@chatpanel/gateway 0.6.74 → 0.6.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.74",
+  "version": "0.6.76",
   "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.7.1",
+    "@chatpanel/pii": "^0.7.2",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c",
     "phonemizer": "^1.2.1"

package/src/config.js

@@ -57,6 +57,14 @@ export const DEFAULTS = {
     // Bearer token for the bridge's privileged /chat route. Empty = read the
     // per-install token from ~/.chatpanel/bridge-token.
     token: '',
+    // What a CLI agent driven THROUGH the gateway may do — the same three modes the
+    // extension offers per agent: 'default' (read-only, asks before writing),
+    // 'acceptEdits' (edits files in its workspace on its own), 'bypassPermissions' (full
+    // access and shell). Absent, the bridge ran every gateway turn read-only and told the
+    // model to "set Permissions" in a settings page the desktop did not have.
+    permissionMode: 'default',
+    // Where the agent works. Empty = the bridge's ChatPanel workspace.
+    workingDir: '',
   },
 
   upstreams: {

package/src/configstore.js

@@ -46,7 +46,7 @@ export function publicConfig(cfg, { proUnlocked = false } = {}) {
     backend: cfg.backend,
     // Strip per-destination apiKey (write-only).
     destinations: (Array.isArray(cfg.destinations) ? cfg.destinations : []).map((d) => { const { apiKey, ...rest } = d; return { ...rest, hasKey: !!apiKey }; }),
-    bridge: { url: cfg.bridge?.url, agent: cfg.bridge?.agent, hasToken: !!cfg.bridge?.token },
+    bridge: { url: cfg.bridge?.url, agent: cfg.bridge?.agent, hasToken: !!cfg.bridge?.token, permissionMode: cfg.bridge?.permissionMode || 'default', workingDir: cfg.bridge?.workingDir || '' },
     upstreams: cfg.upstreams,
     redaction: {
       tier: cfg.redaction?.tier,
@@ -98,6 +98,18 @@ export function isSelfDestination(d, cfg = {}) {
   return loop && port === (Number(cfg.port) || 4320);
 }
 
+export const PERMISSION_MODES = ['default', 'acceptEdits', 'bypassPermissions'];
+
+/** The per-turn options a gateway-driven agent receives — the bridge's own vocabulary. */
+export function bridgeAgentOptions(cfg, extra = {}) {
+  const b = cfg?.bridge || {};
+  return {
+    ...(PERMISSION_MODES.includes(b.permissionMode) && b.permissionMode !== 'default' ? { permissionMode: b.permissionMode } : {}),
+    ...(typeof b.workingDir === 'string' && b.workingDir.trim() ? { workingDir: b.workingDir.trim() } : {}),
+    ...extra,
+  };
+}
+
 export function applyConfigPatch(cfg, patch = {}) {
   if (patch.backend === 'bridge' || patch.backend === 'api') cfg.backend = patch.backend;
   if (Array.isArray(patch.destinations)) {
@@ -122,6 +134,8 @@ export function applyConfigPatch(cfg, patch = {}) {
   if (patch.bridge && typeof patch.bridge === 'object') {
     if (typeof patch.bridge.url === 'string') cfg.bridge.url = patch.bridge.url;
     if (typeof patch.bridge.agent === 'string') cfg.bridge.agent = patch.bridge.agent;
+    if (PERMISSION_MODES.includes(patch.bridge.permissionMode)) cfg.bridge.permissionMode = patch.bridge.permissionMode;
+    if (typeof patch.bridge.workingDir === 'string') cfg.bridge.workingDir = patch.bridge.workingDir.trim().slice(0, 1024);
   }
   // api backend: where redacted traffic is forwarded (the client still picks the
   // model + sends its own key).

package/src/server.js

@@ -47,7 +47,7 @@ import { rawOrtAvailable } from './ort.js';
 import * as ttsVoices from './tts-voices.js';
 import { resolveTtsVoice } from './tts-voice-resolve.js';
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
-import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath } from './configstore.js';
+import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath, bridgeAgentOptions } from './configstore.js';
 import { resolveDestination, aggregateModelsAsync, listDestinations } from './router.js';
 import { makeAccessEvent } from './observability.js';
 import { createPersistentAccessLog } from './access-log-store.js';
@@ -56,7 +56,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.74';
+export const VERSION = '0.6.76';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -401,7 +401,7 @@ async function startRelay(req, res, { kind, adapter, agent }, body, vault, cfg,
   // redaction in the main handler), so toTurn() carried it here — nothing to add.
   let resp;
   try {
-    resp = await openBridgeChat({ bridgeUrl, agent, token, messages, system, specs: toolsToSpecs(tools), options: {}, signal: undefined });
+    resp = await openBridgeChat({ bridgeUrl, agent, token, messages, system, specs: toolsToSpecs(tools), options: bridgeAgentOptions(cfg), signal: undefined });
   } catch (e) { clearTimeout(ttl); endRelaySession(s.id); trace?.commit(); return sendJson(res, 502, { error: { message: `bridge: ${e.message}`, type: 'bridge_error' } }); }
   s.reader = resp.body.getReader();
   res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' });
@@ -453,14 +453,23 @@ async function handleBridge(req, res, { kind, adapter, redactable, pathname, age
   const shaper = shaperFor(kind, body?.model || agent);
   const token = readBridgeToken(cfg.bridge.token);
   const ac = new AbortController();
-  req.on('close', () => ac.abort());
+  // STOP MUST REACH THE AGENT. The client pressing Stop aborts ITS request; the bridge only
+  // kills the CLI when the gateway's request to it goes away, and that happened only if the
+  // gateway noticed. It listened on `req 'close'`, which on this Node fires when the REQUEST
+  // is complete — the body was read long ago — not when the socket is cut mid-response. So
+  // Stop in the desktop stopped nothing: Codex wrote its whole essay to nobody (measured:
+  // the process outlived the abort by the length of the answer). The RESPONSE closing is
+  // the signal for a severed connection; a response that finished normally is not a stop.
+  res.on('close', () => { if (!res.writableFinished) ac.abort(); });
 
   // The model half of `claude/opus`, handed to the CLI as its `--model`. Absent for a bare
   // agent id, which leaves the agent on its own default exactly as before.
   const { agentModel } = parseAgentModel(body?.model, cfg);
   const turn = {
     bridgeUrl: await resolveBridgeUrl(cfg), agent, token, messages, system, signal: ac.signal,
-    ...(agentModel ? { options: { model: agentModel } } : {}),
+    // Permissions and working directory from the gateway's config (the desktop's Settings →
+    // Engine → Agents), plus the model half of `claude/opus` when the caller named one.
+    options: bridgeAgentOptions(cfg, agentModel ? { model: agentModel } : {}),
   };
 
   if (!wantStream) {
@@ -1764,7 +1773,7 @@ export function createGateway(cfg = loadConfig()) {
         if (!redactionOff) await ensureNer(cfg);
         const segs = redactionOff ? [] : r.adapter.collectSegments(body, cfg.redaction);
         const ac = new AbortController();
-        req.on('close', () => ac.abort());
+        res.on('close', () => { if (!res.writableFinished) ac.abort(); });
         const rd0 = trace ? trace.clock() : 0;
         // Redact at the configured tier for everyone (free users get name/org
         // redaction within their allowance); the custom dictionary stays capped for
@@ -1799,7 +1808,16 @@ export function createGateway(cfg = loadConfig()) {
         // AFTER redaction so the note isn't itself redacted. Covers BOTH the API
         // forward and the relay (which reads system from this same body).
         if (!redactionOff && Array.isArray(body.tools) && body.tools.length && typeof r.adapter.injectSystemNote === 'function') {
-          r.adapter.injectSystemNote(body, placeholderToolNote({ toolData: cfg.tools?.toolData }));
+          // A relayed CLI agent brings tools of its own that run PAST this proxy and get the
+          // placeholder literally; an API model has only the tools in this request. The note
+          // has to say which is which, so the destination is looked up here — the same
+          // resolution as below, on the same hint, just earlier. No destination means the
+          // legacy bridge path, which is an agent.
+          const early = resolveDestination(body?.model, cfg, r.kind, {
+            destination: String(req.headers['x-chatpanel-destination'] || body?.chatpanel?.destination || '').trim(),
+          });
+          const ownTools = !(early && early.type === 'api');
+          r.adapter.injectSystemNote(body, placeholderToolNote({ toolData: cfg.tools?.toolData, ownTools }));
         }
         outBody = Buffer.from(JSON.stringify(body), 'utf8');
       }