@chatpanel/bridge 0.11.3 → 0.11.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/scripts/sync-channels.mjs

@@ -24,7 +24,7 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 // The service and everything under it. `config.js` is deliberately absent: it resolves paths
 // and reads the bridge token from disk, and the bridge already knows both.
 const FILES = [
-  'normalize.js', 'pairing.js', 'invoke.js', 'stream.js', 'bridge.js',
+  'normalize.js', 'pairing.js', 'invoke.js', 'stream.js', 'bridge.js', 'gateway.js',
   'eventlog.js', 'service.js', 'adapters/telegram.js',
 ];
 

package/src/channels/adapters/telegram.js

@@ -46,6 +46,12 @@ export function startTelegram({
   savePairing = async () => {},
   appender,                    // createEventLog(...) or nullEventLog()
   agent = 'claude',
+  // Which transport answers, and with what. `bridge` runs a CLI agent on this machine;
+  // `gateway` reaches any destination the user configured there — an API provider or, via the
+  // gateway's own bridge backend, the same CLI agents. The adapter must not be able to tell
+  // which it has: both expose chat()/cancel() and fold into one reply state.
+  transport = bridge,
+  model = '',
   system = '',
   redact = { tier: 'basic' },
   privacy = 'standard',
@@ -99,7 +105,7 @@ export function startTelegram({
     // no six digits thumbed in from another screen. Bare /start is still the greeting.
     const pairCode = name === 'pair' || (name === 'start' && args) ? args : '';
     if (pairCode) {
-      const r = pairing.redeem(id, pairCode);
+      const r = pairing.redeem(id, pairCode, { label: norm.from?.name || '' });
       await savePairing();
       return void send(norm.chatId, r.ok
         ? `✅ paired (reach: ${r.reach}). Send me anything — I'll run it on your machine.`
@@ -113,7 +119,7 @@ export function startTelegram({
     }
     if (name === 'stop') {
       const st = chatState(norm.chatId);
-      const ok = await bridge.cancel(st.runId, { baseUrl, token });
+      const ok = await transport.cancel(st.runId, { baseUrl, token });
       st.runId = null;
       return void send(norm.chatId, ok ? '⏹ stopped.' : 'nothing running.');
     }
@@ -151,15 +157,16 @@ export function startTelegram({
     const messages = [...st.history, { role: 'user', content: redacted }];
 
     try {
-      const finalState = await bridge.chat(
-        { agent, system, messages, images, options: { reach } },
+      const finalState = await transport.chat(
+        { agent, model, system, messages, images, options: { reach } },
         {
           baseUrl, token, signal,
           onEvent: (ev, state) => {
-            if (ev.type === 'run') st.runId = state.runId;
-            // Throttled live edit: restore the user's own values + egress-scrub fresh secrets, so
-            // the user watches real text stream in but the provider never carries a leaked secret.
-            if ((ev.type === 'delta' || ev.type === 'done') && replyId && (ev.type === 'done' || gate.ready())) {
+            if (state.runId) st.runId = state.runId;
+            // Driven by the folded STATE, not by an event's `type`: the bridge emits
+            // {type:'delta'} and the gateway emits OpenAI chunks, and this has to work on both.
+            // The `first !== shown` guard below makes a no-text event a no-op anyway.
+            if (replyId && (state.done || gate.ready())) {
               const text = outboundText(state.text, st.vault, { privacy });
               const first = splitForTelegram(text || '…')[0];
               if (first && first !== shown) { shown = first; edit(norm.chatId, replyId, first).catch(() => {}); }

package/src/channels/gateway.js

@@ -0,0 +1,106 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-channels/src/gateway.js (npm @chatpanel/channels).
+// Edit there, then run: npm run sync:channels
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve. Package imports are rewritten to the
+// vendored engines (src/pii, src/events) by the sync script.
+
+// Gateway backend: reach ANY configured destination — an API provider or a CLI agent —
+// through the ChatPanel gateway's OpenAI-compatible endpoint.
+//
+//   channel  →  POST http://127.0.0.1:4320/v1/chat/completions  { model, messages, stream }
+//
+// WHY THIS EXISTS ALONGSIDE bridge.js. The bridge runs CLI agents, and that is all it can
+// answer with — so a phone could only ever talk to Claude Code or Codex, never to the OpenAI,
+// Anthropic or local-model endpoints the same user already configured. Those live in the
+// gateway, which persists its `destinations` (0600, keys included) and routes a model id to
+// an API provider OR back to the bridge for an agent. So the gateway is the superset, and
+// pointing a channel at it is what makes "answer from my phone" work with every target the
+// user has rather than a subset.
+//
+// NO NEW SECRET. The alternative was teaching the bridge to hold provider API keys, which
+// would have put them on disk a second time, in a second format, with a second thing to
+// rotate. The gateway already holds them and already guards them; this borrows the routing
+// instead of copying the credentials.
+//
+// The /v1 data plane is deliberately unauthenticated for local clients — that is the
+// gateway's product — so there is no token to present here, and none to leak.
+
+import { parseSse, foldOpenAiEvent, initialState } from './stream.js';
+
+// Per-turn aborts, so /stop can cancel a gateway turn the way it cancels a bridge run. The
+// bridge hands out a run id for this; OpenAI's API has no such handle, so we mint one and
+// keep the controller behind it rather than leaving /stop silently broken on this transport.
+const inflight = new Map();
+
+/**
+ * Drive one turn against a gateway destination. Same shape as bridge.chat so the adapter does
+ * not know which transport it has: streams events to onEvent(ev, state) and returns the folded
+ * final state.
+ */
+export async function chat({ model = '', system = '', messages = [], options = {} }, {
+  baseUrl, signal, onEvent = () => {},
+} = {}) {
+  const runId = `gw_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+  const ac = new AbortController();
+  inflight.set(runId, ac);
+  // The caller's signal (the poll loop shutting down) must still abort the turn.
+  const relay = () => ac.abort();
+  signal?.addEventListener?.('abort', relay, { once: true });
+
+  let state = initialState();
+  const emit = (ev) => { state = foldOpenAiEvent(state, ev); onEvent(ev, state); };
+  emit({ type: 'run', id: runId });
+
+  try {
+    const res = await fetch(`${String(baseUrl).replace(/\/$/, '')}/v1/chat/completions`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        model,
+        stream: true,
+        messages: [
+          ...(system ? [{ role: 'system', content: system }] : []),
+          ...messages.map((m) => ({ role: m.role, content: String(m.content ?? '') })),
+        ],
+        // Carried through so a capped phone's reach still reaches the router. The gateway
+        // ignores what it does not know, which is what keeps an older gateway working.
+        ...(options?.reach ? { chatpanel: { reach: options.reach } } : {}),
+      }),
+      signal: ac.signal,
+    });
+    if (!res.ok || !res.body) {
+      const detail = await res.text().catch(() => '');
+      throw new Error(`gateway ${res.status}${detail ? `: ${detail.slice(0, 300)}` : ''}`);
+    }
+    let buffer = '';
+    const decoder = new TextDecoder();
+    for await (const chunk of res.body) {
+      buffer += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });
+      const { events, rest } = parseSse(buffer);
+      buffer = rest;
+      for (const ev of events) emit(ev);
+    }
+    // OpenAI streams end with `data: [DONE]`, which is not JSON and is dropped by parseSse —
+    // so a stream that ended cleanly still has to be marked done here.
+    if (!state.done) state = { ...state, done: true };
+    return state;
+  } catch (e) {
+    if (ac.signal.aborted) return { ...state, done: true };
+    return { ...state, done: true, error: e?.message || String(e) };
+  } finally {
+    inflight.delete(runId);
+    signal?.removeEventListener?.('abort', relay);
+  }
+}
+
+/** Stop a run by the id emitted as the first {type:'run'} event. Best-effort, like the bridge's. */
+export async function cancel(runId) {
+  const ac = runId && inflight.get(runId);
+  if (!ac) return false;
+  ac.abort();
+  inflight.delete(runId);
+  return true;
+}

package/src/channels/pairing.js

@@ -23,6 +23,17 @@ export { REACH };
 
 // 6 digits: enough entropy for a short-lived, single-use enrollment code shown on a screen,
 // short enough to thumb into a phone. It is NOT a password — it expires and burns on first use.
+// A display name from a remote platform is untrusted text that lands in the owner's settings
+// screen: strip control characters and bidi overrides (which can make one name render as
+// another), collapse whitespace, and cap it. The UI escapes too — this is the other half.
+function cleanLabel(value) {
+  return String(value || '')
+    .replace(/[\u0000-\u001f\u007f\u200b-\u200f\u202a-\u202e\u2066-\u2069]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 48);
+}
+
 function sixDigits(randomInt) {
   return String(randomInt(0, 1_000_000)).padStart(6, '0');
 }
@@ -55,20 +66,24 @@ export function createPairingStore(state = {}, {
       pending.set(code, { at: now(), ttlMs });
       return code;
     },
-    /** Phone-side: "/pair 123456". Burns the code and pairs the actor at 'trusted'. */
-    redeem(actorId, code, { reach = 'trusted' } = {}) {
+    /** Phone-side: "/pair 123456". Burns the code and pairs the actor at 'trusted'.
+     *  `label` is whatever the platform calls the person (a Telegram first name or @handle) —
+     *  stored so the owner's screen can say WHICH phone it just enrolled. An opaque
+     *  'telegram:789795542' is not something anyone can recognise, and the whole point of the
+     *  list is deciding whether to revoke one. Display only: authorization is by actorId. */
+    redeem(actorId, code, { reach = 'trusted', label = '' } = {}) {
       prune();
       const c = String(code || '').trim();
       if (!pending.has(c)) return { ok: false, reason: 'unknown or expired code' };
       if (!REACH.includes(reach)) return { ok: false, reason: `unknown reach '${reach}'` };
       pending.delete(c);
-      paired.set(actorId, { reach, at: now() });
+      paired.set(actorId, { reach, at: now(), label: cleanLabel(label) });
       return { ok: true, reach };
     },
     /** Bootstrap without a code — for an operator-supplied allow list. Explicit, not silent. */
-    allow(actorId, { reach = 'trusted' } = {}) {
+    allow(actorId, { reach = 'trusted', label = '' } = {}) {
       if (!REACH.includes(reach)) throw new Error(`unknown reach '${reach}'`);
-      paired.set(actorId, { reach, at: now() });
+      paired.set(actorId, { reach, at: now(), label: cleanLabel(label) });
     },
     revoke(actorId) { return paired.delete(actorId); },
     isPaired(actorId) { return paired.has(actorId); },

package/src/channels/service.js

@@ -27,11 +27,22 @@
 import path from 'node:path';
 import { readFile, writeFile, mkdir, rm, stat } from 'node:fs/promises';
 import { createPairingStore } from './pairing.js';
+import * as bridgeTransport from './bridge.js';
+import * as gateway from './gateway.js';
+
+// The gateway's fixed local port (see chatpanel-gateway: 4319 bridge / 4320 gateway).
+const DEFAULT_GATEWAY_URL = 'http://127.0.0.1:4320';
 import { createEventLog } from './eventlog.js';
 import { startTelegram } from './adapters/telegram.js';
 
 const TELEGRAM_API = 'https://api.telegram.org';
-export const DEFAULT_SETTINGS = Object.freeze({ agent: 'claude', privacy: 'standard', tier: 'basic' });
+// `agent` routes through the bridge (a CLI on this machine). `model` routes through the
+// gateway, which reaches every destination the user configured there — API providers AND, via
+// its own bridge backend, the same agents. They are mutually exclusive: update() clears one
+// when the other is set, because "which thing answers" is one choice, not two.
+export const DEFAULT_SETTINGS = Object.freeze({
+  agent: 'claude', model: '', gatewayUrl: DEFAULT_GATEWAY_URL, privacy: 'standard', tier: 'basic',
+});
 
 // Restart backoff. A long-poll that dies (network drop, laptop asleep, Telegram hiccup) must
 // come back on its own — a channel nobody is watching is exactly the one that must self-heal —
@@ -120,9 +131,13 @@ export function createChannelService({
   function spawnLoop(botToken) {
     controller = new AbortController();
     running = true;
+    // One choice, resolved here so the adapter never has to ask "which kind am I?".
+    const viaGateway = !!settings.model;
     const done = startAdapter({
       botToken,
-      baseUrl: bridge.baseUrl,
+      transport: viaGateway ? gateway : bridgeTransport,
+      model: viaGateway ? settings.model : '',
+      baseUrl: viaGateway ? (settings.gatewayUrl || DEFAULT_GATEWAY_URL) : bridge.baseUrl,
       token: bridge.token,
       pairing,
       savePairing,
@@ -232,7 +247,13 @@ export function createChannelService({
     async update(patch = {}) {
       await load();
       const next = { ...settings };
-      for (const k of ['agent', 'privacy', 'tier', 'system']) if (patch[k] != null) next[k] = patch[k];
+          for (const k of ['agent', 'model', 'gatewayUrl', 'privacy', 'tier', 'system']) {
+        if (patch[k] != null) next[k] = patch[k];
+      }
+      // Picking one target unpicks the other. Without this a stale `model` would silently win
+      // over the agent the user just chose, and the screen would disagree with the machine.
+      if (patch.agent != null && patch.model == null) next.model = '';
+      if (patch.model) next.agent = '';
       settings = next;
       await saveSettings();
       // Settings are read when the loop starts, so a change only lands on a restart.
@@ -273,7 +294,16 @@ export function createChannelService({
         bot: bot ? { ...bot } : null,
         error: lastError,
         paired: pairing.list(),
-        settings: { agent: settings.agent, privacy: settings.privacy, tier: settings.tier },
+        settings: {
+          agent: settings.agent,
+          model: settings.model || '',
+          gatewayUrl: settings.gatewayUrl || DEFAULT_GATEWAY_URL,
+          privacy: settings.privacy,
+          tier: settings.tier,
+        },
+        // Which transport a message will actually take, so a screen can say so rather than
+        // inferring it from two fields and getting it wrong.
+        via: settings.model ? 'gateway' : 'bridge',
       };
     },
   };

package/src/channels/stream.js

@@ -35,6 +35,26 @@ export function foldEvent(state, ev) {
   }
 }
 
+/**
+ * Fold one OpenAI-style chunk (what the gateway streams) into the same reply state, so a
+ * caller cannot tell which transport it has. Shares parseSse: `data: [DONE]` is not JSON and
+ * is dropped there, which is why the transport marks `done` itself when the stream ends.
+ */
+export function foldOpenAiEvent(state, ev) {
+  if (ev?.type === 'run') return { ...state, runId: ev.id || state.runId };
+  // An error can arrive as a streamed frame rather than an HTTP status.
+  if (ev?.error) return { ...state, done: true, error: ev.error.message || String(ev.error) };
+  const choice = ev?.choices?.[0];
+  let next = state;
+  const delta = choice?.delta?.content;
+  if (typeof delta === 'string' && delta) next = { ...next, text: next.text + delta };
+  // Non-streaming replies (a gateway destination that cannot stream) carry the whole message.
+  const whole = choice?.message?.content;
+  if (!next.text && typeof whole === 'string' && whole) next = { ...next, text: whole };
+  if (choice?.finish_reason) next = { ...next, done: true };
+  return next;
+}
+
 /**
  * Pull complete SSE events out of a growing buffer. Returns the parsed events and the
  * UNCONSUMED tail (a partial frame still arriving), which the caller prepends next read.

package/src/engines/claude.js

@@ -23,6 +23,7 @@ import { summarizeCliError } from '../cli-errors.js';
 import { killOnAbort } from '../proc.js';
 import { pushExtraArgs, FORBIDDEN } from './args.js';
 import { displayPath, resolveWorkdir } from '../workdir.js';
+import { connectorsFor } from '../connectors.js';
 
 // Write base64 data-URL images to temp files. Claude Code reads them with its
 // Read tool (which feeds images to the model as vision), so we just reference the
@@ -69,6 +70,44 @@ const CHANNEL_ALLOW = Object.freeze({
 // a capped turn can never reach shell, writes, or a network egress even via an MCP alias.
 const CHANNEL_DENY = Object.freeze(['Bash', 'Edit', 'Write', 'WebFetch', 'WebSearch']);
 
+// ChatPanel's OWN history/memory tools, which arrive as a user-configured MCP server rather
+// than as built-ins — so the tier's allow-list, which only ever named built-ins, left them out
+// and a headless channel turn had no way to approve them. The phone got "the search tools need
+// your permission and it hasn't been granted yet", which is the one question a texting-your-
+// machine product must never ask: nobody is at the keyboard.
+//
+// Granting them changes nothing about the posture. `trusted` already allows Read/Grep/Glob
+// across the machine, so reading the user's own meetings and notes is narrower than what is
+// already permitted, and egress stays cut — the only place an answer can go is the reply to the
+// phone that is already paired. The MUTATING half is a different question and stays denied: a
+// prompt-injected message must not be able to rewrite what the assistant remembers about you.
+const CHANNEL_MCP_READ = Object.freeze([
+  'search_history', 'smart_search', 'get_record', 'list_history', 'find_related', 'recall',
+  'list_skills', 'open_skill', 'read_skill_file',
+]);
+const CHANNEL_MCP_WRITE = Object.freeze(['remember', 'forget']);
+// Which tiers get the read half. `device` is "conversational only" and stays that way.
+const CHANNEL_MCP_BY_REACH = Object.freeze({ device: Object.freeze([]), trusted: CHANNEL_MCP_READ });
+
+/**
+ * `mcp__<server>__<tool>` entries for the ChatPanel MCP servers this agent actually has
+ * configured. Names come from the agent's own config (connectors.js) because the user chooses
+ * them — 'chatpanel', 'chatpanel-history', whatever they typed. Anything not matching is left
+ * alone: a capped turn must not be handed a stranger's MCP server because it was present.
+ */
+export function channelMcpTools(reach, connectors = []) {
+  const reads = CHANNEL_MCP_BY_REACH[reach] || CHANNEL_MCP_BY_REACH.device;
+  const servers = (connectors || []).filter((n) => typeof n === 'string' && /^chatpanel/i.test(n));
+  const allow = [];
+  const deny = [];
+  for (const server of servers) {
+    for (const tool of reads) allow.push(`mcp__${server}__${tool}`);
+    // Denied on every capped tier, including the ones that get no reads.
+    for (const tool of CHANNEL_MCP_WRITE) deny.push(`mcp__${server}__${tool}`);
+  }
+  return { allow, deny };
+}
+
 /**
  * Tool policy for a channel/remote caller. Returns { allow, deny } for a capped tier, or null
  * when reach is absent or 'any' (no cap — the existing permissionMode logic applies). An unknown
@@ -309,8 +348,11 @@ export async function chat({ messages, system, options, images }, emit, { signal
   // permissionMode behavior unchanged.
   const channelPolicy = channelToolPolicy(options.reach);
   if (channelPolicy) {
-    args.push('--allowedTools', ...channelPolicy.allow, ...mcpAllow);
-    args.push('--disallowedTools', ...channelPolicy.deny);
+    // Read from the agent's own config each turn rather than cached at boot: a server the user
+    // added five minutes ago should work on the next message, not the next restart.
+    const own = channelMcpTools(options.reach, await connectorsFor('claude').catch(() => []));
+    args.push('--allowedTools', ...channelPolicy.allow, ...mcpAllow, ...own.allow);
+    args.push('--disallowedTools', ...channelPolicy.deny, ...own.deny);
   }
   // Gate writes/shell behind the chosen mode; otherwise restrict to read-only
   // tools so headless runs never block on an approval prompt. The relayed browser

package/src/server.js

@@ -67,7 +67,7 @@ import {
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.11.3';
+const VERSION = '0.11.5';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;