@chatpanel/gateway 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/openai.js

@@ -3,8 +3,9 @@
 // request body as in-place segments, and restores tokens in a non-streaming
 // response. (Streaming is restored generically in stream.js.)
 
+import { restoreText } from '@chatpanel/pii';
 import { segment } from './redact.js';
-import { restoreDeep } from './stream.js';
+import { restoreDeepAliases } from './stream.js';
 
 export function matches(pathname) {
   return /\/chat\/completions$/.test(pathname) || /\/completions$/.test(pathname);
@@ -58,10 +59,12 @@ export function restoreResponse(json, vault) {
   for (const choice of json?.choices || []) {
     const msg = choice?.message;
     if (!msg) continue;
-    if (typeof msg.content === 'string') msg.content = restoreDeep(msg.content, vault);
+    // Visible text keeps the pseudonym (restoreText); tool-call args get the REAL
+    // value (restoreDeepAliases) so the client runs the tool on real data.
+    if (typeof msg.content === 'string') msg.content = restoreText(msg.content, vault);
     for (const tc of msg.tool_calls || []) {
       if (tc?.function && typeof tc.function.arguments === 'string') {
-        tc.function.arguments = restoreDeep(tc.function.arguments, vault);
+        tc.function.arguments = restoreDeepAliases(tc.function.arguments, vault);
       }
     }
   }

package/src/server.js

@@ -20,7 +20,7 @@
 import { createServer } from 'node:http';
 import { loadConfig } from './config.js';
 import { redactSegments } from './redact.js';
-import { pipeRestoredStream, makeTokenRestorer } from './stream.js';
+import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
 import { restoreText, effectiveTier, gatedDictionary } from '@chatpanel/pii';
 import { streamBridgeChat, readBridgeToken, openBridgeChat } from './bridge.js';
 import { createRelaySession, getRelaySession, endRelaySession, pumpBridgeStream, deliverToolResult, toolsToSpecs, parseToolCallId } from './toolrelay.js';
@@ -33,7 +33,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.3.0';
+export const VERSION = '0.3.1';
 
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);
 
@@ -236,7 +236,7 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
 
 // ---- backend: api ----------------------------------------------------------
 
-async function handleApi(req, res, { adapter, pathname, search, base, destKey, destProtocol }, outBody, vault) {
+async function handleApi(req, res, { adapter, kind, pathname, search, base, destKey, destProtocol }, outBody, vault) {
   let upstream;
   try {
     const headers = forwardHeaders(req.headers, base);
@@ -261,7 +261,10 @@ async function handleApi(req, res, { adapter, pathname, search, base, destKey, d
 
   if (ct.includes('text/event-stream') && upstream.body) {
     res.writeHead(upstream.status, resHeaders);
-    return pipeRestoredStream(upstream.body, res, vault);
+    // OpenAI streaming: restore tool-call args with real values (aliases undone)
+    // while keeping visible text pseudonymized. Other protocols: generic restore.
+    const pipe = kind === 'openai' ? pipeRestoredOpenAIStream : pipeRestoredStream;
+    return pipe(upstream.body, res, vault);
   }
 
   const buf = Buffer.from(await upstream.arrayBuffer());

package/src/stream.js

@@ -12,7 +12,7 @@
 // agent unchanged — its defined "permanent substitution" behavior. Only reversible
 // [[TYPE_n]] tokens are restored here.
 
-import { restoreText } from '@chatpanel/pii';
+import { restoreText, restoreWithAliases } from '@chatpanel/pii';
 
 // Returns a TransformStream-free chunk transformer: feed it decoded string chunks,
 // it returns the prefix that's safe to forward now and buffers a possibly-partial
@@ -60,6 +60,97 @@ export function restoreDeep(value, vault) {
   return value;
 }
 
+// Deep-restore for tool-call argument values (non-stream), undoing aliases too —
+// so a client running tools LOCALLY gets the REAL value (pseudonyms included),
+// while the model stays blinded. Mirrors the extension's restoreDeep.
+export function restoreDeepAliases(value, vault) {
+  if (!vault) return value;
+  if (typeof value === 'string') return restoreWithAliases(value, vault);
+  if (Array.isArray(value)) return value.map((v) => restoreDeepAliases(v, vault));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const k of Object.keys(value)) out[k] = restoreDeepAliases(value[k], vault);
+    return out;
+  }
+  return value;
+}
+
+// A per-field tail-buffered restorer (holds a partial trailing [[token). `restoreFn`
+// is restoreText for VISIBLE text (keep pseudonyms) or restoreWithAliases for
+// TOOL-CALL args (real values).
+function makeFieldRestorer(vault, restoreFn) {
+  let buf = '';
+  return {
+    push(chunk) {
+      buf += chunk || '';
+      const open = buf.lastIndexOf('[[');
+      let safe;
+      if (open !== -1 && !buf.slice(open).includes(']]')) { safe = buf.slice(0, open); buf = buf.slice(open); }
+      else { safe = buf; buf = ''; }
+      return restoreFn(safe, vault);
+    },
+    flush() { const out = restoreFn(buf, vault); buf = ''; return out; },
+  };
+}
+
+// OpenAI streaming restorer that restores VISIBLE content with restoreText (the
+// model + user keep the pseudonym) but TOOL-CALL argument deltas with
+// restoreWithAliases (the client runs the tool on the REAL value). Passes through
+// any non-JSON event untouched.
+export async function pipeRestoredOpenAIStream(upstreamBody, nodeRes, vault) {
+  const reader = upstreamBody.getReader();
+  const decoder = new TextDecoder();
+  let buf = '';
+  const contentR = makeFieldRestorer(vault, restoreText);
+  const argRs = new Map(); // tool_call index -> field restorer (aliases)
+
+  const handleBlock = (block) => {
+    const out = [];
+    for (const line of block.split('\n')) {
+      if (!line.startsWith('data:')) { out.push(line); continue; }
+      const payload = line.slice(5).replace(/^\s/, '');
+      if (!payload) { out.push(line); continue; }
+      if (payload === '[DONE]') {
+        const tail = contentR.flush();
+        if (tail) out.push(`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: tail }, finish_reason: null }] })}`);
+        out.push(line);
+        continue;
+      }
+      let evt; try { evt = JSON.parse(payload); } catch { out.push(line); continue; }
+      for (const choice of evt.choices || []) {
+        const d = choice.delta;
+        if (!d) continue;
+        if (typeof d.content === 'string') d.content = contentR.push(d.content);
+        for (const tc of d.tool_calls || []) {
+          const idx = typeof tc.index === 'number' ? tc.index : 0;
+          if (tc.function && typeof tc.function.arguments === 'string') {
+            if (!argRs.has(idx)) argRs.set(idx, makeFieldRestorer(vault, restoreWithAliases));
+            tc.function.arguments = argRs.get(idx).push(tc.function.arguments);
+          }
+        }
+      }
+      out.push(`data: ${JSON.stringify(evt)}`);
+    }
+    return out.join('\n');
+  };
+
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buf += decoder.decode(value, { stream: true });
+      let i;
+      while ((i = buf.indexOf('\n\n')) !== -1) {
+        nodeRes.write(handleBlock(buf.slice(0, i)) + '\n\n');
+        buf = buf.slice(i + 2);
+      }
+    }
+    if (buf) nodeRes.write(handleBlock(buf));
+  } finally {
+    nodeRes.end();
+  }
+}
+
 // Pipe a fetch Response body (web ReadableStream) through the restorer into a
 // Node response. Works on raw bytes decoded as UTF-8 — fine because placeholders
 // are ASCII, so even if a multibyte char is split the token bytes are intact.