@chatpanel/gateway 0.6.91 → 0.6.92

package/README.md

@@ -37,14 +37,19 @@ The redaction engine is the **same code** the ChatPanel extension runs — the
 [`@chatpanel/pii`](https://github.com/chatpanel/chatpanel-pii) package is the
 single source of truth, so a privacy feature added once is shared everywhere.
 
-## Quick start (bridge backend)
+## Quick start — the one thing to install
 
-You need the [ChatPanel bridge](https://github.com/chatpanel/chatpanel-bridge)
-running and logged into codex/claude (the same bridge the extension uses).
+The gateway **carries the [bridge](https://github.com/chatpanel/chatpanel-bridge)**
+(0.6.92+): `@chatpanel/bridge` is a dependency, bundled into the same binary, and the
+gateway starts it as a child process when nothing already answers on 4319 — or adopts a
+bridge that is already running (the desktop app's, or a standalone you installed; a newer
+standalone is preferred so bridge fixes keep their own cadence). Two processes on purpose:
+the bridge spawns your CLIs and holds SCM tokens; the model runtimes live here. Log into
+the CLIs (`claude`, `codex`, …) as you normally would — that is all.
 
 ```bash
 # Standalone binary — no Node.js required:
-curl -fsSL https://dl.chatpanel.net/gateway/install.sh | bash   # macOS / Linux
+curl -fsSL https://dl.chatpanel.net/install.sh | bash   # macOS / Linux
 #   Windows (PowerShell):  irm https://dl.chatpanel.net/gateway/install.ps1 | iex
 
 # Or via npm (needs Node):
@@ -52,8 +57,15 @@ npm install -g @chatpanel/gateway
 chatpanel-gateway
 # → ChatPanel Privacy Gateway on http://127.0.0.1:4320
 #     backend  : bridge (agent: codex, via http://127.0.0.1:4319)
+#     bridge   : starting the embedded bridge (v0.11.20)
 ```
 
+`GET /health` says which bridge it runs: `bridge.mode` is `embedded`, `standalone`,
+`adopted` or `off`. `CHATPANEL_BRIDGE_MANAGED=off` (or `bridge.managed: false`) turns the
+supervision off for a host that runs its own bridge — the desktop app does. A
+`bridge.url` that is not on this machine is left alone: nothing is started for a remote
+bridge.
+
 > **Binary vs. npm — same features, very different local-AI speed.** Both run
 > identical redaction/routing. But the standalone binary runs the local models
 > (speech-to-text, diarization, NER) on the **WASM** runtime — **fp32-only,

package/bin/chatpanel-gateway.js

@@ -12,6 +12,7 @@
 //   chatpanel-gateway --uninstall  remove login auto-start
 //   chatpanel-gateway --status     is auto-start registered?
 //   chatpanel-gateway --version    print version
+//   chatpanel-gateway --bridge     run the embedded bridge (the supervisor's child; not for hands)
 //
 // Config comes from gateway.config.json / env (see src/config.js).
 export {}; // mark as an ES module (all imports below are dynamic)
@@ -19,7 +20,16 @@ export {}; // mark as an ES module (all imports below are dynamic)
 const arg = process.argv[2];
 
 try {
-  if (arg === 'mcp') {
+  if (arg === '--bridge') {
+    // THE EMBEDDED BRIDGE. The gateway carries @chatpanel/bridge and starts it as a child of
+    // itself (src/bridge-supervisor.js) when nothing answers on 4319 — one install, two
+    // processes. The flag is consumed here; what remains of argv is the bridge's own
+    // (`--version` for the supervisor's check). CHATPANEL_BRIDGE_EMBEDDED tells the bridge its
+    // execPath is the gateway, so it never self-updates over it.
+    process.env.CHATPANEL_BRIDGE_EMBEDDED = '1';
+    process.argv.splice(2, 1);
+    await import('@chatpanel/bridge/src/server.js');
+  } else if (arg === 'mcp') {
     // Its own path: proxies to the running gateway over HTTP and must NOT import
     // server.js (which would open a second handle on the warm SQLite store).
     const { runMcpServer } = await import('../src/mcp.js');
@@ -60,7 +70,7 @@ try {
         start();
         break;
       default:
-        console.error(`unknown option: ${arg}\nUsage: chatpanel-gateway [mcp|tools list|tools schema <tool>|call <tool> '<json>'|local|connect|--install|--uninstall|--status|--version]`);
+        console.error(`unknown option: ${arg}\nUsage: chatpanel-gateway [mcp|tools list|tools schema <tool>|call <tool> '<json>'|local|connect|--install|--uninstall|--status|--version|--bridge]`);
         process.exit(2);
     }
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.91",
-  "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
+  "version": "0.6.92",
+  "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
     "chatpanel-gateway": "bin/chatpanel-gateway.js"
@@ -27,6 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
+    "@chatpanel/bridge": "^0.11.20",
     "@chatpanel/pii": "^0.7.4",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c",

package/src/bridge-supervisor.js

@@ -0,0 +1,176 @@
+// The gateway carries the bridge — one install, two processes.
+//
+// A user installs ONE thing (this gateway: the binary, or `npm i -g @chatpanel/gateway`) and
+// gets the bridge with it: `@chatpanel/bridge` is a dependency, bundled into the same binary,
+// and the gateway STARTS it as a child process when nothing already answers on the bridge
+// port. Two processes on purpose: the bridge spawns CLIs, holds SCM tokens and runs shells —
+// a small zero-dependency process with its own failure domain — and the NER / STT / TTS
+// runtimes that crash or eat memory live here, not there. A gateway restart never takes a
+// running Claude Code task down with it.
+//
+// What is already there is ADOPTED, never fought: a bridge the desktop app installed, a
+// standalone the user put in ~/.local/bin (preferred when it is NEWER than the embedded copy,
+// so a bridge fix keeps shipping on its own tag), a remote bridge named in config. The plan
+// is a pure function (`planBridge`) so the rule is testable without spawning anything.
+//
+// An embedded child is started with CHATPANEL_BRIDGE_EMBEDDED=1: its `process.execPath` is
+// the GATEWAY binary, so the bridge's self-update is disabled there (it would overwrite the
+// gateway with a bridge) and its /health says `update.embedded: 'gateway'`. Both children get
+// CHATPANEL_MANAGED_BY=gateway so a client can say who runs it instead of offering install.sh.
+
+import os from 'node:os';
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+import { spawn, spawnSync } from 'node:child_process';
+import { resolveLaunch } from './service.js';
+import { DEFAULT_BRIDGE_URL } from './bridge.js';
+
+const LOOPBACK = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:(\d+))?\/?$/i;
+const BACKOFF_MS = [1000, 2000, 5000, 10000, 30000];
+const STABLE_MS = 60_000; // a child up this long resets the back-off
+const PROBE_TIMEOUT_MS = 1200;
+
+/** Where the standalone bridge installer puts its binary (scripts/install.sh / install.ps1 in the bridge repo). */
+export function standaloneCandidates({ home = os.homedir(), platform = process.platform, env = process.env } = {}) {
+  if (platform === 'win32') return [path.join(env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'), 'ChatPanel', 'chatpanel-bridge.exe')];
+  return [path.join(home, '.local', 'bin', 'chatpanel-bridge')];
+}
+
+/** semver-ish: 1 when a > b, -1 when a < b, 0 when equal or unreadable. */
+export function compareVersions(a, b) {
+  const pa = String(a || '').split('.').map((x) => parseInt(x, 10)); const pb = String(b || '').split('.').map((x) => parseInt(x, 10));
+  if (pa.some(Number.isNaN) || pb.some(Number.isNaN) || pa.length < 3 || pb.length < 3) return 0;
+  for (let i = 0; i < 3; i += 1) { if (pa[i] !== pb[i]) return pa[i] > pb[i] ? 1 : -1; }
+  return 0;
+}
+
+/**
+ * What to do about the bridge — pure.
+ *   managed: false / 'off'      → off   (the host runs its own, e.g. the desktop app)
+ *   a non-loopback bridge.url   → off   (a remote bridge is the user's; never start one here)
+ *   something answers the port  → adopt
+ *   a standalone newer than the embedded copy → spawn-standalone
+ *   an embedded copy            → spawn-embedded
+ *   only a standalone           → spawn-standalone
+ */
+export function planBridge({ managed = true, cfgUrl = '', healthy = null, standalone = null, embeddedVersion = null } = {}) {
+  if (managed === false || managed === 'off') return { action: 'off', why: 'bridge supervision is off (the host runs its own)' };
+  const url = String(cfgUrl || DEFAULT_BRIDGE_URL);
+  if (!LOOPBACK.test(url)) return { action: 'off', why: `bridge.url ${url} is not on this machine; nothing to start here` };
+  if (healthy) return { action: 'adopt', why: `a bridge already answers at ${url}${healthy.version ? ` (v${healthy.version}${healthy.managedBy ? `, run by ${healthy.managedBy}` : ''})` : ''}` };
+  const sv = standalone?.version || null;
+  if (standalone?.path && embeddedVersion && compareVersions(sv, embeddedVersion) > 0) return { action: 'spawn-standalone', why: `the installed bridge (v${sv}) is newer than the embedded one (v${embeddedVersion})`, path: standalone.path };
+  if (embeddedVersion) return { action: 'spawn-embedded', why: `starting the embedded bridge (v${embeddedVersion})${standalone?.path ? ` — the installed one is v${sv || '?'}` : ''}` };
+  if (standalone?.path) return { action: 'spawn-standalone', why: `starting the installed bridge${sv ? ` (v${sv})` : ''}`, path: standalone.path };
+  return { action: 'off', why: 'no bridge to start (no embedded copy, no standalone install)' };
+}
+
+/** `GET /health` on the bridge, or null. */
+export async function probeBridge(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl = fetch } = {}) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(`${String(url).replace(/\/$/, '')}/health`, { signal: ctrl.signal });
+    if (!res.ok) return null;
+    const j = await res.json().catch(() => null);
+    return j && j.ok !== false ? { version: j.version || null, managedBy: j.managedBy || null } : null;
+  } catch { return null; } finally { clearTimeout(t); }
+}
+
+/** `<program> [...args] --version`, or null — one process, bounded. */
+export function versionOf(program, args = [], { timeoutMs = 8000 } = {}) {
+  try {
+    const r = spawnSync(program, [...args, '--version'], { encoding: 'utf8', timeout: timeoutMs, env: { ...process.env, CHATPANEL_BRIDGE_EMBEDDED: '1' } });
+    const v = String(r.stdout || '').trim().split('\n').pop();
+    return /^\d+\.\d+\.\d+/.test(v) ? v : null;
+  } catch { return null; }
+}
+
+/** How THIS gateway starts its embedded bridge: itself, with `--bridge` (bin/chatpanel-gateway.js). */
+export function embeddedLaunch() {
+  const { program, args } = resolveLaunch();
+  return { program, args: [...args, '--bridge'] };
+}
+
+const portOf = (url) => { const m = LOOPBACK.exec(String(url || DEFAULT_BRIDGE_URL)); return m?.[3] || '4319'; };
+
+/**
+ * Make sure a bridge is running for this gateway, and keep it running. Returns a controller:
+ * `status()` → `{ mode: 'adopted'|'embedded'|'standalone'|'off', version, pid, restarts, why }`,
+ * `stop()` ends a child we started. Everything that touches the machine is injectable so the
+ * rule can be tested without a process: `probe`, `spawnImpl`, `version`, `candidates`, `exists`.
+ */
+export async function ensureBridge(cfg, {
+  log = (line) => console.log(line),
+  probe = probeBridge,
+  spawnImpl = spawn,
+  version = versionOf,
+  candidates = standaloneCandidates(),
+  exists = existsSync,
+  launch = embeddedLaunch,
+  managed = process.env.CHATPANEL_BRIDGE_MANAGED === 'off' ? false : cfg?.bridge?.managed,
+  waitForSiblingMs = 2500,
+  now = Date.now,
+  setTimer = setTimeout,
+} = {}) {
+  const url = String(cfg?.bridge?.url || DEFAULT_BRIDGE_URL).replace(/\/$/, '');
+  const state = { mode: 'off', version: null, pid: null, restarts: 0, why: '', child: null, stopping: false, backoff: 0 };
+  const settle = (mode, why, extra = {}) => { Object.assign(state, { mode, why }, extra); log(`  bridge   : ${why}`); };
+
+  // Someone else (the desktop's supervisor, launchd) may be starting a bridge this very
+  // second; wait a moment before deciding it is absent, or two bridges race for one port.
+  let healthy = await probe(url);
+  if (!healthy && managed !== false && managed !== 'off' && LOOPBACK.test(url) && waitForSiblingMs > 0) {
+    const until = now() + waitForSiblingMs;
+    while (!healthy && now() < until) { await new Promise((r) => setTimer(r, 500)); healthy = await probe(url); }
+  }
+  const emb = launch();
+  const embeddedVersion = managed === false || managed === 'off' || healthy ? null : version(emb.program, emb.args);
+  const standalonePath = candidates.find((p) => exists(p)) || null;
+  const standalone = standalonePath && !healthy ? { path: standalonePath, version: version(standalonePath, []) } : null;
+  const plan = planBridge({ managed, cfgUrl: url, healthy, standalone, embeddedVersion });
+
+  if (plan.action === 'off') { settle('off', plan.why); return controller(); }
+  if (plan.action === 'adopt') { settle('adopted', plan.why, { version: healthy.version }); return controller(); }
+
+  const spec = plan.action === 'spawn-embedded'
+    ? { ...emb, env: { CHATPANEL_BRIDGE_EMBEDDED: '1' }, mode: 'embedded', version: embeddedVersion }
+    : { program: plan.path, args: [], env: {}, mode: 'standalone', version: standalone?.version || null };
+  let startedAt = 0;
+
+  const start = () => {
+    if (state.stopping) return;
+    const child = spawnImpl(spec.program, spec.args, {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, ...spec.env, CHATPANEL_MANAGED_BY: 'gateway', CHATPANEL_BRIDGE_PORT: portOf(url) },
+    });
+    startedAt = now();
+    state.child = child; state.pid = child.pid || null;
+    const relay = (stream, tag) => stream?.on('data', (buf) => { for (const line of String(buf).split('\n')) if (line.trim()) log(`[bridge] ${line}`); });
+    relay(child.stdout, 'out'); relay(child.stderr, 'err');
+    child.on('error', (e) => log(`[bridge] could not start ${spec.program}: ${e?.message || e}`));
+    child.on('exit', async (code, sig) => {
+      state.child = null; state.pid = null;
+      if (state.stopping) return;
+      // The port may have been taken by a bridge someone else started while ours came up —
+      // that is not a failure to restart from, it is a bridge to adopt.
+      const other = await probe(url);
+      if (other) { settle('adopted', `a bridge already answers at ${url} (v${other.version || '?'}) — ours stepped aside`, { version: other.version }); return; }
+      if (now() - startedAt > STABLE_MS) state.backoff = 0;
+      const delay = BACKOFF_MS[Math.min(state.backoff, BACKOFF_MS.length - 1)];
+      state.backoff += 1; state.restarts += 1;
+      log(`[bridge] exited (${sig || code}); restarting in ${delay / 1000}s`);
+      setTimer(start, delay);
+    });
+  };
+  settle(spec.mode, plan.why, { version: spec.version });
+  start();
+  return controller();
+
+  function controller() {
+    return {
+      status: () => ({ mode: state.mode, version: state.version, pid: state.pid, restarts: state.restarts, why: state.why }),
+      stop: () => { state.stopping = true; if (state.child && !state.child.killed) { try { state.child.kill('SIGTERM'); } catch { /* gone */ } } },
+    };
+  }
+}

package/src/local-status.js

@@ -101,5 +101,5 @@ export async function bridgePresenceNote(brOverride) {
     const n = (br.data.skills?.count ?? null);
     return `bridge detected at ${url} (v${br.data.version}${n != null ? `, ${n} skills` : ''}) — its agents and skills are available through this gateway.`;
   }
-  return `bridge not detected at ${url} — local agents/skills are unavailable until it runs (curl -fsSL https://dl.chatpanel.net/bridge/install.sh | bash). The gateway runs fine without it.`;
+  return `bridge not detected at ${url} — a running gateway (0.6.92+) starts its embedded bridge itself; if this one did not, check ~/.chatpanel/gateway.log. The gateway runs fine without it, minus local agents/skills.`;
 }

package/src/server.js

@@ -39,6 +39,7 @@ import { createScorecardStore } from './scorecard-store.js';
 import { createEngineLedgerStore } from './engine-ledger-store.js';
 import { createProjectStore } from './project-store.js';
 import { applicationsFor, recruitPass } from './recruiting.js';
+import { ensureBridge } from './bridge-supervisor.js';
 import { createHistoryStore } from './sqlite-store.js';
 import { ingestBackups } from './backup-ingest.js';
 import * as nerEngine from './ner-engine.js';
@@ -62,7 +63,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.91';
+export const VERSION = '0.6.92';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -745,6 +746,10 @@ export function createGateway(cfg = loadConfig()) {
         // on the login service it registers, so a client can say "provided by the desktop app"
         // and stop offering install.sh for a gateway that is already installed. Absent otherwise.
         ...(process.env.CHATPANEL_MANAGED_BY ? { managedBy: String(process.env.CHATPANEL_MANAGED_BY).slice(0, 32) } : {}),
+        // THE BRIDGE THIS GATEWAY RUNS OR ADOPTED — additive. `mode` is adopted | embedded |
+        // standalone | off; a client can say "bridge: provided by the gateway" and stop
+        // offering a second installer.
+        ...(bridgeSupervisor ? { bridge: bridgeSupervisor.status() } : {}),
         // `runtime` = 'native' (npm, fast quantized) | 'wasm' (binary, slow fp32) —
         // the extension uses it to advise the far-faster native gateway.
         stt: { enabled: cfg.stt?.enabled !== false, state: stt.state, ready: stt.ok, model: stt.model || cfg.stt?.model || DEFAULT_STT_MODEL, runtime: stt.runtime, dtype: stt.dtype },
@@ -2208,6 +2213,8 @@ function readRunHint(header, legacy) {
   return Object.keys(out).length ? out : null;
 }
 
+let bridgeSupervisor = null; // the running gateway's bridge controller (bridge-supervisor.js), for /health and shutdown
+
 export function start(cfg = loadConfig()) {
   installTimestampedConsole(); // every gateway log line gets a clock — before anything logs
   ensureGatewayToken(); // M2: load/create the admin-route token (best-effort)
@@ -2234,13 +2241,11 @@ export function start(cfg = loadConfig()) {
   server.listen(cfg.port, cfg.host, () => {
     console.log(`ChatPanel Privacy Gateway v${VERSION} on http://${cfg.host}:${cfg.port}`);
     console.log(`  backend  : ${cfg.backend}` + (cfg.backend === 'bridge' ? ` (agent: ${cfg.bridge.agent}, via ${cfg.bridge.url})` : ''));
-    // U3: report the bridge at startup so the operator sees the unified picture without
-    // running anything. Detect only — never force-spawn a managed service. Best-effort and
-    // non-fatal: a probe failure just logs "not detected".
-    import('./local-status.js')
-      .then((m) => m.bridgePresenceNote())
-      .then((note) => console.log(`  bridge   : ${note}`))
-      .catch(() => {});
+    // THE GATEWAY CARRIES THE BRIDGE (bridge-supervisor.js): adopt one that already answers
+    // (the desktop's, a standalone, launchd's), else start the embedded copy as a child and
+    // keep it up. One install for the user; two processes on purpose. Best-effort and
+    // non-fatal: the gateway runs without a bridge, it just has no local agents.
+    ensureBridge(cfg).then((c) => { bridgeSupervisor = c; }).catch((e) => console.log(`  bridge   : not supervised (${e?.message || e})`));
     console.log(`  redaction: ${cfg.redaction.tier}` + (cfg.redaction.detection?.backend && cfg.redaction.detection.backend !== 'off'
       ? ` + ${cfg.redaction.detection.backend} detector` : (cfg.ner?.autostart ? ' (+ NER starting…)' : '')));
     // M7: a non-loopback bind exposes the gateway on the LAN, where the per-request
@@ -2258,7 +2263,7 @@ export function start(cfg = loadConfig()) {
       .then((r) => { if (r?.ok) console.log(`  warm     : seeded ${r.ingested} records from ${r.file}`); })
       .catch(() => {});
   }
-  const shutdown = () => { ner?.stop(); entitlement.stop(); server.close(() => process.exit(0)); };
+  const shutdown = () => { ner?.stop(); entitlement.stop(); bridgeSupervisor?.stop(); server.close(() => process.exit(0)); };
   process.on('SIGINT', shutdown);
   process.on('SIGTERM', shutdown);
   return server;