASE',
+  'GEMINI_API_KEY', 'GOOGLE_API_KEY',
+  'OPENROUTER_API_KEY', 'GROQ_API_KEY', 'XAI_API_KEY', 'MISTRAL_API_KEY',
+];
+
+export function enrichAgentEnv() {
+  if (envEnriched) return;
+  envEnriched = true;
+  if (process.platform === 'win32') return; // service env is inherited there
+
+  const missing = AGENT_ENV_KEYS.filter((k) => !process.env[k]);
+  if (!missing.length) return;
+  try {
+    const shell = process.env.SHELL || '/bin/zsh';
+    // Emit NAME\tVALUE for each var that is actually set; trailing `true` keeps
+    // the exit status clean when the last test fails.
+    const script = `${missing
+      .map((k) => `[ -n "\${${k}:-}" ] && printf '%s\\t%s\\n' ${k} "\$${k}"`)
+      .join('; ')}; true`;
+    // -lic, not -lc: these keys are typically exported from ~/.zshrc (or ~/.bashrc),
+    // which a LOGIN-only shell does NOT source — that's interactive-only. TERM=dumb
+    // keeps prompt/banner noise down, and the parser below ignores any line that
+    // isn't a clean NAME<TAB>VALUE, so rc-file chatter is harmless.
+    const r = spawnSync(shell, ['-lic', script], {
+      encoding: 'utf8',
+      timeout: 6000,
+      env: { ...process.env, TERM: 'dumb' },
+    });
+    for (const line of String(r.stdout || '').split('\n')) {
+      const i = line.indexOf('\t');
+      if (i <= 0) continue;
+      const key = line.slice(0, i).trim();
+      const value = line.slice(i + 1);
+      if (AGENT_ENV_KEYS.includes(key) && !process.env[key] && value) process.env[key] = value;
+    }
+  } catch {
+    /* no login shell / timeout — agents that need a file-based login still work */
+  }
+}
+
 export function enrichPath() {
   if (enriched) return;
   enriched = true;

package/src/server.js

@@ -26,10 +26,10 @@ import { join } from 'node:path';
 import * as claude from './engines/claude.js';
 import * as codex from './engines/codex.js';
 import * as antigravity from './engines/antigravity.js';
-import { pi, opencode, kiro } from './engines/cli-agents.js';
+import { pi, opencode, kiro, copilot, deepseek } from './engines/cli-agents.js';
 import * as custom from './engines/custom.js';
 import { installService, uninstallService, serviceStatus, restartService } from './service.js';
-import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
+import { AGENT_CLIS, enrichPath, enrichAgentEnv, findAgentBin, resolveCommand } from './env.js';
 import { stripHidden } from './sanitize.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
@@ -38,7 +38,7 @@ import { assertPublicHttpUrl, assertPublicWebUrl } from './ssrf.js';
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.22';
+const VERSION = '0.10.24';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -49,6 +49,8 @@ const ENGINES = {
   pi: { engine: pi, label: 'Pi' },
   opencode: { engine: opencode, label: 'OpenCode' },
   kiro: { engine: kiro, label: 'Kiro' },
+  copilot: { engine: copilot, label: 'GitHub Copilot' },
+  deepseek: { engine: deepseek, label: 'DeepSeek Harness' },
   // "Bring your own" — one engine drives any user-onboarded CLI (Pro). Hidden
   // from /health (it's not a single installable agent; the extension manages the
   // list and validates commands via /agent-check).
@@ -826,6 +828,7 @@ function runMcpStdioProxy(url) {
 
 function startServer() {
   enrichPath(); // so codex/agy (Antigravity) are found even under a minimal service PATH
+  enrichAgentEnv(); // and so env-authenticated CLIs (dsh) have their key under launchd
   ensureToken(); // per-install bearer token for privileged routes (defense-in-depth)
   // Fail LOUD on a port clash. The bridge binds a FIXED 4319 so the extension always
   // finds it; if it's taken, say how to recover instead of dying on a raw stack trace.