@chatpanel/gateway 0.6.29 → 0.6.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.29",
+  "version": "0.6.31",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.2.12",
+    "@chatpanel/pii": "^0.2.14",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c"
   },

package/src/config.js

@@ -34,12 +34,9 @@ const DEFAULTS = {
   allowedOrigins: [],
   maxBodyBytes: 26214400,
 
-  // Monetization: the gateway is free to try, paid to rely on. Free = full-tier
-  // redaction (the real thing — NER names/orgs + dictionary) for a FIXED LIFETIME
-  // allowance (freegate.FREE_TOTAL_CAP redactions), then it stops. Paste a
-  // ChatPanel Pro entitlement token (the same offline-signed token the extension/
-  // bridge use) to unlock unlimited usage. `free.used` is the running lifetime
-  // count (server-authoritative; persisted here so it survives restarts).
+  // `free.used` is the running lifetime redaction count for the free allowance
+  // (freegate.FREE_TOTAL_CAP redactions at full tier), persisted here. A valid
+  // ChatPanel entitlement token unlocks unlimited use.
   pro: {
     entitlementToken: '',
     free: {

package/src/configstore.js

@@ -53,8 +53,7 @@ export function publicConfig(cfg, { proUnlocked = false } = {}) {
     ner: cfg.ner,
     stt: cfg.stt,
     allowedOrigins: Array.isArray(cfg.allowedOrigins) ? cfg.allowedOrigins : [],
-    // free = lifetime trial usage ({ used, cap, remaining }) — read-only; the cap
-    // is fixed and the count is server-authoritative (never settable from the UI).
+    // free = lifetime trial usage ({ used, cap, remaining }), read-only.
     pro: { unlocked: proUnlocked, hasToken: !!cfg.pro?.entitlementToken, free: usage(cfg) },
     logRequests: !!cfg.logRequests,
     logDetail: ['types', 'values'].includes(cfg.logDetail) ? cfg.logDetail : 'off',
@@ -112,9 +111,8 @@ export function applyConfigPatch(cfg, patch = {}) {
   if (Array.isArray(patch.allowedOrigins)) cfg.allowedOrigins = patch.allowedOrigins;
   if (patch.pro && typeof patch.pro === 'object') {
     if (typeof patch.pro.entitlementToken === 'string') cfg.pro.entitlementToken = patch.pro.entitlementToken;
-    // NOTE: the free trial is a FIXED lifetime cap (freegate.FREE_TOTAL_CAP) and
-    // its `used` count is server-authoritative — neither is editable here, so a
-    // client can't raise the cap or reset its own trial.
+    // The free allowance (freegate.FREE_TOTAL_CAP) and its `used` count are not
+    // part of the editable patch.
   }
   // Local dictation toggle. The MODEL is switched via POST /stt/models (like the
   // NER manager), not patched here.

package/src/entitlement-refresh.js

@@ -1,25 +1,15 @@
-// Online entitlement re-validation — closes the refund/revoke abuse window.
-//
-// The gateway stores ONE offline-signed entitlement token (pushed once from the
-// extension via POST /config). Verified purely offline (entitlement.js), that token
-// keeps unlocking Pro until its `exp` — up to 7 days — EVEN AFTER the subscription
-// is refunded, cancelled, or the seat is revoked. The extension/bridge avoid this
-// by re-polling the license worker; the gateway didn't, so a refund left unlimited
-// redaction open for the rest of the token's life.
-//
-// So we also re-check ONLINE on an interval: poll the worker's /entitlement for the
-// token's install_id and either
-//   • REFRESH the stored token (still entitled) — so it never lapses while paid, and
-//   • CLEAR it (worker says valid:false → refunded/cancelled/revoked) — dropping the
-//     gateway to Free immediately instead of riding the offline exp.
-// Network/worker errors NEVER revoke (fail-open for paying users); the offline `exp`
-// still bounds the worst case. Bounds post-refund Pro to <= CHECK_INTERVAL_MS.
+// Online entitlement re-validation. The gateway stores one offline-signed
+// entitlement token and verifies it offline (entitlement.js). On an interval it also
+// re-checks online: it polls the worker's /entitlement for the token's install_id and
+// either refreshes the stored token (still entitled) or clears it (worker reports
+// valid:false), dropping the gateway to Free. Network/worker errors never revoke
+// (fail-open); the offline `exp` still bounds the token's lifetime.
 
 import { persistConfig, configPath } from './configstore.js';
 
 // Same worker the extension/bridge use. Overridable for self-hosted/test.
 const API_BASE = (process.env.CHATPANEL_API_BASE || 'https://api.chatpanel.net').replace(/\/+$/, '');
-const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1h — the autonomous post-refund Pro window
+const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1h — online re-check interval
 const FIRST_CHECK_DELAY_MS = 30 * 1000;   // let the server settle before first poll
 const MIN_RECHECK_MS = 2 * 60 * 1000;     // throttle on-demand (/status) re-checks
 
@@ -63,7 +53,7 @@ async function revalidate(cfg) {
       try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
     }
   } else if (data && data.valid === false) {
-    // Refunded / cancelled / seat revoked → drop Pro NOW (don't wait out the exp).
+    // Worker reports the token is no longer valid → clear it and drop to Free.
     cfg.pro.entitlementToken = '';
     try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
     console.log('[gateway] entitlement no longer valid — Pro deactivated (refund/revoke/seat lost).');

package/src/entitlement.js

@@ -1,11 +1,6 @@
-// Offline Pro/Team entitlement verification — the HARD gate for paid features
-// (e.g. custom "bring your own CLI" agents).
-//
-// The license server (Cloudflare Worker) signs a compact entitlement token with
-// an ECDSA P-256 private key that lives ONLY there. The bridge ships the matching
-// PUBLIC key and verifies the signature locally — no network, no secret. A forked
-// client or a raw `curl` to the bridge can't forge entitlement without the
-// private key, so this is a real cryptographic gate, not a UI check.
+// Offline entitlement verification. The license server signs an ECDSA P-256 token;
+// the gateway ships the matching public key and verifies it locally. Gates paid
+// features such as custom "bring your own CLI" agents.
 //
 // Token format (identical to the extension's, extension/js/license.js):
 //   token   = base64url(JSON payload) + "." + base64url(raw ECDSA signature)

package/src/freegate.js

@@ -1,20 +1,11 @@
-// Free vs Pro for the gateway runtime — the "taste" gate.
-//
-// Free (no entitlement token): full-tier redaction works, but only for a fixed
-// LIFETIME number of redactions (FREE_TOTAL_CAP) — a real trial of the genuine
-// thing, then you buy. Pro (a valid ChatPanel entitlement token — the same
-// offline-signed token the extension and bridge use) unlocks UNLIMITED redaction.
-// The cryptographic check (entitlement.js) means a forked UI can't unlock it —
-// only the configured/paid token does.
-//
-// The cap is LIFETIME (overall), not per-day, and it is NOT user-editable — so a
-// free user gets exactly FREE_TOTAL_CAP genuine redactions, full stop. The count
-// persists in cfg.pro.free.used (written via configstore.persistConfig), so it
-// survives restarts.
+// Free vs Pro for the gateway runtime. Without an entitlement token, full-tier
+// redaction is available for a fixed lifetime number of redactions (FREE_TOTAL_CAP);
+// a valid ChatPanel entitlement token unlocks unlimited redaction. The count is
+// stored in cfg.pro.free.used (persisted via configstore.persistConfig).
 
 import { isProEntitled } from './entitlement.js';
 
-// The lifetime free allowance. Fixed — deliberately NOT configurable.
+// The lifetime free allowance.
 export const FREE_TOTAL_CAP = 100;
 
 const proCache = { token: null, val: false };
@@ -34,10 +25,10 @@ export async function resolvePro(token) {
   return val;
 }
 
-// May this request still redact? Pro = always. Free = allowed until the lifetime
-// cap is reached, then refused so the client gets a clear upsell. This only
-// CHECKS — the count is advanced by consume() AFTER a redaction actually happens,
-// so requests with nothing to redact don't burn the allowance.
+// May this request still redact? Pro = always; Free = allowed until the lifetime
+// cap is reached. This only CHECKS — consume() advances the count after a
+// redaction actually happens, so requests with nothing to redact don't consume
+// allowance.
 export function checkQuota(cfg, isPro) {
   if (isPro) return { allowed: true, remaining: Infinity, isPro: true };
   const used = Number(cfg.pro?.free?.used) || 0;

package/src/gateway-token.js

@@ -0,0 +1,60 @@
+// Per-install bearer token for the gateway's ADMIN routes (M2), mirroring the
+// bridge's model. The gateway proxies model traffic for any local client (the /v1/*
+// data plane stays open, no auth — that's the product), but its ADMIN surface
+// (reconfigure via POST /config, read /logs) must not be reachable by every local
+// process or by a drive-by localhost web page.
+//
+// Two ways to authenticate an admin call:
+//   • the ChatPanel extension — recognised by its chrome-/moz-extension:// Origin
+//     (a web page can't forge that; browsers set it honestly). The extension can't
+//     read a local file, so Origin is how IT authenticates.
+//   • a token — this 32-byte secret at ~/.chatpanel/gateway-token (0600), for a
+//     non-browser admin client (a setup script/CLI). A random local process doesn't
+//     have it.
+// Residual (same as the bridge): a MALICIOUS local process could forge the
+// extension Origin. A local attacker at that privilege level already owns much;
+// this still blocks web drive-by and benign no-Origin processes from the admin API.
+
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import os from 'node:os';
+
+const TOKEN_PATH = process.env.CHATPANEL_GATEWAY_TOKEN_PATH || join(os.homedir(), '.chatpanel', 'gateway-token');
+let TOKEN = '';
+
+// Load-or-create the token. Best-effort: token auth is hardening, never fail startup.
+export function ensureGatewayToken(path = TOKEN_PATH) {
+  try {
+    if (existsSync(path)) TOKEN = readFileSync(path, 'utf8').trim();
+    if (!TOKEN) {
+      TOKEN = randomBytes(32).toString('hex');
+      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+      writeFileSync(path, TOKEN, { mode: 0o600 });
+      try { chmodSync(path, 0o600); } catch { /* non-POSIX */ }
+    }
+  } catch (e) {
+    console.warn(`[gateway] could not initialise admin token: ${e?.message || e}`);
+  }
+  return TOKEN;
+}
+
+export function isExtensionOrigin(origin) {
+  return typeof origin === 'string' && (/^chrome-extension:\/\//.test(origin) || /^moz-extension:\/\//.test(origin));
+}
+
+function tokenMatches(headers) {
+  if (!TOKEN) return false;
+  const h = String(headers?.authorization || '');
+  const provided = (h.startsWith('Bearer ') ? h.slice(7) : String(headers?.['x-chatpanel-token'] || '')).trim();
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+// True when a request may reach an ADMIN route: the extension (by Origin) or a
+// token-bearing client.
+export function isAdminAuthorized(req) {
+  return isExtensionOrigin(req.headers?.origin) || tokenMatches(req.headers);
+}

package/src/model-hashes.json

@@ -0,0 +1,3 @@
+{
+  "_README": "SHA-256 hashes of curated model weight files, keyed by modelId then by path relative to the model's cache dir (~/.chatpanel/models/<org>/<name>/). Generated on a TRUSTED host by tools/gen-model-hashes.mjs — do NOT hand-edit. Empty = verification is warn-and-allow (no protection yet); populate to enable fail-closed integrity checking. Keys starting with '_' are ignored by the loader."
+}

package/src/model-integrity.js

@@ -0,0 +1,82 @@
+// Model-weight integrity verification (H3).
+//
+// The gateway downloads ONNX model weights (NER / Whisper / Parakeet) from the
+// dl.chatpanel.net mirror or Hugging Face and loads them straight into an ONNX
+// runtime. A compromised mirror, an HF repo takeover, or a MITM on a downgraded
+// connection could therefore feed a malicious model into native code. This module
+// verifies a downloaded model's weight files against committed SHA-256 hashes.
+//
+// Design (deliberately non-breaking):
+//   • Hashes live in the committed `model-hashes.json` — a { modelId: { relPath:
+//     sha256 } } map generated on a TRUSTED host by `tools/gen-model-hashes.mjs`.
+//   • FAIL-CLOSED only on a genuine mismatch: a listed file whose hash differs is
+//     deleted and the load is refused (throws). That's the security event.
+//   • WARN-AND-ALLOW everywhere else: a model not in the manifest, or a listed file
+//     not yet on disk, logs loudly and proceeds — so an empty/partial manifest never
+//     bricks model loading, and shipping the mechanism before the hashes are
+//     populated is safe. (Populate on a trusted machine to switch protection on.)
+//   • Verified on the DOWNLOAD path (when weights first arrive from the network —
+//     the supply-chain moment), not on every offline load (avoids re-hashing 100s of
+//     MB each boot).
+
+import { createHash } from 'node:crypto';
+import { readFileSync, existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MANIFEST_PATH = fileURLToPath(new URL('./model-hashes.json', import.meta.url));
+let _manifest = null;
+
+// { modelId: { 'onnx/model_quantized.onnx': '<sha256>' , … } }. Keys starting with
+// '_' are metadata (schema note) and ignored. Missing/invalid file → empty map
+// (verification simply becomes warn-and-allow for everything).
+export function loadHashManifest(path = MANIFEST_PATH) {
+  if (_manifest && path === MANIFEST_PATH) return _manifest;
+  let parsed = {};
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    for (const [k, v] of Object.entries(raw)) {
+      if (!k.startsWith('_') && v && typeof v === 'object') parsed[k] = v;
+    }
+  } catch { parsed = {}; }
+  if (path === MANIFEST_PATH) _manifest = parsed;
+  return parsed;
+}
+
+export function sha256File(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+
+// Verify a model's weight files under `modelsDir`. Returns a result object; THROWS
+// only on a real hash mismatch (fail-closed). `modelsDir` is the model cache root
+// (e.g. ~/.chatpanel/models); the per-model dir is modelsDir/<org>/<name>.
+/**
+ * @param {string} modelId
+ * @param {{ modelsDir?: string, log?: (msg: string) => void, manifest?: Record<string, Record<string, string>> }} [opts]
+ */
+export function verifyModelWeights(modelId, { modelsDir, log = () => {}, manifest = loadHashManifest() } = {}) {
+  const expected = manifest[modelId];
+  if (!expected || Object.keys(expected).length === 0) {
+    log(`[integrity] no recorded hashes for ${modelId} — skipping verification `
+      + `(run tools/gen-model-hashes.mjs on a trusted host to enable)`);
+    return { verified: false, reason: 'unlisted', checked: 0 };
+  }
+  const dir = join(modelsDir, ...modelId.split('/'));
+  let checked = 0;
+  for (const [rel, wantSha] of Object.entries(expected)) {
+    const p = join(dir, ...rel.split('/'));
+    if (!existsSync(p)) { log(`[integrity] ${modelId}: listed file ${rel} not on disk — skipping`); continue; }
+    const gotSha = sha256File(p);
+    if (gotSha !== wantSha) {
+      try { rmSync(p); } catch { /* best effort */ }
+      throw new Error(
+        `[integrity] ${modelId}/${rel} SHA-256 mismatch `
+        + `(expected ${wantSha.slice(0, 12)}…, got ${gotSha.slice(0, 12)}…) — `
+        + `deleted the file and refusing to load a tampered model`,
+      );
+    }
+    checked++;
+  }
+  if (checked) log(`[integrity] ${modelId}: ${checked} weight file(s) verified ✓`);
+  return { verified: checked > 0, reason: checked ? 'ok' : 'no-files-present', checked };
+}

package/src/ner-engine.js

@@ -19,6 +19,7 @@ import { join } from 'node:path';
 import { existsSync, mkdirSync } from 'node:fs';
 import { isKnownModel } from './models.js';
 import { isLoopbackHost, isPrivateHost, isMetadataHost } from '@chatpanel/pii';
+import { verifyModelWeights } from './model-integrity.js';
 
 const DEFAULT_MODEL = 'Xenova/bert-base-NER';
 const DEFAULT_MODEL_HOST = 'https://dl.chatpanel.net/models/';
@@ -256,6 +257,20 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true } = {})
       lib.env.allowRemoteModels = true;
       pipe = await lib.pipeline('token-classification', modelId, { dtype: 'q8', progress_callback });
     }
+    // H3: verify freshly-downloaded weights against committed hashes before we trust
+    // this pipeline. On a mismatch, dispose it (never use its outputs) and let the
+    // throw fall through to the catch (keeps the previous model / deterministic-only).
+    // NOTE: transformers downloads+loads in one call, so this runs POST-load — it
+    // prevents USING and PERSISTING a tampered model, not a hypothetical ORT
+    // parse-time bug. Warn-and-allow when the model isn't in the hash manifest.
+    if (!haveLocal) {
+      try {
+        verifyModelWeights(modelId, { modelsDir: modelRoot(), log });
+      } catch (e) {
+        try { await pipe.dispose?.(); } catch { /* ignore */ }
+        throw e;
+      }
+    }
     // Swap in the new pipeline, dispose the old one (free its WASM/native session).
     _pipe = pipe; _model = modelId; _state = 'ready'; _err = null; _progress = null;
     if (prevPipe && prevPipe !== pipe) { try { await prevPipe.dispose?.(); } catch { /* ignore */ } }

package/src/redact.js

@@ -14,10 +14,10 @@ import * as engine from './ner-engine.js';
 // tier: 'basic' | 'full'. For 'full' we run the local detector over the combined
 // text to harvest names/orgs, then redact every segment against that entity set.
 //
-// Free vs Pro on the gateway: the free trial is limited by a REQUEST QUOTA
-// (freegate.js), not by downgrading quality — so free users get the REAL tier
-// (names/orgs via NER) within their allowance. The custom dictionary, though, is
-// still a Pro power feature: gatedDictionary caps it to FREE_DICT_LIMIT for free.
+// Free use is bounded by a request quota (freegate.js), not by downgrading
+// quality — free requests get the full tier (names/orgs via NER) within their
+// allowance. The custom dictionary is capped for free: gatedDictionary limits it
+// to FREE_DICT_LIMIT via the shared chatpanel-pii gate.
 export async function redactSegments(segments, redactionCfg, { signal, isPro = true } = {}) {
   const vault = createVault();
 
@@ -38,7 +38,7 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
   const texts = segments.map((s) => s.get()).filter((t) => typeof t === 'string' && t);
   if (texts.length === 0) return { vault, count: 0, sanitized };
 
-  // Use the configured tier as-is (no free downgrade — the quota is the free gate),
+  // Use the configured tier as-is (no free downgrade — the quota bounds free use),
   // but keep the dictionary capped for free via the shared chatpanel-pii gate.
   const tier = redactionCfg.tier === 'full' ? 'full' : 'basic';
   const dictionary = gatedDictionary(redactionCfg, isPro);

package/src/router.js

@@ -11,7 +11,7 @@
 //     models: [..],             models this destination serves (for /v1/models)
 //   }
 
-import { assertEndpointUrl } from '@chatpanel/pii';
+import { secureFetch } from './secure-fetch.js';
 //
 // /v1/models aggregates every destination's models so clients can discover them.
 
@@ -89,8 +89,8 @@ export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
         if (d.protocol === 'anthropic') { headers['x-api-key'] = d.apiKey; headers['anthropic-version'] = '2023-06-01'; }
         else headers.authorization = `Bearer ${d.apiKey}`;
       }
-      const modelsUrl = assertEndpointUrl(`${d.baseUrl.replace(/\/$/, '')}/models`).toString(); // SSRF guard (skips a blocked dest via the catch)
-      const res = await fetch(modelsUrl, { headers, signal: ctrl.signal });
+      // secureFetch: SSRF guard (scheme/host + resolved-IP); a blocked dest throws → skipped via the catch.
+      const res = await secureFetch(`${d.baseUrl.replace(/\/$/, '')}/models`, { headers, signal: ctrl.signal });
       if (!res.ok) return;
       const j = await res.json();
       const list = Array.isArray(j?.data) ? j.data : (Array.isArray(j?.models) ? j.models : []);

package/src/secure-fetch.js

@@ -0,0 +1,58 @@
+// Node-side SSRF-hardened fetch (M1). The shared @chatpanel/pii/net.js classifier is
+// browser-safe and can only match on the URL's HOSTNAME string — so a public name
+// whose A/AAAA record resolves to a private/metadata IP (DNS-rebinding at the fetch
+// layer) slips past it. Node CAN resolve DNS, so here we additionally validate every
+// RESOLVED address against the same policy, and revalidate on each redirect hop.
+//
+// Policy defaults to the ENDPOINT context (loopback + LAN allowed — Ollama / a LAN
+// model box are legitimate gateway upstreams — but cloud metadata never). So in
+// practice the DNS check blocks a hostname that resolves to cloud metadata; the
+// redirect revalidation blocks a public upstream that 3xx-redirects to a blocked host.
+//
+// Residual (documented): we validate the resolved IPs but do NOT pin the socket to
+// them, so a sub-second TOCTOU window between lookup and connect remains. Closing it
+// fully needs a custom undici dispatcher; the resolved-IP check already removes the
+// easy DNS-rebinding cases, which is the point of M1.
+
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { assertEndpointUrl, isBlockedHost } from '@chatpanel/pii';
+
+const ENDPOINT_POLICY = { allowLoopback: true, allowPrivate: true };
+const isLiteralIp = (h) => /^\d{1,3}(\.\d{1,3}){3}$/.test(h) || h.includes(':');
+
+// Reject if ANY resolved address is blocked under `policy`. A literal-IP host is
+// already covered by the URL check, so skip DNS for it. A resolution failure is left
+// for fetch() to surface (don't mask a real network error as a security error).
+async function assertResolvedIps(hostname, policy, lookupFn) {
+  if (isLiteralIp(hostname)) return;
+  let addrs;
+  try { addrs = await lookupFn(hostname, { all: true }); } catch { return; }
+  for (const { address } of addrs) {
+    if (isBlockedHost(address, policy)) {
+      throw new Error(`refusing to reach ${hostname} — it resolves to a blocked address (${address})`);
+    }
+  }
+}
+
+// secureFetch(url, { policy?, maxRedirects?, lookupFn?, fetchFn?, ...init })
+// Validates the URL (scheme + host policy) AND its resolved IPs before each request,
+// following redirects manually so every hop is re-checked. Returns the final Response.
+// `...init` forwards any standard fetch options (method, headers, body, signal, …).
+/**
+ * @param {string|URL} url
+ * @param {any} [opts]
+ */
+export async function secureFetch(url, {
+  policy = ENDPOINT_POLICY, maxRedirects = 5, lookupFn = dnsLookup, fetchFn = fetch, ...init
+} = {}) {
+  let current = assertEndpointUrl(url, policy);
+  for (let hop = 0; ; hop++) {
+    await assertResolvedIps(current.hostname, policy, lookupFn);
+    const res = await fetchFn(current.toString(), { ...init, redirect: 'manual' });
+    const loc = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+    if (!loc) return res;
+    if (hop >= maxRedirects) throw new Error('too many redirects');
+    current = assertEndpointUrl(new URL(loc, current).toString(), policy); // revalidate the hop
+    try { res.body?.cancel?.(); } catch { /* free the redirect body */ }
+  }
+}

package/src/server.js

@@ -23,6 +23,8 @@ import { startEntitlementRefresh, maybeRevalidate } from './entitlement-refresh.
 import { redactSegments, segment } from './redact.js';
 import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
 import { restoreText, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote, assertEndpointUrl } from '@chatpanel/pii';
+import { ensureGatewayToken, isAdminAuthorized } from './gateway-token.js';
+import { secureFetch } from './secure-fetch.js';
 import { streamBridgeChat, readBridgeToken, openBridgeChat } from './bridge.js';
 import { createRelaySession, getRelaySession, endRelaySession, pumpBridgeStream, deliverToolResult, toolsToSpecs, parseToolCallId } from './toolrelay.js';
 import { shaperFor } from './shape.js';
@@ -43,7 +45,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.29';
+export const VERSION = '0.6.31';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -255,8 +257,8 @@ async function probeNerHealth(cfg) {
   const url = nerBaseUrl(cfg);
   if (!url) return { configured: false, ok: false, url: null, model: null };
   try {
-    const healthUrl = assertEndpointUrl(url.replace(/\/ner\/?$/, '') + '/health').toString();
-    const r = await fetch(healthUrl, { signal: AbortSignal.timeout(2000) });
+    // secureFetch: scheme + host policy AND resolved-IP validation (DNS-rebinding).
+    const r = await secureFetch(url.replace(/\/ner\/?$/, '') + '/health', { signal: AbortSignal.timeout(2000) });
     if (!r.ok) return { configured: true, ok: false, url, model: null };
     const j = await r.json().catch(() => ({}));
     return { configured: true, ok: true, url, model: j.model || null };
@@ -307,8 +309,8 @@ async function startRelay(req, res, { kind, adapter, agent }, body, vault, cfg,
   const { messages, system } = adapter.toTurn(body);
   const token = readBridgeToken(cfg.bridge.token);
   const shaper = shaperFor(kind, body?.model || agent);
-  // Full tier for everyone here (the free allowance is enforced by the quota gate
-  // in the main handler), but the custom dictionary stays capped for free.
+  // Full tier for everyone here (the free allowance is enforced in the main
+  // handler), but the custom dictionary stays capped for free.
   const redactOpts = { tier: cfg.redaction.tier === 'full' ? 'full' : 'basic', dictionary: gatedDictionary(cfg.redaction, isPro), entities: [] };
   const s = createRelaySession({ vault, redactOpts, bridgeUrl: cfg.bridge.url, token, harness });
   const ttl = setTimeout(() => endRelaySession(s.id), 135_000); // bridge tool-call timeout is 120s
@@ -497,6 +499,26 @@ export function createGateway(cfg = loadConfig()) {
     if (req.headers.origin) setCors(res, req.headers.origin);
     if (req.method === 'OPTIONS') { res.writeHead(204); return res.end(); }
 
+    // Admin-token handshake. The extension authenticates admin routes by its
+    // chrome-extension:// Origin, but Chrome OMITS Origin on GET requests to a host the
+    // extension has permission for — so config READS (GET /config) would fail. A POST
+    // still carries the Origin, so the extension POSTs here (authorized by Origin) to get
+    // the token, then sends it as `Authorization: Bearer` on the GET admin routes. A
+    // drive-by web page can't reach this: its Origin isn't chrome-extension:// (Origin
+    // check) and it has no token. Additive route — old extensions ignore it.
+    if (pathname === '/admin/token' && req.method === 'POST') {
+      if (!isAdminAuthorized(req)) return sendJson(res, 403, { error: 'admin: extension origin or gateway token required' });
+      return sendJson(res, 200, { token: ensureGatewayToken() });
+    }
+
+    // M2: ADMIN routes reconfigure the gateway (POST /config) or expose its in-memory
+    // logs (GET /logs). Unlike the /v1 data plane (open to any local client — the
+    // product), these must not be reachable by a no-Origin local process or a drive-by
+    // localhost web page. Require the extension Origin or the gateway token.
+    if ((pathname === '/config' || pathname === '/logs') && !isAdminAuthorized(req)) {
+      return sendJson(res, 403, { error: 'admin route: extension origin or gateway token required' });
+    }
+
     if (req.method === 'GET' && pathname === '/health') {
       // `stt` is ADDITIVE (Tesla rule): old clients ignore it, new clients use it
       // to auto-detect local dictation. `enabled` reflects config; the model only
@@ -626,8 +648,8 @@ export function createGateway(cfg = loadConfig()) {
         if (!url) return sendJson(res, 503, { error: { message: 'NER not configured — deterministic-only redaction', type: 'ner_off' } });
         try {
           const body = await readBody(req, cfg.maxBodyBytes);
-          assertEndpointUrl(url); // block metadata/non-http(s) before POSTing raw text to the detector
-          const r = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body, signal: AbortSignal.timeout(8000) });
+          // secureFetch: scheme/host policy + resolved-IP check before POSTing raw text to the detector.
+          const r = await secureFetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body, signal: AbortSignal.timeout(8000) });
           const text = await r.text();
           res.writeHead(r.status, { 'content-type': 'application/json' });
           return res.end(text);
@@ -898,9 +920,9 @@ export function createGateway(cfg = loadConfig()) {
           body.tools = narrowSpecs(body.tools, latestUserText(body, r.kind), { cap, keep, name: toolName, description: toolDesc });
           narrowedTools = before - body.tools.length;
         }
-        // Free/Pro gate: free users get the REAL thing (full-tier redaction), but
-        // only for a fixed lifetime allowance — checked here, consumed below once a
-        // redaction actually happens. Over the cap → 402 upsell.
+        // Free users get full-tier redaction within a fixed lifetime allowance —
+        // checked here, consumed below once a redaction actually happens. Over the
+        // cap returns 402.
         isPro = await resolvePro(cfg.pro?.entitlementToken);
         const allow = checkQuota(cfg, isPro);
         if (!allow.allowed) {
@@ -913,16 +935,16 @@ export function createGateway(cfg = loadConfig()) {
         const ac = new AbortController();
         req.on('close', () => ac.abort());
         const rd0 = trace ? trace.clock() : 0;
-        // Redact at the configured tier for everyone (free users get genuine
-        // name/org redaction within their allowance, not a downgraded preview);
-        // the custom dictionary stays capped for free (isPro decides that inside).
+        // Redact at the configured tier for everyone (free users get name/org
+        // redaction within their allowance); the custom dictionary stays capped for
+        // free (isPro decides that inside).
         const { vault: v, count, sanitized } = await redactSegments(segs, cfg.redaction, { signal: ac.signal, isPro });
         if (trace) trace.lap('redact', rd0);
         vault = v;
         redactedCount = count;
         sanitizedCount = sanitized || 0;
-        // Burn one lifetime free credit only when we actually redacted something,
-        // then persist so the count survives a restart. (No-op / no write for Pro.)
+        // Consume one lifetime free credit only when we actually redacted
+        // something, then persist. (No-op / no write for Pro.)
         if (!isPro && count > 0) {
           consume(cfg, isPro);
           try { persistConfig(cfg, configPath()); } catch { /* best effort — usage is advisory */ }
@@ -964,11 +986,12 @@ export function createGateway(cfg = loadConfig()) {
 
 export function start(cfg = loadConfig()) {
   installTimestampedConsole(); // every gateway log line gets a clock — before anything logs
+  ensureGatewayToken(); // M2: load/create the admin-route token (best-effort)
   const server = createGateway(cfg);
   const ner = startNer(cfg); // may mutate cfg.redaction when it comes up
-  // Re-validate the stored Pro entitlement online on an interval, so a refunded /
-  // revoked subscription drops the gateway to Free instead of riding the offline
-  // token to its exp (see entitlement-refresh.js).
+  // Re-validate the stored entitlement online on an interval; clears it and drops
+  // the gateway to Free when the worker reports it invalid (see
+  // entitlement-refresh.js).
   const entitlement = startEntitlementRefresh(cfg);
   // Fail LOUD on a port clash instead of crashing with a raw stack trace. We bind a
   // FIXED port (4320) so the extension / install.sh / OpenCode can always find us; if
@@ -989,6 +1012,12 @@ export function start(cfg = loadConfig()) {
     console.log(`  backend  : ${cfg.backend}` + (cfg.backend === 'bridge' ? ` (agent: ${cfg.bridge.agent}, via ${cfg.bridge.url})` : ''));
     console.log(`  redaction: ${cfg.redaction.tier}` + (cfg.redaction.detection?.backend && cfg.redaction.detection.backend !== 'off'
       ? ` + ${cfg.redaction.detection.backend} detector` : (cfg.ner?.autostart ? ' (+ NER starting…)' : '')));
+    // M7: a non-loopback bind exposes the gateway on the LAN, where the per-request
+    // loopback Host check is trivially satisfied by a spoofed `Host: 127.0.0.1`. The
+    // /v1 data plane forwards with the client's own key, but make the exposure LOUD.
+    if (!isLoopbackHost(cfg.host)) {
+      console.error(`⚠ SECURITY: gateway bound to NON-LOOPBACK host ${cfg.host}. It is reachable off-machine, and the loopback Host-header check is spoofable from the LAN. Admin routes still need the token/extension, but prefer binding 127.0.0.1 unless you intend LAN exposure on a trusted network.`);
+    }
   });
   // If the user handed off a backup key, refresh the warm store from the latest
   // daily backup in the background — so the gateway stays current even when the

package/src/stt-engine.js

@@ -20,6 +20,7 @@ import { join } from 'node:path';
 import { existsSync, readdirSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { ensureLib, modelRoot } from './ner-engine.js';
+import { verifyModelWeights } from './model-integrity.js';
 import { DEFAULT_STT_MODEL, isEnglishOnly, sttModelDtype, isKnownSttModel, sttModelEngine } from './stt-models.js';
 import * as parakeet from './parakeet-engine.js';
 import * as diarize from './diarize-engine.js';
@@ -151,6 +152,16 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true, dtype:
       lib.env.allowRemoteModels = true;
       pipe = await lib.pipeline('automatic-speech-recognition', modelId, { dtype, progress_callback });
     }
+    // H3: verify freshly-downloaded weights (fail-closed on a real mismatch;
+    // warn-and-allow when unlisted). Post-load — see model-integrity.js note.
+    if (!haveLocal) {
+      try {
+        verifyModelWeights(modelId, { modelsDir: modelRoot(), log });
+      } catch (e) {
+        try { await pipe.dispose?.(); } catch { /* ignore */ }
+        throw e;
+      }
+    }
     _pipe = pipe; _model = modelId; _state = 'ready'; _err = null; _progress = null; _dtype = dtype;
     if (prevPipe && prevPipe !== pipe) { try { await prevPipe.dispose?.(); } catch { /* ignore */ } }
     log(`[stt] ready — model ${modelId} @ ${dtype} (in-process, offline) — local dictation active`);