@chatpanel/bridge 0.10.9 → 0.10.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.9",
+  "version": "0.10.11",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine — Claude Code (CLI), Codex (CLI), and Gemini CLI — to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/engines/claude.js

@@ -244,7 +244,18 @@ export async function chat({ messages, system, options, images }, emit) {
     }: ${imageFiles.join(', ')}`;
   }
 
-  if (options.extraArgs) args.push(...String(options.extraArgs).split(/\s+/).filter(Boolean));
+  if (options.extraArgs) {
+    const extra = String(options.extraArgs).split(/\s+/).filter(Boolean);
+    // Never let caller-supplied extras re-open the read-only boundary the mode
+    // flags above establish. If ANY security-sensitive flag is present, drop the
+    // whole extraArgs (these tokens take values, so partial filtering is unsafe).
+    const FORBIDDEN = /^--?(permission-mode|allowed-?tools|disallowed-?tools|dangerously|add-dir|mcp-config|setting-sources|permission-prompt-tool)/i;
+    if (extra.some((t) => FORBIDDEN.test(t))) {
+      emit({ type: 'status', text: '(ignored unsafe extraArgs)' });
+    } else {
+      args.push(...extra);
+    }
+  }
   const run = runClaude({ prompt, args, cwd, emit });
   if (run === null) {
     cleanup(); // SDK fallback doesn't take images yet

package/src/env.js

@@ -14,11 +14,11 @@ let enriched = false;
 
 // The agent CLIs the bridge shells out to. Claude has its own richer resolution
 // (resolveClaude: native / cli.js / WSL / SDK) below.
-const AGENT_CLIS = ['codex', 'claude', 'agy', 'pi', 'opencode', 'kiro-cli'];
+export const AGENT_CLIS = ['codex', 'claude', 'agy', 'pi', 'opencode', 'kiro-cli'];
 
 // Is `name` executable somewhere on the current PATH?
 function onPath(name) {
-  const dirs = (process.env.PATH || '').split(path.delimiter);
+  const dirs = splitPathList(process.env.PATH || '', process.platform);
   return dirs.some((d) => d && (existsSync(path.join(d, name)) || existsSync(path.join(d, name + '.exe'))));
 }
 
@@ -27,14 +27,9 @@ function onPath(name) {
 // "is it installed/findable", NOT "does `--version` exit 0" (which can fail for
 // reasons unrelated to installation, e.g. the CLI needs login).
 export function findAgentBin(name) {
-  // On Windows, CLIs are usually <name>.cmd / .exe / .bat (npm shims).
-  const exts = process.platform === 'win32' ? ['', '.cmd', '.exe', '.bat', '.ps1'] : [''];
-  const dirs = (process.env.PATH || '').split(path.delimiter);
-  for (const d of dirs) {
-    if (!d) continue;
-    for (const ext of exts) {
-      const p = path.join(d, name + ext);
-      if (existsSync(p)) return p;
+  for (const p of commandCandidateFiles(name)) {
+    if (existsSync(p)) {
+      return p;
     }
   }
   return shellWhich(name) || null;
@@ -152,20 +147,20 @@ export function resolveCommand(command) {
 // own Node/Bun — clean arg passing, no cmd.exe quoting), then a real .exe, then a
 // .cmd/.bat shim launched safely via cmd.exe.
 function findCommandWindows(name) {
-  const dirs = (process.env.PATH || '').split(path.delimiter);
-  for (const d of dirs) {
-    if (!d) continue;
-    const exts = ['', '.cmd', '.exe', '.ps1', '.bat'];
-    if (!exts.some((e) => existsSync(path.join(d, name + e)))) continue;
+  const p = pathFor('win32');
+  for (const candidate of commandCandidateFiles(name, os.homedir(), 'win32', process.env)) {
+    if (!existsSync(candidate)) continue;
+    const d = p.dirname(candidate);
+    const ext = p.extname(candidate).toLowerCase();
     // Running cli.js with our own interpreter only works under a real Node/Bun,
     // not inside a compiled single-file binary (which is not a JS interpreter).
     if (!isCompiledBinary()) {
       const js = (name === 'claude' && claudeCliJs(d)) || shimTarget(d, name);
       if (js) return { kind: 'script', script: js };
+      if (/^\.(c?js|mjs)$/.test(ext)) return { kind: 'script', script: candidate };
     }
-    if (existsSync(path.join(d, name + '.exe'))) return { kind: 'native', bin: path.join(d, name + '.exe') };
-    if (existsSync(path.join(d, name + '.cmd'))) return { kind: 'cmd', bin: path.join(d, name + '.cmd') };
-    if (existsSync(path.join(d, name + '.bat'))) return { kind: 'cmd', bin: path.join(d, name + '.bat') };
+    if (ext === '.exe' || ext === '') return { kind: 'native', bin: candidate };
+    if (ext === '.cmd' || ext === '.bat') return { kind: 'cmd', bin: candidate };
   }
   return null;
 }
@@ -290,14 +285,156 @@ function versionManagerBins(home) {
   return bins;
 }
 
-export function enrichPath() {
-  if (enriched || process.platform === 'win32') {
-    enriched = true;
-    return; // Windows scheduled tasks run as the user and inherit a fuller PATH.
+function pathFor(platform) {
+  return platform === 'win32' ? path.win32 : path;
+}
+
+function pathDelimiterFor(platform) {
+  return platform === 'win32' ? ';' : path.delimiter;
+}
+
+function splitPathList(value, platform) {
+  return (value || '').split(pathDelimiterFor(platform)).filter(Boolean);
+}
+
+function unique(items) {
+  return [...new Set(items.filter(Boolean))];
+}
+
+export function agentInstallDirs(home, platform = process.platform, env = process.env) {
+  const p = pathFor(platform);
+  if (platform === 'win32') {
+    const appData = env.APPDATA || p.join(home, 'AppData', 'Roaming');
+    const localAppData = env.LOCALAPPDATA || p.join(home, 'AppData', 'Local');
+    const programFiles = env.ProgramFiles || 'C:\\Program Files';
+    const programFilesX86 = env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)';
+    const programData = env.ProgramData || 'C:\\ProgramData';
+    return [
+      p.join(home, '.local', 'bin'),
+      p.join(home, '.codex', 'bin'),
+      p.join(home, '.claude', 'bin'),
+      p.join(home, '.claude', 'local'),
+      p.join(home, '.claude', 'local', 'bin'),
+      p.join(appData, 'npm'),
+      p.join(localAppData, 'pnpm'),
+      p.join(localAppData, 'Yarn', 'bin'),
+      p.join(localAppData, 'Volta', 'bin'),
+      p.join(home, '.yarn', 'bin'),
+      p.join(home, '.bun', 'bin'),
+      p.join(home, '.deno', 'bin'),
+      p.join(home, 'scoop', 'shims'),
+      p.join(programData, 'chocolatey', 'bin'),
+      p.join(localAppData, 'Microsoft', 'WindowsApps'),
+      p.join(localAppData, 'Programs', 'Claude Code'),
+      p.join(localAppData, 'Anthropic', 'Claude Code'),
+      p.join(programFiles, 'Claude Code'),
+      p.join(programFiles, 'Anthropic', 'Claude Code'),
+      p.join(programFilesX86, 'Claude Code'),
+      p.join(programFilesX86, 'Anthropic', 'Claude Code'),
+    ];
   }
+  return [
+    path.join(home, '.local', 'bin'),
+    path.join(home, '.opencode', 'bin'),
+    path.join(home, '.codex', 'bin'),
+    path.join(home, '.claude', 'bin'),
+    path.join(home, '.claude', 'local'),
+    path.join(home, '.claude', 'local', 'bin'),
+  ];
+}
+
+function claudeNativeBins(home, platform = process.platform) {
+  const p = pathFor(platform);
+  const versionsDir = p.join(home, '.local', 'share', 'claude', 'versions');
+  let versions = [];
+  try {
+    versions = readdirSync(versionsDir)
+      .filter((v) => /^\d+\.\d+\.\d+/.test(v))
+      .sort((a, b) => b.localeCompare(a, undefined, { numeric: true }));
+  } catch {
+    /* native installer may not be present */
+  }
+  return versions.map((v) => p.join(versionsDir, v));
+}
+
+function withWindowsExts(file, platform) {
+  if (platform !== 'win32') return [file];
+  if (/\.(cmd|exe|bat|ps1)$/i.test(file)) return [file];
+  return [file, `${file}.cmd`, `${file}.exe`, `${file}.bat`, `${file}.ps1`];
+}
+
+export function agentCandidateBins(name, home = os.homedir(), platform = process.platform, env = process.env) {
+  const p = pathFor(platform);
+  const local = p.join(home, '.local', 'bin', name);
+  const localAppData = platform === 'win32' ? env.LOCALAPPDATA || p.join(home, 'AppData', 'Local') : null;
+  const programFiles = platform === 'win32' ? env.ProgramFiles || 'C:\\Program Files' : null;
+  const programFilesX86 = platform === 'win32' ? env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)' : null;
+  const map = {
+    claude: [
+      local,
+      p.join(home, '.claude', 'bin', 'claude'),
+      p.join(home, '.claude', 'local', 'claude'),
+      p.join(home, '.claude', 'local', 'bin', 'claude'),
+      ...(platform === 'win32'
+        ? [
+            p.join(localAppData, 'Microsoft', 'WindowsApps', 'claude.exe'),
+            p.join(localAppData, 'Programs', 'Claude Code', 'claude.exe'),
+            p.join(localAppData, 'Anthropic', 'Claude Code', 'claude.exe'),
+            p.join(programFiles, 'Claude Code', 'claude.exe'),
+            p.join(programFiles, 'Anthropic', 'Claude Code', 'claude.exe'),
+            p.join(programFilesX86, 'Claude Code', 'claude.exe'),
+            p.join(programFilesX86, 'Anthropic', 'Claude Code', 'claude.exe'),
+            ...claudeNativeBins(home, platform),
+          ]
+        : claudeNativeBins(home, platform)),
+    ],
+    codex: [
+      local,
+      p.join(home, '.codex', 'bin', 'codex'),
+    ],
+    agy: [
+      local,
+      '/Applications/Antigravity.app/Contents/MacOS/agy',
+      '/Applications/Antigravity IDE.app/Contents/MacOS/agy',
+    ],
+    pi: [
+      local,
+    ],
+    opencode: [
+      p.join(home, '.opencode', 'bin', 'opencode'),
+      local,
+    ],
+    'kiro-cli': [
+      local,
+      '/Applications/Kiro CLI.app/Contents/MacOS/kiro-cli',
+    ],
+  };
+  return unique((map[name] || [local]).flatMap((file) => withWindowsExts(file, platform)));
+}
+
+export function commandCandidateFiles(name, home = os.homedir(), platform = process.platform, env = process.env) {
+  const p = pathFor(platform);
+  const fromDirs = unique([
+    ...splitPathList(env.PATH || '', platform),
+    ...agentInstallDirs(home, platform, env),
+  ]).flatMap((dir) => withWindowsExts(p.join(dir, name), platform));
+  return unique([...fromDirs, ...agentCandidateBins(name, home, platform, env)]);
+}
+
+export function enrichPath() {
+  if (enriched) return;
   enriched = true;
 
   const home = os.homedir();
+  if (process.platform === 'win32') {
+    const merged = unique([
+      ...splitPathList(process.env.PATH || '', 'win32'),
+      ...agentInstallDirs(home, 'win32', process.env),
+    ]);
+    process.env.PATH = merged.join(pathDelimiterFor('win32'));
+    return;
+  }
+
   const common = [
     '/opt/homebrew/bin',
     '/opt/homebrew/sbin',
@@ -312,7 +449,7 @@ export function enrichPath() {
     path.join(home, '.cargo', 'bin'),
     path.join(home, '.deno', 'bin'),
     path.join(home, '.bun', 'bin'),
-    path.join(home, '.opencode', 'bin'),
+    ...agentInstallDirs(home),
     ...versionManagerBins(home),
   ];
 

package/src/server.js

@@ -12,25 +12,31 @@
 //                     {type:'done',  text?}    (text only if not streamed)
 //                     {type:'error', error}
 //
-// Binds to 127.0.0.1 only and accepts requests from the extension origin.
+// Binds to 127.0.0.1 only. A request guard (see `guard()`) enforces a loopback
+// Host (anti DNS-rebinding) and an allowlisted Origin; the command-spawning
+// endpoints (/chat, /mcp-local, /update, …) additionally require the extension
+// origin or the per-install bridge token, so a malicious web page can't drive
+// local execution. The CLI-facing /mcp endpoints stay open to no-Origin clients.
 
 import { createServer } from 'node:http';
 import os from 'node:os';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
 import * as claude from './engines/claude.js';
 import * as codex from './engines/codex.js';
 import * as antigravity from './engines/antigravity.js';
 import { pi, opencode, kiro } from './engines/cli-agents.js';
 import * as custom from './engines/custom.js';
 import { installService, uninstallService, serviceStatus, restartService } from './service.js';
-import { enrichPath, findAgentBin, resolveCommand } from './env.js';
+import { AGENT_CLIS, enrichPath, findAgentBin, resolveCommand } from './env.js';
 import { checkForUpdate, selfUpdate } from './update.js';
 import { callLocalMcp } from './mcp-local.js';
 
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.9';
+const VERSION = '0.10.11';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 
@@ -115,18 +121,129 @@ function toMcpContent(result) {
 
 // --------------------------------------------------------------------------
 // CORS — allow the extension (chrome-extension://…) and localhost dev origins.
+// NOTE: CORS only controls whether a *page* may READ the response; it does NOT
+// stop a cross-origin request from running. The hard allow/deny gating that
+// actually protects the command-spawning endpoints lives in `guard()` below.
 // --------------------------------------------------------------------------
-function cors(req, res) {
-  const origin = req.headers.origin || '';
-  const allow =
+function originAllowed(origin) {
+  return (
     !origin ||
     origin.startsWith('chrome-extension://') ||
     origin.startsWith('moz-extension://') ||
     origin.startsWith('http://localhost') ||
-    origin.startsWith('http://127.0.0.1');
+    origin.startsWith('http://127.0.0.1') ||
+    origin.startsWith('http://[::1]')
+  );
+}
+
+// An origin that identifies the ChatPanel extension (or a local dev build).
+// Distinct from originAllowed(): this REQUIRES the header to be present, so a
+// no-Origin local process cannot pose as the extension on privileged routes.
+function isExtensionOrigin(origin) {
+  return (
+    origin.startsWith('chrome-extension://') ||
+    origin.startsWith('moz-extension://') ||
+    origin.startsWith('http://localhost') ||
+    origin.startsWith('http://127.0.0.1') ||
+    origin.startsWith('http://[::1]')
+  );
+}
+
+function cors(req, res) {
+  const origin = req.headers.origin || '';
+  const allow = originAllowed(origin);
   res.setHeader('Access-Control-Allow-Origin', allow ? origin || '*' : 'null');
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-ChatPanel-Token');
+  res.setHeader('Vary', 'Origin');
+}
+
+// --------------------------------------------------------------------------
+// Security gates — defend the localhost server against a malicious web page.
+//
+// Two browser attack classes are in scope even though we bind to 127.0.0.1:
+//   1. DNS rebinding — a page on http://evil.example rebinds that name to
+//      127.0.0.1 and fetches http://evil.example:PORT/…; the request arrives
+//      with Host: evil.example, which a naïve server happily serves.
+//   2. Cross-origin CSRF — a page POSTs a CORS "simple" request (text/plain)
+//      to http://127.0.0.1:PORT/…; no preflight fires and the side effect runs.
+//
+// hostAllowed() closes (1) by rejecting any non-loopback Host. The Origin
+// checks close (2). Privileged endpoints additionally require the extension
+// origin or the per-install token, so a no-Origin local process can't drive
+// command execution either.
+// --------------------------------------------------------------------------
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1']);
+
+function hostAllowed(req) {
+  // If the operator deliberately bound to a non-loopback/all interface
+  // (CHATPANEL_BRIDGE_HOST=0.0.0.0 / a LAN IP), don't second-guess their Host.
+  if (!LOOPBACK_HOSTNAMES.has(HOST)) return true;
+  const raw = String(req.headers.host || '');
+  if (!raw) return false; // HTTP/1.1 requires Host; absent → reject
+  const hostname = raw
+    .replace(/:\d+$/, '') // strip :port
+    .replace(/^\[|\]$/g, '') // strip IPv6 brackets
+    .toLowerCase();
+  return LOOPBACK_HOSTNAMES.has(hostname);
+}
+
+// Per-install bearer token — defense-in-depth so a non-browser local client can
+// authenticate to privileged routes without relying on an Origin header. Written
+// 0600 to ~/.chatpanel/bridge-token; the extension is allowed by origin and need
+// not send it, so adding this never breaks the existing wire contract.
+const TOKEN_PATH = join(os.homedir(), '.chatpanel', 'bridge-token');
+let AUTH_TOKEN = '';
+function ensureToken() {
+  try {
+    if (existsSync(TOKEN_PATH)) AUTH_TOKEN = readFileSync(TOKEN_PATH, 'utf8').trim();
+    if (!AUTH_TOKEN) {
+      AUTH_TOKEN = randomBytes(32).toString('hex');
+      mkdirSync(join(os.homedir(), '.chatpanel'), { recursive: true });
+      writeFileSync(TOKEN_PATH, AUTH_TOKEN, { mode: 0o600 });
+    }
+  } catch (e) {
+    // Token is optional hardening — never fail startup over it.
+    log('error', `could not initialise bridge token: ${e?.message || e}`);
+  }
+}
+function tokenOk(req) {
+  if (!AUTH_TOKEN) return false;
+  const h = String(req.headers['authorization'] || '');
+  const provided = (h.startsWith('Bearer ') ? h.slice(7) : String(req.headers['x-chatpanel-token'] || '')).trim();
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(AUTH_TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+// POST sinks that spawn local agents/commands or self-update, plus GET /debug
+// (leaks PATH/home). Only the extension (allowlisted origin) or a token-bearing
+// client may reach these. The CLI-facing /mcp and /mcp/<id> routes are NOT here:
+// local coding-agent CLIs connect to them with no Origin header by design.
+const PRIVILEGED_POST = new Set([
+  '/chat',
+  '/mcp-local',
+  '/complete',
+  '/list-models',
+  '/agent-check',
+  '/update',
+  '/tool-result',
+]);
+const PRIVILEGED_GET = new Set(['/debug']);
+
+// Returns an error code if the request must be blocked, else null.
+function guard(req, pathname) {
+  if (!hostAllowed(req)) return 'forbidden host';
+  const origin = req.headers.origin || '';
+  if (origin && !originAllowed(origin)) return 'forbidden origin';
+  const privileged =
+    (req.method === 'POST' && PRIVILEGED_POST.has(pathname)) ||
+    (req.method === 'GET' && PRIVILEGED_GET.has(pathname));
+  if (privileged && !(isExtensionOrigin(origin) || tokenOk(req))) {
+    return 'forbidden: this endpoint requires the ChatPanel extension or a valid bridge token';
+  }
+  return null;
 }
 
 function json(res, code, obj) {
@@ -431,15 +548,22 @@ const server = createServer(async (req, res) => {
     res.writeHead(204);
     return res.end();
   }
-  const url = new URL(req.url, `http://${req.headers.host}`);
+  let url;
+  try {
+    url = new URL(req.url, `http://${req.headers.host || '127.0.0.1'}`);
+  } catch {
+    return json(res, 400, { error: 'bad request' });
+  }
+  // Block DNS-rebinding / cross-origin CSRF before any route runs.
+  const blocked = guard(req, url.pathname);
+  if (blocked) return json(res, 403, { error: blocked });
   try {
     if (req.method === 'GET' && url.pathname === '/health') return handleHealth(res);
     if (req.method === 'GET' && url.pathname === '/debug') {
       return json(res, 200, {
         version: VERSION,
         home: os.homedir(),
-        codex: findAgentBin('codex') || null,
-        agy: findAgentBin('agy') || null,
+        agents: Object.fromEntries(AGENT_CLIS.map((name) => [name, findAgentBin(name) || null])),
         path: process.env.PATH,
       });
     }
@@ -528,6 +652,7 @@ function runMcpStdioProxy(url) {
 
 function startServer() {
   enrichPath(); // so codex/gemini are found even under a minimal service PATH
+  ensureToken(); // per-install bearer token for privileged routes (defense-in-depth)
   server.listen(PORT, HOST, async () => {
     log('info', `listening on http://${HOST}:${PORT}`);
     for (const [, { engine, label, hidden }] of Object.entries(ENGINES)) {