@chatpanel/gateway 0.6.63 → 0.6.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.63",
+  "version": "0.6.65",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/bridge.js

@@ -67,9 +67,11 @@ export async function openBridgeChat({ bridgeUrl, agent, token, messages, system
   return res;
 }
 
-// Stream a turn through the bridge. Calls onText(restorableChunk) for each delta
+// Stream a turn through the bridge. Calls onText(restorableChunk) for each delta, and
+// onActivity(event) for everything else the agent reports — status lines, the working
+// directory, tool calls, reasoning.
 // of model text and returns the full (un-restored) text. Throws on bridge error.
-export async function streamBridgeChat({ bridgeUrl, agent, token, messages, system, options, signal }, onText) {
+export async function streamBridgeChat({ bridgeUrl, agent, token, messages, system, options, signal }, onText, onActivity = null) {
   const res = await fetch(`${bridgeUrl.replace(/\/$/, '')}/chat`, {
     method: 'POST',
     headers: {
@@ -118,8 +120,20 @@ export async function streamBridgeChat({ bridgeUrl, agent, token, messages, syst
         }
       } else if (evt.type === 'error') {
         err = new Error(evt.error || 'bridge error');
+      } else if (onActivity) {
+        // WHAT THE AGENT IS DOING, for a client that wants to show it.
+        //
+        // These used to be dropped with a comment calling them "the agent's local side
+        // effects". They are — and they are also the ONLY thing that happens for the ten
+        // seconds an agent spends reading files before it says a word. A client routed
+        // through this gateway saw a spinner and nothing else, while one talking to the
+        // bridge directly showed the work; that difference was pushing clients toward the
+        // direct path, which is the one with no redaction in it.
+        //
+        // Passed through as-is. Deciding here which of a coding agent's events are worth
+        // showing would be this file guessing at someone's UI.
+        onActivity(evt);
       }
-      // tool / reasoning / status events are the agent's local side effects — ignore.
     }
   };
 

package/src/router.js

@@ -12,6 +12,7 @@
 //   }
 
 import { secureFetch } from './secure-fetch.js';
+import { readBridgeToken } from './bridge.js';
 //
 // /v1/models aggregates every destination's models so clients can discover them.
 
@@ -67,22 +68,155 @@ export function resolveDestination(model, cfg, kind, { destination = '' } = {})
 // Aggregate every destination's models for GET /v1/models. Agents expose their
 // own name as the model; APIs expose ONLY real model ids (never the destination
 // id — that's a provider name, not a model).
+/**
+ * WHICH API SHAPE A MODEL WANTS TO BE CALLED WITH.
+ *
+ * `owned_by` names the destination, which is a routing fact, not a calling convention — and
+ * a client needs the second one to build a request. Anthropic models take the Messages API;
+ * OpenAI-compatible ones take chat/completions (and the Responses API where the destination
+ * offers it); an agent takes neither, because the gateway synthesises the response itself
+ * from the bridge's stream.
+ *
+ * Stated here rather than inferred from the id in every client. Guessing from the name is
+ * how `claude` the local CLI agent gets called as if it were Anthropic's hosted API.
+ */
+function apiShapeOf(d) {
+  if (d.type === 'agent') return { api: 'agent', endpoints: ['/v1/chat/completions'] };
+  if (d.protocol === 'anthropic') return { api: 'anthropic', endpoints: ['/v1/messages'] };
+  return { api: 'openai', endpoints: ['/v1/chat/completions', '/v1/responses'] };
+}
+
 export function aggregateModels(cfg) {
   const data = [];
   const seen = new Set();
-  const add = (id, owner) => { if (id && !seen.has(id)) { seen.add(id); data.push({ id, object: 'model', owned_by: owner }); } };
+  const add = (id, owner, d) => {
+    if (!id || seen.has(id)) return;
+    seen.add(id);
+    const shape = apiShapeOf(d);
+    data.push({
+      id,
+      object: 'model',
+      owned_by: owner,
+      // Additive fields an OpenAI client ignores and a ChatPanel client uses to decide how
+      // to call, and to group a picker by provider instead of by a flat list of ids.
+      provider: d.id,
+      provider_type: d.type === 'agent' ? 'agent' : (d.protocol === 'anthropic' ? 'anthropic' : 'openai'),
+      api: shape.api,
+      endpoints: shape.endpoints,
+    });
+  };
   for (const d of listDestinations(cfg)) {
-    if (d.type === 'agent') for (const m of (d.models?.length ? d.models : [d.id])) add(m, 'chatpanel-bridge');
-    else for (const m of (d.models || [])) add(m, d.id);
+    if (d.type === 'agent') for (const m of (d.models?.length ? d.models : [d.id])) add(m, 'chatpanel-bridge', d);
+    else for (const m of (d.models || [])) add(m, d.id, d);
   }
   return { object: 'list', data };
 }
 
+/**
+ * The models each installed agent can be asked for.
+ *
+ * A CLI agent is not one model — Claude Code takes opus/sonnet/haiku, others enumerate their
+ * own — and listing only the agent id meant a user picked `claude` and got whatever default
+ * the CLI had. When that default is newer than the installed CLI, the answer is a version
+ * error about a model the user never chose.
+ *
+ * Asked of the bridge, which is the only thing that knows what each CLI supports, and only
+ * for agents that are actually INSTALLED: enumerating models for a CLI that is not there
+ * spends a subprocess per agent to describe something unusable.
+ */
+async function bridgeAgentModels(cfg, installed, timeoutMs) {
+  const base = String(cfg?.bridge?.url || '').replace(/\/$/, '');
+  if (!base || !installed) return new Map();
+  const token = readBridgeToken(cfg.bridge?.token);
+  const ids = [...installed.entries()].filter(([, ok]) => ok).map(([id]) => id);
+  const out = new Map();
+  await Promise.all(ids.map(async (id) => {
+    try {
+      const res = await fetch(`${base}/list-models`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+        body: JSON.stringify({ agent: id }),
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+      if (!res.ok) return;
+      const body = await res.json();
+      const models = (Array.isArray(body?.models) ? body.models : [])
+        .map((m) => (typeof m === 'string' ? m : m?.id || m?.name || ''))
+        .map((m) => String(m).trim())
+        .filter(Boolean);
+      if (models.length) out.set(id, models.slice(0, 40));
+    } catch { /* an agent that will not enumerate still works under its bare id */ }
+  }));
+  return out;
+}
+
+/** id → installed, from the bridge's own /health. `null` when it could not be asked. */
+async function bridgeAgentAvailability(cfg, timeoutMs) {
+  const base = String(cfg?.bridge?.url || '').replace(/\/$/, '');
+  if (!base) return null;
+  try {
+    const token = readBridgeToken(cfg.bridge?.token);
+    const res = await fetch(`${base}/health`, {
+      headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (!Array.isArray(body?.agents)) return null;
+    return new Map(body.agents.map((a) => [a.id, !!a.available]));
+  } catch {
+    return null; // not reachable — say nothing rather than saying "none"
+  }
+}
+
 // Async variant: also PROXIES each API destination's own /v1/models to discover
 // real model ids (using its saved key). Fail-open per destination.
 export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
   const base = aggregateModels(cfg);
   const seen = new Set(base.data.map((m) => m.id));
+
+  // WHICH AGENTS ARE ACTUALLY ON THIS MACHINE.
+  //
+  // The list above is the ROUTING TABLE: it names every agent the gateway would route to,
+  // whether or not that CLI is installed. On a fresh machine that is a model picker full of
+  // names that all fail on first use, which is the worst possible first five minutes.
+  //
+  // Only the bridge knows what is on disk, so the gateway asks it — once, here — rather than
+  // every client asking separately. A client that had to check for itself would need the
+  // bridge's address and token as well as ours, and the direct-to-bridge path is the one
+  // with no policy in front of it; making it necessary is how it becomes the habit.
+  //
+  // `available` is left UNDEFINED when the bridge cannot be reached. Absent means "we did not
+  // find out", which is not the same as false, and a picker that greys out every agent
+  // because one health check timed out is worse than one that says nothing.
+  const agentAvailability = await bridgeAgentAvailability(cfg, timeoutMs);
+  if (agentAvailability) {
+    for (const m of base.data) {
+      if (m.owned_by === 'chatpanel-bridge') m.available = agentAvailability.get(m.id) ?? false;
+    }
+  }
+
+  // Each installed agent's own models, listed as `agent/model` beside the bare id. The bare
+  // id stays and still means "the agent's default", so nothing that already works breaks.
+  const agentModels = await bridgeAgentModels(cfg, agentAvailability, timeoutMs);
+  for (const [agent, models] of agentModels) {
+    const parent = base.data.find((m) => m.id === agent);
+    if (!parent) continue;
+    for (const model of models) {
+      const id = `${agent}/${model}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      base.data.push({
+        ...parent,
+        id,
+        // `model` is what the picker shows under the agent's heading; the agent stays the
+        // provider, so the grouping puts them together without any id parsing.
+        model,
+        available: true,
+      });
+    }
+  }
+
   const dests = listDestinations(cfg).filter((d) => d.type === 'api' && d.baseUrl);
   await Promise.all(dests.map(async (d) => {
     const ctrl = new AbortController();
@@ -100,7 +234,15 @@ export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
       const list = Array.isArray(j?.data) ? j.data : (Array.isArray(j?.models) ? j.models : []);
       for (const m of list) {
         const id = typeof m === 'string' ? m : m?.id;
-        if (id && !seen.has(id)) { seen.add(id); base.data.push({ id, object: 'model', owned_by: d.id }); }
+        if (id && !seen.has(id)) {
+          seen.add(id);
+          const shape = apiShapeOf(d);
+          base.data.push({
+            id, object: 'model', owned_by: d.id, provider: d.id,
+            provider_type: d.protocol === 'anthropic' ? 'anthropic' : 'openai',
+            api: shape.api, endpoints: shape.endpoints,
+          });
+        }
       }
     } catch { /* fail-open */ } finally { clearTimeout(t); }
   }));

package/src/server.js

@@ -21,7 +21,7 @@ import { createServer } from 'node:http';
 import { loadConfig } from './config.js';
 import { startEntitlementRefresh, maybeRevalidate } from './entitlement-refresh.js';
 import { redactSegments, segment } from './redact.js';
-import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
+import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer, restoreDeep } from './stream.js';
 import { restoreText, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote, assertEndpointUrl } from '@chatpanel/pii';
 import { ensureGatewayToken, isAdminAuthorized } from './gateway-token.js';
 import { secureFetch } from './secure-fetch.js';
@@ -55,7 +55,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.63';
+export const VERSION = '0.6.65';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -204,8 +204,31 @@ function route(pathname, headers, cfg) {
   return { kind: 'openai', adapter: openai, redactable: openai.matches(pathname), base: cfg.upstreams?.openai?.baseUrl };
 }
 
+/**
+ * An agent id, and the model to run it with.
+ *
+ * A CLI agent is not one model. Claude Code takes `opus`, `sonnet` or `haiku`; the others
+ * have their own lists. Picking `claude` alone leaves the CLI on whatever default it has,
+ * which is how a user gets "this version does not support that model" from a tool they never
+ * chose a model for. So `claude/opus` names both, and the slash is the only new syntax.
+ *
+ * A bare agent id still works and still means "the agent's own default" — every client that
+ * predates this keeps working, which is the whole reason the model is a SUFFIX rather than a
+ * change to the id.
+ */
+export function parseAgentModel(model, cfg) {
+  const raw = String(model || '');
+  if (KNOWN_AGENTS.has(raw)) return { agent: raw, agentModel: '' };
+  const slash = raw.indexOf('/');
+  if (slash > 0) {
+    const head = raw.slice(0, slash);
+    if (KNOWN_AGENTS.has(head)) return { agent: head, agentModel: raw.slice(slash + 1) };
+  }
+  return { agent: cfg.bridge.agent, agentModel: '' };
+}
+
 function pickAgent(model, cfg) {
-  return KNOWN_AGENTS.has(model) ? model : cfg.bridge.agent;
+  return parseAgentModel(model, cfg).agent;
 }
 
 // A follow-up request carrying a tool result for a PARKED relay session. Such a
@@ -393,7 +416,13 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
   const ac = new AbortController();
   req.on('close', () => ac.abort());
 
-  const turn = { bridgeUrl: cfg.bridge.url, agent, token, messages, system, signal: ac.signal };
+  // The model half of `claude/opus`, handed to the CLI as its `--model`. Absent for a bare
+  // agent id, which leaves the agent on its own default exactly as before.
+  const { agentModel } = parseAgentModel(body?.model, cfg);
+  const turn = {
+    bridgeUrl: cfg.bridge.url, agent, token, messages, system, signal: ac.signal,
+    ...(agentModel ? { options: { model: agentModel } } : {}),
+  };
 
   if (!wantStream) {
     try {
@@ -424,7 +453,19 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
       if (trace && first) { trace.lap('upstream', up0); sStart = trace.clock(); first = false; } // time-to-first-token
       const restored = restorer.push(chunk);
       if (restored) res.write(shaper.sseDelta(restored));
-    });
+    }, shaper.sseActivity ? (evt) => {
+      // Activity is the agent describing its own work, so it can name a file it read — and
+      // it was handed PLACEHOLDERS, so what it echoes contains them. It is restored like any
+      // other text on the way back: a status line is not a side channel that skips the
+      // round trip and shows the user "[[PERSON_1]].md".
+      //
+      // restoreDeep, NOT the streaming restorer above: that one holds a partial token across
+      // chunks, and pushing an unrelated object through it would splice activity text into
+      // the middle of the assistant's message.
+      try {
+        res.write(shaper.sseActivity(restoreDeep(evt, vault)));
+      } catch { /* a client that hung up mid-turn is not a reason to fail the turn */ }
+    } : null);
     const tail = restorer.flush();
     if (tail) res.write(shaper.sseDelta(tail));
     res.write(shaper.sseTail());
@@ -481,7 +522,7 @@ function resample(input, from, to) {
   return out;
 }
 
-const LOCAL_NAMESPACES = ['/tts', '/stt', '/ner', '/diarize', '/skills', '/config', '/logs', '/status', '/admin'];
+const LOCAL_NAMESPACES = ['/tts', '/stt', '/ner', '/diarize', '/skills', '/redact', '/config', '/logs', '/status', '/admin'];
 
 async function handleApi(req, res, { adapter, kind, pathname, search, base, destKey, destProtocol, harness, trace }, outBody, vault) {
   let upstream;
@@ -1487,6 +1528,30 @@ export function createGateway(cfg = loadConfig()) {
       return sendJson(res, 200, publicConfig(cfg, { proUnlocked }));
     }
 
+    // THE SKILLS ON THIS MACHINE, asked of the gateway rather than the bridge.
+    //
+    // The bridge is what reads the user's disk, so this proxies it — but a client should
+    // have ONE address for everything. A client that talks to the gateway for models and the
+    // bridge for skills has to know both are up, hold both tokens, and handle two failure
+    // modes for one screen; and the direct-to-bridge path is the one with no policy in front
+    // of it, so making it necessary for a feature is how it becomes the habit.
+    if (req.method === 'GET' && pathname === '/skills') {
+      const base = String(cfg.bridge?.url || '').replace(/\/$/, '');
+      if (!base) return sendJson(res, 503, { error: { message: 'no bridge is configured', type: 'no_bridge' } });
+      const token = readBridgeToken(cfg.bridge?.token);
+      try {
+        const r = await fetch(`${base}/skills`, {
+          headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+          signal: AbortSignal.timeout(8000),
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) return sendJson(res, r.status, { error: { message: data?.error || `bridge ${r.status}`, type: 'bridge_error' } });
+        return sendJson(res, 200, { skills: Array.isArray(data?.skills) ? data.skills : [] });
+      } catch (e) {
+        return sendJson(res, 502, { error: { message: `bridge unreachable: ${e.message}`, type: 'bridge_unreachable' } });
+      }
+    }
+
     // Model discovery — aggregate every destination's models.
     if (req.method === 'GET' && /\/models$/.test(pathname)) {
       return sendJson(res, 200, await aggregateModelsAsync(cfg));

package/src/shape.js

@@ -38,6 +38,25 @@ export function openaiChat(model) {
     sseTail() {
       return sse({ ...base, choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] }) + 'data: [DONE]\n\n';
     },
+    /**
+     * What the agent is DOING, on a chunk an OpenAI client ignores.
+     *
+     * The chunk is well-formed and carries an empty delta, so a strict client sees a frame
+     * with nothing in it and moves on — which is what makes this additive rather than a
+     * change to the wire contract. A ChatPanel client reads the extra `chatpanel` key.
+     *
+     * This exists because an agent spends its first ten seconds reading files, and a client
+     * routed through the gateway had no way to know that while one talking to the bridge
+     * directly did. A protocol gap that rewards going around the redacting proxy is a
+     * security problem wearing a UI problem's clothes.
+     */
+    sseActivity(evt) {
+      return sse({
+        ...base,
+        choices: [{ index: 0, delta: {}, finish_reason: null }],
+        chatpanel: { kind: 'activity', event: evt },
+      });
+    },
     // Tool-relay (agent destinations): emit the agent's tool call as an OpenAI
     // tool_calls delta, then end the turn with finish_reason:tool_calls.
     sseToolCalls(calls) {