@chatpanel/gateway 0.6.62 → 0.6.64

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.62",
+  "version": "0.6.64",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.7.0",
+    "@chatpanel/pii": "^0.7.1",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c",
     "phonemizer": "^1.2.1"

package/src/bridge.js

@@ -67,9 +67,11 @@ export async function openBridgeChat({ bridgeUrl, agent, token, messages, system
   return res;
 }
 
-// Stream a turn through the bridge. Calls onText(restorableChunk) for each delta
+// Stream a turn through the bridge. Calls onText(restorableChunk) for each delta, and
+// onActivity(event) for everything else the agent reports — status lines, the working
+// directory, tool calls, reasoning.
 // of model text and returns the full (un-restored) text. Throws on bridge error.
-export async function streamBridgeChat({ bridgeUrl, agent, token, messages, system, options, signal }, onText) {
+export async function streamBridgeChat({ bridgeUrl, agent, token, messages, system, options, signal }, onText, onActivity = null) {
   const res = await fetch(`${bridgeUrl.replace(/\/$/, '')}/chat`, {
     method: 'POST',
     headers: {
@@ -118,8 +120,20 @@ export async function streamBridgeChat({ bridgeUrl, agent, token, messages, syst
         }
       } else if (evt.type === 'error') {
         err = new Error(evt.error || 'bridge error');
+      } else if (onActivity) {
+        // WHAT THE AGENT IS DOING, for a client that wants to show it.
+        //
+        // These used to be dropped with a comment calling them "the agent's local side
+        // effects". They are — and they are also the ONLY thing that happens for the ten
+        // seconds an agent spends reading files before it says a word. A client routed
+        // through this gateway saw a spinner and nothing else, while one talking to the
+        // bridge directly showed the work; that difference was pushing clients toward the
+        // direct path, which is the one with no redaction in it.
+        //
+        // Passed through as-is. Deciding here which of a coding agent's events are worth
+        // showing would be this file guessing at someone's UI.
+        onActivity(evt);
       }
-      // tool / reasoning / status events are the agent's local side effects — ignore.
     }
   };
 

package/src/redact.js

@@ -20,7 +20,14 @@ import * as engine from './ner-engine.js';
 // quality — free requests get the full tier (names/orgs via NER) within their
 // allowance. The custom dictionary is capped for free: gatedDictionary limits it
 // to FREE_DICT_LIMIT via the shared chatpanel-pii gate.
-export async function redactSegments(segments, redactionCfg, { signal, isPro = true, onEgress = null, fetchImpl: fetchOverride = null } = {}) {
+export async function redactSegments(segments, redactionCfg, {
+  signal, isPro = true, onEgress = null, fetchImpl: fetchOverride = null,
+  // The bundled detector, INJECTED rather than reached for. An ES module namespace cannot
+  // be monkey-patched, so with a hard import there is no way to ask "does an entity the
+  // engine found actually come out the other side as a token" without downloading a model.
+  // That question went unasked for exactly that reason, and the answer was no.
+  nerEngine = engine,
+} = {}) {
   const vault = createVault();
 
   // De-steganography FIRST (before detection). Invisible/format Unicode is a triple
@@ -51,7 +58,7 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
   // @chatpanel/pii's caching / timeout / type-gating — one source of truth.
   const det = redactionCfg.detection;
   const useExternal = !!(det && det.backend && det.backend !== 'off');
-  const useEngine = !useExternal && engine.isReady();
+  const useEngine = !useExternal && nerEngine.isReady();
 
   let entities = [];
   if (tier === 'full' && (useExternal || useEngine)) {
@@ -61,12 +68,18 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
     // under a second, but a cold one must be allowed to finish; on timeout the turn
     // falls back to dictionary/deterministic-only redaction.
     const detection = useEngine
-      ? { backend: 'endpoint', url: 'inproc:ner', timeoutMs: 30000, maxChars: 8000, types: det?.types }
+      // `transport: 'in-process'` is load-bearing, not decoration. Without it the sentinel
+      // URL below fails @chatpanel/pii's SSRF scheme check, the throw is swallowed by the
+      // fail-open path, and the bundled engine contributes NOTHING to any redaction while
+      // reporting itself ready — names and organisations reach the model in full under a
+      // config that says "full". The flag is only honoured alongside an injected fetch,
+      // which is `engine.fetchAdapter` on the next line.
+      ? { backend: 'endpoint', url: 'inproc:ner', transport: 'in-process', timeoutMs: 30000, maxChars: 8000, types: det?.types }
       : { ...det, timeoutMs: Math.max(Number(det.timeoutMs) || 0, 30000) };
     // The in-process engine is already injected this way; `fetchOverride` is the same seam
     // for a test, so the detector hop can be exercised without a network. Never used in
     // production — nothing passes it but tests.
-    const fetchImpl = useEngine ? engine.fetchAdapter : (fetchOverride || undefined);
+    const fetchImpl = useEngine ? nerEngine.fetchAdapter : (fetchOverride || undefined);
     try {
       entities = await detectEntities(texts.join('\n\n'), { detection }, {
         signal,

package/src/router.js

@@ -12,6 +12,7 @@
 //   }
 
 import { secureFetch } from './secure-fetch.js';
+import { readBridgeToken } from './bridge.js';
 //
 // /v1/models aggregates every destination's models so clients can discover them.
 
@@ -67,22 +68,96 @@ export function resolveDestination(model, cfg, kind, { destination = '' } = {})
 // Aggregate every destination's models for GET /v1/models. Agents expose their
 // own name as the model; APIs expose ONLY real model ids (never the destination
 // id — that's a provider name, not a model).
+/**
+ * WHICH API SHAPE A MODEL WANTS TO BE CALLED WITH.
+ *
+ * `owned_by` names the destination, which is a routing fact, not a calling convention — and
+ * a client needs the second one to build a request. Anthropic models take the Messages API;
+ * OpenAI-compatible ones take chat/completions (and the Responses API where the destination
+ * offers it); an agent takes neither, because the gateway synthesises the response itself
+ * from the bridge's stream.
+ *
+ * Stated here rather than inferred from the id in every client. Guessing from the name is
+ * how `claude` the local CLI agent gets called as if it were Anthropic's hosted API.
+ */
+function apiShapeOf(d) {
+  if (d.type === 'agent') return { api: 'agent', endpoints: ['/v1/chat/completions'] };
+  if (d.protocol === 'anthropic') return { api: 'anthropic', endpoints: ['/v1/messages'] };
+  return { api: 'openai', endpoints: ['/v1/chat/completions', '/v1/responses'] };
+}
+
 export function aggregateModels(cfg) {
   const data = [];
   const seen = new Set();
-  const add = (id, owner) => { if (id && !seen.has(id)) { seen.add(id); data.push({ id, object: 'model', owned_by: owner }); } };
+  const add = (id, owner, d) => {
+    if (!id || seen.has(id)) return;
+    seen.add(id);
+    const shape = apiShapeOf(d);
+    data.push({
+      id,
+      object: 'model',
+      owned_by: owner,
+      // Additive fields an OpenAI client ignores and a ChatPanel client uses to decide how
+      // to call, and to group a picker by provider instead of by a flat list of ids.
+      provider: d.id,
+      provider_type: d.type === 'agent' ? 'agent' : (d.protocol === 'anthropic' ? 'anthropic' : 'openai'),
+      api: shape.api,
+      endpoints: shape.endpoints,
+    });
+  };
   for (const d of listDestinations(cfg)) {
-    if (d.type === 'agent') for (const m of (d.models?.length ? d.models : [d.id])) add(m, 'chatpanel-bridge');
-    else for (const m of (d.models || [])) add(m, d.id);
+    if (d.type === 'agent') for (const m of (d.models?.length ? d.models : [d.id])) add(m, 'chatpanel-bridge', d);
+    else for (const m of (d.models || [])) add(m, d.id, d);
   }
   return { object: 'list', data };
 }
 
+/** id → installed, from the bridge's own /health. `null` when it could not be asked. */
+async function bridgeAgentAvailability(cfg, timeoutMs) {
+  const base = String(cfg?.bridge?.url || '').replace(/\/$/, '');
+  if (!base) return null;
+  try {
+    const token = readBridgeToken(cfg.bridge?.token);
+    const res = await fetch(`${base}/health`, {
+      headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (!Array.isArray(body?.agents)) return null;
+    return new Map(body.agents.map((a) => [a.id, !!a.available]));
+  } catch {
+    return null; // not reachable — say nothing rather than saying "none"
+  }
+}
+
 // Async variant: also PROXIES each API destination's own /v1/models to discover
 // real model ids (using its saved key). Fail-open per destination.
 export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
   const base = aggregateModels(cfg);
   const seen = new Set(base.data.map((m) => m.id));
+
+  // WHICH AGENTS ARE ACTUALLY ON THIS MACHINE.
+  //
+  // The list above is the ROUTING TABLE: it names every agent the gateway would route to,
+  // whether or not that CLI is installed. On a fresh machine that is a model picker full of
+  // names that all fail on first use, which is the worst possible first five minutes.
+  //
+  // Only the bridge knows what is on disk, so the gateway asks it — once, here — rather than
+  // every client asking separately. A client that had to check for itself would need the
+  // bridge's address and token as well as ours, and the direct-to-bridge path is the one
+  // with no policy in front of it; making it necessary is how it becomes the habit.
+  //
+  // `available` is left UNDEFINED when the bridge cannot be reached. Absent means "we did not
+  // find out", which is not the same as false, and a picker that greys out every agent
+  // because one health check timed out is worse than one that says nothing.
+  const agentAvailability = await bridgeAgentAvailability(cfg, timeoutMs);
+  if (agentAvailability) {
+    for (const m of base.data) {
+      if (m.owned_by === 'chatpanel-bridge') m.available = agentAvailability.get(m.id) ?? false;
+    }
+  }
+
   const dests = listDestinations(cfg).filter((d) => d.type === 'api' && d.baseUrl);
   await Promise.all(dests.map(async (d) => {
     const ctrl = new AbortController();
@@ -100,7 +175,15 @@ export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
       const list = Array.isArray(j?.data) ? j.data : (Array.isArray(j?.models) ? j.models : []);
       for (const m of list) {
         const id = typeof m === 'string' ? m : m?.id;
-        if (id && !seen.has(id)) { seen.add(id); base.data.push({ id, object: 'model', owned_by: d.id }); }
+        if (id && !seen.has(id)) {
+          seen.add(id);
+          const shape = apiShapeOf(d);
+          base.data.push({
+            id, object: 'model', owned_by: d.id, provider: d.id,
+            provider_type: d.protocol === 'anthropic' ? 'anthropic' : 'openai',
+            api: shape.api, endpoints: shape.endpoints,
+          });
+        }
       }
     } catch { /* fail-open */ } finally { clearTimeout(t); }
   }));

package/src/server.js

@@ -21,7 +21,7 @@ import { createServer } from 'node:http';
 import { loadConfig } from './config.js';
 import { startEntitlementRefresh, maybeRevalidate } from './entitlement-refresh.js';
 import { redactSegments, segment } from './redact.js';
-import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
+import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer, restoreDeep } from './stream.js';
 import { restoreText, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote, assertEndpointUrl } from '@chatpanel/pii';
 import { ensureGatewayToken, isAdminAuthorized } from './gateway-token.js';
 import { secureFetch } from './secure-fetch.js';
@@ -55,7 +55,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.62';
+export const VERSION = '0.6.64';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -424,7 +424,19 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
       if (trace && first) { trace.lap('upstream', up0); sStart = trace.clock(); first = false; } // time-to-first-token
       const restored = restorer.push(chunk);
       if (restored) res.write(shaper.sseDelta(restored));
-    });
+    }, shaper.sseActivity ? (evt) => {
+      // Activity is the agent describing its own work, so it can name a file it read — and
+      // it was handed PLACEHOLDERS, so what it echoes contains them. It is restored like any
+      // other text on the way back: a status line is not a side channel that skips the
+      // round trip and shows the user "[[PERSON_1]].md".
+      //
+      // restoreDeep, NOT the streaming restorer above: that one holds a partial token across
+      // chunks, and pushing an unrelated object through it would splice activity text into
+      // the middle of the assistant's message.
+      try {
+        res.write(shaper.sseActivity(restoreDeep(evt, vault)));
+      } catch { /* a client that hung up mid-turn is not a reason to fail the turn */ }
+    } : null);
     const tail = restorer.flush();
     if (tail) res.write(shaper.sseDelta(tail));
     res.write(shaper.sseTail());
@@ -481,7 +493,7 @@ function resample(input, from, to) {
   return out;
 }
 
-const LOCAL_NAMESPACES = ['/tts', '/stt', '/ner', '/diarize', '/skills', '/config', '/logs', '/status', '/admin'];
+const LOCAL_NAMESPACES = ['/tts', '/stt', '/ner', '/diarize', '/skills', '/redact', '/config', '/logs', '/status', '/admin'];
 
 async function handleApi(req, res, { adapter, kind, pathname, search, base, destKey, destProtocol, harness, trace }, outBody, vault) {
   let upstream;
@@ -1487,6 +1499,30 @@ export function createGateway(cfg = loadConfig()) {
       return sendJson(res, 200, publicConfig(cfg, { proUnlocked }));
     }
 
+    // THE SKILLS ON THIS MACHINE, asked of the gateway rather than the bridge.
+    //
+    // The bridge is what reads the user's disk, so this proxies it — but a client should
+    // have ONE address for everything. A client that talks to the gateway for models and the
+    // bridge for skills has to know both are up, hold both tokens, and handle two failure
+    // modes for one screen; and the direct-to-bridge path is the one with no policy in front
+    // of it, so making it necessary for a feature is how it becomes the habit.
+    if (req.method === 'GET' && pathname === '/skills') {
+      const base = String(cfg.bridge?.url || '').replace(/\/$/, '');
+      if (!base) return sendJson(res, 503, { error: { message: 'no bridge is configured', type: 'no_bridge' } });
+      const token = readBridgeToken(cfg.bridge?.token);
+      try {
+        const r = await fetch(`${base}/skills`, {
+          headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+          signal: AbortSignal.timeout(8000),
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) return sendJson(res, r.status, { error: { message: data?.error || `bridge ${r.status}`, type: 'bridge_error' } });
+        return sendJson(res, 200, { skills: Array.isArray(data?.skills) ? data.skills : [] });
+      } catch (e) {
+        return sendJson(res, 502, { error: { message: `bridge unreachable: ${e.message}`, type: 'bridge_unreachable' } });
+      }
+    }
+
     // Model discovery — aggregate every destination's models.
     if (req.method === 'GET' && /\/models$/.test(pathname)) {
       return sendJson(res, 200, await aggregateModelsAsync(cfg));

package/src/shape.js

@@ -38,6 +38,25 @@ export function openaiChat(model) {
     sseTail() {
       return sse({ ...base, choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] }) + 'data: [DONE]\n\n';
     },
+    /**
+     * What the agent is DOING, on a chunk an OpenAI client ignores.
+     *
+     * The chunk is well-formed and carries an empty delta, so a strict client sees a frame
+     * with nothing in it and moves on — which is what makes this additive rather than a
+     * change to the wire contract. A ChatPanel client reads the extra `chatpanel` key.
+     *
+     * This exists because an agent spends its first ten seconds reading files, and a client
+     * routed through the gateway had no way to know that while one talking to the bridge
+     * directly did. A protocol gap that rewards going around the redacting proxy is a
+     * security problem wearing a UI problem's clothes.
+     */
+    sseActivity(evt) {
+      return sse({
+        ...base,
+        choices: [{ index: 0, delta: {}, finish_reason: null }],
+        chatpanel: { kind: 'activity', event: evt },
+      });
+    },
     // Tool-relay (agent destinations): emit the agent's tool call as an OpenAI
     // tool_calls delta, then end the turn with finish_reason:tool_calls.
     sseToolCalls(calls) {