@chatpanel/bridge 0.11.2 → 0.11.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/channels/adapters/telegram.js

@@ -99,7 +99,7 @@ export function startTelegram({
     // no six digits thumbed in from another screen. Bare /start is still the greeting.
     const pairCode = name === 'pair' || (name === 'start' && args) ? args : '';
     if (pairCode) {
-      const r = pairing.redeem(id, pairCode);
+      const r = pairing.redeem(id, pairCode, { label: norm.from?.name || '' });
       await savePairing();
       return void send(norm.chatId, r.ok
         ? `✅ paired (reach: ${r.reach}). Send me anything — I'll run it on your machine.`

package/src/channels/pairing.js

@@ -23,6 +23,17 @@ export { REACH };
 
 // 6 digits: enough entropy for a short-lived, single-use enrollment code shown on a screen,
 // short enough to thumb into a phone. It is NOT a password — it expires and burns on first use.
+// A display name from a remote platform is untrusted text that lands in the owner's settings
+// screen: strip control characters and bidi overrides (which can make one name render as
+// another), collapse whitespace, and cap it. The UI escapes too — this is the other half.
+function cleanLabel(value) {
+  return String(value || '')
+    .replace(/[\u0000-\u001f\u007f\u200b-\u200f\u202a-\u202e\u2066-\u2069]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 48);
+}
+
 function sixDigits(randomInt) {
   return String(randomInt(0, 1_000_000)).padStart(6, '0');
 }
@@ -55,20 +66,24 @@ export function createPairingStore(state = {}, {
       pending.set(code, { at: now(), ttlMs });
       return code;
     },
-    /** Phone-side: "/pair 123456". Burns the code and pairs the actor at 'trusted'. */
-    redeem(actorId, code, { reach = 'trusted' } = {}) {
+    /** Phone-side: "/pair 123456". Burns the code and pairs the actor at 'trusted'.
+     *  `label` is whatever the platform calls the person (a Telegram first name or @handle) —
+     *  stored so the owner's screen can say WHICH phone it just enrolled. An opaque
+     *  'telegram:789795542' is not something anyone can recognise, and the whole point of the
+     *  list is deciding whether to revoke one. Display only: authorization is by actorId. */
+    redeem(actorId, code, { reach = 'trusted', label = '' } = {}) {
       prune();
       const c = String(code || '').trim();
       if (!pending.has(c)) return { ok: false, reason: 'unknown or expired code' };
       if (!REACH.includes(reach)) return { ok: false, reason: `unknown reach '${reach}'` };
       pending.delete(c);
-      paired.set(actorId, { reach, at: now() });
+      paired.set(actorId, { reach, at: now(), label: cleanLabel(label) });
       return { ok: true, reach };
     },
     /** Bootstrap without a code — for an operator-supplied allow list. Explicit, not silent. */
-    allow(actorId, { reach = 'trusted' } = {}) {
+    allow(actorId, { reach = 'trusted', label = '' } = {}) {
       if (!REACH.includes(reach)) throw new Error(`unknown reach '${reach}'`);
-      paired.set(actorId, { reach, at: now() });
+      paired.set(actorId, { reach, at: now(), label: cleanLabel(label) });
     },
     revoke(actorId) { return paired.delete(actorId); },
     isPaired(actorId) { return paired.has(actorId); },

package/src/engines/claude.js

@@ -23,6 +23,7 @@ import { summarizeCliError } from '../cli-errors.js';
 import { killOnAbort } from '../proc.js';
 import { pushExtraArgs, FORBIDDEN } from './args.js';
 import { displayPath, resolveWorkdir } from '../workdir.js';
+import { connectorsFor } from '../connectors.js';
 
 // Write base64 data-URL images to temp files. Claude Code reads them with its
 // Read tool (which feeds images to the model as vision), so we just reference the
@@ -69,6 +70,44 @@ const CHANNEL_ALLOW = Object.freeze({
 // a capped turn can never reach shell, writes, or a network egress even via an MCP alias.
 const CHANNEL_DENY = Object.freeze(['Bash', 'Edit', 'Write', 'WebFetch', 'WebSearch']);
 
+// ChatPanel's OWN history/memory tools, which arrive as a user-configured MCP server rather
+// than as built-ins — so the tier's allow-list, which only ever named built-ins, left them out
+// and a headless channel turn had no way to approve them. The phone got "the search tools need
+// your permission and it hasn't been granted yet", which is the one question a texting-your-
+// machine product must never ask: nobody is at the keyboard.
+//
+// Granting them changes nothing about the posture. `trusted` already allows Read/Grep/Glob
+// across the machine, so reading the user's own meetings and notes is narrower than what is
+// already permitted, and egress stays cut — the only place an answer can go is the reply to the
+// phone that is already paired. The MUTATING half is a different question and stays denied: a
+// prompt-injected message must not be able to rewrite what the assistant remembers about you.
+const CHANNEL_MCP_READ = Object.freeze([
+  'search_history', 'smart_search', 'get_record', 'list_history', 'find_related', 'recall',
+  'list_skills', 'open_skill', 'read_skill_file',
+]);
+const CHANNEL_MCP_WRITE = Object.freeze(['remember', 'forget']);
+// Which tiers get the read half. `device` is "conversational only" and stays that way.
+const CHANNEL_MCP_BY_REACH = Object.freeze({ device: Object.freeze([]), trusted: CHANNEL_MCP_READ });
+
+/**
+ * `mcp__<server>__<tool>` entries for the ChatPanel MCP servers this agent actually has
+ * configured. Names come from the agent's own config (connectors.js) because the user chooses
+ * them — 'chatpanel', 'chatpanel-history', whatever they typed. Anything not matching is left
+ * alone: a capped turn must not be handed a stranger's MCP server because it was present.
+ */
+export function channelMcpTools(reach, connectors = []) {
+  const reads = CHANNEL_MCP_BY_REACH[reach] || CHANNEL_MCP_BY_REACH.device;
+  const servers = (connectors || []).filter((n) => typeof n === 'string' && /^chatpanel/i.test(n));
+  const allow = [];
+  const deny = [];
+  for (const server of servers) {
+    for (const tool of reads) allow.push(`mcp__${server}__${tool}`);
+    // Denied on every capped tier, including the ones that get no reads.
+    for (const tool of CHANNEL_MCP_WRITE) deny.push(`mcp__${server}__${tool}`);
+  }
+  return { allow, deny };
+}
+
 /**
  * Tool policy for a channel/remote caller. Returns { allow, deny } for a capped tier, or null
  * when reach is absent or 'any' (no cap — the existing permissionMode logic applies). An unknown
@@ -309,8 +348,11 @@ export async function chat({ messages, system, options, images }, emit, { signal
   // permissionMode behavior unchanged.
   const channelPolicy = channelToolPolicy(options.reach);
   if (channelPolicy) {
-    args.push('--allowedTools', ...channelPolicy.allow, ...mcpAllow);
-    args.push('--disallowedTools', ...channelPolicy.deny);
+    // Read from the agent's own config each turn rather than cached at boot: a server the user
+    // added five minutes ago should work on the next message, not the next restart.
+    const own = channelMcpTools(options.reach, await connectorsFor('claude').catch(() => []));
+    args.push('--allowedTools', ...channelPolicy.allow, ...mcpAllow, ...own.allow);
+    args.push('--disallowedTools', ...channelPolicy.deny, ...own.deny);
   }
   // Gate writes/shell behind the chosen mode; otherwise restrict to read-only
   // tools so headless runs never block on an approval prompt. The relayed browser

package/src/server.js

@@ -67,7 +67,7 @@ import {
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.11.2';
+const VERSION = '0.11.4';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;
 

package/src/update.js

@@ -78,7 +78,20 @@ export async function checkForUpdate(current, { force = false } = {}) {
 
   let latest = null;
   let assetUrl = null;
+  // Whether `latest` is a real answer or yesterday's. GitHub's unauthenticated API is 60
+  // requests/hour per IP, and a developer machine burns that easily — so the fallback below
+  // is not rare, it fires regularly. Saying WHICH it is matters: acting on a stale "latest"
+  // is how a forced check reported "already on the latest version" minutes after a newer one
+  // was published, and how an earlier update landed on a version that was not the newest and
+  // called it a success.
+  let stale = false;
+  let error = '';
   const cache = await readCache();
+  const fallBackToCache = () => {
+    latest = cache?.latest || null;
+    assetUrl = cache?.assetUrl || null;
+    stale = true;
+  };
   if (!force && cache && Date.now() - cache.checkedAt < CHECK_EVERY_MS) {
     latest = cache.latest;
     assetUrl = cache.assetUrl;
@@ -91,12 +104,12 @@ export async function checkForUpdate(current, { force = false } = {}) {
         assetUrl = want ? (data.assets || []).find((a) => a.name === want)?.browser_download_url || null : null;
         await writeCache({ checkedAt: Date.now(), latest, assetUrl });
       } else {
-        latest = cache?.latest || null;
-        assetUrl = cache?.assetUrl || null;
+        error = res.status === 403 ? 'GitHub rate limit (60/hour per IP) — try again later' : `HTTP ${res.status}`;
+        fallBackToCache();
       }
-    } catch {
-      latest = cache?.latest || null;
-      assetUrl = cache?.assetUrl || null;
+    } catch (e) {
+      error = e?.message || String(e);
+      fallBackToCache();
     }
   }
   const updateAvailable = !!latest && cmp(latest, current) > 0;
@@ -110,6 +123,8 @@ export async function checkForUpdate(current, { force = false } = {}) {
     mode,
     canSelfUpdate,
     assetUrl,
+    stale,
+    error,
     npmCommand: mode === 'npm' ? 'npm i -g @chatpanel/bridge@latest' : null,
   };
 }
@@ -122,10 +137,16 @@ export async function selfUpdate(current) {
     throw new Error('Self-update applies only to the standalone binary. Update the npm/npx version with npm.');
   }
   const info = await checkForUpdate(current, { force: true });
-  if (!info.assetUrl) throw new Error('No downloadable build for this platform — use `npx @chatpanel/bridge`.');
-  if (!info.updateAvailable) {
-    throw new Error(info.latest ? `Already on the latest version (v${current}).` : 'Could not reach the update server.');
+  // A forced check that fell back to the cache has not checked anything. Acting on it is how
+  // an update reported success while installing a version that was already superseded, and how
+  // it later refused with "already on the latest version" while a newer one sat published.
+  // Say what actually happened and leave the binary alone.
+  if (info.stale) {
+    throw new Error(`Could not reach the update server${info.error ? ` (${info.error})` : ''}. `
+      + 'Refusing to act on a stale check — try again in a few minutes.');
   }
+  if (!info.assetUrl) throw new Error('No downloadable build for this platform — use `npx @chatpanel/bridge`.');
+  if (!info.updateAvailable) throw new Error(`Already on the latest version (v${current}).`);
 
   const target = process.execPath; // the running binary's own path
   const dir = path.dirname(target);