@chatpanel/gateway 0.6.61 → 0.6.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.61",
+  "version": "0.6.63",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.7.0",
+    "@chatpanel/pii": "^0.7.1",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c",
     "phonemizer": "^1.2.1"

package/src/redact.js

@@ -20,7 +20,14 @@ import * as engine from './ner-engine.js';
 // quality — free requests get the full tier (names/orgs via NER) within their
 // allowance. The custom dictionary is capped for free: gatedDictionary limits it
 // to FREE_DICT_LIMIT via the shared chatpanel-pii gate.
-export async function redactSegments(segments, redactionCfg, { signal, isPro = true, onEgress = null, fetchImpl: fetchOverride = null } = {}) {
+export async function redactSegments(segments, redactionCfg, {
+  signal, isPro = true, onEgress = null, fetchImpl: fetchOverride = null,
+  // The bundled detector, INJECTED rather than reached for. An ES module namespace cannot
+  // be monkey-patched, so with a hard import there is no way to ask "does an entity the
+  // engine found actually come out the other side as a token" without downloading a model.
+  // That question went unasked for exactly that reason, and the answer was no.
+  nerEngine = engine,
+} = {}) {
   const vault = createVault();
 
   // De-steganography FIRST (before detection). Invisible/format Unicode is a triple
@@ -51,7 +58,7 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
   // @chatpanel/pii's caching / timeout / type-gating — one source of truth.
   const det = redactionCfg.detection;
   const useExternal = !!(det && det.backend && det.backend !== 'off');
-  const useEngine = !useExternal && engine.isReady();
+  const useEngine = !useExternal && nerEngine.isReady();
 
   let entities = [];
   if (tier === 'full' && (useExternal || useEngine)) {
@@ -61,12 +68,18 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
     // under a second, but a cold one must be allowed to finish; on timeout the turn
     // falls back to dictionary/deterministic-only redaction.
     const detection = useEngine
-      ? { backend: 'endpoint', url: 'inproc:ner', timeoutMs: 30000, maxChars: 8000, types: det?.types }
+      // `transport: 'in-process'` is load-bearing, not decoration. Without it the sentinel
+      // URL below fails @chatpanel/pii's SSRF scheme check, the throw is swallowed by the
+      // fail-open path, and the bundled engine contributes NOTHING to any redaction while
+      // reporting itself ready — names and organisations reach the model in full under a
+      // config that says "full". The flag is only honoured alongside an injected fetch,
+      // which is `engine.fetchAdapter` on the next line.
+      ? { backend: 'endpoint', url: 'inproc:ner', transport: 'in-process', timeoutMs: 30000, maxChars: 8000, types: det?.types }
       : { ...det, timeoutMs: Math.max(Number(det.timeoutMs) || 0, 30000) };
     // The in-process engine is already injected this way; `fetchOverride` is the same seam
     // for a test, so the detector hop can be exercised without a network. Never used in
     // production — nothing passes it but tests.
-    const fetchImpl = useEngine ? engine.fetchAdapter : (fetchOverride || undefined);
+    const fetchImpl = useEngine ? nerEngine.fetchAdapter : (fetchOverride || undefined);
     try {
       entities = await detectEntities(texts.join('\n\n'), { detection }, {
         signal,

package/src/server.js

@@ -55,7 +55,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.61';
+export const VERSION = '0.6.63';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -907,6 +907,47 @@ export function createGateway(cfg = loadConfig()) {
         }
       }
     }
+    // WHAT THE MODEL WOULD RECEIVE. A client asks "if I sent this, what leaves the
+    // machine?" and gets back the redacted text plus the token→type map.
+    //
+    // WHY THIS IS A GATEWAY ROUTE AND NOT A CLIENT FUNCTION. A preview computed in the
+    // client is a SECOND redactor, and the day the two disagree the client is confidently
+    // showing the user something other than what was sent — which is worse than showing
+    // nothing, because it is believed. This runs the SAME redactSegments over the SAME
+    // config, tier, dictionary and detector as a real request, so it cannot drift: if the
+    // preview is wrong, the redaction is wrong too, and that is one bug rather than two.
+    //
+    // Real values NEVER appear in the response. The mapping is token→type only ('types'),
+    // never the 'values' detail an operator can opt into for their own logs: this answer
+    // crosses a process boundary to a UI, and the client already has the original text.
+    // The vault is discarded when this returns, so these tokens are not reusable.
+    if (pathname === '/redact' && req.method === 'POST') {
+      let text = '';
+      try { text = String(JSON.parse((await readBody(req, cfg.maxBodyBytes)).toString('utf8'))?.text || ''); }
+      catch { text = ''; }
+      if (!text) return sendJson(res, 200, { text: '', count: 0, sanitized: 0, entities: [] });
+      try {
+        let out = text;
+        const isPro = await resolvePro(cfg.pro?.entitlementToken);
+        const r = await redactSegments(
+          [segment(() => out, (v) => { out = v; })],
+          cfg.redaction,
+          { isPro },
+        );
+        return sendJson(res, 200, {
+          text: out,
+          count: r.count || 0,
+          sanitized: r.sanitized || 0,
+          tier: cfg.redaction?.tier === 'full' ? 'full' : 'basic',
+          entities: redactionDetail(r.vault, 'types') || [],
+        });
+      } catch (e) {
+        // Fail LOUD. A preview that silently returns the original text would tell the user
+        // "nothing here is sensitive" at the exact moment redaction is broken.
+        return sendJson(res, 500, { error: { message: `redaction preview failed: ${e.message}`, type: 'redact_error' } });
+      }
+    }
+
     // Model manager (the extension's Gateway settings drive these). GET lists the
     // catalog with install state + live download progress; POST switches the active
     // model (downloading it first if needed) and persists the choice.