@chatpanel/gateway 0.6.66 → 0.6.69

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.66",
-  "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
+  "version": "0.6.69",
+  "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
     "chatpanel-gateway": "bin/chatpanel-gateway.js"

package/src/server.js

@@ -55,7 +55,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.66';
+export const VERSION = '0.6.69';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -170,7 +170,7 @@ function mkTrace(sink) {
       const entry = /** @type {any} */ ({ ...this.meta, timings });
       setImmediate(() => {
         sink(entry);
-        console.log(`[gateway] model=${entry.model || '-'} → ${entry.dest ? `${entry.dest}(${entry.type})` : 'none'} · redacted ${entry.redacted || 0}${entry.sanitized ? ` · scrubbed ${entry.sanitized} hidden` : ''}${entry.narrowed ? ` · narrowed -${entry.narrowed}` : ''} · ${fmtTimings(timings)}`);
+        console.log(`[gateway] model=${entry.model || '-'} → ${entry.dest ? `${entry.dest}(${entry.type})` : 'none'} · ${entry.redaction === 'off' ? 'redaction OFF (client request)' : `redacted ${entry.redacted || 0}`}${entry.sanitized ? ` · scrubbed ${entry.sanitized} hidden` : ''}${entry.narrowed ? ` · narrowed -${entry.narrowed}` : ''} · ${fmtTimings(timings)}`);
       });
     },
   };
@@ -660,6 +660,10 @@ export function createGateway(cfg = loadConfig()) {
       const tts = ttsEngine.health();
       return sendJson(res, 200, {
         ok: true, version: VERSION, backend: cfg.backend, tier: cfg.redaction.tier,
+        // WHO STARTED THIS PROCESS — additive. ChatPanel Desktop sets CHATPANEL_MANAGED_BY=desktop
+        // on the login service it registers, so a client can say "provided by the desktop app"
+        // and stop offering install.sh for a gateway that is already installed. Absent otherwise.
+        ...(process.env.CHATPANEL_MANAGED_BY ? { managedBy: String(process.env.CHATPANEL_MANAGED_BY).slice(0, 32) } : {}),
         // `runtime` = 'native' (npm, fast quantized) | 'wasm' (binary, slow fp32) —
         // the extension uses it to advise the far-faster native gateway.
         stt: { enabled: cfg.stt?.enabled !== false, state: stt.state, ready: stt.ok, model: stt.model || cfg.stt?.model || DEFAULT_STT_MODEL, runtime: stt.runtime, dtype: stt.dtype },
@@ -676,6 +680,7 @@ export function createGateway(cfg = loadConfig()) {
       const health = await probeNerHealth(cfg); // live GET /health on the detector
       return sendJson(res, 200, {
         ok: true, version: VERSION, backend: cfg.backend, tier: cfg.redaction.tier,
+        ...(process.env.CHATPANEL_MANAGED_BY ? { managedBy: String(process.env.CHATPANEL_MANAGED_BY).slice(0, 32) } : {}), // see /health
         ner: {
           autostart: !!cfg.ner?.autostart,
           configured: health.configured,
@@ -1552,6 +1557,37 @@ export function createGateway(cfg = loadConfig()) {
       }
     }
 
+    // ONE skill, with the prompt the list deliberately leaves out.
+    //
+    // /skills answers `promptChars` — a COUNT — because a list of ninety-five skills carrying
+    // ninety-five prompt bodies is a megabyte nobody asked for. A client that wants to scope a
+    // task to a skill needs the body itself, and the only other way to get it was to go
+    // straight at the bridge, which is the habit the /skills comment above exists to prevent.
+    //
+    // The id is passed through as ONE path segment, encoded. A skill id is a file name on the
+    // user's disk, so letting a slash or a `..` reach the bridge's reader would be asking it
+    // to open something else; the bridge validates too, and this is the half we own.
+    if (req.method === 'GET' && /^\/skills\/[^/]+$/.test(pathname)) {
+      const id = decodeURIComponent(pathname.slice('/skills/'.length));
+      if (!id || id === '.' || id === '..' || id.includes('/') || id.includes('\\')) {
+        return sendJson(res, 400, { error: { message: 'not a skill id', type: 'invalid_request' } });
+      }
+      const base = String(cfg.bridge?.url || '').replace(/\/$/, '');
+      if (!base) return sendJson(res, 503, { error: { message: 'no bridge is configured', type: 'no_bridge' } });
+      const token = readBridgeToken(cfg.bridge?.token);
+      try {
+        const r = await fetch(`${base}/skills/${encodeURIComponent(id)}`, {
+          headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+          signal: AbortSignal.timeout(8000),
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) return sendJson(res, r.status, { error: { message: data?.error || `bridge ${r.status}`, type: 'bridge_error' } });
+        return sendJson(res, 200, { skill: data?.skill || null });
+      } catch (e) {
+        return sendJson(res, 502, { error: { message: `bridge unreachable: ${e.message}`, type: 'bridge_unreachable' } });
+      }
+    }
+
     // Model discovery — aggregate every destination's models.
     if (req.method === 'GET' && /\/models$/.test(pathname)) {
       return sendJson(res, 200, await aggregateModelsAsync(cfg));
@@ -1588,6 +1624,7 @@ export function createGateway(cfg = loadConfig()) {
     let redactedCount = 0;
     let sanitizedCount = 0;
     let narrowedTools = 0;
+    let redactionOff = false;
     let isPro = true;
     // Off the hot path: only build a trace when logging is on, so it adds nothing
     // when off (no clock reads, no record, no console line).
@@ -1623,14 +1660,24 @@ export function createGateway(cfg = loadConfig()) {
             type: 'free_limit_reached',
           } });
         }
-        const segs = r.adapter.collectSegments(body, cfg.redaction);
+        // REDACTION OFF, FOR THIS REQUEST, BECAUSE THE USER SAID SO. A note task that reads
+        // "write about NVIDIA GPUs" had NVIDIA replaced with an organisation placeholder, and
+        // the model — seeing only [[ORG_1]] — guessed a different company and wrote about
+        // that. The policy is right for the corpus and wrong for the user's own instruction,
+        // and only the user can tell which a given turn is. So an AUTHENTICATED local client
+        // (the desktop, the extension — both hold the gateway token) may send
+        // `X-ChatPanel-Redaction: off`; the trace records it so the ledger says "redaction
+        // was off for this turn" rather than "0 redactions", which would read as "nothing to
+        // redact". Anonymous callers cannot switch it off: that is what the token is for.
+        redactionOff = String(req.headers['x-chatpanel-redaction'] || '').trim().toLowerCase() === 'off' && isAdminAuthorized(req);
+        const segs = redactionOff ? [] : r.adapter.collectSegments(body, cfg.redaction);
         const ac = new AbortController();
         req.on('close', () => ac.abort());
         const rd0 = trace ? trace.clock() : 0;
         // Redact at the configured tier for everyone (free users get name/org
         // redaction within their allowance); the custom dictionary stays capped for
         // free (isPro decides that inside).
-        const { vault: v, count, sanitized } = await redactSegments(segs, cfg.redaction, {
+        const { vault: v, count, sanitized } = redactionOff ? { vault: null, count: 0, sanitized: 0 } : await redactSegments(segs, cfg.redaction, {
           signal: ac.signal,
           isPro,
           // A detector is the only hop that sees the request BEFORE redaction. It is guarded
@@ -1659,7 +1706,7 @@ export function createGateway(cfg = loadConfig()) {
         // tools (so privacy-aware models USE them instead of refusing). Injected
         // AFTER redaction so the note isn't itself redacted. Covers BOTH the API
         // forward and the relay (which reads system from this same body).
-        if (Array.isArray(body.tools) && body.tools.length && typeof r.adapter.injectSystemNote === 'function') {
+        if (!redactionOff && Array.isArray(body.tools) && body.tools.length && typeof r.adapter.injectSystemNote === 'function') {
           r.adapter.injectSystemNote(body, placeholderToolNote({ toolData: cfg.tools?.toolData }));
         }
         outBody = Buffer.from(JSON.stringify(body), 'utf8');
@@ -1713,7 +1760,7 @@ export function createGateway(cfg = loadConfig()) {
       });
     }
     if (trace) {
-      trace.meta = { t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, sanitized: sanitizedCount, narrowed: narrowedTools, detail: redactionDetail(vault, cfg.logDetail) };
+      trace.meta = { t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, sanitized: sanitizedCount, narrowed: narrowedTools, detail: redactionDetail(vault, cfg.logDetail), redaction: redactionOff ? 'off' : (cfg.redaction.tier || 'basic') };
     }
     if (dest && dest.type === 'api') {
       if (!dest.baseUrl) { trace?.commit(); return sendJson(res, 502, { error: `destination "${dest.id}" has no baseUrl` }); }

package/src/stream.js

@@ -17,23 +17,30 @@ import { restoreText, restoreWithAliases } from '@chatpanel/pii';
 // Returns a TransformStream-free chunk transformer: feed it decoded string chunks,
 // it returns the prefix that's safe to forward now and buffers a possibly-partial
 // trailing token. Call flush() at end-of-stream.
+/**
+ * Split `buf` into what is safe to forward now and what may still be the start of a token.
+ *
+ * Two shapes are held back: an unterminated "[[" (a token mid-way), and a trailing SINGLE
+ * "[" — a model tokenizes "[[ORG_1]]" as "[" + "[ORG_1]]" often enough that forwarding the
+ * lone bracket left every restored name wearing one: "[NVIDIA designs GPUs". "[[" cannot
+ * legitimately appear except as a token open, and a lone "[" at a chunk edge costs nothing to
+ * wait one chunk for.
+ */
+function splitSafe(buf) {
+  const open = buf.lastIndexOf('[[');
+  if (open !== -1 && !buf.slice(open).includes(']]')) return [buf.slice(0, open), buf.slice(open)];
+  if (buf.endsWith('[')) return [buf.slice(0, -1), '['];
+  return [buf, ''];
+}
+
 export function makeTokenRestorer(vault) {
   let buf = '';
   return {
     push(chunk) {
       if (!vault) return chunk || '';
       buf += chunk || '';
-      // If an unterminated "[[" sits in the tail, a token may still be forming —
-      // hold from there. "[[" can't legitimately appear except as a token open.
-      const open = buf.lastIndexOf('[[');
       let safe;
-      if (open !== -1 && !buf.slice(open).includes(']]')) {
-        safe = buf.slice(0, open);
-        buf = buf.slice(open);
-      } else {
-        safe = buf;
-        buf = '';
-      }
+      [safe, buf] = splitSafe(buf);
       return restoreText(safe, vault);
     },
     flush() {
@@ -83,10 +90,8 @@ function makeFieldRestorer(vault, restoreFn) {
   return {
     push(chunk) {
       buf += chunk || '';
-      const open = buf.lastIndexOf('[[');
       let safe;
-      if (open !== -1 && !buf.slice(open).includes(']]')) { safe = buf.slice(0, open); buf = buf.slice(open); }
-      else { safe = buf; buf = ''; }
+      [safe, buf] = splitSafe(buf);
       return restoreFn(safe, vault);
     },
     flush() { const out = restoreFn(buf, vault); buf = ''; return out; },