@chatpanel/gateway 0.6.19 → 0.6.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.19",
+  "version": "0.6.20",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/models.js

@@ -36,3 +36,12 @@ export const MODEL_CATALOG = [
 export function isKnownModel(id) {
   return MODEL_CATALOG.some((m) => m.id === id);
 }
+
+// Accept a user-supplied ("bring your own") NER model id. STRICT `org/name` shape,
+// no path traversal. We can't verify it's token-classification from the id alone —
+// the engine fails open if the download/labels don't fit. Custom ids fetch from
+// Hugging Face directly (the engine points remoteHost there for the custom load).
+export function isValidCustomModelId(id) {
+  const s = String(id || '');
+  return /^[A-Za-z0-9][\w.-]*\/[\w.-]+$/.test(s) && !s.includes('..');
+}

package/src/ner-engine.js

@@ -17,6 +17,7 @@
 import os from 'node:os';
 import { join } from 'node:path';
 import { existsSync, mkdirSync } from 'node:fs';
+import { isKnownModel } from './models.js';
 
 const DEFAULT_MODEL = 'Xenova/bert-base-NER';
 
@@ -199,8 +200,15 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true } = {})
     return false;
   }
 
+  // Curated catalog models come from the private dl.chatpanel.net mirror
+  // (ensureLib set that as remoteHost). A user's BYO id isn't mirrored, so fetch
+  // it from Hugging Face directly — only for this load, then restore.
+  const prevHost = lib.env.remoteHost;
+  const isCustom = !isKnownModel(modelId);
+  if (!haveLocal && isCustom) { try { lib.env.remoteHost = 'https://huggingface.co/'; } catch { /* optional */ } }
+
   _state = haveLocal ? 'loading' : 'downloading';
-  if (!haveLocal) { _progress = { model: modelId, file: null, pct: 0 }; log(`[ner] downloading model ${modelId} (one-time)…`); }
+  if (!haveLocal) { _progress = { model: modelId, file: null, pct: 0 }; log(`[ner] downloading model ${modelId} (one-time${isCustom ? ', from Hugging Face' : ''})…`); }
 
   try {
     const pipe = await lib.pipeline('token-classification', modelId, {
@@ -227,6 +235,8 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true } = {})
     else { _state = 'error'; }
     log(`[ner] model load failed (${e.message})${prevPipe ? ' — keeping previous model' : ' — deterministic-only'}`);
     return false;
+  } finally {
+    try { lib.env.remoteHost = prevHost; } catch { /* optional */ } // restore the mirror
   }
 }
 

package/src/server.js

@@ -33,7 +33,7 @@ import { createHistoryStore } from './sqlite-store.js';
 import { ingestBackup } from './backup-ingest.js';
 import * as nerEngine from './ner-engine.js';
 import * as sttEngine from './stt-engine.js';
-import { MODEL_CATALOG, isKnownModel } from './models.js';
+import { MODEL_CATALOG, isKnownModel, isValidCustomModelId } from './models.js';
 import { STT_MODEL_CATALOG, isKnownSttModel, isValidCustomSttId, DEFAULT_STT_MODEL } from './stt-models.js';
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
 import { publicConfig, applyConfigPatch, persistConfig, configPath } from './configstore.js';
@@ -42,7 +42,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.19';
+export const VERSION = '0.6.20';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -632,9 +632,14 @@ export function createGateway(cfg = loadConfig()) {
     // model (downloading it first if needed) and persists the choice.
     if (pathname === '/ner/models') {
       if (req.method === 'GET') {
-        const available = MODEL_CATALOG.map((m) => ({ ...m, installed: nerEngine.modelOnDisk(m.id) }));
+        const active = nerEngine.health().model || cfg.ner?.model || null;
+        const available = /** @type {any[]} */ (MODEL_CATALOG.map((m) => ({ ...m, installed: nerEngine.modelOnDisk(m.id) })));
+        // Surface an active BYO (non-catalog) model so the UI shows it too.
+        if (active && !available.some((m) => m.id === active)) {
+          available.push({ id: active, label: active, lang: '—', custom: true, installed: nerEngine.modelOnDisk(active), note: 'Custom model (from Hugging Face).' });
+        }
         return sendJson(res, 200, {
-          active: nerEngine.health().model || cfg.ner?.model || null,
+          active,
           state: nerEngine.state(),
           progress: nerEngine.progress(),
           available,
@@ -643,8 +648,9 @@ export function createGateway(cfg = loadConfig()) {
       if (req.method === 'POST') {
         let body = null;
         try { body = JSON.parse((await readBody(req, cfg.maxBodyBytes)).toString('utf8')); } catch { body = null; }
-        const id = body && typeof body.id === 'string' ? body.id : null;
-        if (!id || !isKnownModel(id)) return sendJson(res, 400, { error: { message: 'unknown model id', type: 'bad_model' } });
+        const id = body && typeof body.id === 'string' ? body.id.trim() : null;
+        // Curated catalog OR a strictly-validated BYO id (org/name, from HF).
+        if (!id || !(isKnownModel(id) || isValidCustomModelId(id))) return sendJson(res, 400, { error: { message: 'unknown or invalid model id', type: 'bad_model' } });
         // Persist first so a restart keeps the choice, then (re)load. Don't block the
         // response on a possibly-long download — the client polls GET for progress.
         if (cfg.ner) cfg.ner.model = id; else cfg.ner = { autostart: true, model: id, allowDownload: true, enableFullTier: true };

package/src/stt-engine.js

@@ -44,6 +44,7 @@ let _pipe = null;          // the loaded automatic-speech-recognition pipeline
 let _err = null;           // last error message (for /health)
 let _initPromise = null;   // single-flight init
 let _progress = null;      // { model, file, pct } while downloading, else null
+let _dtype = null;         // the quantization actually loaded (fp32 on WASM, q8 native)
 
 // transformers.js dtype → the ONNX filename suffix it loads. Presence must check
 // the EXACT file the current runtime will fetch — otherwise a q8 install (native)
@@ -70,7 +71,7 @@ export function isReady() { return _state === 'ready' && !!_pipe; }
 export function progress() { return _progress; }
 
 export function health() {
-  return { configured: _state !== 'off', ok: isReady(), state: _state, model: _model, error: _err };
+  return { configured: _state !== 'off', ok: isReady(), state: _state, model: _model, dtype: _dtype, error: _err };
 }
 
 // (Re)load a model into _pipe. Same contract as ner-engine.loadModel: fail-open,
@@ -121,9 +122,9 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true } = {})
         }
       },
     });
-    _pipe = pipe; _model = modelId; _state = 'ready'; _err = null; _progress = null;
+    _pipe = pipe; _model = modelId; _state = 'ready'; _err = null; _progress = null; _dtype = dtype;
     if (prevPipe && prevPipe !== pipe) { try { await prevPipe.dispose?.(); } catch { /* ignore */ } }
-    log(`[stt] ready — model ${modelId} (in-process, offline) — local dictation active`);
+    log(`[stt] ready — model ${modelId} @ ${dtype} (in-process, offline) — local dictation active`);
     return true;
   } catch (e) {
     _err = e.message; _progress = null;