@chatpanel/gateway 0.6.38 → 0.6.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.38",
+  "version": "0.6.40",
   "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/history-store.js

@@ -13,7 +13,7 @@
 // tier, not this one. The file on disk is useless without the local key.
 
 import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, unlinkSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, unlinkSync, statSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import os from 'node:os';
 import { SearchIndex } from './search-index.js';
@@ -104,6 +104,11 @@ export class HistoryStore {
     return max || null;
   }
 
+  // On-disk footprint for the storage dashboard: the encrypted store file.
+  get bytes() {
+    try { return existsSync(this.storePath) ? statSync(this.storePath).size : 0; } catch { return 0; }
+  }
+
   key() {
     if (!this._key) this._key = loadOrCreateKey();
     return this._key;
@@ -173,6 +178,15 @@ export class HistoryStore {
     return this.records.size;
   }
 
+  // Wipe every record — the user purging the on-disk warm copy. Returns how many were dropped.
+  clear() {
+    const n = this.records.size;
+    this.records.clear();
+    this.index = new SearchIndex();
+    this.schedulePersist();
+    return n;
+  }
+
   search(query, opts) {
     return this.index.search(query, opts);
   }

package/src/mcp.js

@@ -16,10 +16,31 @@
 
 import { loadConfig } from './config.js';
 import { readBridgeToken } from './bridge.js';
+import { ensureGatewayToken } from './gateway-token.js';
 
 const PROTOCOL_VERSION = '2024-11-05';
 const SERVER = { name: 'chatpanel-history', version: '1.0.0' };
 
+// The calling agent's self-reported name (from MCP `initialize` clientInfo), so the
+// observability dashboard can say WHICH agent read what. Untrusted; the gateway coerces it.
+let clientName = 'unknown';
+
+// Report one tool call to the long-lived gateway service's access log. Fire-and-forget:
+// telemetry must never slow, block or fail a tool call. Authorized with the gateway token
+// (readable only by this same-user process), so a drive-by localhost page can't forge entries.
+// Raw args are sent, but the server REDACTS them before storing (a search query is never
+// kept) — and the query already crossed this same loopback on the search call itself.
+function reportAccess(evt) {
+  try {
+    const token = ensureGatewayToken();
+    fetch(`${baseUrl()}/v1/observability/access`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+      body: JSON.stringify(evt),
+    }).catch(() => {});
+  } catch { /* no token or gateway down — drop the telemetry, never the call */ }
+}
+
 function baseUrl() {
   const env = process.env.CHATPANEL_GATEWAY_URL;
   if (env) return env.replace(/\/+$/, '');
@@ -201,12 +222,20 @@ export async function handleRpc(msg) {
   try {
     switch (method) {
       case 'initialize':
+        clientName = params?.clientInfo?.name || clientName;
         return ok({ protocolVersion: PROTOCOL_VERSION, capabilities: { tools: {} }, serverInfo: SERVER });
       case 'tools/list':
         return ok({ tools: TOOLS });
       case 'tools/call': {
-        const text = await callTool(params?.name, params?.arguments || {});
-        return ok({ content: [{ type: 'text', text }] });
+        const started = Date.now();
+        try {
+          const text = await callTool(params?.name, params?.arguments || {});
+          reportAccess({ client: clientName, tool: params?.name, ok: true, ms: Date.now() - started, args: params?.arguments || {} });
+          return ok({ content: [{ type: 'text', text }] });
+        } catch (e) {
+          reportAccess({ client: clientName, tool: params?.name, ok: false, ms: Date.now() - started, args: params?.arguments || {}, error: e.message });
+          throw e;
+        }
       }
       case 'ping':
         return ok({});

package/src/observability.js

@@ -0,0 +1,121 @@
+// VENDORED from @chatpanel/events/observability.js — edit there, then copy over.
+// The gateway keeps its dependency surface small; this one pure module is copied in
+// rather than pulling the whole events package, the same way the bridge vendors its
+// events files. Source of truth: chatpanel-events/observability.js.
+//
+// observability.js — the contract for "who consumed what, when, and how much is stored".
+//
+// ChatPanel's data is reachable by more than one agent now: the side panel, and any CLI
+// (Codex, Claude Code, OpenCode…) wired to the gateway's MCP server. Once several agents
+// read your history and skills, you need to SEE that — which agent touched what, and how
+// much sits in each storage tier. That is one question with one answer shape, so it lives
+// here, not re-derived in every client. The extension renders it; the gateway records it;
+// a desktop/mobile app will do both against this same contract.
+//
+// Pure and dependency-free (the @chatpanel/events rule): identical code in browser ESM,
+// the gateway (Node) and a mobile JS runtime. No clock, no storage, no platform APIs —
+// the caller passes `ts`; the caller owns persistence.
+//
+// PRIVACY IS THE POINT of the redactor below. An access log that stored raw tool arguments
+// would quietly become a second copy of every search query — the exact PII we redact
+// everywhere else. So the note attached to each event is built from a per-tool WHITELIST of
+// non-sensitive fields; a search query's TEXT is never recorded, only that a search ran.
+
+export const ACCESS_LOG_VERSION = 1;
+
+// Default ring size — enough to see a working session's activity without unbounded growth.
+export const ACCESS_LOG_MAX = 500;
+
+// Per-tool whitelist: which argument fields are safe to keep in the human note. Anything not
+// listed here is dropped. Content-bearing fields (a search `query`) are deliberately ABSENT —
+// the tool name already says "a search happened"; the words searched are not logged.
+const SAFE_ARGS = {
+  search_history: ['limit'],
+  list_history: ['limit', 'offset'],
+  get_record: ['id'],            // opaque record id, not content
+  open_skill: ['skill'],         // skill names are catalog identifiers, not PII
+  read_skill_file: ['skill', 'path'],
+  list_skills: ['limit'],
+};
+
+/**
+ * A short, SAFE descriptor of a call's arguments for display. Never returns content that
+ * could carry PII. Unknown tools get an empty note (the tool name is the only signal).
+ */
+export function redactAccessArgs(tool, args) {
+  const allow = SAFE_ARGS[tool];
+  if (!allow || !args || typeof args !== 'object') return '';
+  const parts = [];
+  for (const key of allow) {
+    const v = args[key];
+    if (v === undefined || v === null || v === '') continue;
+    // Cap any string field so a long id/path can't smuggle content or blow up the row.
+    const s = typeof v === 'string' ? (v.length > 80 ? `${v.slice(0, 77)}…` : v) : String(v);
+    parts.push(`${key}=${s}`);
+  }
+  return parts.join(' ');
+}
+
+/**
+ * Normalize one access into the record everything stores and renders. `client` is the calling
+ * agent's self-reported name (MCP clientInfo) — untrusted, so it's coerced to a short string.
+ */
+export function makeAccessEvent({ ts, client, tool, ok = true, ms, args, error } = {}) {
+  return {
+    v: ACCESS_LOG_VERSION,
+    ts: Number(ts) || 0,
+    client: shortStr(client, 'unknown', 60),
+    tool: shortStr(tool, 'unknown', 60),
+    ok: !!ok,
+    ms: Number.isFinite(ms) ? Math.max(0, Math.round(ms)) : null,
+    note: redactAccessArgs(tool, args),
+    error: error ? shortStr(error, '', 200) : '',
+  };
+}
+
+function shortStr(v, fallback, max) {
+  const s = (v == null ? '' : String(v)).trim() || fallback;
+  return s.length > max ? `${s.slice(0, max - 1)}…` : s;
+}
+
+/**
+ * A tiny fixed-capacity ring for access events. Pure and synchronous — the gateway keeps one
+ * in memory and snapshots it for the dashboard; the caller decides whether/how to persist.
+ */
+export function createAccessLog(max = ACCESS_LOG_MAX) {
+  const cap = Math.max(1, max | 0);
+  let buf = [];
+  return {
+    push(evt) { buf.push(evt); if (buf.length > cap) buf = buf.slice(buf.length - cap); return evt; },
+    // Newest first, optionally limited — the order a dashboard wants.
+    snapshot(limit) { const out = buf.slice().reverse(); return limit ? out.slice(0, limit) : out; },
+    get size() { return buf.length; },
+    clear() { buf = []; },
+  };
+}
+
+// ── Storage tiers ────────────────────────────────────────────────────────────────────────
+// One descriptor per place data lives: hot (browser), warm (local gateway), cold (cloud,
+// future). The dashboard renders a row per tier; a tier that isn't configured says so.
+
+export function makeStorageTier({ tier, label, present = true, records = null, bytes = null, newest = null, note = '' } = {}) {
+  return {
+    tier: String(tier || ''),
+    label: String(label || tier || ''),
+    present: !!present,
+    records: records == null ? null : Math.max(0, records | 0),
+    bytes: bytes == null ? null : Math.max(0, Number(bytes) || 0),
+    newest: newest == null ? null : Number(newest) || 0,
+    note: String(note || ''),
+  };
+}
+
+/** Human-friendly byte size. Binary units, one decimal above KB. */
+export function formatBytes(n) {
+  const b = Number(n);
+  if (!Number.isFinite(b) || b <= 0) return '0 B';
+  const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+  let i = 0, v = b;
+  while (v >= 1024 && i < units.length - 1) { v /= 1024; i++; }
+  return `${i === 0 ? Math.round(v) : v.toFixed(1)} ${units[i]}`;
+}

package/src/server.js

@@ -41,11 +41,12 @@ import { STT_MODEL_CATALOG, isKnownSttModel, isValidCustomSttId, DEFAULT_STT_MOD
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
 import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath } from './configstore.js';
 import { resolveDestination, aggregateModelsAsync } from './router.js';
+import { createAccessLog, makeAccessEvent } from './observability.js';
 import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.38';
+export const VERSION = '0.6.40';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -53,6 +54,13 @@ export const VERSION = '0.6.38';
 // See docs/architecture-data-tiers.
 const historyStore = await createHistoryStore();
 
+// OBSERVABILITY — an in-memory ring of "which agent read what, when". Populated by the
+// MCP server process (chatpanel-gateway mcp) reporting each tool call here, so a person
+// can SEE cross-agent access in ChatPanel's dashboard. In-memory by design: a working
+// session's activity, not an audit trail that itself becomes data to protect. The note on
+// each event is redacted (never a search query) by makeAccessEvent.
+const accessLog = createAccessLog();
+
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);
 
 // Auto-narrow: arm only the top-K most-relevant MCP tools per turn (speed). Mirrors
@@ -522,6 +530,19 @@ export function createGateway(cfg = loadConfig()) {
       && req.method === 'POST' && !isAdminAuthorized(req)) {
       return sendJson(res, 403, { error: { message: 'history key route: extension origin or gateway token required', type: 'forbidden' } });
     }
+    // Reads of the warm index are open (that's the product — Codex/OpenCode query it).
+    // WRITES are not: a drive-by localhost page or a random local process must not be
+    // able to inject records the model then trusts as the user's real history. Ingest
+    // requires the extension Origin (which its POST always carries) or the gateway token.
+    if ((pathname === '/v1/history/ingest' || pathname === '/v1/history/clear') && req.method === 'POST' && !isAdminAuthorized(req)) {
+      return sendJson(res, 403, { error: { message: 'history write — extension origin or gateway token required', type: 'forbidden' } });
+    }
+    // The access log is who-read-what — sensitive, and writable only by the local MCP
+    // process (which sends the gateway token). Extension Origin or token for both the
+    // read (dashboard) and the report (MCP child); a drive-by page has neither.
+    if (pathname.startsWith('/v1/observability') && !isAdminAuthorized(req)) {
+      return sendJson(res, 403, { error: { message: 'observability: extension origin or gateway token required', type: 'forbidden' } });
+    }
 
     if (req.method === 'GET' && pathname === '/health') {
       // `stt` is ADDITIVE (Tesla rule): old clients ignore it, new clients use it
@@ -575,6 +596,10 @@ export function createGateway(cfg = loadConfig()) {
         return sendJson(res, 400, { error: { message: `ingest failed: ${e.message}`, type: 'ingest_error' } });
       }
     }
+    if (pathname === '/v1/history/clear' && req.method === 'POST') {
+      const dropped = historyStore.clear();
+      return sendJson(res, 200, { ok: true, dropped, size: historyStore.size });
+    }
     if (pathname === '/v1/history/search' && req.method === 'POST') {
       try {
         const body = JSON.parse((await readBody(req, cfg.maxBodyBytes)).toString('utf8')) || {};
@@ -585,7 +610,28 @@ export function createGateway(cfg = loadConfig()) {
       }
     }
     if (pathname === '/v1/history/status' && req.method === 'GET') {
-      return sendJson(res, 200, { ok: true, size: historyStore.size, newest: historyStore.newest });
+      return sendJson(res, 200, { ok: true, size: historyStore.size, newest: historyStore.newest, bytes: historyStore.bytes });
+    }
+
+    // OBSERVABILITY (admin-gated above).
+    //   GET  /v1/observability            → { storage:{warm:{records,bytes,newest}}, access:[…] }
+    //   POST /v1/observability/access     ← the MCP process reports one tool call
+    if (pathname === '/v1/observability' && req.method === 'GET') {
+      const limit = Math.min(500, Math.max(1, Number(url.searchParams.get('limit')) || 200));
+      return sendJson(res, 200, {
+        ok: true,
+        storage: { warm: { records: historyStore.size, bytes: historyStore.bytes, newest: historyStore.newest } },
+        access: accessLog.snapshot(limit),
+      });
+    }
+    if (pathname === '/v1/observability/access' && req.method === 'POST') {
+      try {
+        const body = JSON.parse((await readBody(req, cfg.maxBodyBytes)).toString('utf8')) || {};
+        const evt = accessLog.push(makeAccessEvent({ ts: Date.now(), ...body }));
+        return sendJson(res, 200, { ok: true, event: evt });
+      } catch (e) {
+        return sendJson(res, 400, { error: { message: `access log failed: ${e.message}`, type: 'observability_error' } });
+      }
     }
     if (pathname === '/v1/history/list' && req.method === 'GET') {
       const limit = Math.min(500, Math.max(1, Number(url.searchParams.get('limit')) || 50));

package/src/sqlite-store.js

@@ -15,7 +15,7 @@
 // via history-store.js's saveBackupSecret.
 
 import { join } from 'node:path';
-import { mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { mkdirSync, chmodSync, existsSync, statSync } from 'node:fs';
 import os from 'node:os';
 import { HistoryStore } from './history-store.js';
 
@@ -92,6 +92,22 @@ export class SqliteHistoryStore {
     return this.db.get('SELECT COUNT(*) c FROM records')?.c || 0;
   }
 
+  // Freshness horizon — the newest record's timestamp. The MCP tools surface this so
+  // an agent knows how current the warm copy is (and stops denying un-synced items).
+  get newest() {
+    return this.db.get('SELECT MAX(date) m FROM records')?.m || 0;
+  }
+
+  // On-disk footprint for the storage dashboard: the .db plus its WAL/shm sidecars.
+  get bytes() {
+    if (this.path === ':memory:') return 0;
+    let total = 0;
+    for (const p of [this.path, `${this.path}-wal`, `${this.path}-shm`]) {
+      try { if (existsSync(p)) total += statSync(p).size; } catch { /* ignore */ }
+    }
+    return total;
+  }
+
   bulk({ upserts = [], removes = [] } = {}) {
     this.db.exec('BEGIN');
     try {
@@ -137,6 +153,14 @@ export class SqliteHistoryStore {
     const body = this.db.get('SELECT text FROM fts WHERE id = ?', [id]);
     return { ...meta, text: body?.text || '' };
   }
+
+  // Wipe every record — the user purging the on-disk warm copy. Returns how many were dropped.
+  clear() {
+    const n = this.size;
+    this.db.exec('DELETE FROM records');
+    this.db.exec('DELETE FROM fts');
+    return n;
+  }
 }
 
 // Pick the best available warm engine. SQLite when it loads; otherwise the