@chatpanel/gateway 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.1.1"
+    "@chatpanel/pii": "^0.2.1"
   },
   "homepage": "https://chatpanel.net",
   "repository": {

package/src/configstore.js

@@ -19,7 +19,7 @@ export function persistConfig(cfg, path = configPath()) {
     host: cfg.host, port: cfg.port, backend: cfg.backend,
     bridge: cfg.bridge, upstreams: cfg.upstreams, redaction: cfg.redaction,
     ner: cfg.ner, allowedOrigins: cfg.allowedOrigins, maxBodyBytes: cfg.maxBodyBytes,
-    pro: cfg.pro, logRequests: cfg.logRequests,
+    pro: cfg.pro, logRequests: cfg.logRequests, tools: cfg.tools,
   };
   writeFileSync(path, JSON.stringify(out, null, 2));
 }
@@ -44,6 +44,11 @@ export function publicConfig(cfg, { proUnlocked = false } = {}) {
     allowedOrigins: Array.isArray(cfg.allowedOrigins) ? cfg.allowedOrigins : [],
     pro: { unlocked: proUnlocked, hasToken: !!cfg.pro?.entitlementToken, free: cfg.pro?.free },
     logRequests: !!cfg.logRequests,
+    tools: {
+      autoNarrow: cfg.tools?.autoNarrow !== false,
+      maxPerTurn: Number(cfg.tools?.maxPerTurn) > 0 ? Number(cfg.tools.maxPerTurn) : 8,
+      narrowAll: !!cfg.tools?.narrowAll,
+    },
   };
 }
 
@@ -96,5 +101,12 @@ export function applyConfigPatch(cfg, patch = {}) {
     if (Number.isFinite(cap) && cap >= 0) cfg.pro.free.maxRequestsPerDay = cap;
   }
   if (typeof patch.logRequests === 'boolean') cfg.logRequests = patch.logRequests;
+  if (patch.tools && typeof patch.tools === 'object') {
+    cfg.tools = cfg.tools || {};
+    if ('autoNarrow' in patch.tools) cfg.tools.autoNarrow = !!patch.tools.autoNarrow;
+    if ('narrowAll' in patch.tools) cfg.tools.narrowAll = !!patch.tools.narrowAll;
+    const cap = Number(patch.tools.maxPerTurn);
+    if (Number.isFinite(cap) && cap >= 1) cfg.tools.maxPerTurn = Math.floor(cap);
+  }
   return cfg;
 }

package/src/openai.js

@@ -3,8 +3,9 @@
 // request body as in-place segments, and restores tokens in a non-streaming
 // response. (Streaming is restored generically in stream.js.)
 
+import { restoreText } from '@chatpanel/pii';
 import { segment } from './redact.js';
-import { restoreDeep } from './stream.js';
+import { restoreDeepAliases } from './stream.js';
 
 export function matches(pathname) {
   return /\/chat\/completions$/.test(pathname) || /\/completions$/.test(pathname);
@@ -58,10 +59,12 @@ export function restoreResponse(json, vault) {
   for (const choice of json?.choices || []) {
     const msg = choice?.message;
     if (!msg) continue;
-    if (typeof msg.content === 'string') msg.content = restoreDeep(msg.content, vault);
+    // Visible text keeps the pseudonym (restoreText); tool-call args get the REAL
+    // value (restoreDeepAliases) so the client runs the tool on real data.
+    if (typeof msg.content === 'string') msg.content = restoreText(msg.content, vault);
     for (const tc of msg.tool_calls || []) {
       if (tc?.function && typeof tc.function.arguments === 'string') {
-        tc.function.arguments = restoreDeep(tc.function.arguments, vault);
+        tc.function.arguments = restoreDeepAliases(tc.function.arguments, vault);
       }
     }
   }

package/src/server.js

@@ -20,8 +20,8 @@
 import { createServer } from 'node:http';
 import { loadConfig } from './config.js';
 import { redactSegments } from './redact.js';
-import { pipeRestoredStream, makeTokenRestorer } from './stream.js';
-import { restoreText, effectiveTier, gatedDictionary } from '@chatpanel/pii';
+import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
+import { restoreText, effectiveTier, gatedDictionary, narrowSpecs } from '@chatpanel/pii';
 import { streamBridgeChat, readBridgeToken, openBridgeChat } from './bridge.js';
 import { createRelaySession, getRelaySession, endRelaySession, pumpBridgeStream, deliverToolResult, toolsToSpecs, parseToolCallId } from './toolrelay.js';
 import { shaperFor } from './shape.js';
@@ -33,10 +33,40 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.3.0';
+export const VERSION = '0.4.0';
 
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);
 
+// Auto-narrow: arm only the top-K most-relevant MCP tools per turn (speed). Mirrors
+// the extension's AUTO mode via the SAME shared ranker. We narrow only tools whose
+// name looks like an MCP tool (server-prefixed) so a client's CORE tools (bash,
+// read, edit…) are never dropped — that would break agent clients like OpenCode.
+const DEFAULT_GATEWAY_TOOL_CAP = 8;
+const MCP_NAME_RE = /^mcp[_-]/i;
+const toolName = (t) => (t && t.function && t.function.name) || (t && t.name) || '';
+const toolDesc = (t) => (t && t.function && t.function.description) || (t && t.description) || '';
+
+// Flatten message/content shapes to the latest user text — the query we rank tools against.
+function textFromContent(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) return content.map((p) => (typeof p === 'string' ? p : (p && (p.text || p.content)) || '')).join(' ');
+  return '';
+}
+function latestUserText(body, kind) {
+  if (!body) return '';
+  if (kind === 'responses') {
+    const inp = body.input;
+    if (typeof inp === 'string') return inp;
+    if (Array.isArray(inp)) return inp.map((x) => textFromContent(x && (x.content ?? x))).join(' ');
+    return '';
+  }
+  const msgs = Array.isArray(body.messages) ? body.messages : [];
+  for (let i = msgs.length - 1; i >= 0; i--) {
+    if (msgs[i] && msgs[i].role === 'user') return textFromContent(msgs[i].content);
+  }
+  return '';
+}
+
 const HOP_BY_HOP = new Set([
   'host', 'connection', 'content-length', 'transfer-encoding',
   'accept-encoding', 'content-encoding', 'keep-alive',
@@ -236,7 +266,7 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
 
 // ---- backend: api ----------------------------------------------------------
 
-async function handleApi(req, res, { adapter, pathname, search, base, destKey, destProtocol }, outBody, vault) {
+async function handleApi(req, res, { adapter, kind, pathname, search, base, destKey, destProtocol }, outBody, vault) {
   let upstream;
   try {
     const headers = forwardHeaders(req.headers, base);
@@ -261,7 +291,10 @@ async function handleApi(req, res, { adapter, pathname, search, base, destKey, d
 
   if (ct.includes('text/event-stream') && upstream.body) {
     res.writeHead(upstream.status, resHeaders);
-    return pipeRestoredStream(upstream.body, res, vault);
+    // OpenAI streaming: restore tool-call args with real values (aliases undone)
+    // while keeping visible text pseudonymized. Other protocols: generic restore.
+    const pipe = kind === 'openai' ? pipeRestoredOpenAIStream : pipeRestoredStream;
+    return pipe(upstream.body, res, vault);
   }
 
   const buf = Buffer.from(await upstream.arrayBuffer());
@@ -342,10 +375,24 @@ export function createGateway(cfg = loadConfig()) {
     let body = null;
     let outBody = raw;
     let redactedCount = 0;
+    let narrowedTools = 0;
     let isPro = true;
     if (r.redactable && req.method === 'POST' && raw.length) {
       try { body = JSON.parse(raw.toString('utf8')); } catch { body = null; }
       if (body) {
+        // Auto-narrow tools to the top-K most relevant for this turn (speed) —
+        // same shared ranker as the extension's AUTO mode. Only MCP-named tools
+        // are narrowed; the client's core tools (bash/read/edit…) are always kept,
+        // unless tools.narrowAll is set. Mutates body.tools BEFORE redaction so
+        // both the API forward and the bridge relay see the trimmed set.
+        const tcfg = cfg.tools || {};
+        if (tcfg.autoNarrow !== false && Array.isArray(body.tools) && body.tools.length) {
+          const cap = Number(tcfg.maxPerTurn) > 0 ? Number(tcfg.maxPerTurn) : DEFAULT_GATEWAY_TOOL_CAP;
+          const keep = tcfg.narrowAll ? null : (t) => !MCP_NAME_RE.test(toolName(t));
+          const before = body.tools.length;
+          body.tools = narrowSpecs(body.tools, latestUserText(body, r.kind), { cap, keep, name: toolName, description: toolDesc });
+          narrowedTools = before - body.tools.length;
+        }
         // Free/Pro gate: meter the request and pick the effective tier.
         isPro = await resolvePro(cfg.pro?.entitlementToken);
         const allow = meter(cfg, isPro);
@@ -369,8 +416,8 @@ export function createGateway(cfg = loadConfig()) {
     // API we forward to). Falls back to the legacy backend when none configured.
     const dest = resolveDestination(body?.model, cfg, r.kind);
     if (cfg.logRequests && r.redactable) {
-      recordRequest({ t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount });
-      console.log(`[gateway] ${req.method} ${pathname} · model=${body?.model || '-'} → ${dest ? `${dest.id}(${dest.type})` : 'none'} · redacted ${redactedCount}`);
+      recordRequest({ t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, narrowed: narrowedTools });
+      console.log(`[gateway] ${req.method} ${pathname} · model=${body?.model || '-'} → ${dest ? `${dest.id}(${dest.type})` : 'none'} · redacted ${redactedCount}${narrowedTools ? ` · narrowed -${narrowedTools} tools` : ''}`);
     }
     if (dest && dest.type === 'api') {
       if (!dest.baseUrl) return sendJson(res, 502, { error: `destination "${dest.id}" has no baseUrl` });

package/src/stream.js

@@ -12,7 +12,7 @@
 // agent unchanged — its defined "permanent substitution" behavior. Only reversible
 // [[TYPE_n]] tokens are restored here.
 
-import { restoreText } from '@chatpanel/pii';
+import { restoreText, restoreWithAliases } from '@chatpanel/pii';
 
 // Returns a TransformStream-free chunk transformer: feed it decoded string chunks,
 // it returns the prefix that's safe to forward now and buffers a possibly-partial
@@ -60,6 +60,97 @@ export function restoreDeep(value, vault) {
   return value;
 }
 
+// Deep-restore for tool-call argument values (non-stream), undoing aliases too —
+// so a client running tools LOCALLY gets the REAL value (pseudonyms included),
+// while the model stays blinded. Mirrors the extension's restoreDeep.
+export function restoreDeepAliases(value, vault) {
+  if (!vault) return value;
+  if (typeof value === 'string') return restoreWithAliases(value, vault);
+  if (Array.isArray(value)) return value.map((v) => restoreDeepAliases(v, vault));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const k of Object.keys(value)) out[k] = restoreDeepAliases(value[k], vault);
+    return out;
+  }
+  return value;
+}
+
+// A per-field tail-buffered restorer (holds a partial trailing [[token). `restoreFn`
+// is restoreText for VISIBLE text (keep pseudonyms) or restoreWithAliases for
+// TOOL-CALL args (real values).
+function makeFieldRestorer(vault, restoreFn) {
+  let buf = '';
+  return {
+    push(chunk) {
+      buf += chunk || '';
+      const open = buf.lastIndexOf('[[');
+      let safe;
+      if (open !== -1 && !buf.slice(open).includes(']]')) { safe = buf.slice(0, open); buf = buf.slice(open); }
+      else { safe = buf; buf = ''; }
+      return restoreFn(safe, vault);
+    },
+    flush() { const out = restoreFn(buf, vault); buf = ''; return out; },
+  };
+}
+
+// OpenAI streaming restorer that restores VISIBLE content with restoreText (the
+// model + user keep the pseudonym) but TOOL-CALL argument deltas with
+// restoreWithAliases (the client runs the tool on the REAL value). Passes through
+// any non-JSON event untouched.
+export async function pipeRestoredOpenAIStream(upstreamBody, nodeRes, vault) {
+  const reader = upstreamBody.getReader();
+  const decoder = new TextDecoder();
+  let buf = '';
+  const contentR = makeFieldRestorer(vault, restoreText);
+  const argRs = new Map(); // tool_call index -> field restorer (aliases)
+
+  const handleBlock = (block) => {
+    const out = [];
+    for (const line of block.split('\n')) {
+      if (!line.startsWith('data:')) { out.push(line); continue; }
+      const payload = line.slice(5).replace(/^\s/, '');
+      if (!payload) { out.push(line); continue; }
+      if (payload === '[DONE]') {
+        const tail = contentR.flush();
+        if (tail) out.push(`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: tail }, finish_reason: null }] })}`);
+        out.push(line);
+        continue;
+      }
+      let evt; try { evt = JSON.parse(payload); } catch { out.push(line); continue; }
+      for (const choice of evt.choices || []) {
+        const d = choice.delta;
+        if (!d) continue;
+        if (typeof d.content === 'string') d.content = contentR.push(d.content);
+        for (const tc of d.tool_calls || []) {
+          const idx = typeof tc.index === 'number' ? tc.index : 0;
+          if (tc.function && typeof tc.function.arguments === 'string') {
+            if (!argRs.has(idx)) argRs.set(idx, makeFieldRestorer(vault, restoreWithAliases));
+            tc.function.arguments = argRs.get(idx).push(tc.function.arguments);
+          }
+        }
+      }
+      out.push(`data: ${JSON.stringify(evt)}`);
+    }
+    return out.join('\n');
+  };
+
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buf += decoder.decode(value, { stream: true });
+      let i;
+      while ((i = buf.indexOf('\n\n')) !== -1) {
+        nodeRes.write(handleBlock(buf.slice(0, i)) + '\n\n');
+        buf = buf.slice(i + 2);
+      }
+    }
+    if (buf) nodeRes.write(handleBlock(buf));
+  } finally {
+    nodeRes.end();
+  }
+}
+
 // Pipe a fetch Response body (web ReadableStream) through the restorer into a
 // Node response. Works on raw bytes decoded as UTF-8 — fine because placeholders
 // are ASCII, so even if a multibyte char is split the token bytes are intact.