@chatpanel/bridge 0.10.41 → 0.11.0

package/src/sanitize.js

@@ -1,137 +1,7 @@
-// VENDORED COPY of chatpanel-pii/sanitize.js - keep in sync with the canonical
-// engine (the bridge stays dependency-free, so this is a copy, not an import).
-// Regenerate by copying ../chatpanel-pii/sanitize.js over this file.
-
-// Unicode de-steganography for text that flows through the privacy boundary.
+// The Unicode sanitizer, from the one engine that owns it.
 //
-// Invisible and format-control characters are a single vector with three abuses,
-// all relevant to a redaction product:
-//
-//   1. Redaction bypass - splitting a value with zero-width chars (j<ZWSP>o<ZWSP>hn@x.com)
-//      hides it from the regex/NER detector, then the model reassembles the real
-//      value. The deterministic engine works on text, so the smuggled PII leaks.
-//   2. Hidden prompt injection - Unicode Tag characters (U+E0000-E007F) render as
-//      nothing but encode a full ASCII instruction the model reads ("ASCII smuggling").
-//   3. Fingerprinting / watermarking - steganographic markers injected into a prompt
-//      (e.g. a client classifying a custom gateway and encoding a bit into invisible
-//      punctuation). A privacy proxy should scrub these - and never emit its own.
-//
-// We strip the channels that have no legitimate place in plain prompt text, while
-// PRESERVING the few legitimate uses (emoji ZWJ/variation sequences, normal accents).
-//
-// The patterns are BUILT FROM NUMERIC CODE POINTS below - there are deliberately no
-// literal invisible characters anywhere in this source (auditable, and fitting for a
-// de-steg module). Pure + dependency-free ESM. Call it BEFORE detection so obfuscated
-// PII becomes matchable, and on model output before restoration so a token can't be
-// split/spoofed with invisibles.
-
-// Code-point ranges (inclusive) per category, by their abuse.
-const RANGES = {
-  // Unicode Tag block - the ASCII-smuggling channel.
-  tags: [[0xE0000, 0xE007F]],
-  // Bidi controls - reorder/override visible text to hide reversed instructions.
-  bidi: [[0x061C, 0x061C], [0x200E, 0x200F], [0x202A, 0x202E], [0x2066, 0x2069]],
-  // Zero-width & assorted invisible format chars: soft hyphen, Hangul/Mongolian
-  // fillers, ZWSP, word/invisible joiners, deprecated format controls, BOM/ZWNBSP,
-  // interlinear annotation, object replacement.
-  zeroWidth: [
-    [0x00AD, 0x00AD], [0x115F, 0x1160], [0x180E, 0x180E], [0x200B, 0x200B],
-    [0x2060, 0x2064], [0x206A, 0x206F], [0x3164, 0x3164], [0xFEFF, 0xFEFF],
-    [0xFFA0, 0xFFA0], [0xFFF9, 0xFFFB], [0xFFFC, 0xFFFC],
-  ],
-  // Supplementary variation selectors - the byte-smuggling range. Never legit in text.
-  supVS: [[0xE0100, 0xE01EF]],
-  // Line/paragraph separators - converted to '\n' (kill parser tricks, keep the break).
-  lineSep: [[0x2028, 0x2029]],
-  // ZWJ/ZWNJ + BMP variation selectors - legit ONLY next to an emoji base, so these
-  // are stripped contextually (see ANOMALOUS_JOIN_VS), not unconditionally.
-  joinVS: [[0x200C, 0x200D], [0xFE00, 0xFE0F]],
-};
-
-const u = (cp) => `\\u{${cp.toString(16).toUpperCase()}}`;
-const cls = (ranges) => ranges.map(([a, b]) => (a === b ? u(a) : `${u(a)}-${u(b)}`)).join('');
-
-const TAGS = new RegExp(`[${cls(RANGES.tags)}]`, 'gu');
-const BIDI = new RegExp(`[${cls(RANGES.bidi)}]`, 'gu');
-const ZERO_WIDTH = new RegExp(`[${cls(RANGES.zeroWidth)}]`, 'gu');
-const SUP_VS = new RegExp(`[${cls(RANGES.supVS)}]`, 'gu');
-const LINE_SEP = new RegExp(`[${cls(RANGES.lineSep)}]`, 'gu');
-// Strip ZWJ/ZWNJ/VS only when NOT preceded by an emoji base (so emoji sequences and
-// regional-indicator flags survive); supplementary VS are always stripped.
-const ANOMALOUS_JOIN_VS = new RegExp(
-  `(?<![\\p{Extended_Pictographic}${u(0x1F1E6)}-${u(0x1F1FF)}])[${cls(RANGES.joinVS)}]|[${cls(RANGES.supVS)}]`,
-  'gu',
-);
-// Runs of combining marks (Zalgo / bit-stuffing). A real stacked diacritic is 1-3
-// marks; anything past the cap is signalling, not language.
-const COMBINING_RUN = /\p{M}+/gu;
-
-// Cheap boolean for hot paths / UI ("does this contain anything hidden?"). Excludes
-// the context-dependent joinVS so legitimate emoji aren't flagged - sanitizeUnicode()
-// stays the source of truth for those.
-const ANY_HIDDEN = new RegExp(
-  `[${cls(RANGES.bidi)}${cls(RANGES.zeroWidth)}]|[${cls(RANGES.tags)}]|[${cls(RANGES.supVS)}]`,
-  'u',
-);
-
-export function hasHiddenChars(text) {
-  return typeof text === 'string' && ANY_HIDDEN.test(text);
-}
-
-// sanitizeUnicode(text, opts) -> { clean, removed, findings }
-//   clean    - text with the smuggling channels stripped/normalized
-//   removed  - total count of stripped/collapsed characters (0 = nothing hidden)
-//   findings - per-category counts (only non-zero keys), for transparent reporting
-//
-// opts.normalize: 'NFC' (default, appearance-preserving) | 'NFKC' (also folds
-//   fullwidth/homoglyph compatibility forms - stronger for detection, but rewrites
-//   some visible glyphs) | 'none'.
-// opts.collapseCombiningOver: max combining marks kept per run (default 4).
-export function sanitizeUnicode(text, { normalize = 'NFC', collapseCombiningOver = 4 } = {}) {
-  if (typeof text !== 'string' || text === '') return { clean: text ?? '', removed: 0, findings: {} };
-  let s = text;
-  const findings = {};
-
-  // Strip one category, counting by code point (spread iterates code points, so a
-  // supplementary char like a Tag counts as 1, not 2 UTF-16 units).
-  const strip = (re, key) => {
-    let n = 0;
-    s = s.replace(re, (m) => { n += [...m].length; return ''; });
-    if (n) findings[key] = n;
-  };
-
-  let lineSep = 0;
-  s = s.replace(LINE_SEP, () => { lineSep++; return '\n'; });
-  if (lineSep) findings.lineSep = lineSep;
-
-  strip(TAGS, 'tags');
-  strip(BIDI, 'bidi');
-  strip(ZERO_WIDTH, 'zeroWidth');
-  strip(ANOMALOUS_JOIN_VS, 'joinersVS');
-
-  // Compose canonically so split/decomposed forms can't dodge the detector.
-  if (normalize && normalize !== 'none') {
-    try { s = s.normalize(normalize); } catch { /* invalid form name -> skip */ }
-  }
-
-  let combining = 0;
-  s = s.replace(COMBINING_RUN, (run) => {
-    const marks = [...run];
-    if (marks.length <= collapseCombiningOver) return run;
-    combining += marks.length - collapseCombiningOver;
-    return marks.slice(0, collapseCombiningOver).join('');
-  });
-  if (combining) findings.combining = combining;
-
-  const removed = (findings.tags || 0) + (findings.bidi || 0) + (findings.zeroWidth || 0)
-    + (findings.joinersVS || 0) + (findings.combining || 0);
-  return { clean: s, removed, findings };
-}
-
-// Convenience for the common "just give me clean text" caller.
-export function stripHidden(text, opts) {
-  return sanitizeUnicode(text, opts).clean;
-}
-
-// Exposed for tests / external auditing.
-export const SANITIZE_RANGES = RANGES;
+// This file used to be a HAND copy of chatpanel-pii/sanitize.js, kept in step by memory — the
+// exact drift the vendoring scripts exist to prevent. The engine is now vendored properly under
+// src/pii/ (npm run sync:pii, with a --check drift guard), so this is a re-export and there is
+// only one copy in the repo to diverge from. Existing importers are unchanged.
+export { hasHiddenChars, sanitizeUnicode, stripHidden, SANITIZE_RANGES } from './pii/sanitize.js';

package/src/server.js

@@ -67,7 +67,7 @@ import {
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.41';
+const VERSION = '0.11.0';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -244,6 +244,57 @@ function ensureToken() {
     log('error', `could not initialise bridge token: ${e?.message || e}`);
   }
 }
+// ---------------------------------------------------------------------------
+// CHANNELS — a messaging surface (Telegram today) driving a local agent.
+//
+// Hosted HERE because a channel has to be running when nobody is looking: the point is to
+// reach your machine from a phone with the browser closed, and the bridge is the only
+// always-on local process a ChatPanel user already has. The alternative — a second daemon, or
+// an npm install, or a service worker Chrome suspends — is another thing a non-technical
+// person has to install and keep alive, which is the same as not shipping it.
+//
+// The bridge owns transport and auth; @chatpanel/channels (vendored to src/channels) owns the
+// contract: verify a bot, hold its token 0600, enroll a phone by one-time code, cap it with
+// `reach`, redact both ways. Loaded lazily so the redaction engine never touches a boot where
+// no channel is configured.
+let channelsSvc = null;
+async function channelService() {
+  if (channelsSvc) return channelsSvc;
+  const { createChannelService } = await import('./channels/service.js');
+  channelsSvc = createChannelService({
+    home: join(os.homedir(), '.chatpanel'),
+    dataDir: join(os.homedir(), '.chatpanel', 'channels'),
+    // It talks to THIS bridge as a privileged local client — same port, same token it just
+    // read. No second address to configure and get wrong.
+    bridge: { baseUrl: `http://127.0.0.1:${PORT}`, token: AUTH_TOKEN },
+    logger: { log: (m) => log('info', m), warn: (m) => log('info', m), error: (m) => log('error', m) },
+  });
+  return channelsSvc;
+}
+
+async function handleChannels(req, res, action) {
+  try {
+    const svc = await channelService();
+    const body = req.method === 'POST' ? await readBody(req) : {};
+    if (action === 'status') return json(res, 200, await svc.status());
+    if (action === 'connect') {
+      // The token is verified with Telegram before it is written, so a typo fails HERE, in the
+      // settings screen, with a reason — not later as a silent poll loop nobody reads the logs of.
+      const r = await svc.connect(body);
+      return json(res, 200, { ok: true, ...r });
+    }
+    if (action === 'pair') return json(res, 200, await svc.pair());
+    if (action === 'unpair') return json(res, 200, await svc.unpair(String(body.actorId || '')));
+    if (action === 'settings') return json(res, 200, await svc.update(body));
+    if (action === 'disconnect') return json(res, 200, await svc.stop({ forget: !!body.forget }));
+    return json(res, 404, { error: 'unknown channel action' });
+  } catch (e) {
+    // A readable reason, because every one of these is something a person can fix: a bad token,
+    // a bot not created yet, no network.
+    return json(res, 400, { error: e?.message || String(e) });
+  }
+}
+
 function tokenOk(req) {
   if (!AUTH_TOKEN) return false;
   const h = String(req.headers['authorization'] || '');
@@ -278,8 +329,16 @@ const PRIVILEGED_POST = new Set([
   // endpoint that touches a run is already guarded. An unauthenticated hole next to nine
   // guarded neighbours is a hole regardless of how little it grants.
   '/cancel',
+  // A channel is a way into this machine from the internet. Everything that configures one —
+  // and the code that enrolls a phone — is as privileged as /chat itself.
+  '/channels/connect',
+  '/channels/pair',
+  '/channels/unpair',
+  '/channels/settings',
+  '/channels/disconnect',
 ]);
-const PRIVILEGED_GET = new Set(['/debug']);
+// /channels lists which phones may drive this machine. That is not a public reading.
+const PRIVILEGED_GET = new Set(['/debug', '/channels']);
 
 // /skills* is NOT privileged, and that is a considered position rather than a
 // convenience. `privileged` adds exactly one thing over the origin allowlist: it requires
@@ -1123,6 +1182,10 @@ const server = createServer(async (req, res) => {
       if (req.method === 'GET') { res.writeHead(405); return res.end(); } // no server-initiated stream
       if (req.method === 'DELETE') { deleteSession(sid); res.writeHead(204); return res.end(); }
     }
+    if (req.method === 'GET' && url.pathname === '/channels') return handleChannels(req, res, 'status');
+    if (req.method === 'POST' && url.pathname.startsWith('/channels/')) {
+      return handleChannels(req, res, url.pathname.slice('/channels/'.length));
+    }
     if (req.method === 'POST' && url.pathname === '/cancel') return handleCancel(req, res);
     if (req.method === 'POST' && url.pathname === '/tool-result') return handleToolResult(req, res);
     if (req.method === 'POST' && url.pathname === '/mcp-local') return handleMcpLocal(req, res);
@@ -1237,6 +1300,17 @@ function startServer() {
       log('info', `  ${a.ok ? '✓' : '✕'} ${label}${a.ok ? '' : ' — ' + (a.reason || 'unavailable')}`);
     }
     log('info', 'Open the ChatPanel side panel; installed agents (Claude Code, Codex, Antigravity) appear automatically.');
+    // A channel someone connected last week must come back by itself after a reboot — nobody
+    // is at the keyboard to press start, which is the entire premise of driving this from a
+    // phone. Nothing loads and nothing runs until a bot has actually been connected.
+    channelService()
+      .then((svc) => svc.startIfConfigured())
+      .then((r) => {
+        if (r?.skipped) return;
+        if (r?.ok) log('info', 'channels: telegram connected — polling for messages');
+        else log('error', `channels: telegram not started — ${r?.error || 'unknown error'}`);
+      })
+      .catch((e) => log('error', `channels: ${e?.message || e}`));
   });
 }