@chatpanel/gateway 0.2.3 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.2.3",
+  "version": "0.3.1",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/openai.js

@@ -3,8 +3,9 @@
 // request body as in-place segments, and restores tokens in a non-streaming
 // response. (Streaming is restored generically in stream.js.)
 
+import { restoreText } from '@chatpanel/pii';
 import { segment } from './redact.js';
-import { restoreDeep } from './stream.js';
+import { restoreDeepAliases } from './stream.js';
 
 export function matches(pathname) {
   return /\/chat\/completions$/.test(pathname) || /\/completions$/.test(pathname);
@@ -37,15 +38,33 @@ export function toTurn(body) {
   return { messages: Array.isArray(body?.messages) ? body.messages : [], system: '' };
 }
 
+// Tool-relay: the client's tool definitions, and (on a follow-up request) the
+// most recent tool result the client sent back.
+export function extractTools(body) {
+  return Array.isArray(body?.tools) ? body.tools : [];
+}
+export function extractLatestToolResult(body) {
+  const msgs = Array.isArray(body?.messages) ? body.messages : [];
+  for (let i = msgs.length - 1; i >= 0; i--) {
+    const m = msgs[i];
+    if (m?.role === 'tool' && m.tool_call_id) {
+      return { tool_call_id: m.tool_call_id, content: typeof m.content === 'string' ? m.content : JSON.stringify(m.content) };
+    }
+  }
+  return null;
+}
+
 // Restore a buffered (non-streaming) response: assistant text + tool-call args.
 export function restoreResponse(json, vault) {
   for (const choice of json?.choices || []) {
     const msg = choice?.message;
     if (!msg) continue;
-    if (typeof msg.content === 'string') msg.content = restoreDeep(msg.content, vault);
+    // Visible text keeps the pseudonym (restoreText); tool-call args get the REAL
+    // value (restoreDeepAliases) so the client runs the tool on real data.
+    if (typeof msg.content === 'string') msg.content = restoreText(msg.content, vault);
     for (const tc of msg.tool_calls || []) {
       if (tc?.function && typeof tc.function.arguments === 'string') {
-        tc.function.arguments = restoreDeep(tc.function.arguments, vault);
+        tc.function.arguments = restoreDeepAliases(tc.function.arguments, vault);
       }
     }
   }

package/src/server.js

@@ -20,9 +20,10 @@
 import { createServer } from 'node:http';
 import { loadConfig } from './config.js';
 import { redactSegments } from './redact.js';
-import { pipeRestoredStream, makeTokenRestorer } from './stream.js';
-import { restoreText } from '@chatpanel/pii';
-import { streamBridgeChat, readBridgeToken } from './bridge.js';
+import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
+import { restoreText, effectiveTier, gatedDictionary } from '@chatpanel/pii';
+import { streamBridgeChat, readBridgeToken, openBridgeChat } from './bridge.js';
+import { createRelaySession, getRelaySession, endRelaySession, pumpBridgeStream, deliverToolResult, toolsToSpecs, parseToolCallId } from './toolrelay.js';
 import { shaperFor } from './shape.js';
 import { startNer } from './ner.js';
 import { resolvePro, meter, usage } from './freegate.js';
@@ -32,7 +33,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.2.3';
+export const VERSION = '0.3.1';
 
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);
 
@@ -131,11 +132,70 @@ function forwardHeaders(headers, base) {
 
 // ---- backend: bridge -------------------------------------------------------
 
-async function handleBridge(req, res, { kind, adapter, redactable, pathname, agentOverride }, body, vault, cfg) {
+// Stream the bridge SSE through the OpenAI shaper, parking on a tool call.
+async function pumpRelay(res, s, shaper) {
+  const restorer = makeTokenRestorer(s.vault);
+  await pumpBridgeStream(s, {
+    onText: (text) => { const r = restorer.push(text); if (r) res.write(shaper.sseDelta(r)); },
+    onToolRequest: ({ name, restoredArgs, toolId }) => {
+      const tail = restorer.flush(); if (tail) res.write(shaper.sseDelta(tail));
+      res.write(shaper.sseToolCalls([{ id: toolId, name, arguments: JSON.stringify(restoredArgs) }]));
+      res.write(shaper.sseToolFinish());
+      res.end(); // park: turn ends with tool_calls; the session stays alive for the follow-up
+    },
+    onDone: () => { const tail = restorer.flush(); if (tail) res.write(shaper.sseDelta(tail)); res.write(shaper.sseTail()); res.end(); endRelaySession(s.id); },
+    onError: (e) => { res.write(`data: ${JSON.stringify({ error: { message: e.message, type: 'bridge_error' } })}\n\n`); res.end(); endRelaySession(s.id); },
+  });
+}
+
+// New tool-enabled turn: open the bridge with the client's tools as MCP specs.
+async function startRelay(req, res, { kind, adapter, agent }, body, vault, cfg, isPro, tools) {
+  const { messages, system } = adapter.toTurn(body);
+  const token = readBridgeToken(cfg.bridge.token);
+  const shaper = shaperFor(kind, body?.model || agent);
+  const redactOpts = { tier: effectiveTier({ tier: cfg.redaction.tier }, isPro), dictionary: gatedDictionary(cfg.redaction, isPro), entities: [] };
+  const s = createRelaySession({ vault, redactOpts, bridgeUrl: cfg.bridge.url, token });
+  const ttl = setTimeout(() => endRelaySession(s.id), 135_000); // bridge tool-call timeout is 120s
+  let resp;
+  try {
+    resp = await openBridgeChat({ bridgeUrl: cfg.bridge.url, agent, token, messages, system, specs: toolsToSpecs(tools), options: {}, signal: undefined });
+  } catch (e) { clearTimeout(ttl); endRelaySession(s.id); return sendJson(res, 502, { error: { message: `bridge: ${e.message}`, type: 'bridge_error' } }); }
+  s.reader = resp.body.getReader();
+  res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' });
+  res.write(shaper.sseHead());
+  return pumpRelay(res, s, shaper);
+}
+
+// Follow-up turn carrying a tool result: feed it to the parked agent + resume.
+async function resumeRelay(res, s, toolContent, model) {
+  try { await deliverToolResult(s, toolContent); }
+  catch (e) { endRelaySession(s.id); return sendJson(res, 502, { error: { message: `tool-result: ${e.message}`, type: 'bridge_error' } }); }
+  const shaper = shaperFor('openai', model || 'codex');
+  res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' });
+  res.write(shaper.sseHead());
+  return pumpRelay(res, s, shaper);
+}
+
+async function handleBridge(req, res, { kind, adapter, redactable, pathname, agentOverride }, body, vault, cfg, isPro) {
   if (!redactable) {
     return sendJson(res, 404, { error: `endpoint ${pathname} not supported by the bridge backend` });
   }
 
+  // Tool relay (OpenAI protocol + agent destinations). A follow-up request carries
+  // a tool result for a parked session; a new request with `tools` starts one.
+  if (kind === 'openai') {
+    const toolResult = adapter.extractLatestToolResult(body);
+    if (toolResult) {
+      const parsed = parseToolCallId(toolResult.tool_call_id);
+      const s = parsed && getRelaySession(parsed.gwId);
+      if (s) return resumeRelay(res, s, toolResult.content, body?.model);
+    }
+    const tools = adapter.extractTools(body);
+    if (tools.length && body?.stream === true) {
+      return startRelay(req, res, { kind, adapter, agent: agentOverride || pickAgent(body?.model, cfg) }, body, vault, cfg, isPro, tools);
+    }
+  }
+
   const { messages, system } = adapter.toTurn(body);
   const agent = agentOverride || pickAgent(body?.model, cfg);
   const wantStream = body?.stream === true;
@@ -176,7 +236,7 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
 
 // ---- backend: api ----------------------------------------------------------
 
-async function handleApi(req, res, { adapter, pathname, search, base, destKey, destProtocol }, outBody, vault) {
+async function handleApi(req, res, { adapter, kind, pathname, search, base, destKey, destProtocol }, outBody, vault) {
   let upstream;
   try {
     const headers = forwardHeaders(req.headers, base);
@@ -201,7 +261,10 @@ async function handleApi(req, res, { adapter, pathname, search, base, destKey, d
 
   if (ct.includes('text/event-stream') && upstream.body) {
     res.writeHead(upstream.status, resHeaders);
-    return pipeRestoredStream(upstream.body, res, vault);
+    // OpenAI streaming: restore tool-call args with real values (aliases undone)
+    // while keeping visible text pseudonymized. Other protocols: generic restore.
+    const pipe = kind === 'openai' ? pipeRestoredOpenAIStream : pipeRestoredStream;
+    return pipe(upstream.body, res, vault);
   }
 
   const buf = Buffer.from(await upstream.arrayBuffer());
@@ -282,11 +345,12 @@ export function createGateway(cfg = loadConfig()) {
     let body = null;
     let outBody = raw;
     let redactedCount = 0;
+    let isPro = true;
     if (r.redactable && req.method === 'POST' && raw.length) {
       try { body = JSON.parse(raw.toString('utf8')); } catch { body = null; }
       if (body) {
         // Free/Pro gate: meter the request and pick the effective tier.
-        const isPro = await resolvePro(cfg.pro?.entitlementToken);
+        isPro = await resolvePro(cfg.pro?.entitlementToken);
         const allow = meter(cfg, isPro);
         if (!allow.allowed) {
           return sendJson(res, 402, { error: {
@@ -318,7 +382,7 @@ export function createGateway(cfg = loadConfig()) {
       }
       return handleApi(req, res, { ...r, pathname, search: url.search, base: dest.baseUrl, destKey: dest.apiKey, destProtocol: dest.protocol }, outBody, vault);
     }
-    return handleBridge(req, res, { ...r, pathname, agentOverride: dest?.agent }, body, vault, cfg);
+    return handleBridge(req, res, { ...r, pathname, agentOverride: dest?.agent }, body, vault, cfg, isPro);
   });
 }
 

package/src/shape.js

@@ -38,6 +38,14 @@ export function openaiChat(model) {
     sseTail() {
       return sse({ ...base, choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] }) + 'data: [DONE]\n\n';
     },
+    // Tool-relay (agent destinations): emit the agent's tool call as an OpenAI
+    // tool_calls delta, then end the turn with finish_reason:tool_calls.
+    sseToolCalls(calls) {
+      return sse({ ...base, choices: [{ index: 0, delta: { tool_calls: calls.map((c, i) => ({ index: i, id: c.id, type: 'function', function: { name: c.name, arguments: c.arguments } })) }, finish_reason: null }] });
+    },
+    sseToolFinish() {
+      return sse({ ...base, choices: [{ index: 0, delta: {}, finish_reason: 'tool_calls' }] }) + 'data: [DONE]\n\n';
+    },
   };
 }
 

package/src/stream.js

@@ -12,7 +12,7 @@
 // agent unchanged — its defined "permanent substitution" behavior. Only reversible
 // [[TYPE_n]] tokens are restored here.
 
-import { restoreText } from '@chatpanel/pii';
+import { restoreText, restoreWithAliases } from '@chatpanel/pii';
 
 // Returns a TransformStream-free chunk transformer: feed it decoded string chunks,
 // it returns the prefix that's safe to forward now and buffers a possibly-partial
@@ -60,6 +60,97 @@ export function restoreDeep(value, vault) {
   return value;
 }
 
+// Deep-restore for tool-call argument values (non-stream), undoing aliases too —
+// so a client running tools LOCALLY gets the REAL value (pseudonyms included),
+// while the model stays blinded. Mirrors the extension's restoreDeep.
+export function restoreDeepAliases(value, vault) {
+  if (!vault) return value;
+  if (typeof value === 'string') return restoreWithAliases(value, vault);
+  if (Array.isArray(value)) return value.map((v) => restoreDeepAliases(v, vault));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const k of Object.keys(value)) out[k] = restoreDeepAliases(value[k], vault);
+    return out;
+  }
+  return value;
+}
+
+// A per-field tail-buffered restorer (holds a partial trailing [[token). `restoreFn`
+// is restoreText for VISIBLE text (keep pseudonyms) or restoreWithAliases for
+// TOOL-CALL args (real values).
+function makeFieldRestorer(vault, restoreFn) {
+  let buf = '';
+  return {
+    push(chunk) {
+      buf += chunk || '';
+      const open = buf.lastIndexOf('[[');
+      let safe;
+      if (open !== -1 && !buf.slice(open).includes(']]')) { safe = buf.slice(0, open); buf = buf.slice(open); }
+      else { safe = buf; buf = ''; }
+      return restoreFn(safe, vault);
+    },
+    flush() { const out = restoreFn(buf, vault); buf = ''; return out; },
+  };
+}
+
+// OpenAI streaming restorer that restores VISIBLE content with restoreText (the
+// model + user keep the pseudonym) but TOOL-CALL argument deltas with
+// restoreWithAliases (the client runs the tool on the REAL value). Passes through
+// any non-JSON event untouched.
+export async function pipeRestoredOpenAIStream(upstreamBody, nodeRes, vault) {
+  const reader = upstreamBody.getReader();
+  const decoder = new TextDecoder();
+  let buf = '';
+  const contentR = makeFieldRestorer(vault, restoreText);
+  const argRs = new Map(); // tool_call index -> field restorer (aliases)
+
+  const handleBlock = (block) => {
+    const out = [];
+    for (const line of block.split('\n')) {
+      if (!line.startsWith('data:')) { out.push(line); continue; }
+      const payload = line.slice(5).replace(/^\s/, '');
+      if (!payload) { out.push(line); continue; }
+      if (payload === '[DONE]') {
+        const tail = contentR.flush();
+        if (tail) out.push(`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: tail }, finish_reason: null }] })}`);
+        out.push(line);
+        continue;
+      }
+      let evt; try { evt = JSON.parse(payload); } catch { out.push(line); continue; }
+      for (const choice of evt.choices || []) {
+        const d = choice.delta;
+        if (!d) continue;
+        if (typeof d.content === 'string') d.content = contentR.push(d.content);
+        for (const tc of d.tool_calls || []) {
+          const idx = typeof tc.index === 'number' ? tc.index : 0;
+          if (tc.function && typeof tc.function.arguments === 'string') {
+            if (!argRs.has(idx)) argRs.set(idx, makeFieldRestorer(vault, restoreWithAliases));
+            tc.function.arguments = argRs.get(idx).push(tc.function.arguments);
+          }
+        }
+      }
+      out.push(`data: ${JSON.stringify(evt)}`);
+    }
+    return out.join('\n');
+  };
+
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buf += decoder.decode(value, { stream: true });
+      let i;
+      while ((i = buf.indexOf('\n\n')) !== -1) {
+        nodeRes.write(handleBlock(buf.slice(0, i)) + '\n\n');
+        buf = buf.slice(i + 2);
+      }
+    }
+    if (buf) nodeRes.write(handleBlock(buf));
+  } finally {
+    nodeRes.end();
+  }
+}
+
 // Pipe a fetch Response body (web ReadableStream) through the restorer into a
 // Node response. Works on raw bytes decoded as UTF-8 — fine because placeholders
 // are ASCII, so even if a multibyte char is split the token bytes are intact.