@chatpanel/gateway 0.6.6 → 0.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.2.9",
+    "@chatpanel/pii": "^0.2.10",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c"
   },

package/src/redact.js

@@ -8,7 +8,7 @@
 // mapping is self-consistent within the request. (Same reasoning as the
 // extension's pii-pipeline.)
 
-import { createVault, redactText, detectEntities, gatedDictionary } from '@chatpanel/pii';
+import { createVault, redactText, detectEntities, gatedDictionary, sanitizeUnicode } from '@chatpanel/pii';
 import * as engine from './ner-engine.js';
 
 // tier: 'basic' | 'full'. For 'full' we run the local detector over the combined
@@ -20,8 +20,23 @@ import * as engine from './ner-engine.js';
 // still a Pro power feature: gatedDictionary caps it to FREE_DICT_LIMIT for free.
 export async function redactSegments(segments, redactionCfg, { signal, isPro = true } = {}) {
   const vault = createVault();
+
+  // De-steganography FIRST (before detection). Invisible/format Unicode is a triple
+  // threat at this boundary: it can split a value so the detector misses it and the
+  // model reassembles real PII (redaction bypass), smuggle a hidden instruction via
+  // Tag chars (ASCII smuggling), or carry a fingerprint/watermark a client injected.
+  // We strip it in place so detection sees clean text and the forwarded request is
+  // clean too. Counted (not silently dropped) so the server can report it.
+  let sanitized = 0;
+  for (const seg of segments) {
+    const before = seg.get();
+    if (typeof before !== 'string' || !before) continue;
+    const { clean, removed } = sanitizeUnicode(before);
+    if (removed) { seg.set(clean); sanitized += removed; }
+  }
+
   const texts = segments.map((s) => s.get()).filter((t) => typeof t === 'string' && t);
-  if (texts.length === 0) return { vault, count: 0 };
+  if (texts.length === 0) return { vault, count: 0, sanitized };
 
   // Use the configured tier as-is (no free downgrade — the quota is the free gate),
   // but keep the dictionary capped for free via the shared chatpanel-pii gate.
@@ -64,7 +79,7 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
     if (after !== before) count++;
     seg.set(after);
   }
-  return { vault, count };
+  return { vault, count, sanitized };
 }
 
 // A `segment` is a tiny getter/setter over wherever the text lives in the parsed

package/src/server.js

@@ -36,7 +36,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.6';
+export const VERSION = '0.6.8';
 
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);
 
@@ -137,7 +137,7 @@ function mkTrace(sink) {
       const entry = /** @type {any} */ ({ ...this.meta, timings });
       setImmediate(() => {
         sink(entry);
-        console.log(`[gateway] model=${entry.model || '-'} → ${entry.dest ? `${entry.dest}(${entry.type})` : 'none'} · redacted ${entry.redacted || 0}${entry.narrowed ? ` · narrowed -${entry.narrowed}` : ''} · ${fmtTimings(timings)}`);
+        console.log(`[gateway] model=${entry.model || '-'} → ${entry.dest ? `${entry.dest}(${entry.type})` : 'none'} · redacted ${entry.redacted || 0}${entry.sanitized ? ` · scrubbed ${entry.sanitized} hidden` : ''}${entry.narrowed ? ` · narrowed -${entry.narrowed}` : ''} · ${fmtTimings(timings)}`);
       });
     },
   };
@@ -613,6 +613,7 @@ export function createGateway(cfg = loadConfig()) {
     let body = null;
     let outBody = raw;
     let redactedCount = 0;
+    let sanitizedCount = 0;
     let narrowedTools = 0;
     let isPro = true;
     // Off the hot path: only build a trace when logging is on, so it adds nothing
@@ -656,10 +657,11 @@ export function createGateway(cfg = loadConfig()) {
         // Redact at the configured tier for everyone (free users get genuine
         // name/org redaction within their allowance, not a downgraded preview);
         // the custom dictionary stays capped for free (isPro decides that inside).
-        const { vault: v, count } = await redactSegments(segs, cfg.redaction, { signal: ac.signal, isPro });
+        const { vault: v, count, sanitized } = await redactSegments(segs, cfg.redaction, { signal: ac.signal, isPro });
         if (trace) trace.lap('redact', rd0);
         vault = v;
         redactedCount = count;
+        sanitizedCount = sanitized || 0;
         // Burn one lifetime free credit only when we actually redacted something,
         // then persist so the count survives a restart. (No-op / no write for Pro.)
         if (!isPro && count > 0) {
@@ -687,7 +689,7 @@ export function createGateway(cfg = loadConfig()) {
     // API we forward to). Falls back to the legacy backend when none configured.
     const dest = resolveDestination(body?.model, cfg, r.kind);
     if (trace) {
-      trace.meta = { t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, narrowed: narrowedTools, detail: redactionDetail(vault, cfg.logDetail) };
+      trace.meta = { t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, sanitized: sanitizedCount, narrowed: narrowedTools, detail: redactionDetail(vault, cfg.logDetail) };
     }
     if (dest && dest.type === 'api') {
       if (!dest.baseUrl) { trace?.commit(); return sendJson(res, 502, { error: `destination "${dest.id}" has no baseUrl` }); }