@chatpanel/gateway 0.6.65 → 0.6.68

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.65",
-  "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
+  "version": "0.6.68",
+  "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
     "chatpanel-gateway": "bin/chatpanel-gateway.js"

package/src/router.js

@@ -86,6 +86,32 @@ function apiShapeOf(d) {
   return { api: 'openai', endpoints: ['/v1/chat/completions', '/v1/responses'] };
 }
 
+/**
+ * CAN THIS DESTINATION ANSWER AT ALL — before anyone sends a turn to it.
+ *
+ * This list is a ROUTING TABLE. It names every model the gateway would forward to, and a
+ * provider that lists four hundred can be configured with no key at all — so the list is
+ * mostly names that cannot answer. A user picks one, and finds out at 08:00 when a scheduled
+ * job comes back `Missing Authentication header` or `upstream fetch failed`, quoting undici
+ * about a destination they never knowingly chose.
+ *
+ * Local endpoints are the exception that must NOT be marked unconfigured: llama.cpp, Ollama
+ * and LM Studio take no key, and greying them out would hide the one setup that needs
+ * nothing. So this asks only the question it can answer honestly — "is a credential
+ * required here, and is one saved" — and says nothing about whether the server is up.
+ *
+ * Returns `''` when there is nothing to report.
+ */
+const LOCAL_HOST = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0|[^/]*\.local)(:|\/|$)/i;
+function unconfiguredReason(d) {
+  if (!d || d.type === 'agent') return '';
+  const base = String(d.baseUrl || '');
+  if (!base) return 'no endpoint URL is set for this provider';
+  if (LOCAL_HOST.test(base)) return '';        // a local server needs no key
+  if (d.apiKey || d.hasKey) return '';
+  return `no API key is saved for ${d.id}`;
+}
+
 export function aggregateModels(cfg) {
   const data = [];
   const seen = new Set();
@@ -93,10 +119,15 @@ export function aggregateModels(cfg) {
     if (!id || seen.has(id)) return;
     seen.add(id);
     const shape = apiShapeOf(d);
+    const blocked = unconfiguredReason(d);
     data.push({
       id,
       object: 'model',
       owned_by: owner,
+      // `configured` is about SETUP, not liveness: false means a turn sent here is known to
+      // fail for a reason the user can fix in Settings. Absent liveness is deliberate — the
+      // gateway does not probe every provider to draw a list.
+      ...(blocked ? { configured: false, reason: blocked } : {}),
       // Additive fields an OpenAI client ignores and a ChatPanel client uses to decide how
       // to call, and to group a picker by provider instead of by a flat list of ids.
       provider: d.id,
@@ -237,10 +268,12 @@ export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
         if (id && !seen.has(id)) {
           seen.add(id);
           const shape = apiShapeOf(d);
+          const blocked = unconfiguredReason(d);
           base.data.push({
             id, object: 'model', owned_by: d.id, provider: d.id,
             provider_type: d.protocol === 'anthropic' ? 'anthropic' : 'openai',
             api: shape.api, endpoints: shape.endpoints,
+            ...(blocked ? { configured: false, reason: blocked } : {}),
           });
         }
       }

package/src/server.js

@@ -55,7 +55,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.65';
+export const VERSION = '0.6.68';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -660,6 +660,10 @@ export function createGateway(cfg = loadConfig()) {
       const tts = ttsEngine.health();
       return sendJson(res, 200, {
         ok: true, version: VERSION, backend: cfg.backend, tier: cfg.redaction.tier,
+        // WHO STARTED THIS PROCESS — additive. ChatPanel Desktop sets CHATPANEL_MANAGED_BY=desktop
+        // on the login service it registers, so a client can say "provided by the desktop app"
+        // and stop offering install.sh for a gateway that is already installed. Absent otherwise.
+        ...(process.env.CHATPANEL_MANAGED_BY ? { managedBy: String(process.env.CHATPANEL_MANAGED_BY).slice(0, 32) } : {}),
         // `runtime` = 'native' (npm, fast quantized) | 'wasm' (binary, slow fp32) —
         // the extension uses it to advise the far-faster native gateway.
         stt: { enabled: cfg.stt?.enabled !== false, state: stt.state, ready: stt.ok, model: stt.model || cfg.stt?.model || DEFAULT_STT_MODEL, runtime: stt.runtime, dtype: stt.dtype },
@@ -676,6 +680,7 @@ export function createGateway(cfg = loadConfig()) {
       const health = await probeNerHealth(cfg); // live GET /health on the detector
       return sendJson(res, 200, {
         ok: true, version: VERSION, backend: cfg.backend, tier: cfg.redaction.tier,
+        ...(process.env.CHATPANEL_MANAGED_BY ? { managedBy: String(process.env.CHATPANEL_MANAGED_BY).slice(0, 32) } : {}), // see /health
         ner: {
           autostart: !!cfg.ner?.autostart,
           configured: health.configured,
@@ -1552,6 +1557,37 @@ export function createGateway(cfg = loadConfig()) {
       }
     }
 
+    // ONE skill, with the prompt the list deliberately leaves out.
+    //
+    // /skills answers `promptChars` — a COUNT — because a list of ninety-five skills carrying
+    // ninety-five prompt bodies is a megabyte nobody asked for. A client that wants to scope a
+    // task to a skill needs the body itself, and the only other way to get it was to go
+    // straight at the bridge, which is the habit the /skills comment above exists to prevent.
+    //
+    // The id is passed through as ONE path segment, encoded. A skill id is a file name on the
+    // user's disk, so letting a slash or a `..` reach the bridge's reader would be asking it
+    // to open something else; the bridge validates too, and this is the half we own.
+    if (req.method === 'GET' && /^\/skills\/[^/]+$/.test(pathname)) {
+      const id = decodeURIComponent(pathname.slice('/skills/'.length));
+      if (!id || id === '.' || id === '..' || id.includes('/') || id.includes('\\')) {
+        return sendJson(res, 400, { error: { message: 'not a skill id', type: 'invalid_request' } });
+      }
+      const base = String(cfg.bridge?.url || '').replace(/\/$/, '');
+      if (!base) return sendJson(res, 503, { error: { message: 'no bridge is configured', type: 'no_bridge' } });
+      const token = readBridgeToken(cfg.bridge?.token);
+      try {
+        const r = await fetch(`${base}/skills/${encodeURIComponent(id)}`, {
+          headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+          signal: AbortSignal.timeout(8000),
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) return sendJson(res, r.status, { error: { message: data?.error || `bridge ${r.status}`, type: 'bridge_error' } });
+        return sendJson(res, 200, { skill: data?.skill || null });
+      } catch (e) {
+        return sendJson(res, 502, { error: { message: `bridge unreachable: ${e.message}`, type: 'bridge_unreachable' } });
+      }
+    }
+
     // Model discovery — aggregate every destination's models.
     if (req.method === 'GET' && /\/models$/.test(pathname)) {
       return sendJson(res, 200, await aggregateModelsAsync(cfg));