@chatpanel/bridge 0.11.4 → 0.11.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/scripts/sync-channels.mjs

@@ -24,7 +24,7 @@ const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 // The service and everything under it. `config.js` is deliberately absent: it resolves paths
 // and reads the bridge token from disk, and the bridge already knows both.
 const FILES = [
-  'normalize.js', 'pairing.js', 'invoke.js', 'stream.js', 'bridge.js',
+  'normalize.js', 'pairing.js', 'invoke.js', 'stream.js', 'bridge.js', 'gateway.js',
   'eventlog.js', 'service.js', 'adapters/telegram.js',
 ];
 

package/src/channels/adapters/telegram.js

@@ -46,6 +46,13 @@ export function startTelegram({
   savePairing = async () => {},
   appender,                    // createEventLog(...) or nullEventLog()
   agent = 'claude',
+  // Which transport answers, and with what. `bridge` runs a CLI agent on this machine;
+  // `gateway` reaches any destination the user configured there — an API provider or, via the
+  // gateway's own bridge backend, the same CLI agents. The adapter must not be able to tell
+  // which it has: both expose chat()/cancel() and fold into one reply state.
+  transport = bridge,
+  model = '',
+  provider = '',
   system = '',
   redact = { tier: 'basic' },
   privacy = 'standard',
@@ -113,7 +120,7 @@ export function startTelegram({
     }
     if (name === 'stop') {
       const st = chatState(norm.chatId);
-      const ok = await bridge.cancel(st.runId, { baseUrl, token });
+      const ok = await transport.cancel(st.runId, { baseUrl, token });
       st.runId = null;
       return void send(norm.chatId, ok ? '⏹ stopped.' : 'nothing running.');
     }
@@ -151,15 +158,16 @@ export function startTelegram({
     const messages = [...st.history, { role: 'user', content: redacted }];
 
     try {
-      const finalState = await bridge.chat(
-        { agent, system, messages, images, options: { reach } },
+      const finalState = await transport.chat(
+        { agent, model, provider, system, messages, images, options: { reach } },
         {
           baseUrl, token, signal,
           onEvent: (ev, state) => {
-            if (ev.type === 'run') st.runId = state.runId;
-            // Throttled live edit: restore the user's own values + egress-scrub fresh secrets, so
-            // the user watches real text stream in but the provider never carries a leaked secret.
-            if ((ev.type === 'delta' || ev.type === 'done') && replyId && (ev.type === 'done' || gate.ready())) {
+            if (state.runId) st.runId = state.runId;
+            // Driven by the folded STATE, not by an event's `type`: the bridge emits
+            // {type:'delta'} and the gateway emits OpenAI chunks, and this has to work on both.
+            // The `first !== shown` guard below makes a no-text event a no-op anyway.
+            if (replyId && (state.done || gate.ready())) {
               const text = outboundText(state.text, st.vault, { privacy });
               const first = splitForTelegram(text || '…')[0];
               if (first && first !== shown) { shown = first; edit(norm.chatId, replyId, first).catch(() => {}); }

package/src/channels/gateway.js

@@ -0,0 +1,114 @@
+// GENERATED — do not edit.
+// Source of truth: chatpanel-channels/src/gateway.js (npm @chatpanel/channels).
+// Edit there, then run: npm run sync:channels
+//
+// Vendored rather than depended on: the bridge ships zero runtime dependencies so a
+// curl one-liner install cannot fail on someone's registry, and so the compiled
+// single-file binary has nothing to resolve. Package imports are rewritten to the
+// vendored engines (src/pii, src/events) by the sync script.
+
+// Gateway backend: reach ANY configured destination — an API provider or a CLI agent —
+// through the ChatPanel gateway's OpenAI-compatible endpoint.
+//
+//   channel  →  POST http://127.0.0.1:4320/v1/chat/completions  { model, messages, stream }
+//
+// WHY THIS EXISTS ALONGSIDE bridge.js. The bridge runs CLI agents, and that is all it can
+// answer with — so a phone could only ever talk to Claude Code or Codex, never to the OpenAI,
+// Anthropic or local-model endpoints the same user already configured. Those live in the
+// gateway, which persists its `destinations` (0600, keys included) and routes a model id to
+// an API provider OR back to the bridge for an agent. So the gateway is the superset, and
+// pointing a channel at it is what makes "answer from my phone" work with every target the
+// user has rather than a subset.
+//
+// NO NEW SECRET. The alternative was teaching the bridge to hold provider API keys, which
+// would have put them on disk a second time, in a second format, with a second thing to
+// rotate. The gateway already holds them and already guards them; this borrows the routing
+// instead of copying the credentials.
+//
+// The /v1 data plane is deliberately unauthenticated for local clients — that is the
+// gateway's product — so there is no token to present here, and none to leak.
+
+import { parseSse, foldOpenAiEvent, initialState } from './stream.js';
+
+// Per-turn aborts, so /stop can cancel a gateway turn the way it cancels a bridge run. The
+// bridge hands out a run id for this; OpenAI's API has no such handle, so we mint one and
+// keep the controller behind it rather than leaving /stop silently broken on this transport.
+const inflight = new Map();
+
+/**
+ * Drive one turn against a gateway destination. Same shape as bridge.chat so the adapter does
+ * not know which transport it has: streams events to onEvent(ev, state) and returns the folded
+ * final state.
+ */
+export async function chat({ model = '', provider = '', system = '', messages = [], options = {} }, {
+  baseUrl, signal, onEvent = () => {},
+} = {}) {
+  const runId = `gw_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+  const ac = new AbortController();
+  inflight.set(runId, ac);
+  // The caller's signal (the poll loop shutting down) must still abort the turn.
+  const relay = () => ac.abort();
+  signal?.addEventListener?.('abort', relay, { once: true });
+
+  let state = initialState();
+  const emit = (ev) => { state = foldOpenAiEvent(state, ev); onEvent(ev, state); };
+  emit({ type: 'run', id: runId });
+
+  try {
+    const res = await fetch(`${String(baseUrl).replace(/\/$/, '')}/v1/chat/completions`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        // ChatPanel's routing metadata goes in HEADERS, never in the request body. It rode the
+        // body first and NVIDIA answered "unsupported parameters": OpenAI-compatible providers
+        // validate the body strictly and reject unknown fields, while ignoring unknown headers.
+        // The gateway strips x-chatpanel-* before forwarding, so the provider never sees it.
+        ...(options?.reach ? { 'x-chatpanel-reach': options.reach } : {}),
+        // WHICH provider, not just which model. A model id is not a unique key — two providers
+        // can serve the same one — so without this the gateway picks whichever destination it
+        // lists first and the call goes out on a key the user never chose.
+        ...(provider ? { 'x-chatpanel-destination': provider } : {}),
+      },
+      body: JSON.stringify({
+        model,
+        stream: true,
+        messages: [
+          ...(system ? [{ role: 'system', content: system }] : []),
+          ...messages.map((m) => ({ role: m.role, content: String(m.content ?? '') })),
+        ],
+      }),
+      signal: ac.signal,
+    });
+    if (!res.ok || !res.body) {
+      const detail = await res.text().catch(() => '');
+      throw new Error(`gateway ${res.status}${detail ? `: ${detail.slice(0, 300)}` : ''}`);
+    }
+    let buffer = '';
+    const decoder = new TextDecoder();
+    for await (const chunk of res.body) {
+      buffer += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });
+      const { events, rest } = parseSse(buffer);
+      buffer = rest;
+      for (const ev of events) emit(ev);
+    }
+    // OpenAI streams end with `data: [DONE]`, which is not JSON and is dropped by parseSse —
+    // so a stream that ended cleanly still has to be marked done here.
+    if (!state.done) state = { ...state, done: true };
+    return state;
+  } catch (e) {
+    if (ac.signal.aborted) return { ...state, done: true };
+    return { ...state, done: true, error: e?.message || String(e) };
+  } finally {
+    inflight.delete(runId);
+    signal?.removeEventListener?.('abort', relay);
+  }
+}
+
+/** Stop a run by the id emitted as the first {type:'run'} event. Best-effort, like the bridge's. */
+export async function cancel(runId) {
+  const ac = runId && inflight.get(runId);
+  if (!ac) return false;
+  ac.abort();
+  inflight.delete(runId);
+  return true;
+}

package/src/channels/service.js

@@ -27,11 +27,23 @@
 import path from 'node:path';
 import { readFile, writeFile, mkdir, rm, stat } from 'node:fs/promises';
 import { createPairingStore } from './pairing.js';
+import * as bridgeTransport from './bridge.js';
+import * as gateway from './gateway.js';
+
+// The gateway's fixed local port (see chatpanel-gateway: 4319 bridge / 4320 gateway).
+const DEFAULT_GATEWAY_URL = 'http://127.0.0.1:4320';
 import { createEventLog } from './eventlog.js';
 import { startTelegram } from './adapters/telegram.js';
 
 const TELEGRAM_API = 'https://api.telegram.org';
-export const DEFAULT_SETTINGS = Object.freeze({ agent: 'claude', privacy: 'standard', tier: 'basic' });
+// `agent` routes through the bridge (a CLI on this machine). `model` routes through the
+// gateway, which reaches every destination the user configured there — API providers AND, via
+// its own bridge backend, the same agents. They are mutually exclusive: update() clears one
+// when the other is set, because "which thing answers" is one choice, not two.
+export const DEFAULT_SETTINGS = Object.freeze({
+  agent: 'claude', model: '', provider: '', gatewayUrl: DEFAULT_GATEWAY_URL,
+  privacy: 'standard', tier: 'basic',
+});
 
 // Restart backoff. A long-poll that dies (network drop, laptop asleep, Telegram hiccup) must
 // come back on its own — a channel nobody is watching is exactly the one that must self-heal —
@@ -120,9 +132,14 @@ export function createChannelService({
   function spawnLoop(botToken) {
     controller = new AbortController();
     running = true;
+    // One choice, resolved here so the adapter never has to ask "which kind am I?".
+    const viaGateway = !!settings.model;
     const done = startAdapter({
       botToken,
-      baseUrl: bridge.baseUrl,
+      transport: viaGateway ? gateway : bridgeTransport,
+      model: viaGateway ? settings.model : '',
+      provider: viaGateway ? (settings.provider || '') : '',
+      baseUrl: viaGateway ? (settings.gatewayUrl || DEFAULT_GATEWAY_URL) : bridge.baseUrl,
       token: bridge.token,
       pairing,
       savePairing,
@@ -232,7 +249,13 @@ export function createChannelService({
     async update(patch = {}) {
       await load();
       const next = { ...settings };
-      for (const k of ['agent', 'privacy', 'tier', 'system']) if (patch[k] != null) next[k] = patch[k];
+          for (const k of ['agent', 'model', 'provider', 'gatewayUrl', 'privacy', 'tier', 'system']) {
+        if (patch[k] != null) next[k] = patch[k];
+      }
+      // Picking one target unpicks the other. Without this a stale `model` would silently win
+      // over the agent the user just chose, and the screen would disagree with the machine.
+      if (patch.agent != null && patch.model == null) { next.model = ''; next.provider = ''; }
+      if (patch.model) next.agent = '';
       settings = next;
       await saveSettings();
       // Settings are read when the loop starts, so a change only lands on a restart.
@@ -273,7 +296,17 @@ export function createChannelService({
         bot: bot ? { ...bot } : null,
         error: lastError,
         paired: pairing.list(),
-        settings: { agent: settings.agent, privacy: settings.privacy, tier: settings.tier },
+        settings: {
+          agent: settings.agent,
+          model: settings.model || '',
+          provider: settings.provider || '',
+          gatewayUrl: settings.gatewayUrl || DEFAULT_GATEWAY_URL,
+          privacy: settings.privacy,
+          tier: settings.tier,
+        },
+        // Which transport a message will actually take, so a screen can say so rather than
+        // inferring it from two fields and getting it wrong.
+        via: settings.model ? 'gateway' : 'bridge',
       };
     },
   };

package/src/channels/stream.js

@@ -35,6 +35,26 @@ export function foldEvent(state, ev) {
   }
 }
 
+/**
+ * Fold one OpenAI-style chunk (what the gateway streams) into the same reply state, so a
+ * caller cannot tell which transport it has. Shares parseSse: `data: [DONE]` is not JSON and
+ * is dropped there, which is why the transport marks `done` itself when the stream ends.
+ */
+export function foldOpenAiEvent(state, ev) {
+  if (ev?.type === 'run') return { ...state, runId: ev.id || state.runId };
+  // An error can arrive as a streamed frame rather than an HTTP status.
+  if (ev?.error) return { ...state, done: true, error: ev.error.message || String(ev.error) };
+  const choice = ev?.choices?.[0];
+  let next = state;
+  const delta = choice?.delta?.content;
+  if (typeof delta === 'string' && delta) next = { ...next, text: next.text + delta };
+  // Non-streaming replies (a gateway destination that cannot stream) carry the whole message.
+  const whole = choice?.message?.content;
+  if (!next.text && typeof whole === 'string' && whole) next = { ...next, text: whole };
+  if (choice?.finish_reason) next = { ...next, done: true };
+  return next;
+}
+
 /**
  * Pull complete SSE events out of a growing buffer. Returns the parsed events and the
  * UNCONSUMED tail (a partial frame still arriving), which the caller prepends next read.

package/src/server.js

@@ -67,7 +67,7 @@ import {
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.11.4';
+const VERSION = '0.11.6';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;