@chatpanel/bridge 0.10.41 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.41",
+  "version": "0.11.0",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [
@@ -38,7 +38,11 @@
     "test": "node --test tests/*.test.mjs",
     "build:bin": "bash scripts/build-binaries.sh",
     "sync:events": "node scripts/sync-events.mjs",
-    "test:events-sync": "node scripts/sync-events.mjs --check"
+    "test:events-sync": "node scripts/sync-events.mjs --check",
+    "sync:pii": "node scripts/sync-pii.mjs",
+    "sync:channels": "node scripts/sync-channels.mjs",
+    "test:pii-sync": "node scripts/sync-pii.mjs --check",
+    "test:channels-sync": "node scripts/sync-channels.mjs --check"
   },
   "dependencies": {},
   "optionalDependencies": {

package/scripts/sync-channels.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+// Vendors the channel core from `chatpanel-channels`.
+//
+// WHY THE BRIDGE HOSTS IT. A messaging channel has to be running when nobody is looking — the
+// whole point is to reach your machine from a phone while the browser is closed — and the
+// bridge is the only always-on local process a ChatPanel user already has. Putting the loop
+// anywhere else (a second daemon, an npm install, a service worker that Chrome suspends) is a
+// second thing a non-technical person has to install and keep alive.
+//
+//   node scripts/sync-channels.mjs           refresh src/channels/ from the package
+//   node scripts/sync-channels.mjs --check   verify it matches (drift guard); exit 1 if not
+//
+// The package imports `@chatpanel/pii` and `@chatpanel/events/*` by name; the bridge has no
+// node_modules, so those specifiers are REWRITTEN to the vendored copies as the files are
+// copied. The rewrite is table-driven and fails loudly on an unknown bare import rather than
+// emitting a file that throws at runtime inside a compiled binary.
+
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// The service and everything under it. `config.js` is deliberately absent: it resolves paths
+// and reads the bridge token from disk, and the bridge already knows both.
+const FILES = [
+  'normalize.js', 'pairing.js', 'invoke.js', 'stream.js', 'bridge.js',
+  'eventlog.js', 'service.js', 'adapters/telegram.js',
+];
+
+// bare specifier → path relative to src/channels/ (adjusted per file depth below).
+const REWRITE = {
+  '@chatpanel/pii': '../pii/index.js',
+  '@chatpanel/events/event.js': '../events/event.js',
+  '@chatpanel/events/capability.js': '../events/capability.js',
+  '@chatpanel/events/reach.js': '../events/reach.js',
+};
+
+function pkgDir() {
+  return [
+    join(ROOT, 'node_modules', '@chatpanel', 'channels', 'src'),
+    join(ROOT, '..', 'chatpanel-channels', 'src'),
+  ].find((d) => existsSync(join(d, 'service.js')));
+}
+
+const check = process.argv.includes('--check');
+const src = pkgDir();
+
+if (!src) {
+  const msg = 'chatpanel-channels not found (check out ../chatpanel-channels).';
+  if (check) { console.error(`sync-channels --check: ${msg}`); process.exit(1); }
+  console.warn(`sync-channels: ${msg} Leaving src/channels as-is.`);
+  process.exit(0);
+}
+
+const banner = (f) => `// GENERATED — do not edit.\n`
+  + `// Source of truth: chatpanel-channels/src/${f} (npm @chatpanel/channels).\n`
+  + `// Edit there, then run: npm run sync:channels\n`
+  + `//\n`
+  + `// Vendored rather than depended on: the bridge ships zero runtime dependencies so a\n`
+  + `// curl one-liner install cannot fail on someone's registry, and so the compiled\n`
+  + `// single-file binary has nothing to resolve. Package imports are rewritten to the\n`
+  + `// vendored engines (src/pii, src/events) by the sync script.\n\n`;
+
+// Rewrite every bare @chatpanel specifier, and refuse to emit a file with one left over.
+function vendor(file, text) {
+  const up = '../'.repeat(file.split('/').length - 1); // adapters/telegram.js sits one deeper
+  let out = text.replace(/(from\s+['"])(@chatpanel\/[^'"]+)(['"])/g, (full, a, spec, b) => {
+    const to = REWRITE[spec];
+    if (!to) throw new Error(`sync-channels: no rewrite for '${spec}' (imported by ${file}) — add it to REWRITE`);
+    return `${a}${up}${to}${b}`;
+  });
+  const left = out.match(/from\s+['"]@chatpanel\/[^'"]+['"]/);
+  if (left) throw new Error(`sync-channels: unrewritten import in ${file}: ${left[0]}`);
+  return banner(file) + out;
+}
+
+let drift = 0;
+for (const f of FILES) {
+  const want = vendor(f, readFileSync(join(src, f), 'utf8'));
+  const dest = join(ROOT, 'src', 'channels', f);
+  if (!check) mkdirSync(dirname(dest), { recursive: true });
+  const have = existsSync(dest) ? readFileSync(dest, 'utf8') : null;
+  if (have === want) continue;
+  if (check) { console.error(`sync-channels --check: src/channels/${f} differs from chatpanel-channels`); drift += 1; continue; }
+  writeFileSync(dest, want);
+  console.log(`sync-channels: updated src/channels/${f}`);
+}
+
+if (check) {
+  if (drift) { console.error('Run `npm run sync:channels` and commit the result.'); process.exit(1); }
+  console.log('sync-channels --check: src/channels matches chatpanel-channels ✓');
+}

package/scripts/sync-events.mjs

@@ -21,7 +21,15 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 // Deliberately short. `skill-manifest.js` imports only `scopes.js`, which is why that
 // vocabulary was split out of `capability.js` — vendoring the capability machinery and
 // the event schema to reach a five-element array would defeat the point.
-const FILES = ['scopes.js', 'skill-manifest.js', 'skill-scan.js'];
+// The channel service brings the second group: `event.js` (+ its `ref.js`) is the audit
+// appender every channel turn writes through, `capability.js` (+ `view.js`, `scopes.js`) is
+// the invocation contract it validates against, and `reach.js` is the ladder that caps a
+// paired phone. `reach.js` exists as its own module for exactly this reason — the ladder is
+// three strings, and taking it out of `router.js` would have vendored 50 KB of model routing.
+const FILES = [
+  'scopes.js', 'skill-manifest.js', 'skill-scan.js',
+  'ref.js', 'event.js', 'view.js', 'capability.js', 'reach.js',
+];
 
 function pkgDir() {
   return [

package/scripts/sync-pii.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// Vendors the redaction engine the channel service needs from `chatpanel-pii`.
+//
+// The bridge ships ZERO runtime dependencies on purpose — it installs by curl one-liner and
+// compiles to a single binary, and every dependency is something that can fail on a stranger's
+// laptop. So the engine arrives the way the event contracts do: copied in, generated, never
+// hand-edited.
+//
+//   node scripts/sync-pii.mjs           refresh src/pii/ from the package
+//   node scripts/sync-pii.mjs --check   verify it matches (drift guard); exit 1 if not
+//
+// This is also what retires the oldest hand-copy in the repo: `src/sanitize.js` used to be a
+// manual copy of the same engine's sanitizer, kept in step by memory. It is now a two-line
+// re-export of the vendored copy, so there is one file to diverge from and a test that notices.
+
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// The whole engine, because redaction is not a subset you can take half of: `index.js` is the
+// entry the channel core imports, and every file below it is on that graph.
+const FILES = [
+  'index.js', 'pii-redact.js', 'pii-detect.js', 'pipeline.js',
+  'tool-rank.js', 'tool-harness.js', 'sanitize.js', 'net.js',
+];
+
+function pkgDir() {
+  return [
+    join(ROOT, 'node_modules', '@chatpanel', 'pii'),
+    join(ROOT, '..', 'chatpanel-pii'),
+  ].find((d) => existsSync(join(d, 'pii-redact.js')));
+}
+
+const check = process.argv.includes('--check');
+const src = pkgDir();
+
+if (!src) {
+  const msg = 'chatpanel-pii not found (check out ../chatpanel-pii).';
+  if (check) { console.error(`sync-pii --check: ${msg}`); process.exit(1); }
+  console.warn(`sync-pii: ${msg} Leaving src/pii as-is.`);
+  process.exit(0);
+}
+
+const outDir = join(ROOT, 'src', 'pii');
+if (!check) mkdirSync(outDir, { recursive: true });
+
+const banner = (f) => `// GENERATED — do not edit.\n`
+  + `// Source of truth: chatpanel-pii/${f} (npm @chatpanel/pii).\n`
+  + `// Edit there, then run: npm run sync:pii\n`
+  + `//\n`
+  + `// Vendored rather than depended on: the bridge ships zero runtime dependencies so a\n`
+  + `// curl one-liner install cannot fail on someone's registry, and so the compiled\n`
+  + `// single-file binary has nothing to resolve.\n\n`;
+
+let drift = 0;
+for (const f of FILES) {
+  const want = banner(f) + readFileSync(join(src, f), 'utf8');
+  const dest = join(outDir, f);
+  const have = existsSync(dest) ? readFileSync(dest, 'utf8') : null;
+  if (have === want) continue;
+  if (check) { console.error(`sync-pii --check: src/pii/${f} differs from chatpanel-pii`); drift += 1; continue; }
+  writeFileSync(dest, want);
+  console.log(`sync-pii: updated src/pii/${f}`);
+}
+
+if (check) {
+  if (drift) { console.error('Run `npm run sync:pii` and commit the result.'); process.exit(1); }
+  console.log('sync-pii --check: src/pii matches chatpanel-pii ✓');
+}

package/src/api-compat.js

@@ -6,6 +6,7 @@
 // are rejected when accepting them would produce misleading behavior.
 
 import { randomUUID } from 'node:crypto';
+import { normalizeNames } from './mcp-quarantine.js';
 
 const AGENT_IDS = new Set(['claude', 'codex', 'antigravity', 'pi', 'opencode', 'kiro', 'copilot', 'deepseek']);
 
@@ -76,6 +77,9 @@ function resolveTarget(model, chatpanel = {}) {
       workingDir: chatpanel.working_dir || chatpanel.workingDir || process.env.CHATPANEL_API_WORKING_DIR || '',
       permissionMode,
       useLocalConfig: chatpanel.use_local_config ?? chatpanel.useLocalConfig ?? true,
+      // Servers in the agent's OWN MCP config to leave out of this run — one that can't
+      // authenticate or can't be reached otherwise kills the whole turn (see mcp-quarantine.js).
+      mcpDisabled: normalizeNames(chatpanel.mcp_disabled ?? chatpanel.mcpDisabled),
       ...(engineModel ? { model: engineModel } : {}),
     },
   };

package/src/channels/adapters/telegram.js

@@ -0,0 +1,248 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-channels/src/adapters/telegram.js (npm @chatpanel/channels).
+// Edit there, then run: npm run sync:channels
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve. Package imports are rewritten to the
+// vendored engines (src/pii, src/events) by the sync script.
+
+// Telegram adapter — the LOCAL shape (§3 of feature-f7). getUpdates long-poll is
+// OUTBOUND-ONLY, so this mirrors Claude Code Remote Control's key property: the machine never
+// opens an inbound port, works behind NAT, needs no tunnel. The adapter is dumb transport;
+// normalize → gate → redact → invoke → stream → restore is the shared core it drives.
+
+import { normalizeTelegram, actorId } from '../normalize.js';
+import {
+  buildInvocation, redactInbound, outboundText, appendTurn,
+  appendInvoked, appendRedacted, appendEgress,
+} from '../invoke.js';
+import * as bridge from '../bridge.js';
+import { splitForTelegram, createGate } from '../stream.js';
+import { createVault } from '../../pii/index.js';
+
+const TG_HOST = 'api.telegram.org';
+
+const HELP = [
+  'ChatPanel — drive your local agent from here.',
+  '',
+  'Send a message and I run it on your machine.',
+  '/pair <code> — enroll this chat (ChatPanel → Settings → Channels)',
+  '/new         — start fresh (forget this conversation + new privacy vault)',
+  '/stop        — stop the current run',
+  '/help        — this message',
+].join('\n');
+
+/**
+ * Start the long-poll loop. Returns the loop promise; abort `signal` to stop it. Everything
+ * it needs is injected — a bot token, the bridge address+token, a pairing store, an event sink
+ * — so nothing here reads a secret or reaches for global state.
+ */
+export function startTelegram({
+  botToken,
+  baseUrl,
+  token,                       // bridge token
+  pairing,                     // createPairingStore(...)
+  savePairing = async () => {},
+  appender,                    // createEventLog(...) or nullEventLog()
+  agent = 'claude',
+  system = '',
+  redact = { tier: 'basic' },
+  privacy = 'standard',
+  logger = console,
+  signal,                      // AbortSignal to stop the whole loop
+}) {
+  const api = `https://${TG_HOST}/bot${botToken}`;
+  const fileApi = `https://${TG_HOST}/file/bot${botToken}`;
+  // Per-chat session: a persistent vault (stable placeholders across turns), the live run id
+  // (/stop), and the redacted conversation history (multi-turn context).
+  const chats = new Map(); // chatId -> { vault, runId, history }
+  const freshChat = () => ({ vault: createVault(), runId: null, history: [] });
+  const chatState = (id) => {
+    if (!chats.has(id)) chats.set(id, freshChat());
+    return chats.get(id);
+  };
+
+  async function tg(method, body) {
+    const res = await fetch(`${api}/${method}`, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal,
+    });
+    return res.json();
+  }
+  const send = (chatId, text) => tg('sendMessage', { chat_id: chatId, text });
+  const edit = (chatId, messageId, text) => tg('editMessageText', { chat_id: chatId, message_id: messageId, text });
+
+  // Resolve Telegram photos to the { dataUrl } shape the bridge's engines expect (Claude Code
+  // writes them to temp files and reads them as vision). A failed fetch drops that one image
+  // rather than failing the whole turn.
+  async function toBridgeImages(photos) {
+    const out = [];
+    for (const p of photos || []) {
+      try {
+        const info = await tg('getFile', { file_id: p.fileId });
+        const fp = info?.result?.file_path;
+        if (!fp) continue;
+        const bin = await fetch(`${fileApi}/${fp}`, { signal });
+        const buf = Buffer.from(await bin.arrayBuffer());
+        const mime = /\.png$/i.test(fp) ? 'image/png' : /\.webp$/i.test(fp) ? 'image/webp' : 'image/jpeg';
+        out.push({ dataUrl: `data:${mime};base64,${buf.toString('base64')}` });
+      } catch (e) { logger.warn?.(`[telegram] image fetch failed: ${e?.message || e}`); }
+    }
+    return out;
+  }
+
+  async function handleCommand(norm) {
+    const id = actorId('telegram', norm.chatId);
+    const { name, args } = norm.command;
+    // `/start <code>` is what a t.me/<bot>?start=<code> link SENDS. Telegram turns the link
+    // into that first message, so tapping "Pair this phone" in ChatPanel enrolls in one tap —
+    // no six digits thumbed in from another screen. Bare /start is still the greeting.
+    const pairCode = name === 'pair' || (name === 'start' && args) ? args : '';
+    if (pairCode) {
+      const r = pairing.redeem(id, pairCode);
+      await savePairing();
+      return void send(norm.chatId, r.ok
+        ? `✅ paired (reach: ${r.reach}). Send me anything — I'll run it on your machine.`
+        : `⛔ ${r.reason}`);
+    }
+    if (name === 'help' || name === 'start') return void send(norm.chatId, HELP);
+    if (name === 'pair') return void send(norm.chatId, 'send /pair <code> — get the code in ChatPanel → Settings → Channels');
+    if (name === 'new') {
+      chats.set(norm.chatId, freshChat());
+      return void send(norm.chatId, '🧹 fresh conversation.');
+    }
+    if (name === 'stop') {
+      const st = chatState(norm.chatId);
+      const ok = await bridge.cancel(st.runId, { baseUrl, token });
+      st.runId = null;
+      return void send(norm.chatId, ok ? '⏹ stopped.' : 'nothing running.');
+    }
+    return void send(norm.chatId, `unknown command /${name} — try /help`);
+  }
+
+  async function handleMessage(norm) {
+    const id = actorId('telegram', norm.chatId);
+    // AUTHENTICATION gate: an unpaired sender cannot drive anything. This proves WHO, not WHAT
+    // — tool scoping (reach → per-actor allowlist) is the next layer and lives above the bridge.
+    const reach = pairing.reachOf(id);
+    if (!reach) {
+      return void send(norm.chatId, '🔒 not paired. Get a code in the ChatPanel extension, then send: /pair <code>');
+    }
+    if (!norm.text && !norm.photos.length) return;
+    const st = chatState(norm.chatId);
+
+    // Contract + audit BEFORE anything leaves for the agent.
+    let invocation;
+    try { invocation = buildInvocation(norm); }
+    catch (e) { return void send(norm.chatId, `⚠️ ${e.message}`); }
+
+    const { redacted, counts } = redactInbound(norm.text, st.vault, redact);
+    await appendInvoked(appender, invocation);
+    await appendRedacted(appender, counts);
+
+    const images = await toBridgeImages(norm.photos);
+    const placeholder = await tg('sendMessage', { chat_id: norm.chatId, text: '…' });
+    const replyId = placeholder?.result?.message_id;
+    const gate = createGate(1200); // ~1 edit/sec, Telegram's ceiling for a chat
+    let shown = '';
+
+    // Replay prior turns as context; the new (redacted) message is the live one. buildCliPrompt
+    // on the bridge renders all-but-last as history and the last as "answer this now".
+    const messages = [...st.history, { role: 'user', content: redacted }];
+
+    try {
+      const finalState = await bridge.chat(
+        { agent, system, messages, images, options: { reach } },
+        {
+          baseUrl, token, signal,
+          onEvent: (ev, state) => {
+            if (ev.type === 'run') st.runId = state.runId;
+            // Throttled live edit: restore the user's own values + egress-scrub fresh secrets, so
+            // the user watches real text stream in but the provider never carries a leaked secret.
+            if ((ev.type === 'delta' || ev.type === 'done') && replyId && (ev.type === 'done' || gate.ready())) {
+              const text = outboundText(state.text, st.vault, { privacy });
+              const first = splitForTelegram(text || '…')[0];
+              if (first && first !== shown) { shown = first; edit(norm.chatId, replyId, first).catch(() => {}); }
+            }
+          },
+        },
+      );
+      st.runId = null;
+
+      const restored = outboundText(finalState.text, st.vault, { privacy });
+      const chunks = splitForTelegram(finalState.error ? `⚠️ ${finalState.error}` : (restored || '(no output)'));
+      if (replyId) await edit(norm.chatId, replyId, chunks[0]);
+      else await send(norm.chatId, chunks[0]);
+      for (const extra of chunks.slice(1)) await send(norm.chatId, extra);
+
+      // Remember the exchange for follow-ups — the REDACTED forms, so what we replay next turn
+      // never carries a real value and stays consistent with the vault. A failed turn (error /
+      // no text) records nothing, so history never implies an answer that didn't happen.
+      if (!finalState.error && finalState.text) st.history = appendTurn(st.history, redacted, finalState.text);
+
+      // Egress to Telegram, recorded: 'standard' restores real values (a third party sees
+      // them → redacted:false); 'strict' keeps placeholders (redacted:true). controlled:false
+      // either way — Telegram is not ours.
+      await appendEgress(appender, { host: TG_HOST, redacted: privacy === 'strict', controlled: false });
+    } catch (e) {
+      st.runId = null;
+      const msg = `⚠️ ${e?.message || e}`;
+      if (replyId) await edit(norm.chatId, replyId, msg).catch(() => {});
+      else await send(norm.chatId, msg).catch(() => {});
+    }
+  }
+
+  // A sleep that gives up when the loop is asked to stop, so Ctrl-C is immediate rather than
+  // "immediate in up to five seconds".
+  const nap = (ms) => new Promise((resolve) => {
+    if (signal?.aborted) return resolve();
+    let t;
+    const done = () => { clearTimeout(t); signal?.removeEventListener?.('abort', done); resolve(); };
+    t = setTimeout(done, ms);
+    signal?.addEventListener?.('abort', done, { once: true });
+  });
+
+  async function loop() {
+    let offset = 0;
+    logger.log?.('[telegram] long-poll started (outbound-only; no inbound port).');
+    while (!signal?.aborted) {
+      let updates;
+      try {
+        const res = await tg('getUpdates', { offset, timeout: 30, allowed_updates: ['message'] });
+        // Telegram REFUSES with a normal JSON body, not an HTTP error this code would throw
+        // on: a bad token answers {ok:false, 401} INSTANTLY, so `res.result || []` turned a
+        // wrong token into a silent hot loop — no message, no long-poll delay, and an API
+        // hammered hard enough to get rate-limited. The two refusals that actually happen
+        // during setup are named, because "nothing arrives" is the same symptom as "it works
+        // and nobody has texted you".
+        if (res && res.ok === false) {
+          const code = res.error_code;
+          const hint = code === 401 ? ' — check the bot token (@BotFather → /mybots → API token)'
+            : code === 409 ? ' — another chatpanel-channels (or another poller) is already reading this bot'
+              : '';
+          logger.error?.(`[telegram] getUpdates refused: ${res.description || `error_code ${code}`}${hint}`);
+          await nap(5000);
+          continue;
+        }
+        updates = res?.result || [];
+      } catch (e) {
+        if (signal?.aborted) break;
+        logger.warn?.(`[telegram] getUpdates failed: ${e?.message || e}; retrying in 2s`);
+        await nap(2000);
+        continue;
+      }
+      for (const u of updates) {
+        offset = u.update_id + 1;
+        const norm = normalizeTelegram(u);
+        if (!norm) continue;
+        // Fire-and-forget per message so one slow turn doesn't stall the poll; errors are
+        // caught so a single bad message never kills the loop.
+        const run = norm.command ? handleCommand(norm) : handleMessage(norm);
+        Promise.resolve(run).catch((e) => logger.error?.(`[telegram] handler error: ${e?.message || e}`));
+      }
+    }
+    logger.log?.('[telegram] stopped.');
+  }
+
+  return loop();
+}

package/src/channels/bridge.js

@@ -0,0 +1,59 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-channels/src/bridge.js (npm @chatpanel/channels).
+// Edit there, then run: npm run sync:channels
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve. Package imports are rewritten to the
+// vendored engines (src/pii, src/events) by the sync script.
+
+// The transport to the local agent: POST /chat (SSE) and POST /cancel on the bridge. The
+// bridge binds 127.0.0.1:4319 and runs Claude Code / Codex / etc. as CLIs — so this is the ONE
+// hop where the (already-redacted) conversation reaches the agent, and it never leaves the
+// machine. A channel adapter is a non-browser local client, so it presents the per-install
+// bridge token, exactly like any privileged caller.
+
+import { parseSse, foldEvent, initialState } from './stream.js';
+
+/**
+ * Drive one turn. Streams bridge events to onEvent(ev, state) as they arrive AND folds them
+ * into a final reply state it returns. `agent` is a bridge engine id ('claude','codex',…).
+ */
+export async function chat({ agent = 'claude', system = '', messages, images = [], options = {} }, {
+  baseUrl, token, signal, onEvent = () => {},
+} = {}) {
+  const res = await fetch(`${baseUrl}/chat`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+    body: JSON.stringify({ agent, system, messages, images, options }),
+    signal,
+  });
+  if (!res.ok || !res.body) {
+    const detail = await res.text().catch(() => '');
+    throw new Error(`bridge /chat ${res.status}${detail ? `: ${detail.slice(0, 300)}` : ''}`);
+  }
+  let state = initialState();
+  let buffer = '';
+  const decoder = new TextDecoder();
+  for await (const chunk of res.body) {
+    buffer += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });
+    const { events, rest } = parseSse(buffer);
+    buffer = rest;
+    for (const ev of events) { state = foldEvent(state, ev); onEvent(ev, state); }
+  }
+  return state;
+}
+
+/** Stop a run by the id the bridge emitted as its first {type:'run'} event. Best-effort. */
+export async function cancel(runId, { baseUrl, token } = {}) {
+  if (!runId) return false;
+  try {
+    const res = await fetch(`${baseUrl}/cancel`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+      body: JSON.stringify({ id: runId }),
+    });
+    const out = await res.json().catch(() => ({}));
+    return !!out.cancelled;
+  } catch { return false; }
+}

package/src/channels/eventlog.js

@@ -0,0 +1,57 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-channels/src/eventlog.js (npm @chatpanel/channels).
+// Edit there, then run: npm run sync:channels
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve. Package imports are rewritten to the
+// vendored engines (src/pii, src/events) by the sync script.
+
+// A file-backed sink for the capability/privacy events a channel run produces — the audit
+// trail neither Claude Code Remote nor Hermes has. Events are metadata only (counts, ids;
+// never message content — see chatpanel-events/event.js), so this JSONL is safe to keep and
+// replicate. One line per event, append-only. seq is owned by the appender and recovered from
+// the file on restart so ordering survives a bounce.
+
+import { appendFile, readFile, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { createAppender } from '../events/event.js';
+
+async function nextSeq(file) {
+  try {
+    const txt = await readFile(file, 'utf8');
+    let max = -1;
+    for (const l of txt.split('\n')) {
+      if (!l) continue;
+      try { const e = JSON.parse(l); if (Number.isInteger(e.seq)) max = Math.max(max, e.seq); } catch { /* skip */ }
+    }
+    return max + 1;
+  } catch { return 0; }
+}
+
+export async function createEventLog({ file, host = 'channel' }) {
+  await mkdir(path.dirname(file), { recursive: true });
+  const seq = await nextSeq(file);
+  const appender = createAppender({ host, seq, newId: () => globalThis.crypto.randomUUID() });
+  return {
+    host,
+    get seq() { return appender.seq; },
+    // Same signature as the raw appender, but persists. Returns the validated event.
+    async append(type, payload, causes = []) {
+      const e = appender.append(type, payload, causes);
+      await appendFile(file, JSON.stringify(e) + '\n');
+      return e;
+    },
+  };
+}
+
+// A no-op sink for the allow-list prototype or tests — same interface, writes nothing but
+// still builds + validates each event, so a bad payload fails loudly here too.
+export function nullEventLog({ host = 'channel' } = {}) {
+  const appender = createAppender({ host, seq: 0, newId: () => globalThis.crypto.randomUUID() });
+  return {
+    host,
+    get seq() { return appender.seq; },
+    async append(type, payload, causes = []) { return appender.append(type, payload, causes); },
+  };
+}