@chatpanel/bridge 0.10.42 → 0.11.0

package/src/pii/net.js

@@ -0,0 +1,111 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-pii/net.js (npm @chatpanel/pii).
+// Edit there, then run: npm run sync:pii
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve.
+
+// Shared host classifier + outbound-URL guard — the SSRF primitive.
+//
+// One implementation of "what is a loopback / cloud-metadata / private host",
+// delivered the way the rest of @chatpanel/pii is: npm dependency for the
+// gateway/bridge, vendorable into the browser extension (pure — only URL + string
+// ops, no node APIs, so it runs in a Worker/service-worker too). Replaces the
+// hand-maintained copies in the bridge (src/ssrf.js) and the extension
+// (js/context.js isBlockedHost) so a security guard can't silently drift between
+// the direct client path and the proxied path. See docs/secure-data-plane.md.
+//
+// The policy knobs cover the two legitimate trust contexts:
+//   • A MODEL / API / MCP endpoint (gateway upstream, bridge MCP proxy) may live on
+//     loopback (Ollama, LM Studio) or the LAN (a homelab GPU box) — so those are
+//     allowed by default — but must NEVER reach cloud instance metadata.
+//   • A WEB PAGE fetch (link title, page context) has no business touching loopback
+//     or any private host at all — call with { allowLoopback:false, allowPrivate:false }.
+// Cloud metadata (169.254.169.254 & friends) and non-http(s) schemes are blocked in
+// BOTH contexts, unconditionally. Re-run the assert on every redirect hop.
+
+function ipv4(h) {
+  const m = String(h).match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+const norm = (hostname) => String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+
+// Loopback = this host's own services (127.0.0.0/8, ::1, localhost, *.localhost).
+export function isLoopbackHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — the sharpest SSRF target (credential theft). Covers the
+// link-local IMDS address used by AWS/GCP/Azure/DO (169.254.169.254), Alibaba's
+// 100.100.100.200, and the GCP/name-based metadata hosts. ALWAYS blocked.
+export function isMetadataHost(hostname) {
+  const h = norm(hostname);
+  if (h === 'metadata.google.internal' || h === 'metadata') return true;
+  const o = ipv4(h);
+  if (!o) return false;
+  if (o[0] === 169 && o[1] === 254) return true;                 // 169.254.169.254 (+ link-local)
+  if (o[0] === 100 && o[1] === 100 && o[2] === 100 && o[3] === 200) return true; // Alibaba IMDS
+  return false;
+}
+
+// Private / internal address space, EXCLUDING loopback + metadata (checked
+// separately): RFC1918, CGNAT, IPv6 ULA/link-local, mDNS .local, this-host 0.x/::.
+export function isPrivateHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (h.endsWith('.local')) return true;
+  if (
+    h === '::' || h.startsWith('fc') || h.startsWith('fd')       // IPv6 ULA
+    || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb') // link-local
+  ) return true;
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true;                        // this-host / RFC1918
+    if (a === 169 && b === 254) return true;                     // link-local
+    if (a === 172 && b >= 16 && b <= 31) return true;            // RFC1918
+    if (a === 192 && b === 168) return true;                     // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;           // CGNAT
+  }
+  return false;
+}
+
+// Policy-driven classifier. Returns true if `hostname` must be blocked under `policy`.
+// Defaults model the ENDPOINT context (loopback + LAN allowed, metadata never).
+export function isBlockedHost(hostname, { allowLoopback = true, allowPrivate = true } = {}) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (isMetadataHost(h)) return true;                            // never, in any context
+  if (isLoopbackHost(h)) return !allowLoopback;
+  if (isPrivateHost(h)) return !allowPrivate;
+  return false;                                                  // public host
+}
+
+// Assert a URL is fetchable under `policy`; returns the parsed URL or throws.
+// Call on the initial URL AND after every redirect hop.
+export function assertFetchableUrl(u, policy = {}) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHost(parsed.hostname, policy)) {
+    throw new Error(`refusing to reach a blocked address (${parsed.hostname})`);
+  }
+  return parsed;
+}
+
+// Endpoint context: model/API/MCP upstream — loopback + LAN OK, metadata never.
+export const assertEndpointUrl = (u, opts = {}) => assertFetchableUrl(u, { allowLoopback: true, allowPrivate: true, ...opts });
+// Web-page context: no loopback, no private, no metadata — genuinely public only.
+export const assertPublicWebUrl = (u) => assertFetchableUrl(u, { allowLoopback: false, allowPrivate: false });

package/src/pii/pii-detect.js

@@ -0,0 +1,177 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-pii/pii-detect.js (npm @chatpanel/pii).
+// Edit there, then run: npm run sync:pii
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve.
+
+// Phase 2: configurable, LOCAL entity detection.
+//
+// Produces [{value, type}] spans that feed the redaction engine, so names / orgs /
+// IDs get redacted WITHOUT a hand-maintained dictionary. Detection runs on-device
+// only — the detector is a local NER service (spaCy / Presidio / any HTTP service)
+// or a local LLM (OpenAI-compatible, e.g. a gemma served by llama.cpp). Raw text
+// reaches the detector but never the final agent; only the redacted text does.
+//
+// Performance / flexibility (the whole point):
+//   - backends are pluggable and user-configured (URL + model + timeout).
+//   - a content-hash cache avoids re-detecting unchanged text.
+//   - a per-call timeout + fail-open means a slow/broken detector NEVER blocks the
+//     chat — redaction silently falls back to the deterministic layer.
+//   - input is length-capped so a huge transcript can't stall detection.
+
+import { assertEndpointUrl } from './net.js';
+
+const cache = new Map(); // key -> [{value,type}]
+const CACHE_MAX = 300;
+
+export function clearDetectCache() { cache.clear(); }
+
+function cacheKey(text, det) {
+  let h = 5381;
+  const s = `${det?.backend}|${det?.url}|${det?.model}|${text}`;
+  for (let i = 0; i < s.length; i++) h = ((h << 5) + h + s.charCodeAt(i)) | 0;
+  return `${s.length}:${h}`;
+}
+
+export function withTimeout(promise, ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('detect timeout')), Math.max(200, ms || 1500));
+    const onAbort = () => { clearTimeout(timer); reject(new Error('aborted')); };
+    if (signal) signal.addEventListener?.('abort', onAbort, { once: true });
+    promise.then(
+      (v) => { clearTimeout(timer); resolve(v); },
+      (e) => { clearTimeout(timer); reject(e); },
+    );
+  });
+}
+
+// Map common NER labels (spaCy, HF, Presidio) onto our placeholder types.
+function normType(t) {
+  const s = String(t || 'ENTITY').toUpperCase().replace(/[^A-Z0-9]/g, '') || 'ENTITY';
+  const map = {
+    PER: 'PERSON', PERSON: 'PERSON', PERSONNAME: 'PERSON',
+    ORG: 'ORG', ORGANIZATION: 'ORG',
+    GPE: 'LOCATION', LOC: 'LOCATION', LOCATION: 'LOCATION',
+    NORP: 'GROUP', EMAIL: 'EMAIL', EMAILADDRESS: 'EMAIL',
+    PHONE: 'PHONE', PHONENUMBER: 'PHONE',
+  };
+  return map[s] || s;
+}
+
+// Identifiers we ALWAYS redact (also caught deterministically). The user-facing
+// category toggles (person/org/location/number) control the rest, so geography
+// questions still work if "location" is turned off, etc. Numeric/temporal labels
+// (DATE, CARDINAL, ORDINAL…) are noisy — small NER models tag "today" / "4" — so
+// they only count when the value is a long digit run (phone/account/ID).
+const ALWAYS_KEEP = new Set(['EMAIL', 'PHONE', 'SSN', 'CREDITCARD', 'IBAN', 'ID']);
+const LOCATION_TYPES = new Set(['LOCATION', 'FAC', 'ADDRESS', 'GROUP', 'NRP']);
+
+function keepEntity(value, type, types) {
+  const on = (k) => !types || types[k] !== false; // default on
+  if (ALWAYS_KEEP.has(type)) return true;
+  if (type === 'PERSON') return on('person');
+  if (type === 'ORG') return on('org');
+  if (LOCATION_TYPES.has(type)) return on('location');
+  const digits = (String(value).match(/\d/g) || []).length;
+  return digits >= 7 ? on('number') : false;
+}
+
+// Normalize the many detector response shapes to [{value, type}], de-duplicated.
+// `types` (optional) is the user's category toggles {person,org,location,number}.
+export function normalizeEntities(data, types) {
+  let list = [];
+  if (Array.isArray(data)) list = data;
+  else if (data && Array.isArray(data.entities)) list = data.entities;
+  else if (data && Array.isArray(data.ents)) list = data.ents; // spaCy displacy
+  else if (data && Array.isArray(data.results)) list = data.results; // Presidio
+  const out = [];
+  const seen = new Set();
+  for (const e of list) {
+    if (!e) continue;
+    const value = String(e.value ?? e.text ?? e.entity ?? e.word ?? '').trim();
+    const type = normType(e.type ?? e.label ?? e.entity_group ?? e.entity_type ?? e.tag);
+    if (!value || value.length > 200 || !keepEntity(value, type, types)) continue;
+    const k = `${type}:${value.toLowerCase()}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push({ value, type });
+  }
+  return out;
+}
+
+export function parseJsonLoose(s) {
+  if (!s) return null;
+  const a = String(s).indexOf('{');
+  const b = String(s).lastIndexOf('}');
+  if (a < 0 || b <= a) return null;
+  try { return JSON.parse(String(s).slice(a, b + 1)); } catch { return null; }
+}
+
+export const EXTRACT_SYS = 'You extract sensitive entities from text for redaction. '
+  + 'Return ONLY JSON: {"entities":[{"value":"<verbatim text>","type":"PERSON|ORG|LOCATION|ID|EMAIL|PHONE|OTHER"}]}. '
+  + 'Copy each value exactly as it appears. Include people, organizations, locations, and account/ID numbers. No commentary, no code fences.';
+
+async function detectViaEndpoint(text, det, signal, fetchImpl) {
+  const res = await fetchImpl(det.url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...(det.apiKey ? { Authorization: `Bearer ${det.apiKey}` } : {}) },
+    body: JSON.stringify({ text }),
+    signal,
+  });
+  if (!res.ok) throw new Error(`detect HTTP ${res.status}`);
+  return normalizeEntities(await res.json(), det.types);
+}
+
+async function detectViaOpenAI(text, det, signal, fetchImpl) {
+  const base = String(det.url || '').replace(/\/$/, '');
+  // Build the chat URL the SAME way the chat path does. An OpenAI-compatible baseUrl
+  // already ends in /v1 (Ollama, OpenRouter, NVIDIA, OpenAI…) → only add
+  // /chat/completions (appending /v1/chat/completions would 404 on /v1/v1/…). A bare
+  // host gets /v1/chat/completions; a full chat URL is used as-is.
+  const url = /\/chat\/completions$/.test(base) ? base
+    : /\/v\d+$/.test(base) ? `${base}/chat/completions`
+      : `${base}/v1/chat/completions`;
+  const res = await fetchImpl(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...(det.apiKey ? { Authorization: `Bearer ${det.apiKey}` } : {}) },
+    body: JSON.stringify({
+      model: det.model || 'local',
+      temperature: 0,
+      max_tokens: det.maxTokens || 256,
+      messages: [{ role: 'system', content: EXTRACT_SYS }, { role: 'user', content: text }],
+    }),
+    signal,
+  });
+  if (!res.ok) throw new Error(`detect HTTP ${res.status}`);
+  const json = await res.json();
+  const content = json?.choices?.[0]?.message?.content ?? json?.content ?? '';
+  return normalizeEntities(parseJsonLoose(content), det.types);
+}
+
+// Returns [{value, type}] spans for `text`, or [] (fail-open) on any error/timeout.
+export async function detectEntities(text, cfg, { signal, fetchImpl = globalThis.fetch, strict = false } = {}) {
+  const det = cfg?.detection;
+  if (!det || !det.backend || det.backend === 'off' || !det.url || typeof fetchImpl !== 'function') return [];
+  const capped = String(text || '').slice(0, det.maxChars || 8000);
+  if (capped.trim().length < 8) return [];
+  const key = cacheKey(capped, det);
+  if (!strict && cache.has(key)) return cache.get(key);
+  const run = det.backend === 'endpoint' ? detectViaEndpoint : detectViaOpenAI;
+  let ents = [];
+  try {
+    // SSRF guard before RAW (pre-redaction) text leaves for the detector: http(s)
+    // only, never cloud metadata. Loopback/LAN allowed — a local NER server / Ollama
+    // is the normal case. A blocked URL fails open (deterministic-only), or surfaces
+    // to the Test button in strict mode.
+    assertEndpointUrl(det.url);
+    ents = await withTimeout(run(capped, det, signal, fetchImpl), det.timeoutMs || 1500, signal);
+  } catch (e) {
+    if (strict) throw e; // surface errors to the Test button
+    ents = []; // otherwise fail open — deterministic redaction still applies
+  }
+  if (cache.size >= CACHE_MAX) cache.clear();
+  if (!strict) cache.set(key, ents);
+  return ents;
+}