@chatpanel/gateway 0.6.73 → 0.6.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.73",
+  "version": "0.6.75",
   "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/bridge.js

@@ -58,14 +58,76 @@ export async function resolveBridgeUrl(cfg, { fallback, timeoutMs = 1500, now =
 /** Test seam. */
 export function resetBridgeResolution() { bridgeResolved = { at: 0, cfgUrl: '', url: '', fell: false }; }
 
-export function readBridgeToken(cfgToken, tokenPath = DEFAULT_TOKEN_PATH) {
-  if (cfgToken) return cfgToken;
+// Once the bridge has REJECTED the configured token while the file held a different one,
+// the file is what every later call presents. Set by `bridgeTokenRejected`, below.
+let preferFileToken = false;
+
+function fileToken(tokenPath) {
   try {
     if (existsSync(tokenPath)) return readFileSync(tokenPath, 'utf8').trim();
   } catch { /* ignore */ }
   return '';
 }
 
+/**
+ * The bridge token: the config's value first, the file otherwise — until the bridge says
+ * the config's value is wrong.
+ *
+ * `bridge.token` in gateway.config.json is a COPY: the extension's Gateway tab writes its
+ * own setting there, and a bridge that regenerates its token leaves the copy behind. The
+ * desktop then relayed every Codex turn with the stale copy and got 403 from a bridge ten
+ * milliseconds away — an empty streaming bubble, forever. The file is written by the
+ * bridge itself, so when the configured token is rejected and the file differs, the file
+ * is tried once and, if it works, kept. Nothing is second-guessed before the bridge has
+ * actually said no: a pinned token on a loopback bridge stays a pinned token.
+ */
+export function readBridgeToken(cfgToken, tokenPath = DEFAULT_TOKEN_PATH) {
+  const file = fileToken(tokenPath);
+  if (!cfgToken) return file;
+  if (preferFileToken && file && file !== cfgToken) return file;
+  return cfgToken;
+}
+
+/**
+ * Called with the token the bridge just refused. Returns the file's token when it is a
+ * different one worth trying — and from then on `readBridgeToken` prefers it — or '' when
+ * there is nothing else to try.
+ */
+export function bridgeTokenRejected(rejected, tokenPath = DEFAULT_TOKEN_PATH) {
+  const file = fileToken(tokenPath);
+  if (!file || file === rejected) return '';
+  if (!preferFileToken) {
+    preferFileToken = true;
+    console.warn('[gateway] the bridge rejected bridge.token from gateway.config.json; using ~/.chatpanel/bridge-token (the bridge wrote it). Clear the config value to silence this.');
+  }
+  return file;
+}
+
+/** Test seam. */
+export function resetBridgeTokenPreference() { preferFileToken = false; }
+
+const isAuthFailure = (status) => status === 401 || status === 403;
+
+// One POST to /chat, retried once with the file's token when the bridge refuses the one
+// it was given — the stale-copy case above.
+async function postChat(bridgeUrl, token, body, signal, tokenPath) {
+  const send = (t) => fetch(`${bridgeUrl.replace(/\/$/, '')}/chat`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...(t ? { authorization: `Bearer ${t}` } : {}) },
+    body,
+    signal,
+  });
+  // A caller hands over the token it resolved; once a rejection has flipped the
+  // preference, the file's token goes first here too.
+  const first = readBridgeToken(token, tokenPath);
+  let res = await send(first);
+  if (isAuthFailure(res.status)) {
+    const alt = bridgeTokenRejected(first, tokenPath);
+    if (alt) { await res.text().catch(() => {}); res = await send(alt); }
+  }
+  return res;
+}
+
 // Flatten an OpenAI/Anthropic message's content (string | parts[]) to plain text
 // for the bridge, which expects string content. Image parts are dropped here (the
 // bridge takes images separately; wire that later if needed).
@@ -88,19 +150,14 @@ export function toBridgeMessages(messages) {
 
 // Open a bridge /chat stream WITH tool specs (pageTools), returning the raw fetch
 // Response so the tool-relay can hold the reader open across the OpenAI round-trip.
-export async function openBridgeChat({ bridgeUrl, agent, token, messages, system, specs, options, signal }) {
-  const res = await fetch(`${bridgeUrl.replace(/\/$/, '')}/chat`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
-    body: JSON.stringify({
-      agent,
-      messages: toBridgeMessages(messages),
-      system: system || '',
-      options: options || {},
-      ...(Array.isArray(specs) && specs.length ? { pageTools: { specs } } : {}),
-    }),
-    signal,
-  });
+export async function openBridgeChat({ bridgeUrl, agent, token, messages, system, specs, options, signal, tokenPath }) {
+  const res = await postChat(bridgeUrl, token, JSON.stringify({
+    agent,
+    messages: toBridgeMessages(messages),
+    system: system || '',
+    options: options || {},
+    ...(Array.isArray(specs) && specs.length ? { pageTools: { specs } } : {}),
+  }), signal, tokenPath);
   if (!res.ok || !res.body) {
     const detail = await res.text().catch(() => '');
     throw new Error(`bridge /chat HTTP ${res.status}${detail ? `: ${detail.slice(0, 200)}` : ''}`);
@@ -112,21 +169,13 @@ export async function openBridgeChat({ bridgeUrl, agent, token, messages, system
 // onActivity(event) for everything else the agent reports — status lines, the working
 // directory, tool calls, reasoning.
 // of model text and returns the full (un-restored) text. Throws on bridge error.
-export async function streamBridgeChat({ bridgeUrl, agent, token, messages, system, options, signal }, onText, onActivity = null) {
-  const res = await fetch(`${bridgeUrl.replace(/\/$/, '')}/chat`, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      ...(token ? { authorization: `Bearer ${token}` } : {}),
-    },
-    body: JSON.stringify({
-      agent,
-      messages: toBridgeMessages(messages),
-      system: system || '',
-      options: options || {},
-    }),
-    signal,
-  });
+export async function streamBridgeChat({ bridgeUrl, agent, token, messages, system, options, signal, tokenPath }, onText, onActivity = null) {
+  const res = await postChat(bridgeUrl, token, JSON.stringify({
+    agent,
+    messages: toBridgeMessages(messages),
+    system: system || '',
+    options: options || {},
+  }), signal, tokenPath);
 
   if (!res.ok || !res.body) {
     const detail = await res.text().catch(() => '');

package/src/config.js

@@ -57,6 +57,14 @@ export const DEFAULTS = {
     // Bearer token for the bridge's privileged /chat route. Empty = read the
     // per-install token from ~/.chatpanel/bridge-token.
     token: '',
+    // What a CLI agent driven THROUGH the gateway may do — the same three modes the
+    // extension offers per agent: 'default' (read-only, asks before writing),
+    // 'acceptEdits' (edits files in its workspace on its own), 'bypassPermissions' (full
+    // access and shell). Absent, the bridge ran every gateway turn read-only and told the
+    // model to "set Permissions" in a settings page the desktop did not have.
+    permissionMode: 'default',
+    // Where the agent works. Empty = the bridge's ChatPanel workspace.
+    workingDir: '',
   },
 
   upstreams: {

package/src/configstore.js

@@ -46,7 +46,7 @@ export function publicConfig(cfg, { proUnlocked = false } = {}) {
     backend: cfg.backend,
     // Strip per-destination apiKey (write-only).
     destinations: (Array.isArray(cfg.destinations) ? cfg.destinations : []).map((d) => { const { apiKey, ...rest } = d; return { ...rest, hasKey: !!apiKey }; }),
-    bridge: { url: cfg.bridge?.url, agent: cfg.bridge?.agent, hasToken: !!cfg.bridge?.token },
+    bridge: { url: cfg.bridge?.url, agent: cfg.bridge?.agent, hasToken: !!cfg.bridge?.token, permissionMode: cfg.bridge?.permissionMode || 'default', workingDir: cfg.bridge?.workingDir || '' },
     upstreams: cfg.upstreams,
     redaction: {
       tier: cfg.redaction?.tier,
@@ -98,6 +98,18 @@ export function isSelfDestination(d, cfg = {}) {
   return loop && port === (Number(cfg.port) || 4320);
 }
 
+export const PERMISSION_MODES = ['default', 'acceptEdits', 'bypassPermissions'];
+
+/** The per-turn options a gateway-driven agent receives — the bridge's own vocabulary. */
+export function bridgeAgentOptions(cfg, extra = {}) {
+  const b = cfg?.bridge || {};
+  return {
+    ...(PERMISSION_MODES.includes(b.permissionMode) && b.permissionMode !== 'default' ? { permissionMode: b.permissionMode } : {}),
+    ...(typeof b.workingDir === 'string' && b.workingDir.trim() ? { workingDir: b.workingDir.trim() } : {}),
+    ...extra,
+  };
+}
+
 export function applyConfigPatch(cfg, patch = {}) {
   if (patch.backend === 'bridge' || patch.backend === 'api') cfg.backend = patch.backend;
   if (Array.isArray(patch.destinations)) {
@@ -122,6 +134,8 @@ export function applyConfigPatch(cfg, patch = {}) {
   if (patch.bridge && typeof patch.bridge === 'object') {
     if (typeof patch.bridge.url === 'string') cfg.bridge.url = patch.bridge.url;
     if (typeof patch.bridge.agent === 'string') cfg.bridge.agent = patch.bridge.agent;
+    if (PERMISSION_MODES.includes(patch.bridge.permissionMode)) cfg.bridge.permissionMode = patch.bridge.permissionMode;
+    if (typeof patch.bridge.workingDir === 'string') cfg.bridge.workingDir = patch.bridge.workingDir.trim().slice(0, 1024);
   }
   // api backend: where redacted traffic is forwarded (the client still picks the
   // model + sends its own key).

package/src/server.js

@@ -47,7 +47,7 @@ import { rawOrtAvailable } from './ort.js';
 import * as ttsVoices from './tts-voices.js';
 import { resolveTtsVoice } from './tts-voice-resolve.js';
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
-import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath } from './configstore.js';
+import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath, bridgeAgentOptions } from './configstore.js';
 import { resolveDestination, aggregateModelsAsync, listDestinations } from './router.js';
 import { makeAccessEvent } from './observability.js';
 import { createPersistentAccessLog } from './access-log-store.js';
@@ -56,7 +56,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.73';
+export const VERSION = '0.6.75';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -401,7 +401,7 @@ async function startRelay(req, res, { kind, adapter, agent }, body, vault, cfg,
   // redaction in the main handler), so toTurn() carried it here — nothing to add.
   let resp;
   try {
-    resp = await openBridgeChat({ bridgeUrl, agent, token, messages, system, specs: toolsToSpecs(tools), options: {}, signal: undefined });
+    resp = await openBridgeChat({ bridgeUrl, agent, token, messages, system, specs: toolsToSpecs(tools), options: bridgeAgentOptions(cfg), signal: undefined });
   } catch (e) { clearTimeout(ttl); endRelaySession(s.id); trace?.commit(); return sendJson(res, 502, { error: { message: `bridge: ${e.message}`, type: 'bridge_error' } }); }
   s.reader = resp.body.getReader();
   res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' });
@@ -453,14 +453,23 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
   const shaper = shaperFor(kind, body?.model || agent);
   const token = readBridgeToken(cfg.bridge.token);
   const ac = new AbortController();
-  req.on('close', () => ac.abort());
+  // STOP MUST REACH THE AGENT. The client pressing Stop aborts ITS request; the bridge only
+  // kills the CLI when the gateway's request to it goes away, and that happened only if the
+  // gateway noticed. It listened on `req 'close'`, which on this Node fires when the REQUEST
+  // is complete — the body was read long ago — not when the socket is cut mid-response. So
+  // Stop in the desktop stopped nothing: Codex wrote its whole essay to nobody (measured:
+  // the process outlived the abort by the length of the answer). The RESPONSE closing is
+  // the signal for a severed connection; a response that finished normally is not a stop.
+  res.on('close', () => { if (!res.writableFinished) ac.abort(); });
 
   // The model half of `claude/opus`, handed to the CLI as its `--model`. Absent for a bare
   // agent id, which leaves the agent on its own default exactly as before.
   const { agentModel } = parseAgentModel(body?.model, cfg);
   const turn = {
     bridgeUrl: await resolveBridgeUrl(cfg), agent, token, messages, system, signal: ac.signal,
-    ...(agentModel ? { options: { model: agentModel } } : {}),
+    // Permissions and working directory from the gateway's config (the desktop's Settings →
+    // Engine → Agents), plus the model half of `claude/opus` when the caller named one.
+    options: bridgeAgentOptions(cfg, agentModel ? { model: agentModel } : {}),
   };
 
   if (!wantStream) {
@@ -1764,7 +1773,7 @@ export function createGateway(cfg = loadConfig()) {
         if (!redactionOff) await ensureNer(cfg);
         const segs = redactionOff ? [] : r.adapter.collectSegments(body, cfg.redaction);
         const ac = new AbortController();
-        req.on('close', () => ac.abort());
+        res.on('close', () => { if (!res.writableFinished) ac.abort(); });
         const rd0 = trace ? trace.clock() : 0;
         // Redact at the configured tier for everyone (free users get name/org
         // redaction within their allowance); the custom dictionary stays capped for